rpc - zygaena/hammerhead

root / base / usr / src / uts / common / rpc
rpc Plain Text 50071 lines 1.2 MB
#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License, Version 1.0 only
# (the "License").  You may not use this file except in compliance
# with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#

#
# Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
# Use is subject to license terms.
#
# Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
#

#
# uts/common/rpc/Makefile
#
# include global definitions
include ../../../Makefile.master

i386_HDRS=

# Hammerhead: sparc_HDRS removed - amd64 only build

COMMHDRS= \
auth.h		auth_des.h	auth_sys.h	auth_unix.h \
bootparam.h	clnt.h		clnt_soc.h	clnt_stat.h	des_crypt.h \
nettype.h	pmap_clnt.h	pmap_rmt.h \
rpc.h		rpc_com.h	rpc_msg.h \
rpcb_clnt.h	rpcent.h	svc.h		svc_auth.h	svc_soc.h \
types.h		xdr.h		rpcsec_gss.h	svc_mt.h \
rpcsys.h	rpc_rdma.h	rpc_tags.h

HDRS=			\
	$(COMMHDRS)	\
	$($(MACH)_HDRS)

RPC_SRC=	pmap_prot.x	rpcb_prot.x

RPCSVC_SRC=	key_prot.x	rpc_sztypes.x

# Hammerhead: These headers are pre-generated and checked into the repo.
# The illumos rpcgen + GNU cpp combination truncates output on .x files
# containing %#define directives. Pre-generated from OI native rpcgen.
# Do NOT regenerate — the generated versions will be incomplete.
DERIVED_FILES=	key_prot.h	pmap_prot.h	rpcb_prot.h	rpc_sztypes.h

RPCHDRS=	$(HDRS)	$(RPC_SRC) $(DERIVED_FILES)

RPCSVCHDRS=	$(RPCSVC_SRC)

RPCDIRS=	$(ROOT)/usr/include/rpc
RPCSVCDIRS=	$(ROOT)/usr/include/rpcsvc

ROOTHDRS= $(RPCHDRS:%=$(RPCDIRS)/%) $(RPCSVCHDRS:%=$(RPCSVCDIRS)/%)

$(RPCDIRS)/%: %
	$(INS.file)

$(RPCSVCDIRS)/%: %
	$(INS.file)

# XXX: should really check the style of the derived files as well...
#	$(RPC_SRC:%.x=%.check) \
#	$(RPCSVC_SRC:%.x=%.check)
#
CHECKHDRS= $(HDRS:%.h=%.check)

.KEEP_STATE:

.PARALLEL: $(CHECKHDRS)

all: all_h

install_h: all_h $(RPCDIRS) $(RPCSVCDIRS) $(ROOTHDRS)

# all_h permits derived headers to be built here in the uts source area
# for the kernel to reference, without going so far as to install them.
#
all_h: $(DERIVED_FILES)

clean:
	@# Hammerhead: do NOT delete pre-generated headers (DERIVED_FILES)

clobber: clean

$(RPCDIRS):
	$(INS.dir)

$(RPCSVCDIRS):
	$(INS.dir)

# Hammerhead: Pre-generated headers — do NOT regenerate with rpcgen.
# rpcgen + GNU cpp truncates %#define output. If you need to regenerate,
# use illumos native rpcgen on OI: rpcgen -C -h foo.x > foo.h

check:	$(CHECKHDRS)
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Copyright 2017 Joyent Inc
 * Use is subject to license terms.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

/*
 * auth.h, Authentication interface.
 *
 * The data structures are completely opaque to the client. The client
 * is required to pass a AUTH * to routines that create rpc
 * "sessions".
 */

#ifndef	_RPC_AUTH_H
#define	_RPC_AUTH_H

#include <rpc/xdr.h>
#include <rpc/clnt_stat.h>
#include <sys/cred.h>
#include <sys/tiuser.h>
#ifdef _KERNEL
#include <sys/zone.h>
#endif

#ifdef	__cplusplus
extern "C" {
#endif

#define	MAX_AUTH_BYTES	400	/* maximum length of an auth type, from RFC */
#define	MAXNETNAMELEN	255	/* maximum length of network user's name */

/*
 * NOTE: this value *must* be kept larger than the maximum size of all the
 * structs that rq_clntcred is cast to in the different authentication types.
 * If changes are made to any of these *_area structs, double-check they all
 * still fit. If any new authentication mechanisms are added, add a note here.
 *
 * Currently these structs can be found in:
 *  - __svcauth_sys (svc_auth_sys.c)
 *  - __svcauth_des (svcauth_des.c)
 *  - __svcauth_loopback (svc_auth_loopb.c)
 */
#define	RQCRED_SIZE	700	/* size allocated for rq_clntcred */

/*
 *  Client side authentication/security data
 */
typedef struct sec_data {
	uint_t	secmod;		/* security mode number e.g. in nfssec.conf */
	uint_t	rpcflavor;	/* rpc flavors:AUTH_UNIX,AUTH_DES,RPCSEC_GSS */
	int	flags;		/* AUTH_F_xxx flags */
	uid_t	uid;		/* uid of caller for all sec flavors (NFSv4)  */
	caddr_t	data;		/* opaque data per flavor */
} sec_data_t;

#ifdef _SYSCALL32_IMPL
struct sec_data32 {
	uint32_t	secmod;	/* security mode number e.g. in nfssec.conf */
	uint32_t	rpcflavor; /* AUTH_UNIX,AUTH_DES,RPCSEC_GSS */
	int32_t		flags;	/* AUTH_F_xxx flags */
	uid_t		uid;	/* uid of caller for all sec flavors (NFSv4) */
	caddr32_t	data;	/* opaque data per flavor */
};
#endif /* _SYSCALL32_IMPL */

/*
 * AUTH_DES flavor specific data from sec_data opaque data field.
 * AUTH_KERB has the same structure.
 */
typedef struct des_clnt_data {
	struct netbuf	syncaddr;	/* time sync addr */
	struct knetconfig *knconf;	/* knetconfig info that associated */
					/* with the syncaddr. */
	char		*netname;	/* server's netname */
	int		netnamelen;	/* server's netname len */
} dh_k4_clntdata_t;

#ifdef _SYSCALL32_IMPL
struct des_clnt_data32 {
	struct netbuf32 syncaddr;	/* time sync addr */
	caddr32_t knconf;		/* knetconfig info that associated */
					/* with the syncaddr. */
	caddr32_t netname;		/* server's netname */
	int32_t	netnamelen;		/* server's netname len */
};
#endif /* _SYSCALL32_IMPL */

/*
 * flavor specific data to hold the data for AUTH_DES/AUTH_KERB(v4)
 * in sec_data->data opaque field.
 */
typedef struct krb4_svc_data {
	int		window;		/* window option value */
} krb4_svcdata_t;

typedef struct krb4_svc_data	des_svcdata_t;

/*
 * authentication/security specific flags
 */
#define	AUTH_F_RPCTIMESYNC	0x001	/* use RPC to do time sync */
#define	AUTH_F_TRYNONE		0x002	/* allow fall back to AUTH_NONE */


/*
 * Status returned from authentication check
 */
enum auth_stat {
	AUTH_OK = 0,
	/*
	 * failed at remote end
	 */
	AUTH_BADCRED = 1,		/* bogus credentials (seal broken) */
	AUTH_REJECTEDCRED = 2,		/* client should begin new session */
	AUTH_BADVERF = 3,		/* bogus verifier (seal broken) */
	AUTH_REJECTEDVERF = 4,		/* verifier expired or was replayed */
	AUTH_TOOWEAK = 5,		/* rejected due to security reasons */
	/*
	 * failed locally
	 */
	AUTH_INVALIDRESP = 6,		/* bogus response verifier */
	AUTH_FAILED = 7,			/* some unknown reason */
	/*
	 * kerberos errors
	 */
	AUTH_KERB_GENERIC = 8,		/* kerberos generic error */
	AUTH_TIMEEXPIRE = 9,		/* time of credential expired */
	AUTH_TKT_FILE = 10,		/* something wrong with ticket file */
	AUTH_DECODE = 11,		/* can't decode authenticator */
	AUTH_NET_ADDR = 12,		/* wrong net address in ticket */
	/*
	 * GSS related errors
	 */
	RPCSEC_GSS_NOCRED = 13,		/* no credentials for user */
	RPCSEC_GSS_FAILED = 14		/* GSS failure, credentials deleted */
};
typedef enum auth_stat AUTH_STAT;

union des_block {
	struct	{
		uint32_t high;
		uint32_t low;
	} key;
	char c[8];
};
typedef union des_block des_block;

#ifdef __STDC__
extern bool_t xdr_des_block(XDR *, des_block *);
#else
extern bool_t xdr_des_block();
#endif


/*
 * Authentication info. Opaque to client.
 */
struct opaque_auth {
	enum_t	oa_flavor;		/* flavor of auth */
	caddr_t	oa_base;		/* address of more auth stuff */
	uint_t	oa_length;		/* not to exceed MAX_AUTH_BYTES */
};


/*
 * Auth handle, interface to client side authenticators.
 */
typedef struct __auth {
	struct	opaque_auth	ah_cred;
	struct	opaque_auth	ah_verf;
	union	des_block	ah_key;
	struct auth_ops {
#ifdef __STDC__
		void	(*ah_nextverf)(struct __auth *);
#ifdef _KERNEL
		int	(*ah_marshal)(struct __auth *, XDR *, struct cred *);
#else
		int	(*ah_marshal)(struct __auth *, XDR *);
#endif
		/* nextverf & serialize */
		int	(*ah_validate)(struct __auth *,
		    struct opaque_auth *);
		/* validate varifier */
#ifdef _KERNEL
		int	(*ah_refresh)(struct __auth *, struct rpc_msg *,
		    cred_t *);
#else
		int	(*ah_refresh)(struct __auth *, void *);
		/* refresh credentials */
#endif
		void	(*ah_destroy)(struct __auth *);
		/* destroy this structure */

#ifdef _KERNEL
		int	(*ah_wrap)(struct __auth *, caddr_t, uint_t,
		    XDR *, xdrproc_t, caddr_t);
		int	(*ah_unwrap)(struct __auth *, XDR *, xdrproc_t,
		    caddr_t);
#endif
#else
		void	(*ah_nextverf)();
		int	(*ah_marshal)();	/* nextverf & serialize */
		int	(*ah_validate)();	/* validate verifier */
		int	(*ah_refresh)();	/* refresh credentials */
		void	(*ah_destroy)();	/* destroy this structure */
#ifdef _KERNEL
		int	(*ah_wrap)();		/* encode XDR data */
		int	(*ah_unwrap)();		/* decode XDR data */
#endif

#endif
	} *ah_ops;
	caddr_t ah_private;
} AUTH;


/*
 * Authentication ops.
 * The ops and the auth handle provide the interface to the authenticators.
 *
 * AUTH	*auth;
 * XDR	*xdrs;
 * struct opaque_auth verf;
 */
#define	AUTH_NEXTVERF(auth)		\
		((*((auth)->ah_ops->ah_nextverf))(auth))
#define	auth_nextverf(auth)		\
		((*((auth)->ah_ops->ah_nextverf))(auth))


#ifdef _KERNEL
#define	AUTH_MARSHALL(auth, xdrs, cred)	\
		((*((auth)->ah_ops->ah_marshal))(auth, xdrs, cred))
#define	auth_marshall(auth, xdrs, cred)	\
		((*((auth)->ah_ops->ah_marshal))(auth, xdrs, cred))
#else
#define	AUTH_MARSHALL(auth, xdrs)	\
		((*((auth)->ah_ops->ah_marshal))(auth, xdrs))
#define	auth_marshall(auth, xdrs)	\
		((*((auth)->ah_ops->ah_marshal))(auth, xdrs))
#endif


#define	AUTH_VALIDATE(auth, verfp)	\
		((*((auth)->ah_ops->ah_validate))((auth), verfp))
#define	auth_validate(auth, verfp)	\
		((*((auth)->ah_ops->ah_validate))((auth), verfp))

#ifdef _KERNEL
#define	AUTH_REFRESH(auth, msg, cr)		\
		((*((auth)->ah_ops->ah_refresh))(auth, msg, cr))
#define	auth_refresh(auth, msg, cr)		\
		((*((auth)->ah_ops->ah_refresh))(auth, msg, cr))
#else
#define	AUTH_REFRESH(auth, msg)		\
		((*((auth)->ah_ops->ah_refresh))(auth, msg))
#define	auth_refresh(auth, msg)		\
		((*((auth)->ah_ops->ah_refresh))(auth, msg))
#endif

#define	AUTH_DESTROY(auth)		\
		((*((auth)->ah_ops->ah_destroy))(auth))
#define	auth_destroy(auth)		\
		((*((auth)->ah_ops->ah_destroy))(auth))

/*
 * Auth flavors can now apply a transformation in addition to simple XDR
 * on the body of a call/response in ways that depend on the flavor being
 * used.  These interfaces provide a generic interface between the
 * internal RPC frame and the auth flavor specific code to allow the
 * auth flavor to encode (WRAP) or decode (UNWRAP) the body.
 */
#ifdef _KERNEL
#define	AUTH_WRAP(auth, buf, buflen, xdrs, xfunc, xwhere)	\
		((*((auth)->ah_ops->ah_wrap))(auth, buf, buflen, \
				xdrs, xfunc, xwhere))
#define	auth_wrap(auth, buf, buflen, xdrs, xfunc, xwhere)	\
		((*((auth)->ah_ops->ah_wrap))(auth, buf, buflen, \
				xdrs, xfunc, xwhere))

#define	AUTH_UNWRAP(auth, xdrs, xfunc, xwhere)	\
		((*((auth)->ah_ops->ah_unwrap))(auth, xdrs, xfunc, xwhere))
#define	auth_unwrap(auth, xdrs)	\
		((*((auth)->ah_ops->ah_unwrap))(auth, xdrs, xfunc, xwhere))
#endif

extern struct opaque_auth _null_auth;

/*
 * These are the various implementations of client side authenticators.
 */

/*
 * System style authentication
 * AUTH *authsys_create(machname, uid, gid, len, aup_gids)
 *	const char *machname;
 *	const uid_t uid;
 *	const gid_t gid;
 *	const int len;
 *	const gid_t *aup_gids;
 */
#ifdef _KERNEL
extern AUTH *authkern_create(void);		/* takes no parameters */
extern int authkern_init(void *, void *, int);
extern struct kmem_cache *authkern_cache;
extern AUTH *authnone_create(void);		/* takes no parameters */
extern int authnone_init(void *, void *, int);
extern struct kmem_cache *authnone_cache;
extern AUTH *authloopback_create(void);		/* takes no parameters */
extern int authloopback_init(void *, void *, int);
extern struct kmem_cache *authloopback_cache;
#else /* _KERNEL */
#ifdef __STDC__
extern AUTH *authsys_create(const char *, const uid_t, const gid_t, const int,
    const gid_t *);
extern AUTH *authsys_create_default(void);	/* takes no parameters */
extern AUTH *authnone_create(void);		/* takes no parameters */
#else /* __STDC__ */
extern AUTH *authsys_create();
extern AUTH *authsys_create_default();	/* takes no parameters */
extern AUTH *authnone_create();	/* takes no parameters */
#endif /* __STDC__ */
/* Will get obsolete in near future */
#define	authunix_create		authsys_create
#define	authunix_create_default authsys_create_default
#endif /* _KERNEL */

/*
 * DES style authentication
 * AUTH *authdes_seccreate(servername, window, timehost, ckey)
 *	const char *servername;		- network name of server
 *	const uint_t window;			- time to live
 *	const char *timehost;			- optional hostname to sync with
 *	const des_block *ckey;		- optional conversation key to use
 */
/* Will get obsolete in near future */
#ifdef _KERNEL
extern int authdes_create(char *, uint_t, struct netbuf *, struct knetconfig *,
    des_block *, int, AUTH **retauth);
#else /* _KERNEL */
#ifdef __STDC__
extern AUTH *authdes_seccreate(const char *, const uint_t, const  char *,
    const des_block *);
#else
extern AUTH *authdes_seccreate();
#endif /* __STDC__ */
#endif /* _KERNEL */

/*
 *  Netname manipulating functions
 */

#ifdef	_KERNEL
extern enum clnt_stat netname2user(char *, uid_t *, gid_t *, int *, gid_t *);
#endif
#ifdef __STDC__
extern int getnetname(char *);
extern int host2netname(char *, const char *, const char *);
extern int user2netname(char *, const uid_t, const char *);
#ifndef	_KERNEL
extern int netname2user(const char *, uid_t *, gid_t *, int *, gid_t *);
#endif
extern int netname2host(const char *, char *, const int);
#else
extern int getnetname();
extern int host2netname();
extern int user2netname();
extern int netname2host();
#endif

/*
 * These routines interface to the keyserv daemon
 */

#ifdef _KERNEL
extern enum clnt_stat key_decryptsession();
extern enum clnt_stat key_encryptsession();
extern enum clnt_stat key_gendes();
extern enum clnt_stat key_getnetname();
#endif

#ifndef _KERNEL
#ifdef	__STDC__
extern int key_decryptsession(const char *, des_block *);
extern int key_encryptsession(const char *, des_block *);
extern int key_gendes(des_block *);
extern int key_setsecret(const char *);
extern int key_secretkey_is_set(void);
/*
 * The following routines are private.
 */
extern int key_setnet_ruid();
extern int key_setnet_g_ruid();
extern int key_removesecret_g_ruid();
extern int key_secretkey_is_set_g_ruid();
extern AUTH *authsys_create_ruid();
#else
extern int key_decryptsession();
extern int key_encryptsession();
extern int key_gendes();
extern int key_setsecret();
extern int key_secretkey_is_set();
#endif
#endif


/*
 * Kerberos style authentication
 * AUTH *authkerb_seccreate(service, srv_inst, realm, window, timehost, status)
 *	const char *service;			- service name
 *	const char *srv_inst;			- server instance
 *	const char *realm;			- server realm
 *	const uint_t window;			- time to live
 *	const char *timehost;			- optional hostname to sync with
 *	int *status;			- kerberos status returned
 */
#ifdef _KERNEL
extern int    authkerb_create(char *, char *, char *, uint_t,
    struct netbuf *, int *, struct knetconfig *, int, AUTH **);
#else
#ifdef __STDC__
extern AUTH *authkerb_seccreate(const char *, const char *, const  char *,
    const uint_t, const char *, int *);
#else
extern AUTH *authkerb_seccreate();
#endif
#endif /* _KERNEL */

/*
 * Map a kerberos credential into a unix cred.
 *
 *  authkerb_getucred(rqst, uid, gid, grouplen, groups)
 *	const struct svc_req *rqst;		- request pointer
 *	uid_t *uid;
 *	gid_t *gid;
 *	short *grouplen;
 *	int   *groups;
 *
 */
#ifdef __STDC__
struct svc_req;
extern int authkerb_getucred(struct svc_req *, uid_t *, gid_t *,
    short *, int *);
#else
extern int authkerb_getucred();
#endif

#ifdef _KERNEL
/*
 * XDR an opaque authentication struct.  See auth.h.
 */
extern bool_t xdr_opaque_auth(XDR *, struct opaque_auth *);
#endif

#ifdef _KERNEL
extern int authany_wrap(AUTH *, caddr_t, uint_t, XDR *, xdrproc_t, caddr_t);
extern int authany_unwrap(AUTH *, XDR *, xdrproc_t, caddr_t);
#endif

#define	AUTH_NONE	0		/* no authentication */
#define	AUTH_NULL	0		/* backward compatibility */
#define	AUTH_SYS	1		/* unix style (uid, gids) */
#define	AUTH_UNIX	AUTH_SYS
#define	AUTH_SHORT	2		/* short hand unix style */
#define	AUTH_DH		3		/* for Diffie-Hellman mechanism */
#define	AUTH_DES	AUTH_DH		/* for backward compatibility */
#define	AUTH_KERB	4		/* kerberos style */
#define	RPCSEC_GSS	6		/* GSS-API style */

#define	AUTH_LOOPBACK	21982		/* unix style w/ expanded groups */
					/* for use over the local transport */

#ifdef _KERNEL
extern char	loopback_name[];

extern zone_key_t	auth_zone_key;
extern void *		auth_zone_init(zoneid_t);
extern void		auth_zone_fini(zoneid_t, void *);
#endif

#ifdef	__cplusplus
}
#endif

#endif	/* !_RPC_AUTH_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

#ifndef	_RPC_AUTH_DES_H
#define	_RPC_AUTH_DES_H

/*
 * auth_des.h, Protocol for DES style authentication for RPC
 *
 */

#include <rpc/auth.h>
#ifdef _KERNEL
#include <rpc/svc.h>
#endif /* _KERNEL */

#ifdef	__cplusplus
extern "C" {
#endif


/*
 * There are two kinds of "names": fullnames and nicknames
 */
enum authdes_namekind {
	ADN_FULLNAME,
	ADN_NICKNAME
};

/*
 * A fullname contains the network name of the client,
 * a conversation key and the window
 */
struct authdes_fullname {
	char *name;	/* network name of client, up to MAXNETNAMELEN */
	des_block key;	/* conversation key */
	uint32_t window;	/* associated window */
};


/*
 * A credential
 */
struct authdes_cred {
	enum authdes_namekind adc_namekind;
	struct authdes_fullname adc_fullname;
	uint32_t adc_nickname;
};

/*
 * A des authentication verifier
 */
struct authdes_verf {
	union {
		struct timeval adv_ctime;	/* clear time */
		des_block adv_xtime;		/* crypt time */
	} adv_time_u;
	uint32_t adv_int_u;
};

/*
 * des authentication verifier: client variety
 *
 * adv_timestamp is the current time.
 * adv_winverf is the credential window + 1.
 * Both are encrypted using the conversation key.
 */
#define	adv_timestamp	adv_time_u.adv_ctime
#define	adv_xtimestamp	adv_time_u.adv_xtime
#define	adv_winverf	adv_int_u

/*
 * des authentication verifier: server variety
 *
 * adv_timeverf is the client's timestamp + client's window
 * adv_nickname is the server's nickname for the client.
 * adv_timeverf is encrypted using the conversation key.
 */
#define	adv_timeverf	adv_time_u.adv_ctime
#define	adv_xtimeverf	adv_time_u.adv_xtime
#define	adv_nickname	adv_int_u

/*
 * Map a des credential into a unix cred.
 *
 *  authdes_getucred(adc, uid, gid, grouplen, groups)
 *	struct authdes_cred *adc;
 *	uid_t *uid;
 *	gid_t *gid;
 *	short *grouplen;
 *	gid_t *groups;
 *
 */

#ifdef _KERNEL
extern int	kauthdes_getucred(const struct authdes_cred *, cred_t *);
#else
#ifdef __STDC__
extern int	authdes_getucred(const struct authdes_cred *,
			uid_t *, gid_t *, short *, gid_t *);
#else
extern int	authdes_getucred();
#endif
#endif

#ifndef _KERNEL
#ifdef __STDC__
extern int	getpublickey(const char *, char *);
extern int	getsecretkey(const char *, char *, const char *);
#else
extern int	getpublickey();
extern int	getsecretkey();
#endif
#endif

#ifdef _KERNEL

#ifdef __STDC__
extern int	authdes_create(char *, uint_t, struct netbuf *,
			struct knetconfig *, des_block *, int, AUTH **);
extern bool_t	xdr_authdes_cred(XDR *, struct authdes_cred *);
extern bool_t	xdr_authdes_verf(XDR *, struct authdes_verf *);
extern int	rtime(struct knetconfig *, struct netbuf *, int,
			struct timeval *, struct timeval *);
extern enum clnt_stat kgetnetname(char *);
extern enum auth_stat _svcauth_des(struct svc_req *, struct rpc_msg *);
#else
extern int	authdes_create();
extern bool_t	xdr_authdes_cred();
extern bool_t	xdr_authdes_verf();
extern int	rtime();
extern enum clnt_stat	kgetnetname();
extern enum auth_stat _svcauth_des();
#endif

extern kmutex_t	authdes_ops_lock;

#endif

#ifdef	__cplusplus
}
#endif

#endif	/* _RPC_AUTH_DES_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
 * Copyright 2017 Joyent Inc
 */

/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

/*
 * auth_sys.h, Protocol for UNIX style authentication parameters for RPC
 */

#ifndef	_RPC_AUTH_SYS_H
#define	_RPC_AUTH_SYS_H

/*
 * The system is very weak.  The client uses no encryption for  it
 * credentials and only sends null verifiers.  The server sends backs
 * null verifiers or optionally a verifier that suggests a new short hand
 * for the credentials.
 */

#include <sys/types.h>
#include <sys/param.h>
#include <rpc/types.h>
#include <rpc/xdr.h>
#include <rpc/auth.h>

#ifdef	__cplusplus
extern "C" {
#endif

/* The machine name is part of a credential; it may not exceed 255 bytes */
#define	 MAX_MACHINE_NAME 255

/* gids compose part of a credential; there may not be more than 16 of them */
#define	 NGRPS 16

/*
 * "sys" (Old UNIX) style credentials.
 */
struct authsys_parms {
	uint_t	 aup_time;
	char	*aup_machname;
	uid_t	 aup_uid;
	gid_t	 aup_gid;
	uint_t	 aup_len;
	gid_t	*aup_gids;
};
/* For backward compatibility */
#define	 authunix_parms authsys_parms

/*
 * Ideally, we would like this to be NGROUPS_UMAX, but the RFC mandates that
 * auth sections must not exceed 400 bytes. For AUTH_LOOPBACK, that means the
 * largest number of groups we can have without breaking RFC compat is 92
 * groups.
 *
 * NOTE: changing this value changes the size of authlpbk_area in
 * svc_auth_loopb.c, which means RQCRED_SIZE *must* be updated!
 */
#define	 NGRPS_LOOPBACK 92

#ifdef __STDC__
extern bool_t xdr_authsys_parms(XDR *, struct authsys_parms *);
#else
extern bool_t xdr_authsys_parms();
#endif


/* For backward compatibility */
#define	xdr_authunix_parms(xdrs, p) xdr_authsys_parms(xdrs, p)

/*
 * If a response verifier has flavor AUTH_SHORT, then the body of
 * the response verifier encapsulates the following structure;
 * again it is serialized in the obvious fashion.
 */
struct short_hand_verf {
	struct opaque_auth new_cred;
};

struct svc_req;

extern bool_t xdr_gid_t(XDR *, gid_t *);
extern bool_t xdr_uid_t(XDR *, uid_t *);

#ifdef _KERNEL
extern bool_t xdr_authkern(XDR *, cred_t *);
extern bool_t xdr_authloopback(XDR *, cred_t *);
extern enum auth_stat _svcauth_unix(struct svc_req *, struct rpc_msg *);
extern enum auth_stat _svcauth_short(struct svc_req *, struct rpc_msg *);
#endif

#ifdef	__cplusplus
}
#endif

#endif	/* !_RPC_AUTH_SYS_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 *
 * Copyright 1991 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

/*
 * auth_unix.h, Protocol for UNIX style authentication parameters for RPC
 */

#ifndef _RPC_AUTH_UNIX_H
#define	_RPC_AUTH_UNIX_H

/*
 * This file is now obsolete. Users should switch to <rpc/auth_sys.h>
 */
#include <rpc/auth_sys.h>

#endif	/* !_RPC_AUTH_UNIX_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (C) 1984, Sun Microsystems, Inc.
 */

#ifndef	_RPC_BOOTPARAM_H
#define	_RPC_BOOTPARAM_H

#ifndef _KERNEL
#include <rpc/types.h>
#include <sys/time.h>
#include <sys/errno.h>
#include <nfs/nfs.h>
#endif

#ifdef	__cplusplus
extern "C" {
#endif

#define	MAX_MACHINE_NAME 255
#define	MAX_PATH_LEN	1024
#define	MAX_FILEID	32
#define	IP_ADDR_TYPE	1

typedef char *bp_machine_name_t;
typedef char *bp_path_t;
typedef char *bp_fileid_t;

struct ip_addr_t {
	char net;
	char host;
	char lh;
	char impno;
};
typedef struct ip_addr_t ip_addr_t;

struct bp_address {
	int address_type;
	union {
		ip_addr_t ip_addr;
	} bp_address;
};
typedef struct bp_address bp_address;


struct bp_whoami_arg {
	bp_address client_address;
};
typedef struct bp_whoami_arg bp_whoami_arg;


struct bp_whoami_res {
	bp_machine_name_t client_name;
	bp_machine_name_t domain_name;
	bp_address router_address;
};
typedef struct bp_whoami_res bp_whoami_res;


struct bp_getfile_arg {
	bp_machine_name_t client_name;
	bp_fileid_t file_id;
};
typedef struct bp_getfile_arg bp_getfile_arg;


struct bp_getfile_res {
	bp_machine_name_t server_name;
	bp_address server_address;
	bp_path_t server_path;
};
typedef struct bp_getfile_res bp_getfile_res;


#define	BOOTPARAMPROG 100026
#define	BOOTPARAMVERS 1
#define	BOOTPARAMPROC_WHOAMI 1
#define	BOOTPARAMPROC_GETFILE 2

bool_t xdr_bp_machine_name_t();
bool_t xdr_bp_path_t();
bool_t xdr_bp_fileid_t();
bool_t xdr_ip_addr_t();
bool_t xdr_bp_address();
bool_t xdr_bp_whoami_arg();
bool_t xdr_bp_whoami_res();
bool_t xdr_bp_getfile_arg();
bool_t xdr_bp_getfile_res();

#ifdef	__cplusplus
}
#endif

#endif	/* !_RPC_BOOTPARAM_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 * Copyright 2020 Tintri by DDN. All rights reserved.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

/*
 * clnt.h - Client side remote procedure call interface.
 */

#ifndef	_RPC_CLNT_H
#define	_RPC_CLNT_H

#include <sys/types.h>
#include <rpc/rpc_com.h>
#include <rpc/clnt_stat.h>
#include <rpc/auth.h>

/*
 * rpc calls return an enum clnt_stat.  This should be looked at more,
 * since each implementation is required to live with this (implementation
 * independent) list of errors.
 */
#include <sys/netconfig.h>
#ifdef _KERNEL
#include <sys/t_kuser.h>
#endif	/* _KERNEL */

#ifdef __cplusplus
extern "C" {
#endif

/*
 * Following defines the multicast group address used by IPV6 enabled
 * client to do the broadcast. IPv6 doesn't have any broadcast support
 * as IPv4 provides, thus it used this reserved address which is joined
 * by all rpc clients.
 */

#define	RPCB_MULTICAST_ADDR "FF02::202"

/*
 * the following errors are in general unrecoverable.  The caller
 * should give up rather than retry.
 */
#define	IS_UNRECOVERABLE_RPC(s)	(((s) == RPC_AUTHERROR) || \
	((s) == RPC_CANTENCODEARGS) || \
	((s) == RPC_CANTDECODERES) || \
	((s) == RPC_VERSMISMATCH) || \
	((s) == RPC_PROCUNAVAIL) || \
	((s) == RPC_PROGUNAVAIL) || \
	((s) == RPC_PROGVERSMISMATCH) || \
	((s) == RPC_SYSTEMERROR) || \
	((s) == RPC_CANTDECODEARGS))

/* Maximum rpc backoff time */
#define	RPC_MAX_BACKOFF	30

/*
 * Error info.
 */
struct rpc_err {
	enum clnt_stat re_status;
	union {
		struct {
			int RE_errno;	/* related system error */
			int RE_t_errno;	/* related tli error number */
		} RE_err;
		enum auth_stat RE_why;	/* why the auth error occurred */
		struct {
			rpcvers_t low;	/* lowest verion supported */
			rpcvers_t high;	/* highest verion supported */
		} RE_vers;
		struct {		/* maybe meaningful if RPC_FAILED */
			int32_t s1;
			int32_t s2;
		} RE_lb;		/* life boot & debugging only */
	} ru;
#define	re_errno	ru.RE_err.RE_errno
#define	re_terrno	ru.RE_err.RE_t_errno
#define	re_why		ru.RE_why
#define	re_vers		ru.RE_vers
#define	re_lb		ru.RE_lb
};


/*
 * Timers used for the pseudo-transport protocol when using datagrams
 */
struct rpc_timers {
	clock_t		rt_srtt;	/* smoothed round-trip time */
	clock_t		rt_deviate;	/* estimated deviation */
	clock_t		rt_rtxcur;	/* current (backed-off) rto */
};

/*
 * PSARC 2003/523 Contract Private Interface
 * CLIENT
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 *
 * Client rpc handle.
 * Created by individual implementations
 * Client is responsible for initializing auth, see e.g. auth_none.c.
 */

typedef struct __client {
	AUTH	*cl_auth;			/* authenticator */
	struct clnt_ops {
#ifdef __STDC__
		/* call remote procedure */
		enum clnt_stat	(*cl_call)(struct __client *, rpcproc_t,
				    xdrproc_t, caddr_t, xdrproc_t,
				    caddr_t, struct timeval);
		/* abort a call */
		void		(*cl_abort)(/* various */);
		/* get specific error code */
		void		(*cl_geterr)(struct __client *,
				    struct rpc_err *);
		/* frees results */
		bool_t		(*cl_freeres)(struct __client *, xdrproc_t,
				    caddr_t);
		/* destroy this structure */
		void		(*cl_destroy)(struct __client *);
		/* the ioctl() of rpc */
		bool_t		(*cl_control)(struct __client *, int, char *);
		/* set rpc level timers */
		int		(*cl_settimers)(struct __client *,
				    struct rpc_timers *, struct rpc_timers *,
				    int, void (*)(), caddr_t, uint32_t);
#ifndef _KERNEL
		/* send a one-way asynchronous call to remote procedure */
		enum clnt_stat	(*cl_send)(struct __client *, rpcproc_t,
				    xdrproc_t, caddr_t);
#endif /* !_KERNEL */
#else
		enum clnt_stat	(*cl_call)();	/* call remote procedure */
		void		(*cl_abort)();	/* abort a call */
		void		(*cl_geterr)();	/* get specific error code */
		bool_t		(*cl_freeres)(); /* frees results */
		void		(*cl_destroy)(); /* destroy this structure */
		bool_t		(*cl_control)(); /* the ioctl() of rpc */
		int		(*cl_settimers)(); /* set rpc level timers */
#ifndef _KERNEL
		enum clnt_stat  (*cl_send)();   /* send one-way request */
#endif /* !_KERNEL */
#endif
	} *cl_ops;
	caddr_t			cl_private;	/* private stuff */
#ifndef _KERNEL
	char			*cl_netid;	/* network token */
	char			*cl_tp;		/* device name */
#else
	bool_t			cl_nosignal;  /* to handle NOINTR */
#endif
} CLIENT;

/*
 * Feedback values used for possible congestion and rate control
 */
#define	FEEDBACK_REXMIT1	1	/* first retransmit */
#define	FEEDBACK_OK		2	/* no retransmits */

/*
 * The following defines the control routines
 * for rpcbind.
 */

#define	CLCR_GET_RPCB_TIMEOUT	1
#define	CLCR_SET_RPCB_TIMEOUT	2
#define	CLCR_SET_LOWVERS	3
#define	CLCR_GET_LOWVERS	4
#define	CLCR_SET_RPCB_RMTTIME	5
#define	CLCR_GET_RPCB_RMTTIME	6
#define	CLCR_SET_CRED_CACHE_SZ	7
#define	CLCR_GET_CRED_CACHE_SZ	8

#define	RPCSMALLMSGSIZE	400	/* a more reasonable packet size */

#define	KNC_STRSIZE	128	/* maximum length of knetconfig strings */
/*
 * PSARC 2003/523 Contract Private Interface
 * knetconfig
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 *
 * Note that the knetconfig strings can either be dynamically allocated, or
 * they can be string literals.  The code that sets up the knetconfig is
 * responsible for keeping track of this and freeing the strings if
 * necessary when the knetconfig is destroyed.
 */
struct knetconfig {
	unsigned int	knc_semantics;	/* token name */
	caddr_t		knc_protofmly;	/* protocol family */
	caddr_t		knc_proto;	/* protocol */
	dev_t		knc_rdev;	/* device id */
	unsigned int	knc_unused[8];
};

#ifdef _SYSCALL32
struct knetconfig32 {
	uint32_t	knc_semantics;	/* token name */
	caddr32_t	knc_protofmly;	/* protocol family */
	caddr32_t	knc_proto;	/* protocol */
	dev32_t		knc_rdev;	/* device id */
	uint32_t	knc_unused[8];
};
#endif /* _SYSCALL32 */

#ifdef _KERNEL

/*
 * Bucket defined for the call table.  Padded out to 64 bytes so that
 * false sharing won't be induced.
 */
typedef	union call_table {
	struct {
		struct calllist_s	*uct_call_next;
		struct calllist_s	*uct_call_prev;
		uint_t			uct_len;
		kmutex_t		uct_lock;
	} ct_s;
	char				uct_pad[64];
} call_table_t;

/*
 * Define some macros for easy access into the call table structure
 */
#define	ct_call_next ct_s.uct_call_next
#define	ct_call_prev ct_s.uct_call_prev
#define	ct_len ct_s.uct_len
#define	ct_lock ct_s.uct_lock

/*
 * List of outstanding calls awaiting replies, for COTS, CLTS
 */
typedef struct calllist_s {
	struct calllist_s *call_next;	/* hash chain, MUST BE FIRST */
	struct calllist_s *call_prev;
	bool_t		call_notified;
	uint_t		call_xid;	/* the xid on the call */
	uint_t		call_hash;	/* hash value */
	call_table_t	*call_bucket;	/* back pointer to bucket */
	mblk_t		*call_reply;	/* the reply to the call */
	kcondvar_t	call_cv;	/* cv to notify when reply is done */
	kmutex_t	call_lock;	/* lock for cv */
	struct rpc_err	call_err;	/* status on reply */
#define	call_status call_err.re_status	/* error on reply (rep is invalid) */
#define	call_reason call_err.re_errno	/* reason code on T_DISCON_IND */
	queue_t		*call_wq;	/* the write queue the call is using */
	zoneid_t	call_zoneid;	/* zoneid the call was made from */
} calllist_t;

/*
 * Define macros for call table hashing
 */
/*
 * A simple hash function.  Due to the way XID's get allocated, this may be
 * sufficient.  This hash function provides round robin bucket selection so
 * that the next time a particular bucket gets picked is when there have
 * been N-1 calls.  N is the number of buckets.
 */
#define	call_hash(xid, hashsize) \
		(xid % hashsize);

#define	call_table_enter(e)				\
{							\
	call_table_t *ctp = (e)->call_bucket;		\
	mutex_enter(&ctp->ct_lock);			\
	ctp->ct_len++;					\
	(e)->call_next = ctp->ct_call_next;		\
	(e)->call_prev = (calllist_t *)ctp;		\
	ctp->ct_call_next->call_prev = (e);		\
	ctp->ct_call_next = (e);			\
	mutex_exit(&ctp->ct_lock);			\
}

#define	call_table_remove(e)				\
{							\
	call_table_t *ctp = (e)->call_bucket;		\
	mutex_enter(&ctp->ct_lock);			\
	ctp->ct_len--;					\
	(e)->call_prev->call_next = (e)->call_next;	\
	(e)->call_next->call_prev = (e)->call_prev;	\
	mutex_exit(&ctp->ct_lock);			\
}

#define	call_table_find(ctp, xid, ele)			\
{							\
	calllist_t *cp;					\
	(ele) = NULL;					\
	mutex_enter(&(ctp)->ct_lock);			\
	for (cp = (ctp)->ct_call_next;			\
		cp != (calllist_t *)(ctp);		\
		cp = cp->call_next) {			\
		if (cp->call_xid == (xid))		\
			(ele) = cp;			\
	}						\
}

#define	DEFAULT_MIN_HASH_SIZE	32
#define	DEFAULT_HASH_SIZE	1024

#define	RESERVED_PORTSPACE (IPPORT_RESERVED - (IPPORT_RESERVED/2))
#define	NONRESERVED_PORTSPACE (0xFFFF - IPPORT_RESERVED)

/*
 *	Alloc_xid presents an interface which kernel RPC clients
 *	should use to allocate their XIDs.  Its implementation
 *	may change over time (for example, to allow sharing of
 *	XIDs between the kernel and user-level applications, so
 *	all XID allocation should be done by calling alloc_xid().
 */
extern uint32_t alloc_xid(void);

extern struct zone *rpc_zone(void);
extern zoneid_t rpc_zoneid(void);

extern int clnt_tli_kcreate(struct knetconfig *config, struct netbuf *svcaddr,
	rpcprog_t, rpcvers_t, uint_t max_msgsize, int retrys,
	struct cred *cred, CLIENT **ncl);

extern int clnt_tli_kinit(CLIENT *h, struct knetconfig *config,
	struct netbuf *addr, uint_t max_msgsize, int retries,
	struct cred *cred);

extern int rpc_uaddr2port(int af, char *addr);

extern void clnt_init_netbuf(struct netbuf *, int);
extern void clnt_free_netbuf(struct netbuf *);
extern void clnt_dup_netbuf(const struct netbuf *, struct netbuf *);
extern int clnt_cmp_netaddr(const struct netbuf *, struct netbuf *);

/*
 * kRPC internal function. Not for general use. Subject to rapid change.
 */
extern int bindresvport(TIUSER *tiptr, struct netbuf *addr,
	struct netbuf *bound_addr, bool_t istcp);

/*
 * kRPC internal function. Not for general use. Subject to rapid change.
 */
extern int clnt_clts_kcreate(struct knetconfig *config, struct netbuf *addr,
	rpcprog_t, rpcvers_t, int retries, struct cred *cred, CLIENT **cl);

/*
 * kRPC internal function. Not for general use. Subject to rapid change.
 */
extern int clnt_cots_kcreate(dev_t dev, struct netbuf *addr, int family,
	rpcprog_t, rpcvers_t, uint_t max_msgsize, struct cred *cred,
	CLIENT **ncl);
/*
 * kRPC internal function. Not for general use. Subject to rapid change.
 */
extern int clnt_rdma_kcreate(char *proto, void *handle, struct netbuf *raddr,
	int family, rpcprog_t pgm, rpcvers_t vers, struct cred *cred,
	CLIENT **cl);
/*
 * kRPC internal function. Not for general use. Subject to rapid change.
 */
extern int rdma_reachable(int addr_type, struct netbuf *addr,
	struct knetconfig **knconf);

/*
 * kRPC internal function. Not for general use. Subject to rapid change.
 */
extern void clnt_clts_kinit(CLIENT *h, struct netbuf *addr, int retries,
	struct cred *cred);

/*
 * kRPC internal function. Not for general use. Subject to rapid change.
 */
extern void clnt_cots_kinit(CLIENT *h, dev_t dev, int family,
	struct netbuf *addr, int max_msgsize, struct cred *cred);

/*
 * kRPC internal function. Not for general use. Subject to rapid change.
 */
extern void clnt_rdma_kinit(CLIENT *h, char *proto, void *handle,
	struct netbuf *addr, struct cred *cred);

/*
 * kRPC internal function. Not for general use. Subject to rapid change.
 */
extern bool_t clnt_dispatch_notify(mblk_t *, zoneid_t, uint32_t);

/*
 * kRPC internal function. Not for general use. Subject to rapid change.
 */
extern bool_t clnt_dispatch_notifyconn(queue_t *, mblk_t *);

/*
 * kRPC internal function. Not for general use. Subject to rapid change.
 */
extern void clnt_dispatch_notifyall(queue_t *, int32_t, int32_t);

/*
 * kRPC internal function. Not for general use. Subject to rapid change.
 */
extern enum clnt_stat clnt_clts_kcallit_addr(CLIENT *, rpcproc_t, xdrproc_t,
	caddr_t, xdrproc_t, caddr_t, struct timeval, struct netbuf *);

/*
 * kRPC internal function. Not for general use. Subject to rapid change.
 */
extern call_table_t *call_table_init(int);

/*
 * kRPC internal function. Not for general use. Subject to rapid change.
 */
extern void clnt_init(void);

/*
 * kRPC internal function. Not for general use. Subject to rapid change.
 */
extern void clnt_fini(void);

/*
 * kRPC internal function. Not for general use. Subject to rapid change.
 */
extern void clnt_clts_init(void);

/*
 * kRPC internal function. Not for general use. Subject to rapid change.
 */
extern void clnt_clts_fini(void);

/*
 * kRPC internal function. Not for general use. Subject to rapid change.
 */
extern void clnt_cots_init(void);

/*
 * kRPC internal function. Not for general use. Subject to rapid change.
 */
extern void clnt_cots_fini(void);

/*
 * kRPC internal function. Not for general use. Subject to rapid change.
 */
extern void clnt_clts_dispatch_notify(mblk_t *, int, zoneid_t);
extern int connmgr_cb_create(void *, rpcprog_t, rpcvers_t, int, void *);
extern void connmgr_cb_destroy(queue_t *);

extern void rpc_poptimod(struct vnode *);
extern int kstr_push(struct vnode *, char *);
extern void t_kadvise(TIUSER *, uchar_t *, int);

extern boolean_t connmgr_cpr_reset(void *, int);
extern void connmgr_destroy(queue_t *);

extern void put_inet_port(struct netbuf *, ushort_t);
extern void put_inet6_port(struct netbuf *, ushort_t);
extern void put_loopback_port(struct netbuf *, char *);
extern enum clnt_stat rpcbind_getaddr(struct knetconfig *, rpcprog_t,
    rpcvers_t, struct netbuf *);
extern enum clnt_stat rpcbind_getaddr5(struct knetconfig *, rpcprog_t,
    rpcvers_t, struct netbuf *, struct netbuf *);

/*
 * Kstat stuff
 */
#include <sys/zone.h>

extern zone_key_t rpcstat_zone_key;

struct rpc_clts_client;		/* unix:0:rpc_clts_client */
struct rpc_clts_server;		/* unix:0:rpc_clts_server */
struct rpc_cots_client;		/* unix:0:rpc_cots_client */
struct rpc_cots_server;		/* unix:0:rpc_cots_server */

struct rpcstat {
	struct rpc_clts_client *rpc_clts_client;
	struct rpc_clts_server *rpc_clts_server;
	struct rpc_cots_client *rpc_cots_client;
	struct rpc_cots_server *rpc_cots_server;
};

extern kstat_named_t *rpcstat_zone_init_common(zoneid_t, const char *,
    const char *, const kstat_named_t *, size_t);
extern void rpcstat_zone_fini_common(zoneid_t, const char *, const char *);

extern void clnt_clts_stats_init(zoneid_t, struct rpc_clts_client **);
extern void clnt_clts_stats_fini(zoneid_t, struct rpc_clts_client **);

extern void svc_clts_stats_init(zoneid_t, struct rpc_clts_server **);
extern void svc_clts_stats_fini(zoneid_t, struct rpc_clts_server **);

extern void clnt_cots_stats_init(zoneid_t, struct rpc_cots_client **);
extern void clnt_cots_stats_fini(zoneid_t, struct rpc_cots_client **);

extern void svc_cots_stats_init(zoneid_t, struct rpc_cots_server **);
extern void svc_cots_stats_fini(zoneid_t, struct rpc_cots_server **);

#endif /* _KERNEL */

/*
 * client side rpc interface ops
 */

/*
 * enum clnt_stat
 * CLNT_CALL(rh, proc, xargs, argsp, xres, resp, timeout)
 *	CLIENT *rh;
 *	rpcproc_t proc;
 *	xdrproc_t xargs;
 *	caddr_t argsp;
 *	xdrproc_t xres;
 *	caddr_t resp;
 *	struct timeval timeout;
 *
 * PSARC 2003/523 Contract Private Interface
 * CLNT_CALL
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
#define	CLNT_CALL(rh, proc, xargs, argsp, xres, resp, secs)	\
	((*(rh)->cl_ops->cl_call)(rh, proc, xargs, argsp, xres, resp, secs))
#define	clnt_call(rh, proc, xargs, argsp, xres, resp, secs)	\
	((*(rh)->cl_ops->cl_call)(rh, proc, xargs, argsp, xres, resp, secs))

#ifndef _KERNEL
/*
 * enum clnt_stat
 * CLNT_SEND(rh, proc, xargs, argsp)
 *	CLIENT *rh;
 *	rpcproc_t proc;
 *	xdrproc_t xargs;
 *	caddr_t argsp;
 *
 * PSARC 2000/428  Contract Private Interface
 */
#define	CLNT_SEND(rh, proc, xargs, argsp)	\
	((*(rh)->cl_ops->cl_send)(rh, proc, xargs, argsp))
#define	clnt_send(rh, proc, xargs, argsp)	\
	((*(rh)->cl_ops->cl_send)(rh, proc, xargs, argsp))
#endif /* !_KERNEL */

/*
 * void
 * CLNT_ABORT(rh);
 *	CLIENT *rh;
 */
#define	CLNT_ABORT(rh)	((*(rh)->cl_ops->cl_abort)(rh))
#define	clnt_abort(rh)	((*(rh)->cl_ops->cl_abort)(rh))

/*
 * struct rpc_err
 * CLNT_GETERR(rh);
 *	CLIENT *rh;
 */
#define	CLNT_GETERR(rh, errp)	((*(rh)->cl_ops->cl_geterr)(rh, errp))
#define	clnt_geterr(rh, errp)	((*(rh)->cl_ops->cl_geterr)(rh, errp))

/*
 * bool_t
 * CLNT_FREERES(rh, xres, resp);
 *	CLIENT *rh;
 *	xdrproc_t xres;
 *	caddr_t resp;
 */
#define	CLNT_FREERES(rh, xres, resp) \
		((*(rh)->cl_ops->cl_freeres)(rh, xres, resp))
#define	clnt_freeres(rh, xres, resp) \
		((*(rh)->cl_ops->cl_freeres)(rh, xres, resp))

/*
 * bool_t
 * CLNT_CONTROL(cl, request, info)
 *	CLIENT *cl;
 *	uint_t request;
 *	char *info;
 *
 * PSARC 2003/523 Contract Private Interface
 * CLNT_CONTROL
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
#define	CLNT_CONTROL(cl, rq, in) ((*(cl)->cl_ops->cl_control)(cl, rq, in))
#define	clnt_control(cl, rq, in) ((*(cl)->cl_ops->cl_control)(cl, rq, in))


/*
 * control operations that apply to all transports
 */
#define	CLSET_TIMEOUT		1	/* set timeout (timeval) */
#define	CLGET_TIMEOUT		2	/* get timeout (timeval) */
#define	CLGET_SERVER_ADDR	3	/* get server's address (sockaddr) */
#define	CLGET_FD		6	/* get connections file descriptor */
#define	CLGET_SVC_ADDR		7	/* get server's address (netbuf) */
#define	CLSET_FD_CLOSE		8	/* close fd while clnt_destroy */
#define	CLSET_FD_NCLOSE		9	/* Do not close fd while clnt_destroy */
#define	CLGET_XID		10	/* Get xid */
#define	CLSET_XID		11	/* Set xid */
#define	CLGET_VERS		12	/* Get version number */
#define	CLSET_VERS		13	/* Set version number */
#define	CLGET_PROG		14	/* Get program number */
#define	CLSET_PROG		15	/* Set program number */
#define	CLSET_SVC_ADDR		16	/* get server's address (netbuf) */
#define	CLSET_PUSH_TIMOD	17	/* push timod if not already present */
#define	CLSET_POP_TIMOD		18	/* pop timod */
#ifndef _KERNEL
/* 00-08-17 - NON STANDARD CONTROL PARAMETER */
#define	CLSET_IO_MODE		19	/* clnt_send behavior */
#define	CLGET_IO_MODE		20	/* clnt_send behavior */
#define	CLSET_FLUSH_MODE	21	/* flush behavior */
#define	CLGET_FLUSH_MODE	22	/* flush behavior */
#define	CLFLUSH			23	/* flush now (user wants it) */
#define	CLSET_CONNMAXREC_SIZE	24	/* set pending request buffer size */
#define	CLGET_CONNMAXREC_SIZE	25	/* set pending request buffer size */
#define	CLGET_CURRENT_REC_SIZE	26	/* get pending request buffer size */

typedef enum {
	RPC_CL_BESTEFFORT_FLUSH = 100,	/* flush as much as possible */
					/* without blocking */
	RPC_CL_BLOCKING_FLUSH,		/* flush the buffer completely */
					/* (possibly blocking) */
	RPC_CL_DEFAULT_FLUSH		/* flush according to the currently */
					/* defined policy. */
} rpcflushmode_t;


typedef enum {
	RPC_CL_BLOCKING = 10,	/* PASSED CLNT_CONTROL SET_IO_MODE */
	RPC_CL_NONBLOCKING
} rpciomode_t;
#endif /* !_KERNEL */
/*
 * Connectionless only control operations
 */
#define	CLSET_RETRY_TIMEOUT 4   /* set retry timeout (timeval) */
#define	CLGET_RETRY_TIMEOUT 5   /* get retry timeout (timeval) */

#ifdef	_KERNEL
/*
 * Connection oriented only control operation.
 */
#define	CLSET_PROGRESS		10000	/* Report RPC_INPROGRESS if a request */
					/* has been sent but no reply */
					/* received yet. */
#define	CLSET_BCAST		10001	/* Set RPC Broadcast hint */
#define	CLGET_BCAST		10002	/* Get RPC Broadcast hint */
#define	CLSET_NODELAYONERR	10003	/* Set enable/disable of delay on */
					/* connection setup error	  */
#define	CLGET_NODELAYONERR	10004	/* Get enable/disable of delay on */
					/* connection setup error	  */
#define	CLSET_BINDRESVPORT	10005	/* Set preference for reserve port */
#define	CLGET_BINDRESVPORT	10006	/* Get preference for reserve port */
#define	CLSET_BINDSRCADDR	10007	/* Set preference for interface */
					/* and end port */
#define	CLSET_CBSERVER_SETUP	10008	/* Init back channel info */
#define	CLSET_CBSERVER_CLEAR	10009	/* Clear bc setup flags */
#define	CLSET_BACKCHANNEL	10010	/* Use backchannel connection */
#define	CLSET_BACKCHANNEL_CLEAR	10011	/* Clear backchannel flag */
#define	CLSET_TAG		10012	/* set rpc tags */
#define	CLSET_TAG_CLEAR		10013	/* clear rpc tags */
#define	CLSET_TAG_SWAP		10014	/* swap the tags */
#define	CLSET_CB_TEST		10015	/* used to test cb conn's */
					/* for a specific tag */

#define	CLGET_CB_UNTESTED	10016	/* return untested */
					/* callback connections */

#define	CLSET_CB_TEST_CLEAR	10017	/* clear previous flag */
#define	CLSET_NON_BIRPC		10018	/* non bi-directional rpc */
#define	CLSET_BINDCONN_TO_TAG	10019	/* associate a connection */
					/* with the tag */
#define	CLSET_CLEAR_BINDCONN	10020	/* clear the previous flag */
#define	CLSET_TAG_CONN_UNBIND	10021	/* remove associated conn */
					/* for the tag */
#define	CLSET_TAG_DESTROY	10022	/* destroy the tag and */
					/* dis-associate any conn */
#define	CLSET_CBSERVER_CLEANUP	10023	/* clear cbinfo in a */
#define	CLSET_CBCLIENT		10024	/* Use callback conn */
					/* nfs server side only */

#endif

/*
 * void
 * CLNT_SETTIMERS(rh);
 *	CLIENT *rh;
 *	struct rpc_timers *t;
 *	struct rpc_timers *all;
 *	unsigned int min;
 *	void    (*fdbck)();
 *	caddr_t arg;
 *	uint_t  xid;
 */
#define	CLNT_SETTIMERS(rh, t, all, min, fdbck, arg, xid) \
		((*(rh)->cl_ops->cl_settimers)(rh, t, all, min, \
		fdbck, arg, xid))
#define	clnt_settimers(rh, t, all, min, fdbck, arg, xid) \
		((*(rh)->cl_ops->cl_settimers)(rh, t, all, min, \
		fdbck, arg, xid))


/*
 * void
 * CLNT_DESTROY(rh);
 *	CLIENT *rh;
 *
 * PSARC 2003/523 Contract Private Interface
 * CLNT_DESTROY
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
#define	CLNT_DESTROY(rh)	((*(rh)->cl_ops->cl_destroy)(rh))
#define	clnt_destroy(rh)	((*(rh)->cl_ops->cl_destroy)(rh))


/*
 * RPCTEST is a test program which is accessable on every rpc
 * transport/port.  It is used for testing, performance evaluation,
 * and network administration.
 */

#define	RPCTEST_PROGRAM		((rpcprog_t)1)
#define	RPCTEST_VERSION		((rpcvers_t)1)
#define	RPCTEST_NULL_PROC	((rpcproc_t)2)
#define	RPCTEST_NULL_BATCH_PROC	((rpcproc_t)3)

/*
 * By convention, procedure 0 takes null arguments and returns them
 */

#define	NULLPROC ((rpcproc_t)0)

/*
 * Below are the client handle creation routines for the various
 * implementations of client side rpc.  They can return NULL if a
 * creation failure occurs.
 */

#ifndef _KERNEL

/*
 * Generic client creation routine. Supported protocols are which belong
 * to the nettype name space
 */
#ifdef __STDC__
extern  CLIENT * clnt_create(const char *, const rpcprog_t, const rpcvers_t,
	const char *);
/*
 *
 *	const char *hostname;			-- hostname
 *	const rpcprog_t prog;			-- program number
 *	const rpcvers_t vers;			-- version number
 *	const char *nettype;			-- network type
 */
#else
extern CLIENT * clnt_create();
#endif

/*
 * Generic client creation routine. Just like clnt_create(), except
 * it takes an additional timeout parameter.
 */
#ifdef __STDC__
extern  CLIENT * clnt_create_timed(const char *, const rpcprog_t,
	const rpcvers_t, const char *, const struct timeval *);
/*
 *
 *	const char *hostname;			-- hostname
 *	const rpcprog_t prog;			-- program number
 *	const rpcvers_t vers;			-- version number
 *	const char *nettype;			-- network type
 *	const struct timeval *tp;		-- timeout
 */
#else
extern CLIENT * clnt_create_timed();
#endif

/*
 * Generic client creation routine. Supported protocols are which belong
 * to the nettype name space.
 */
#ifdef __STDC__
extern CLIENT * clnt_create_vers(const char *, const rpcprog_t, rpcvers_t *,
	const rpcvers_t, const rpcvers_t, const char *);
/*
 *	const char *host;		-- hostname
 *	const rpcprog_t prog;		-- program number
 *	rpcvers_t *vers_out;	-- servers highest available version number
 *	const rpcvers_t vers_low;	-- low version number
 *	const rpcvers_t vers_high;	-- high version number
 *	const char *nettype;		-- network type
 */
#else
extern CLIENT * clnt_create_vers();
#endif

/*
 * Generic client creation routine. Supported protocols are which belong
 * to the nettype name space.
 */
#ifdef __STDC__
extern CLIENT * clnt_create_vers_timed(const char *, const rpcprog_t,
	rpcvers_t *, const rpcvers_t, const rpcvers_t, const char *,
	const struct timeval *);
/*
 *	const char *host;		-- hostname
 *	const rpcprog_t prog;		-- program number
 *	rpcvers_t *vers_out;	-- servers highest available version number
 *	const rpcvers_t vers_low;	-- low version number
 *	const prcvers_t vers_high;	-- high version number
 *	const char *nettype;		-- network type
 *	const struct timeval *tp	-- timeout
 */
#else
extern CLIENT * clnt_create_vers_timed();
#endif


/*
 * Generic client creation routine. It takes a netconfig structure
 * instead of nettype
 */
#ifdef __STDC__
extern CLIENT * clnt_tp_create(const char *, const rpcprog_t, const rpcvers_t,
	const struct netconfig *);
/*
 *	const char *hostname;			-- hostname
 *	const rpcprog_t prog;			-- program number
 *	const rpcvers_t vers;			-- version number
 *	const struct netconfig *netconf;	-- network config structure
 */
#else
extern CLIENT * clnt_tp_create();
#endif

/*
 * Generic client creation routine. Just like clnt_tp_create(), except
 * it takes an additional timeout parameter.
 */
#ifdef __STDC__
extern CLIENT * clnt_tp_create_timed(const char *, const rpcprog_t,
	const rpcvers_t, const struct netconfig *, const struct timeval *);
/*
 *	const char *hostname;			-- hostname
 *	const rpcprog_t prog;			-- program number
 *	const rpcvers_t vers;			-- version number
 *	const struct netconfig *netconf;	-- network config structure
 *	const struct timeval *tp;		-- timeout
 */
#else
extern CLIENT * clnt_tp_create_timed();
#endif

/*
 * Generic TLI create routine
 */

#ifdef __STDC__
extern CLIENT * clnt_tli_create(const int, const struct netconfig *,
	struct netbuf *, const rpcprog_t, const rpcvers_t, const uint_t,
	const uint_t);
/*
 *	const int fd;		-- fd
 *	const struct netconfig *nconf;	-- netconfig structure
 *	struct netbuf *svcaddr;		-- servers address
 *	const rpcprog_t prog;		-- program number
 *	const rpcvers_t vers;		-- version number
 *	const uint_t sendsz;		-- send size
 *	const uint_t recvsz;		-- recv size
 */

#else
extern CLIENT * clnt_tli_create();
#endif

/*
 * Low level clnt create routine for connectionful transports, e.g. tcp.
 */
#ifdef __STDC__
extern  CLIENT * clnt_vc_create(const int, struct netbuf *,
	const rpcprog_t, const rpcvers_t, const uint_t, const uint_t);
/*
 *	const int fd;				-- open file descriptor
 *	const struct netbuf *svcaddr;		-- servers address
 *	const rpcprog_t prog;			-- program number
 *	const rpcvers_t vers;			-- version number
 *	const uint_t sendsz;			-- buffer recv size
 *	const uint_t recvsz;			-- buffer send size
 */
#else
extern CLIENT * clnt_vc_create();
#endif

/*
 * Low level clnt create routine for connectionless transports, e.g. udp.
 */
#ifdef __STDC__
extern  CLIENT * clnt_dg_create(const int, struct netbuf *,
	const rpcprog_t, const rpcvers_t, const uint_t, const uint_t);
/*
 *	const int fd;				-- open file descriptor
 *	const struct netbuf *svcaddr;		-- servers address
 *	const rpcprog_t program;		-- program number
 *	const rpcvers_t version;		-- version number
 *	const uint_t sendsz;			-- buffer recv size
 *	const uint_t recvsz;			-- buffer send size
 */
#else
extern CLIENT * clnt_dg_create();
#endif

/*
 * Memory based rpc (for speed check and testing)
 * CLIENT *
 * clnt_raw_create(prog, vers)
 *	const rpcprog_t prog;			-- program number
 *	const rpcvers_t vers;			-- version number
 */
#ifdef __STDC__
extern CLIENT *clnt_raw_create(const rpcprog_t, const rpcvers_t);
#else
extern CLIENT *clnt_raw_create();
#endif

/*
 * Client creation routine over doors transport.
 */
#ifdef __STDC__
extern  CLIENT * clnt_door_create(const rpcprog_t, const rpcvers_t,
	const uint_t);
/*
 *	const rpcprog_t prog;			-- program number
 *	const rpcvers_t vers;			-- version number
 *	const uint_t sendsz;			-- max send size
 */
#else
extern CLIENT * clnt_door_create();
#endif

/*
 * internal function. Not for general use. Subject to rapid change.
 */
#ifdef __STDC__
extern CLIENT *clnt_create_service_timed(const char *,
					const char *,
					const rpcprog_t,
					const rpcvers_t,
					const ushort_t,
					const char *,
					const struct timeval *);
#else
extern CLIENT *clnt_create_service_timed();
#endif

/*
 * Print why creation failed
 */
#ifdef __STDC__
void clnt_pcreateerror(const char *);	/* stderr */
char *clnt_spcreateerror(const char *);	/* string */
#else
void clnt_pcreateerror();
char *clnt_spcreateerror();
#endif

/*
 * Like clnt_perror(), but is more verbose in its output
 */
#ifdef __STDC__
void clnt_perrno(const enum clnt_stat);	/* stderr */
#else
void clnt_perrno();
#endif

/*
 * Print an error message, given the client error code
 */
#ifdef __STDC__
void clnt_perror(const CLIENT *, const char *);
#else
void clnt_perror();
#endif

/*
 * If a creation fails, the following allows the user to figure out why.
 */
struct rpc_createerr {
	enum clnt_stat cf_stat;
	struct rpc_err cf_error; /* useful when cf_stat == RPC_PMAPFAILURE */
};

#ifdef	_REENTRANT
extern struct rpc_createerr	*__rpc_createerr();
#define	rpc_createerr	(*(__rpc_createerr()))
#else
extern struct rpc_createerr rpc_createerr;
#endif	/* _REENTRANT */

/*
 * The simplified interface:
 * enum clnt_stat
 * rpc_call(host, prognum, versnum, procnum, inproc, in, outproc, out, nettype)
 *	const char *host;
 *	const rpcprog_t prognum;
 *	const rpcvers_t versnum;
 *	const rpcproc_t procnum;
 *	const xdrproc_t inproc, outproc;
 *	const char *in;
 *	char *out;
 *	const char *nettype;
 */
#ifdef __STDC__
extern enum clnt_stat rpc_call(const char *, const rpcprog_t, const rpcvers_t,
	const rpcproc_t, const xdrproc_t, const char *, const xdrproc_t,
	char *, const char *);
#else
extern enum clnt_stat rpc_call();
#endif

#ifdef	_REENTRANT
extern struct rpc_err	*__rpc_callerr();
#define	rpc_callerr	(*(__rpc_callerr()))
#else
extern struct rpc_err rpc_callerr;
#endif	/* _REENTRANT */

/*
 * RPC broadcast interface
 * The call is broadcasted to all locally connected nets.
 *
 * extern enum clnt_stat
 * rpc_broadcast(prog, vers, proc, xargs, argsp, xresults, resultsp,
 *			eachresult, nettype)
 *	const rpcprog_t		prog;		-- program number
 *	const rpcvers_t		vers;		-- version number
 *	const rpcproc_t		proc;		-- procedure number
 *	const xdrproc_t	xargs;		-- xdr routine for args
 *	caddr_t		argsp;		-- pointer to args
 *	const xdrproc_t	xresults;	-- xdr routine for results
 *	caddr_t		resultsp;	-- pointer to results
 *	const resultproc_t	eachresult;	-- call with each result
 *	const char		*nettype;	-- Transport type
 *
 * For each valid response received, the procedure eachresult is called.
 * Its form is:
 *		done = eachresult(resp, raddr, nconf)
 *			bool_t done;
 *			caddr_t resp;
 *			struct netbuf *raddr;
 *			struct netconfig *nconf;
 * where resp points to the results of the call and raddr is the
 * address if the responder to the broadcast.  nconf is the transport
 * on which the response was received.
 *
 * extern enum clnt_stat
 * rpc_broadcast_exp(prog, vers, proc, xargs, argsp, xresults, resultsp,
 *			eachresult, inittime, waittime, nettype)
 *	const rpcprog_t		prog;		-- program number
 *	const rpcvers_t		vers;		-- version number
 *	const rpcproc_t		proc;		-- procedure number
 *	const xdrproc_t	xargs;		-- xdr routine for args
 *	caddr_t		argsp;		-- pointer to args
 *	const xdrproc_t	xresults;	-- xdr routine for results
 *	caddr_t		resultsp;	-- pointer to results
 *	const resultproc_t	eachresult;	-- call with each result
 *	const int		inittime;	-- how long to wait initially
 *	const int		waittime;	-- maximum time to wait
 *	const char		*nettype;	-- Transport type
 */

typedef bool_t(*resultproc_t)(
#ifdef	__STDC__
	caddr_t,
	... /* for backward compatibility */
#endif				/* __STDC__ */
);
#ifdef __STDC__
extern enum clnt_stat rpc_broadcast(const rpcprog_t, const rpcvers_t,
	const rpcproc_t, const xdrproc_t, caddr_t, const xdrproc_t,
	caddr_t, const resultproc_t, const char *);
extern enum clnt_stat rpc_broadcast_exp(const rpcprog_t, const rpcvers_t,
	const rpcproc_t, const xdrproc_t, caddr_t, const xdrproc_t, caddr_t,
	const resultproc_t, const int, const int, const char *);
#else
extern enum clnt_stat rpc_broadcast();
extern enum clnt_stat rpc_broadcast_exp();
#endif
#endif /* !_KERNEL */

/*
 * Copy error message to buffer.
 */
#ifdef __STDC__
const char *clnt_sperrno(const enum clnt_stat);
#else
char *clnt_sperrno();	/* string */
#endif

/*
 * Print an error message, given the client error code
 */
#ifdef __STDC__
char *clnt_sperror(const CLIENT *, const char *);
#else
char *clnt_sperror();
#endif

/*
 * Client side rpc control routine for rpcbind.
 */
#ifdef __STDC__
bool_t __rpc_control(int, void *);
#else
bool_t __rpc_control();
#endif

#ifdef __cplusplus
}
#endif

#ifdef PORTMAP
/* For backward compatibility */
#include <rpc/clnt_soc.h>
#endif

#endif	/* !_RPC_CLNT_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
 */

/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T
 * All Rights Reserved
 */

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */


/*
 * Implements a kernel based, client side RPC.
 */

#include <sys/param.h>
#include <sys/types.h>
#include <sys/systm.h>
#include <sys/sysmacros.h>
#include <sys/stream.h>
#include <sys/strsubr.h>
#include <sys/ddi.h>
#include <sys/tiuser.h>
#include <sys/tihdr.h>
#include <sys/t_kuser.h>
#include <sys/errno.h>
#include <sys/kmem.h>
#include <sys/debug.h>
#include <sys/kstat.h>
#include <sys/t_lock.h>
#include <sys/cmn_err.h>
#include <sys/conf.h>
#include <sys/disp.h>
#include <sys/taskq.h>
#include <sys/list.h>
#include <sys/atomic.h>
#include <sys/zone.h>
#include <netinet/in.h>
#include <rpc/types.h>
#include <rpc/xdr.h>
#include <rpc/auth.h>
#include <rpc/clnt.h>
#include <rpc/rpc_msg.h>

#include <sys/sdt.h>

static enum clnt_stat clnt_clts_kcallit(CLIENT *, rpcproc_t, xdrproc_t,
		    caddr_t, xdrproc_t, caddr_t, struct timeval);
static void	clnt_clts_kabort(CLIENT *);
static void	clnt_clts_kerror(CLIENT *, struct rpc_err *);
static bool_t	clnt_clts_kfreeres(CLIENT *, xdrproc_t, caddr_t);
static bool_t	clnt_clts_kcontrol(CLIENT *, int, char *);
static void	clnt_clts_kdestroy(CLIENT *);
static int	clnt_clts_ksettimers(CLIENT *, struct rpc_timers *,
		    struct rpc_timers *, int, void (*)(), caddr_t, uint32_t);

/*
 * Operations vector for CLTS based RPC
 */
static struct clnt_ops clts_ops = {
	clnt_clts_kcallit,	/* do rpc call */
	clnt_clts_kabort,	/* abort call */
	clnt_clts_kerror,	/* return error status */
	clnt_clts_kfreeres,	/* free results */
	clnt_clts_kdestroy,	/* destroy rpc handle */
	clnt_clts_kcontrol,	/* the ioctl() of rpc */
	clnt_clts_ksettimers	/* set retry timers */
};

/*
 * Endpoint for CLTS (INET, INET6, loopback, etc.)
 */
typedef struct endpnt_type {
	struct endpnt_type *e_next;	/* pointer to next endpoint type */
	list_t		e_pool;		/* list of available endpoints */
	list_t		e_ilist;	/* list of idle endpoints */
	struct endpnt	*e_pcurr;	/* pointer to current endpoint */
	char		e_protofmly[KNC_STRSIZE];	/* protocol family */
	dev_t		e_rdev;		/* device */
	kmutex_t	e_plock;	/* pool lock */
	kmutex_t	e_ilock;	/* idle list lock */
	timeout_id_t	e_itimer;	/* timer to dispatch the taskq */
	uint_t		e_cnt;		/* number of endpoints in the pool */
	zoneid_t	e_zoneid;	/* zoneid of endpoint type */
	kcondvar_t	e_async_cv;	/* cv for asynchronous reap threads */
	uint_t		e_async_count;	/* count of asynchronous reap threads */
	struct netbuf	e_laddr;	/* endpnt local address */
} endpnt_type_t;

typedef struct endpnt {
	list_node_t	e_node;		/* link to the pool */
	list_node_t	e_idle;		/* link to the idle list */
	endpnt_type_t	*e_type;	/* back pointer to endpoint type */
	TIUSER		*e_tiptr;	/* pointer to transport endpoint */
	queue_t		*e_wq;		/* write queue */
	uint_t		e_flags;	/* endpoint flags */
	uint_t		e_ref;		/* ref count on endpoint */
	kcondvar_t	e_cv;		/* condition variable */
	kmutex_t	e_lock;		/* protects cv and flags */
	time_t		e_itime;	/* time when rele'd */
} endpnt_t;

#define	ENDPNT_ESTABLISHED	0x1	/* endpoint is established */
#define	ENDPNT_WAITING		0x2	/* thread waiting for endpoint */
#define	ENDPNT_BOUND		0x4	/* endpoint is bound */
#define	ENDPNT_STALE		0x8	/* endpoint is dead */
#define	ENDPNT_ONIDLE		0x10	/* endpoint is on the idle list */

static krwlock_t	endpnt_type_lock; /* protects endpnt_type_list */
static endpnt_type_t	*endpnt_type_list = NULL; /* list of CLTS endpoints */
static struct kmem_cache	*endpnt_cache; /* cache of endpnt_t's */
static taskq_t			*endpnt_taskq; /* endpnt_t reaper thread */
static bool_t			taskq_created; /* flag for endpnt_taskq */
static kmutex_t			endpnt_taskq_lock; /* taskq lock */
static zone_key_t		endpnt_destructor_key;

#define	DEFAULT_ENDPOINT_REAP_INTERVAL 60 /* 1 minute */
#define	DEFAULT_INTERVAL_SHIFT 30 /* 30 seconds */

/*
 * Endpoint tunables
 */
static int	clnt_clts_max_endpoints = -1;
static int	clnt_clts_hash_size = DEFAULT_HASH_SIZE;
static time_t	clnt_clts_endpoint_reap_interval = -1;
static clock_t	clnt_clts_taskq_dispatch_interval;

/*
 * Response completion hash queue
 */
static call_table_t *clts_call_ht;

/*
 * Routines for the endpoint manager
 */
static struct endpnt_type *endpnt_type_create(struct knetconfig *);
static void endpnt_type_free(struct endpnt_type *);
static int check_endpnt(struct endpnt *, struct endpnt **);
static struct endpnt *endpnt_get(struct knetconfig *, int, int,
				struct netbuf *);
static void endpnt_rele(struct endpnt *);
static void endpnt_reap_settimer(endpnt_type_t *);
static void endpnt_reap(endpnt_type_t *);
static void endpnt_reap_dispatch(void *);
static void endpnt_reclaim(zoneid_t);


/*
 * Request dipatching function.
 */
static int clnt_clts_dispatch_send(queue_t *q, mblk_t *, struct netbuf *addr,
					calllist_t *, uint_t, cred_t *);

/*
 * The size of the preserialized RPC header information.
 */
#define	CKU_HDRSIZE	20
/*
 * The initial allocation size.  It is small to reduce space requirements.
 */
#define	CKU_INITSIZE	2048
/*
 * The size of additional allocations, if required.  It is larger to
 * reduce the number of actual allocations.
 */
#define	CKU_ALLOCSIZE	8192

/*
 * Private data per rpc handle.  This structure is allocated by
 * clnt_clts_kcreate, and freed by clnt_clts_kdestroy.
 */
struct cku_private {
	CLIENT			 cku_client;	/* client handle */
	int			 cku_retrys;	/* request retrys */
	calllist_t		 cku_call;
	struct endpnt		*cku_endpnt;	/* open end point */
	struct knetconfig	 cku_config;
	struct netbuf		 cku_addr;	/* remote address */
	struct netbuf		 cku_lcladdr;	/* local address */
	struct rpc_err		 cku_err;	/* error status */
	XDR			 cku_outxdr;	/* xdr stream for output */
	XDR			 cku_inxdr;	/* xdr stream for input */
	char			 cku_rpchdr[CKU_HDRSIZE + 4]; /* rpc header */
	struct cred		*cku_cred;	/* credentials */
	struct rpc_timers	*cku_timers;	/* for estimating RTT */
	struct rpc_timers	*cku_timeall;	/* for estimating RTT */
	void			 (*cku_feedback)(int, int, caddr_t);
						/* ptr to feedback rtn */
	caddr_t			 cku_feedarg;	/* argument for feedback func */
	uint32_t		 cku_xid;	/* current XID */
	bool_t			 cku_bcast;	/* RPC broadcast hint */
	int			cku_useresvport; /* Use reserved port */
	int			cku_bindsrc;	/* Use source address */
	struct rpc_clts_client	*cku_stats;	/* counters for the zone */
};

static const struct rpc_clts_client {
	kstat_named_t	rccalls;
	kstat_named_t	rcbadcalls;
	kstat_named_t	rcretrans;
	kstat_named_t	rcbadxids;
	kstat_named_t	rctimeouts;
	kstat_named_t	rcnewcreds;
	kstat_named_t	rcbadverfs;
	kstat_named_t	rctimers;
	kstat_named_t	rcnomem;
	kstat_named_t	rccantsend;
} clts_rcstat_tmpl = {
	{ "calls",	KSTAT_DATA_UINT64 },
	{ "badcalls",	KSTAT_DATA_UINT64 },
	{ "retrans",	KSTAT_DATA_UINT64 },
	{ "badxids",	KSTAT_DATA_UINT64 },
	{ "timeouts",	KSTAT_DATA_UINT64 },
	{ "newcreds",	KSTAT_DATA_UINT64 },
	{ "badverfs",	KSTAT_DATA_UINT64 },
	{ "timers",	KSTAT_DATA_UINT64 },
	{ "nomem",	KSTAT_DATA_UINT64 },
	{ "cantsend",	KSTAT_DATA_UINT64 },
};

static uint_t clts_rcstat_ndata =
	sizeof (clts_rcstat_tmpl) / sizeof (kstat_named_t);

#define	RCSTAT_INCR(s, x)			\
	atomic_inc_64(&(s)->x.value.ui64)

#define	ptoh(p)		(&((p)->cku_client))
#define	htop(h)		((struct cku_private *)((h)->cl_private))

/*
 * Times to retry
 */
#define	SNDTRIES	4
#define	REFRESHES	2	/* authentication refreshes */

/*
 * The following is used to determine the global default behavior for
 * CLTS when binding to a local port.
 *
 * If the value is set to 1 the default will be to select a reserved
 * (aka privileged) port, if the value is zero the default will be to
 * use non-reserved ports.  Users of kRPC may override this by using
 * CLNT_CONTROL() and CLSET_BINDRESVPORT.
 */
static int clnt_clts_do_bindresvport = 1;

#define	BINDRESVPORT_RETRIES 5

void
clnt_clts_stats_init(zoneid_t zoneid, struct rpc_clts_client **statsp)
{
	kstat_t *ksp;
	kstat_named_t *knp;

	knp = rpcstat_zone_init_common(zoneid, "unix", "rpc_clts_client",
	    (const kstat_named_t *)&clts_rcstat_tmpl,
	    sizeof (clts_rcstat_tmpl));
	/*
	 * Backwards compatibility for old kstat clients
	 */
	ksp = kstat_create_zone("unix", 0, "rpc_client", "rpc",
	    KSTAT_TYPE_NAMED, clts_rcstat_ndata,
	    KSTAT_FLAG_VIRTUAL | KSTAT_FLAG_WRITABLE, zoneid);
	if (ksp) {
		ksp->ks_data = knp;
		kstat_install(ksp);
	}
	*statsp = (struct rpc_clts_client *)knp;
}

void
clnt_clts_stats_fini(zoneid_t zoneid, struct rpc_clts_client **statsp)
{
	rpcstat_zone_fini_common(zoneid, "unix", "rpc_clts_client");
	kstat_delete_byname_zone("unix", 0, "rpc_client", zoneid);
	kmem_free(*statsp, sizeof (clts_rcstat_tmpl));
}

/*
 * Create an rpc handle for a clts rpc connection.
 * Allocates space for the handle structure and the private data.
 */
/* ARGSUSED */
int
clnt_clts_kcreate(struct knetconfig *config, struct netbuf *addr,
    rpcprog_t pgm, rpcvers_t vers, int retrys, struct cred *cred,
    CLIENT **cl)
{
	CLIENT *h;
	struct cku_private *p;
	struct rpc_msg call_msg;
	int error;
	int plen;

	if (cl == NULL)
		return (EINVAL);

	*cl = NULL;
	error = 0;

	p = kmem_zalloc(sizeof (*p), KM_SLEEP);

	h = ptoh(p);

	/* handle */
	h->cl_ops = &clts_ops;
	h->cl_private = (caddr_t)p;
	h->cl_auth = authkern_create();

	/* call message, just used to pre-serialize below */
	call_msg.rm_xid = 0;
	call_msg.rm_direction = CALL;
	call_msg.rm_call.cb_rpcvers = RPC_MSG_VERSION;
	call_msg.rm_call.cb_prog = pgm;
	call_msg.rm_call.cb_vers = vers;

	/* private */
	clnt_clts_kinit(h, addr, retrys, cred);

	xdrmem_create(&p->cku_outxdr, p->cku_rpchdr, CKU_HDRSIZE, XDR_ENCODE);

	/* pre-serialize call message header */
	if (!xdr_callhdr(&p->cku_outxdr, &call_msg)) {
		XDR_DESTROY(&p->cku_outxdr);
		error = EINVAL;		/* XXX */
		goto bad;
	}
	XDR_DESTROY(&p->cku_outxdr);

	p->cku_config.knc_rdev = config->knc_rdev;
	p->cku_config.knc_semantics = config->knc_semantics;
	plen = strlen(config->knc_protofmly) + 1;
	p->cku_config.knc_protofmly = kmem_alloc(plen, KM_SLEEP);
	bcopy(config->knc_protofmly, p->cku_config.knc_protofmly, plen);
	p->cku_useresvport = -1; /* value has not been set */
	p->cku_bindsrc = 0; /* value has not been set */

	cv_init(&p->cku_call.call_cv, NULL, CV_DEFAULT, NULL);
	mutex_init(&p->cku_call.call_lock, NULL, MUTEX_DEFAULT, NULL);

	*cl = h;
	return (0);

bad:
	auth_destroy(h->cl_auth);
	kmem_free(p->cku_addr.buf, addr->maxlen);
	kmem_free(p, sizeof (struct cku_private));

	return (error);
}

void
clnt_clts_kinit(CLIENT *h, struct netbuf *addr, int retrys, cred_t *cred)
{
	/* LINTED pointer alignment */
	struct cku_private *p = htop(h);
	struct rpcstat *rsp;

	rsp = zone_getspecific(rpcstat_zone_key, rpc_zone());
	ASSERT(rsp != NULL);

	p->cku_retrys = retrys;

	if (p->cku_addr.maxlen < addr->maxlen) {
		if (p->cku_addr.maxlen != 0 && p->cku_addr.buf != NULL)
			kmem_free(p->cku_addr.buf, p->cku_addr.maxlen);

		p->cku_addr.buf = kmem_zalloc(addr->maxlen, KM_SLEEP);
		p->cku_addr.maxlen = addr->maxlen;
	}

	p->cku_addr.len = addr->len;
	bcopy(addr->buf, p->cku_addr.buf, addr->len);

	p->cku_cred = cred;
	p->cku_xid = 0;
	p->cku_timers = NULL;
	p->cku_timeall = NULL;
	p->cku_feedback = NULL;
	p->cku_bcast = FALSE;
	p->cku_call.call_xid = 0;
	p->cku_call.call_hash = 0;
	p->cku_call.call_notified = FALSE;
	p->cku_call.call_next = NULL;
	p->cku_call.call_prev = NULL;
	p->cku_call.call_reply = NULL;
	p->cku_call.call_wq = NULL;
	p->cku_stats = rsp->rpc_clts_client;
}

/*
 * set the timers.  Return current retransmission timeout.
 */
static int
clnt_clts_ksettimers(CLIENT *h, struct rpc_timers *t, struct rpc_timers *all,
    int minimum, void (*feedback)(int, int, caddr_t), caddr_t arg,
    uint32_t xid)
{
	/* LINTED pointer alignment */
	struct cku_private *p = htop(h);
	int value;

	p->cku_feedback = feedback;
	p->cku_feedarg = arg;
	p->cku_timers = t;
	p->cku_timeall = all;
	if (xid)
		p->cku_xid = xid;
	value = all->rt_rtxcur;
	value += t->rt_rtxcur;
	if (value < minimum)
		return (minimum);
	RCSTAT_INCR(p->cku_stats, rctimers);
	return (value);
}

/*
 * Time out back off function. tim is in HZ
 */
#define	MAXTIMO	(20 * hz)
#define	backoff(tim)	(((tim) < MAXTIMO) ? dobackoff(tim) : (tim))
#define	dobackoff(tim)	((((tim) << 1) > MAXTIMO) ? MAXTIMO : ((tim) << 1))

#define	RETRY_POLL_TIMO	30

/*
 * Call remote procedure.
 * Most of the work of rpc is done here.  We serialize what is left
 * of the header (some was pre-serialized in the handle), serialize
 * the arguments, and send it off.  We wait for a reply or a time out.
 * Timeout causes an immediate return, other packet problems may cause
 * a retry on the receive.  When a good packet is received we deserialize
 * it, and check verification.  A bad reply code will cause one retry
 * with full (longhand) credentials.
 */
enum clnt_stat
clnt_clts_kcallit_addr(CLIENT *h, rpcproc_t procnum, xdrproc_t xdr_args,
    caddr_t argsp, xdrproc_t xdr_results, caddr_t resultsp,
    struct timeval wait, struct netbuf *sin)
{
	/* LINTED pointer alignment */
	struct cku_private *p = htop(h);
	XDR *xdrs;
	int stries = p->cku_retrys;
	int refreshes = REFRESHES;	/* number of times to refresh cred */
	int round_trip;			/* time the RPC */
	int error;
	mblk_t *mp;
	mblk_t *mpdup;
	mblk_t *resp = NULL;
	mblk_t *tmp;
	calllist_t *call = &p->cku_call;
	clock_t ori_timout, timout;
	bool_t interrupted;
	enum clnt_stat status;
	struct rpc_msg reply_msg;
	enum clnt_stat re_status;
	endpnt_t *endpt;

	RCSTAT_INCR(p->cku_stats, rccalls);

	RPCLOG(2, "clnt_clts_kcallit_addr: wait.tv_sec: %ld\n", wait.tv_sec);
	RPCLOG(2, "clnt_clts_kcallit_addr: wait.tv_usec: %ld\n", wait.tv_usec);

	timout = TIMEVAL_TO_TICK(&wait);
	ori_timout = timout;

	if (p->cku_xid == 0) {
		p->cku_xid = alloc_xid();
		if (p->cku_endpnt != NULL)
			endpnt_rele(p->cku_endpnt);
		p->cku_endpnt = NULL;
	}
	call->call_zoneid = rpc_zoneid();

	mpdup = NULL;
call_again:

	if (mpdup == NULL) {

		while ((mp = allocb(CKU_INITSIZE, BPRI_LO)) == NULL) {
			if (strwaitbuf(CKU_INITSIZE, BPRI_LO)) {
				p->cku_err.re_status = RPC_SYSTEMERROR;
				p->cku_err.re_errno = ENOSR;
				goto done;
			}
		}

		xdrs = &p->cku_outxdr;
		xdrmblk_init(xdrs, mp, XDR_ENCODE, CKU_ALLOCSIZE);

		if (h->cl_auth->ah_cred.oa_flavor != RPCSEC_GSS) {
			/*
			 * Copy in the preserialized RPC header
			 * information.
			 */
			bcopy(p->cku_rpchdr, mp->b_rptr, CKU_HDRSIZE);

			/*
			 * transaction id is the 1st thing in the output
			 * buffer.
			 */
			/* LINTED pointer alignment */
			(*(uint32_t *)(mp->b_rptr)) = p->cku_xid;

			/* Skip the preserialized stuff. */
			XDR_SETPOS(xdrs, CKU_HDRSIZE);

			/* Serialize dynamic stuff into the output buffer. */
			if ((!XDR_PUTINT32(xdrs, (int32_t *)&procnum)) ||
			    (!AUTH_MARSHALL(h->cl_auth, xdrs, p->cku_cred)) ||
			    (!(*xdr_args)(xdrs, argsp))) {
				XDR_DESTROY(xdrs);
				freemsg(mp);
				p->cku_err.re_status = RPC_CANTENCODEARGS;
				p->cku_err.re_errno = EIO;
				goto done;
			}
		} else {
			uint32_t *uproc = (uint32_t *)
			    &p->cku_rpchdr[CKU_HDRSIZE];
			IXDR_PUT_U_INT32(uproc, procnum);

			(*(uint32_t *)(&p->cku_rpchdr[0])) = p->cku_xid;
			XDR_SETPOS(xdrs, 0);

			/* Serialize the procedure number and the arguments. */
			if (!AUTH_WRAP(h->cl_auth, (caddr_t)p->cku_rpchdr,
			    CKU_HDRSIZE+4, xdrs, xdr_args, argsp)) {
				XDR_DESTROY(xdrs);
				freemsg(mp);
				p->cku_err.re_status = RPC_CANTENCODEARGS;
				p->cku_err.re_errno = EIO;
				goto done;
			}
		}

		XDR_DESTROY(xdrs);
	} else
		mp = mpdup;

	mpdup = dupmsg(mp);
	if (mpdup == NULL) {
		freemsg(mp);
		p->cku_err.re_status = RPC_SYSTEMERROR;
		p->cku_err.re_errno = ENOSR;
		goto done;
	}

	/*
	 * Grab an endpnt only if the endpoint is NULL.  We could be retrying
	 * the request and in this case we want to go through the same
	 * source port, so that the duplicate request cache may detect a
	 * retry.
	 */

	if (p->cku_endpnt == NULL)
		p->cku_endpnt = endpnt_get(&p->cku_config, p->cku_useresvport,
		    p->cku_bindsrc, &p->cku_lcladdr);

	if (p->cku_endpnt == NULL) {
		freemsg(mp);
		p->cku_err.re_status = RPC_SYSTEMERROR;
		p->cku_err.re_errno = ENOSR;
		goto done;
	}

	round_trip = ddi_get_lbolt();

	error = clnt_clts_dispatch_send(p->cku_endpnt->e_wq, mp,
	    &p->cku_addr, call, p->cku_xid, p->cku_cred);

	if (error != 0) {
		freemsg(mp);
		p->cku_err.re_status = RPC_CANTSEND;
		p->cku_err.re_errno = error;
		RCSTAT_INCR(p->cku_stats, rccantsend);
		goto done1;
	}

	RPCLOG(64, "clnt_clts_kcallit_addr: sent call for xid 0x%x\n",
	    p->cku_xid);

	/*
	 * There are two reasons for which we go back to to tryread.
	 *
	 * a) In case the status is RPC_PROCUNAVAIL and we sent out a
	 *    broadcast we should not get any invalid messages with the
	 *    RPC_PROCUNAVAIL error back. Some broken RPC implementations
	 *    send them and for this we have to ignore them ( as we would
	 *    have never received them ) and look for another message
	 *    which might contain the valid response because we don't know
	 *    how many broken implementations are in the network. So we are
	 *    going to loop until
	 *    - we received a valid response
	 *    - we have processed all invalid responses and
	 *	got a time out when we try to receive again a
	 *	message.
	 *
	 * b) We will jump back to tryread also in case we failed
	 *    within the AUTH_VALIDATE. In this case we should move
	 *    on and loop until we received a valid response or we
	 *    have processed all responses with broken authentication
	 *    and we got a time out when we try to receive a message.
	 */
tryread:
	mutex_enter(&call->call_lock);
	interrupted = FALSE;
	if (call->call_notified == FALSE) {
		klwp_t *lwp = ttolwp(curthread);
		clock_t cv_wait_ret = 1; /* init to > 0 */
		clock_t cv_timout = timout;

		if (lwp != NULL)
			lwp->lwp_nostop++;

		cv_timout += ddi_get_lbolt();

		if (h->cl_nosignal)
			while ((cv_wait_ret =
			    cv_timedwait(&call->call_cv,
			    &call->call_lock, cv_timout)) > 0 &&
			    call->call_notified == FALSE)
				;
		else
			while ((cv_wait_ret =
			    cv_timedwait_sig(&call->call_cv,
			    &call->call_lock, cv_timout)) > 0 &&
			    call->call_notified == FALSE)
				;

		if (cv_wait_ret == 0)
			interrupted = TRUE;

		if (lwp != NULL)
			lwp->lwp_nostop--;
	}
	resp = call->call_reply;
	call->call_reply = NULL;
	status = call->call_status;
	/*
	 * We have to reset the call_notified here. In case we have
	 * to do a retry ( e.g. in case we got a RPC_PROCUNAVAIL
	 * error ) we need to set this to false to ensure that
	 * we will wait for the next message. When the next message
	 * is going to arrive the function clnt_clts_dispatch_notify
	 * will set this to true again.
	 */
	call->call_notified = FALSE;
	call->call_status = RPC_TIMEDOUT;
	mutex_exit(&call->call_lock);

	if (status == RPC_TIMEDOUT) {
		if (interrupted) {
			/*
			 * We got interrupted, bail out
			 */
			p->cku_err.re_status = RPC_INTR;
			p->cku_err.re_errno = EINTR;
			goto done1;
		} else {
			RPCLOG(8, "clnt_clts_kcallit_addr: "
			    "request w/xid 0x%x timedout "
			    "waiting for reply\n", p->cku_xid);
#if 0 /* XXX not yet */
			/*
			 * Timeout may be due to a dead gateway. Send
			 * an ioctl downstream advising deletion of
			 * route when we reach the half-way point to
			 * timing out.
			 */
			if (stries == p->cku_retrys/2) {
				t_kadvise(p->cku_endpnt->e_tiptr,
				    (uchar_t *)p->cku_addr.buf,
				    p->cku_addr.len);
			}
#endif /* not yet */
			p->cku_err.re_status = RPC_TIMEDOUT;
			p->cku_err.re_errno = ETIMEDOUT;
			RCSTAT_INCR(p->cku_stats, rctimeouts);
			goto done1;
		}
	}

	ASSERT(resp != NULL);

	/*
	 * Prepare the message for further processing.  We need to remove
	 * the datagram header and copy the source address if necessary.  No
	 * need to verify the header since rpcmod took care of that.
	 */
	/*
	 * Copy the source address if the caller has supplied a netbuf.
	 */
	if (sin != NULL) {
		union T_primitives *pptr;

		pptr = (union T_primitives *)resp->b_rptr;
		bcopy(resp->b_rptr + pptr->unitdata_ind.SRC_offset, sin->buf,
		    pptr->unitdata_ind.SRC_length);
		sin->len = pptr->unitdata_ind.SRC_length;
	}

	/*
	 * Pop off the datagram header.
	 * It was retained in rpcmodrput().
	 */
	tmp = resp;
	resp = resp->b_cont;
	tmp->b_cont = NULL;
	freeb(tmp);

	round_trip = ddi_get_lbolt() - round_trip;
	/*
	 * Van Jacobson timer algorithm here, only if NOT a retransmission.
	 */
	if (p->cku_timers != NULL && stries == p->cku_retrys) {
		int rt;

		rt = round_trip;
		rt -= (p->cku_timers->rt_srtt >> 3);
		p->cku_timers->rt_srtt += rt;
		if (rt < 0)
			rt = - rt;
		rt -= (p->cku_timers->rt_deviate >> 2);
		p->cku_timers->rt_deviate += rt;
		p->cku_timers->rt_rtxcur =
		    (clock_t)((p->cku_timers->rt_srtt >> 2) +
		    p->cku_timers->rt_deviate) >> 1;

		rt = round_trip;
		rt -= (p->cku_timeall->rt_srtt >> 3);
		p->cku_timeall->rt_srtt += rt;
		if (rt < 0)
			rt = - rt;
		rt -= (p->cku_timeall->rt_deviate >> 2);
		p->cku_timeall->rt_deviate += rt;
		p->cku_timeall->rt_rtxcur =
		    (clock_t)((p->cku_timeall->rt_srtt >> 2) +
		    p->cku_timeall->rt_deviate) >> 1;
		if (p->cku_feedback != NULL) {
			(*p->cku_feedback)(FEEDBACK_OK, procnum,
			    p->cku_feedarg);
		}
	}

	/*
	 * Process reply
	 */
	xdrs = &(p->cku_inxdr);
	xdrmblk_init(xdrs, resp, XDR_DECODE, 0);

	reply_msg.rm_direction = REPLY;
	reply_msg.rm_reply.rp_stat = MSG_ACCEPTED;
	reply_msg.acpted_rply.ar_stat = SUCCESS;
	reply_msg.acpted_rply.ar_verf = _null_auth;
	/*
	 *  xdr_results will be done in AUTH_UNWRAP.
	 */
	reply_msg.acpted_rply.ar_results.where = NULL;
	reply_msg.acpted_rply.ar_results.proc = xdr_void;

	/*
	 * Decode and validate the response.
	 */
	if (!xdr_replymsg(xdrs, &reply_msg)) {
		p->cku_err.re_status = RPC_CANTDECODERES;
		p->cku_err.re_errno = EIO;
		(void) xdr_rpc_free_verifier(xdrs, &reply_msg);
		XDR_DESTROY(xdrs);
		goto done1;
	}

	_seterr_reply(&reply_msg, &(p->cku_err));

	re_status = p->cku_err.re_status;
	if (re_status == RPC_SUCCESS) {
		/*
		 * Reply is good, check auth.
		 */
		if (!AUTH_VALIDATE(h->cl_auth,
		    &reply_msg.acpted_rply.ar_verf)) {
			p->cku_err.re_status = RPC_AUTHERROR;
			p->cku_err.re_why = AUTH_INVALIDRESP;
			RCSTAT_INCR(p->cku_stats, rcbadverfs);
			(void) xdr_rpc_free_verifier(xdrs, &reply_msg);
			XDR_DESTROY(xdrs);
			goto tryread;
		}
		if (!AUTH_UNWRAP(h->cl_auth, xdrs, xdr_results, resultsp)) {
			p->cku_err.re_status = RPC_CANTDECODERES;
			p->cku_err.re_errno = EIO;
		}
		(void) xdr_rpc_free_verifier(xdrs, &reply_msg);
		XDR_DESTROY(xdrs);
		goto done1;
	}
	/* set errno in case we can't recover */
	if (re_status != RPC_VERSMISMATCH &&
	    re_status != RPC_AUTHERROR && re_status != RPC_PROGVERSMISMATCH)
		p->cku_err.re_errno = EIO;
	/*
	 * Determine whether or not we're doing an RPC
	 * broadcast. Some server implementations don't
	 * follow RFC 1050, section 7.4.2 in that they
	 * don't remain silent when they see a proc
	 * they don't support. Therefore we keep trying
	 * to receive on RPC_PROCUNAVAIL, hoping to get
	 * a valid response from a compliant server.
	 */
	if (re_status == RPC_PROCUNAVAIL && p->cku_bcast) {
		(void) xdr_rpc_free_verifier(xdrs, &reply_msg);
		XDR_DESTROY(xdrs);
		goto tryread;
	}
	if (re_status == RPC_AUTHERROR) {

		(void) xdr_rpc_free_verifier(xdrs, &reply_msg);
		XDR_DESTROY(xdrs);
		call_table_remove(call);
		if (call->call_reply != NULL) {
			freemsg(call->call_reply);
			call->call_reply = NULL;
		}

		/*
		 * Maybe our credential need to be refreshed
		 */
		if (refreshes > 0 &&
		    AUTH_REFRESH(h->cl_auth, &reply_msg, p->cku_cred)) {
			/*
			 * The credential is refreshed. Try the request again.
			 * Even if stries == 0, we still retry as long as
			 * refreshes > 0. This prevents a soft authentication
			 * error turning into a hard one at an upper level.
			 */
			refreshes--;
			RCSTAT_INCR(p->cku_stats, rcbadcalls);
			RCSTAT_INCR(p->cku_stats, rcnewcreds);

			freemsg(mpdup);
			mpdup = NULL;
			freemsg(resp);
			resp = NULL;
			goto call_again;
		}
		/*
		 * We have used the client handle to do an AUTH_REFRESH
		 * and the RPC status may be set to RPC_SUCCESS;
		 * Let's make sure to set it to RPC_AUTHERROR.
		 */
		p->cku_err.re_status = RPC_CANTDECODERES;

		/*
		 * Map recoverable and unrecoverable
		 * authentication errors to appropriate errno
		 */
		switch (p->cku_err.re_why) {
		case AUTH_TOOWEAK:
			/*
			 * Could be an nfsportmon failure, set
			 * useresvport and try again.
			 */
			if (p->cku_useresvport != 1) {
				p->cku_useresvport = 1;

				freemsg(mpdup);
				mpdup = NULL;
				freemsg(resp);
				resp = NULL;

				endpt = p->cku_endpnt;
				if (endpt->e_tiptr != NULL) {
					mutex_enter(&endpt->e_lock);
					endpt->e_flags &= ~ENDPNT_BOUND;
					(void) t_kclose(endpt->e_tiptr, 1);
					endpt->e_tiptr = NULL;
					mutex_exit(&endpt->e_lock);

				}

				p->cku_xid = alloc_xid();
				endpnt_rele(p->cku_endpnt);
				p->cku_endpnt = NULL;
				goto call_again;
			}
			/* FALLTHRU */
		case AUTH_BADCRED:
		case AUTH_BADVERF:
		case AUTH_INVALIDRESP:
		case AUTH_FAILED:
		case RPCSEC_GSS_NOCRED:
		case RPCSEC_GSS_FAILED:
			p->cku_err.re_errno = EACCES;
			break;
		case AUTH_REJECTEDCRED:
		case AUTH_REJECTEDVERF:
		default:
			p->cku_err.re_errno = EIO;
			break;
		}
		RPCLOG(1, "clnt_clts_kcallit : authentication failed "
		    "with RPC_AUTHERROR of type %d\n",
		    p->cku_err.re_why);
		goto done;
	}

	(void) xdr_rpc_free_verifier(xdrs, &reply_msg);
	XDR_DESTROY(xdrs);

done1:
	call_table_remove(call);
	if (call->call_reply != NULL) {
		freemsg(call->call_reply);
		call->call_reply = NULL;
	}
	RPCLOG(64, "clnt_clts_kcallit_addr: xid 0x%x taken off dispatch list",
	    p->cku_xid);

done:
	if (resp != NULL) {
		freemsg(resp);
		resp = NULL;
	}

	if ((p->cku_err.re_status != RPC_SUCCESS) &&
	    (p->cku_err.re_status != RPC_INTR) &&
	    (p->cku_err.re_status != RPC_UDERROR) &&
	    !IS_UNRECOVERABLE_RPC(p->cku_err.re_status)) {
		if (p->cku_feedback != NULL && stries == p->cku_retrys) {
			(*p->cku_feedback)(FEEDBACK_REXMIT1, procnum,
			    p->cku_feedarg);
		}

		timout = backoff(timout);
		if (p->cku_timeall != (struct rpc_timers *)0)
			p->cku_timeall->rt_rtxcur = timout;

		if (p->cku_err.re_status == RPC_SYSTEMERROR ||
		    p->cku_err.re_status == RPC_CANTSEND) {
			/*
			 * Errors due to lack of resources, wait a bit
			 * and try again.
			 */
			(void) delay(hz/10);
		}
		if (stries-- > 0) {
			RCSTAT_INCR(p->cku_stats, rcretrans);
			goto call_again;
		}
	}

	if (mpdup != NULL)
		freemsg(mpdup);

	if (p->cku_err.re_status != RPC_SUCCESS) {
		RCSTAT_INCR(p->cku_stats, rcbadcalls);
	}

	/*
	 * Allow the endpoint to be held by the client handle in case this
	 * RPC was not successful.  A retry may occur at a higher level and
	 * in this case we may want to send the request over the same
	 * source port.
	 * Endpoint is also released for one-way RPC: no reply, nor retransmit
	 * is expected.
	 */
	if ((p->cku_err.re_status == RPC_SUCCESS ||
	    (p->cku_err.re_status == RPC_TIMEDOUT && ori_timout == 0)) &&
	    p->cku_endpnt != NULL) {
		endpnt_rele(p->cku_endpnt);
		p->cku_endpnt = NULL;
	} else {
		DTRACE_PROBE2(clnt_clts_kcallit_done, int, p->cku_err.re_status,
		    struct endpnt *, p->cku_endpnt);
	}

	return (p->cku_err.re_status);
}

static enum clnt_stat
clnt_clts_kcallit(CLIENT *h, rpcproc_t procnum, xdrproc_t xdr_args,
    caddr_t argsp, xdrproc_t xdr_results, caddr_t resultsp,
    struct timeval wait)
{
	return (clnt_clts_kcallit_addr(h, procnum, xdr_args, argsp,
	    xdr_results, resultsp, wait, NULL));
}

/*
 * Return error info on this handle.
 */
static void
clnt_clts_kerror(CLIENT *h, struct rpc_err *err)
{
	/* LINTED pointer alignment */
	struct cku_private *p = htop(h);

	*err = p->cku_err;
}

/*ARGSUSED*/
static bool_t
clnt_clts_kfreeres(CLIENT *h, xdrproc_t xdr_res, caddr_t res_ptr)
{
	xdr_free(xdr_res, res_ptr);

	return (TRUE);
}

/*ARGSUSED*/
static void
clnt_clts_kabort(CLIENT *h)
{
}

static bool_t
clnt_clts_kcontrol(CLIENT *h, int cmd, char *arg)
{
	/* LINTED pointer alignment */
	struct cku_private *p = htop(h);

	switch (cmd) {
	case CLSET_XID:
		p->cku_xid = *((uint32_t *)arg);
		return (TRUE);

	case CLGET_XID:
		*((uint32_t *)arg) = p->cku_xid;
		return (TRUE);

	case CLSET_NODELAYONERR:
		/*
		 * CLTS does not have this functionality, but
		 * we return TRUE here to avoid error messages.
		 */
		return (TRUE);

	case CLGET_NODELAYONERR:
		/* CLTS does not support this functionality. */
		return (FALSE);

	case CLSET_BCAST:
		p->cku_bcast = *((uint32_t *)arg);
		return (TRUE);

	case CLGET_BCAST:
		*((uint32_t *)arg) = p->cku_bcast;
		return (TRUE);
	case CLSET_BINDRESVPORT:
		if (arg == NULL)
			return (FALSE);

		if (*(int *)arg != 1 && *(int *)arg != 0)
			return (FALSE);

		p->cku_useresvport = *(int *)arg;

		return (TRUE);

	case CLGET_BINDRESVPORT:
		if (arg == NULL)
			return (FALSE);

		*(int *)arg = p->cku_useresvport;

		return (TRUE);

	case CLSET_BINDSRCADDR:
		if (arg == NULL)
			return (FALSE);

		struct netbuf *addr = (struct netbuf *)arg;
		clnt_dup_netbuf(addr, &p->cku_lcladdr);
		p->cku_bindsrc = 1;

		return (TRUE);

	default:
		return (FALSE);
	}
}

/*
 * Destroy rpc handle.
 * Frees the space used for output buffer, private data, and handle
 * structure, and the file pointer/TLI data on last reference.
 */
static void
clnt_clts_kdestroy(CLIENT *h)
{
	/* LINTED pointer alignment */
	struct cku_private *p = htop(h);
	calllist_t *call = &p->cku_call;

	int plen;

	RPCLOG(8, "clnt_clts_kdestroy h: %p\n", (void *)h);
	RPCLOG(8, "clnt_clts_kdestroy h: xid=0x%x\n", p->cku_xid);

	if (p->cku_endpnt != NULL)
		endpnt_rele(p->cku_endpnt);

	cv_destroy(&call->call_cv);
	mutex_destroy(&call->call_lock);

	plen = strlen(p->cku_config.knc_protofmly) + 1;
	kmem_free(p->cku_config.knc_protofmly, plen);
	kmem_free(p->cku_addr.buf, p->cku_addr.maxlen);
	kmem_free(p->cku_lcladdr.buf, p->cku_lcladdr.maxlen);
	kmem_free(p, sizeof (*p));
}

/*
 * The connectionless (CLTS) kRPC endpoint management subsystem.
 *
 * Because endpoints are potentially shared among threads making RPC calls,
 * they are managed in a pool according to type (endpnt_type_t).  Each
 * endpnt_type_t points to a list of usable endpoints through the e_pool
 * field, which is of type list_t.  list_t is a doubly-linked list.
 * The number of endpoints in the pool is stored in the e_cnt field of
 * endpnt_type_t and the endpoints are reference counted using the e_ref field
 * in the endpnt_t structure.
 *
 * As an optimization, endpoints that have no references are also linked
 * to an idle list via e_ilist which is also of type list_t.  When a thread
 * calls endpnt_get() to obtain a transport endpoint, the idle list is first
 * consulted and if such an endpoint exists, it is removed from the idle list
 * and returned to the caller.
 *
 * If the idle list is empty, then a check is made to see if more endpoints
 * can be created.  If so, we proceed and create a new endpoint which is added
 * to the pool and returned to the caller.  If we have reached the limit and
 * cannot make a new endpoint then one is returned to the caller via round-
 * robin policy.
 *
 * When an endpoint is placed on the idle list by a thread calling
 * endpnt_rele(), it is timestamped and then a reaper taskq is scheduled to
 * be dispatched if one hasn't already been.  When the timer fires, the
 * taskq traverses the idle list and checks to see which endpoints are
 * eligible to be closed.  It determines this by checking if the timestamp
 * when the endpoint was released has exceeded the the threshold for how long
 * it should stay alive.
 *
 * endpnt_t structures remain persistent until the memory reclaim callback,
 * endpnt_reclaim(), is invoked.
 *
 * Here is an example of how the data structures would be laid out by the
 * subsystem:
 *
 *       endpnt_type_t
 *
 *	 loopback		                  inet
 *	 _______________	                  ______________
 *	| e_next        |----------------------->| e_next       |---->>
 *	| e_pool        |<---+                   | e_pool       |<----+
 *	| e_ilist       |<---+--+                | e_ilist      |<----+--+
 *   +->| e_pcurr       |----+--+--+	      +->| e_pcurr      |-----+--+--+
 *   |	| ...           |    |  |  |	      |	 | ...	        |     |  |  |
 *   |	| e_itimer (90) |    |  |  |	      |	 | e_itimer (0) |     |  |  |
 *   |	| e_cnt (1)     |    |  |  |	      |	 | e_cnt (3)    |     |  |  |
 *   |	+---------------+    |  |  |	      |	 +--------------+     |  |  |
 *   |			     |  |  |	      |			      |  |  |
 *   |   endpnt_t            |  |  |          |	                      |  |  |
 *   |	 ____________        |  |  |	      |	  ____________        |  |  |
 *   |	| e_node     |<------+  |  |	      |	 | e_node     |<------+  |  |
 *   |	| e_idle     |<---------+  |	      |	 | e_idle     |       |  |  |
 *   +--| e_type     |<------------+	      +--| e_type     |       |  |  |
 *	| e_tiptr    |                        |  | e_tiptr    |       |  |  |
 *      | ...	     |		              |	 | ...	      |       |  |  |
 *	| e_lock     |		              |	 | e_lock     |       |  |  |
 *	| ...        |		              |	 | ...	      |       |  |  |
 *      | e_ref (0)  |		              |	 | e_ref (2)  |       |  |  |
 *	| e_itime    |	                      |	 | e_itime    |       |  |  |
 *	+------------+		              |	 +------------+       |  |  |
 *					      |			      |  |  |
 *					      |			      |  |  |
 *					      |	  ____________        |  |  |
 *					      |	 | e_node     |<------+  |  |
 *					      |	 | e_idle     |<------+--+  |
 *					      +--| e_type     |       |     |
 *					      |	 | e_tiptr    |       |     |
 *					      |	 | ...	      |       |     |
 *					      |	 | e_lock     |       |     |
 *					      |	 | ...	      |       |     |
 *					      |	 | e_ref (0)  |       |     |
 *					      |	 | e_itime    |       |     |
 *					      |	 +------------+       |     |
 *					      |			      |     |
 *					      |			      |     |
 *					      |	  ____________        |     |
 *					      |	 | e_node     |<------+     |
 *					      |	 | e_idle     |             |
 *					      +--| e_type     |<------------+
 *						 | e_tiptr    |
 *						 | ...	      |
 *						 | e_lock     |
 *						 | ...	      |
 *						 | e_ref (1)  |
 *						 | e_itime    |
 *						 +------------+
 *
 * Endpoint locking strategy:
 *
 * The following functions manipulate lists which hold the endpoint and the
 * endpoints themselves:
 *
 * endpnt_get()/check_endpnt()/endpnt_rele()/endpnt_reap()/do_endpnt_reclaim()
 *
 * Lock description follows:
 *
 * endpnt_type_lock: Global reader/writer lock which protects accesses to the
 *		     endpnt_type_list.
 *
 * e_plock: Lock defined in the endpnt_type_t.  It is intended to
 *	    protect accesses to the pool of endopints (e_pool) for a given
 *	    endpnt_type_t.
 *
 * e_ilock: Lock defined in endpnt_type_t.  It is intended to protect accesses
 *	    to the idle list (e_ilist) of available endpoints for a given
 *	    endpnt_type_t.  It also protects access to the e_itimer, e_async_cv,
 *	    and e_async_count fields in endpnt_type_t.
 *
 * e_lock: Lock defined in the endpnt structure.  It is intended to protect
 *	   flags, cv, and ref count.
 *
 * The order goes as follows so as not to induce deadlock.
 *
 * endpnt_type_lock -> e_plock -> e_ilock -> e_lock
 *
 * Interaction with Zones and shutting down:
 *
 * endpnt_type_ts are uniquely identified by the (e_zoneid, e_rdev, e_protofmly)
 * tuple, which means that a zone may not reuse another zone's idle endpoints
 * without first doing a t_kclose().
 *
 * A zone's endpnt_type_ts are destroyed when a zone is shut down; e_async_cv
 * and e_async_count are used to keep track of the threads in endpnt_taskq
 * trying to reap endpnt_ts in the endpnt_type_t.
 */

/*
 * Allocate and initialize an endpnt_type_t
 */
static struct endpnt_type *
endpnt_type_create(struct knetconfig *config)
{
	struct endpnt_type	*etype;

	/*
	 * Allocate a new endpoint type to hang a list of
	 * endpoints off of it.
	 */
	etype = kmem_alloc(sizeof (struct endpnt_type), KM_SLEEP);
	etype->e_next = NULL;
	etype->e_pcurr = NULL;
	etype->e_laddr.buf = NULL;
	etype->e_laddr.maxlen = 0;
	etype->e_laddr.len = 0;
	etype->e_itimer = 0;
	etype->e_cnt = 0;

	(void) strncpy(etype->e_protofmly, config->knc_protofmly, KNC_STRSIZE);
	mutex_init(&etype->e_plock, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&etype->e_ilock, NULL, MUTEX_DEFAULT, NULL);
	etype->e_rdev = config->knc_rdev;
	etype->e_zoneid = rpc_zoneid();
	etype->e_async_count = 0;
	cv_init(&etype->e_async_cv, NULL, CV_DEFAULT, NULL);

	list_create(&etype->e_pool, sizeof (endpnt_t),
	    offsetof(endpnt_t, e_node));
	list_create(&etype->e_ilist, sizeof (endpnt_t),
	    offsetof(endpnt_t, e_idle));

	/*
	 * Check to see if we need to create a taskq for endpoint
	 * reaping
	 */
	mutex_enter(&endpnt_taskq_lock);
	if (taskq_created == FALSE) {
		taskq_created = TRUE;
		mutex_exit(&endpnt_taskq_lock);
		ASSERT(endpnt_taskq == NULL);
		endpnt_taskq = taskq_create("clts_endpnt_taskq", 1,
		    minclsyspri, 200, INT_MAX, 0);
	} else
		mutex_exit(&endpnt_taskq_lock);

	return (etype);
}

/*
 * Free an endpnt_type_t
 */
static void
endpnt_type_free(struct endpnt_type *etype)
{
	mutex_destroy(&etype->e_plock);
	mutex_destroy(&etype->e_ilock);
	list_destroy(&etype->e_pool);
	list_destroy(&etype->e_ilist);
	if (etype->e_laddr.buf != NULL)
		clnt_free_netbuf(&etype->e_laddr);
	kmem_free(etype, sizeof (endpnt_type_t));
}

/*
 * Check the endpoint to ensure that it is suitable for use.
 *
 * Possible return values:
 *
 * return (1) - Endpoint is established, but needs to be re-opened.
 * return (0) && *newp == NULL - Endpoint is established, but unusable.
 * return (0) && *newp != NULL - Endpoint is established and usable.
 */
static int
check_endpnt(struct endpnt *endp, struct endpnt **newp)
{
	*newp = endp;

	mutex_enter(&endp->e_lock);
	ASSERT(endp->e_ref >= 1);

	/*
	 * The first condition we check for is if the endpoint has been
	 * allocated, but is unusable either because it has been closed or
	 * has been marked stale.  Only *one* thread will be allowed to
	 * execute the then clause.  This is enforced because the first thread
	 * to check this condition will clear the flags, so that subsequent
	 * thread(s) checking this endpoint will move on.
	 */
	if ((endp->e_flags & ENDPNT_ESTABLISHED) &&
	    (!(endp->e_flags & ENDPNT_BOUND) ||
	    (endp->e_flags & ENDPNT_STALE))) {
		/*
		 * Clear the flags here since they will be
		 * set again by this thread.  They need to be
		 * individually cleared because we want to maintain
		 * the state for ENDPNT_ONIDLE.
		 */
		endp->e_flags &= ~(ENDPNT_ESTABLISHED |
		    ENDPNT_WAITING | ENDPNT_BOUND | ENDPNT_STALE);
		mutex_exit(&endp->e_lock);
		return (1);
	}

	/*
	 * The second condition is meant for any thread that is waiting for
	 * an endpoint to become established.  It will cv_wait() until
	 * the condition for the endpoint has been changed to ENDPNT_BOUND or
	 * ENDPNT_STALE.
	 */
	while (!(endp->e_flags & ENDPNT_BOUND) &&
	    !(endp->e_flags & ENDPNT_STALE)) {
		endp->e_flags |= ENDPNT_WAITING;
		cv_wait(&endp->e_cv, &endp->e_lock);
	}

	ASSERT(endp->e_flags & ENDPNT_ESTABLISHED);

	/*
	 * The last case we check for is if the endpoint has been marked stale.
	 * If this is the case then set *newp to NULL and return, so that the
	 * caller is notified of the error and can take appropriate action.
	 */
	if (endp->e_flags & ENDPNT_STALE) {
		endp->e_ref--;
		*newp = NULL;
	}
	mutex_exit(&endp->e_lock);
	return (0);
}

#ifdef DEBUG
/*
 * Provide a fault injection setting to test error conditions.
 */
static int endpnt_get_return_null = 0;
#endif

/*
 * Returns a handle (struct endpnt *) to an open and bound endpoint
 * specified by the knetconfig passed in.  Returns NULL if no valid endpoint
 * can be obtained.
 */
static struct endpnt *
endpnt_get(struct knetconfig *config, int useresvport,
    int useintf, struct netbuf *laddr)
{
	struct endpnt_type	*n_etype = NULL;
	struct endpnt_type	*np = NULL;
	struct endpnt		*new = NULL;
	struct endpnt		*endp = NULL;
	struct endpnt		*next = NULL;
	TIUSER			*tiptr = NULL;
	int			rtries = BINDRESVPORT_RETRIES;
	int			i = 0;
	int			error;
	int			retval;
	zoneid_t		zoneid = rpc_zoneid();
	cred_t			*cr;

	RPCLOG(1, "endpnt_get: protofmly %s, ", config->knc_protofmly);
	RPCLOG(1, "rdev %ld\n", config->knc_rdev);

#ifdef DEBUG
	/*
	 * Inject fault if desired.  Pretend we have a stale endpoint
	 * and return NULL.
	 */
	if (endpnt_get_return_null > 0) {
		endpnt_get_return_null--;
		return (NULL);
	}
#endif
	rw_enter(&endpnt_type_lock, RW_READER);

top:
	for (np = endpnt_type_list; np != NULL; np = np->e_next) {
		if ((np->e_zoneid == zoneid) &&
		    (np->e_rdev == config->knc_rdev) &&
		    (strcmp(np->e_protofmly,
		    config->knc_protofmly) == 0)) {
			if (useintf == 1 && laddr != NULL &&
			    laddr->buf != NULL && np->e_laddr.buf != NULL) {
				retval = clnt_cmp_netaddr(laddr, &np->e_laddr);
				if (retval != 0) {
					continue;
				}
			}
			break;
		}
	}

	if (np == NULL && n_etype != NULL) {
		ASSERT(rw_write_held(&endpnt_type_lock));

		/*
		 * Link the endpoint type onto the list
		 */
		n_etype->e_next = endpnt_type_list;
		endpnt_type_list = n_etype;
		np = n_etype;
		n_etype = NULL;
	}

	if (np == NULL) {
		/*
		 * The logic here is that we were unable to find an
		 * endpnt_type_t that matched our criteria, so we allocate a
		 * new one.  Because kmem_alloc() needs to be called with
		 * KM_SLEEP, we drop our locks so that we don't induce
		 * deadlock.  After allocating and initializing the
		 * endpnt_type_t, we reaquire the lock and go back to check
		 * if this entry needs to be added to the list.  Since we do
		 * some operations without any locking other threads may
		 * have been looking for the same endpnt_type_t and gone
		 * through this code path.  We check for this case and allow
		 * one thread to link its endpnt_type_t to the list and the
		 * other threads will simply free theirs.
		 */
		rw_exit(&endpnt_type_lock);
		n_etype = endpnt_type_create(config);
		if (useintf == 1 && laddr != NULL) {
			clnt_dup_netbuf(laddr, &n_etype->e_laddr);
		}

		/*
		 * We need to reaquire the lock with RW_WRITER here so that
		 * we can safely link the new endpoint type onto the list.
		 */
		rw_enter(&endpnt_type_lock, RW_WRITER);
		goto top;
	}

	rw_exit(&endpnt_type_lock);
	/*
	 * If n_etype is not NULL, then another thread was able to
	 * insert an endpnt_type_t of this type  onto the list before
	 * we did.  Go ahead and free ours.
	 */
	if (n_etype != NULL)
		endpnt_type_free(n_etype);

	mutex_enter(&np->e_ilock);
	/*
	 * The algorithm to hand out endpoints is to first
	 * give out those that are idle if such endpoints
	 * exist.  Otherwise, create a new one if we haven't
	 * reached the max threshold.  Finally, we give out
	 * endpoints in a pseudo LRU fashion (round-robin).
	 *
	 * Note:  The idle list is merely a hint of those endpoints
	 * that should be idle.  There exists a window after the
	 * endpoint is released and before it is linked back onto the
	 * idle list where a thread could get a reference to it and
	 * use it.  This is okay, since the reference counts will
	 * still be consistent.
	 */
	if ((endp = (endpnt_t *)list_head(&np->e_ilist)) != NULL) {
		timeout_id_t t_id = 0;

		mutex_enter(&endp->e_lock);
		endp->e_ref++;
		endp->e_itime = 0;
		endp->e_flags &= ~ENDPNT_ONIDLE;
		mutex_exit(&endp->e_lock);

		/*
		 * Pop the endpoint off the idle list and hand it off
		 */
		list_remove(&np->e_ilist, endp);

		if (np->e_itimer != 0) {
			t_id = np->e_itimer;
			np->e_itimer = 0;
		}
		mutex_exit(&np->e_ilock);
		/*
		 * Reset the idle timer if it has been set
		 */
		if (t_id != (timeout_id_t)0)
			(void) untimeout(t_id);

		if (check_endpnt(endp, &new) == 0)
			return (new);
	} else if (np->e_cnt >= clnt_clts_max_endpoints) {
		/*
		 * There are no idle endpoints currently, so
		 * create a new one if we have not reached the maximum or
		 * hand one out in round-robin.
		 */
		mutex_exit(&np->e_ilock);
		mutex_enter(&np->e_plock);
		endp = np->e_pcurr;
		mutex_enter(&endp->e_lock);
		endp->e_ref++;
		mutex_exit(&endp->e_lock);

		ASSERT(endp != NULL);
		/*
		 * Advance the pointer to the next eligible endpoint, if
		 * necessary.
		 */
		if (np->e_cnt > 1) {
			next = (endpnt_t *)list_next(&np->e_pool, np->e_pcurr);
			if (next == NULL)
				next = (endpnt_t *)list_head(&np->e_pool);
			np->e_pcurr = next;
		}

		mutex_exit(&np->e_plock);

		/*
		 * We need to check to see if this endpoint is bound or
		 * not.  If it is in progress then just wait until
		 * the set up is complete
		 */
		if (check_endpnt(endp, &new) == 0)
			return (new);
	} else {
		mutex_exit(&np->e_ilock);
		mutex_enter(&np->e_plock);

		/*
		 * Allocate a new endpoint to use.  If we can't allocate any
		 * more memory then use one that is already established if any
		 * such endpoints exist.
		 */
		new = kmem_cache_alloc(endpnt_cache, KM_NOSLEEP);
		if (new == NULL) {
			RPCLOG0(1, "endpnt_get: kmem_cache_alloc failed\n");
			/*
			 * Try to recover by using an existing endpoint.
			 */
			if (np->e_cnt <= 0) {
				mutex_exit(&np->e_plock);
				return (NULL);
			}
			endp = np->e_pcurr;
			if ((next = list_next(&np->e_pool, np->e_pcurr)) !=
			    NULL)
				np->e_pcurr = next;
			ASSERT(endp != NULL);
			mutex_enter(&endp->e_lock);
			endp->e_ref++;
			mutex_exit(&endp->e_lock);
			mutex_exit(&np->e_plock);

			if (check_endpnt(endp, &new) == 0)
				return (new);
		} else {
			/*
			 * Partially init an endpoint structure and put
			 * it on the list, so that other interested threads
			 * know that one is being created
			 */
			bzero(new, sizeof (struct endpnt));

			cv_init(&new->e_cv, NULL, CV_DEFAULT, NULL);
			mutex_init(&new->e_lock, NULL, MUTEX_DEFAULT, NULL);
			new->e_ref = 1;
			new->e_type = np;

			/*
			 * Link the endpoint into the pool.
			 */
			list_insert_head(&np->e_pool, new);
			np->e_cnt++;
			if (np->e_pcurr == NULL)
				np->e_pcurr = new;
			mutex_exit(&np->e_plock);
		}
	}

	/*
	 * The transport should be opened with sufficient privs
	 */
	cr = zone_kcred();
	error = t_kopen(NULL, config->knc_rdev, FREAD|FWRITE|FNDELAY, &tiptr,
	    cr);
	if (error) {
		RPCLOG(1, "endpnt_get: t_kopen: %d\n", error);
		goto bad;
	}

	new->e_tiptr = tiptr;
	rpc_poptimod(tiptr->fp->f_vnode);

	/*
	 * Allow the kernel to push the module on behalf of the user.
	 */
	error = strioctl(tiptr->fp->f_vnode, I_PUSH, (intptr_t)"rpcmod", 0,
	    K_TO_K, cr, &retval);
	if (error) {
		RPCLOG(1, "endpnt_get: kstr_push on rpcmod failed %d\n", error);
		goto bad;
	}

	error = strioctl(tiptr->fp->f_vnode, RPC_CLIENT, 0, 0, K_TO_K,
	    cr, &retval);
	if (error) {
		RPCLOG(1, "endpnt_get: strioctl failed %d\n", error);
		goto bad;
	}

	/*
	 * Connectionless data flow should bypass the stream head.
	 */
	new->e_wq = tiptr->fp->f_vnode->v_stream->sd_wrq->q_next;

	error = strioctl(tiptr->fp->f_vnode, I_PUSH, (intptr_t)"timod", 0,
	    K_TO_K, cr, &retval);
	if (error) {
		RPCLOG(1, "endpnt_get: kstr_push on timod failed %d\n", error);
		goto bad;
	}

	/*
	 * Attempt to bind the endpoint.  If we fail then propogate
	 * error back to calling subsystem, so that it can be handled
	 * appropriately.
	 * If the caller has not specified reserved port usage then
	 * take the system default.
	 */
	if (useresvport == -1)
		useresvport = clnt_clts_do_bindresvport;

	if ((useresvport || useintf) &&
	    (strcmp(config->knc_protofmly, NC_INET) == 0 ||
	    strcmp(config->knc_protofmly, NC_INET6) == 0)) {

		while ((error =
		    bindresvport(new->e_tiptr, laddr, NULL, FALSE)) != 0) {
			RPCLOG(1,
			    "endpnt_get: bindresvport error %d\n", error);
			if (error != EPROTO) {
				if (rtries-- <= 0)
					goto bad;

				delay(hz << i++);
				continue;
			}

			(void) t_kclose(new->e_tiptr, 1);
			/*
			 * reopen with all privileges
			 */
			error = t_kopen(NULL, config->knc_rdev,
			    FREAD|FWRITE|FNDELAY,
			    &new->e_tiptr, cr);
			if (error) {
				RPCLOG(1, "endpnt_get: t_kopen: %d\n", error);
					new->e_tiptr = NULL;
					goto bad;
			}
		}
	} else if ((error = t_kbind(new->e_tiptr, NULL, NULL)) != 0) {
		RPCLOG(1, "endpnt_get: t_kbind failed: %d\n", error);
		goto bad;
	}

	/*
	 * Set the flags and notify and waiters that we have an established
	 * endpoint.
	 */
	mutex_enter(&new->e_lock);
	new->e_flags |= ENDPNT_ESTABLISHED;
	new->e_flags |= ENDPNT_BOUND;
	if (new->e_flags & ENDPNT_WAITING) {
		cv_broadcast(&new->e_cv);
		new->e_flags &= ~ENDPNT_WAITING;
	}
	mutex_exit(&new->e_lock);

	return (new);

bad:
	ASSERT(new != NULL);
	/*
	 * mark this endpoint as stale and notify any threads waiting
	 * on this endpoint that it will be going away.
	 */
	mutex_enter(&new->e_lock);
	if (new->e_ref > 0) {
		new->e_flags |= ENDPNT_ESTABLISHED;
		new->e_flags |= ENDPNT_STALE;
		if (new->e_flags & ENDPNT_WAITING) {
			cv_broadcast(&new->e_cv);
			new->e_flags &= ~ENDPNT_WAITING;
		}
	}
	new->e_ref--;
	new->e_tiptr = NULL;
	mutex_exit(&new->e_lock);

	/*
	 * If there was a transport endopoint opened, then close it.
	 */
	if (tiptr != NULL)
		(void) t_kclose(tiptr, 1);

	return (NULL);
}

/*
 * Release a referece to the endpoint
 */
static void
endpnt_rele(struct endpnt *sp)
{
	mutex_enter(&sp->e_lock);
	ASSERT(sp->e_ref > 0);
	sp->e_ref--;
	/*
	 * If the ref count is zero, then start the idle timer and link
	 * the endpoint onto the idle list.
	 */
	if (sp->e_ref == 0) {
		sp->e_itime = gethrestime_sec();

		/*
		 * Check to see if the endpoint is already linked to the idle
		 * list, so that we don't try to reinsert it.
		 */
		if (sp->e_flags & ENDPNT_ONIDLE) {
			mutex_exit(&sp->e_lock);
			mutex_enter(&sp->e_type->e_ilock);
			endpnt_reap_settimer(sp->e_type);
			mutex_exit(&sp->e_type->e_ilock);
			return;
		}

		sp->e_flags |= ENDPNT_ONIDLE;
		mutex_exit(&sp->e_lock);
		mutex_enter(&sp->e_type->e_ilock);
		list_insert_tail(&sp->e_type->e_ilist, sp);
		endpnt_reap_settimer(sp->e_type);
		mutex_exit(&sp->e_type->e_ilock);
	} else
		mutex_exit(&sp->e_lock);
}

static void
endpnt_reap_settimer(endpnt_type_t *etp)
{
	if (etp->e_itimer == (timeout_id_t)0)
		etp->e_itimer = timeout(endpnt_reap_dispatch, (void *)etp,
		    clnt_clts_taskq_dispatch_interval);
}

static void
endpnt_reap_dispatch(void *a)
{
	endpnt_type_t *etp = a;

	/*
	 * The idle timer has fired, so dispatch the taskq to close the
	 * endpoint.
	 */
	if (taskq_dispatch(endpnt_taskq, (task_func_t *)endpnt_reap, etp,
	    TQ_NOSLEEP) == TASKQID_INVALID)
		return;
	mutex_enter(&etp->e_ilock);
	etp->e_async_count++;
	mutex_exit(&etp->e_ilock);
}

/*
 * Traverse the idle list and close those endpoints that have reached their
 * timeout interval.
 */
static void
endpnt_reap(endpnt_type_t *etp)
{
	struct endpnt *e;
	struct endpnt *next_node = NULL;

	mutex_enter(&etp->e_ilock);
	e = list_head(&etp->e_ilist);
	while (e != NULL) {
		next_node = list_next(&etp->e_ilist, e);

		mutex_enter(&e->e_lock);
		if (e->e_ref > 0) {
			mutex_exit(&e->e_lock);
			e = next_node;
			continue;
		}

		ASSERT(e->e_ref == 0);
		if (e->e_itime > 0 &&
		    (e->e_itime + clnt_clts_endpoint_reap_interval) <
		    gethrestime_sec()) {
			e->e_flags &= ~ENDPNT_BOUND;
			(void) t_kclose(e->e_tiptr, 1);
			e->e_tiptr = NULL;
			e->e_itime = 0;
		}
		mutex_exit(&e->e_lock);
		e = next_node;
	}
	etp->e_itimer = 0;
	if (--etp->e_async_count == 0)
		cv_signal(&etp->e_async_cv);
	mutex_exit(&etp->e_ilock);
}

static void
endpnt_reclaim(zoneid_t zoneid)
{
	struct endpnt_type *np;
	struct endpnt *e;
	struct endpnt *next_node = NULL;
	list_t free_list;
	int rcnt = 0;

	list_create(&free_list, sizeof (endpnt_t), offsetof(endpnt_t, e_node));

	RPCLOG0(1, "endpnt_reclaim: reclaim callback started\n");
	rw_enter(&endpnt_type_lock, RW_READER);
	for (np = endpnt_type_list; np != NULL; np = np->e_next) {
		if (zoneid != ALL_ZONES && zoneid != np->e_zoneid)
			continue;

		mutex_enter(&np->e_plock);
		RPCLOG(1, "endpnt_reclaim: protofmly %s, ",
		    np->e_protofmly);
		RPCLOG(1, "rdev %ld\n", np->e_rdev);
		RPCLOG(1, "endpnt_reclaim: found %d endpoint(s)\n",
		    np->e_cnt);

		if (np->e_cnt == 0) {
			mutex_exit(&np->e_plock);
			continue;
		}

		/*
		 * The nice thing about maintaining an idle list is that if
		 * there are any endpoints to reclaim, they are going to be
		 * on this list.  Just go through and reap the one's that
		 * have ref counts of zero.
		 */
		mutex_enter(&np->e_ilock);
		e = list_head(&np->e_ilist);
		while (e != NULL) {
			next_node = list_next(&np->e_ilist, e);
			mutex_enter(&e->e_lock);
			if (e->e_ref > 0) {
				mutex_exit(&e->e_lock);
				e = next_node;
				continue;
			}
			ASSERT(e->e_ref == 0);
			mutex_exit(&e->e_lock);

			list_remove(&np->e_ilist, e);
			list_remove(&np->e_pool, e);
			list_insert_head(&free_list, e);

			rcnt++;
			np->e_cnt--;
			e = next_node;
		}
		mutex_exit(&np->e_ilock);
		/*
		 * Reset the current pointer to be safe
		 */
		if ((e = (struct endpnt *)list_head(&np->e_pool)) != NULL)
			np->e_pcurr = e;
		else {
			ASSERT(np->e_cnt == 0);
			np->e_pcurr = NULL;
		}

		mutex_exit(&np->e_plock);
	}
	rw_exit(&endpnt_type_lock);

	while ((e = list_head(&free_list)) != NULL) {
		list_remove(&free_list, e);
		if (e->e_tiptr != NULL)
			(void) t_kclose(e->e_tiptr, 1);

		cv_destroy(&e->e_cv);
		mutex_destroy(&e->e_lock);
		kmem_cache_free(endpnt_cache, e);
	}
	list_destroy(&free_list);
	RPCLOG(1, "endpnt_reclaim: reclaimed %d endpoint(s)\n", rcnt);
}

/*
 * Endpoint reclaim zones destructor callback routine.
 *
 * After reclaiming any cached entries, we basically go through the endpnt_type
 * list, canceling outstanding timeouts and free'ing data structures.
 */
/* ARGSUSED */
static void
endpnt_destructor(zoneid_t zoneid, void *a)
{
	struct endpnt_type **npp;
	struct endpnt_type *np;
	struct endpnt_type *free_list = NULL;
	timeout_id_t t_id = 0;
	extern void clcleanup_zone(zoneid_t);
	extern void clcleanup4_zone(zoneid_t);

	/* Make sure NFS client handles are released. */
	clcleanup_zone(zoneid);
	clcleanup4_zone(zoneid);

	endpnt_reclaim(zoneid);
	/*
	 * We don't need to be holding on to any locks across the call to
	 * endpnt_reclaim() and the code below; we know that no-one can
	 * be holding open connections for this zone (all processes and kernel
	 * threads are gone), so nothing could be adding anything to the list.
	 */
	rw_enter(&endpnt_type_lock, RW_WRITER);
	npp = &endpnt_type_list;
	while ((np = *npp) != NULL) {
		if (np->e_zoneid != zoneid) {
			npp = &np->e_next;
			continue;
		}
		mutex_enter(&np->e_plock);
		mutex_enter(&np->e_ilock);
		if (np->e_itimer != 0) {
			t_id = np->e_itimer;
			np->e_itimer = 0;
		}
		ASSERT(np->e_cnt == 0);
		ASSERT(list_head(&np->e_pool) == NULL);
		ASSERT(list_head(&np->e_ilist) == NULL);

		mutex_exit(&np->e_ilock);
		mutex_exit(&np->e_plock);

		/*
		 * untimeout() any outstanding timers that have not yet fired.
		 */
		if (t_id != (timeout_id_t)0)
			(void) untimeout(t_id);
		*npp = np->e_next;
		np->e_next = free_list;
		free_list = np;
	}
	rw_exit(&endpnt_type_lock);

	while (free_list != NULL) {
		np = free_list;
		free_list = free_list->e_next;
		/*
		 * Wait for threads in endpnt_taskq trying to reap endpnt_ts in
		 * the endpnt_type_t.
		 */
		mutex_enter(&np->e_ilock);
		while (np->e_async_count > 0)
			cv_wait(&np->e_async_cv, &np->e_ilock);
		cv_destroy(&np->e_async_cv);
		mutex_destroy(&np->e_plock);
		mutex_destroy(&np->e_ilock);
		list_destroy(&np->e_pool);
		list_destroy(&np->e_ilist);
		kmem_free(np, sizeof (endpnt_type_t));
	}
}

/*
 * Endpoint reclaim kmem callback routine.
 */
/* ARGSUSED */
static void
endpnt_repossess(void *a)
{
	/*
	 * Reclaim idle endpnt's from all zones.
	 */
	if (endpnt_taskq != NULL)
		(void) taskq_dispatch(endpnt_taskq,
		    (task_func_t *)(uintptr_t)endpnt_reclaim, (void *)ALL_ZONES,
		    TQ_NOSLEEP);
}

/*
 * RPC request dispatch routine.  Constructs a datagram message and wraps it
 * around the RPC request to pass downstream.
 */
static int
clnt_clts_dispatch_send(queue_t *q, mblk_t *mp, struct netbuf *addr,
    calllist_t *cp, uint_t xid, cred_t *cr)
{
	mblk_t *bp;
	int msgsz;
	struct T_unitdata_req *udreq;

	/*
	 * Set up the call record.
	 */
	cp->call_wq = q;
	cp->call_xid = xid;
	cp->call_status = RPC_TIMEDOUT;
	cp->call_notified = FALSE;
	RPCLOG(64,
	    "clnt_clts_dispatch_send: putting xid 0x%x on "
	    "dispatch list\n", xid);
	cp->call_hash = call_hash(xid, clnt_clts_hash_size);
	cp->call_bucket = &clts_call_ht[cp->call_hash];
	call_table_enter(cp);

	/*
	 * Construct the datagram
	 */
	msgsz = (int)TUNITDATAREQSZ;
	/*
	 * Note: if the receiver uses SCM_UCRED/getpeerucred the pid will
	 * appear as -1.
	 */
	while (!(bp = allocb_cred(msgsz + addr->len, cr, NOPID))) {
		if (strwaitbuf(msgsz + addr->len, BPRI_LO))
			return (ENOSR);
	}

	udreq = (struct T_unitdata_req *)bp->b_wptr;
	udreq->PRIM_type = T_UNITDATA_REQ;
	udreq->DEST_length = addr->len;

	if (addr->len) {
		bcopy(addr->buf, bp->b_wptr + msgsz, addr->len);
		udreq->DEST_offset = (t_scalar_t)msgsz;
		msgsz += addr->len;
	} else
		udreq->DEST_offset = 0;
	udreq->OPT_length = 0;
	udreq->OPT_offset = 0;

	bp->b_datap->db_type = M_PROTO;
	bp->b_wptr += msgsz;

	/*
	 * Link the datagram header with the actual data
	 */
	linkb(bp, mp);

	/*
	 * Send downstream.
	 */
	if (canput(cp->call_wq)) {
		put(cp->call_wq, bp);
		return (0);
	}

	return (EIO);
}

/*
 * RPC response delivery routine.  Deliver the response to the waiting
 * thread by matching the xid.
 */
void
clnt_clts_dispatch_notify(mblk_t *mp, int resp_off, zoneid_t zoneid)
{
	calllist_t *e = NULL;
	call_table_t *chtp;
	uint32_t xid;
	uint_t hash;
	unsigned char *hdr_offset;
	mblk_t *resp;

	/*
	 * If the RPC response is not contained in the same mblk as the
	 * datagram header, then move to the next mblk.
	 */
	hdr_offset = mp->b_rptr;
	resp = mp;
	if ((mp->b_wptr - (mp->b_rptr + resp_off)) == 0)
		resp = mp->b_cont;
	else
		resp->b_rptr += resp_off;

	ASSERT(resp != NULL);

	if ((IS_P2ALIGNED(resp->b_rptr, sizeof (uint32_t))) &&
	    (resp->b_wptr - resp->b_rptr) >= sizeof (xid))
		xid = *((uint32_t *)resp->b_rptr);
	else {
		int i = 0;
		unsigned char *p = (unsigned char *)&xid;
		unsigned char *rptr;
		mblk_t *tmp = resp;

		/*
		 * Copy the xid, byte-by-byte into xid.
		 */
		while (tmp) {
			rptr = tmp->b_rptr;
			while (rptr < tmp->b_wptr) {
				*p++ = *rptr++;
				if (++i >= sizeof (xid))
					goto done_xid_copy;
			}
			tmp = tmp->b_cont;
		}

		/*
		 * If we got here, we ran out of mblk space before the
		 * xid could be copied.
		 */
		ASSERT(tmp == NULL && i < sizeof (xid));

		RPCLOG0(1,
		    "clnt_dispatch_notify(clts): message less than "
		    "size of xid\n");

		freemsg(mp);
		return;
	}

done_xid_copy:

	/*
	 * Reset the read pointer back to the beginning of the protocol
	 * header if we moved it.
	 */
	if (mp->b_rptr != hdr_offset)
		mp->b_rptr = hdr_offset;

	hash = call_hash(xid, clnt_clts_hash_size);
	chtp = &clts_call_ht[hash];
	/* call_table_find returns with the hash bucket locked */
	call_table_find(chtp, xid, e);

	if (e != NULL) {
		mutex_enter(&e->call_lock);

		/*
		 * verify that the reply is coming in on
		 * the same zone that it was sent from.
		 */
		if (e->call_zoneid != zoneid) {
			mutex_exit(&e->call_lock);
			mutex_exit(&chtp->ct_lock);
			RPCLOG0(8, "clnt_dispatch_notify (clts): incorrect "
			    "zoneid\n");
			freemsg(mp);
			return;
		}

		/*
		 * found thread waiting for this reply.
		 */
		if (e->call_reply) {
			RPCLOG(8,
			    "clnt_dispatch_notify (clts): discarding old "
			    "reply for xid 0x%x\n",
			    xid);
			freemsg(e->call_reply);
		}
		e->call_notified = TRUE;
		e->call_reply = mp;
		e->call_status = RPC_SUCCESS;
		cv_signal(&e->call_cv);
		mutex_exit(&e->call_lock);
		mutex_exit(&chtp->ct_lock);
	} else {
		zone_t *zone;
		struct rpcstat *rpcstat;

		mutex_exit(&chtp->ct_lock);
		RPCLOG(8, "clnt_dispatch_notify (clts): no caller for reply "
		    "0x%x\n", xid);
		freemsg(mp);
		/*
		 * This is unfortunate, but we need to lookup the zone so we
		 * can increment its "rcbadxids" counter.
		 */
		zone = zone_find_by_id(zoneid);
		if (zone == NULL) {
			/*
			 * The zone went away...
			 */
			return;
		}
		rpcstat = zone_getspecific(rpcstat_zone_key, zone);
		if (zone_status_get(zone) >= ZONE_IS_SHUTTING_DOWN) {
			/*
			 * Not interested
			 */
			zone_rele(zone);
			return;
		}
		RCSTAT_INCR(rpcstat->rpc_clts_client, rcbadxids);
		zone_rele(zone);
	}
}

/*
 * Init routine.  Called when rpcmod is loaded.
 */
void
clnt_clts_init(void)
{
	endpnt_cache = kmem_cache_create("clnt_clts_endpnt_cache",
	    sizeof (struct endpnt), 0, NULL, NULL, endpnt_repossess, NULL,
	    NULL, 0);

	rw_init(&endpnt_type_lock, NULL, RW_DEFAULT, NULL);

	/*
	 * Perform simple bounds checking to make sure that the setting is
	 * reasonable
	 */
	if (clnt_clts_max_endpoints <= 0) {
		if (clnt_clts_do_bindresvport)
			clnt_clts_max_endpoints = RESERVED_PORTSPACE;
		else
			clnt_clts_max_endpoints = NONRESERVED_PORTSPACE;
	}

	if (clnt_clts_do_bindresvport &&
	    clnt_clts_max_endpoints > RESERVED_PORTSPACE)
		clnt_clts_max_endpoints = RESERVED_PORTSPACE;
	else if (clnt_clts_max_endpoints > NONRESERVED_PORTSPACE)
		clnt_clts_max_endpoints = NONRESERVED_PORTSPACE;

	if (clnt_clts_hash_size < DEFAULT_MIN_HASH_SIZE)
		clnt_clts_hash_size = DEFAULT_MIN_HASH_SIZE;

	/*
	 * Defer creating the taskq until rpcmod gets pushed.  If we are
	 * in diskless boot mode, rpcmod will get loaded early even before
	 * thread_create() is available.
	 */
	endpnt_taskq = NULL;
	taskq_created = FALSE;
	mutex_init(&endpnt_taskq_lock, NULL, MUTEX_DEFAULT, NULL);

	if (clnt_clts_endpoint_reap_interval < DEFAULT_ENDPOINT_REAP_INTERVAL)
		clnt_clts_endpoint_reap_interval =
		    DEFAULT_ENDPOINT_REAP_INTERVAL;

	/*
	 * Dispatch the taskq at an interval which is offset from the
	 * interval that the endpoints should be reaped.
	 */
	clnt_clts_taskq_dispatch_interval =
	    (clnt_clts_endpoint_reap_interval + DEFAULT_INTERVAL_SHIFT) * hz;

	/*
	 * Initialize the completion queue
	 */
	clts_call_ht = call_table_init(clnt_clts_hash_size);
	/*
	 * Initialize the zone destructor callback.
	 */
	zone_key_create(&endpnt_destructor_key, NULL, NULL, endpnt_destructor);
}

void
clnt_clts_fini(void)
{
	(void) zone_key_delete(endpnt_destructor_key);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2016 by Delphix. All rights reserved.
 * Copyright 2019 Joyent, Inc.
 * Copyright 2020 Tintri by DDN. All rights reserved.
 */

/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T
 *		All Rights Reserved
 */

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */


/*
 * Implements a kernel based, client side RPC over Connection Oriented
 * Transports (COTS).
 */

/*
 * Much of this file has been re-written to let NFS work better over slow
 * transports. A description follows.
 *
 * One of the annoying things about kRPC/COTS is that it will temporarily
 * create more than one connection between a client and server. This
 * happens because when a connection is made, the end-points entry in the
 * linked list of connections (headed by cm_hd), is removed so that other
 * threads don't mess with it. Went ahead and bit the bullet by keeping
 * the endpoint on the connection list and introducing state bits,
 * condition variables etc. to the connection entry data structure (struct
 * cm_xprt).
 *
 * Here is a summary of the changes to cm-xprt:
 *
 *	x_ctime is the timestamp of when the endpoint was last
 *	connected or disconnected. If an end-point is ever disconnected
 *	or re-connected, then any outstanding RPC request is presumed
 *	lost, telling clnt_cots_kcallit that it needs to re-send the
 *	request, not just wait for the original request's reply to
 *	arrive.
 *
 *	x_thread flag which tells us if a thread is doing a connection attempt.
 *
 *	x_waitdis flag which tells us we are waiting a disconnect ACK.
 *
 *	x_needdis flag which tells us we need to send a T_DISCONN_REQ
 *	to kill the connection.
 *
 *	x_needrel flag which tells us we need to send a T_ORDREL_REQ to
 *	gracefully close the connection.
 *
 *	#defined bitmasks for the all the b_* bits so that more
 *	efficient (and at times less clumsy) masks can be used to
 *	manipulated state in cases where multiple bits have to
 *	set/cleared/checked in the same critical section.
 *
 *	x_conn_cv and x_dis-_cv are new condition variables to let
 *	threads knows when the connection attempt is done, and to let
 *	the connecting thread know when the disconnect handshake is
 *	done.
 *
 * Added the CONN_HOLD() macro so that all reference holds have the same
 * look and feel.
 *
 * In the private (cku_private) portion of the client handle,
 *
 *	cku_flags replaces the cku_sent a boolean. cku_flags keeps
 *	track of whether a request as been sent, and whether the
 *	client's handles call record is on the dispatch list (so that
 *	the reply can be matched by XID to the right client handle).
 *	The idea of CKU_ONQUEUE is that we can exit clnt_cots_kcallit()
 *	and still have the response find the right client handle so
 *	that the retry of CLNT_CALL() gets the result. Testing, found
 *	situations where if the timeout was increased, performance
 *	degraded. This was due to us hitting a window where the thread
 *	was back in rfscall() (probably printing server not responding)
 *	while the response came back but no place to put it.
 *
 *	cku_ctime is just a cache of x_ctime. If they match,
 *	clnt_cots_kcallit() won't to send a retry (unless the maximum
 *	receive count limit as been reached). If the don't match, then
 *	we assume the request has been lost, and a retry of the request
 *	is needed.
 *
 *	cku_recv_attempts counts the number of receive count attempts
 *	after one try is sent on the wire.
 *
 * Added the clnt_delay() routine so that interruptible and
 * noninterruptible delays are possible.
 *
 * CLNT_MIN_TIMEOUT has been bumped to 10 seconds from 3. This is used to
 * control how long the client delays before returned after getting
 * ECONNREFUSED. At 3 seconds, 8 client threads per mount really does bash
 * a server that may be booting and not yet started nfsd.
 *
 * CLNT_MAXRECV_WITHOUT_RETRY is a new macro (value of 3) (with a tunable)
 * Why don't we just wait forever (receive an infinite # of times)?
 * Because the server may have rebooted. More insidious is that some
 * servers (ours) will drop NFS/TCP requests in some cases. This is bad,
 * but it is a reality.
 *
 * The case of a server doing orderly release really messes up the
 * client's recovery, especially if the server's TCP implementation is
 * buggy.  It was found was that the kRPC/COTS client was breaking some
 * TPI rules, such as not waiting for the acknowledgement of a
 * T_DISCON_REQ (hence the added case statements T_ERROR_ACK, T_OK_ACK and
 * T_DISCON_REQ in clnt_dispatch_notifyall()).
 *
 * One of things that we've seen is that a kRPC TCP endpoint goes into
 * TIMEWAIT and a thus a reconnect takes a long time to satisfy because
 * that the TIMEWAIT state takes a while to finish.  If a server sends a
 * T_ORDREL_IND, there is little point in an RPC client doing a
 * T_ORDREL_REQ, because the RPC request isn't going to make it (the
 * server is saying that it won't accept any more data). So kRPC was
 * changed to send a T_DISCON_REQ when we get a T_ORDREL_IND. So now the
 * connection skips the TIMEWAIT state and goes straight to a bound state
 * that kRPC can quickly switch to connected.
 *
 * Code that issues TPI request must use waitforack() to wait for the
 * corresponding ack (assuming there is one) in any future modifications.
 * This works around problems that may be introduced by breaking TPI rules
 * (by submitting new calls before earlier requests have been acked) in the
 * case of a signal or other early return.  waitforack() depends on
 * clnt_dispatch_notifyconn() to issue the wakeup when the ack
 * arrives, so adding new TPI calls may require corresponding changes
 * to clnt_dispatch_notifyconn(). Presently, the timeout period is based on
 * CLNT_MIN_TIMEOUT which is 10 seconds. If you modify this value, be sure
 * not to set it too low or TPI ACKS will be lost.
 */

#include <sys/param.h>
#include <sys/types.h>
#include <sys/user.h>
#include <sys/systm.h>
#include <sys/sysmacros.h>
#include <sys/proc.h>
#include <sys/socket.h>
#include <sys/file.h>
#include <sys/stream.h>
#include <sys/strsubr.h>
#include <sys/stropts.h>
#include <sys/strsun.h>
#include <sys/timod.h>
#include <sys/tiuser.h>
#include <sys/tihdr.h>
#include <sys/t_kuser.h>
#include <sys/fcntl.h>
#include <sys/errno.h>
#include <sys/kmem.h>
#include <sys/debug.h>
#include <sys/systm.h>
#include <sys/kstat.h>
#include <sys/t_lock.h>
#include <sys/ddi.h>
#include <sys/cmn_err.h>
#include <sys/time.h>
#include <sys/isa_defs.h>
#include <sys/callb.h>
#include <sys/sunddi.h>
#include <sys/atomic.h>
#include <sys/sdt.h>
#include <sys/list.h>
#include <sys/pathname.h>

#include <netinet/in.h>
#include <netinet/tcp.h>

#include <rpc/types.h>
#include <rpc/xdr.h>
#include <rpc/auth.h>
#include <rpc/clnt.h>
#include <rpc/rpc_msg.h>
#include <rpc/rpc_tags.h>

#include <rpc/svc.h>

#define	COTS_DEFAULT_ALLOCSIZE	2048

#define	WIRE_HDR_SIZE	20	/* serialized call header, sans proc number */
#define	MSG_OFFSET	128	/* offset of call into the mblk */

/*
 * Returns 0 if same
 */
#define	NETBUF_CMP(addr1, addr2) ((addr1->len == addr2->len) ?	\
	bcmp(addr1->buf, addr2->buf, addr1->len) : 1)

/*
 * Bi-directional RPC by default
 */

int clnt_cots_birpc = 1;

const char *kinet_ntop6(uchar_t *, char *, size_t);

static int	clnt_cots_ksettimers(CLIENT *, struct rpc_timers *,
    struct rpc_timers *, int, void(*)(int, int, caddr_t), caddr_t, uint32_t);
static enum clnt_stat	clnt_cots_kcallit(CLIENT *, rpcproc_t, xdrproc_t,
    caddr_t, xdrproc_t, caddr_t, struct timeval);
static void	clnt_cots_kabort(CLIENT *);
static void	clnt_cots_kerror(CLIENT *, struct rpc_err *);
static bool_t	clnt_cots_kfreeres(CLIENT *, xdrproc_t, caddr_t);
static void	clnt_cots_kdestroy(CLIENT *);
static bool_t	clnt_cots_kcontrol(CLIENT *, int, char *);

/* Callback RPC */
static bool_t connmgr_cb_totest(CLIENT *, void *);

/*
 * Global list of connmgr tags
 */
static rpc_tag_hd_t cm_tag_hd;

/* List of transports managed by the connection manager. */
struct cm_xprt {
	TIUSER		*x_tiptr;	/* transport handle */
	queue_t		*x_wq;		/* send queue */
	clock_t		x_time;		/* last time we handed this xprt out */
	clock_t		x_ctime;	/* time we went to CONNECTED */
	int		x_tidu_size;    /* TIDU size of this transport */
	union {
	    struct {
		unsigned int
#ifdef	_BIT_FIELDS_HTOL
		b_closing:	1,	/* we've sent a ord rel on this conn */
		b_dead:		1,	/* transport is closed or disconn */
		b_doomed:	1,	/* too many conns, let this go idle */
		b_connected:	1,	/* this connection is connected */

		b_ordrel:	1,	/* do an orderly release? */
		b_thread:	1,	/* thread doing connect */
		b_waitdis:	1,	/* waiting for disconnect ACK */
		b_needdis:	1,	/* need T_DISCON_REQ */

		b_needrel:	1,	/* need T_ORDREL_REQ */
		b_early_disc:	1,	/* got a T_ORDREL_IND or T_DISCON_IND */
					/* disconnect during connect */
		b_cb_tested:	1,	/* server side cb conn only */
		b_cb:		1,	/* client side cb conn */

		b_pad:		20;

#endif

#ifdef	_BIT_FIELDS_LTOH
		b_pad:		20,

		b_cb:		1,	/* client side cb conn */
		b_cb_tested:	1,	/* server side cb conn only */
		b_early_disc:	1,	/* got a T_ORDREL_IND or T_DISCON_IND */
					/* disconnect during connect */
		b_needrel:	1,	/* need T_ORDREL_REQ */

		b_needdis:	1,	/* need T_DISCON_REQ */
		b_waitdis:	1,	/* waiting for disconnect ACK */
		b_thread:	1,	/* thread doing connect */
		b_ordrel:	1,	/* do an orderly release? */

		b_connected:	1,	/* this connection is connected */
		b_doomed:	1,	/* too many conns, let this go idle */
		b_dead:		1,	/* transport is closed or disconn */
		b_closing:	1;	/* we've sent a ord rel on this conn */
#endif
	    } bit;	    unsigned int word;

#define	x_closing	x_state.bit.b_closing
#define	x_dead		x_state.bit.b_dead
#define	x_doomed	x_state.bit.b_doomed
#define	x_connected	x_state.bit.b_connected

#define	x_ordrel	x_state.bit.b_ordrel
#define	x_thread	x_state.bit.b_thread
#define	x_waitdis	x_state.bit.b_waitdis
#define	x_needdis	x_state.bit.b_needdis

#define	x_needrel	x_state.bit.b_needrel
#define	x_early_disc    x_state.bit.b_early_disc
#define	x_cb_tested	x_state.bit.b_cb_tested
#define	x_cb		x_state.bit.b_cb

#define	x_state_flags	x_state.word

#define	X_CLOSING	0x80000000
#define	X_DEAD		0x40000000
#define	X_DOOMED	0x20000000
#define	X_CONNECTED	0x10000000

#define	X_ORDREL	0x08000000
#define	X_THREAD	0x04000000
#define	X_WAITDIS	0x02000000
#define	X_NEEDDIS	0x01000000

#define	X_NEEDREL	0x00800000
#define	X_EARLYDISC	0x00400000
#define	X_CBTESTED	0x00200000
#define	X_CB		0x00100000

#define	X_BADSTATES	(X_CLOSING | X_DEAD | X_DOOMED)

	}		x_state;
	int		x_ref;		/* number of users of this xprt */
	int		x_family;	/* address family of transport */
	dev_t		x_rdev;		/* device number of transport */
	list_node_t	x_next;

	struct netbuf	x_server;	/* destination address */
	struct netbuf	x_src;		/* src address (for retries) */
	kmutex_t	x_lock;		/* lock on this entry */
	kcondvar_t	x_cv;		/* to signal when can be closed */
	kcondvar_t	x_conn_cv;	/* to signal when connection attempt */
					/* is complete */
	kstat_t		*x_ksp;

	kcondvar_t	x_dis_cv;	/* to signal when disconnect attempt */
					/* is complete */
	zoneid_t	x_zoneid;	/* zone this xprt belongs to */
	rpcprog_t	x_prog;		/* Program number for incoming calls */
	void		*x_tags;	/* tags list for this xprt */
};

typedef struct cm_kstat_xprt {
	kstat_named_t	x_wq;
	kstat_named_t	x_server;
	kstat_named_t	x_family;
	kstat_named_t	x_rdev;
	kstat_named_t	x_time;
	kstat_named_t	x_state;
	kstat_named_t	x_ref;
	kstat_named_t	x_port;
} cm_kstat_xprt_t;

static cm_kstat_xprt_t cm_kstat_template = {
	{ "write_queue", KSTAT_DATA_UINT32 },
	{ "server",	KSTAT_DATA_STRING },
	{ "addr_family", KSTAT_DATA_UINT32 },
	{ "device",	KSTAT_DATA_UINT32 },
	{ "time_stamp",	KSTAT_DATA_UINT32 },
	{ "status",	KSTAT_DATA_UINT32 },
	{ "ref_count",	KSTAT_DATA_INT32 },
	{ "port",	KSTAT_DATA_UINT32 },
};

/*
 * The inverse of this is connmgr_release().
 */
#define	CONN_HOLD(Cm_entry)	{\
	mutex_enter(&(Cm_entry)->x_lock);	\
	(Cm_entry)->x_ref++;	\
	mutex_exit(&(Cm_entry)->x_lock);	\
}


/*
 * Private data per rpc handle.  This structure is allocated by
 * clnt_cots_kcreate, and freed by clnt_cots_kdestroy.
 */
typedef struct cku_private_s {
	CLIENT			cku_client;	/* client handle */
	calllist_t		cku_call;	/* for dispatching calls */
	struct rpc_err		cku_err;	/* error status */

	struct netbuf		cku_srcaddr;	/* source or bind address */
						/* for retries */
	int			cku_addrfmly;  /* for binding port */
	struct netbuf		cku_addr;	/* remote address */
	dev_t			cku_device;	/* device to use */
	uint_t			cku_flags;
#define	CKU_ONQUEUE		0x1
#define	CKU_SENT		0x2
#define	CKU_CALLBACK		0x4		/* server side call back */
#define	CKU_BC_SETUP		0x8		/* init back channel info */
#define	CKU_BACKCHANNEL		0x10		/* client side back channel */
#define	CKU_TAGCMP		0x20		/* turns no tag check */
#define	CKU_CB_TEST		0x40		/* cb test clnt handle */
#define	CKU_BIND_CONN		0x80		/* bind conn to tag */

	bool_t			cku_progress;	/* for CLSET_PROGRESS */
	uint32_t		cku_xid;	/* current XID */
	clock_t			cku_ctime;	/* time stamp of when */
						/* connection was created */
	uint_t			cku_recv_attempts;
	XDR			cku_outxdr;	/* xdr routine for output */
	XDR			cku_inxdr;	/* xdr routine for input */
	char			cku_rpchdr[WIRE_HDR_SIZE + 4];
						/* pre-serialized rpc header */

	uint_t			cku_outbuflen;	/* default output mblk length */
	struct cred		*cku_cred;	/* credentials */
	bool_t			cku_nodelayonerr;
						/* for CLSET_NODELAYONERR */
	int			cku_useresvport; /* Use reserved port */
	int			cku_bindsrc;	/* bind to src address */
	struct rpc_cots_client	*cku_stats;	/* stats for zone */
	struct cm_xprt		*cku_entry;	/* Callback Connection Info */
	tagid			cku_tag;
} cku_private_t;

typedef struct connmgr_data {
	list_t	cm_hd;		/* list of transports */
	list_t	cm_cb_hd;	/* callback list */
	kmutex_t cm_lock;	/* for connmgr's list of transports */
	kmutex_t cm_cb_lock;	/* for connmgr's callback list */
} connmgr_data_t;

static struct cm_xprt *connmgr_wrapconnect(struct cm_xprt *,
	const struct timeval *, struct netbuf *, int, struct netbuf *,
	struct rpc_err *, bool_t, bool_t, cred_t *);

static bool_t	connmgr_connect(struct cm_xprt *, queue_t *, struct netbuf *,
				int, calllist_t *, int *, bool_t reconnect,
				const struct timeval *, bool_t, cred_t *);

static void	*connmgr_opt_getoff(mblk_t *mp, t_uscalar_t offset,
				t_uscalar_t length, uint_t align_size);
static bool_t	connmgr_setbufsz(calllist_t *e, queue_t *wq, cred_t *cr);
static bool_t	connmgr_getopt_int(queue_t *wq, int level, int name, int *val,
				calllist_t *e, cred_t *cr);
static bool_t	connmgr_setopt_int(queue_t *wq, int level, int name, int val,
				calllist_t *e, cred_t *cr);
static bool_t	connmgr_setopt(queue_t *, int, int, calllist_t *, cred_t *cr);
static void	connmgr_sndrel(struct cm_xprt *);
static void	connmgr_snddis(struct cm_xprt *);
static void	connmgr_close(struct cm_xprt *);
static void	connmgr_release(struct cm_xprt *);
static struct cm_xprt *connmgr_wrapget(struct netbuf *, const struct timeval *,
	cku_private_t *, bool_t);

static struct cm_xprt *connmgr_get(struct netbuf *, const struct timeval *,
	cku_private_t *, bool_t);

static void connmgr_cancelconn(struct cm_xprt *);
static enum clnt_stat connmgr_cwait(struct cm_xprt *, const struct timeval *,
	bool_t);
static void connmgr_dis_and_wait(struct cm_xprt *);

static int	clnt_dispatch_send(queue_t *, mblk_t *, calllist_t *, uint_t,
					uint_t);

static int clnt_delay(clock_t, bool_t);

static int waitforack(calllist_t *, t_scalar_t, const struct timeval *, bool_t);
static bool_t connmgr_tag_swap(cku_private_t *, void *);
static void connmgr_tag_unbind(cku_private_t *);
static void connmgr_tag_destroy(cku_private_t *, char *);

/*
 * Operations vector for TCP/IP based RPC
 */
static struct clnt_ops tcp_ops = {
	clnt_cots_kcallit,	/* do rpc call */
	clnt_cots_kabort,	/* abort call */
	clnt_cots_kerror,	/* return error status */
	clnt_cots_kfreeres,	/* free results */
	clnt_cots_kdestroy,	/* destroy rpc handle */
	clnt_cots_kcontrol,	/* the ioctl() of rpc */
	clnt_cots_ksettimers,	/* set retry timers */
};

static int rpc_kstat_instance = 0;  /* keeps the current instance */
				/* number for the next kstat_create */

static connmgr_data_t *connmgr_data = NULL;

extern kmutex_t clnt_max_msg_lock;

static calllist_t *clnt_pending = NULL;
extern kmutex_t clnt_pending_lock;

static int clnt_cots_hash_size = DEFAULT_HASH_SIZE;

static call_table_t *cots_call_ht;

static const struct rpc_cots_client {
	kstat_named_t	rccalls;
	kstat_named_t	rcbadcalls;
	kstat_named_t	rcbadxids;
	kstat_named_t	rctimeouts;
	kstat_named_t	rcnewcreds;
	kstat_named_t	rcbadverfs;
	kstat_named_t	rctimers;
	kstat_named_t	rccantconn;
	kstat_named_t	rcnomem;
	kstat_named_t	rcintrs;
} cots_rcstat_tmpl = {
	{ "calls",	KSTAT_DATA_UINT64 },
	{ "badcalls",	KSTAT_DATA_UINT64 },
	{ "badxids",	KSTAT_DATA_UINT64 },
	{ "timeouts",	KSTAT_DATA_UINT64 },
	{ "newcreds",	KSTAT_DATA_UINT64 },
	{ "badverfs",	KSTAT_DATA_UINT64 },
	{ "timers",	KSTAT_DATA_UINT64 },
	{ "cantconn",	KSTAT_DATA_UINT64 },
	{ "nomem",	KSTAT_DATA_UINT64 },
	{ "interrupts", KSTAT_DATA_UINT64 }
};

#define	COTSRCSTAT_INCR(p, x)	\
	do {\
		if (p != NULL)		\
			atomic_inc_64(&(p)->x.value.ui64); \
	} while (0)

#define	CLNT_MAX_CONNS	1	/* concurrent connections between clnt/srvr */
int clnt_max_conns = CLNT_MAX_CONNS;

#define	CLNT_MIN_TIMEOUT	10	/* seconds to wait after we get a */
					/* connection reset */
#define	CLNT_MIN_CONNTIMEOUT	5	/* seconds to wait for a connection */


int clnt_cots_min_tout = CLNT_MIN_TIMEOUT;
int clnt_cots_min_conntout = CLNT_MIN_CONNTIMEOUT;

/*
 * Limit the number of times we will attempt to receive a reply without
 * re-sending a response.
 */
#define	CLNT_MAXRECV_WITHOUT_RETRY	3
uint_t clnt_cots_maxrecv	= CLNT_MAXRECV_WITHOUT_RETRY;

uint_t *clnt_max_msg_sizep;
void (*clnt_stop_idle)(queue_t *wq);

#define	ptoh(p)		(&((p)->cku_client))
#define	htop(h)		((cku_private_t *)((h)->cl_private))

/*
 * Times to retry
 */
#define	REFRESHES	2	/* authentication refreshes */

/*
 * The following is used to determine the global default behavior for
 * COTS when binding to a local port.
 *
 * If the value is set to 1 the default will be to select a reserved
 * (aka privileged) port, if the value is zero the default will be to
 * use non-reserved ports.  Users of kRPC may override this by using
 * CLNT_CONTROL() and CLSET_BINDRESVPORT.
 */
int clnt_cots_do_bindresvport = 1;

static zone_key_t zone_cots_key;

/*
 * Defaults TCP send and receive buffer size for RPC connections.
 * These values can be tuned by /etc/system.
 */
int rpc_send_bufsz = 1024*1024;
int rpc_recv_bufsz = 1024*1024;
/*
 * To use system-wide default for TCP send and receive buffer size,
 * use /etc/system to set rpc_default_tcp_bufsz to 1:
 *
 * set rpcmod:rpc_default_tcp_bufsz=1
 */
int rpc_default_tcp_bufsz = 0;

/*
 * We need to do this after all kernel threads in the zone have exited.
 */
static void
clnt_zone_destroy(zoneid_t zoneid, void *unused __unused)
{
	struct cm_xprt *cm_entry, *next;
	list_t freelist;

	list_create(&freelist, sizeof (struct cm_xprt),
	    offsetof(struct cm_xprt, x_next));

	/* build freelist */
	mutex_enter(&connmgr_data->cm_lock);
	cm_entry = list_head(&connmgr_data->cm_hd);
	while (cm_entry != NULL) {
		next = list_next(&connmgr_data->cm_hd, cm_entry);

		if (cm_entry->x_zoneid != zoneid) {
			cm_entry = next;
			continue;
		}

		list_remove(&connmgr_data->cm_hd, cm_entry);
		list_insert_head(&freelist, cm_entry);
		cm_entry = next;
	}
	mutex_exit(&connmgr_data->cm_lock);
	while ((cm_entry = list_head(&freelist)) != NULL) {
		list_remove(&freelist, cm_entry);
		connmgr_close(cm_entry);
	}
}

int
clnt_cots_kcreate(dev_t dev, struct netbuf *addr, int family, rpcprog_t prog,
    rpcvers_t vers, uint_t max_msgsize, cred_t *cred, CLIENT **ncl)
{
	CLIENT *h;
	cku_private_t *p;
	struct rpc_msg call_msg;
	struct rpcstat *rpcstat;

	RPCLOG(8, "clnt_cots_kcreate: prog %u\n", prog);

	rpcstat = zone_getspecific(rpcstat_zone_key, rpc_zone());
	ASSERT(rpcstat != NULL);

	/* Allocate and intialize the client handle. */
	p = kmem_zalloc(sizeof (*p), KM_SLEEP);

	h = ptoh(p);

	h->cl_private = (caddr_t)p;
	h->cl_auth = authkern_create();
	h->cl_ops = &tcp_ops;

	cv_init(&p->cku_call.call_cv, NULL, CV_DEFAULT, NULL);
	mutex_init(&p->cku_call.call_lock, NULL, MUTEX_DEFAULT, NULL);

	/*
	 * If the current sanity check size in rpcmod is smaller
	 * than the size needed, then increase the sanity check.
	 */
	if (max_msgsize != 0 && clnt_max_msg_sizep != NULL &&
	    max_msgsize > *clnt_max_msg_sizep) {
		mutex_enter(&clnt_max_msg_lock);
		if (max_msgsize > *clnt_max_msg_sizep)
			*clnt_max_msg_sizep = max_msgsize;
		mutex_exit(&clnt_max_msg_lock);
	}

	p->cku_outbuflen = COTS_DEFAULT_ALLOCSIZE;

	/* Preserialize the call message header */

	call_msg.rm_xid = 0;
	call_msg.rm_direction = CALL;
	call_msg.rm_call.cb_rpcvers = RPC_MSG_VERSION;
	call_msg.rm_call.cb_prog = prog;
	call_msg.rm_call.cb_vers = vers;

	xdrmem_create(&p->cku_outxdr, p->cku_rpchdr, WIRE_HDR_SIZE, XDR_ENCODE);

	if (!xdr_callhdr(&p->cku_outxdr, &call_msg)) {
		XDR_DESTROY(&p->cku_outxdr);
		RPCLOG0(1, "clnt_cots_kcreate - Fatal header serialization "
		    "error\n");
		auth_destroy(h->cl_auth);
		kmem_free(p, sizeof (cku_private_t));
		RPCLOG0(1, "clnt_cots_kcreate: create failed error EINVAL\n");
		return (EINVAL);		/* XXX */
	}
	XDR_DESTROY(&p->cku_outxdr);

	/*
	 * The zalloc initialized the fields below.
	 * p->cku_xid = 0;
	 * p->cku_flags = 0;
	 * p->cku_srcaddr.buf = NULL;
	 * p->cku_srcaddr.len = 0;
	 * p->cku_srcaddr.maxlen = 0;
	 */

	p->cku_cred = cred;
	p->cku_device = dev;
	p->cku_addrfmly = family;
	p->cku_stats = rpcstat->rpc_cots_client;
	p->cku_useresvport = -1; /* value has not been set */
	p->cku_bindsrc = 0;
	if (addr != NULL) {
		p->cku_addr.buf = kmem_zalloc(addr->maxlen, KM_SLEEP);
		p->cku_addr.maxlen = addr->maxlen;
		p->cku_addr.len = addr->len;
		bcopy(addr->buf, p->cku_addr.buf, addr->len);
	} else {
		/*
		 * Only valid for a callback client handle
		 * (the connection is picked up via tags).
		 */
		p->cku_addr.buf = NULL;
		p->cku_addr.maxlen = 0;
		p->cku_addr.len = 0;
	}

	*ncl = h;
	return (0);
}

static void
clnt_cots_kabort(CLIENT *h __unused)
{
}

/*
 * Return error info on this handle.
 */
static void
clnt_cots_kerror(CLIENT *h, struct rpc_err *err)
{
	cku_private_t *p = htop(h);

	*err = p->cku_err;
}

static bool_t
clnt_cots_kfreeres(CLIENT *h __unused, xdrproc_t xdr_res, caddr_t res_ptr)
{
	xdr_free(xdr_res, res_ptr);

	return (TRUE);
}

static bool_t
clnt_cots_kcontrol(CLIENT *h, int cmd, char *arg)
{
	cku_private_t *p = htop(h);

	switch (cmd) {
	case CLSET_PROGRESS:
		p->cku_progress = TRUE;
		return (TRUE);

	case CLSET_XID:
		if (arg == NULL)
			return (FALSE);

		p->cku_xid = *((uint32_t *)arg);
		return (TRUE);

	case CLGET_XID:
		if (arg == NULL)
			return (FALSE);

		*((uint32_t *)arg) = p->cku_xid;
		return (TRUE);

	case CLSET_NODELAYONERR:
		if (arg == NULL)
			return (FALSE);

		if (*((bool_t *)arg) == TRUE) {
			p->cku_nodelayonerr = TRUE;
			return (TRUE);
		}
		if (*((bool_t *)arg) == FALSE) {
			p->cku_nodelayonerr = FALSE;
			return (TRUE);
		}
		return (FALSE);

	case CLGET_NODELAYONERR:
		if (arg == NULL)
			return (FALSE);

		*((bool_t *)arg) = p->cku_nodelayonerr;
		return (TRUE);

	case CLSET_BINDRESVPORT:
		if (arg == NULL)
			return (FALSE);

		if (*(int *)arg != 1 && *(int *)arg != 0)
			return (FALSE);

		p->cku_useresvport = *(int *)arg;

		return (TRUE);

	case CLGET_BINDRESVPORT:
		if (arg == NULL)
			return (FALSE);

		*(int *)arg = p->cku_useresvport;

		return (TRUE);

	case CLSET_BINDSRCADDR:
		if (arg == NULL)
			return (FALSE);

		struct netbuf *addr = (struct netbuf *)arg;
		clnt_dup_netbuf(addr, &p->cku_srcaddr);
		p->cku_bindsrc = 1;

		return (TRUE);

	case CLSET_CBCLIENT:
		p->cku_flags |= CKU_CALLBACK;
		return (TRUE);

	case CLSET_CBSERVER_SETUP:
		cmn_err(CE_WARN, "Not supported CLSET_CBSERVER_SETUP\n");
		return (FALSE);

	case CLSET_CBSERVER_CLEANUP:
		cmn_err(CE_WARN, "Not supported CLSET_CBSERVER_CLEANUP\n");
		return (FALSE);

	case CLSET_BACKCHANNEL:
		p->cku_flags |= CKU_BACKCHANNEL;
		return (TRUE);

	case CLSET_BACKCHANNEL_CLEAR:
		/*
		 * Clears both the backchannel related
		 * flags
		 */
		p->cku_flags &= ~CKU_BACKCHANNEL;
		p->cku_flags &= ~CKU_BC_SETUP;
		return (TRUE);

	case CLSET_TAG:
		p->cku_flags |= CKU_TAGCMP;
		bcopy(arg, p->cku_tag, sizeof (tagid));
		return (TRUE);

	case CLSET_TAG_CLEAR:
		p->cku_flags &= ~CKU_TAGCMP;
		bzero(p->cku_tag, sizeof (tagid));
		return (TRUE);

	case CLSET_TAG_SWAP:
		return (connmgr_tag_swap(p, arg));

	case CLSET_CB_TEST:
		p->cku_flags |= CKU_CB_TEST;
		return (TRUE);

	case CLGET_CB_UNTESTED:
		return (connmgr_cb_totest(h, arg));

	case CLSET_CB_TEST_CLEAR:
		p->cku_flags &= ~CKU_CB_TEST;
		return (TRUE);

	case CLSET_NON_BIRPC:
		clnt_cots_birpc = 0;
		return (TRUE);

	case CLSET_CBSERVER_CLEAR:
		p->cku_flags &= ~CKU_BC_SETUP;
		return (TRUE);

	case CLSET_BINDCONN_TO_TAG:
		p->cku_flags |= CKU_BIND_CONN;
		return (TRUE);

	case CLSET_CLEAR_BINDCONN:
		p->cku_flags &= ~CKU_BIND_CONN;
		return (TRUE);

	case CLSET_TAG_CONN_UNBIND:
		connmgr_tag_unbind(p);
		return (TRUE);

	case CLSET_TAG_DESTROY:
		rpc_destroy_tag(&cm_tag_hd, (void *)arg);
		return (TRUE);

	default:
		return (FALSE);
	}
}

/*
 * Destroy rpc handle.  Frees the space used for output buffer,
 * private data, and handle structure.
 */
static void
clnt_cots_kdestroy(CLIENT *h)
{
	/* LINTED pointer alignment */
	cku_private_t *p = htop(h);
	calllist_t *call = &p->cku_call;

	RPCLOG(8, "clnt_cots_kdestroy h: %p\n", (void *)h);
	RPCLOG(8, "clnt_cots_kdestroy h: xid=0x%x\n", p->cku_xid);

	if (p->cku_flags & CKU_ONQUEUE) {
		RPCLOG(64, "clnt_cots_kdestroy h: removing call for xid 0x%x "
		    "from dispatch list\n", p->cku_xid);
		call_table_remove(call);
	}

	if (call->call_reply)
		freemsg(call->call_reply);
	cv_destroy(&call->call_cv);
	mutex_destroy(&call->call_lock);

	kmem_free(p->cku_srcaddr.buf, p->cku_srcaddr.maxlen);
	kmem_free(p->cku_addr.buf, p->cku_addr.maxlen);
	kmem_free(p, sizeof (*p));
}

static int clnt_cots_pulls;
#define	RM_HDR_SIZE	4	/* record mark header size */

/*
 * Call remote procedure.
 */
static enum clnt_stat
clnt_cots_kcallit(CLIENT *h, rpcproc_t procnum, xdrproc_t xdr_args,
    caddr_t argsp, xdrproc_t xdr_results, caddr_t resultsp, struct timeval wait)
{
	/* LINTED pointer alignment */
	cku_private_t *p = htop(h);
	calllist_t *call = &p->cku_call;
	XDR *xdrs;
	struct rpc_msg reply_msg;
	mblk_t *mp;
#ifdef	RPCDEBUG
	clock_t time_sent;
#endif
	struct netbuf *retryaddr;
	struct cm_xprt *cm_entry = NULL;
	queue_t *wq;
	int len, waitsecs, max_waitsecs;
	int mpsize;
	int refreshes = REFRESHES;
	int interrupted;
	int tidu_size;
	enum clnt_stat status;
	struct timeval cwait;
	bool_t delay_first = FALSE;
	bool_t srcbind_only = FALSE;
	clock_t ticks, now;

	RPCLOG(2, "clnt_cots_kcallit, procnum %u\n", procnum);
	COTSRCSTAT_INCR(p->cku_stats, rccalls);

	RPCLOG(2, "clnt_cots_kcallit: wait.tv_sec: %ld\n", wait.tv_sec);
	RPCLOG(2, "clnt_cots_kcallit: wait.tv_usec: %ld\n", wait.tv_usec);
	/*
	 * Bug ID 1240234:
	 * Look out for zero length timeouts. We don't want to
	 * wait zero seconds for a connection to be established.
	 */
	if (wait.tv_sec < clnt_cots_min_conntout) {
		cwait.tv_sec = clnt_cots_min_conntout;
		cwait.tv_usec = 0;
		RPCLOG(8, "clnt_cots_kcallit: wait.tv_sec (%ld) too low,",
		    wait.tv_sec);
		RPCLOG(8, " setting to: %d\n", clnt_cots_min_conntout);
	} else {
		cwait = wait;
	}

call_again:
	if (cm_entry) {
		connmgr_release(cm_entry);
		cm_entry = NULL;
	}

	mp = NULL;

	/*
	 * If the call is not a retry, allocate a new xid and cache it
	 * for future retries.
	 * Bug ID 1246045:
	 * Treat call as a retry for purposes of binding the source
	 * port only if we actually attempted to send anything on
	 * the previous call.
	 */
	if (p->cku_xid == 0) {
		p->cku_xid = alloc_xid();
		call->call_zoneid = rpc_zoneid();

		/*
		 * We need to ASSERT here that our xid != 0 because this
		 * determines whether or not our call record gets placed on
		 * the hash table or the linked list.  By design, we mandate
		 * that RPC calls over cots must have xid's != 0, so we can
		 * ensure proper management of the hash table.
		 */
		ASSERT(p->cku_xid != 0);

		if (p->cku_bindsrc) {
			retryaddr = &p->cku_srcaddr;
			srcbind_only = TRUE;
		} else {
			retryaddr = NULL;
		}
		p->cku_flags &= ~CKU_SENT;

		if (p->cku_flags & CKU_ONQUEUE) {
			RPCLOG(8, "clnt_cots_kcallit: new call, dequeuing old"
			    " one (%p)\n", (void *)call);
			call_table_remove(call);
			p->cku_flags &= ~CKU_ONQUEUE;
			RPCLOG(64, "clnt_cots_kcallit: removing call from "
			    "dispatch list because xid was zero (now 0x%x)\n",
			    p->cku_xid);
		}

		if (call->call_reply != NULL) {
			freemsg(call->call_reply);
			call->call_reply = NULL;
		}
	} else if (p->cku_srcaddr.buf == NULL || p->cku_srcaddr.len == 0) {
		retryaddr = NULL;

	} else if (p->cku_flags & CKU_SENT) {
		retryaddr = &p->cku_srcaddr;
		srcbind_only = FALSE;

	} else {
		/*
		 * Bug ID 1246045: Nothing was sent, so set retryaddr to
		 * NULL and let connmgr_get() bind to any source port it
		 * can get.
		 */
		if (p->cku_bindsrc) {
			retryaddr = &p->cku_srcaddr;
			srcbind_only = TRUE;
		} else {
			retryaddr = NULL;
		}
	}

	RPCLOG(64, "clnt_cots_kcallit: xid = 0x%x", p->cku_xid);
	RPCLOG(64, " flags = 0x%x\n", p->cku_flags);

	p->cku_err.re_status = RPC_TIMEDOUT;
	p->cku_err.re_errno = p->cku_err.re_terrno = 0;

	cm_entry = connmgr_wrapget(retryaddr, &cwait, p, srcbind_only);

	if (cm_entry == NULL) {
		RPCLOG(1, "clnt_cots_kcallit: can't connect status %s\n",
		    clnt_sperrno(p->cku_err.re_status));

		/*
		 * The reasons why we fail to create a connection are
		 * varied. In most cases we don't want the caller to
		 * immediately retry. This could have one or more
		 * bad effects. This includes flooding the net with
		 * connect requests to ports with no listener; a hard
		 * kernel loop due to all the "reserved" TCP ports being
		 * in use.
		 */
		delay_first = TRUE;

		/*
		 * Even if we end up returning EINTR, we still count a
		 * a "can't connect", because the connection manager
		 * might have been committed to waiting for or timing out on
		 * a connection.
		 */
		COTSRCSTAT_INCR(p->cku_stats, rccantconn);
		switch (p->cku_err.re_status) {
		case RPC_INTR:
			p->cku_err.re_errno = EINTR;

			/*
			 * No need to delay because a UNIX signal(2)
			 * interrupted us. The caller likely won't
			 * retry the CLNT_CALL() and even if it does,
			 * we assume the caller knows what it is doing.
			 */
			delay_first = FALSE;
			break;

		case RPC_TIMEDOUT:
			p->cku_err.re_errno = ETIMEDOUT;

			/*
			 * No need to delay because timed out already
			 * on the connection request and assume that the
			 * transport time out is longer than our minimum
			 * timeout, or least not too much smaller.
			 */
			delay_first = FALSE;
			break;

		case RPC_SYSTEMERROR:
		case RPC_TLIERROR:
			/*
			 * We want to delay here because a transient
			 * system error has a better chance of going away
			 * if we delay a bit. If it's not transient, then
			 * we don't want end up in a hard kernel loop
			 * due to retries.
			 */
			ASSERT(p->cku_err.re_errno != 0);
			break;


		case RPC_CANTCONNECT:
			/*
			 * RPC_CANTCONNECT is set on T_ERROR_ACK which
			 * implies some error down in the TCP layer or
			 * below. If cku_nodelayonerror is set then we
			 * assume the caller knows not to try too hard.
			 */
			RPCLOG0(8, "clnt_cots_kcallit: connection failed,");
			RPCLOG0(8, " re_status=RPC_CANTCONNECT,");
			RPCLOG(8, " re_errno=%d,", p->cku_err.re_errno);
			RPCLOG(8, " cku_nodelayonerr=%d", p->cku_nodelayonerr);
			if (p->cku_nodelayonerr == TRUE)
				delay_first = FALSE;

			p->cku_err.re_errno = EIO;

			break;

		case RPC_XPRTFAILED:
			/*
			 * We want to delay here because we likely
			 * got a refused connection.
			 */
			if (p->cku_err.re_errno == 0)
				p->cku_err.re_errno = EIO;

			RPCLOG(1, "clnt_cots_kcallit: transport failed: %d\n",
			    p->cku_err.re_errno);

			break;

		default:
			/*
			 * We delay here because it is better to err
			 * on the side of caution. If we got here then
			 * status could have been RPC_SUCCESS, but we
			 * know that we did not get a connection, so
			 * force the rpc status to RPC_CANTCONNECT.
			 */
			p->cku_err.re_status = RPC_CANTCONNECT;
			p->cku_err.re_errno = EIO;
			break;
		}
		if (delay_first == TRUE)
			ticks = clnt_cots_min_tout * drv_usectohz(1000000);
		goto cots_done;
	}

	/*
	 * If we've never sent any request on this connection (send count
	 * is zero, or the connection has been reset), cache the
	 * the connection's create time and send a request (possibly a retry)
	 */
	if ((p->cku_flags & CKU_SENT) == 0 ||
	    p->cku_ctime != cm_entry->x_ctime) {
		p->cku_ctime = cm_entry->x_ctime;

	} else if ((p->cku_flags & CKU_SENT) && (p->cku_flags & CKU_ONQUEUE) &&
	    (call->call_reply != NULL ||
	    p->cku_recv_attempts < clnt_cots_maxrecv)) {

		/*
		 * If we've sent a request and our call is on the dispatch
		 * queue and we haven't made too many receive attempts, then
		 * don't re-send, just receive.
		 */
		p->cku_recv_attempts++;
		goto read_again;
	}

	/*
	 * Now we create the RPC request in a STREAMS message.  We have to do
	 * this after the call to connmgr_get so that we have the correct
	 * TIDU size for the transport.
	 */
	tidu_size = cm_entry->x_tidu_size;
	len = MSG_OFFSET + MAX(tidu_size, RM_HDR_SIZE + WIRE_HDR_SIZE);

	while ((mp = allocb(len, BPRI_MED)) == NULL) {
		if (strwaitbuf(len, BPRI_MED)) {
			p->cku_err.re_status = RPC_SYSTEMERROR;
			p->cku_err.re_errno = ENOSR;
			COTSRCSTAT_INCR(p->cku_stats, rcnomem);
			goto cots_done;
		}
	}
	xdrs = &p->cku_outxdr;
	xdrmblk_init(xdrs, mp, XDR_ENCODE, tidu_size);
	mpsize = MBLKSIZE(mp);
	ASSERT(mpsize >= len);
	ASSERT(mp->b_rptr == mp->b_datap->db_base);

	/*
	 * If the size of mblk is not appreciably larger than what we
	 * asked, then resize the mblk to exactly len bytes. The reason for
	 * this: suppose len is 1600 bytes, the tidu is 1460 bytes
	 * (from TCP over ethernet), and the arguments to the RPC require
	 * 2800 bytes. Ideally we want the protocol to render two
	 * ~1400 byte segments over the wire. However if allocb() gives us a 2k
	 * mblk, and we allocate a second mblk for the remainder, the protocol
	 * module may generate 3 segments over the wire:
	 * 1460 bytes for the first, 448 (2048 - 1600) for the second, and
	 * 892 for the third. If we "waste" 448 bytes in the first mblk,
	 * the XDR encoding will generate two ~1400 byte mblks, and the
	 * protocol module is more likely to produce properly sized segments.
	 */
	if ((mpsize >> 1) <= len)
		mp->b_rptr += (mpsize - len);

	/*
	 * Adjust b_rptr to reserve space for the non-data protocol headers
	 * any downstream modules might like to add, and for the
	 * record marking header.
	 */
	mp->b_rptr += (MSG_OFFSET + RM_HDR_SIZE);

	if (h->cl_auth->ah_cred.oa_flavor != RPCSEC_GSS) {
		/* Copy in the preserialized RPC header information. */
		bcopy(p->cku_rpchdr, mp->b_rptr, WIRE_HDR_SIZE);

		/* Use XDR_SETPOS() to set the b_wptr to past the RPC header. */
		XDR_SETPOS(xdrs, (uint_t)(mp->b_rptr - mp->b_datap->db_base +
		    WIRE_HDR_SIZE));

		ASSERT((mp->b_wptr - mp->b_rptr) == WIRE_HDR_SIZE);

		/* Serialize the procedure number and the arguments. */
		if ((!XDR_PUTINT32(xdrs, (int32_t *)&procnum)) ||
		    (!AUTH_MARSHALL(h->cl_auth, xdrs, p->cku_cred)) ||
		    (!(*xdr_args)(xdrs, argsp))) {
			XDR_DESTROY(xdrs);
			p->cku_err.re_status = RPC_CANTENCODEARGS;
			p->cku_err.re_errno = EIO;
			goto cots_done;
		}

		(*(uint32_t *)(mp->b_rptr)) = p->cku_xid;
	} else {
		uint32_t *uproc = (uint32_t *)&p->cku_rpchdr[WIRE_HDR_SIZE];
		IXDR_PUT_U_INT32(uproc, procnum);

		(*(uint32_t *)(&p->cku_rpchdr[0])) = p->cku_xid;

		/* Use XDR_SETPOS() to set the b_wptr. */
		XDR_SETPOS(xdrs, (uint_t)(mp->b_rptr - mp->b_datap->db_base));

		/* Serialize the procedure number and the arguments. */
		if (!AUTH_WRAP(h->cl_auth, p->cku_rpchdr, WIRE_HDR_SIZE+4,
		    xdrs, xdr_args, argsp)) {
			XDR_DESTROY(xdrs);
			p->cku_err.re_status = RPC_CANTENCODEARGS;
			p->cku_err.re_errno = EIO;
			goto cots_done;
		}
	}

	XDR_DESTROY(xdrs);

	RPCLOG(2, "clnt_cots_kcallit: connected, sending call, tidu_size %d\n",
	    tidu_size);

	wq = cm_entry->x_wq;
	waitsecs = 0;

dispatch_again:
	status = clnt_dispatch_send(wq, mp, call, p->cku_xid,
	    (p->cku_flags & CKU_ONQUEUE));

	if ((status == RPC_CANTSEND) && (call->call_reason == ENOBUFS)) {
		/*
		 * QFULL condition, allow some time for queue to drain
		 * and try again. Give up after waiting for all timeout
		 * specified for the call, or zone is going away.
		 */
		max_waitsecs = wait.tv_sec ? wait.tv_sec : clnt_cots_min_tout;
		if ((waitsecs++ < max_waitsecs) &&
		    !(zone_status_get(curproc->p_zone) >=
		    ZONE_IS_SHUTTING_DOWN)) {

			/* wait 1 sec for queue to drain */
			if (clnt_delay(drv_usectohz(1000000),
			    h->cl_nosignal) == EINTR) {
				p->cku_err.re_errno = EINTR;
				p->cku_err.re_status = RPC_INTR;

				goto cots_done;
			}

			/* and try again */
			goto dispatch_again;
		}
		p->cku_err.re_status = status;
		p->cku_err.re_errno = call->call_reason;
		DTRACE_PROBE(krpc__e__clntcots__kcallit__cantsend);

		goto cots_done;
	}

	if (waitsecs) {
		/* adjust timeout to account for time wait to send */
		wait.tv_sec -= waitsecs;
		if (wait.tv_sec < 0) {
			/* pick up reply on next retry */
			wait.tv_sec = 0;
		}
		DTRACE_PROBE2(clnt_cots__sendwait, CLIENT *, h,
		    int, waitsecs);
	}

	RPCLOG(64, "clnt_cots_kcallit: sent call for xid 0x%x\n",
	    (uint_t)p->cku_xid);
	p->cku_flags |= (CKU_ONQUEUE|CKU_SENT);
	p->cku_recv_attempts = 1;

#ifdef	RPCDEBUG
	time_sent = ddi_get_lbolt();
#endif

	/*
	 * Wait for a reply or a timeout.  If there is no error or timeout,
	 * (both indicated by call_status), call->call_reply will contain
	 * the RPC reply message.
	 */
read_again:
	mutex_enter(&call->call_lock);
	interrupted = 0;
	if (call->call_status == RPC_TIMEDOUT) {
		/*
		 * Indicate that the lwp is not to be stopped while waiting
		 * for this network traffic.  This is to avoid deadlock while
		 * debugging a process via /proc and also to avoid recursive
		 * mutex_enter()s due to NFS page faults while stopping
		 * (NFS holds locks when it calls here).
		 */
		clock_t cv_wait_ret;
		clock_t timout;
		clock_t oldlbolt;

		klwp_t *lwp = ttolwp(curthread);

		if (lwp != NULL)
			lwp->lwp_nostop++;

		oldlbolt = ddi_get_lbolt();
		timout = wait.tv_sec * drv_usectohz(1000000) +
		    drv_usectohz(wait.tv_usec) + oldlbolt;
		/*
		 * Iterate until the call_status is changed to something
		 * other that RPC_TIMEDOUT, or if cv_timedwait_sig() returns
		 * something <=0 zero. The latter means that we timed
		 * out.
		 */
		if (h->cl_nosignal)
			while ((cv_wait_ret = cv_timedwait(&call->call_cv,
			    &call->call_lock, timout)) > 0 &&
			    call->call_status == RPC_TIMEDOUT)
				;
		else
			while ((cv_wait_ret = cv_timedwait_sig(
			    &call->call_cv,
			    &call->call_lock, timout)) > 0 &&
			    call->call_status == RPC_TIMEDOUT)
				;

		switch (cv_wait_ret) {
		case 0:
			/*
			 * If we got out of the above loop with
			 * cv_timedwait_sig() returning 0, then we were
			 * interrupted regardless what call_status is.
			 */
			interrupted = 1;
			break;
		case -1:
			/* cv_timedwait_sig() timed out */
			break;
		default:

			/*
			 * We were cv_signaled(). If we didn't
			 * get a successful call_status and returned
			 * before time expired, delay up to clnt_cots_min_tout
			 * seconds so that the caller doesn't immediately
			 * try to call us again and thus force the
			 * same condition that got us here (such
			 * as a RPC_XPRTFAILED due to the server not
			 * listening on the end-point.
			 */
			if (call->call_status != RPC_SUCCESS) {
				clock_t curlbolt;
				clock_t diff;

				curlbolt = ddi_get_lbolt();
				ticks = clnt_cots_min_tout *
				    drv_usectohz(1000000);
				diff = curlbolt - oldlbolt;
				if (diff < ticks) {
					delay_first = TRUE;
					if (diff > 0)
						ticks -= diff;
				}
			}
			break;
		}

		if (lwp != NULL)
			lwp->lwp_nostop--;
	}
	/*
	 * Get the reply message, if any.  This will be freed at the end
	 * whether or not an error occurred.
	 */
	mp = call->call_reply;
	call->call_reply = NULL;

	/*
	 * call_err is the error info when the call is on dispatch queue.
	 * cku_err is the error info returned to the caller.
	 * Sync cku_err with call_err for local message processing.
	 */

	status = call->call_status;
	p->cku_err = call->call_err;
	mutex_exit(&call->call_lock);

	if (status != RPC_SUCCESS) {
		switch (status) {
		case RPC_TIMEDOUT:
			now = ddi_get_lbolt();
			if (interrupted) {
				COTSRCSTAT_INCR(p->cku_stats, rcintrs);
				p->cku_err.re_status = RPC_INTR;
				p->cku_err.re_errno = EINTR;
				RPCLOG(1, "clnt_cots_kcallit: xid 0x%x",
				    p->cku_xid);
				RPCLOG(1, "signal interrupted at %ld", now);
				RPCLOG(1, ", was sent at %ld\n", time_sent);
			} else {
				COTSRCSTAT_INCR(p->cku_stats, rctimeouts);
				p->cku_err.re_errno = ETIMEDOUT;
				RPCLOG(1, "clnt_cots_kcallit: timed out at %ld",
				    now);
				RPCLOG(1, ", was sent at %ld\n", time_sent);
			}
			break;

		case RPC_XPRTFAILED:
			if (p->cku_err.re_errno == 0)
				p->cku_err.re_errno = EIO;

			RPCLOG(1, "clnt_cots_kcallit: transport failed: %d\n",
			    p->cku_err.re_errno);
			break;

		case RPC_SYSTEMERROR:
			ASSERT(p->cku_err.re_errno);
			RPCLOG(1, "clnt_cots_kcallit: system error: %d\n",
			    p->cku_err.re_errno);
			break;

		default:
			p->cku_err.re_status = RPC_SYSTEMERROR;
			p->cku_err.re_errno = EIO;
			RPCLOG(1, "clnt_cots_kcallit: error: %s\n",
			    clnt_sperrno(status));
			break;
		}
		if (p->cku_err.re_status != RPC_TIMEDOUT) {

			if (p->cku_flags & CKU_ONQUEUE) {
				call_table_remove(call);
				p->cku_flags &= ~CKU_ONQUEUE;
			}

			RPCLOG(64, "clnt_cots_kcallit: non TIMEOUT so xid 0x%x "
			    "taken off dispatch list\n", p->cku_xid);
			if (call->call_reply) {
				freemsg(call->call_reply);
				call->call_reply = NULL;
			}
		} else if (wait.tv_sec != 0) {
			/*
			 * We've sent the request over TCP and so we have
			 * every reason to believe it will get
			 * delivered. In which case returning a timeout is not
			 * appropriate.
			 */
			if (p->cku_progress == TRUE &&
			    p->cku_recv_attempts < clnt_cots_maxrecv) {
				p->cku_err.re_status = RPC_INPROGRESS;
			}
		}
		goto cots_done;
	}

	xdrs = &p->cku_inxdr;
	xdrmblk_init(xdrs, mp, XDR_DECODE, 0);

	reply_msg.rm_direction = REPLY;
	reply_msg.rm_reply.rp_stat = MSG_ACCEPTED;
	reply_msg.acpted_rply.ar_stat = SUCCESS;

	reply_msg.acpted_rply.ar_verf = _null_auth;
	/*
	 *  xdr_results will be done in AUTH_UNWRAP.
	 */
	reply_msg.acpted_rply.ar_results.where = NULL;
	reply_msg.acpted_rply.ar_results.proc = xdr_void;

	if (xdr_replymsg(xdrs, &reply_msg)) {
		enum clnt_stat re_status;

		_seterr_reply(&reply_msg, &p->cku_err);

		re_status = p->cku_err.re_status;
		if (re_status == RPC_SUCCESS) {
			/*
			 * Reply is good, check auth.
			 */
			if (!AUTH_VALIDATE(h->cl_auth,
			    &reply_msg.acpted_rply.ar_verf)) {
				COTSRCSTAT_INCR(p->cku_stats, rcbadverfs);
				RPCLOG0(1, "clnt_cots_kcallit: validation "
				    "failure\n");
				freemsg(mp);
				(void) xdr_rpc_free_verifier(xdrs, &reply_msg);
				XDR_DESTROY(xdrs);
				mutex_enter(&call->call_lock);
				if (call->call_reply == NULL)
					call->call_status = RPC_TIMEDOUT;
				mutex_exit(&call->call_lock);
				goto read_again;
			} else if (!AUTH_UNWRAP(h->cl_auth, xdrs,
			    xdr_results, resultsp)) {
				RPCLOG0(1, "clnt_cots_kcallit: validation "
				    "failure (unwrap)\n");
				p->cku_err.re_status = RPC_CANTDECODERES;
				p->cku_err.re_errno = EIO;
			}
		} else {
			/* set errno in case we can't recover */
			if (re_status != RPC_VERSMISMATCH &&
			    re_status != RPC_AUTHERROR &&
			    re_status != RPC_PROGVERSMISMATCH)
				p->cku_err.re_errno = EIO;

			if (re_status == RPC_AUTHERROR) {
				/*
				 * Maybe our credential need to be refreshed
				 */
				if (cm_entry) {
					/*
					 * There is the potential that the
					 * cm_entry has/will be marked dead,
					 * so drop the connection altogether,
					 * force REFRESH to establish new
					 * connection.
					 */
					connmgr_cancelconn(cm_entry);
					cm_entry = NULL;
				}

				(void) xdr_rpc_free_verifier(xdrs,
				    &reply_msg);
				XDR_DESTROY(xdrs);

				if (p->cku_flags & CKU_ONQUEUE) {
					call_table_remove(call);
					p->cku_flags &= ~CKU_ONQUEUE;
				}
				RPCLOG(64,
				    "clnt_cots_kcallit: AUTH_ERROR, xid"
				    " 0x%x removed off dispatch list\n",
				    p->cku_xid);
				if (call->call_reply) {
					freemsg(call->call_reply);
					call->call_reply = NULL;
				}

				if ((refreshes > 0) &&
				    AUTH_REFRESH(h->cl_auth, &reply_msg,
				    p->cku_cred)) {
					refreshes--;
					freemsg(mp);
					mp = NULL;

					COTSRCSTAT_INCR(p->cku_stats,
					    rcbadcalls);
					COTSRCSTAT_INCR(p->cku_stats,
					    rcnewcreds);
					goto call_again;
				}

				/*
				 * We have used the client handle to
				 * do an AUTH_REFRESH and the RPC status may
				 * be set to RPC_SUCCESS; Let's make sure to
				 * set it to RPC_AUTHERROR.
				 */
				p->cku_err.re_status = RPC_AUTHERROR;

				/*
				 * Map recoverable and unrecoverable
				 * authentication errors to appropriate errno
				 */
				switch (p->cku_err.re_why) {
				case AUTH_TOOWEAK:
					/*
					 * This could be a failure where the
					 * server requires use of a reserved
					 * port,  check and optionally set the
					 * client handle useresvport trying
					 * one more time. Next go round we
					 * fall out with the tooweak error.
					 */
					if (p->cku_useresvport != 1) {
						p->cku_useresvport = 1;
						p->cku_xid = 0;
						freemsg(mp);
						mp = NULL;
						goto call_again;
					}
					/* FALLTHRU */
				case AUTH_BADCRED:
				case AUTH_BADVERF:
				case AUTH_INVALIDRESP:
				case AUTH_FAILED:
				case RPCSEC_GSS_NOCRED:
				case RPCSEC_GSS_FAILED:
						p->cku_err.re_errno = EACCES;
						break;
				case AUTH_REJECTEDCRED:
				case AUTH_REJECTEDVERF:
				default:	p->cku_err.re_errno = EIO;
						break;
				}
				RPCLOG(1, "clnt_cots_kcallit : authentication"
				    " failed with RPC_AUTHERROR of type %d\n",
				    (int)p->cku_err.re_why);
				goto cots_done;
			}
		}
	} else {
		/* reply didn't decode properly. */
		p->cku_err.re_status = RPC_CANTDECODERES;
		p->cku_err.re_errno = EIO;
		RPCLOG0(1, "clnt_cots_kcallit: decode failure\n");
	}

	(void) xdr_rpc_free_verifier(xdrs, &reply_msg);
	XDR_DESTROY(xdrs);

	if (p->cku_flags & CKU_ONQUEUE) {
		call_table_remove(call);
		p->cku_flags &= ~CKU_ONQUEUE;
	}

	RPCLOG(64, "clnt_cots_kcallit: xid 0x%x taken off dispatch list",
	    p->cku_xid);
	RPCLOG(64, " status is %s\n", clnt_sperrno(p->cku_err.re_status));
cots_done:
	if (cm_entry) {

		/*
		 * If it was a test of the cb connection, set status as
		 * tested.
		 */
		if ((p->cku_flags & (CKU_CALLBACK | CKU_CB_TEST)) &&
		    p->cku_err.re_status == RPC_SUCCESS)
			cm_entry->x_cb_tested = TRUE;
		connmgr_release(cm_entry);
	}

	if (mp != NULL)
		freemsg(mp);
	if ((p->cku_flags & CKU_ONQUEUE) == 0 && call->call_reply) {
		freemsg(call->call_reply);
		call->call_reply = NULL;
	}
	if (p->cku_err.re_status != RPC_SUCCESS) {
		RPCLOG0(1, "clnt_cots_kcallit: tail-end failure\n");
		COTSRCSTAT_INCR(p->cku_stats, rcbadcalls);
	}

	/*
	 * No point in delaying if the zone is going away.
	 */
	if (delay_first == TRUE &&
	    !(zone_status_get(curproc->p_zone) >= ZONE_IS_SHUTTING_DOWN)) {
		if (clnt_delay(ticks, h->cl_nosignal) == EINTR) {
			p->cku_err.re_errno = EINTR;
			p->cku_err.re_status = RPC_INTR;
		}
	}
	return (p->cku_err.re_status);
}

/*
 * Kinit routine for cots.  This sets up the correct operations in
 * the client handle, as the handle may have previously been a clts
 * handle, and clears the xid field so there is no way a new call
 * could be mistaken for a retry.  It also sets in the handle the
 * information that is passed at create/kinit time but needed at
 * call time, as cots creates the transport at call time - device,
 * address of the server, protocol family.
 */
void
clnt_cots_kinit(CLIENT *h, dev_t dev, int family, struct netbuf *addr,
    int max_msgsize, cred_t *cred)
{
	/* LINTED pointer alignment */
	cku_private_t *p = htop(h);
	calllist_t *call = &p->cku_call;

	h->cl_ops = &tcp_ops;
	if (p->cku_flags & CKU_ONQUEUE) {
		call_table_remove(call);
		p->cku_flags &= ~CKU_ONQUEUE;
		RPCLOG(64, "clnt_cots_kinit: removing call for xid 0x%x from"
		    " dispatch list\n", p->cku_xid);
	}

	if (call->call_reply != NULL) {
		freemsg(call->call_reply);
		call->call_reply = NULL;
	}

	call->call_bucket = NULL;
	call->call_hash = 0;

	/*
	 * We don't clear cku_flags here, because clnt_cots_kcallit()
	 * takes care of handling the cku_flags reset.
	 */
	p->cku_xid = 0;
	p->cku_device = dev;
	p->cku_addrfmly = family;
	p->cku_cred = cred;

	if (p->cku_addr.maxlen < addr->maxlen) {
		if (p->cku_addr.maxlen != 0 && p->cku_addr.buf != NULL)
			kmem_free(p->cku_addr.buf, p->cku_addr.maxlen);

		p->cku_addr.buf = kmem_zalloc(addr->maxlen, KM_SLEEP);
		p->cku_addr.maxlen = addr->maxlen;
	}

	p->cku_addr.len = addr->len;
	bcopy(addr->buf, p->cku_addr.buf, addr->len);

	/*
	 * If the current sanity check size in rpcmod is smaller
	 * than the size needed, then increase the sanity check.
	 */
	if (max_msgsize != 0 && clnt_max_msg_sizep != NULL &&
	    max_msgsize > *clnt_max_msg_sizep) {
		mutex_enter(&clnt_max_msg_lock);
		if (max_msgsize > *clnt_max_msg_sizep)
			*clnt_max_msg_sizep = max_msgsize;
		mutex_exit(&clnt_max_msg_lock);
	}
}

/*
 * ksettimers is a no-op for cots, with the exception of setting the xid.
 */
/* ARGSUSED */
static int
clnt_cots_ksettimers(CLIENT *h, struct rpc_timers *t, struct rpc_timers *all,
    int minimum, void (*feedback)(int, int, caddr_t), caddr_t arg, uint32_t xid)
{
	/* LINTED pointer alignment */
	cku_private_t *p = htop(h);

	if (xid)
		p->cku_xid = xid;
	COTSRCSTAT_INCR(p->cku_stats, rctimers);
	return (0);
}

extern void rpc_poptimod(struct vnode *);
extern int kstr_push(struct vnode *, char *);

int
conn_kstat_update(kstat_t *ksp, int rw)
{
	struct cm_xprt *cm_entry;
	struct cm_kstat_xprt *cm_ksp_data;
	uchar_t *b;
	char *fbuf;

	if (rw == KSTAT_WRITE)
		return (EACCES);
	if (ksp == NULL || ksp->ks_private == NULL)
		return (EIO);
	cm_entry  = (struct cm_xprt *)ksp->ks_private;
	cm_ksp_data = (struct cm_kstat_xprt *)ksp->ks_data;

	cm_ksp_data->x_wq.value.ui32 = (uint32_t)(uintptr_t)cm_entry->x_wq;
	cm_ksp_data->x_family.value.ui32 = cm_entry->x_family;
	cm_ksp_data->x_rdev.value.ui32 = (uint32_t)cm_entry->x_rdev;
	cm_ksp_data->x_time.value.ui32 = cm_entry->x_time;
	cm_ksp_data->x_ref.value.ui32 = cm_entry->x_ref;
	cm_ksp_data->x_state.value.ui32 = cm_entry->x_state_flags;

	if (cm_entry->x_server.buf) {
		fbuf = cm_ksp_data->x_server.value.str.addr.ptr;
		if (cm_entry->x_family == AF_INET &&
		    cm_entry->x_server.len ==
		    sizeof (struct sockaddr_in)) {
			struct sockaddr_in  *sa;
			sa = (struct sockaddr_in *)
				cm_entry->x_server.buf;
			b = (uchar_t *)&sa->sin_addr;
			(void) sprintf(fbuf,
			    "%d.%d.%d.%d", b[0] & 0xFF, b[1] & 0xFF,
			    b[2] & 0xFF, b[3] & 0xFF);
			cm_ksp_data->x_port.value.ui32 = ntohs(sa->sin_port);
		} else if (cm_entry->x_family == AF_INET6 &&
				cm_entry->x_server.len >=
				sizeof (struct sockaddr_in6)) {
			/* extract server IP address & port */
			struct sockaddr_in6 *sin6;
			sin6 = (struct sockaddr_in6 *)cm_entry->x_server.buf;
			(void) kinet_ntop6((uchar_t *)&sin6->sin6_addr, fbuf,
				INET6_ADDRSTRLEN);
			cm_ksp_data->x_port.value.ui32 = ntohs(sin6->sin6_port);
		} else {
			struct sockaddr_in  *sa;

			sa = (struct sockaddr_in *)cm_entry->x_server.buf;
			b = (uchar_t *)&sa->sin_addr;
			(void) sprintf(fbuf,
			    "%d.%d.%d.%d", b[0] & 0xFF, b[1] & 0xFF,
			    b[2] & 0xFF, b[3] & 0xFF);
		}
		KSTAT_NAMED_STR_BUFLEN(&cm_ksp_data->x_server) =
		    strlen(fbuf) + 1;
	}

	return (0);
}


/*
 * We want a version of delay which is interruptible by a UNIX signal
 * Return EINTR if an interrupt occured.
 */
static int
clnt_delay(clock_t ticks, bool_t nosignal)
{
	if (nosignal == TRUE) {
		delay(ticks);
		return (0);
	}
	return (delay_sig(ticks));
}

/*
 * Wait for a connection until a timeout, or until we are
 * signalled that there has been a connection state change.
 */
static enum clnt_stat
connmgr_cwait(struct cm_xprt *cm_entry, const struct timeval *waitp,
    bool_t nosignal)
{
	bool_t interrupted;
	clock_t timout, cv_stat;
	enum clnt_stat clstat;
	unsigned int old_state;

	ASSERT(MUTEX_HELD(&connmgr_data->cm_lock));
	/*
	 * We wait for the transport connection to be made, or an
	 * indication that it could not be made.
	 */
	clstat = RPC_TIMEDOUT;
	interrupted = FALSE;

	old_state = cm_entry->x_state_flags;
	/*
	 * Now loop until cv_timedwait{_sig} returns because of
	 * a signal(0) or timeout(-1) or cv_signal(>0). But it may be
	 * cv_signalled for various other reasons too. So loop
	 * until there is a state change on the connection.
	 */

	timout = waitp->tv_sec * drv_usectohz(1000000) +
	    drv_usectohz(waitp->tv_usec) + ddi_get_lbolt();

	if (nosignal) {
		while ((cv_stat = cv_timedwait(&cm_entry->x_conn_cv,
		    &connmgr_data->cm_lock, timout)) > 0 &&
		    cm_entry->x_state_flags == old_state)
			;
	} else {
		while ((cv_stat = cv_timedwait_sig(&cm_entry->x_conn_cv,
		    &connmgr_data->cm_lock, timout)) > 0 &&
		    cm_entry->x_state_flags == old_state)
			;

		if (cv_stat == 0) /* got intr signal? */
			interrupted = TRUE;
	}

	if ((cm_entry->x_state_flags & (X_BADSTATES|X_CONNECTED)) ==
	    X_CONNECTED) {
		clstat = RPC_SUCCESS;
	} else {
		if (interrupted == TRUE)
			clstat = RPC_INTR;
		RPCLOG(1, "connmgr_cwait: can't connect, error: %s\n",
		    clnt_sperrno(clstat));
	}

	return (clstat);
}

static bool_t
clnt_connmgr_cmptag(cku_private_t *p, struct cm_xprt *xprt)
{
	bool_t same_tag = FALSE;
	bool_t bc_call;
	bool_t bc_conn;
	int tagless = 0;

	tagless = rpc_is_taglist_empty(xprt->x_tags);

	bc_conn = xprt->x_cb;

	/*
	 * Old style request with no TAGS (nfsv4.0/nfsv3/NLM)
	 * If the connection is tagged, return TRUE only if it is
	 * a fore-channel only connection. Don't allow old styled
	 * requests over a connection that allows only backchannel traffic.
	 */
	if (!(p->cku_flags & CKU_TAGCMP)) {

		if (bc_conn)
			return (FALSE);

		return (TRUE);
	}

	bc_call = (p->cku_flags & CKU_BACKCHANNEL) ? TRUE : FALSE;

	/*
	 * If request is for back channel exclusively,
	 * but the connection is not marked as BC connection.
	 */

	if (bc_call && !bc_conn)
		return (FALSE);

	/*
	 * In case of non bi-dir RPC, if request is for fore channel,
	 * but the connection is for back channel only, fail.
	 */

	if (!clnt_cots_birpc && (!bc_call && bc_conn))
		return (FALSE);

	/*
	 * Now compare tags
	 */

	if (!tagless) {
		same_tag = rpc_cmp_tag(xprt->x_tags, (void *)p->cku_tag);
	}
	if (!same_tag) {
		rpc_add_tag(&cm_tag_hd, (void *)xprt, (void *)p->cku_tag);
	}

	return (TRUE);
}

/*
 * connmgr wrapper to swap tag values
 * client handle's tag p->cku_tag is changedd to new
 * tag as well
 */

static bool_t
connmgr_tag_swap(cku_private_t *p, void *newtag)
{
	if (!rpc_tag_swap(&cm_tag_hd, (void *)p->cku_tag, newtag))
		return (FALSE);

	/*
	 * Now set the new tag on the client handle
	 */
	bcopy(newtag, p->cku_tag, sizeof (tagid));

	return (TRUE);
}

#if 0
/* Currently not used, left it there for reference. */
/*
 * Detaches all the connections associated with the tag.
 */
static void
connmgr_tag_disassociate(cku_private_t *p)
{
	rpc_tag_t *tag;

	tag = rpc_lookup_tag(&cm_tag_hd, (void *)p->cku_tag, FALSE);

	if (tag == NULL) {
		return;
	}

	mutex_enter(&tag->rt_lock);
	rpc_remove_all_xprt(&cm_tag_hd, tag);
	/*
	 * Release the refcnt acquired by rpc_lookup_tag()
	 */
	RPC_TAG_RELE_LOCKED(tag);
	mutex_exit(&tag->rt_lock);
}
#endif

/*
 * Detaches the connections associated with the tag (eventually).
 * The way we go about doing this is, we mark the connection as
 * doomed. The connection will take the usual course to closure
 * when the timer goes off, at which point it is detached from
 * the tag as well. This way, we try to avoid rt_refcnt from
 * going to 0 and having to reallocate the tag for the new
 * connection.
 */
static void
connmgr_tag_unbind(cku_private_t *p)
{
	rpc_tag_t *tag;
	int back_chan = 0;
	struct cm_xprt *xprt;
	void *cookie = NULL;

	if (p->cku_flags & CKU_BACKCHANNEL)
		back_chan = 1;

	/*
	 * Unfortunately we'll need to hold this lock
	 * to change x_state_flags
	 */
	mutex_enter(&connmgr_data->cm_lock);

	tag = rpc_lookup_tag(&cm_tag_hd, (void *)p->cku_tag, FALSE);

	if (tag == NULL) {
		mutex_exit(&connmgr_data->cm_lock);
		return;
	}

	mutex_enter(&tag->rt_lock);

	xprt = (struct cm_xprt *)rpc_get_next_xprt(tag, &cookie);
	while (xprt) {
		/*
		 * Mark only connections of the right type
		 * in the case for non-bidir rpc.
		 */
		if (!clnt_cots_birpc &&
		    ((back_chan && !xprt->x_cb) ||
		    (!back_chan && xprt->x_cb))) {
			xprt =
			    (struct cm_xprt *)rpc_get_next_xprt(tag, &cookie);
			continue;
		}

		if ((xprt->x_state_flags & X_DOOMED) == 0)
			xprt->x_doomed = TRUE;

		xprt = (struct cm_xprt *)rpc_get_next_xprt(tag, &cookie);
	}
	/*
	 * Release the refcnt acquired by rpc_lookup_tag()
	 */
	RPC_TAG_RELE_LOCKED(tag);
	mutex_exit(&tag->rt_lock);

	mutex_exit(&connmgr_data->cm_lock);
}

/*
 * Primary interface for how RPC grabs a connection.
 */
static struct cm_xprt *
connmgr_wrapget(struct netbuf *retryaddr, const struct timeval *waitp,
    cku_private_t *p, bool_t srcbind_only)
{
	struct cm_xprt *cm_entry;

	cm_entry = connmgr_get(retryaddr, waitp, p, srcbind_only);

	if (cm_entry == NULL) {
		/*
		 * Re-map the call status to RPC_INTR if the err code is
		 * EINTR. This can happen if calls status is RPC_TLIERROR.
		 * However, don't re-map if signalling has been turned off.
		 * XXX Really need to create a separate thread whenever
		 * there isn't an existing connection.
		 */
		if (p->cku_err.re_errno == EINTR) {
			if (p->cku_client.cl_nosignal == TRUE)
				p->cku_err.re_errno = EIO;
			else
				p->cku_err.re_status = RPC_INTR;
		}
	}

	return (cm_entry);
}

/*
 * Make sure the cm_xprt is not destryoed by connmgr_cb_destroy
 * from cb_cm_hd list. Expects connmgr_data->cm_cb_lock to be held.
 */
static boolean_t
connmgr_cb_doomed(struct cm_xprt *xprt)
{
	struct cm_xprt *cm_entry;

	ASSERT(MUTEX_HELD(&connmgr_data->cm_cb_lock));

	for (cm_entry = list_head(&connmgr_data->cm_cb_hd);
	    cm_entry != NULL;
	    cm_entry = list_next(&connmgr_data->cm_cb_hd, cm_entry)) {

		if (cm_entry == xprt)
			return (B_FALSE);
	}

	return (B_TRUE);
}

struct cm_xprt *
connmgr_cb_get(struct netbuf *retryaddr, const struct timeval *waitp __unused,
    cku_private_t *p)
{
	rpc_tag_t *tag;
	struct cm_xprt *cm_entry, *lru_entry;
	struct netbuf *srcaddr;
	clock_t prev_time;
	bool_t cbconn_test = FALSE;
	void *cookie = NULL;

	ASSERT(p->cku_flags & (CKU_TAGCMP|CKU_CALLBACK));

	cbconn_test = (p->cku_flags & CKU_CB_TEST);

	/*
	 * Unfortunately we'll need to hold this lock to
	 * check/update x_src and x_time and x_cb_tested.
	 */
	mutex_enter(&connmgr_data->cm_cb_lock);

	tag = rpc_lookup_tag(&cm_tag_hd, (void *)p->cku_tag, FALSE);
	if (tag == NULL) {
		mutex_exit(&connmgr_data->cm_cb_lock);
		p->cku_err.re_status = RPC_CANTCONNECT;
		p->cku_err.re_errno = EIO;
		return (NULL);
	}

	prev_time = ddi_get_lbolt();
	lru_entry = NULL;

	/*
	 * Pick the LRU cm_entry for the tag
	 */
	mutex_enter(&tag->rt_lock);

	cm_entry = (struct cm_xprt *)rpc_get_next_xprt(tag, &cookie);
	while (cm_entry) {

		/*
		 * Skip doomed callback xprt(s)
		 */
		if (connmgr_cb_doomed(cm_entry)) {
			cm_entry =
			    (struct cm_xprt *)rpc_get_next_xprt(tag, &cookie);
			continue;
		}

		srcaddr = &cm_entry->x_src;
		if ((retryaddr != NULL) &&
		    (NETBUF_CMP(retryaddr, srcaddr) != 0)) {
			cm_entry =
			    (struct cm_xprt *)rpc_get_next_xprt(tag, &cookie);
			continue;
		}

		/*
		 * If it is a cb connection test, pick up only untested
		 * connections. Skip already tested connections.
		 */

		if (cbconn_test &&
		    (cm_entry->x_cb_tested == TRUE)) {
			cm_entry =
			    (struct cm_xprt *)rpc_get_next_xprt(tag, &cookie);
			continue;
		}

		if ((cm_entry->x_time - prev_time) <= 0 || lru_entry == NULL) {
			lru_entry = cm_entry;
			prev_time = cm_entry->x_time;
		}

		cm_entry = (struct cm_xprt *)rpc_get_next_xprt(tag, &cookie);
	}

	mutex_exit(&tag->rt_lock);

	if (lru_entry != NULL) {
		CONN_HOLD(lru_entry);
		lru_entry->x_time = ddi_get_lbolt();
	}

	/*
	 * Release the refcnt acquired by rpc_lookup_tag()
	 */
	RPC_TAG_RELE(tag);

	mutex_exit(&connmgr_data->cm_cb_lock);

	DTRACE_PROBE2(cb__connmgr, char *, "lru_entry",
	    struct cm_xprt *, lru_entry);

	if (lru_entry == NULL) {
		p->cku_err.re_status = RPC_CANTCONNECT;
		p->cku_err.re_errno = EIO;
		return (NULL);
	}

	return (lru_entry);
}

/*
 * Given a specific tag, return number of untested
 * connections.
 */
bool_t
connmgr_cb_totest(CLIENT *h, void *conn_num)
{
	cku_private_t *p = htop(h);
	rpc_tag_t *tag;
	struct cm_xprt *cm_entry;
	void *cookie = NULL;
	int cno = 0;

	/*
	 * Unfortunately we'll need to hold this lock to
	 * check x_cb_tested and validate cm_entry.
	 */
	mutex_enter(&connmgr_data->cm_cb_lock);

	tag = rpc_lookup_tag(&cm_tag_hd, (void *)p->cku_tag, FALSE);
	if (tag == NULL) {
		mutex_exit(&connmgr_data->cm_cb_lock);
		*((int *)conn_num) = cno;
		return (FALSE);
	}

	mutex_enter(&tag->rt_lock);
	cm_entry = (struct cm_xprt *)rpc_get_next_xprt(tag, &cookie);

	while (cm_entry) {
		if ((connmgr_cb_doomed(cm_entry) == FALSE) &&
		    (cm_entry->x_cb_tested == FALSE))
			cno++;
		cm_entry = (struct cm_xprt *)rpc_get_next_xprt(tag, &cookie);
	}

	/*
	 * Release the refcnt acquired by rpc_lookup_tag()
	 */
	RPC_TAG_RELE_LOCKED(tag);
	mutex_exit(&tag->rt_lock);

	mutex_exit(&connmgr_data->cm_cb_lock);

	*((int *)conn_num) = cno;
	return (TRUE);
}

/*
 * Obtains a transport to the server specified in addr.  If a suitable transport
 * does not already exist in the list of cached transports, a new connection
 * is created, connected, and added to the list. The connection is for sending
 * only - the reply message may come back on another transport connection.
 *
 * To implement round-robin load balancing with multiple client connections,
 * the last entry on the list is always selected. Once the entry is selected
 * it's re-inserted to the head of the list.
 */
static struct cm_xprt *
connmgr_get(struct netbuf *retryaddr, const struct timeval *waitp,
    cku_private_t *p, bool_t do_srcbind)
{
	struct cm_xprt *cm_entry;
	struct cm_xprt *lru_entry;
	struct cm_xprt *cmp, *next;
	queue_t *wq;
	TIUSER *tiptr;
	int i;
	int retval;
	int tidu_size;
	bool_t	connected;
	zoneid_t zoneid = rpc_zoneid();
	struct netbuf	*destaddr = &p->cku_addr;
	struct netbuf	*cm_destaddr, *cm_srcaddr;
	int		addrfmly = p->cku_addrfmly;
	struct netbuf	*srcaddr = &p->cku_srcaddr;
	struct rpc_err	*rpcerr = &p->cku_err;
	dev_t		device = p->cku_device;
	bool_t		nosignal = p->cku_client.cl_nosignal;
	int		useresvport = p->cku_useresvport;

	/*
	 * Server side callback connections
	 */
	if (p->cku_flags & CKU_CALLBACK) {
		return (connmgr_cb_get(retryaddr, waitp, p));
	}

	/*
	 * If the call is not a retry, look for a transport entry that
	 * goes to the server of interest.
	 */
	mutex_enter(&connmgr_data->cm_lock);

	if (retryaddr == NULL || (do_srcbind && retryaddr != NULL)) {
use_new_conn:
		i = 0;
		cm_entry = lru_entry = NULL;

		cmp = list_head(&connmgr_data->cm_hd);
		while ((cm_entry = cmp) != NULL) {
			next = list_next(&connmgr_data->cm_hd, cm_entry);
			ASSERT(cm_entry != next);
			/*
			 * Garbage collect conections that are marked
			 * for needs disconnect.
			 */
			if (cm_entry->x_needdis) {
				CONN_HOLD(cm_entry);
				connmgr_dis_and_wait(cm_entry);
				connmgr_release(cm_entry);
				/*
				 * connmgr_data->cm_lock could have been
				 * dropped for the disconnect
				 * processing so start over.
				 */
				goto use_new_conn;
			}

			/*
			 * Garbage collect the dead connections that have
			 * no threads working on them.
			 */
			if ((cm_entry->x_state_flags & (X_DEAD|X_THREAD)) ==
			    X_DEAD) {
				mutex_enter(&cm_entry->x_lock);
				if (cm_entry->x_ref != 0) {
					/*
					 * Currently in use.
					 * Cleanup later.
					 */
					cmp = next;
					mutex_exit(&cm_entry->x_lock);
					continue;
				}
				mutex_exit(&cm_entry->x_lock);
				cmp = next;
				list_remove(&connmgr_data->cm_hd, cm_entry);
				mutex_exit(&connmgr_data->cm_lock);
				connmgr_close(cm_entry);
				mutex_enter(&connmgr_data->cm_lock);
				goto use_new_conn;
			}


			/*
			 * Playing safe, there is a goto below,
			 * which sets retryaddr to NULL,
			 * Invalidating the if check above.
			 */
			if (retryaddr == NULL) {
				do_srcbind = FALSE;
			}
			if ((cm_entry->x_state_flags & X_BADSTATES) == 0 &&
			    cm_entry->x_zoneid == zoneid &&
			    cm_entry->x_rdev == device &&
			    destaddr->len == cm_entry->x_server.len &&
			    bcmp(destaddr->buf, cm_entry->x_server.buf,
			    destaddr->len) == 0) {

				if (do_srcbind) {
					if (cm_entry->x_src.buf == NULL ||
					    clnt_cmp_netaddr(retryaddr,
					    &cm_entry->x_src) != 0) {
						cmp = next;
						continue;
					}
				}
				/*
				 * If the matching entry isn't connected,
				 * attempt to reconnect it.
				 */
				if (cm_entry->x_connected == FALSE) {
					/*
					 * We don't go through trying
					 * to find the least recently
					 * used connected because
					 * connmgr_reconnect() briefly
					 * dropped the connmgr_data->cm_lock,
					 * allowing a window for our
					 * accounting to be messed up.
					 * In any case, a re-connected
					 * connection is as good as
					 * a LRU connection.
					 */
					return (connmgr_wrapconnect(cm_entry,
					    waitp, destaddr, addrfmly, srcaddr,
					    rpcerr, TRUE, nosignal,
					    p->cku_cred));
				}
				i++;

				/* keep track of the last entry */
				lru_entry = cm_entry;
			}
			cmp = next;
		}

		if (i > clnt_max_conns) {
			RPCLOG(8, "connmgr_get: too many conns, dooming entry"
			    " %p\n", (void *)lru_entry->x_tiptr);
			lru_entry->x_doomed = TRUE;
			goto use_new_conn;
		}

		/*
		 * If we are at the maximum number of connections to
		 * the server, hand back the least recently used one.
		 */
		if (i == clnt_max_conns) {
			/*
			 * Copy into the handle the source address of
			 * the connection, which we will use in case of
			 * a later retry.
			 */
			if (srcaddr->len != lru_entry->x_src.len) {
				kmem_free(srcaddr->buf, srcaddr->maxlen);
				ASSERT(lru_entry->x_src.len != 0);
				srcaddr->buf = kmem_alloc(
				    lru_entry->x_src.len, KM_SLEEP);
				srcaddr->maxlen = srcaddr->len =
				    lru_entry->x_src.len;
			}
			bcopy(lru_entry->x_src.buf, srcaddr->buf, srcaddr->len);
			RPCLOG(2, "connmgr_get: call going out on %p\n",
			    (void *)lru_entry);
			lru_entry->x_time = ddi_get_lbolt();
			CONN_HOLD(lru_entry);

			if (i > 1 &&
			    lru_entry != list_head(&connmgr_data->cm_hd)) {
				/*
				 * remove and re-insert entry at head of list.
				 */
				list_remove(&connmgr_data->cm_hd, lru_entry);
				list_insert_head(&connmgr_data->cm_hd,
				    lru_entry);
			}

			mutex_exit(&connmgr_data->cm_lock);
			return (lru_entry);
		}

	} else {
		/*
		 * This is the retry case (retryaddr != NULL).  Retries must
		 * be sent on the same source port as the original call.
		 */

		/*
		 * Walk the list looking for a connection with a source address
		 * that matches the retry address.
		 */
start_retry_loop:
		cmp = list_head(&connmgr_data->cm_hd);
		while ((cm_entry = cmp) != NULL) {
			next = list_next(&connmgr_data->cm_hd, cm_entry);
			ASSERT(cm_entry != next);

			cm_srcaddr = &cm_entry->x_src;
			/*
			 * determine if this connection matches the passed
			 * in retry address.  If it does not match, advance
			 * to the next element on the list.
			 */
			if (zoneid != cm_entry->x_zoneid ||
			    device != cm_entry->x_rdev ||
			    (NETBUF_CMP(retryaddr, cm_srcaddr)) != 0) {
				cmp = next;
				continue;
			}
			/*
			 * Garbage collect conections that are marked
			 * for needs disconnect.
			 */
			if (cm_entry->x_needdis) {
				CONN_HOLD(cm_entry);
				connmgr_dis_and_wait(cm_entry);
				connmgr_release(cm_entry);
				/*
				 * connmgr_data->cm_lock could have been
				 * dropped for the disconnect
				 * processing so start over.
				 */
				goto start_retry_loop;
			}
			/*
			 * Garbage collect the dead connections that have
			 * no threads working on them.
			 */
			if ((cm_entry->x_state_flags & (X_DEAD|X_THREAD)) ==
			    X_DEAD) {
				mutex_enter(&cm_entry->x_lock);
				if (cm_entry->x_ref != 0) {
					/*
					 * Currently in use.
					 * Cleanup later.
					 */
					cmp = next;
					mutex_exit(&cm_entry->x_lock);
					continue;
				}
				mutex_exit(&cm_entry->x_lock);
				list_remove(&connmgr_data->cm_hd, cm_entry);
				cmp = next;
				mutex_exit(&connmgr_data->cm_lock);
				connmgr_close(cm_entry);
				mutex_enter(&connmgr_data->cm_lock);
				goto start_retry_loop;
			}

			/*
			 * Sanity check: if the connection with our source
			 * port is going to some other server, something went
			 * wrong, as we never delete connections (i.e. release
			 * ports) unless they have been idle.  In this case,
			 * it is probably better to send the call out using
			 * a new source address than to fail it altogether,
			 * since that port may never be released.
			 */

			cm_destaddr = &cm_entry->x_server;
			if (NETBUF_CMP(destaddr, cm_destaddr)) {
				RPCLOG(1, "connmgr_get: tiptr %p"
				    " is going to a different server"
				    " with the port that belongs"
				    " to us!\n", (void *)cm_entry->x_tiptr);
				retryaddr = NULL;
				goto use_new_conn;
			}

			/*
			 * If the connection of interest is not connected and we
			 * can't reconnect it, then the server is probably
			 * still down.  Return NULL to the caller and let it
			 * retry later if it wants to.  We have a delay so the
			 * machine doesn't go into a tight retry loop.  If the
			 * entry was already connected, or the reconnected was
			 * successful, return this entry.
			 */
			if (cm_entry->x_connected == FALSE) {
				return (connmgr_wrapconnect(cm_entry,
				    waitp, destaddr, addrfmly, NULL,
				    rpcerr, TRUE, nosignal, p->cku_cred));
			} else {
				CONN_HOLD(cm_entry);

				cm_entry->x_time = ddi_get_lbolt();
				mutex_exit(&connmgr_data->cm_lock);
				RPCLOG(2, "connmgr_get: found old "
				    "transport %p for retry\n",
				    (void *)cm_entry);
				return (cm_entry);
			}
		}

		/*
		 * We cannot find an entry in the list for this retry.
		 * Either the entry has been removed temporarily to be
		 * reconnected by another thread, or the original call
		 * got a port but never got connected,
		 * and hence the transport never got put in the
		 * list.  Fall through to the "create new connection" code -
		 * the former case will fail there trying to rebind the port,
		 * and the later case (and any other pathological cases) will
		 * rebind and reconnect and not hang the client machine.
		 */
		RPCLOG0(8, "connmgr_get: no entry in list for retry\n");
	}
	/*
	 * Set up a transport entry in the connection manager's list.
	 */
	cm_entry = (struct cm_xprt *)
	    kmem_zalloc(sizeof (struct cm_xprt), KM_SLEEP);

	cm_entry->x_server.buf = kmem_zalloc(destaddr->len, KM_SLEEP);
	bcopy(destaddr->buf, cm_entry->x_server.buf, destaddr->len);
	cm_entry->x_server.len = cm_entry->x_server.maxlen = destaddr->len;

	cm_entry->x_state_flags = X_THREAD;
	cm_entry->x_ref = 1;
	cm_entry->x_family = addrfmly;
	cm_entry->x_rdev = device;
	cm_entry->x_zoneid = zoneid;
	mutex_init(&cm_entry->x_lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&cm_entry->x_cv, NULL, CV_DEFAULT, NULL);
	cv_init(&cm_entry->x_conn_cv, NULL, CV_DEFAULT, NULL);
	cv_init(&cm_entry->x_dis_cv, NULL, CV_DEFAULT, NULL);

	cm_entry->x_cb = (p->cku_flags & CKU_BACKCHANNEL) ? TRUE : FALSE;

	rpc_init_taglist(&cm_entry->x_tags);

	/*
	 * Note that we add this partially initialized entry to the
	 * connection list. This is so that we don't have connections to
	 * the same server.
	 *
	 * Note that x_src is not initialized at this point. This is because
	 * retryaddr might be NULL in which case x_src is whatever
	 * t_kbind/bindresvport gives us. If another thread wants a
	 * connection to the same server, seemingly we have an issue, but we
	 * don't. If the other thread comes in with retryaddr == NULL, then it
	 * will never look at x_src, and it will end up waiting in
	 * connmgr_cwait() for the first thread to finish the connection
	 * attempt. If the other thread comes in with retryaddr != NULL, then
	 * that means there was a request sent on a connection, in which case
	 * the the connection should already exist. Thus the first thread
	 * never gets here ... it finds the connection it its server in the
	 * connection list.
	 *
	 * But even if theory is wrong, in the retryaddr != NULL case, the 2nd
	 * thread will skip us because x_src.len == 0.
	 */
	list_insert_head(&connmgr_data->cm_hd, cm_entry);
	mutex_exit(&connmgr_data->cm_lock);

	/*
	 * Either we didn't find an entry to the server of interest, or we
	 * don't have the maximum number of connections to that server -
	 * create a new connection.
	 */
	RPCLOG0(8, "connmgr_get: creating new connection\n");
	rpcerr->re_status = RPC_TLIERROR;

	i = t_kopen(NULL, device, FREAD|FWRITE|FNDELAY, &tiptr, zone_kcred());
	if (i) {
		RPCLOG(1, "connmgr_get: can't open cots device, error %d\n", i);
		rpcerr->re_errno = i;
		connmgr_cancelconn(cm_entry);
		return (NULL);
	}
	rpc_poptimod(tiptr->fp->f_vnode);

	if (i = strioctl(tiptr->fp->f_vnode, I_PUSH, (intptr_t)"rpcmod", 0,
	    K_TO_K, kcred, &retval)) {
		RPCLOG(1, "connmgr_get: can't push cots module, %d\n", i);
		(void) t_kclose(tiptr, 1);
		rpcerr->re_errno = i;
		connmgr_cancelconn(cm_entry);
		return (NULL);
	}

	if (i = strioctl(tiptr->fp->f_vnode, RPC_CLIENT, 0, 0, K_TO_K,
	    kcred, &retval)) {
		RPCLOG(1, "connmgr_get: can't set client status with cots "
		    "module, %d\n", i);
		(void) t_kclose(tiptr, 1);
		rpcerr->re_errno = i;
		connmgr_cancelconn(cm_entry);
		return (NULL);
	}

	mutex_enter(&connmgr_data->cm_lock);

	wq = tiptr->fp->f_vnode->v_stream->sd_wrq->q_next;
	cm_entry->x_wq = wq;

	mutex_exit(&connmgr_data->cm_lock);

	if (i = strioctl(tiptr->fp->f_vnode, I_PUSH, (intptr_t)"timod", 0,
	    K_TO_K, kcred, &retval)) {
		RPCLOG(1, "connmgr_get: can't push timod, %d\n", i);
		(void) t_kclose(tiptr, 1);
		rpcerr->re_errno = i;
		connmgr_cancelconn(cm_entry);
		return (NULL);
	}

	/*
	 * If the caller has not specified reserved port usage then
	 * take the system default.
	 */
	if (useresvport == -1)
		useresvport = clnt_cots_do_bindresvport;

	if ((useresvport || retryaddr != NULL) &&
	    (addrfmly == AF_INET || addrfmly == AF_INET6)) {
		bool_t alloc_src = FALSE;

		if (srcaddr->len != destaddr->len) {
			kmem_free(srcaddr->buf, srcaddr->maxlen);
			srcaddr->buf = kmem_zalloc(destaddr->len, KM_SLEEP);
			srcaddr->maxlen = destaddr->len;
			srcaddr->len = destaddr->len;
			alloc_src = TRUE;
		}

		if ((i = bindresvport(tiptr, retryaddr, srcaddr, TRUE)) != 0) {
			(void) t_kclose(tiptr, 1);
			RPCLOG(1, "connmgr_get: couldn't bind, retryaddr: "
			    "%p\n", (void *)retryaddr);

			/*
			 * 1225408: If we allocated a source address, then it
			 * is either garbage or all zeroes. In that case
			 * we need to clear srcaddr.
			 */
			if (alloc_src == TRUE) {
				kmem_free(srcaddr->buf, srcaddr->maxlen);
				srcaddr->maxlen = srcaddr->len = 0;
				srcaddr->buf = NULL;
			}
			rpcerr->re_errno = i;
			connmgr_cancelconn(cm_entry);
			return (NULL);
		}
	} else {
		if ((i = t_kbind(tiptr, NULL, NULL)) != 0) {
			RPCLOG(1, "clnt_cots_kcreate: t_kbind: %d\n", i);
			(void) t_kclose(tiptr, 1);
			rpcerr->re_errno = i;
			connmgr_cancelconn(cm_entry);
			return (NULL);
		}
	}

	{
		/*
		 * Keep the kernel stack lean. Don't move this call
		 * declaration to the top of this function because a
		 * call is declared in connmgr_wrapconnect()
		 */
		calllist_t call;

		bzero(&call, sizeof (call));
		cv_init(&call.call_cv, NULL, CV_DEFAULT, NULL);

		/*
		 * This is a bound end-point so don't close it's stream.
		 */
		connected = connmgr_connect(cm_entry, wq, destaddr, addrfmly,
		    &call, &tidu_size, FALSE, waitp, nosignal, p->cku_cred);
		*rpcerr = call.call_err;
		cv_destroy(&call.call_cv);

	}

	mutex_enter(&connmgr_data->cm_lock);

	/*
	 * Set up a transport entry in the connection manager's list.
	 */
	if (srcaddr->len > 0) {
		cm_entry->x_src.buf = kmem_zalloc(srcaddr->len, KM_SLEEP);
		bcopy(srcaddr->buf, cm_entry->x_src.buf, srcaddr->len);
		cm_entry->x_src.len = cm_entry->x_src.maxlen = srcaddr->len;
	} /* Else kmem_zalloc() of cm_entry already sets its x_src to NULL. */

	cm_entry->x_tiptr = tiptr;
	cm_entry->x_time = ddi_get_lbolt();

	if (tiptr->tp_info.servtype == T_COTS_ORD)
		cm_entry->x_ordrel = TRUE;
	else
		cm_entry->x_ordrel = FALSE;

	cm_entry->x_tidu_size = tidu_size;

	if (cm_entry->x_early_disc) {
		/*
		 * We need to check if a disconnect request has come
		 * while we are connected, if so, then we need to
		 * set rpcerr->re_status appropriately before returning
		 * NULL to caller.
		 */
		if (rpcerr->re_status == RPC_SUCCESS)
			rpcerr->re_status = RPC_XPRTFAILED;
		cm_entry->x_connected = FALSE;
	} else
		cm_entry->x_connected = connected;

	/*
	 * There could be a discrepancy here such that
	 * x_early_disc is TRUE yet connected is TRUE as well
	 * and the connection is actually connected. In that case
	 * lets be conservative and declare the connection as not
	 * connected.
	 */
	cm_entry->x_early_disc = FALSE;
	cm_entry->x_needdis = (cm_entry->x_connected == FALSE);
	cm_entry->x_ctime = ddi_get_lbolt();

	DTRACE_PROBE2(connmgr__get, char *, "created a new cm_entry",
	    struct cm_xprt *, cm_entry);

	/*
	 * Notify any threads waiting that the connection attempt is done.
	 */
	cm_entry->x_thread = FALSE;
	cv_broadcast(&cm_entry->x_conn_cv);

	if (cm_entry->x_connected == FALSE) {
		mutex_exit(&connmgr_data->cm_lock);
		connmgr_release(cm_entry);
		return (NULL);
	}

	mutex_exit(&connmgr_data->cm_lock);

	return (cm_entry);
}

/*
 * Keep the cm_xprt entry on the connecton list when making a connection. This
 * is to prevent multiple connections to a slow server from appearing.
 * We use the bit field x_thread to tell if a thread is doing a connection
 * which keeps other interested threads from messing with connection.
 * Those other threads just wait if x_thread is set.
 *
 * If x_thread is not set, then we do the actual work of connecting via
 * connmgr_connect().
 *
 * mutex convention: called with connmgr_data->cm_lock held, returns with it
 * released.
 */
static struct cm_xprt *
connmgr_wrapconnect(
	struct cm_xprt	*cm_entry,
	const struct timeval	*waitp,
	struct netbuf	*destaddr,
	int		addrfmly,
	struct netbuf	*srcaddr,
	struct rpc_err	*rpcerr,
	bool_t		reconnect,
	bool_t		nosignal,
	cred_t		*cr)
{
	ASSERT(MUTEX_HELD(&connmgr_data->cm_lock));
	/*
	 * Hold this entry as we are about to drop connmgr_data->cm_lock.
	 */
	CONN_HOLD(cm_entry);

	/*
	 * If there is a thread already making a connection for us, then
	 * wait for it to complete the connection.
	 */
	if (cm_entry->x_thread == TRUE) {
		rpcerr->re_status = connmgr_cwait(cm_entry, waitp, nosignal);

		if (rpcerr->re_status != RPC_SUCCESS) {
			mutex_exit(&connmgr_data->cm_lock);
			connmgr_release(cm_entry);
			return (NULL);
		}
	} else {
		bool_t connected;
		calllist_t call;

		cm_entry->x_thread = TRUE;

		while (cm_entry->x_needrel == TRUE) {
			cm_entry->x_needrel = FALSE;

			connmgr_sndrel(cm_entry);
			delay(drv_usectohz(1000000));

			mutex_enter(&connmgr_data->cm_lock);
		}

		/*
		 * If we need to send a T_DISCON_REQ, send one.
		 */
		connmgr_dis_and_wait(cm_entry);
		cm_entry->x_dead = FALSE;

		mutex_exit(&connmgr_data->cm_lock);

		bzero(&call, sizeof (call));
		cv_init(&call.call_cv, NULL, CV_DEFAULT, NULL);

		connected = connmgr_connect(cm_entry, cm_entry->x_wq,
		    destaddr, addrfmly, &call, &cm_entry->x_tidu_size,
		    reconnect, waitp, nosignal, cr);

		*rpcerr = call.call_err;
		cv_destroy(&call.call_cv);

		mutex_enter(&connmgr_data->cm_lock);


		if (cm_entry->x_early_disc) {
			/*
			 * We need to check if a disconnect request has come
			 * while we are connected, if so, then we need to
			 * set rpcerr->re_status appropriately before returning
			 * NULL to caller.
			 */
			if (rpcerr->re_status == RPC_SUCCESS)
				rpcerr->re_status = RPC_XPRTFAILED;
			cm_entry->x_connected = FALSE;
		} else
			cm_entry->x_connected = connected;

		/*
		 * There could be a discrepancy here such that
		 * x_early_disc is TRUE yet connected is TRUE as well
		 * and the connection is actually connected. In that case
		 * lets be conservative and declare the connection as not
		 * connected.
		 */

		cm_entry->x_early_disc = FALSE;
		cm_entry->x_needdis = (cm_entry->x_connected == FALSE);


		/*
		 * connmgr_connect() may have given up before the connection
		 * actually timed out. So ensure that before the next
		 * connection attempt we do a disconnect.
		 */
		cm_entry->x_ctime = ddi_get_lbolt();
		cm_entry->x_thread = FALSE;

		cv_broadcast(&cm_entry->x_conn_cv);

		if (cm_entry->x_connected == FALSE) {
			mutex_exit(&connmgr_data->cm_lock);
			connmgr_release(cm_entry);
			return (NULL);
		}
	}

	if (srcaddr != NULL) {
		/*
		 * Copy into the handle the
		 * source address of the
		 * connection, which we will use
		 * in case of a later retry.
		 */
		if (srcaddr->len != cm_entry->x_src.len) {
			kmem_free(srcaddr->buf, srcaddr->maxlen);
			ASSERT(cm_entry->x_src.len != 0);
			srcaddr->buf = kmem_alloc(cm_entry->x_src.len,
			    KM_SLEEP);
			srcaddr->maxlen = srcaddr->len = cm_entry->x_src.len;
		}
		bcopy(cm_entry->x_src.buf, srcaddr->buf, srcaddr->len);
	}
	cm_entry->x_time = ddi_get_lbolt();
	mutex_exit(&connmgr_data->cm_lock);
	return (cm_entry);
}

/*
 * If we need to send a T_DISCON_REQ, send one.
 */
static void
connmgr_dis_and_wait(struct cm_xprt *cm_entry)
{
	ASSERT(MUTEX_HELD(&connmgr_data->cm_lock));
	for (;;) {
		while (cm_entry->x_needdis == TRUE) {
			RPCLOG(8, "connmgr_dis_and_wait: need "
			    "T_DISCON_REQ for connection 0x%p\n",
			    (void *)cm_entry);
			cm_entry->x_needdis = FALSE;
			cm_entry->x_waitdis = TRUE;

			connmgr_snddis(cm_entry);

			mutex_enter(&connmgr_data->cm_lock);
		}

		if (cm_entry->x_waitdis == TRUE) {
			clock_t timout;

			RPCLOG(8, "connmgr_dis_and_wait waiting for "
			    "T_DISCON_REQ's ACK for connection %p\n",
			    (void *)cm_entry);

			timout = clnt_cots_min_conntout * drv_usectohz(1000000);

			/*
			 * The TPI spec says that the T_DISCON_REQ
			 * will get acknowledged, but in practice
			 * the ACK may never get sent. So don't
			 * block forever.
			 */
			(void) cv_reltimedwait(&cm_entry->x_dis_cv,
			    &connmgr_data->cm_lock, timout, TR_CLOCK_TICK);
		}
		/*
		 * If we got the ACK, break. If we didn't,
		 * then send another T_DISCON_REQ.
		 */
		if (cm_entry->x_waitdis == FALSE) {
			cm_entry->x_dead = TRUE;
			break;
		} else {
			RPCLOG(8, "connmgr_dis_and_wait: did"
			    "not get T_DISCON_REQ's ACK for "
			    "connection  %p\n", (void *)cm_entry);
			cm_entry->x_needdis = TRUE;
		}
	}
}

static void
connmgr_cancelconn(struct cm_xprt *cm_entry)
{
	/*
	 * Mark the connection table entry as dead; the next thread that
	 * goes through connmgr_release() will notice this and deal with it.
	 */
	mutex_enter(&connmgr_data->cm_lock);
	cm_entry->x_dead = TRUE;

	/*
	 * Notify any threads waiting for the connection that it isn't
	 * going to happen.
	 */
	cm_entry->x_thread = FALSE;
	cv_broadcast(&cm_entry->x_conn_cv);
	mutex_exit(&connmgr_data->cm_lock);

	connmgr_release(cm_entry);
}

static void
connmgr_close(struct cm_xprt *cm_entry)
{
	mutex_enter(&cm_entry->x_lock);
	while (cm_entry->x_ref != 0) {
		/*
		 * Must be a noninterruptible wait.
		 */
		cv_wait(&cm_entry->x_cv, &cm_entry->x_lock);
	}

	if (cm_entry->x_tiptr != NULL)
		(void) t_kclose(cm_entry->x_tiptr, 1);

	/*
	 * Remove all tags
	 */
	if (!rpc_is_taglist_empty(cm_entry->x_tags))
		rpc_remove_all_tag(&cm_tag_hd, (void *)cm_entry);

	rpc_destroy_taglist(&cm_entry->x_tags);

	mutex_exit(&cm_entry->x_lock);

	if (cm_entry->x_ksp != NULL) {
		mutex_enter(cm_entry->x_ksp->ks_lock);
		cm_entry->x_ksp->ks_private = NULL;
		mutex_exit(cm_entry->x_ksp->ks_lock);

		/*
		 * Must free the buffer we allocated for the
		 * server address in the update function
		 */
		if (((struct cm_kstat_xprt *)(cm_entry->x_ksp->ks_data))->
		    x_server.value.str.addr.ptr != NULL)
			kmem_free(((struct cm_kstat_xprt *)(cm_entry->x_ksp->
			    ks_data))->x_server.value.str.addr.ptr,
			    INET6_ADDRSTRLEN);
		kmem_free(cm_entry->x_ksp->ks_data,
		    cm_entry->x_ksp->ks_data_size);
		kstat_delete(cm_entry->x_ksp);
	}

	mutex_destroy(&cm_entry->x_lock);
	cv_destroy(&cm_entry->x_cv);
	cv_destroy(&cm_entry->x_conn_cv);
	cv_destroy(&cm_entry->x_dis_cv);

	if (cm_entry->x_server.buf != NULL)
		kmem_free(cm_entry->x_server.buf, cm_entry->x_server.maxlen);
	if (cm_entry->x_src.buf != NULL)
		kmem_free(cm_entry->x_src.buf, cm_entry->x_src.maxlen);
	cm_entry->x_cb = FALSE;
	kmem_free(cm_entry, sizeof (struct cm_xprt));
}

/*
 * Called by KRPC after sending the call message to release the connection
 * it was using.
 */
static void
connmgr_release(struct cm_xprt *cm_entry)
{
	mutex_enter(&cm_entry->x_lock);
	cm_entry->x_ref--;
	if (cm_entry->x_ref == 0)
		cv_signal(&cm_entry->x_cv);
	mutex_exit(&cm_entry->x_lock);
}

/*
 * Set TCP receive and xmit buffer size for RPC connections.
 */
static bool_t
connmgr_setbufsz(calllist_t *e, queue_t *wq, cred_t *cr)
{
	int ok = FALSE;
	int val;

	if (rpc_default_tcp_bufsz)
		return (FALSE);

	/*
	 * Only set new buffer size if it's larger than the system
	 * default buffer size. If smaller buffer size is needed
	 * then use /etc/system to set rpc_default_tcp_bufsz to 1.
	 */
	ok = connmgr_getopt_int(wq, SOL_SOCKET, SO_RCVBUF, &val, e, cr);
	if ((ok == TRUE) && (val < rpc_send_bufsz)) {
		ok = connmgr_setopt_int(wq, SOL_SOCKET, SO_RCVBUF,
		    rpc_send_bufsz, e, cr);
		DTRACE_PROBE2(krpc__i__connmgr_rcvbufsz,
		    int, ok, calllist_t *, e);
	}

	ok = connmgr_getopt_int(wq, SOL_SOCKET, SO_SNDBUF, &val, e, cr);
	if ((ok == TRUE) && (val < rpc_recv_bufsz)) {
		ok = connmgr_setopt_int(wq, SOL_SOCKET, SO_SNDBUF,
		    rpc_recv_bufsz, e, cr);
		DTRACE_PROBE2(krpc__i__connmgr_sndbufsz,
		    int, ok, calllist_t *, e);
	}
	return (TRUE);
}

/*
 * Given an open stream, connect to the remote.  Returns true if connected,
 * false otherwise.
 */
static bool_t
connmgr_connect(
	struct cm_xprt		*cm_entry,
	queue_t			*wq,
	struct netbuf		*addr,
	int			addrfmly,
	calllist_t		*e,
	int			*tidu_ptr,
	bool_t			reconnect,
	const struct timeval	*waitp,
	bool_t			nosignal,
	cred_t			*cr)
{
	mblk_t *mp;
	struct T_conn_req *tcr;
	struct T_info_ack *tinfo;
	int interrupted, error;
	int tidu_size, kstat_instance;

	/* if it's a reconnect, flush any lingering data messages */
	if (reconnect)
		(void) putctl1(wq, M_FLUSH, FLUSHRW);

	/*
	 * Note: if the receiver uses SCM_UCRED/getpeerucred the pid will
	 * appear as -1.
	 */
	mp = allocb_cred(sizeof (*tcr) + addr->len, cr, NOPID);
	if (mp == NULL) {
		/*
		 * This is unfortunate, but we need to look up the stats for
		 * this zone to increment the "memory allocation failed"
		 * counter.  curproc->p_zone is safe since we're initiating a
		 * connection and not in some strange streams context.
		 */
		struct rpcstat *rpcstat;

		rpcstat = zone_getspecific(rpcstat_zone_key, rpc_zone());
		ASSERT(rpcstat != NULL);

		RPCLOG0(1, "connmgr_connect: cannot alloc mp for "
		    "sending conn request\n");
		COTSRCSTAT_INCR(rpcstat->rpc_cots_client, rcnomem);
		e->call_status = RPC_SYSTEMERROR;
		e->call_reason = ENOSR;
		return (FALSE);
	}

	/* Set TCP buffer size for RPC connections if needed */
	if (addrfmly == AF_INET || addrfmly == AF_INET6)
		(void) connmgr_setbufsz(e, wq, cr);

	mp->b_datap->db_type = M_PROTO;
	tcr = (struct T_conn_req *)mp->b_rptr;
	bzero(tcr, sizeof (*tcr));
	tcr->PRIM_type = T_CONN_REQ;
	tcr->DEST_length = addr->len;
	tcr->DEST_offset = sizeof (struct T_conn_req);
	mp->b_wptr = mp->b_rptr + sizeof (*tcr);

	bcopy(addr->buf, mp->b_wptr, tcr->DEST_length);
	mp->b_wptr += tcr->DEST_length;

	RPCLOG(8, "connmgr_connect: sending conn request on queue "
	    "%p", (void *)wq);
	RPCLOG(8, " call %p\n", (void *)wq);
	/*
	 * We use the entry in the handle that is normally used for
	 * waiting for RPC replies to wait for the connection accept.
	 */
	if (clnt_dispatch_send(wq, mp, e, 0, 0) != RPC_SUCCESS) {
		DTRACE_PROBE(krpc__e__connmgr__connect__cantsend);
		freemsg(mp);
		return (FALSE);
	}

	mutex_enter(&clnt_pending_lock);

	/*
	 * We wait for the transport connection to be made, or an
	 * indication that it could not be made.
	 */
	interrupted = 0;

	/*
	 * waitforack should have been called with T_OK_ACK, but the
	 * present implementation needs to be passed T_INFO_ACK to
	 * work correctly.
	 */
	error = waitforack(e, T_INFO_ACK, waitp, nosignal);
	if (error == EINTR)
		interrupted = 1;
	if (zone_status_get(curproc->p_zone) >= ZONE_IS_EMPTY) {
		/*
		 * No time to lose; we essentially have been signaled to
		 * quit.
		 */
		interrupted = 1;
	}
#ifdef RPCDEBUG
	if (error == ETIME)
		RPCLOG0(8, "connmgr_connect: giving up "
		    "on connection attempt; "
		    "clnt_dispatch notifyconn "
		    "diagnostic 'no one waiting for "
		    "connection' should not be "
		    "unexpected\n");
#endif
	if (e->call_prev)
		e->call_prev->call_next = e->call_next;
	else
		clnt_pending = e->call_next;
	if (e->call_next)
		e->call_next->call_prev = e->call_prev;
	mutex_exit(&clnt_pending_lock);

	if (e->call_status != RPC_SUCCESS || error != 0) {
		if (interrupted)
			e->call_status = RPC_INTR;
		else if (error == ETIME)
			e->call_status = RPC_TIMEDOUT;
		else if (error == EPROTO) {
			e->call_status = RPC_SYSTEMERROR;
			e->call_reason = EPROTO;
		}

		RPCLOG(8, "connmgr_connect: can't connect, status: "
		    "%s\n", clnt_sperrno(e->call_status));

		if (e->call_reply) {
			freemsg(e->call_reply);
			e->call_reply = NULL;
		}

		return (FALSE);
	}
	/*
	 * The result of the "connection accept" is a T_info_ack
	 * in the call_reply field.
	 */
	ASSERT(e->call_reply != NULL);
	mp = e->call_reply;
	e->call_reply = NULL;
	tinfo = (struct T_info_ack *)mp->b_rptr;

	tidu_size = tinfo->TIDU_size;
	tidu_size -= (tidu_size % BYTES_PER_XDR_UNIT);
	if (tidu_size > COTS_DEFAULT_ALLOCSIZE || (tidu_size <= 0))
		tidu_size = COTS_DEFAULT_ALLOCSIZE;
	*tidu_ptr = tidu_size;

	freemsg(mp);

	/*
	 * Set up the pertinent options.  NODELAY is so the transport doesn't
	 * buffer up RPC messages on either end.  This may not be valid for
	 * all transports.  Failure to set this option is not cause to
	 * bail out so we return success anyway.  Note that lack of NODELAY
	 * or some other way to flush the message on both ends will cause
	 * lots of retries and terrible performance.
	 */
	if (addrfmly == AF_INET || addrfmly == AF_INET6) {
		(void) connmgr_setopt(wq, IPPROTO_TCP, TCP_NODELAY, e, cr);
		if (e->call_status == RPC_XPRTFAILED)
			return (FALSE);
	}

	/*
	 * Since we have a connection, we now need to figure out if
	 * we need to create a kstat. If x_ksp is not NULL then we
	 * are reusing a connection and so we do not need to create
	 * another kstat -- lets just return.
	 */
	if (cm_entry->x_ksp != NULL)
		return (TRUE);

	/*
	 * We need to increment rpc_kstat_instance atomically to prevent
	 * two kstats being created with the same instance.
	 */
	kstat_instance = atomic_inc_32_nv((uint32_t *)&rpc_kstat_instance);

	if ((cm_entry->x_ksp = kstat_create_zone("unix", kstat_instance,
	    "rpc_cots_connections", "rpc", KSTAT_TYPE_NAMED,
	    (uint_t)(sizeof (cm_kstat_xprt_t) / sizeof (kstat_named_t)),
	    KSTAT_FLAG_VIRTUAL, cm_entry->x_zoneid)) == NULL) {
		return (TRUE);
	}

	cm_entry->x_ksp->ks_lock = &connmgr_data->cm_lock;
	cm_entry->x_ksp->ks_private = cm_entry;
	cm_entry->x_ksp->ks_data_size = ((INET6_ADDRSTRLEN * sizeof (char))
	    + sizeof (cm_kstat_template));
	cm_entry->x_ksp->ks_data = kmem_alloc(cm_entry->x_ksp->ks_data_size,
	    KM_SLEEP);
	bcopy(&cm_kstat_template, cm_entry->x_ksp->ks_data,
	    cm_entry->x_ksp->ks_data_size);
	((struct cm_kstat_xprt *)(cm_entry->x_ksp->ks_data))->
	    x_server.value.str.addr.ptr =
	    kmem_alloc(INET6_ADDRSTRLEN, KM_SLEEP);

	cm_entry->x_ksp->ks_update = conn_kstat_update;
	kstat_install(cm_entry->x_ksp);
	return (TRUE);
}

/*
 * Verify that the specified offset falls within the mblk and
 * that the resulting pointer is aligned.
 * Returns NULL if not.
 *
 * code from fs/sockfs/socksubr.c
 */
static void *
connmgr_opt_getoff(mblk_t *mp, t_uscalar_t offset,
    t_uscalar_t length, uint_t align_size)
{
	uintptr_t ptr1, ptr2;

	ASSERT(mp && mp->b_wptr >= mp->b_rptr);
	ptr1 = (uintptr_t)mp->b_rptr + offset;
	ptr2 = (uintptr_t)ptr1 + length;
	if (ptr1 < (uintptr_t)mp->b_rptr || ptr2 > (uintptr_t)mp->b_wptr) {
		return (NULL);
	}
	if ((ptr1 & (align_size - 1)) != 0) {
		return (NULL);
	}
	return ((void *)ptr1);
}

static bool_t
connmgr_getopt_int(queue_t *wq, int level, int name, int *val,
    calllist_t *e, cred_t *cr)
{
	mblk_t *mp;
	struct opthdr *opt, *opt_res;
	struct T_optmgmt_req *tor;
	struct T_optmgmt_ack *opt_ack;
	struct timeval waitp;
	int error;

	mp = allocb_cred(sizeof (struct T_optmgmt_req) +
	    sizeof (struct opthdr) + sizeof (int), cr, NOPID);
	if (mp == NULL)
		return (FALSE);

	mp->b_datap->db_type = M_PROTO;
	tor = (struct T_optmgmt_req *)(mp->b_rptr);
	tor->PRIM_type = T_SVR4_OPTMGMT_REQ;
	tor->MGMT_flags = T_CURRENT;
	tor->OPT_length = sizeof (struct opthdr) + sizeof (int);
	tor->OPT_offset = sizeof (struct T_optmgmt_req);

	opt = (struct opthdr *)(mp->b_rptr + sizeof (struct T_optmgmt_req));
	opt->level = level;
	opt->name = name;
	opt->len = sizeof (int);
	mp->b_wptr += sizeof (struct T_optmgmt_req) + sizeof (struct opthdr) +
	    sizeof (int);

	/*
	 * We will use this connection regardless
	 * of whether or not the option is readable.
	 */
	if (clnt_dispatch_send(wq, mp, e, 0, 0) != RPC_SUCCESS) {
		DTRACE_PROBE(krpc__e__connmgr__getopt__cantsend);
		freemsg(mp);
		return (FALSE);
	}

	mutex_enter(&clnt_pending_lock);

	waitp.tv_sec = clnt_cots_min_conntout;
	waitp.tv_usec = 0;
	error = waitforack(e, T_OPTMGMT_ACK, &waitp, 1);

	if (e->call_prev)
		e->call_prev->call_next = e->call_next;
	else
		clnt_pending = e->call_next;
	if (e->call_next)
		e->call_next->call_prev = e->call_prev;
	mutex_exit(&clnt_pending_lock);

	/* get reply message */
	mp = e->call_reply;
	e->call_reply = NULL;

	if ((!mp) || (e->call_status != RPC_SUCCESS) || (error != 0)) {

		DTRACE_PROBE4(krpc__e__connmgr_getopt, int, name,
		    int, e->call_status, int, error, mblk_t *, mp);

		if (mp)
			freemsg(mp);
		return (FALSE);
	}

	opt_ack = (struct T_optmgmt_ack *)mp->b_rptr;
	opt_res = (struct opthdr *)connmgr_opt_getoff(mp, opt_ack->OPT_offset,
	    opt_ack->OPT_length, __TPI_ALIGN_SIZE);

	if (!opt_res) {
		DTRACE_PROBE4(krpc__e__connmgr_optres, mblk_t *, mp, int, name,
		    int, opt_ack->OPT_offset, int, opt_ack->OPT_length);
		freemsg(mp);
		return (FALSE);
	}
	*val = *(int *)&opt_res[1];

	DTRACE_PROBE2(connmgr_getopt__ok, int, name, int, *val);

	freemsg(mp);
	return (TRUE);
}

/*
 * Called by connmgr_connect to set an option on the new stream.
 */
static bool_t
connmgr_setopt_int(queue_t *wq, int level, int name, int val,
    calllist_t *e, cred_t *cr)
{
	mblk_t *mp;
	struct opthdr *opt;
	struct T_optmgmt_req *tor;
	struct timeval waitp;
	int error;

	mp = allocb_cred(sizeof (struct T_optmgmt_req) +
	    sizeof (struct opthdr) + sizeof (int), cr, NOPID);
	if (mp == NULL) {
		RPCLOG0(1, "connmgr_setopt: cannot alloc mp for option "
		    "request\n");
		return (FALSE);
	}

	mp->b_datap->db_type = M_PROTO;
	tor = (struct T_optmgmt_req *)(mp->b_rptr);
	tor->PRIM_type = T_SVR4_OPTMGMT_REQ;
	tor->MGMT_flags = T_NEGOTIATE;
	tor->OPT_length = sizeof (struct opthdr) + sizeof (int);
	tor->OPT_offset = sizeof (struct T_optmgmt_req);

	opt = (struct opthdr *)(mp->b_rptr + sizeof (struct T_optmgmt_req));
	opt->level = level;
	opt->name = name;
	opt->len = sizeof (int);
	*(int *)((char *)opt + sizeof (*opt)) = val;
	mp->b_wptr += sizeof (struct T_optmgmt_req) + sizeof (struct opthdr) +
	    sizeof (int);

	/*
	 * We will use this connection regardless
	 * of whether or not the option is settable.
	 */
	if (clnt_dispatch_send(wq, mp, e, 0, 0) != RPC_SUCCESS) {
		DTRACE_PROBE(krpc__e__connmgr__setopt__cantsend);
		freemsg(mp);
		return (FALSE);
	}

	mutex_enter(&clnt_pending_lock);

	waitp.tv_sec = clnt_cots_min_conntout;
	waitp.tv_usec = 0;
	error = waitforack(e, T_OPTMGMT_ACK, &waitp, 1);

	if (e->call_prev)
		e->call_prev->call_next = e->call_next;
	else
		clnt_pending = e->call_next;
	if (e->call_next)
		e->call_next->call_prev = e->call_prev;
	mutex_exit(&clnt_pending_lock);

	if (e->call_reply != NULL) {
		freemsg(e->call_reply);
		e->call_reply = NULL;
	}

	if (e->call_status != RPC_SUCCESS || error != 0) {
		RPCLOG(1, "connmgr_setopt: can't set option: %d\n", name);
		return (FALSE);
	}
	RPCLOG(8, "connmgr_setopt: successfully set option: %d\n", name);
	return (TRUE);
}

static bool_t
connmgr_setopt(queue_t *wq, int level, int name, calllist_t *e, cred_t *cr)
{
	return (connmgr_setopt_int(wq, level, name, 1, e, cr));
}

#ifdef	DEBUG

/*
 * This is a knob to let us force code coverage in allocation failure
 * case.
 */
static int	connmgr_failsnd;
#define	CONN_SND_ALLOC(Size, Pri)	\
	((connmgr_failsnd-- > 0) ? NULL : allocb(Size, Pri))

#else

#define	CONN_SND_ALLOC(Size, Pri)	allocb(Size, Pri)

#endif

/*
 * Sends an orderly release on the specified queue.
 * Entered with connmgr_data->cm_lock. Exited without connmgr_data->cm_lock
 */
static void
connmgr_sndrel(struct cm_xprt *cm_entry)
{
	struct T_ordrel_req *torr;
	mblk_t *mp;
	queue_t *q = cm_entry->x_wq;
	ASSERT(MUTEX_HELD(&connmgr_data->cm_lock));
	mp = CONN_SND_ALLOC(sizeof (struct T_ordrel_req), BPRI_LO);
	if (mp == NULL) {
		cm_entry->x_needrel = TRUE;
		mutex_exit(&connmgr_data->cm_lock);
		RPCLOG(1, "connmgr_sndrel: cannot alloc mp for sending ordrel "
		    "to queue %p\n", (void *)q);
		return;
	}
	mutex_exit(&connmgr_data->cm_lock);

	mp->b_datap->db_type = M_PROTO;
	torr = (struct T_ordrel_req *)(mp->b_rptr);
	torr->PRIM_type = T_ORDREL_REQ;
	mp->b_wptr = mp->b_rptr + sizeof (struct T_ordrel_req);

	RPCLOG(8, "connmgr_sndrel: sending ordrel to queue %p\n", (void *)q);
	put(q, mp);
}

/*
 * Sends an disconnect on the specified queue.
 * Entered with connmgr_data->cm_lock. Exited without connmgr_data->cm_lock
 */
static void
connmgr_snddis(struct cm_xprt *cm_entry)
{
	struct T_discon_req *tdis;
	mblk_t *mp;
	queue_t *q = cm_entry->x_wq;

	ASSERT(MUTEX_HELD(&connmgr_data->cm_lock));
	mp = CONN_SND_ALLOC(sizeof (*tdis), BPRI_LO);
	if (mp == NULL) {
		cm_entry->x_needdis = TRUE;
		mutex_exit(&connmgr_data->cm_lock);
		RPCLOG(1, "connmgr_snddis: cannot alloc mp for sending discon "
		    "to queue %p\n", (void *)q);
		return;
	}
	mutex_exit(&connmgr_data->cm_lock);

	mp->b_datap->db_type = M_PROTO;
	tdis = (struct T_discon_req *)mp->b_rptr;
	tdis->PRIM_type = T_DISCON_REQ;
	mp->b_wptr = mp->b_rptr + sizeof (*tdis);

	RPCLOG(8, "connmgr_snddis: sending discon to queue %p\n", (void *)q);
	put(q, mp);
}

void
connmgr_cb_add(struct cm_xprt *cm_entry)
{
	mutex_enter(&connmgr_data->cm_cb_lock);
	list_insert_head(&connmgr_data->cm_cb_hd, cm_entry);
	mutex_exit(&connmgr_data->cm_cb_lock);
}

/*
 * lookup the cb_cm_hd list for a cm_xprt
 * Adds a reference to the xprt
 */
static struct cm_xprt *
connmgr_cb_lookup(queue_t *wq)
{
	struct cm_xprt *cm_entry;

	mutex_enter(&connmgr_data->cm_cb_lock);
	cm_entry = list_head(&connmgr_data->cm_cb_hd);

	while (cm_entry != NULL) {
		if (cm_entry->x_wq == wq) {
			CONN_HOLD(cm_entry);
			break;
		}
		cm_entry = list_next(&connmgr_data->cm_cb_hd, cm_entry);
	}
	mutex_exit(&connmgr_data->cm_cb_lock);

	return (cm_entry);
}

/*
 * Creates a connection manager entry for callback connection
 * and adds it to the callback connection list
 */
int
connmgr_cb_create(void *tp_handle, rpcprog_t prog, rpcvers_t vers,
    int family, void *tag)
{
	struct cm_xprt *cm_entry;
	uint_t addr_len;
	zoneid_t zoneid = rpc_zoneid();
	vnode_t *vp;
	struct sockaddr_storage *sa;
	char *devnam;
	SVCMASTERXPRT *mxprt = (SVCMASTERXPRT *)tp_handle;

	/*
	 * If there is already a cm_xprt for the same transport
	 * then just add the tag.
	 */
	cm_entry = connmgr_cb_lookup(mxprt->xp_wq);
	if (cm_entry != NULL) {
		/*
		 * Do nothing if the same tag already exists
		 * for this cm_xprt, else add the tag
		 */
		if (rpc_cmp_tag(cm_entry->x_tags, tag) == FALSE)
			rpc_add_tag(
			    &cm_tag_hd, (void *)cm_entry, (void *)tag);

		connmgr_release(cm_entry);

		return (0);
	}

	cm_entry = (struct cm_xprt *)
	    kmem_zalloc(sizeof (struct cm_xprt), KM_SLEEP);

	cm_entry->x_tiptr = NULL;

	addr_len = mxprt->xp_rtaddr.len;
	cm_entry->x_server.buf = kmem_zalloc(addr_len, KM_SLEEP);
	bcopy(mxprt->xp_rtaddr.buf, cm_entry->x_server.buf, addr_len);
	cm_entry->x_server.len = cm_entry->x_server.maxlen = addr_len;

	addr_len = mxprt->xp_lcladdr.len;
	cm_entry->x_src.buf = kmem_zalloc(addr_len, KM_SLEEP);
	bcopy(mxprt->xp_lcladdr.buf, cm_entry->x_src.buf, addr_len);
	cm_entry->x_src.len = cm_entry->x_src.maxlen = addr_len;
	cm_entry->x_tiptr = NULL;


	cm_entry->x_state_flags = X_CONNECTED;
	cm_entry->x_ref = 0;
	cm_entry->x_family = family;
	cm_entry->x_zoneid = zoneid;
	mutex_init(&cm_entry->x_lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&cm_entry->x_cv, NULL, CV_DEFAULT, NULL);
	cv_init(&cm_entry->x_conn_cv, NULL, CV_DEFAULT, NULL);
	cm_entry->x_wq = mxprt->xp_wq;
	cm_entry->x_tidu_size = mxprt->xp_msg_size;
	cm_entry->x_prog = prog;
	cm_entry->x_cb = FALSE;

	sa = (struct sockaddr_storage *)mxprt->xp_lcladdr.buf;
	switch (sa->ss_family) {
	case AF_INET:
		devnam = "/dev/tcp";
		break;
	case AF_INET6:
		devnam = "/dev/tcp6";
		break;
	default:
		goto errout;
	}

	if (lookupname(devnam, UIO_SYSSPACE, FOLLOW, NULLVPP, &vp) != 0) {
		goto errout;
	}

	if (vp->v_type != VCHR) {
		VN_RELE(vp);
		goto errout;
	}

	cm_entry->x_rdev = vp->v_rdev;

	VN_RELE(vp);

	/* XXX do we need kstats */
	cm_entry->x_ksp = NULL;
	rpc_init_taglist(&cm_entry->x_tags);
	rpc_add_tag(&cm_tag_hd, (void *)cm_entry, tag);

	connmgr_cb_add(cm_entry);

	return (0);

errout:
	connmgr_close(cm_entry);
	return (1);
}

/*
 * We end up here if there is a connection disconnect.
 * The cm_entry is taken off the list.
 */
static void
connmgr_destroy_impl(queue_t *wq, kmutex_t *lock, list_t *cm_head)
{
	struct cm_xprt *cm_entry, *next;

	mutex_enter(lock);
	cm_entry = list_head(cm_head);

	while (cm_entry != NULL) {
		next = list_next(cm_head, cm_entry);
		if (cm_entry->x_wq == wq) {
			list_remove(cm_head, cm_entry);
			break;
		}
		cm_entry = next;
	}
	mutex_exit(lock);

	if (cm_entry != NULL)
		connmgr_close(cm_entry);
}

void
connmgr_destroy(queue_t *wq)
{
	connmgr_destroy_impl(wq, &connmgr_data->cm_lock,
	    &connmgr_data->cm_hd);
}

void
connmgr_cb_destroy(queue_t *wq)
{
	connmgr_destroy_impl(wq, &connmgr_data->cm_cb_lock,
	    &connmgr_data->cm_cb_hd);
}

/*
 * Sets up the entry for receiving replies, and calls rpcmod's write put proc
 * (through put) to send the call.
 */
static int
clnt_dispatch_send(queue_t *q, mblk_t *mp, calllist_t *e, uint_t xid,
    uint_t queue_flag)
{
	ASSERT(e != NULL);

	e->call_status = RPC_TIMEDOUT;	/* optimistic, eh? */
	e->call_reason = 0;
	e->call_wq = q;
	e->call_xid = xid;
	e->call_notified = FALSE;

	if (!canput(q)) {
		e->call_status = RPC_CANTSEND;
		e->call_reason = ENOBUFS;
		return (RPC_CANTSEND);
	}

	/*
	 * If queue_flag is set then the calllist_t is already on the hash
	 * queue.  In this case just send the message and return.
	 */
	if (queue_flag) {
		put(q, mp);
		return (RPC_SUCCESS);

	}

	/*
	 * Set up calls for RPC requests (with XID != 0) on the hash
	 * queue for fast lookups and place other calls (i.e.
	 * connection management) on the linked list.
	 */
	if (xid != 0) {
		RPCLOG(64, "clnt_dispatch_send: putting xid 0x%x on "
		    "dispatch list\n", xid);
		e->call_hash = call_hash(xid, clnt_cots_hash_size);
		e->call_bucket = &cots_call_ht[e->call_hash];
		call_table_enter(e);
	} else {
		mutex_enter(&clnt_pending_lock);
		if (clnt_pending)
			clnt_pending->call_prev = e;
		e->call_next = clnt_pending;
		e->call_prev = NULL;
		clnt_pending = e;
		mutex_exit(&clnt_pending_lock);
	}

	put(q, mp);
	return (RPC_SUCCESS);
}

/*
 * Called by rpcmod to notify a client with a clnt_pending call that its reply
 * has arrived.  If we can't find a client waiting for this reply, we log
 * the error and return.
 */
bool_t
clnt_dispatch_notify(mblk_t *mp, zoneid_t zoneid, uint32_t xid)
{
	calllist_t *e = NULL;
	call_table_t *chtp;
	uint_t hash;

	hash = call_hash(xid, clnt_cots_hash_size);
	chtp = &cots_call_ht[hash];
	/* call_table_find returns with the hash bucket locked */
	call_table_find(chtp, xid, e);

	if (e != NULL) {
		/*
		 * Found thread waiting for this reply
		 */
		mutex_enter(&e->call_lock);

		/*
		 * verify that the reply is coming in on
		 * the same zone that it was sent from.
		 */
		if (e->call_zoneid != zoneid) {
			mutex_exit(&e->call_lock);
			mutex_exit(&chtp->ct_lock);
			RPCLOG0(1, "clnt_dispatch_notify: incorrect zoneid\n");
			return (FALSE);
		}

		if (e->call_reply)
			/*
			 * This can happen under the following scenario:
			 * clnt_cots_kcallit() times out on the response,
			 * rfscall() repeats the CLNT_CALL() with
			 * the same xid, clnt_cots_kcallit() sends the retry,
			 * thereby putting the clnt handle on the pending list,
			 * the first response arrives, signalling the thread
			 * in clnt_cots_kcallit(). Before that thread is
			 * dispatched, the second response arrives as well,
			 * and clnt_dispatch_notify still finds the handle on
			 * the pending list, with call_reply set. So free the
			 * old reply now.
			 *
			 * It is also possible for a response intended for
			 * an RPC call with a different xid to reside here.
			 * This can happen if the thread that owned this
			 * client handle prior to the current owner bailed
			 * out and left its call record on the dispatch
			 * queue.  A window exists where the response can
			 * arrive before the current owner dispatches its
			 * RPC call.
			 *
			 * In any case, this is the very last point where we
			 * can safely check the call_reply field before
			 * placing the new response there.
			 */
			freemsg(e->call_reply);
		e->call_reply = mp;
		e->call_status = RPC_SUCCESS;
		e->call_notified = TRUE;
		cv_signal(&e->call_cv);
		mutex_exit(&e->call_lock);
		mutex_exit(&chtp->ct_lock);
		return (TRUE);
	} else {
		zone_t *zone;
		struct rpcstat *rpcstat;

		mutex_exit(&chtp->ct_lock);
		RPCLOG(65, "clnt_dispatch_notify: no caller for reply 0x%x\n",
		    xid);
		/*
		 * This is unfortunate, but we need to lookup the zone so we
		 * can increment its "rcbadxids" counter.
		 */
		zone = zone_find_by_id(zoneid);
		if (zone == NULL) {
			/*
			 * The zone went away...
			 */
			return (FALSE);
		}
		rpcstat = zone_getspecific(rpcstat_zone_key, zone);
		if (zone_status_get(zone) >= ZONE_IS_SHUTTING_DOWN) {
			/*
			 * Not interested
			 */
			zone_rele(zone);
			return (FALSE);
		}
		COTSRCSTAT_INCR(rpcstat->rpc_cots_client, rcbadxids);
		zone_rele(zone);
	}
	return (FALSE);
}

/*
 * Called by rpcmod when a non-data indication arrives.  The ones in which we
 * are interested are connection indications and options acks.  We dispatch
 * based on the queue the indication came in on.  If we are not interested in
 * what came in, we return false to rpcmod, who will then pass it upstream.
 */
bool_t
clnt_dispatch_notifyconn(queue_t *q, mblk_t *mp)
{
	calllist_t *e;
	int type;

	ASSERT((q->q_flag & QREADR) == 0);

	type = ((union T_primitives *)mp->b_rptr)->type;
	RPCLOG(8, "clnt_dispatch_notifyconn: prim type: [%s]\n",
	    rpc_tpiprim2name(type));
	mutex_enter(&clnt_pending_lock);
	for (e = clnt_pending; /* NO CONDITION */; e = e->call_next) {
		if (e == NULL) {
			mutex_exit(&clnt_pending_lock);
			RPCLOG(1, "clnt_dispatch_notifyconn: no one waiting "
			    "for connection on queue 0x%p\n", (void *)q);
			return (FALSE);
		}
		if (e->call_wq == q)
			break;
	}

	switch (type) {
	case T_CONN_CON:
		/*
		 * The transport is now connected, send a T_INFO_REQ to get
		 * the tidu size.
		 */
		mutex_exit(&clnt_pending_lock);
		ASSERT(mp->b_datap->db_lim - mp->b_datap->db_base >=
		    sizeof (struct T_info_req));
		mp->b_rptr = mp->b_datap->db_base;
		((union T_primitives *)mp->b_rptr)->type = T_INFO_REQ;
		mp->b_wptr = mp->b_rptr + sizeof (struct T_info_req);
		mp->b_datap->db_type = M_PCPROTO;
		put(q, mp);
		return (TRUE);
	case T_INFO_ACK:
	case T_OPTMGMT_ACK:
		e->call_status = RPC_SUCCESS;
		e->call_reply = mp;
		e->call_notified = TRUE;
		cv_signal(&e->call_cv);
		break;
	case T_ERROR_ACK:
		e->call_status = RPC_CANTCONNECT;
		e->call_reply = mp;
		e->call_notified = TRUE;
		cv_signal(&e->call_cv);
		break;
	case T_OK_ACK:
		/*
		 * Great, but we are really waiting for a T_CONN_CON
		 */
		freemsg(mp);
		break;
	default:
		mutex_exit(&clnt_pending_lock);
		RPCLOG(1, "clnt_dispatch_notifyconn: bad type %d\n", type);
		return (FALSE);
	}

	mutex_exit(&clnt_pending_lock);
	return (TRUE);
}

/*
 * Called by rpcmod when the transport is (or should be) going away.  Informs
 * all callers waiting for replies and marks the entry in the connection
 * manager's list as unconnected, and either closing (close handshake in
 * progress) or dead.
 */
void
clnt_dispatch_notifyall(queue_t *q, int32_t msg_type, int32_t reason)
{
	calllist_t *e;
	call_table_t *ctp;
	struct cm_xprt *cm_entry;
	int have_connmgr_lock;
	int i;

	ASSERT((q->q_flag & QREADR) == 0);

	RPCLOG(1, "clnt_dispatch_notifyall on queue %p", (void *)q);
	RPCLOG(1, " received a notifcation prim type [%s]",
	    rpc_tpiprim2name(msg_type));
	RPCLOG(1, " and reason %d\n", reason);

	/*
	 * Find the transport entry in the connection manager's list, close
	 * the transport and delete the entry.  In the case where rpcmod's
	 * idle timer goes off, it sends us a T_ORDREL_REQ, indicating we
	 * should gracefully close the connection.
	 */
	have_connmgr_lock = 1;
	mutex_enter(&connmgr_data->cm_lock);
	for (cm_entry = list_head(&connmgr_data->cm_hd);
	    cm_entry != NULL;
	    cm_entry = list_next(&connmgr_data->cm_hd, cm_entry)) {
		ASSERT(cm_entry != list_next(&connmgr_data->cm_hd, cm_entry));
		if (cm_entry->x_wq == q) {
			ASSERT(MUTEX_HELD(&connmgr_data->cm_lock));
			ASSERT(have_connmgr_lock == 1);
			switch (msg_type) {
			case T_ORDREL_REQ:

				if (cm_entry->x_dead) {
					RPCLOG(1, "idle timeout on dead "
					    "connection: %p\n",
					    (void *)cm_entry);
					if (clnt_stop_idle != NULL)
						(*clnt_stop_idle)(q);
					break;
				}

				/*
				 * Only mark the connection as dead if it is
				 * connected and idle.
				 * An unconnected connection has probably
				 * gone idle because the server is down,
				 * and when it comes back up there will be
				 * retries that need to use that connection.
				 */
				if (cm_entry->x_connected ||
				    cm_entry->x_doomed) {
					if (cm_entry->x_ordrel) {
						if (cm_entry->x_closing ==
						    TRUE) {
							/*
							 * The connection is
							 * obviously wedged due
							 * to a bug or problem
							 * with the transport.
							 * Mark it as dead.
							 * Otherwise we can
							 * leak connections.
							 */
							cm_entry->x_dead = TRUE;
							mutex_exit(
							    &connmgr_data->
							    cm_lock);
							have_connmgr_lock = 0;
							if (clnt_stop_idle !=
							    NULL)
							(*clnt_stop_idle)(q);
							break;
						}
						cm_entry->x_closing = TRUE;
						connmgr_sndrel(cm_entry);
						have_connmgr_lock = 0;
					} else {
						cm_entry->x_dead = TRUE;
						mutex_exit(
						    &connmgr_data->cm_lock);
						have_connmgr_lock = 0;
						if (clnt_stop_idle != NULL)
							(*clnt_stop_idle)(q);
					}
				} else {
					/*
					 * We don't mark the connection
					 * as dead, but we turn off the
					 * idle timer.
					 */
					mutex_exit(&connmgr_data->cm_lock);
					have_connmgr_lock = 0;
					if (clnt_stop_idle != NULL)
						(*clnt_stop_idle)(q);
					RPCLOG(1, "clnt_dispatch_notifyall:"
					    " ignoring timeout from rpcmod"
					    " (q %p) because we are not "
					    " connected\n", (void *)q);
				}
				break;
			case T_ORDREL_IND:
				/*
				 * If this entry is marked closing, then we are
				 * completing a close handshake, and the
				 * connection is dead.  Otherwise, the server is
				 * trying to close. Since the server will not
				 * be sending any more RPC replies, we abort
				 * the connection, including flushing
				 * any RPC requests that are in-transit.
				 * In either case, mark the entry as dead so
				 * that it can be closed by the connection
				 * manager's garbage collector.
				 */
				cm_entry->x_dead = TRUE;
				if (cm_entry->x_closing) {
					mutex_exit(&connmgr_data->cm_lock);
					have_connmgr_lock = 0;
					if (clnt_stop_idle != NULL)
						(*clnt_stop_idle)(q);
				} else {
					/*
					 * if we're getting a disconnect
					 * before we've finished our
					 * connect attempt, mark it for
					 * later processing
					 */
					if (cm_entry->x_thread)
						cm_entry->x_early_disc = TRUE;
					else
						cm_entry->x_connected = FALSE;
					cm_entry->x_waitdis = TRUE;
					connmgr_snddis(cm_entry);
					have_connmgr_lock = 0;
				}
				break;

			case T_ERROR_ACK:
			case T_OK_ACK:
				cm_entry->x_waitdis = FALSE;
				cv_signal(&cm_entry->x_dis_cv);
				mutex_exit(&connmgr_data->cm_lock);
				return;

			case T_DISCON_REQ:
				if (cm_entry->x_thread)
					cm_entry->x_early_disc = TRUE;
				else
					cm_entry->x_connected = FALSE;
				cm_entry->x_waitdis = TRUE;

				connmgr_snddis(cm_entry);
				have_connmgr_lock = 0;
				break;

			case T_DISCON_IND:
			default:
				/*
				 * if we're getting a disconnect before
				 * we've finished our connect attempt,
				 * mark it for later processing
				 */
				if (cm_entry->x_closing) {
					cm_entry->x_dead = TRUE;
					mutex_exit(&connmgr_data->cm_lock);
					have_connmgr_lock = 0;
					if (clnt_stop_idle != NULL)
						(*clnt_stop_idle)(q);
				} else {
					if (cm_entry->x_thread) {
						cm_entry->x_early_disc = TRUE;
					} else {
						cm_entry->x_dead = TRUE;
						cm_entry->x_connected = FALSE;
					}
				}
				break;
			}
			break;
		}
	}

	if (have_connmgr_lock)
		mutex_exit(&connmgr_data->cm_lock);

	if (msg_type == T_ERROR_ACK || msg_type == T_OK_ACK) {
		RPCLOG(1, "clnt_dispatch_notifyall: (wq %p) could not find "
		    "connmgr entry for discon ack\n", (void *)q);
		return;
	}

	/*
	 * Then kick all the clnt_pending calls out of their wait.  There
	 * should be no clnt_pending calls in the case of rpcmod's idle
	 * timer firing.
	 */
	for (i = 0; i < clnt_cots_hash_size; i++) {
		ctp = &cots_call_ht[i];
		mutex_enter(&ctp->ct_lock);
		for (e = ctp->ct_call_next;
		    e != (calllist_t *)ctp;
		    e = e->call_next) {
			if (e->call_wq == q && e->call_notified == FALSE) {
				RPCLOG(1,
				    "clnt_dispatch_notifyall for queue %p ",
				    (void *)q);
				RPCLOG(1, "aborting clnt_pending call %p\n",
				    (void *)e);

				if (msg_type == T_DISCON_IND)
					e->call_reason = reason;
				e->call_notified = TRUE;
				e->call_status = RPC_XPRTFAILED;
				cv_signal(&e->call_cv);
			}
		}
		mutex_exit(&ctp->ct_lock);
	}

	mutex_enter(&clnt_pending_lock);
	for (e = clnt_pending; e; e = e->call_next) {
		/*
		 * Only signal those RPC handles that haven't been
		 * signalled yet. Otherwise we can get a bogus call_reason.
		 * This can happen if thread A is making a call over a
		 * connection. If the server is killed, it will cause
		 * reset, and reason will default to EIO as a result of
		 * a T_ORDREL_IND. Thread B then attempts to recreate
		 * the connection but gets a T_DISCON_IND. If we set the
		 * call_reason code for all threads, then if thread A
		 * hasn't been dispatched yet, it will get the wrong
		 * reason. The bogus call_reason can make it harder to
		 * discriminate between calls that fail because the
		 * connection attempt failed versus those where the call
		 * may have been executed on the server.
		 */
		if (e->call_wq == q && e->call_notified == FALSE) {
			RPCLOG(1, "clnt_dispatch_notifyall for queue %p ",
			    (void *)q);
			RPCLOG(1, " aborting clnt_pending call %p\n",
			    (void *)e);

			if (msg_type == T_DISCON_IND)
				e->call_reason = reason;
			e->call_notified = TRUE;
			/*
			 * Let the caller timeout, else it will retry
			 * immediately.
			 */
			e->call_status = RPC_XPRTFAILED;

			/*
			 * We used to just signal those threads
			 * waiting for a connection, (call_xid = 0).
			 * That meant that threads waiting for a response
			 * waited till their timeout expired. This
			 * could be a long time if they've specified a
			 * maximum timeout. (2^31 - 1). So we
			 * Signal all threads now.
			 */
			cv_signal(&e->call_cv);
		}
	}
	mutex_exit(&clnt_pending_lock);
}


/*
 * after resuming a system that's been suspended for longer than the
 * NFS server's idle timeout (svc_idle_timeout for Solaris 2), rfscall()
 * generates "NFS server X not responding" and "NFS server X ok" messages;
 * here we reset inet connections to cause a re-connect and avoid those
 * NFS messages.  see 4045054
 */
boolean_t
connmgr_cpr_reset(void *arg __unused, int code)
{
	struct cm_xprt *cxp;

	if (code == CB_CODE_CPR_CHKPT)
		return (B_TRUE);

	if (mutex_tryenter(&connmgr_data->cm_lock) == 0)
		return (B_FALSE);
	for (cxp = list_head(&connmgr_data->cm_hd);
	    cxp != NULL;
	    cxp = list_next(&connmgr_data->cm_hd, cxp)) {
		if ((cxp->x_family == AF_INET || cxp->x_family == AF_INET6) &&
		    cxp->x_connected == TRUE) {
			if (cxp->x_thread)
				cxp->x_early_disc = TRUE;
			else
				cxp->x_connected = FALSE;
			cxp->x_needdis = TRUE;
		}
	}
	mutex_exit(&connmgr_data->cm_lock);
	return (B_TRUE);
}

void
clnt_cots_stats_init(zoneid_t zoneid, struct rpc_cots_client **statsp)
{

	*statsp = (struct rpc_cots_client *)rpcstat_zone_init_common(zoneid,
	    "unix", "rpc_cots_client", (const kstat_named_t *)&cots_rcstat_tmpl,
	    sizeof (cots_rcstat_tmpl));
}

void
clnt_cots_stats_fini(zoneid_t zoneid, struct rpc_cots_client **statsp)
{
	rpcstat_zone_fini_common(zoneid, "unix", "rpc_cots_client");
	kmem_free(*statsp, sizeof (cots_rcstat_tmpl));
}

void
clnt_cots_init(void)
{
	connmgr_data = kmem_alloc(sizeof (*connmgr_data), KM_SLEEP);
	list_create(&connmgr_data->cm_hd, sizeof (struct cm_xprt),
	    offsetof(struct cm_xprt, x_next));
	list_create(&connmgr_data->cm_cb_hd, sizeof (struct cm_xprt),
	    offsetof(struct cm_xprt, x_next));
	mutex_init(&connmgr_data->cm_lock, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&connmgr_data->cm_cb_lock, NULL, MUTEX_DEFAULT, NULL);

	rpc_taghd_init(&cm_tag_hd,
	    offsetof(struct cm_xprt, x_tags));

	if (clnt_cots_hash_size < DEFAULT_MIN_HASH_SIZE)
		clnt_cots_hash_size = DEFAULT_MIN_HASH_SIZE;

	cots_call_ht = call_table_init(clnt_cots_hash_size);
	zone_key_create(&zone_cots_key, NULL, NULL, clnt_zone_destroy);
}

void
clnt_cots_fini(void)
{
	rpc_taghd_destroy(&cm_tag_hd);
	(void) zone_key_delete(zone_cots_key);
	kmem_free(connmgr_data, sizeof (*connmgr_data));
	connmgr_data = NULL;
}

/*
 * Wait for TPI ack, returns success only if expected ack is received
 * within timeout period.
 */

static int
waitforack(calllist_t *e, t_scalar_t ack_prim, const struct timeval *waitp,
    bool_t nosignal)
{
	union T_primitives *tpr;
	clock_t timout;
	int cv_stat = 1;

	ASSERT(MUTEX_HELD(&clnt_pending_lock));
	while (e->call_reply == NULL) {
		if (waitp != NULL) {
			timout = waitp->tv_sec * drv_usectohz(MICROSEC) +
			    drv_usectohz(waitp->tv_usec);
			if (nosignal)
				cv_stat = cv_reltimedwait(&e->call_cv,
				    &clnt_pending_lock, timout, TR_CLOCK_TICK);
			else
				cv_stat = cv_reltimedwait_sig(&e->call_cv,
				    &clnt_pending_lock, timout, TR_CLOCK_TICK);
		} else {
			if (nosignal)
				cv_wait(&e->call_cv, &clnt_pending_lock);
			else
				cv_stat = cv_wait_sig(&e->call_cv,
				    &clnt_pending_lock);
		}
		if (cv_stat == -1)
			return (ETIME);
		if (cv_stat == 0)
			return (EINTR);
		/*
		 * if we received an error from the server and we know a reply
		 * is not going to be sent, do not wait for the full timeout,
		 * return now.
		 */
		if (e->call_status == RPC_XPRTFAILED)
			return (e->call_reason);
	}
	tpr = (union T_primitives *)e->call_reply->b_rptr;
	if (tpr->type == ack_prim)
		return (0); /* Success */

	if (tpr->type == T_ERROR_ACK) {
		if (tpr->error_ack.TLI_error == TSYSERR)
			return (tpr->error_ack.UNIX_error);
		else
			return (t_tlitosyserr(tpr->error_ack.TLI_error));
	}

	return (EPROTO); /* unknown or unexpected primitive */
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

#include <sys/param.h>
#include <sys/types.h>
#include <rpc/types.h>
#include <netinet/in.h>
#include <rpc/auth.h>
#include <rpc/clnt.h>
#include <sys/tiuser.h>
#include <sys/t_kuser.h>
#include <rpc/svc.h>
#include <rpc/xdr.h>
#include <sys/file.h>
#include <sys/user.h>
#include <sys/proc.h>
#include <sys/vnode.h>
#include <sys/stream.h>
#include <sys/tihdr.h>
#include <sys/fcntl.h>
#include <sys/socket.h>
#include <sys/sysmacros.h>
#include <sys/errno.h>
#include <sys/cred.h>
#include <sys/systm.h>
#include <sys/cmn_err.h>

#define	NC_INET		"inet"

#define	MAX_PRIV	(IPPORT_RESERVED-1)
#define	MIN_PRIV	(IPPORT_RESERVED/2)

ushort_t clnt_udp_last_used = MIN_PRIV;
ushort_t clnt_tcp_last_used = MIN_PRIV;

/*
 * PSARC 2003/523 Contract Private Interface
 * clnt_tli_kcreate
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
int
clnt_tli_kcreate(
	struct knetconfig	*config,
	struct netbuf		*svcaddr,	/* Servers address */
	rpcprog_t		prog,		/* Program number */
	rpcvers_t		vers,		/* Version number */
	uint_t			max_msgsize,
	int			retries,
	struct cred		*cred,
	CLIENT			**ncl)
{
	CLIENT			*cl;		/* Client handle */
	int			error;
	int			family = AF_UNSPEC;

	error = 0;
	cl = NULL;

	RPCLOG(8, "clnt_tli_kcreate: prog %x", prog);
	RPCLOG(8, ", vers %d", vers);
	RPCLOG(8, ", knc_semantics %d", config->knc_semantics);
	RPCLOG(8, ", knc_protofmly %s", config->knc_protofmly);
	RPCLOG(8, ", knc_proto %s\n", config->knc_proto);

	if (config == NULL || config->knc_protofmly == NULL || ncl == NULL) {
		RPCLOG0(1, "clnt_tli_kcreate: bad config or handle\n");
		return (EINVAL);
	}

	switch (config->knc_semantics) {
	case NC_TPI_CLTS:
		RPCLOG0(8, "clnt_tli_kcreate: CLTS selected\n");
		error = clnt_clts_kcreate(config, svcaddr, prog, vers,
		    retries, cred, &cl);
		if (error != 0) {
			RPCLOG(1,
			"clnt_tli_kcreate: clnt_clts_kcreate failed error %d\n",
			    error);
			return (error);
		}
		break;

	case NC_TPI_COTS:
	case NC_TPI_COTS_ORD:
		RPCLOG0(8, "clnt_tli_kcreate: COTS selected\n");
		if (strcmp(config->knc_protofmly, NC_INET) == 0)
			family = AF_INET;
		else if (strcmp(config->knc_protofmly, NC_INET6) == 0)
			family = AF_INET6;
		error = clnt_cots_kcreate(config->knc_rdev, svcaddr, family,
		    prog, vers, max_msgsize, cred, &cl);
		if (error != 0) {
			RPCLOG(1,
			"clnt_tli_kcreate: clnt_cots_kcreate failed error %d\n",
			    error);
			return (error);
		}
		break;
	case NC_TPI_RDMA:
		RPCLOG0(8, "clnt_tli_kcreate: RDMA selected\n");
		/*
		 * RDMA doesn't support TSOL. It's better to
		 * disallow it here.
		 */
		if (is_system_labeled()) {
			RPCLOG0(1, "clnt_tli_kcreate: tsol not supported\n");
			return (EPROTONOSUPPORT);
		}

		if (strcmp(config->knc_protofmly, NC_INET) == 0)
			family = AF_INET;
		else if (strcmp(config->knc_protofmly, NC_INET6) == 0)
			family = AF_INET6;
		error = clnt_rdma_kcreate(config->knc_proto,
		    (void *)config->knc_rdev, svcaddr, family, prog, vers, cred,
		    &cl);
		if (error != 0) {
			RPCLOG(1,
			"clnt_tli_kcreate: clnt_rdma_kcreate failed error %d\n",
			    error);
			return (error);
		}
		break;
	default:
		error = EINVAL;
		RPCLOG(1, "clnt_tli_kcreate: Bad service type %d\n",
		    config->knc_semantics);
		return (error);
	}
	*ncl = cl;
	return (0);
}

/*
 * "Kinit" a client handle by calling the appropriate cots or clts routine.
 *
 * PSARC 2003/523 Contract Private Interface
 * clnt_tli_kinit
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
int
clnt_tli_kinit(
	CLIENT		*h,
	struct knetconfig *config,
	struct netbuf	*addr,
	uint_t		max_msgsize,
	int		retries,
	struct cred	*cred)
{
	int error = 0;
	int family = AF_UNSPEC;

	switch (config->knc_semantics) {
	case NC_TPI_CLTS:
		clnt_clts_kinit(h, addr, retries, cred);
		break;
	case NC_TPI_COTS:
	case NC_TPI_COTS_ORD:
		RPCLOG0(2, "clnt_tli_kinit: COTS selected\n");
		if (strcmp(config->knc_protofmly, NC_INET) == 0)
			family = AF_INET;
		else if (strcmp(config->knc_protofmly, NC_INET6) == 0)
			family = AF_INET6;
		clnt_cots_kinit(h, config->knc_rdev, family,
		    addr, max_msgsize, cred);
		break;
	case NC_TPI_RDMA:
		RPCLOG0(2, "clnt_tli_kinit: RDMA selected\n");
		clnt_rdma_kinit(h, config->knc_proto,
		    (void *)config->knc_rdev, addr, cred);
		break;
	default:
		error = EINVAL;
	}

	return (error);
}


/*
 * try to bind to a reserved port
 */
int
bindresvport(
	TIUSER		*tiptr,
	struct netbuf	*addr,
	struct netbuf	*bound_addr,
	bool_t		tcp)
{
	struct sockaddr_in	*sin;
	struct sockaddr_in6	*sin6;
	bool_t			ipv6_flag = 0;
	int			i;
	struct t_bind		*req;
	struct t_bind		*ret;
	int			error;
	bool_t			loop_twice;
	int			start;
	int			stop;
	ushort_t			*last_used;

	if ((error = t_kalloc(tiptr, T_BIND, T_ADDR, (char **)&req)) != 0) {
		RPCLOG(1, "bindresvport: t_kalloc %d\n", error);
		return (error);
	}

	if ((error = t_kalloc(tiptr, T_BIND, T_ADDR, (char **)&ret)) != 0) {
		RPCLOG(1, "bindresvport: t_kalloc %d\n", error);
		(void) t_kfree(tiptr, (char *)req, T_BIND);
		return (error);
	}

	/* now separate IPv4 and IPv6 by looking at len of tiptr.addr */
	if (tiptr->tp_info.addr == sizeof (struct sockaddr_in6)) {
		/* it's IPv6 */
		ipv6_flag = 1;
		sin6 = (struct sockaddr_in6 *)req->addr.buf;
		sin6->sin6_family = AF_INET6;
		bzero((char *)&sin6->sin6_addr, sizeof (struct in6_addr));
		req->addr.len = sizeof (struct sockaddr_in6);
	} else {
		/* LINTED pointer alignment */
		sin = (struct sockaddr_in *)req->addr.buf;
		sin->sin_family = AF_INET;
		sin->sin_addr.s_addr = INADDR_ANY;
		req->addr.len = sizeof (struct sockaddr_in);
	}

	int useresvport = 0;
	if (addr) {
		if (ipv6_flag) {
			bcopy(addr->buf, (char *)sin6,
			    sizeof (struct sockaddr_in6));
			if (sin6->sin6_port != 0) {
				useresvport = 1;
			}
		} else {
			bcopy(addr->buf, req->addr.buf, addr->len);
			if (sin->sin_port != 0) {
				useresvport = 1;
			}
		}
		req->addr.len = addr->len;
		RPCLOG(8, "bindresvport: calling t_kbind useresvport = %d\n",
		    useresvport);
	}
	/*
	 * Caller wants to bind to a specific port, so don't bother with the
	 * loop that binds to the next free one.
	 */
	if (useresvport) {
		if ((error = t_kbind(tiptr, req, ret)) != 0) {
			RPCLOG(1, "bindresvport: t_kbind: %d\n", error);
			/*
			 * The unbind is called in case the bind failed
			 * with an EINTR potentially leaving the
			 * transport in bound state.
			 */
			if (error == EINTR)
				(void) t_kunbind(tiptr);
		} else if (bcmp(req->addr.buf, ret->addr.buf,
		    ret->addr.len) != 0) {
			RPCLOG0(1, "bindresvport: bcmp error\n");
			(void) t_kunbind(tiptr);
			error = EADDRINUSE;
		}
	} else {
		if (tcp)
			last_used = &clnt_tcp_last_used;
		else
			last_used = &clnt_udp_last_used;
		error = EADDRINUSE;
		stop = MIN_PRIV;

		start = (*last_used == MIN_PRIV ? MAX_PRIV : *last_used - 1);
		loop_twice = (start < MAX_PRIV ? TRUE : FALSE);

bindresvport_again:
		for (i = start;
		    (error == EADDRINUSE || error == EADDRNOTAVAIL) &&
		    i >= stop; i--) {
			if (ipv6_flag)
				sin6->sin6_port = htons(i);
			else
				sin->sin_port = htons(i);
			RPCLOG(8, "bindresvport: calling t_kbind tiptr = 0%p\n",
			    (void *)tiptr);
			if ((error = t_kbind(tiptr, req, ret)) != 0) {
				RPCLOG(1, "bindresvport: t_kbind: %d\n", error);
				/*
				 * The unbind is called in case the bind failed
				 * with an EINTR potentially leaving the
				 * transport in bound state.
				 */
				if (error == EINTR)
					(void) t_kunbind(tiptr);
			} else if (bcmp(req->addr.buf, ret->addr.buf,
			    ret->addr.len) != 0) {
				RPCLOG0(1, "bindresvport: bcmp error\n");
				(void) t_kunbind(tiptr);
				error = EADDRINUSE;
			} else
				error = 0;
		}
		if (!error) {
			if (ipv6_flag) {
				RPCLOG(8, "bindresvport: port assigned %d\n",
				    sin6->sin6_port);
				*last_used = ntohs(sin6->sin6_port);
			} else {
				RPCLOG(8, "bindresvport: port assigned %d\n",
				    sin->sin_port);
				*last_used = ntohs(sin->sin_port);
			}
		} else if (loop_twice) {
			loop_twice = FALSE;
			start = MAX_PRIV;
			stop = *last_used + 1;
			goto bindresvport_again;
		}
	}

	if (!error && bound_addr) {
		if (bound_addr->maxlen < ret->addr.len) {
			kmem_free(bound_addr->buf, bound_addr->maxlen);
			bound_addr->buf = kmem_zalloc(ret->addr.len, KM_SLEEP);
			bound_addr->maxlen = ret->addr.len;
		}
		bcopy(ret->addr.buf, bound_addr->buf, ret->addr.len);
		bound_addr->len = ret->addr.len;
	}
	(void) t_kfree(tiptr, (char *)req, T_BIND);
	(void) t_kfree(tiptr, (char *)ret, T_BIND);
	return (error);
}

void
clnt_init(void)
{
	clnt_cots_init();
	clnt_clts_init();
}

void
clnt_fini(void)
{
	clnt_clts_fini();
	clnt_cots_fini();
}

call_table_t *
call_table_init(int size)
{
	call_table_t *ctp;
	int i;

	ctp = kmem_alloc(sizeof (call_table_t) * size, KM_SLEEP);

	for (i = 0; i < size; i++) {
		ctp[i].ct_call_next = (calllist_t *)&ctp[i];
		ctp[i].ct_call_prev = (calllist_t *)&ctp[i];
		mutex_init(&ctp[i].ct_lock, NULL, MUTEX_DEFAULT, NULL);
		ctp[i].ct_len = 0;
	}

	return (ctp);
}

/*
 * Initialize a netbuf suitable for
 * describing an address
 */
void
clnt_init_netbuf(struct netbuf *nbuf, int len)
{
	nbuf->buf = kmem_zalloc(len, KM_SLEEP);
	nbuf->maxlen = len;
	nbuf->len = 0;
}

/*
 * Free a netbuf
 */
void
clnt_free_netbuf(struct netbuf *nbuf)
{
	if (nbuf == NULL || nbuf->buf == NULL) {
#ifdef DEBUG
		cmn_err(CE_PANIC, "Null netbuf in clnt_free_netbuf");
#endif
		return;
	}
	kmem_free(nbuf->buf, nbuf->maxlen);
	nbuf->buf = NULL;
	nbuf->maxlen = 0;
	nbuf->len = 0;
}

/*
 * Duplicate a netbuf, must be followed by a clnt_free_netbuf().
 */
void
clnt_dup_netbuf(const struct netbuf *from, struct netbuf *to)
{
	clnt_init_netbuf(to, from->len);
	to->len = from->len;

	bcopy(from->buf, to->buf, (size_t)from->len);
}

/*
 * Compare a netbuf.
 */
int
clnt_cmp_netaddr(const struct netbuf *from, struct netbuf *to)
{
	if (to->len != from->len || from->len == 0)
		return (1);
	struct sockaddr *saddr = (struct sockaddr *)(from->buf);
	struct sockaddr *toaddr = (struct sockaddr *)(to->buf);

	if (saddr->sa_family == AF_INET && toaddr->sa_family == AF_INET) {
		return bcmp(&((struct sockaddr_in *)from->buf)->sin_addr,
		    &((struct sockaddr_in *)to->buf)->sin_addr,
		    sizeof (struct in_addr));
	} else if (saddr->sa_family == AF_INET6 &&
	    toaddr->sa_family == AF_INET6) {
		return bcmp(&(((struct sockaddr_in6 *)from->buf)->sin6_addr),
		    &(((struct sockaddr_in6 *)to->buf)->sin6_addr),
		    sizeof (struct in6_addr));
	}
	return (1);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved  	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

/*
 * clnt_perror.c
 */
#include <sys/types.h>
#include <sys/t_lock.h>
#include <rpc/types.h>
#include <rpc/auth.h>
#include <rpc/clnt.h>
#include <sys/systm.h>
#include <sys/cmn_err.h>
#include <sys/inttypes.h>

/*
 * Return an ascii string which matches the RPC clnt stat passed in.
 */
const char *
clnt_sperrno(const enum clnt_stat stat)
{
	switch (stat) {
	case RPC_SUCCESS:
		return ("RPC: Success");
	case RPC_CANTENCODEARGS:
		return ("RPC: Can't encode arguments");
	case RPC_CANTDECODERES:
		return ("RPC: Can't decode result");
	case RPC_CANTSEND:
		return ("RPC: Unable to send");
	case RPC_CANTRECV:
		return ("RPC: Unable to receive");
	case RPC_TIMEDOUT:
		return ("RPC: Timed out");
	case RPC_INTR:
		return ("RPC: Interrupted");
	case RPC_UDERROR:
		return ("RPC: Unitdata error");
	case RPC_VERSMISMATCH:
		return ("RPC: Incompatible versions of RPC");
	case RPC_AUTHERROR:
		return ("RPC: Authentication error");
	case RPC_PROGUNAVAIL:
		return ("RPC: Program unavailable");
	case RPC_PROGVERSMISMATCH:
		return ("RPC: Program/version mismatch");
	case RPC_PROCUNAVAIL:
		return ("RPC: Procedure unavailable");
	case RPC_CANTDECODEARGS:
		return ("RPC: Server can't decode arguments");
	case RPC_SYSTEMERROR:
		return ("RPC: Remote system error");
	case RPC_UNKNOWNHOST:
		return ("RPC: Unknown host");
	case RPC_UNKNOWNPROTO:
		return ("RPC: Unknown protocol");
	case RPC_UNKNOWNADDR:
		return ("RPC: Remote address unknown");
	case RPC_NOBROADCAST:
		return ("RPC: Broadcasting not supported");
	case RPC_PMAPFAILURE:
		return ("RPC: Port mapper failure");
	case RPC_PROGNOTREGISTERED:
		return ("RPC: Program not registered");
	case RPC_N2AXLATEFAILURE:
		return ("RPC: Name to address translation failed");
	case RPC_TLIERROR:
		return ("RPC: TLI error");
	case RPC_FAILED:
		return ("RPC: Failed (unspecified error)");
	case RPC_INPROGRESS:
		return ("RPC: Operation in progress");
	case RPC_STALERACHANDLE:
		return ("RPC: Stale RAC handle");
	case RPC_CANTCONNECT:
		return ("RPC: Couldn't make connection");
	case RPC_XPRTFAILED:
		return ("RPC: Received disconnect from remote");
	case RPC_CANTCREATESTREAM:
		return ("RPC: Can't push RPC module");
	case RPC_CANTSTORE:
		return ("RPC: Can't store pending message");
	}
	return ("RPC: (unknown error code)");
}

/*
 * Return string reply error info. For use after clnt_call().
 * It allocates the  buffer of size MAXPATHLEN and assumes
 * caller's responsibility to free the memory after use.
 */
char *
clnt_sperror(const CLIENT *cl, const char *s)
{
	struct rpc_err e;
#ifdef notyet
	char *err;
#endif
	char *str;
	char *strstart;

	str = kmem_alloc(MAXPATHLEN, KM_SLEEP);
	strstart = str;

	CLNT_GETERR((CLIENT *) cl, &e);

	(void) sprintf(str, "%s: ", s);
	str += strlen(str);

	(void) strcpy(str, clnt_sperrno(e.re_status));
	str += strlen(str);

	switch (e.re_status) {
	case RPC_SUCCESS:
	case RPC_CANTENCODEARGS:
	case RPC_CANTDECODERES:
	case RPC_TIMEDOUT:
	case RPC_PROGUNAVAIL:
	case RPC_PROCUNAVAIL:
	case RPC_CANTDECODEARGS:
	case RPC_SYSTEMERROR:
	case RPC_UNKNOWNHOST:
	case RPC_UNKNOWNPROTO:
	case RPC_UNKNOWNADDR:
	case RPC_NOBROADCAST:
	case RPC_RPCBFAILURE:
	case RPC_PROGNOTREGISTERED:
	case RPC_FAILED:
	case RPC_INPROGRESS:
		break;

#ifdef notyet
	case RPC_N2AXLATEFAILURE:
		(void) sprintf(str, "; %s", netdir_sperror());
		break;
#endif

	case RPC_TLIERROR:
#ifdef notyet
		(void) sprintf(str, "; %s", t_errlist[e.re_terrno]);
#else
		(void) sprintf(str, "; %d", e.re_terrno);
#endif
		str += strlen(str);
		if (e.re_errno) {
#ifdef notyet
			(void) sprintf(str, "; %s", strerror(e.re_errno));
#else
			(void) sprintf(str, "; %d", e.re_errno);
#endif
		}
		break;

	case RPC_CANTSEND:
	case RPC_CANTRECV:
		if (e.re_errno) {
#ifdef notyet
			(void) sprintf(str, "; errno = %s",
			    strerror(e.re_errno));
#else
			(void) sprintf(str, "; errno = %d", e.re_errno);
#endif
			str += strlen(str);
		}
		if (e.re_terrno) {
#ifdef notyet
			(void) sprintf(str, "; %s", t_errlist[e.re_terrno]);
#else
			(void) sprintf(str, "; %d", e.re_terrno);
#endif
		}
		break;

	case RPC_VERSMISMATCH:
		(void) sprintf(str,
		    "; low version = %" PRIu32 ", high version = %" PRIu32,
		    e.re_vers.low, e.re_vers.high);
		break;

#ifdef notyet
	case RPC_AUTHERROR:
		err = auth_errmsg(e.re_why);
		(void) sprintf(str, "; why = ");
		str += strlen(str);
		if (err != NULL) {
			(void) sprintf(str, "%s", err);
		} else {
			(void) sprintf(str,
			    "(unknown authentication error - %d)",
			    (int)e.re_why);
		}
		break;
#endif

	case RPC_PROGVERSMISMATCH:
		(void) sprintf(str,
		    "; low version = %" PRIu32 ", high version = %" PRIu32,
		    e.re_vers.low, e.re_vers.high);
		break;

	default:	/* unknown */
		(void) sprintf(str, "; s1 = %" PRIu32 ", s2 = %" PRIu32,
		    e.re_lb.s1, e.re_lb.s2);
		break;
	}
	return (strstart);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

#include <sys/param.h>
#include <sys/types.h>
#include <sys/user.h>
#include <sys/systm.h>
#include <sys/sysmacros.h>
#include <sys/errno.h>
#include <sys/kmem.h>
#include <sys/debug.h>
#include <sys/systm.h>
#include <sys/kstat.h>
#include <sys/t_lock.h>
#include <sys/ddi.h>
#include <sys/cmn_err.h>
#include <sys/time.h>
#include <sys/isa_defs.h>
#include <sys/zone.h>
#include <sys/sdt.h>

#include <rpc/types.h>
#include <rpc/xdr.h>
#include <rpc/auth.h>
#include <rpc/clnt.h>
#include <rpc/rpc_msg.h>
#include <rpc/rpc_rdma.h>
#include <nfs/nfs.h>
#include <nfs/nfs4_kprot.h>

static uint32_t rdma_bufs_rqst = RDMA_BUFS_RQST;

static int clnt_compose_rpcmsg(CLIENT *, rpcproc_t, rdma_buf_t *,
			    XDR *, xdrproc_t, caddr_t);
static int  clnt_compose_rdma_header(CONN *, CLIENT *, rdma_buf_t *,
		    XDR **, uint_t *);
static int clnt_setup_rlist(CONN *, XDR *, XDR *);
static int clnt_setup_wlist(CONN *, XDR *, XDR *, rdma_buf_t *);
static int clnt_setup_long_reply(CONN *, struct clist **, uint_t);
static void clnt_check_credit(CONN *);
static void clnt_return_credit(CONN *);
static void clnt_decode_long_reply(CONN *, struct clist *,
		struct clist *, XDR *, XDR **, struct clist *,
		struct clist *, uint_t, uint_t);

static void clnt_update_credit(CONN *, uint32_t);

static enum clnt_stat clnt_rdma_kcallit(CLIENT *, rpcproc_t, xdrproc_t,
    caddr_t, xdrproc_t, caddr_t, struct timeval);
static void	clnt_rdma_kabort(CLIENT *);
static void	clnt_rdma_kerror(CLIENT *, struct rpc_err *);
static bool_t	clnt_rdma_kfreeres(CLIENT *, xdrproc_t, caddr_t);
static void	clnt_rdma_kdestroy(CLIENT *);
static bool_t	clnt_rdma_kcontrol(CLIENT *, int, char *);
static int	clnt_rdma_ksettimers(CLIENT *, struct rpc_timers *,
    struct rpc_timers *, int, void(*)(int, int, caddr_t), caddr_t, uint32_t);

/*
 * Operations vector for RDMA based RPC
 */
static struct clnt_ops rdma_clnt_ops = {
	clnt_rdma_kcallit,	/* do rpc call */
	clnt_rdma_kabort,	/* abort call */
	clnt_rdma_kerror,	/* return error status */
	clnt_rdma_kfreeres,	/* free results */
	clnt_rdma_kdestroy,	/* destroy rpc handle */
	clnt_rdma_kcontrol,	/* the ioctl() of rpc */
	clnt_rdma_ksettimers,	/* set retry timers */
};

/*
 * The size of the preserialized RPC header information.
 */
#define	CKU_HDRSIZE	20
#define	CLNT_RDMA_SUCCESS 0
#define	CLNT_RDMA_FAIL (-1)

#define	AUTH_REFRESH_COUNT 2

#define	IS_RPCSEC_GSS(authh)			\
	(authh->cl_auth->ah_cred.oa_flavor == RPCSEC_GSS)

/*
 * Per RPC RDMA endpoint details
 */
typedef struct cku_private {
	CLIENT			cku_client;	/* client handle */
	rdma_mod_t		*cku_rd_mod;	/* underlying RDMA mod */
	void			*cku_rd_handle;	/* underlying RDMA device */
	struct netbuf		cku_srcaddr;	/* source address for retries */
	struct netbuf		cku_addr;	/* remote netbuf address */
	int			cku_addrfmly;	/* for finding addr_type */
	struct rpc_err		cku_err;	/* error status */
	struct cred		*cku_cred;	/* credentials */
	XDR			cku_outxdr;	/* xdr stream for output */
	uint32_t		cku_outsz;
	XDR			cku_inxdr;	/* xdr stream for input */
	char			cku_rpchdr[CKU_HDRSIZE+4]; /* rpc header */
	uint32_t		cku_xid;	/* current XID */
} cku_private_t;

#define	CLNT_RDMA_DELAY	10	/* secs to delay after a connection failure */
static int clnt_rdma_min_delay = CLNT_RDMA_DELAY;

struct {
	kstat_named_t	rccalls;
	kstat_named_t	rcbadcalls;
	kstat_named_t	rcbadxids;
	kstat_named_t	rctimeouts;
	kstat_named_t	rcnewcreds;
	kstat_named_t	rcbadverfs;
	kstat_named_t	rctimers;
	kstat_named_t	rccantconn;
	kstat_named_t	rcnomem;
	kstat_named_t	rcintrs;
	kstat_named_t	rclongrpcs;
} rdmarcstat = {
	{ "calls",	KSTAT_DATA_UINT64 },
	{ "badcalls",	KSTAT_DATA_UINT64 },
	{ "badxids",	KSTAT_DATA_UINT64 },
	{ "timeouts",	KSTAT_DATA_UINT64 },
	{ "newcreds",	KSTAT_DATA_UINT64 },
	{ "badverfs",	KSTAT_DATA_UINT64 },
	{ "timers",	KSTAT_DATA_UINT64 },
	{ "cantconn",	KSTAT_DATA_UINT64 },
	{ "nomem",	KSTAT_DATA_UINT64 },
	{ "interrupts", KSTAT_DATA_UINT64 },
	{ "longrpc", 	KSTAT_DATA_UINT64 }
};

kstat_named_t *rdmarcstat_ptr = (kstat_named_t *)&rdmarcstat;
uint_t rdmarcstat_ndata = sizeof (rdmarcstat) / sizeof (kstat_named_t);

#ifdef DEBUG
int rdma_clnt_debug = 0;
#endif

#ifdef accurate_stats
extern kmutex_t rdmarcstat_lock;    /* mutex for rcstat updates */

#define	RCSTAT_INCR(x)			\
	mutex_enter(&rdmarcstat_lock);	\
	rdmarcstat.x.value.ui64++;	\
	mutex_exit(&rdmarcstat_lock);
#else
#define	RCSTAT_INCR(x)			\
	rdmarcstat.x.value.ui64++;
#endif

#define	ptoh(p)		(&((p)->cku_client))
#define	htop(h)		((cku_private_t *)((h)->cl_private))

uint_t
calc_length(uint_t len)
{
	len = RNDUP(len);

	if (len <= 64 * 1024) {
		if (len > 32 * 1024) {
			len = 64 * 1024;
		} else {
			if (len > 16 * 1024) {
				len = 32 * 1024;
			} else {
				if (len > 8 * 1024) {
					len = 16 * 1024;
				} else {
					len = 8 * 1024;
				}
			}
		}
	}
	return (len);
}
int
clnt_rdma_kcreate(char *proto, void *handle, struct netbuf *raddr, int family,
    rpcprog_t pgm, rpcvers_t vers, struct cred *cred, CLIENT **cl)
{
	CLIENT *h;
	struct cku_private *p;
	struct rpc_msg call_msg;
	rdma_registry_t *rp;

	ASSERT(INGLOBALZONE(curproc));

	if (cl == NULL)
		return (EINVAL);
	*cl = NULL;

	p = kmem_zalloc(sizeof (*p), KM_SLEEP);

	/*
	 * Find underlying RDMATF plugin
	 */
	rw_enter(&rdma_lock, RW_READER);
	rp = rdma_mod_head;
	while (rp != NULL) {
		if (strcmp(rp->r_mod->rdma_api, proto))
			rp = rp->r_next;
		else {
			p->cku_rd_mod = rp->r_mod;
			p->cku_rd_handle = handle;
			break;
		}
	}
	rw_exit(&rdma_lock);

	if (p->cku_rd_mod == NULL) {
		/*
		 * Should not happen.
		 * No matching RDMATF plugin.
		 */
		kmem_free(p, sizeof (struct cku_private));
		return (EINVAL);
	}

	h = ptoh(p);
	h->cl_ops = &rdma_clnt_ops;
	h->cl_private = (caddr_t)p;
	h->cl_auth = authkern_create();

	/* call message, just used to pre-serialize below */
	call_msg.rm_xid = 0;
	call_msg.rm_direction = CALL;
	call_msg.rm_call.cb_rpcvers = RPC_MSG_VERSION;
	call_msg.rm_call.cb_prog = pgm;
	call_msg.rm_call.cb_vers = vers;

	xdrmem_create(&p->cku_outxdr, p->cku_rpchdr, CKU_HDRSIZE, XDR_ENCODE);
	/* pre-serialize call message header */
	if (!xdr_callhdr(&p->cku_outxdr, &call_msg)) {
		XDR_DESTROY(&p->cku_outxdr);
		auth_destroy(h->cl_auth);
		kmem_free(p, sizeof (struct cku_private));
		return (EINVAL);
	}

	/*
	 * Set up the rpc information
	 */
	p->cku_cred = cred;
	p->cku_srcaddr.buf = kmem_zalloc(raddr->maxlen, KM_SLEEP);
	p->cku_srcaddr.maxlen = raddr->maxlen;
	p->cku_srcaddr.len = 0;
	p->cku_addr.buf = kmem_zalloc(raddr->maxlen, KM_SLEEP);
	p->cku_addr.maxlen = raddr->maxlen;
	p->cku_addr.len = raddr->len;
	bcopy(raddr->buf, p->cku_addr.buf, raddr->len);
	p->cku_addrfmly = family;

	*cl = h;
	return (0);
}

static void
clnt_rdma_kdestroy(CLIENT *h)
{
	struct cku_private *p = htop(h);

	kmem_free(p->cku_srcaddr.buf, p->cku_srcaddr.maxlen);
	kmem_free(p->cku_addr.buf, p->cku_addr.maxlen);
	kmem_free(p, sizeof (*p));
}

void
clnt_rdma_kinit(CLIENT *h, char *proto, void *handle, struct netbuf *raddr,
    struct cred *cred)
{
	struct cku_private *p = htop(h);
	rdma_registry_t *rp;

	ASSERT(INGLOBALZONE(curproc));
	/*
	 * Find underlying RDMATF plugin
	 */
	p->cku_rd_mod = NULL;
	rw_enter(&rdma_lock, RW_READER);
	rp = rdma_mod_head;
	while (rp != NULL) {
		if (strcmp(rp->r_mod->rdma_api, proto))
			rp = rp->r_next;
		else {
			p->cku_rd_mod = rp->r_mod;
			p->cku_rd_handle = handle;
			break;
		}

	}
	rw_exit(&rdma_lock);

	/*
	 * Set up the rpc information
	 */
	p->cku_cred = cred;
	p->cku_xid = 0;

	if (p->cku_addr.maxlen < raddr->len) {
		if (p->cku_addr.maxlen != 0 && p->cku_addr.buf != NULL)
			kmem_free(p->cku_addr.buf, p->cku_addr.maxlen);
		p->cku_addr.buf = kmem_zalloc(raddr->maxlen, KM_SLEEP);
		p->cku_addr.maxlen = raddr->maxlen;
	}

	p->cku_srcaddr.len = 0;

	p->cku_addr.len = raddr->len;
	bcopy(raddr->buf, p->cku_addr.buf, raddr->len);
	h->cl_ops = &rdma_clnt_ops;
}

static int
clnt_compose_rpcmsg(CLIENT *h, rpcproc_t procnum,
    rdma_buf_t *rpcmsg, XDR *xdrs,
    xdrproc_t xdr_args, caddr_t argsp)
{
	cku_private_t *p = htop(h);

	if (h->cl_auth->ah_cred.oa_flavor != RPCSEC_GSS) {
		/*
		 * Copy in the preserialized RPC header
		 * information.
		 */
		bcopy(p->cku_rpchdr, rpcmsg->addr, CKU_HDRSIZE);

		/*
		 * transaction id is the 1st thing in the output
		 * buffer.
		 */
		/* LINTED pointer alignment */
		(*(uint32_t *)(rpcmsg->addr)) = p->cku_xid;

		/* Skip the preserialized stuff. */
		XDR_SETPOS(xdrs, CKU_HDRSIZE);

		/* Serialize dynamic stuff into the output buffer. */
		if ((!XDR_PUTINT32(xdrs, (int32_t *)&procnum)) ||
		    (!AUTH_MARSHALL(h->cl_auth, xdrs, p->cku_cred)) ||
		    (!(*xdr_args)(xdrs, argsp))) {
			DTRACE_PROBE(krpc__e__clntrdma__rpcmsg__dynargs);
			return (CLNT_RDMA_FAIL);
		}
		p->cku_outsz = XDR_GETPOS(xdrs);
	} else {
		uint32_t *uproc = (uint32_t *)&p->cku_rpchdr[CKU_HDRSIZE];
		IXDR_PUT_U_INT32(uproc, procnum);
		(*(uint32_t *)(&p->cku_rpchdr[0])) = p->cku_xid;
		XDR_SETPOS(xdrs, 0);

		/* Serialize the procedure number and the arguments. */
		if (!AUTH_WRAP(h->cl_auth, (caddr_t)p->cku_rpchdr,
		    CKU_HDRSIZE+4, xdrs, xdr_args, argsp)) {
			if (rpcmsg->addr != xdrs->x_base) {
				rpcmsg->addr = xdrs->x_base;
				rpcmsg->len = xdr_getbufsize(xdrs);
			}
			DTRACE_PROBE(krpc__e__clntrdma__rpcmsg__procnum);
			return (CLNT_RDMA_FAIL);
		}
		/*
		 * If we had to allocate a new buffer while encoding
		 * then update the addr and len.
		 */
		if (rpcmsg->addr != xdrs->x_base) {
			rpcmsg->addr = xdrs->x_base;
			rpcmsg->len = xdr_getbufsize(xdrs);
		}

		p->cku_outsz = XDR_GETPOS(xdrs);
		DTRACE_PROBE1(krpc__i__compose__size__sec, int, p->cku_outsz)
	}

	return (CLNT_RDMA_SUCCESS);
}

static int
clnt_compose_rdma_header(CONN *conn, CLIENT *h, rdma_buf_t *clmsg,
    XDR **xdrs, uint_t *op)
{
	cku_private_t *p = htop(h);
	uint_t vers;
	uint32_t rdma_credit = rdma_bufs_rqst;

	vers = RPCRDMA_VERS;
	clmsg->type = SEND_BUFFER;

	if (rdma_buf_alloc(conn, clmsg)) {
		return (CLNT_RDMA_FAIL);
	}

	*xdrs = &p->cku_outxdr;
	xdrmem_create(*xdrs, clmsg->addr, clmsg->len, XDR_ENCODE);

	(*(uint32_t *)clmsg->addr) = p->cku_xid;
	XDR_SETPOS(*xdrs, sizeof (uint32_t));
	(void) xdr_u_int(*xdrs, &vers);
	(void) xdr_u_int(*xdrs, &rdma_credit);
	(void) xdr_u_int(*xdrs, op);

	return (CLNT_RDMA_SUCCESS);
}

/*
 * If xp_cl is NULL value, then the RPC payload will NOT carry
 * an RDMA READ chunk list, in this case we insert FALSE into
 * the XDR stream. Otherwise we use the clist and RDMA register
 * the memory and encode the clist into the outbound XDR stream.
 */
static int
clnt_setup_rlist(CONN *conn, XDR *xdrs, XDR *call_xdrp)
{
	int status;
	struct clist *rclp;
	int32_t xdr_flag = XDR_RDMA_RLIST_REG;

	XDR_CONTROL(call_xdrp, XDR_RDMA_GET_RLIST, &rclp);

	if (rclp != NULL) {
		status = clist_register(conn, rclp, CLIST_REG_SOURCE);
		if (status != RDMA_SUCCESS) {
			return (CLNT_RDMA_FAIL);
		}
		XDR_CONTROL(call_xdrp, XDR_RDMA_SET_FLAGS, &xdr_flag);
	}
	(void) xdr_do_clist(xdrs, &rclp);

	return (CLNT_RDMA_SUCCESS);
}

/*
 * If xp_wcl is NULL value, then the RPC payload will NOT carry
 * an RDMA WRITE chunk list, in this case we insert FALSE into
 * the XDR stream. Otherwise we use the clist and  RDMA register
 * the memory and encode the clist into the outbound XDR stream.
 */
static int
clnt_setup_wlist(CONN *conn, XDR *xdrs, XDR *call_xdrp, rdma_buf_t *rndbuf)
{
	int status;
	struct clist *wlist, *rndcl;
	int wlen, rndlen;
	int32_t xdr_flag = XDR_RDMA_WLIST_REG;

	XDR_CONTROL(call_xdrp, XDR_RDMA_GET_WLIST, &wlist);

	if (wlist != NULL) {
		/*
		 * If we are sending a non 4-byte alligned length
		 * the server will roundup the length to 4-byte
		 * boundary. In such a case, a trailing chunk is
		 * added to take any spill over roundup bytes.
		 */
		wlen = clist_len(wlist);
		rndlen = (roundup(wlen, BYTES_PER_XDR_UNIT) - wlen);
		if (rndlen) {
			rndcl = clist_alloc();
			/*
			 * calc_length() will allocate a PAGESIZE
			 * buffer below.
			 */
			rndcl->c_len = calc_length(rndlen);
			rndcl->rb_longbuf.type = RDMA_LONG_BUFFER;
			rndcl->rb_longbuf.len = rndcl->c_len;
			if (rdma_buf_alloc(conn, &rndcl->rb_longbuf)) {
				clist_free(rndcl);
				return (CLNT_RDMA_FAIL);
			}

			/* Roundup buffer freed back in caller */
			*rndbuf = rndcl->rb_longbuf;

			rndcl->u.c_daddr3 = rndcl->rb_longbuf.addr;
			rndcl->c_next = NULL;
			rndcl->c_dmemhandle = rndcl->rb_longbuf.handle;
			wlist->c_next = rndcl;
		}

		status = clist_register(conn, wlist, CLIST_REG_DST);
		if (status != RDMA_SUCCESS) {
			rdma_buf_free(conn, rndbuf);
			bzero(rndbuf, sizeof (rdma_buf_t));
			return (CLNT_RDMA_FAIL);
		}
		XDR_CONTROL(call_xdrp, XDR_RDMA_SET_FLAGS, &xdr_flag);
	}

	if (!xdr_encode_wlist(xdrs, wlist)) {
		if (rndlen) {
			rdma_buf_free(conn, rndbuf);
			bzero(rndbuf, sizeof (rdma_buf_t));
		}
		return (CLNT_RDMA_FAIL);
	}

	return (CLNT_RDMA_SUCCESS);
}

static int
clnt_setup_long_reply(CONN *conn, struct clist **clpp, uint_t length)
{
	if (length == 0) {
		*clpp = NULL;
		return (CLNT_RDMA_SUCCESS);
	}

	*clpp = clist_alloc();

	(*clpp)->rb_longbuf.len = calc_length(length);
	(*clpp)->rb_longbuf.type = RDMA_LONG_BUFFER;

	if (rdma_buf_alloc(conn, &((*clpp)->rb_longbuf))) {
		clist_free(*clpp);
		*clpp = NULL;
		return (CLNT_RDMA_FAIL);
	}

	(*clpp)->u.c_daddr3 = (*clpp)->rb_longbuf.addr;
	(*clpp)->c_len = (*clpp)->rb_longbuf.len;
	(*clpp)->c_next = NULL;
	(*clpp)->c_dmemhandle = (*clpp)->rb_longbuf.handle;

	if (clist_register(conn, *clpp, CLIST_REG_DST)) {
		DTRACE_PROBE(krpc__e__clntrdma__longrep_regbuf);
		rdma_buf_free(conn, &((*clpp)->rb_longbuf));
		clist_free(*clpp);
		*clpp = NULL;
		return (CLNT_RDMA_FAIL);
	}

	return (CLNT_RDMA_SUCCESS);
}

/* ARGSUSED */
static enum clnt_stat
clnt_rdma_kcallit(CLIENT *h, rpcproc_t procnum, xdrproc_t xdr_args,
    caddr_t argsp, xdrproc_t xdr_results, caddr_t resultsp,
    struct timeval wait)
{
	cku_private_t *p = htop(h);

	int 	try_call_again;
	int	refresh_attempt = AUTH_REFRESH_COUNT;
	int 	status;
	int 	msglen;

	XDR	*call_xdrp, callxdr; /* for xdrrdma encoding the RPC call */
	XDR	*reply_xdrp, replyxdr; /* for xdrrdma decoding the RPC reply */
	XDR 	*rdmahdr_o_xdrs, *rdmahdr_i_xdrs;

	struct rpc_msg 	reply_msg;
	rdma_registry_t	*m;

	struct clist *cl_sendlist;
	struct clist *cl_recvlist;
	struct clist *cl;
	struct clist *cl_rpcmsg;
	struct clist *cl_rdma_reply;
	struct clist *cl_rpcreply_wlist;
	struct clist *cl_long_reply;
	rdma_buf_t  rndup;

	uint_t vers;
	uint_t op;
	uint_t off;
	uint32_t seg_array_len;
	uint_t long_reply_len;
	uint_t rpcsec_gss;
	uint_t gss_i_or_p;

	CONN *conn = NULL;
	rdma_buf_t clmsg;
	rdma_buf_t rpcmsg;
	rdma_chunkinfo_lengths_t rcil;

	clock_t	ticks;
	bool_t wlist_exists_reply;

	uint32_t rdma_credit = rdma_bufs_rqst;

	RCSTAT_INCR(rccalls);

call_again:

	bzero(&clmsg, sizeof (clmsg));
	bzero(&rpcmsg, sizeof (rpcmsg));
	bzero(&rndup, sizeof (rndup));
	try_call_again = 0;
	cl_sendlist = NULL;
	cl_recvlist = NULL;
	cl = NULL;
	cl_rpcmsg = NULL;
	cl_rdma_reply = NULL;
	call_xdrp = NULL;
	reply_xdrp = NULL;
	wlist_exists_reply  = FALSE;
	cl_rpcreply_wlist = NULL;
	cl_long_reply = NULL;
	rcil.rcil_len = 0;
	rcil.rcil_len_alt = 0;
	long_reply_len = 0;

	rw_enter(&rdma_lock, RW_READER);
	m = (rdma_registry_t *)p->cku_rd_handle;
	if (m->r_mod_state == RDMA_MOD_INACTIVE) {
		/*
		 * If we didn't find a matching RDMA module in the registry
		 * then there is no transport.
		 */
		rw_exit(&rdma_lock);
		p->cku_err.re_status = RPC_CANTSEND;
		p->cku_err.re_errno = EIO;
		ticks = clnt_rdma_min_delay * drv_usectohz(1000000);
		if (h->cl_nosignal == TRUE) {
			delay(ticks);
		} else {
			if (delay_sig(ticks) == EINTR) {
				p->cku_err.re_status = RPC_INTR;
				p->cku_err.re_errno = EINTR;
			}
		}
		return (RPC_CANTSEND);
	}
	/*
	 * Get unique xid
	 */
	if (p->cku_xid == 0)
		p->cku_xid = alloc_xid();

	status = RDMA_GET_CONN(p->cku_rd_mod->rdma_ops, &p->cku_srcaddr,
	    &p->cku_addr, p->cku_addrfmly, p->cku_rd_handle, &conn);
	rw_exit(&rdma_lock);

	/*
	 * If there is a problem with the connection reflect the issue
	 * back to the higher level to address, we MAY delay for a short
	 * period so that we are kind to the transport.
	 */
	if (conn == NULL) {
		/*
		 * Connect failed to server. Could be because of one
		 * of several things. In some cases we don't want
		 * the caller to retry immediately - delay before
		 * returning to caller.
		 */
		switch (status) {
		case RDMA_TIMEDOUT:
			/*
			 * Already timed out. No need to delay
			 * some more.
			 */
			p->cku_err.re_status = RPC_TIMEDOUT;
			p->cku_err.re_errno = ETIMEDOUT;
			break;
		case RDMA_INTR:
			/*
			 * Failed because of an signal. Very likely
			 * the caller will not retry.
			 */
			p->cku_err.re_status = RPC_INTR;
			p->cku_err.re_errno = EINTR;
			break;
		default:
			/*
			 * All other failures - server down or service
			 * down or temporary resource failure. Delay before
			 * returning to caller.
			 */
			ticks = clnt_rdma_min_delay * drv_usectohz(1000000);
			p->cku_err.re_status = RPC_CANTCONNECT;
			p->cku_err.re_errno = EIO;

			if (h->cl_nosignal == TRUE) {
				delay(ticks);
			} else {
				if (delay_sig(ticks) == EINTR) {
					p->cku_err.re_status = RPC_INTR;
					p->cku_err.re_errno = EINTR;
				}
			}
			break;
		}

		return (p->cku_err.re_status);
	}

	if (p->cku_srcaddr.maxlen < conn->c_laddr.len) {
		if ((p->cku_srcaddr.maxlen != 0) &&
		    (p->cku_srcaddr.buf != NULL))
			kmem_free(p->cku_srcaddr.buf, p->cku_srcaddr.maxlen);
		p->cku_srcaddr.buf = kmem_zalloc(conn->c_laddr.maxlen,
		    KM_SLEEP);
		p->cku_srcaddr.maxlen = conn->c_laddr.maxlen;
	}

	p->cku_srcaddr.len = conn->c_laddr.len;
	bcopy(conn->c_laddr.buf, p->cku_srcaddr.buf, conn->c_laddr.len);

	clnt_check_credit(conn);

	status = CLNT_RDMA_FAIL;

	rpcsec_gss = gss_i_or_p = FALSE;

	if (IS_RPCSEC_GSS(h)) {
		rpcsec_gss = TRUE;
		if (rpc_gss_get_service_type(h->cl_auth) ==
		    rpc_gss_svc_integrity ||
		    rpc_gss_get_service_type(h->cl_auth) ==
		    rpc_gss_svc_privacy)
			gss_i_or_p = TRUE;
	}

	/*
	 * Try a regular RDMA message if RPCSEC_GSS is not being used
	 * or if RPCSEC_GSS is being used for authentication only.
	 */
	if (rpcsec_gss == FALSE ||
	    (rpcsec_gss == TRUE && gss_i_or_p == FALSE)) {
		/*
		 * Grab a send buffer for the request.  Try to
		 * encode it to see if it fits. If not, then it
		 * needs to be sent in a chunk.
		 */
		rpcmsg.type = SEND_BUFFER;
		if (rdma_buf_alloc(conn, &rpcmsg)) {
			DTRACE_PROBE(krpc__e__clntrdma__callit_nobufs);
			goto done;
		}

		/* First try to encode into regular send buffer */
		op = RDMA_MSG;

		call_xdrp = &callxdr;

		xdrrdma_create(call_xdrp, rpcmsg.addr, rpcmsg.len,
		    rdma_minchunk, NULL, XDR_ENCODE, conn);

		status = clnt_compose_rpcmsg(h, procnum, &rpcmsg, call_xdrp,
		    xdr_args, argsp);

		if (status != CLNT_RDMA_SUCCESS) {
			/* Clean up from previous encode attempt */
			rdma_buf_free(conn, &rpcmsg);
			XDR_DESTROY(call_xdrp);
		} else {
			XDR_CONTROL(call_xdrp, XDR_RDMA_GET_CHUNK_LEN, &rcil);
		}
	}

	/* If the encode didn't work, then try a NOMSG */
	if (status != CLNT_RDMA_SUCCESS) {

		msglen = CKU_HDRSIZE + BYTES_PER_XDR_UNIT + MAX_AUTH_BYTES +
		    xdr_sizeof(xdr_args, argsp);

		msglen = calc_length(msglen);

		/* pick up the lengths for the reply buffer needed */
		(void) xdrrdma_sizeof(xdr_args, argsp, 0,
		    &rcil.rcil_len, &rcil.rcil_len_alt);

		/*
		 * Construct a clist to describe the CHUNK_BUFFER
		 * for the rpcmsg.
		 */
		cl_rpcmsg = clist_alloc();
		cl_rpcmsg->c_len = msglen;
		cl_rpcmsg->rb_longbuf.type = RDMA_LONG_BUFFER;
		cl_rpcmsg->rb_longbuf.len = msglen;
		if (rdma_buf_alloc(conn, &cl_rpcmsg->rb_longbuf)) {
			clist_free(cl_rpcmsg);
			goto done;
		}
		cl_rpcmsg->w.c_saddr3 = cl_rpcmsg->rb_longbuf.addr;

		op = RDMA_NOMSG;
		call_xdrp = &callxdr;

		xdrrdma_create(call_xdrp, cl_rpcmsg->rb_longbuf.addr,
		    cl_rpcmsg->rb_longbuf.len, 0,
		    cl_rpcmsg, XDR_ENCODE, conn);

		status = clnt_compose_rpcmsg(h, procnum, &cl_rpcmsg->rb_longbuf,
		    call_xdrp, xdr_args, argsp);

		DTRACE_PROBE2(krpc__i__clntrdma__callit__longbuf, int, status,
		    int, msglen);
		if (status != CLNT_RDMA_SUCCESS) {
			p->cku_err.re_status = RPC_CANTENCODEARGS;
			p->cku_err.re_errno = EIO;
			DTRACE_PROBE(krpc__e__clntrdma__callit__composemsg);
			goto done;
		}
	}

	/*
	 * During the XDR_ENCODE we may have "allocated" an RDMA READ or
	 * RDMA WRITE clist.
	 *
	 * First pull the RDMA READ chunk list from the XDR private
	 * area to keep it handy.
	 */
	XDR_CONTROL(call_xdrp, XDR_RDMA_GET_RLIST, &cl);

	if (gss_i_or_p) {
		long_reply_len = rcil.rcil_len + rcil.rcil_len_alt;
		long_reply_len += MAX_AUTH_BYTES;
	} else {
		long_reply_len = rcil.rcil_len;
	}

	/*
	 * Update the chunk size information for the Long RPC msg.
	 */
	if (cl && op == RDMA_NOMSG)
		cl->c_len = p->cku_outsz;

	/*
	 * Prepare the RDMA header. On success xdrs will hold the result
	 * of xdrmem_create() for a SEND_BUFFER.
	 */
	status = clnt_compose_rdma_header(conn, h, &clmsg,
	    &rdmahdr_o_xdrs, &op);

	if (status != CLNT_RDMA_SUCCESS) {
		p->cku_err.re_status = RPC_CANTSEND;
		p->cku_err.re_errno = EIO;
		RCSTAT_INCR(rcnomem);
		DTRACE_PROBE(krpc__e__clntrdma__callit__nobufs2);
		goto done;
	}

	/*
	 * Now insert the RDMA READ list iff present
	 */
	status = clnt_setup_rlist(conn, rdmahdr_o_xdrs, call_xdrp);
	if (status != CLNT_RDMA_SUCCESS) {
		DTRACE_PROBE(krpc__e__clntrdma__callit__clistreg);
		rdma_buf_free(conn, &clmsg);
		p->cku_err.re_status = RPC_CANTSEND;
		p->cku_err.re_errno = EIO;
		goto done;
	}

	/*
	 * Setup RDMA WRITE chunk list for nfs read operation
	 * other operations will have a NULL which will result
	 * as a NULL list in the XDR stream.
	 */
	status = clnt_setup_wlist(conn, rdmahdr_o_xdrs, call_xdrp, &rndup);
	if (status != CLNT_RDMA_SUCCESS) {
		rdma_buf_free(conn, &clmsg);
		p->cku_err.re_status = RPC_CANTSEND;
		p->cku_err.re_errno = EIO;
		goto done;
	}

	/*
	 * If NULL call and RPCSEC_GSS, provide a chunk such that
	 * large responses can flow back to the client.
	 * If RPCSEC_GSS with integrity or privacy is in use, get chunk.
	 */
	if ((procnum == 0 && rpcsec_gss == TRUE) ||
	    (rpcsec_gss == TRUE && gss_i_or_p == TRUE))
		long_reply_len += 1024;

	status = clnt_setup_long_reply(conn, &cl_long_reply, long_reply_len);

	DTRACE_PROBE2(krpc__i__clntrdma__callit__longreply, int, status,
	    int, long_reply_len);

	if (status != CLNT_RDMA_SUCCESS) {
		rdma_buf_free(conn, &clmsg);
		p->cku_err.re_status = RPC_CANTSEND;
		p->cku_err.re_errno = EIO;
		goto done;
	}

	/*
	 * XDR encode the RDMA_REPLY write chunk
	 */
	seg_array_len = (cl_long_reply ? 1 : 0);
	(void) xdr_encode_reply_wchunk(rdmahdr_o_xdrs, cl_long_reply,
	    seg_array_len);

	/*
	 * Construct a clist in "sendlist" that represents what we
	 * will push over the wire.
	 *
	 * Start with the RDMA header and clist (if any)
	 */
	clist_add(&cl_sendlist, 0, XDR_GETPOS(rdmahdr_o_xdrs), &clmsg.handle,
	    clmsg.addr, NULL, NULL);

	/*
	 * Put the RPC call message in  sendlist if small RPC
	 */
	if (op == RDMA_MSG) {
		clist_add(&cl_sendlist, 0, p->cku_outsz, &rpcmsg.handle,
		    rpcmsg.addr, NULL, NULL);
	} else {
		/* Long RPC already in chunk list */
		RCSTAT_INCR(rclongrpcs);
	}

	/*
	 * Set up a reply buffer ready for the reply
	 */
	status = rdma_clnt_postrecv(conn, p->cku_xid);
	if (status != RDMA_SUCCESS) {
		rdma_buf_free(conn, &clmsg);
		p->cku_err.re_status = RPC_CANTSEND;
		p->cku_err.re_errno = EIO;
		goto done;
	}

	/*
	 * sync the memory for dma
	 */
	if (cl != NULL) {
		status = clist_syncmem(conn, cl, CLIST_REG_SOURCE);
		if (status != RDMA_SUCCESS) {
			(void) rdma_clnt_postrecv_remove(conn, p->cku_xid);
			rdma_buf_free(conn, &clmsg);
			p->cku_err.re_status = RPC_CANTSEND;
			p->cku_err.re_errno = EIO;
			goto done;
		}
	}

	/*
	 * Send the RDMA Header and RPC call message to the server
	 */
	status = RDMA_SEND(conn, cl_sendlist, p->cku_xid);
	if (status != RDMA_SUCCESS) {
		(void) rdma_clnt_postrecv_remove(conn, p->cku_xid);
		p->cku_err.re_status = RPC_CANTSEND;
		p->cku_err.re_errno = EIO;
		goto done;
	}

	/*
	 * RDMA plugin now owns the send msg buffers.
	 * Clear them out and don't free them.
	 */
	clmsg.addr = NULL;
	if (rpcmsg.type == SEND_BUFFER)
		rpcmsg.addr = NULL;

	/*
	 * Recv rpc reply
	 */
	status = RDMA_RECV(conn, &cl_recvlist, p->cku_xid);

	/*
	 * Now check recv status
	 */
	if (status != 0) {
		if (status == RDMA_INTR) {
			p->cku_err.re_status = RPC_INTR;
			p->cku_err.re_errno = EINTR;
			RCSTAT_INCR(rcintrs);
		} else if (status == RPC_TIMEDOUT) {
			p->cku_err.re_status = RPC_TIMEDOUT;
			p->cku_err.re_errno = ETIMEDOUT;
			RCSTAT_INCR(rctimeouts);
		} else {
			p->cku_err.re_status = RPC_CANTRECV;
			p->cku_err.re_errno = EIO;
		}
		goto done;
	}

	/*
	 * Process the reply message.
	 *
	 * First the chunk list (if any)
	 */
	rdmahdr_i_xdrs = &(p->cku_inxdr);
	xdrmem_create(rdmahdr_i_xdrs,
	    (caddr_t)(uintptr_t)cl_recvlist->w.c_saddr3,
	    cl_recvlist->c_len, XDR_DECODE);

	/*
	 * Treat xid as opaque (xid is the first entity
	 * in the rpc rdma message).
	 * Skip xid and set the xdr position accordingly.
	 */
	XDR_SETPOS(rdmahdr_i_xdrs, sizeof (uint32_t));
	(void) xdr_u_int(rdmahdr_i_xdrs, &vers);
	(void) xdr_u_int(rdmahdr_i_xdrs, &rdma_credit);
	(void) xdr_u_int(rdmahdr_i_xdrs, &op);
	(void) xdr_do_clist(rdmahdr_i_xdrs, &cl);

	clnt_update_credit(conn, rdma_credit);

	wlist_exists_reply = FALSE;
	if (! xdr_decode_wlist(rdmahdr_i_xdrs, &cl_rpcreply_wlist,
	    &wlist_exists_reply)) {
		DTRACE_PROBE(krpc__e__clntrdma__callit__wlist_decode);
		p->cku_err.re_status = RPC_CANTDECODERES;
		p->cku_err.re_errno = EIO;
		goto done;
	}

	/*
	 * The server shouldn't have sent a RDMA_SEND that
	 * the client needs to RDMA_WRITE a reply back to
	 * the server.  So silently ignoring what the
	 * server returns in the rdma_reply section of the
	 * header.
	 */
	(void) xdr_decode_reply_wchunk(rdmahdr_i_xdrs, &cl_rdma_reply);
	off = xdr_getpos(rdmahdr_i_xdrs);

	clnt_decode_long_reply(conn, cl_long_reply,
	    cl_rdma_reply, &replyxdr, &reply_xdrp,
	    cl, cl_recvlist, op, off);

	if (reply_xdrp == NULL)
		goto done;

	if (wlist_exists_reply) {
		XDR_CONTROL(reply_xdrp, XDR_RDMA_SET_WLIST, cl_rpcreply_wlist);
	}

	reply_msg.rm_direction = REPLY;
	reply_msg.rm_reply.rp_stat = MSG_ACCEPTED;
	reply_msg.acpted_rply.ar_stat = SUCCESS;
	reply_msg.acpted_rply.ar_verf = _null_auth;

	/*
	 *  xdr_results will be done in AUTH_UNWRAP.
	 */
	reply_msg.acpted_rply.ar_results.where = NULL;
	reply_msg.acpted_rply.ar_results.proc = xdr_void;

	/*
	 * Decode and validate the response.
	 */
	if (xdr_replymsg(reply_xdrp, &reply_msg)) {
		enum clnt_stat re_status;

		_seterr_reply(&reply_msg, &(p->cku_err));

		re_status = p->cku_err.re_status;
		if (re_status == RPC_SUCCESS) {
			/*
			 * Reply is good, check auth.
			 */
			if (!AUTH_VALIDATE(h->cl_auth,
			    &reply_msg.acpted_rply.ar_verf)) {
				p->cku_err.re_status = RPC_AUTHERROR;
				p->cku_err.re_why = AUTH_INVALIDRESP;
				RCSTAT_INCR(rcbadverfs);
				DTRACE_PROBE(
				    krpc__e__clntrdma__callit__authvalidate);
			} else if (!AUTH_UNWRAP(h->cl_auth, reply_xdrp,
			    xdr_results, resultsp)) {
				p->cku_err.re_status = RPC_CANTDECODERES;
				p->cku_err.re_errno = EIO;
				DTRACE_PROBE(
				    krpc__e__clntrdma__callit__authunwrap);
			}
		} else {
			/* set errno in case we can't recover */
			if (re_status != RPC_VERSMISMATCH &&
			    re_status != RPC_AUTHERROR &&
			    re_status != RPC_PROGVERSMISMATCH)
				p->cku_err.re_errno = EIO;

			if (re_status == RPC_AUTHERROR) {
				if ((refresh_attempt > 0) &&
				    AUTH_REFRESH(h->cl_auth, &reply_msg,
				    p->cku_cred)) {
					refresh_attempt--;
					try_call_again = 1;
					goto done;
				}

				try_call_again = 0;

				/*
				 * We have used the client handle to
				 * do an AUTH_REFRESH and the RPC status may
				 * be set to RPC_SUCCESS; Let's make sure to
				 * set it to RPC_AUTHERROR.
				 */
				p->cku_err.re_status = RPC_AUTHERROR;

				/*
				 * Map recoverable and unrecoverable
				 * authentication errors to appropriate
				 * errno
				 */
				switch (p->cku_err.re_why) {
				case AUTH_BADCRED:
				case AUTH_BADVERF:
				case AUTH_INVALIDRESP:
				case AUTH_TOOWEAK:
				case AUTH_FAILED:
				case RPCSEC_GSS_NOCRED:
				case RPCSEC_GSS_FAILED:
					p->cku_err.re_errno = EACCES;
					break;
				case AUTH_REJECTEDCRED:
				case AUTH_REJECTEDVERF:
				default:
					p->cku_err.re_errno = EIO;
					break;
				}
			}
			DTRACE_PROBE1(krpc__e__clntrdma__callit__rpcfailed,
			    int, p->cku_err.re_why);
		}
	} else {
		p->cku_err.re_status = RPC_CANTDECODERES;
		p->cku_err.re_errno = EIO;
		DTRACE_PROBE(krpc__e__clntrdma__callit__replymsg);
	}

done:
	clnt_return_credit(conn);

	if (cl_sendlist != NULL)
		clist_free(cl_sendlist);

	/*
	 * If rpc reply is in a chunk, free it now.
	 */
	if (cl_long_reply) {
		(void) clist_deregister(conn, cl_long_reply);
		rdma_buf_free(conn, &cl_long_reply->rb_longbuf);
		clist_free(cl_long_reply);
	}

	if (call_xdrp)
		XDR_DESTROY(call_xdrp);

	if (rndup.rb_private) {
		rdma_buf_free(conn, &rndup);
	}

	if (reply_xdrp) {
		(void) xdr_rpc_free_verifier(reply_xdrp, &reply_msg);
		XDR_DESTROY(reply_xdrp);
	}

	if (cl_rdma_reply) {
		clist_free(cl_rdma_reply);
	}

	if (cl_recvlist) {
		rdma_buf_t	recvmsg = {0};
		recvmsg.addr = (caddr_t)(uintptr_t)cl_recvlist->w.c_saddr3;
		recvmsg.type = RECV_BUFFER;
		RDMA_BUF_FREE(conn, &recvmsg);
		clist_free(cl_recvlist);
	}

	RDMA_REL_CONN(conn);

	if (try_call_again)
		goto call_again;

	if (p->cku_err.re_status != RPC_SUCCESS) {
		RCSTAT_INCR(rcbadcalls);
	}
	return (p->cku_err.re_status);
}


static void
clnt_decode_long_reply(CONN *conn,
    struct clist *cl_long_reply,
    struct clist *cl_rdma_reply, XDR *xdrs,
    XDR **rxdrp, struct clist *cl,
    struct clist *cl_recvlist,
    uint_t  op, uint_t off)
{
	if (op != RDMA_NOMSG) {
		DTRACE_PROBE1(krpc__i__longrepl__rdmamsg__len,
		    int, cl_recvlist->c_len - off);
		xdrrdma_create(xdrs,
		    (caddr_t)(uintptr_t)(cl_recvlist->w.c_saddr3 + off),
		    cl_recvlist->c_len - off, 0, cl, XDR_DECODE, conn);
		*rxdrp = xdrs;
		return;
	}

	/* op must be RDMA_NOMSG */
	if (cl) {
		DTRACE_PROBE(krpc__e__clntrdma__declongreply__serverreadlist);
		return;
	}

	if (cl_long_reply->u.c_daddr) {
		DTRACE_PROBE1(krpc__i__longrepl__rdmanomsg__len,
		    int, cl_rdma_reply->c_len);

		xdrrdma_create(xdrs, (caddr_t)cl_long_reply->u.c_daddr3,
		    cl_rdma_reply->c_len, 0, NULL, XDR_DECODE, conn);

		*rxdrp = xdrs;
	}
}

static void
clnt_return_credit(CONN *conn)
{
	rdma_clnt_cred_ctrl_t *cc_info = &conn->rdma_conn_cred_ctrl_u.c_clnt_cc;

	mutex_enter(&conn->c_lock);
	cc_info->clnt_cc_in_flight_ops--;
	cv_signal(&cc_info->clnt_cc_cv);
	mutex_exit(&conn->c_lock);
}

static void
clnt_update_credit(CONN *conn, uint32_t rdma_credit)
{
	rdma_clnt_cred_ctrl_t *cc_info = &conn->rdma_conn_cred_ctrl_u.c_clnt_cc;

	/*
	 * If the granted has not altered, avoid taking the
	 * mutex, to essentially do nothing..
	 */
	if (cc_info->clnt_cc_granted_ops == rdma_credit)
		return;
	/*
	 * Get the granted number of buffers for credit control.
	 */
	mutex_enter(&conn->c_lock);
	cc_info->clnt_cc_granted_ops = rdma_credit;
	mutex_exit(&conn->c_lock);
}

static void
clnt_check_credit(CONN *conn)
{
	rdma_clnt_cred_ctrl_t *cc_info = &conn->rdma_conn_cred_ctrl_u.c_clnt_cc;

	/*
	 * Make sure we are not going over our allowed buffer use
	 * (and make sure we have gotten a granted value before).
	 */
	mutex_enter(&conn->c_lock);
	while (cc_info->clnt_cc_in_flight_ops >= cc_info->clnt_cc_granted_ops &&
	    cc_info->clnt_cc_granted_ops != 0) {
		/*
		 * Client has maxed out its granted buffers due to
		 * credit control.  Current handling is to block and wait.
		 */
		cv_wait(&cc_info->clnt_cc_cv, &conn->c_lock);
	}
	cc_info->clnt_cc_in_flight_ops++;
	mutex_exit(&conn->c_lock);
}

/* ARGSUSED */
static void
clnt_rdma_kabort(CLIENT *h)
{
}

static void
clnt_rdma_kerror(CLIENT *h, struct rpc_err *err)
{
	struct cku_private *p = htop(h);
	*err = p->cku_err;
}

static bool_t
clnt_rdma_kfreeres(CLIENT *h, xdrproc_t xdr_res, caddr_t res_ptr)
{
	struct cku_private *p = htop(h);
	XDR *xdrs;

	xdrs = &(p->cku_outxdr);
	xdrs->x_op = XDR_FREE;
	return ((*xdr_res)(xdrs, res_ptr));
}

/* ARGSUSED */
static bool_t
clnt_rdma_kcontrol(CLIENT *h, int cmd, char *arg)
{
	return (TRUE);
}

/* ARGSUSED */
static int
clnt_rdma_ksettimers(CLIENT *h, struct rpc_timers *t, struct rpc_timers *all,
	int minimum, void(*feedback)(int, int, caddr_t), caddr_t arg,
	uint32_t xid)
{
	RCSTAT_INCR(rctimers);
	return (0);
}

int
rdma_reachable(int addr_type, struct netbuf *addr, struct knetconfig **knconf)
{
	rdma_registry_t	*rp;
	void *handle = NULL;
	struct knetconfig *knc;
	char *pf, *p;
	rdma_stat status;
	int error = 0;

	if (!INGLOBALZONE(curproc))
		return (-1);

	/*
	 * modload the RDMA plugins if not already done.
	 */
	if (!rdma_modloaded) {
		mutex_enter(&rdma_modload_lock);
		if (!rdma_modloaded) {
			error = rdma_modload();
		}
		mutex_exit(&rdma_modload_lock);
		if (error)
			return (-1);
	}

	if (!rdma_dev_available)
		return (-1);

	rw_enter(&rdma_lock, RW_READER);
	rp = rdma_mod_head;
	while (rp != NULL) {
		if (rp->r_mod_state == RDMA_MOD_INACTIVE) {
			rp = rp->r_next;
			continue;
		}
		status = RDMA_REACHABLE(rp->r_mod->rdma_ops, addr_type, addr,
		    &handle);
		if (status == RDMA_SUCCESS) {
			knc = kmem_zalloc(sizeof (struct knetconfig),
			    KM_SLEEP);
			knc->knc_semantics = NC_TPI_RDMA;
			pf = kmem_alloc(KNC_STRSIZE, KM_SLEEP);
			p = kmem_alloc(KNC_STRSIZE, KM_SLEEP);
			if (addr_type == AF_INET)
				(void) strncpy(pf, NC_INET, KNC_STRSIZE);
			else if (addr_type == AF_INET6)
				(void) strncpy(pf, NC_INET6, KNC_STRSIZE);
			pf[KNC_STRSIZE - 1] = '\0';

			(void) strncpy(p, rp->r_mod->rdma_api, KNC_STRSIZE);
			p[KNC_STRSIZE - 1] = '\0';

			knc->knc_protofmly = pf;
			knc->knc_proto = p;
			knc->knc_rdev = (dev_t)rp;
			*knconf = knc;
			rw_exit(&rdma_lock);
			return (0);
		}
		rp = rp->r_next;
	}
	rw_exit(&rdma_lock);
	return (-1);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

/*
 * clnt.h - Client side remote procedure call interface.
 */

#ifndef _RPC_CLNT_SOC_H
#define	_RPC_CLNT_SOC_H

/*
 * All the following declarations are only for backward compatibility
 * with SUNOS 4.0.
 */

#include <sys/socket.h>
#include <netinet/in.h>
#include <rpc/xdr.h>
#include <rpc/clnt.h>

#ifdef	__cplusplus
extern "C" {
#endif

#define	UDPMSGSIZE	8800	/* rpc imposed limit on udp msg size */

/*
 * callrpc(host, prognum, versnum, procnum, inproc, in, outproc, out)
 *	char *host;
 *	rpcprog_t prognum;
 *	rpcvers_t versnum;
 *	rpcproc_t procnum;
 *	xdrproc_t inproc, outproc;
 *	char *in, *out;
 */
#ifdef __STDC__
extern int callrpc(char *, rpcprog_t, rpcvers_t, rpcproc_t, xdrproc_t, char *,
    xdrproc_t, char *);
#else
extern int callrpc();
#endif


/*
 * TCP based rpc
 * CLIENT *
 * clnttcp_create(raddr, prog, vers, fdp, sendsz, recvsz)
 *	struct sockaddr_in *raddr;
 *	rpcprog_t prog;
 *	rpcvers_t version;
 *	int *fdp;
 *	uint_t sendsz;
 *	uint_t recvsz;
 */
#ifdef __STDC__
extern CLIENT *clnttcp_create(struct sockaddr_in *, rpcprog_t, rpcvers_t,
    int *, uint_t, uint_t);
#else
extern CLIENT *clnttcp_create();
#endif


/*
 * UDP based rpc.
 * CLIENT *
 * clntudp_create(raddr, program, version, wait, fdp)
 *	struct sockaddr_in *raddr;
 *	rpcprog_t program;
 *	rpcvers_t version;
 *	struct timeval wait;
 *	int *fdp;
 *
 * Same as above, but you specify max packet sizes.
 * CLIENT *
 * clntudp_bufcreate(raddr, program, version, wait, fdp, sendsz, recvsz)
 *	struct sockaddr_in *raddr;
 *	rpcprog_t program;
 *	rpcvers_t version;
 *	struct timeval wait;
 *	int *fdp;
 *	uint_t sendsz;
 *	uint_t recvsz;
 *
 */
#ifdef __STDC__
extern CLIENT *clntudp_create(struct sockaddr_in *, rpcprog_t, rpcvers_t,
    struct timeval, int *);
extern CLIENT *clntudp_bufcreate(struct sockaddr_in *, rpcprog_t, rpcvers_t,
    struct timeval, int *, uint_t, uint_t);
#else
extern CLIENT *clntudp_create();
extern CLIENT *clntudp_bufcreate();
#endif

/*
 * Memory based rpc (for speed check and testing)
 * CLIENT *
 * clntraw_create(prog, vers)
 *	rpcprog_t prog;
 *	rpcvers_t vers;
 */
#ifdef __STDC__
extern CLIENT *clntraw_create(rpcprog_t, rpcvers_t);
#else
extern CLIENT *clntraw_create();
#endif

/*
 * get the local host's IP address without consulting
 * name service library functions
 * void
 * get_myaddress(addr)
 * 	struct sockaddr_in  *addr;
 */
#ifdef __STDC__
extern void get_myaddress(struct sockaddr_in *);
#else
extern void get_myaddress();
#endif

/*
 * get the port number on the host for the rpc program, version and proto
 * void
 * getrpcport(host, prognum, versnum, proto)
 * 	char *host;
 *	rpcprog_t prognum;
 *	rpcvers_t versnum;
 *	rpcprot_t proto;
 */
#ifdef __STDC__
extern ushort_t getrpcport(char *, rpcprog_t, rpcvers_t, rpcprot_t);
#else
extern ushort_t getrpcport();
#endif

#ifdef	__cplusplus
}
#endif

#endif /* _RPC_CLNT_SOC_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 1986 - 1991, 1994, 1996, 1997, 2001 by Sun Microsystems, Inc.
 * All rights reserved.
 */

/*
 * clnt_stat.h - Client side remote procedure call enum
 *
 */

#ifndef	_RPC_CLNT_STAT_H
#define	_RPC_CLNT_STAT_H

#ifdef __cplusplus
extern "C" {
#endif

enum clnt_stat {
	RPC_SUCCESS = 0,			/* call succeeded */
	/*
	 * local errors
	 */
	RPC_CANTENCODEARGS = 1,		/* can't encode arguments */
	RPC_CANTDECODERES = 2,		/* can't decode results */
	RPC_CANTSEND = 3,			/* failure in sending call */
	RPC_CANTRECV = 4,
	/* failure in receiving result */
	RPC_TIMEDOUT = 5,			/* call timed out */
	RPC_INTR = 18,			/* call interrupted */
	RPC_UDERROR = 23,			/* recv got uderr indication */
	/*
	 * remote errors
	 */
	RPC_VERSMISMATCH = 6,		/* rpc versions not compatible */
	RPC_AUTHERROR = 7,		/* authentication error */
	RPC_PROGUNAVAIL = 8,		/* program not available */
	RPC_PROGVERSMISMATCH = 9,	/* program version mismatched */
	RPC_PROCUNAVAIL = 10,		/* procedure unavailable */
	RPC_CANTDECODEARGS = 11,		/* decode arguments error */
	RPC_SYSTEMERROR = 12,		/* generic "other problem" */

	/*
	 * rpc_call & clnt_create errors
	 */
	RPC_UNKNOWNHOST = 13,		/* unknown host name */
	RPC_UNKNOWNPROTO = 17,		/* unknown protocol */
	RPC_UNKNOWNADDR = 19,		/* Remote address unknown */
	RPC_NOBROADCAST = 21,		/* Broadcasting not supported */

	/*
	 * rpcbind errors
	 */
	RPC_RPCBFAILURE = 14,		/* the pmapper failed in its call */
#define	RPC_PMAPFAILURE RPC_RPCBFAILURE
	RPC_PROGNOTREGISTERED = 15,	/* remote program is not registered */
	RPC_N2AXLATEFAILURE = 22,
	/* Name to address translation failed */
	/*
	 * Misc error in the TLI library
	 */
	RPC_TLIERROR = 20,
	/*
	 * unspecified error
	 */
	RPC_FAILED = 16,
	/*
	 * asynchronous errors
	 */
	RPC_INPROGRESS = 24,
	RPC_STALERACHANDLE = 25,
	RPC_CANTCONNECT = 26,		/* couldn't make connection (cots) */
	RPC_XPRTFAILED = 27,		/* received discon from remote (cots) */
	RPC_CANTCREATESTREAM = 28,	/* can't push rpc module (cots) */
	/*
	 * non blocking mode errors
	 */
	RPC_CANTSTORE = 29		/* fail to store a pending message */

};

#ifdef __cplusplus
}
#endif

#endif	/* !_RPC_CLNT_STAT_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

/*
 * des_crypt.h, des library routine interface
 */

#ifndef _DES_DES_CRYPT_H
#define	_DES_DES_CRYPT_H

#include <sys/types.h>

#ifdef __cplusplus
extern "C" {
#endif

#define	DES_MAXDATA 8192	/* max bytes encrypted in one call */
#define	DES_DIRMASK (1 << 0)
#define	DES_ENCRYPT (0 * DES_DIRMASK)	/* Encrypt */
#define	DES_DECRYPT (1 * DES_DIRMASK)	/* Decrypt */


#define	DES_DEVMASK (1 << 1)
#define	DES_HW (0 * DES_DEVMASK)	/* Use hardware device */
#define	DES_SW (1 * DES_DEVMASK)	/* Use software device */


#define	DESERR_NONE 0		/* succeeded */
#define	DESERR_NOHWDEVICE 1	/* succeeded, but hw device not available */
#define	DESERR_HWERROR 2	/* failed, hardware/driver error */
#define	DESERR_BADPARAM 3	/* failed, bad parameter to call */

#define	DES_FAILED(err) \
	((err) > DESERR_NOHWDEVICE)

/*
 * cbc_crypt()
 * ecb_crypt()
 *
 * Encrypt (or decrypt) len bytes of a buffer buf.
 * The length must be a multiple of eight.
 * The key should have odd parity in the low bit of each byte.
 * ivec is the input vector, and is updated to the new one (cbc only).
 * The mode is created by oring together the appropriate parameters.
 * DESERR_NOHWDEVICE is returned if DES_HW was specified but
 * there was no hardware to do it on (the data will still be
 * encrypted though, in software).
 */


/*
 * Cipher Block Chaining mode
 */
#ifdef __STDC__
int cbc_crypt(char *key, char *buf, size_t len, unsigned int mode, char *ivec);
#else
int cbc_crypt();
#endif


/*
 * Electronic Code Book mode
 */
#ifdef __STDC__
int ecb_crypt(char *key, char *buf, size_t len, unsigned int mode);
#else
int ecb_crypt();
#endif


#ifndef _KERNEL
/*
 * Set des parity for a key.
 * DES parity is odd and in the low bit of each byte
 */
#ifdef __STDC__
void des_setparity(char *key);
#else
void des_setparity();
#endif
#endif	/* _KERNEL */

#ifdef __cplusplus
}
#endif

#endif	/* _DES_DES_CRYPT_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
 */
/*
 * Copyright (c) 2007, The Ohio State University. All rights reserved.
 *
 * Portions of this source code is developed by the team members of
 * The Ohio State University's Network-Based Computing Laboratory (NBCL),
 * headed by Professor Dhabaleswar K. (DK) Panda.
 *
 * Acknowledgements to contributions from developors:
 *   Ranjit Noronha: noronha@cse.ohio-state.edu
 *   Lei Chai      : chail@cse.ohio-state.edu
 *   Weikuan Yu    : yuw@cse.ohio-state.edu
 *
 */


#ifndef _IB_H
#define	_IB_H

/*
 * ib.h, rpcib plugin interface.
 */

#include <sys/types.h>
#include <sys/ddi.h>
#include <sys/sunddi.h>
#include <sys/conf.h>
#include <sys/stat.h>
#include <rpc/rpc.h>
#include <rpc/rpc_rdma.h>
#include <sys/ib/ibtl/ibti.h>
#include <sys/avl.h>

#ifdef __cplusplus
extern "C" {
#endif

#define	MAX_BUFS	1024	/* max no. of buffers per pool */

#define	DEF_CQ_SIZE	4096 - 1	/* default CQ size */
				/*
				 * Tavor returns the next higher power of 2
				 * CQ entries than the requested size.
				 * For instance, if you request (2^12 - 1)
				 * CQ entries, Tavor returns 2^12 entries.
				 * 4K CQ entries suffice.  Hence, 4096 - 1.
				 */
#define	DEF_SQ_SIZE	128	/* default SendQ size */
#define	DEF_RQ_SIZE	256	/* default RecvQ size */
#define	DSEG_MAX	2
#define	RQ_DSEG_MAX	1	/* default RQ data seg */
#define	IBSRM_HB	0x8000	/* high order bit of pkey */

/* max no. of refresh attempts on IBT_CM_CONN_STALE error */
#define	REFRESH_ATTEMPTS	3

typedef struct rib_hca_s rib_hca_t;
typedef struct rib_qp_s rib_qp_t;
typedef struct rib_cq_s rib_cq_t;

/*
 * Notification for RDMA_DONE is based on xid
 */
struct rdma_done_list {
	uint32_t	xid;		/* XID waiting for RDMA_DONE */
	kcondvar_t	rdma_done_cv;	/* cv for RDMA_DONE */
	struct rdma_done_list	*next;
	struct rdma_done_list	*prev;
};

/*
 * State of the plugin.
 * ACCEPT = accepting new connections and requests
 * NO_ACCEPT = not accepting new connection and requests
 */
#define	ACCEPT		1
#define	NO_ACCEPT	2

/*
 * Send Wait states
 */
#define	SEND_WAIT	-1

/*
 * Reply states
 */
#define	REPLY_WAIT	-1

typedef void * rib_pvoid;
typedef rib_pvoid RIB_SYNCMEM_HANDLE;

/*
 * IB buffer pool management structure
 */

/*
 * Buffer pool info
 */
typedef struct {
	kmutex_t	buflock;	/* lock for this structure */
	caddr_t		buf;		/* pool address */
	uint32_t	bufhandle;	/* rkey for this pool */
	ulong_t		bufsize;	/* size of pool */
	int		rsize;		/* size of each element */
	int		numelems;	/* no. of elements allocated */
	int		buffree;	/* no. of free elements */
	void		*buflist[1];	/* free elements in pool */
} bufpool_t;

typedef struct {
	bufpool_t	*bpool;
	ibt_mr_hdl_t	*mr_hdl;
	ibt_mr_desc_t	*mr_desc;	/* vaddr, lkey, rkey */
} rib_bufpool_t;

/*
 * ATS relsted defines and structures.
 */
#define	ATS_AR_DATA_LEN	16


/*
 * Service types supported by RPCIB
 * For now only NFS is supported.
 */
#define	NFS		1
#define	NLM		2

/*
 * Tracks consumer state (client or server).
 */
typedef enum {
	RIB_SERVER,
	RIB_CLIENT
} rib_mode_t;

/*
 * CQ structure
 */
struct rib_cq_s {
	rib_hca_t		*rib_hca;
	ibt_cq_hdl_t		rib_cq_hdl;
};

/*
 * Each registered service's data structure.
 */
typedef struct rib_service_s rib_service_t;
struct rib_service_s {
	uint32_t		srv_type;	/* i.e, NFS, NLM, v4CBD */
	ibt_srv_hdl_t		srv_hdl;	/* from ibt_register call */
	ib_svc_id_t		srv_id;
	rib_service_t		*next;
};

/*
 * RPCIB plugin state
 */
typedef struct rpcib_state {
	ibt_clnt_hdl_t		ibt_clnt_hdl;
	uint32_t		hca_count;
	uint32_t		nhca_inited;
	rib_hca_t		*hcas_list;
	krwlock_t		hcas_list_lock;	/* protects hcas_list */
	int			refcount;
	kmutex_t		open_hca_lock;
	queue_t			*q;		/* up queue for a serv_type */
	void			*private;
	rib_service_t		*service_list;
	krwlock_t		service_list_lock;
	kmutex_t		listen_lock;
} rpcib_state_t;

/*
 * Connection lists
 */
typedef struct {
	krwlock_t	conn_lock;	/* list lock */
	CONN		*conn_hd;	/* list head */
} rib_conn_list_t;

enum hca_state {
	HCA_DETACHED,		/* hca in detached state */
	HCA_INITED,		/* hca in up and running state */
};

typedef struct rib_hca_service_s rib_hca_service_t;
struct rib_hca_service_s {
	ib_svc_id_t	srv_id;
	ib_gid_t	gid;
	ibt_sbind_hdl_t	sbind_hdl;
	rib_hca_service_t *next;
};

/*
 * RPCIB per HCA structure
 */
struct rib_hca_s {
	ibt_clnt_hdl_t		ibt_clnt_hdl;

	/*
	 * per HCA.
	 */
	ibt_hca_hdl_t		hca_hdl;	/* HCA handle */
	ibt_hca_attr_t		hca_attrs;	/* HCA attributes */
	ibt_pd_hdl_t		pd_hdl;
	rib_hca_service_t	*bound_services;
	krwlock_t		bound_services_lock;
	ib_guid_t		hca_guid;
	uint32_t		hca_nports;
	ibt_hca_portinfo_t	*hca_ports;
	size_t			hca_pinfosz;
	enum hca_state		state;		/* state of HCA */
	krwlock_t		state_lock;	/* protects state field */
	bool_t			inuse;		/* indicates HCA usage */
	kmutex_t		inuse_lock;	/* protects inuse field */

	rib_conn_list_t		cl_conn_list;	/* client conn list */
	rib_conn_list_t		srv_conn_list;	/* server conn list */

	rib_cq_t		*clnt_scq;
	rib_cq_t		*clnt_rcq;
	rib_cq_t		*svc_scq;
	rib_cq_t		*svc_rcq;
	kmutex_t		cb_lock;
	kcondvar_t		cb_cv;

	rib_bufpool_t		*recv_pool;	/* recv buf pool */
	rib_bufpool_t		*send_pool;	/* send buf pool */

	void			*iblock;	/* interrupt cookie */

	kmem_cache_t	*server_side_cache;	/* long reply pool */
	avl_tree_t	avl_tree;
	kmutex_t	avl_lock;
	krwlock_t	avl_rw_lock;
	volatile bool_t avl_init;
	kmutex_t	cache_allocation_lock;
	ddi_taskq_t	*cleanup_helper;
	ib_svc_id_t	srv_id;
	ibt_srv_hdl_t 	srv_hdl;
	uint_t		reg_state;

	volatile uint64_t	cache_allocation;
	uint64_t	cache_hits;
	uint64_t	cache_misses;
	uint64_t	cache_cold_misses;
	uint64_t	cache_hot_misses;
	uint64_t	cache_misses_above_the_limit;

	struct rib_hca_s *next;
};


/*
 * Structure on wait state of a post send
 */
struct send_wid {
	uint32_t 	xid;
	int		cv_sig;
	kmutex_t	sendwait_lock;
	kcondvar_t	wait_cv;
	uint_t		status;
	rib_qp_t	*qp;
	int		nsbufs;			/* # of send buffers posted */
	uint64_t	sbufaddr[DSEG_MAX];	/* posted send buffers */
	caddr_t		c;
	caddr_t		c1;
	int		l1;
	caddr_t		c2;
	int		l2;
	int		wl, rl;
};

/*
 * Structure on reply descriptor for recv queue.
 * Different from the above posting of a descriptor.
 */
struct reply {
	uint32_t 	xid;
	uint_t		status;
	uint64_t	vaddr_cq;	/* buf addr from CQ */
	uint_t		bytes_xfer;
	kcondvar_t	wait_cv;
	struct reply	*next;
	struct reply 	*prev;
};

struct svc_recv {
	rib_qp_t	*qp;
	uint64_t	vaddr;
	uint_t		bytes_xfer;
};

struct recv_wid {
	uint32_t 	xid;
	rib_qp_t	*qp;
	uint64_t	addr;	/* posted buf addr */
};

/*
 * Per QP data structure
 */
struct rib_qp_s {
	rib_hca_t		*hca;
	rib_mode_t		mode;	/* RIB_SERVER or RIB_CLIENT */
	CONN			rdmaconn;
	ibt_channel_hdl_t	qp_hdl;
	uint_t			port_num;
	ib_qpn_t		qpn;
	int			chan_flags;
	clock_t			timeout;
	ibt_rc_chan_query_attr_t	qp_q_attrs;
	rib_cq_t		*send_cq;	/* send CQ */
	rib_cq_t		*recv_cq;	/* recv CQ */

	/*
	 * Number of pre-posted rbufs
	 */
	uint_t			n_posted_rbufs;
	kcondvar_t 		posted_rbufs_cv;
	kmutex_t		posted_rbufs_lock;

	/*
	 * Number of SENDs pending completion
	 */

	uint_t			n_send_rbufs;
	kcondvar_t 		send_rbufs_cv;
	kmutex_t		send_rbufs_lock;

	/*
	 * RPC reply
	 */
	uint_t			rep_list_size;
	struct reply		*replylist;
	kmutex_t		replylist_lock;

	/*
	 * server only, RDMA_DONE
	 */
	struct rdma_done_list	*rdlist;
	kmutex_t		rdlist_lock;

	kmutex_t		cb_lock;
	kcondvar_t 		cb_conn_cv;

	caddr_t			q;	/* upstream queue */
	struct send_wid		wd;
};

#define	ctoqp(conn)	((rib_qp_t *)((conn)->c_private))
#define	qptoc(rqp)	((CONN *)&((rqp)->rdmaconn))

/*
 * Timeout for various calls
 */
#define	CONN_WAIT_TIME	40
#define	SEND_WAIT_TIME	40	/* time for send completion */

#define	REPLY_WAIT_TIME	40	/* time to get reply from remote QP */

#ifdef __cplusplus
}
#endif

#endif	/* !_IB_H */
/*
 * Please do not edit this file.
 * It was generated using rpcgen.
 */

#ifndef _KEY_PROT_H_RPCGEN
#define	_KEY_PROT_H_RPCGEN

#include <rpc/rpc.h>

#ifdef __cplusplus
extern "C" {
#endif


/* Copyright (c)  1990, 1991 Sun Microsystems, Inc. */

/*
 * Compiled from key_prot.x using rpcgen.
 * DO NOT EDIT THIS FILE!
 * This is NOT source code!
 */
#define	PROOT 3
#define	HEXMODULUS "d4a0ba0250b6fd2ec626e7efd637df76c716e22d0944b88b"
#define	HEXKEYBYTES 48
#define	KEYSIZE 192
#define	KEYBYTES 24
#define	KEYCHECKSUMSIZE 16

enum keystatus {
	KEY_SUCCESS = 0,
	KEY_NOSECRET = 1,
	KEY_UNKNOWN = 2,
	KEY_SYSTEMERR = 3,
	KEY_BADALG = 4,
	KEY_BADLEN = 5
};
typedef enum keystatus keystatus;

typedef char keybuf[HEXKEYBYTES];

typedef struct {
	u_int keybuf3_len;
	char *keybuf3_val;
} keybuf3;

typedef char *netnamestr;

typedef int keylen_t;

typedef int algtype_t;

struct mechtype {
	keylen_t keylen;
	algtype_t algtype;
};
typedef struct mechtype mechtype;

typedef int keynum_t;

typedef struct {
	u_int deskeyarray_len;
	des_block *deskeyarray_val;
} deskeyarray;

struct cryptkeyarg {
	netnamestr remotename;
	des_block deskey;
};
typedef struct cryptkeyarg cryptkeyarg;

struct cryptkeyarg2 {
	netnamestr remotename;
	netobj remotekey;
	des_block deskey;
};
typedef struct cryptkeyarg2 cryptkeyarg2;

struct cryptkeyarg3 {
	netnamestr remotename;
	keybuf3 remotekey;
	deskeyarray deskey;
	algtype_t algtype;
	keylen_t keylen;
};
typedef struct cryptkeyarg3 cryptkeyarg3;

struct cryptkeyres {
	keystatus status;
	union {
		des_block deskey;
	} cryptkeyres_u;
};
typedef struct cryptkeyres cryptkeyres;

struct cryptkeyres3 {
	keystatus status;
	union {
		deskeyarray deskey;
	} cryptkeyres3_u;
};
typedef struct cryptkeyres3 cryptkeyres3;
#define	MAXGIDS 16

struct unixcred {
	u_int uid;
	u_int gid;
	struct {
		u_int gids_len;
		u_int *gids_val;
	} gids;
};
typedef struct unixcred unixcred;

struct unixcred3 {
	u_int uid;
	u_int gid;
	struct {
		u_int gids_len;
		u_int *gids_val;
	} gids;
};
typedef struct unixcred3 unixcred3;

struct getcredres {
	keystatus status;
	union {
		unixcred cred;
	} getcredres_u;
};
typedef struct getcredres getcredres;

struct getcredres3 {
	keystatus status;
	union {
		unixcred3 cred;
	} getcredres3_u;
};
typedef struct getcredres3 getcredres3;

struct key_netstarg {
	keybuf st_priv_key;
	keybuf st_pub_key;
	netnamestr st_netname;
};
typedef struct key_netstarg key_netstarg;

struct key_netstarg3 {
	keybuf3 st_priv_key;
	keybuf3 st_pub_key;
	netnamestr st_netname;
	algtype_t algtype;
	keylen_t keylen;
	des_block userkey;
};
typedef struct key_netstarg3 key_netstarg3;

struct key_netstres {
	keystatus status;
	union {
		key_netstarg knet;
	} key_netstres_u;
};
typedef struct key_netstres key_netstres;

struct key_netstres3 {
	keystatus status;
	union {
		key_netstarg3 knet;
	} key_netstres3_u;
};
typedef struct key_netstres3 key_netstres3;

struct deskeyarg3 {
	keybuf3 pub_key;
	int nkeys;
	algtype_t algtype;
	keylen_t keylen;
};
typedef struct deskeyarg3 deskeyarg3;

struct setkeyarg3 {
	keybuf3 key;
	des_block userkey;
	algtype_t algtype;
	keylen_t keylen;
};
typedef struct setkeyarg3 setkeyarg3;

#ifndef opaque
#define opaque char
#endif


#define	KEY_PROG	100029
#define	KEY_VERS	1

#if defined(__STDC__) || defined(__cplusplus)
#define	KEY_SET	1
extern  keystatus * key_set_1(char *, CLIENT *);
extern  keystatus * key_set_1_svc(char *, struct svc_req *);
#define	KEY_ENCRYPT	2
extern  cryptkeyres * key_encrypt_1(cryptkeyarg *, CLIENT *);
extern  cryptkeyres * key_encrypt_1_svc(cryptkeyarg *, struct svc_req *);
#define	KEY_DECRYPT	3
extern  cryptkeyres * key_decrypt_1(cryptkeyarg *, CLIENT *);
extern  cryptkeyres * key_decrypt_1_svc(cryptkeyarg *, struct svc_req *);
#define	KEY_GEN	4
extern  des_block * key_gen_1(void *, CLIENT *);
extern  des_block * key_gen_1_svc(void *, struct svc_req *);
#define	KEY_GETCRED	5
extern  getcredres * key_getcred_1(netnamestr *, CLIENT *);
extern  getcredres * key_getcred_1_svc(netnamestr *, struct svc_req *);
extern int key_prog_1_freeresult(SVCXPRT *, xdrproc_t, caddr_t);

#else /* K&R C */
#define	KEY_SET	1
extern  keystatus * key_set_1();
extern  keystatus * key_set_1_svc();
#define	KEY_ENCRYPT	2
extern  cryptkeyres * key_encrypt_1();
extern  cryptkeyres * key_encrypt_1_svc();
#define	KEY_DECRYPT	3
extern  cryptkeyres * key_decrypt_1();
extern  cryptkeyres * key_decrypt_1_svc();
#define	KEY_GEN	4
extern  des_block * key_gen_1();
extern  des_block * key_gen_1_svc();
#define	KEY_GETCRED	5
extern  getcredres * key_getcred_1();
extern  getcredres * key_getcred_1_svc();
extern int key_prog_1_freeresult();
#endif /* K&R C */
#define	KEY_VERS2	2

#if defined(__STDC__) || defined(__cplusplus)
extern  keystatus * key_set_2(char *, CLIENT *);
extern  keystatus * key_set_2_svc(char *, struct svc_req *);
extern  cryptkeyres * key_encrypt_2(cryptkeyarg *, CLIENT *);
extern  cryptkeyres * key_encrypt_2_svc(cryptkeyarg *, struct svc_req *);
extern  cryptkeyres * key_decrypt_2(cryptkeyarg *, CLIENT *);
extern  cryptkeyres * key_decrypt_2_svc(cryptkeyarg *, struct svc_req *);
extern  des_block * key_gen_2(void *, CLIENT *);
extern  des_block * key_gen_2_svc(void *, struct svc_req *);
extern  getcredres * key_getcred_2(netnamestr *, CLIENT *);
extern  getcredres * key_getcred_2_svc(netnamestr *, struct svc_req *);
#define	KEY_ENCRYPT_PK	6
extern  cryptkeyres * key_encrypt_pk_2(cryptkeyarg2 *, CLIENT *);
extern  cryptkeyres * key_encrypt_pk_2_svc(cryptkeyarg2 *, struct svc_req *);
#define	KEY_DECRYPT_PK	7
extern  cryptkeyres * key_decrypt_pk_2(cryptkeyarg2 *, CLIENT *);
extern  cryptkeyres * key_decrypt_pk_2_svc(cryptkeyarg2 *, struct svc_req *);
#define	KEY_NET_PUT	8
extern  keystatus * key_net_put_2(key_netstarg *, CLIENT *);
extern  keystatus * key_net_put_2_svc(key_netstarg *, struct svc_req *);
#define	KEY_NET_GET	9
extern  key_netstres * key_net_get_2(void *, CLIENT *);
extern  key_netstres * key_net_get_2_svc(void *, struct svc_req *);
#define	KEY_GET_CONV	10
extern  cryptkeyres * key_get_conv_2(char *, CLIENT *);
extern  cryptkeyres * key_get_conv_2_svc(char *, struct svc_req *);
extern int key_prog_2_freeresult(SVCXPRT *, xdrproc_t, caddr_t);

#else /* K&R C */
extern  keystatus * key_set_2();
extern  keystatus * key_set_2_svc();
extern  cryptkeyres * key_encrypt_2();
extern  cryptkeyres * key_encrypt_2_svc();
extern  cryptkeyres * key_decrypt_2();
extern  cryptkeyres * key_decrypt_2_svc();
extern  des_block * key_gen_2();
extern  des_block * key_gen_2_svc();
extern  getcredres * key_getcred_2();
extern  getcredres * key_getcred_2_svc();
#define	KEY_ENCRYPT_PK	6
extern  cryptkeyres * key_encrypt_pk_2();
extern  cryptkeyres * key_encrypt_pk_2_svc();
#define	KEY_DECRYPT_PK	7
extern  cryptkeyres * key_decrypt_pk_2();
extern  cryptkeyres * key_decrypt_pk_2_svc();
#define	KEY_NET_PUT	8
extern  keystatus * key_net_put_2();
extern  keystatus * key_net_put_2_svc();
#define	KEY_NET_GET	9
extern  key_netstres * key_net_get_2();
extern  key_netstres * key_net_get_2_svc();
#define	KEY_GET_CONV	10
extern  cryptkeyres * key_get_conv_2();
extern  cryptkeyres * key_get_conv_2_svc();
extern int key_prog_2_freeresult();
#endif /* K&R C */
#define	KEY_VERS3	3

#if defined(__STDC__) || defined(__cplusplus)
extern  keystatus * key_set_3(char *, CLIENT *);
extern  keystatus * key_set_3_svc(char *, struct svc_req *);
extern  cryptkeyres * key_encrypt_3(cryptkeyarg *, CLIENT *);
extern  cryptkeyres * key_encrypt_3_svc(cryptkeyarg *, struct svc_req *);
extern  cryptkeyres * key_decrypt_3(cryptkeyarg *, CLIENT *);
extern  cryptkeyres * key_decrypt_3_svc(cryptkeyarg *, struct svc_req *);
extern  des_block * key_gen_3(void *, CLIENT *);
extern  des_block * key_gen_3_svc(void *, struct svc_req *);
extern  getcredres * key_getcred_3(netnamestr *, CLIENT *);
extern  getcredres * key_getcred_3_svc(netnamestr *, struct svc_req *);
extern  cryptkeyres * key_encrypt_pk_3(cryptkeyarg2 *, CLIENT *);
extern  cryptkeyres * key_encrypt_pk_3_svc(cryptkeyarg2 *, struct svc_req *);
extern  cryptkeyres * key_decrypt_pk_3(cryptkeyarg2 *, CLIENT *);
extern  cryptkeyres * key_decrypt_pk_3_svc(cryptkeyarg2 *, struct svc_req *);
extern  keystatus * key_net_put_3(key_netstarg *, CLIENT *);
extern  keystatus * key_net_put_3_svc(key_netstarg *, struct svc_req *);
extern  key_netstres * key_net_get_3(void *, CLIENT *);
extern  key_netstres * key_net_get_3_svc(void *, struct svc_req *);
extern  cryptkeyres * key_get_conv_3(char *, CLIENT *);
extern  cryptkeyres * key_get_conv_3_svc(char *, struct svc_req *);
#define	KEY_SET_3	11
extern  keystatus * key_set_3_3(setkeyarg3 *, CLIENT *);
extern  keystatus * key_set_3_3_svc(setkeyarg3 *, struct svc_req *);
#define	KEY_ENCRYPT_3	12
extern  cryptkeyres3 * key_encrypt_3_3(cryptkeyarg3 *, CLIENT *);
extern  cryptkeyres3 * key_encrypt_3_3_svc(cryptkeyarg3 *, struct svc_req *);
#define	KEY_DECRYPT_3	13
extern  cryptkeyres3 * key_decrypt_3_3(cryptkeyarg3 *, CLIENT *);
extern  cryptkeyres3 * key_decrypt_3_3_svc(cryptkeyarg3 *, struct svc_req *);
#define	KEY_GEN_3	14
extern  deskeyarray * key_gen_3_3(keynum_t *, CLIENT *);
extern  deskeyarray * key_gen_3_3_svc(keynum_t *, struct svc_req *);
#define	KEY_GETCRED_3	15
extern  getcredres3 * key_getcred_3_3(netnamestr *, CLIENT *);
extern  getcredres3 * key_getcred_3_3_svc(netnamestr *, struct svc_req *);
#define	KEY_ENCRYPT_PK_3	16
extern  cryptkeyres3 * key_encrypt_pk_3_3(cryptkeyarg3 *, CLIENT *);
extern  cryptkeyres3 * key_encrypt_pk_3_3_svc(cryptkeyarg3 *, struct svc_req *);
#define	KEY_DECRYPT_PK_3	17
extern  cryptkeyres3 * key_decrypt_pk_3_3(cryptkeyarg3 *, CLIENT *);
extern  cryptkeyres3 * key_decrypt_pk_3_3_svc(cryptkeyarg3 *, struct svc_req *);
#define	KEY_NET_PUT_3	18
extern  keystatus * key_net_put_3_3(key_netstarg3 *, CLIENT *);
extern  keystatus * key_net_put_3_3_svc(key_netstarg3 *, struct svc_req *);
#define	KEY_NET_GET_3	19
extern  key_netstres3 * key_net_get_3_3(key_netstarg3 *, CLIENT *);
extern  key_netstres3 * key_net_get_3_3_svc(key_netstarg3 *, struct svc_req *);
#define	KEY_GET_CONV_3	20
extern  cryptkeyres3 * key_get_conv_3_3(deskeyarg3 *, CLIENT *);
extern  cryptkeyres3 * key_get_conv_3_3_svc(deskeyarg3 *, struct svc_req *);
#define	KEY_CLEAR_3	21
extern  keystatus * key_clear_3_3(void *, CLIENT *);
extern  keystatus * key_clear_3_3_svc(void *, struct svc_req *);
extern int key_prog_3_freeresult(SVCXPRT *, xdrproc_t, caddr_t);

#else /* K&R C */
extern  keystatus * key_set_3();
extern  keystatus * key_set_3_svc();
extern  cryptkeyres * key_encrypt_3();
extern  cryptkeyres * key_encrypt_3_svc();
extern  cryptkeyres * key_decrypt_3();
extern  cryptkeyres * key_decrypt_3_svc();
extern  des_block * key_gen_3();
extern  des_block * key_gen_3_svc();
extern  getcredres * key_getcred_3();
extern  getcredres * key_getcred_3_svc();
extern  cryptkeyres * key_encrypt_pk_3();
extern  cryptkeyres * key_encrypt_pk_3_svc();
extern  cryptkeyres * key_decrypt_pk_3();
extern  cryptkeyres * key_decrypt_pk_3_svc();
extern  keystatus * key_net_put_3();
extern  keystatus * key_net_put_3_svc();
extern  key_netstres * key_net_get_3();
extern  key_netstres * key_net_get_3_svc();
extern  cryptkeyres * key_get_conv_3();
extern  cryptkeyres * key_get_conv_3_svc();
#define	KEY_SET_3	11
extern  keystatus * key_set_3_3();
extern  keystatus * key_set_3_3_svc();
#define	KEY_ENCRYPT_3	12
extern  cryptkeyres3 * key_encrypt_3_3();
extern  cryptkeyres3 * key_encrypt_3_3_svc();
#define	KEY_DECRYPT_3	13
extern  cryptkeyres3 * key_decrypt_3_3();
extern  cryptkeyres3 * key_decrypt_3_3_svc();
#define	KEY_GEN_3	14
extern  deskeyarray * key_gen_3_3();
extern  deskeyarray * key_gen_3_3_svc();
#define	KEY_GETCRED_3	15
extern  getcredres3 * key_getcred_3_3();
extern  getcredres3 * key_getcred_3_3_svc();
#define	KEY_ENCRYPT_PK_3	16
extern  cryptkeyres3 * key_encrypt_pk_3_3();
extern  cryptkeyres3 * key_encrypt_pk_3_3_svc();
#define	KEY_DECRYPT_PK_3	17
extern  cryptkeyres3 * key_decrypt_pk_3_3();
extern  cryptkeyres3 * key_decrypt_pk_3_3_svc();
#define	KEY_NET_PUT_3	18
extern  keystatus * key_net_put_3_3();
extern  keystatus * key_net_put_3_3_svc();
#define	KEY_NET_GET_3	19
extern  key_netstres3 * key_net_get_3_3();
extern  key_netstres3 * key_net_get_3_3_svc();
#define	KEY_GET_CONV_3	20
extern  cryptkeyres3 * key_get_conv_3_3();
extern  cryptkeyres3 * key_get_conv_3_3_svc();
#define	KEY_CLEAR_3	21
extern  keystatus * key_clear_3_3();
extern  keystatus * key_clear_3_3_svc();
extern int key_prog_3_freeresult();
#endif /* K&R C */

/* the xdr functions */

#if defined(__STDC__) || defined(__cplusplus)
extern  bool_t xdr_keystatus(XDR *, keystatus*);
extern  bool_t xdr_keybuf(XDR *, keybuf);
extern  bool_t xdr_keybuf3(XDR *, keybuf3*);
extern  bool_t xdr_netnamestr(XDR *, netnamestr*);
extern  bool_t xdr_keylen_t(XDR *, keylen_t*);
extern  bool_t xdr_algtype_t(XDR *, algtype_t*);
extern  bool_t xdr_mechtype(XDR *, mechtype*);
extern  bool_t xdr_keynum_t(XDR *, keynum_t*);
extern  bool_t xdr_deskeyarray(XDR *, deskeyarray*);
extern  bool_t xdr_cryptkeyarg(XDR *, cryptkeyarg*);
extern  bool_t xdr_cryptkeyarg2(XDR *, cryptkeyarg2*);
extern  bool_t xdr_cryptkeyarg3(XDR *, cryptkeyarg3*);
extern  bool_t xdr_cryptkeyres(XDR *, cryptkeyres*);
extern  bool_t xdr_cryptkeyres3(XDR *, cryptkeyres3*);
extern  bool_t xdr_unixcred(XDR *, unixcred*);
extern  bool_t xdr_unixcred3(XDR *, unixcred3*);
extern  bool_t xdr_getcredres(XDR *, getcredres*);
extern  bool_t xdr_getcredres3(XDR *, getcredres3*);
extern  bool_t xdr_key_netstarg(XDR *, key_netstarg*);
extern  bool_t xdr_key_netstarg3(XDR *, key_netstarg3*);
extern  bool_t xdr_key_netstres(XDR *, key_netstres*);
extern  bool_t xdr_key_netstres3(XDR *, key_netstres3*);
extern  bool_t xdr_deskeyarg3(XDR *, deskeyarg3*);
extern  bool_t xdr_setkeyarg3(XDR *, setkeyarg3*);

#else /* K&R C */
extern bool_t xdr_keystatus();
extern bool_t xdr_keybuf();
extern bool_t xdr_keybuf3();
extern bool_t xdr_netnamestr();
extern bool_t xdr_keylen_t();
extern bool_t xdr_algtype_t();
extern bool_t xdr_mechtype();
extern bool_t xdr_keynum_t();
extern bool_t xdr_deskeyarray();
extern bool_t xdr_cryptkeyarg();
extern bool_t xdr_cryptkeyarg2();
extern bool_t xdr_cryptkeyarg3();
extern bool_t xdr_cryptkeyres();
extern bool_t xdr_cryptkeyres3();
extern bool_t xdr_unixcred();
extern bool_t xdr_unixcred3();
extern bool_t xdr_getcredres();
extern bool_t xdr_getcredres3();
extern bool_t xdr_key_netstarg();
extern bool_t xdr_key_netstarg3();
extern bool_t xdr_key_netstres();
extern bool_t xdr_key_netstres3();
extern bool_t xdr_deskeyarg3();
extern bool_t xdr_setkeyarg3();

#endif /* K&R C */

#ifdef __cplusplus
}
#endif

#endif /* !_KEY_PROT_H_RPCGEN */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Key server protocol definition
 * Copyright (C) 1990, 1991 Sun Microsystems, Inc.
 *
 * The keyserver is a public key storage/encryption/decryption service
 * The encryption method used is based on the Diffie-Hellman exponential
 * key exchange technology.
 *
 * The key server is local to each machine, akin to the portmapper.
 * Under TI-RPC, communication with the keyserver is through the
 * loopback transport.
 *
 * NOTE: This .x file generates the USER level headers for the keyserver.
 * the KERNEL level headers are created by hand as they kernel has special
 * requirements.
 */

%
%/* Copyright (c)  1990, 1991 Sun Microsystems, Inc. */
%
%/*
% * Compiled from key_prot.x using rpcgen.
% * DO NOT EDIT THIS FILE!
% * This is NOT source code!
% */

/*
 * PROOT and MODULUS define the way the Diffie-Hellman key is generated.
 *
 * MODULUS should be chosen as a prime of the form: MODULUS == 2*p + 1,
 * where p is also prime.
 *
 * PROOT satisfies the following two conditions:
 * (1) (PROOT ** 2) % MODULUS != 1
 * (2) (PROOT ** p) % MODULUS != 1
 *
 */

const PROOT = 3;
const HEXMODULUS = "d4a0ba0250b6fd2ec626e7efd637df76c716e22d0944b88b";

const HEXKEYBYTES = 48;		/* HEXKEYBYTES == strlen(HEXMODULUS) */
const KEYSIZE = 192;		/* KEYSIZE == bit length of key */
const KEYBYTES = 24;		/* byte length of key */

/*
 * The first 16 hex digits of the encrypted secret key are used as
 * a checksum in the database.
 */
const KEYCHECKSUMSIZE = 16;

/*
 * status of operation
 */
enum keystatus {
	KEY_SUCCESS,	/* no problems */
	KEY_NOSECRET,	/* no secret key stored */
	KEY_UNKNOWN,	/* unknown netname */
	KEY_SYSTEMERR, 	/* system error (out of memory, encryption failure) */
	KEY_BADALG,	/* unknown algorithm type */
	KEY_BADLEN	/* unsupported keysize */
};

typedef opaque keybuf[HEXKEYBYTES];	/* store key in hex */
typedef opaque keybuf3<>;		/* store key in binary */

typedef string netnamestr<MAXNETNAMELEN>;

/*
 * algorithm type & key size
 */
typedef int keylen_t;
typedef int algtype_t;

struct mechtype {
	keylen_t keylen;
	algtype_t algtype;
};

/*
 * number of keys for KEY_GEN_3 to return
 */
typedef int keynum_t;

/*
 * Result of KEY_GEN_3
 */
typedef des_block deskeyarray<>;

/*
 * Argument to ENCRYPT or DECRYPT
 */
struct cryptkeyarg {
	netnamestr remotename;
	des_block deskey;
};

/*
 * Argument to ENCRYPT_PK or DECRYPT_PK
 */
struct cryptkeyarg2 {
	netnamestr remotename;
	netobj	remotekey;	/* Contains a length up to 1024 bytes */
	des_block deskey;
};

/*
 * Argument to ENCRYPT_3, ENCRYPT_PK_3, DECRYPT_3, DECRYPT_PK_3
 */
struct cryptkeyarg3 {
	netnamestr remotename;
	keybuf3 remotekey;
	deskeyarray deskey;
	algtype_t algtype;
	keylen_t keylen;
};

/*
 * Result of ENCRYPT, DECRYPT, ENCRYPT_PK, DECRYPT_PK, KEY_GET_CONV
 */
union cryptkeyres switch (keystatus status) {
case KEY_SUCCESS:
	des_block deskey;
default:
	void;
};

/*
 * Result of ENCRYPT_3, DECRYPT_3, ENCRYPT_PK_3, DECRYPT_PK_3, KEY_GET_CONV_3
 */
union cryptkeyres3 switch (keystatus status) {
case KEY_SUCCESS:
	deskeyarray deskey;
default:
	void;
};

const MAXGIDS  = 16;	/* max number of gids in gid list */

/*
 * Unix credential
 */
struct unixcred {
	u_int uid;
	u_int gid;
	u_int gids<MAXGIDS>;
};

/*
 * Unix credential, without arbitrary limit
 */
struct unixcred3 {
	u_int uid;
	u_int gid;
	u_int gids<>;
};

/*
 * Result returned from GETCRED
 */
union getcredres switch (keystatus status) {
case KEY_SUCCESS:
	unixcred cred;
default:
	void;
};

/*
 * Result returned from GETCRED_3
 */
union getcredres3 switch (keystatus status) {
case KEY_SUCCESS:
	unixcred3 cred;
default:
	void;
};

/*
 * key_netstarg;
 */
struct key_netstarg {
	keybuf st_priv_key;
	keybuf st_pub_key;
	netnamestr st_netname;
};

struct key_netstarg3 {
	keybuf3 st_priv_key;
	keybuf3 st_pub_key;
	netnamestr st_netname;
	algtype_t algtype;
	keylen_t keylen;
	des_block userkey;
};

union key_netstres switch (keystatus status){
case KEY_SUCCESS:
	key_netstarg knet;
default:
	void;
};

union key_netstres3 switch (keystatus status){
case KEY_SUCCESS:
	key_netstarg3 knet;
default:
	void;
};

/*
 * Argument to KEY_GET_CONV_3
 */
struct deskeyarg3 {
	keybuf3 pub_key;
	int nkeys;
	algtype_t algtype ;
	keylen_t keylen;
};

/*
 * Argument to KEY_SET_3
 */
struct setkeyarg3 {
	keybuf3 key;
	des_block userkey;
	algtype_t algtype ;
	keylen_t keylen;
};

#ifdef RPC_HDR
%
%#ifndef opaque
%#define	opaque char
%#endif
%
#endif
program KEY_PROG {
	version KEY_VERS {

		/*
		 * This is my secret key.
	 	 * Store it for me.
		 */
		keystatus
		KEY_SET(keybuf) = 1;

		/*
		 * I want to talk to X.
		 * Encrypt a conversation key for me.
	 	 */
		cryptkeyres
		KEY_ENCRYPT(cryptkeyarg) = 2;

		/*
		 * X just sent me a message.
		 * Decrypt the conversation key for me.
		 */
		cryptkeyres
		KEY_DECRYPT(cryptkeyarg) = 3;

		/*
		 * Generate a secure conversation key for me
		 */
		des_block
		KEY_GEN(void) = 4;

		/*
		 * Get me the uid, gid and group-access-list associated
		 * with this netname (for kernel which cannot use NIS)
		 */
		getcredres
		KEY_GETCRED(netnamestr) = 5;
	} = 1;
	version KEY_VERS2 {

		/*
		 * #######
		 * Procedures 1-5 are identical to version 1
		 * #######
		 */

		/*
		 * This is my secret key.
	 	 * Store it for me.
		 */
		keystatus
		KEY_SET(keybuf) = 1;

		/*
		 * I want to talk to X.
		 * Encrypt a conversation key for me.
	 	 */
		cryptkeyres
		KEY_ENCRYPT(cryptkeyarg) = 2;

		/*
		 * X just sent me a message.
		 * Decrypt the conversation key for me.
		 */
		cryptkeyres
		KEY_DECRYPT(cryptkeyarg) = 3;

		/*
		 * Generate a secure conversation key for me
		 */
		des_block
		KEY_GEN(void) = 4;

		/*
		 * Get me the uid, gid and group-access-list associated
		 * with this netname (for kernel which cannot use NIS)
		 */
		getcredres
		KEY_GETCRED(netnamestr) = 5;

		/*
		 * I want to talk to X. and I know X's public key
		 * Encrypt a conversation key for me.
	 	 */
		cryptkeyres
		KEY_ENCRYPT_PK(cryptkeyarg2) = 6;

		/*
		 * X just sent me a message. and I know X's public key
		 * Decrypt the conversation key for me.
		 */
		cryptkeyres
		KEY_DECRYPT_PK(cryptkeyarg2) = 7;

		/*
		 * Store my public key, netname and private key.
		 */
		keystatus
		KEY_NET_PUT(key_netstarg) = 8;

		/*
		 * Retrieve my public key, netname and private key.
		 */
 		key_netstres
		KEY_NET_GET(void) = 9;

		/*
		 * Return me the conversation (common) key that is constructed
		 * from my secret key and this publickey.
		 */
		cryptkeyres
		KEY_GET_CONV(keybuf) = 10;
	} = 2;
	version KEY_VERS3 {

		/*
		 * #######
		 * Procedures 1-10 are identical to versions 1 & 2
		 * #######
		 */

		/*
		 * This is my secret key.
	 	 * Store it for me.
		 */
		keystatus
		KEY_SET(keybuf) = 1;

		/*
		 * I want to talk to X.
		 * Encrypt a conversation key for me.
	 	 */
		cryptkeyres
		KEY_ENCRYPT(cryptkeyarg) = 2;

		/*
		 * X just sent me a message.
		 * Decrypt the conversation key for me.
		 */
		cryptkeyres
		KEY_DECRYPT(cryptkeyarg) = 3;

		/*
		 * Generate a secure conversation key for me
		 */
		des_block
		KEY_GEN(void) = 4;

		/*
		 * Get me the uid, gid and group-access-list associated
		 * with this netname (for kernel which cannot use NIS)
		 */
		getcredres
		KEY_GETCRED(netnamestr) = 5;

		/*
		 * I want to talk to X. and I know X's public key
		 * Encrypt a conversation key for me.
	 	 */
		cryptkeyres
		KEY_ENCRYPT_PK(cryptkeyarg2) = 6;

		/*
		 * X just sent me a message. and I know X's public key
		 * Decrypt the conversation key for me.
		 */
		cryptkeyres
		KEY_DECRYPT_PK(cryptkeyarg2) = 7;

		/*
		 * Store my public key, netname and private key.
		 */
		keystatus
		KEY_NET_PUT(key_netstarg) = 8;

		/*
		 * Retrieve my public key, netname and private key.
		 */
 		key_netstres
		KEY_NET_GET(void) = 9;

		/*
		 * Return me the conversation (common) key that is constructed
		 * from my secret key and this publickey.
		 */
		cryptkeyres
		KEY_GET_CONV(keybuf) = 10;

		/*
		 * #######
		 * Procedures new in version 3 follow...
		 * #######
		 */

		/*
		 * This is my secret key.
	 	 * Store it for me.
		 */
		keystatus
		KEY_SET_3(setkeyarg3) = 11;

		/*
		 * I want to talk to X.
		 * Encrypt a conversation key for me.
	 	 */
		cryptkeyres3
		KEY_ENCRYPT_3(cryptkeyarg3) = 12;

		/*
		 * X just sent me a message.
		 * Decrypt the conversation key for me.
		 */
		cryptkeyres3
		KEY_DECRYPT_3(cryptkeyarg3) = 13;

		/*
		 * Generate secure conversation key(s) for me
		 */
		deskeyarray
		KEY_GEN_3(keynum_t) = 14;

		/*
		 * Get me the uid, gid and group-access-list associated
		 * with this netname (for kernel which cannot use NIS)
		 */
		getcredres3
		KEY_GETCRED_3(netnamestr) = 15;

		/*
		 * I want to talk to X. and I know X's public key
		 * Encrypt a conversation key for me.
	 	 */
		cryptkeyres3
		KEY_ENCRYPT_PK_3(cryptkeyarg3) = 16;

		/*
		 * X just sent me a message. and I know X's public key
		 * Decrypt the conversation key for me.
		 */
		cryptkeyres3
		KEY_DECRYPT_PK_3(cryptkeyarg3) = 17;

		/*
		 * Store my public key, netname and private key.
		 */
		keystatus
		KEY_NET_PUT_3(key_netstarg3) = 18;

		/*
		 * Retrieve my public key, netname and private key.
		 */
 		key_netstres3
		KEY_NET_GET_3(key_netstarg3) = 19;

		/*
		 * Return me the conversation (common) key that is constructed
		 * from my secret key and this publickey.
		 */
		cryptkeyres3
		KEY_GET_CONV_3(deskeyarg3) = 20;

		/*
		 * Clear all the secret/public/netname triplets for the caller
		 */
		keystatus
		KEY_CLEAR_3(void) = 21;

	} = 3;
} = 100029;
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved  	*/


/*
 * Define and initialize MT client/server data.
 */

#include	<sys/types.h>
#include	<sys/t_lock.h>
#include	<sys/kstat.h>
#include	<sys/systm.h>
#include	<sys/zone.h>

#include	<rpc/types.h>
#include	<rpc/auth.h>
#include	<rpc/clnt.h>

kmutex_t xid_lock;		/* XID allocation */
kmutex_t clnt_pending_lock;	/* for list of pending calls awaiting replies */
kmutex_t clnt_max_msg_lock;	/* updating max message sanity check for cots */

zone_key_t	rpcstat_zone_key;

/*
 * rpcstat_zone_[init|fini]_common() ends up being nearly identical to
 * nfsstat_zone_[init|fini]_common().  Due to them necessarily being in
 * different modules, however, we end up needing to duplicate the code.
 */
kstat_named_t *
rpcstat_zone_init_common(zoneid_t zoneid, const char *module, const char *name,
    const kstat_named_t *template, size_t template_size)
{
	kstat_t *ksp;
	kstat_named_t *ks_data;


/*
 * PSARC 2001/697 Contract Private Interface
 * rpc_clts_client
 * rpc_cots_client
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2001-697@sun.com
 *
 */
	ks_data = kmem_alloc(template_size, KM_SLEEP);
	bcopy(template, ks_data, template_size);
	if ((ksp = kstat_create_zone(module, 0, name, "rpc",
	    KSTAT_TYPE_NAMED, template_size / sizeof (kstat_named_t),
	    KSTAT_FLAG_VIRTUAL | KSTAT_FLAG_WRITABLE, zoneid)) != NULL) {
		ksp->ks_data = ks_data;
		kstat_install(ksp);
	}
	return (ks_data);
}

void
rpcstat_zone_fini_common(zoneid_t zoneid, const char *module, const char *name)
{
	kstat_delete_byname_zone(module, 0, name, zoneid);
}

static void *
mt_kstat_zone_init(zoneid_t zoneid)
{
	struct rpcstat *rpcstat;

	rpcstat = kmem_alloc(sizeof (*rpcstat), KM_SLEEP);

	clnt_clts_stats_init(zoneid, &rpcstat->rpc_clts_client);
	svc_clts_stats_init(zoneid, &rpcstat->rpc_clts_server);

	clnt_cots_stats_init(zoneid, &rpcstat->rpc_cots_client);
	svc_cots_stats_init(zoneid, &rpcstat->rpc_cots_server);

	return (rpcstat);
}

/*
 * Deletes the previously allocated "rpc" kstats
 */
static void
mt_kstat_zone_fini(zoneid_t zoneid, void *data)
{
	struct rpcstat *rpcstat = data;

	clnt_cots_stats_fini(zoneid, &rpcstat->rpc_cots_client);
	svc_cots_stats_fini(zoneid, &rpcstat->rpc_cots_server);

	clnt_clts_stats_fini(zoneid, &rpcstat->rpc_clts_client);
	svc_clts_stats_fini(zoneid, &rpcstat->rpc_clts_server);

	kmem_free(rpcstat, sizeof (*rpcstat));
}

void
mt_kstat_init(void)
{
	zone_key_create(&rpcstat_zone_key, mt_kstat_zone_init, NULL,
	    mt_kstat_zone_fini);
}

void
mt_kstat_fini(void)
{
	(void) zone_key_delete(rpcstat_zone_key);
}

static bool_t	clnt_xid_initialized = FALSE;
static uint32_t clnt_xid = 0;	/* transaction id used by all clients */

uint32_t
alloc_xid(void)
{
	uint32_t  xid;
	timestruc_t now;

	/*
	 * Do a one time initialzation to better utilize the number
	 * space.
	 */
	mutex_enter(&xid_lock);
	if (clnt_xid_initialized == FALSE) {
		clnt_xid_initialized = TRUE;
		gethrestime(&now);
		clnt_xid = (uint32_t)((now.tv_sec << 20) |
		    (now.tv_nsec >> 10));
	}

	xid = clnt_xid++;

	/*
	 * Don't return a zero xid.  This could happen if the initialization
	 * happens to return zero or if clnt_xid wraps.
	 */
	if (xid == 0)
		xid = clnt_xid++;

	mutex_exit(&xid_lock);
	return (xid);
}

/*
 * These functions are temporary and designed for the upgrade-workaround only.
 * They cannot be used for general zone-crossing RPC client support, and will
 * be removed shortly.
 *
 * Currently these functions route all nfs global clients to the global zone.
 * When this upgrade-workaround is removed these function should return the
 * correct zone or their calls should be changed (rpc_zone() to curproc->p_zone
 * and rpc_zoneid() to getzoneid()).
 */
struct zone *
rpc_zone(void)
{
	return (nfs_global_client_only != 0 ? global_zone : curproc->p_zone);
}

zoneid_t
rpc_zoneid(void)
{
	return (nfs_global_client_only != 0 ? GLOBAL_ZONEID : getzoneid());
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 *
 * Copyright 1996 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

/*
 * nettype.h, Nettype definitions.
 * All for the topmost layer of rpc
 *
 */

#ifndef	_RPC_NETTYPE_H
#define	_RPC_NETTYPE_H

#include <netconfig.h>

#ifdef	__cplusplus
extern "C" {
#endif

#define	_RPC_NONE		0
#define	_RPC_NETPATH		1
#define	_RPC_VISIBLE		2
#define	_RPC_CIRCUIT_V		3
#define	_RPC_DATAGRAM_V		4
#define	_RPC_CIRCUIT_N		5
#define	_RPC_DATAGRAM_N		6
#define	_RPC_TCP		7
#define	_RPC_UDP		8
#define	_RPC_LOCAL		9
#define	_RPC_DOOR		10
#define	_RPC_DOOR_LOCAL		11
#define	_RPC_DOOR_NETPATH	12

#ifdef __STDC__
extern void *__rpc_setconf(char *);
extern void __rpc_endconf(void *);
extern struct netconfig *__rpc_getconf(void *);
extern struct netconfig *__rpc_getconfip(char *);
#else
extern void *__rpc_setconf();
extern void __rpc_endconf();
extern struct netconfig *__rpc_getconf();
extern struct netconfig *__rpc_getconfip();
#endif

#ifdef	__cplusplus
}
#endif

#endif	/* !_RPC_NETTYPE_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

#ifndef _RPC_PMAP_CLNT_H
#define	_RPC_PMAP_CLNT_H

/*
 * pmap_clnt.h
 * Supplies C routines to get to portmap services.
 */

#include <netinet/in.h>

#ifdef __STDC__
#include <rpc/clnt.h>
#endif

#ifdef __cplusplus
extern "C" {
#endif

/*
 * Usage:
 *	success = pmap_set(program, version, protocol, port);
 *	success = pmap_unset(program, version);
 *	port = pmap_getport(address, program, version, protocol);
 *	head = pmap_getmaps(address);
 *	clnt_stat = pmap_rmtcall(address, program, version, procedure,
 *		xdrargs, argsp, xdrres, resp, tout, port_ptr)
 *		(works for udp only.)
 * 	clnt_stat = clnt_broadcast(program, version, procedure,
 *		xdrargs, argsp,	xdrres, resp, eachresult)
 *		(like pmap_rmtcall, except the call is broadcasted to all
 *		locally connected nets.  For each valid response received,
 *		the procedure eachresult is called.  Its form is:
 *	done = eachresult(resp, raddr)
 *		bool_t done;
 *		caddr_t resp;
 *		struct sockaddr_in raddr;
 *		where resp points to the results of the call and raddr is the
 *		address if the responder to the broadcast.
 */

#ifdef __STDC__
extern bool_t pmap_set(rpcprog_t, rpcvers_t, rpcprot_t, unsigned short port);
extern bool_t pmap_unset(rpcprog_t, rpcvers_t);
extern struct pmaplist *pmap_getmaps(struct sockaddr_in *);
extern ushort_t pmap_getport(struct sockaddr_in *, rpcprog_t, rpcvers_t,
    rpcprot_t);
#ifndef _KERNEL
enum clnt_stat clnt_broadcast(rpcprog_t, rpcvers_t, rpcproc_t, xdrproc_t,
    char *, xdrproc_t, char *, resultproc_t);
enum clnt_stat pmap_rmtcall(struct sockaddr_in *, rpcprog_t, rpcvers_t,
    rpcproc_t, xdrproc_t, caddr_t, xdrproc_t, caddr_t, struct timeval,
    rpcport_t *);
#endif
#else
extern bool_t pmap_set();
extern bool_t pmap_unset();
extern struct pmaplist *pmap_getmaps();
extern ushort_t pmap_getport();
#ifndef _KERNEL
enum clnt_stat clnt_broadcast();
enum clnt_stat pmap_rmtcall();
#endif
#endif

#ifdef __cplusplus
}
#endif

#endif	/* _RPC_PMAP_CLNT_H */
/*
 * Please do not edit this file.
 * It was generated using rpcgen.
 */

#ifndef _PMAP_PROT_H_RPCGEN
#define	_PMAP_PROT_H_RPCGEN

#include <rpc/rpc.h>
#ifndef _KERNEL
#include <synch.h>
#include <thread.h>
#endif /* !_KERNEL */
/*
 * Copyright (c) 1984,1989 by Sun Microsystems, Inc.
 */
/* from pmap_prot.x */

#ifndef _KERNEL

/*
 * Protocol for the local binder service, or pmap.
 *
 * Copyright (C) 1984, Sun Microsystems, Inc.
 *
 * The following procedures are supported by the protocol:
 *
 * PMAPPROC_NULL() returns ()
 * 	takes nothing, returns nothing
 *
 * PMAPPROC_SET(struct pmap) returns (bool_t)
 * 	TRUE is success, FALSE is failure.  Registers the tuple
 *	[prog, vers, prot, port].
 *
 * PMAPPROC_UNSET(struct pmap) returns (bool_t)
 *	TRUE is success, FALSE is failure.  Un-registers pair
 *	[prog, vers].  prot and port are ignored.
 *
 * PMAPPROC_GETPORT(struct pmap) returns (rpcport_t).
 *	0 is failure.  Otherwise returns the port number where the pair
 *	[prog, vers] is registered.  It may lie!
 *
 * PMAPPROC_DUMP() RETURNS (struct pmaplist_ptr)
 *
 * PMAPPROC_CALLIT(unsigned, unsigned, unsigned, string<>)
 * 	RETURNS (port, string<>);
 * usage: encapsulatedresults = PMAPPROC_CALLIT(prog, vers, proc,
 *						encapsulatedargs);
 * 	Calls the procedure on the local machine.  If it is not registered,
 *	this procedure is quite; ie it does not return error information!!!
 *	This procedure only is supported on rpc/udp and calls via
 *	rpc/udp.  This routine only passes null authentication parameters.
 *	This file has no interface to xdr routines for PMAPPROC_CALLIT.
 *
 * The service supports remote procedure calls on udp/ip or tcp/ip socket 111.
 */

#define	PMAPPORT 111


/*
 * A mapping of (program, version, protocol) to port number
 */

struct pmap {
	rpcprog_t pm_prog;
	rpcvers_t pm_vers;
	rpcprot_t pm_prot;
	rpcport_t pm_port;
};
typedef struct pmap pmap;

typedef pmap PMAP;


/*
 * Supported values for the "prot" field
 */

#define	PMAP_IPPROTO_TCP 6
#define	PMAP_IPPROTO_UDP 17


/*
 * A list of mappings
 *
 * Below are two definitions for the pmaplist structure.  This is done because
 * xdr_pmaplist() is specified to take a struct pmaplist **, rather than a
 * struct pmaplist * that rpcgen would produce.  One version of the pmaplist
 * structure (actually called pm__list) is used with rpcgen, and the other is
 * defined only in the header file for compatibility with the specified
 * interface.
 */

struct pm__list {
	pmap pml_map;
	struct pm__list *pml_next;
};
typedef struct pm__list pm__list;

typedef pm__list *pmaplist_ptr;

struct pmaplist {
 PMAP pml_map;
 struct pmaplist *pml_next;
};

typedef struct pmaplist pmaplist;
typedef struct pmaplist PMAPLIST;

#ifdef __cplusplus
extern "C" {
#endif
#if 1
extern bool_t xdr_pmaplist(XDR *, pmaplist**);
#else /* K&R C */
bool_t xdr_pmaplist();
#endif
#ifdef __cplusplus
}
#endif


/*
 * Arguments to callit
 */

struct rmtcallargs {
	rpcprog_t prog;
	rpcvers_t vers;
	rpcproc_t proc;
	struct {
		u_int args_len;
		char *args_val;
	} args;
};
typedef struct rmtcallargs rmtcallargs;

/*
 * Client-side only representation of rmtcallargs structure.
 *
 * The routine that XDRs the rmtcallargs structure must deal with the
 * opaque arguments in the "args" structure.  xdr_rmtcall_args() needs to be
 * passed the XDR routine that knows the args' structure.  This routine
 * doesn't need to go over-the-wire (and it wouldn't make sense anyway) since
 * the application being called knows the args structure already.  So we use a
 * different "XDR" structure on the client side, p_rmtcallargs, which includes
 * the args' XDR routine.
 */
struct p_rmtcallargs {
 rpcprog_t prog;
 rpcvers_t vers;
 rpcproc_t proc;
 struct {
 u_int args_len;
 char *args_val;
 } args;
 xdrproc_t xdr_args; /* encodes args */
};



/*
 * Results of callit
 */

struct rmtcallres {
	rpcport_t port;
	struct {
		u_int res_len;
		char *res_val;
	} res;
};
typedef struct rmtcallres rmtcallres;

/*
 * Client-side only representation of rmtcallres structure.
 */
struct p_rmtcallres {
 rpcport_t port;
 struct {
 u_int res_len;
 char *res_val;
 } res;
 xdrproc_t xdr_res; /* decodes res */
};


#define PMAPVERS_PROTO ((rpcvers_t)2)
#define PMAPVERS_ORIG ((rpcvers_t)1)

#else /* ndef _KERNEL */

#include <rpc/pmap_rmt.h>

#ifdef __cplusplus
extern "C" {
#endif

#define PMAPPORT 111

struct pmap {
 rpcprog_t pm_prog;
 rpcvers_t pm_vers;
 rpcprot_t pm_prot;
 rpcport_t pm_port;
};
typedef struct pmap PMAP;
#if 1
extern bool_t xdr_pmap (XDR *, struct pmap *);
#else
extern bool_t xdr_pmap ();
#endif

struct pmaplist {
 struct pmap pml_map;
 struct pmaplist *pml_next;
};
typedef struct pmaplist PMAPLIST;
typedef struct pmaplist *pmaplist_ptr;


#ifdef __cplusplus
}
#endif

#endif /* ndef _KERNEL */

#define	PMAPPROG	100000
#define	PMAPVERS	2
#define	PMAPPROC_NULL	0
extern  enum clnt_stat pmapproc_null_2();
extern  bool_t pmapproc_null_2_svc();
#define	PMAPPROC_SET	1
extern  enum clnt_stat pmapproc_set_2();
extern  bool_t pmapproc_set_2_svc();
#define	PMAPPROC_UNSET	2
extern  enum clnt_stat pmapproc_unset_2();
extern  bool_t pmapproc_unset_2_svc();
#define	PMAPPROC_GETPORT	3
extern  enum clnt_stat pmapproc_getport_2();
extern  bool_t pmapproc_getport_2_svc();
#define	PMAPPROC_DUMP	4
extern  enum clnt_stat pmapproc_dump_2();
extern  bool_t pmapproc_dump_2_svc();
#define	PMAPPROC_CALLIT	5
extern  enum clnt_stat pmapproc_callit_2();
extern  bool_t pmapproc_callit_2_svc();
extern int pmapprog_2_freeresult();

/* the xdr functions */
extern bool_t xdr_pmap();
extern bool_t xdr_pm__list();
extern bool_t xdr_pmaplist_ptr();
extern bool_t xdr_rmtcallargs();
extern bool_t xdr_rmtcallres();

#endif /* !_PMAP_PROT_H_RPCGEN */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
%/*
% * Copyright (c) 1984,1989 by Sun Microsystems, Inc.
% */

%/* from pmap_prot.x */

#ifdef RPC_HDR
%
%#ifndef _KERNEL
%
#endif

/*
 * Port Mapper Protocol Specification (in RPC Language)
 * derived from RFC 1057
 */

%/*
% * Protocol for the local binder service, or pmap.
% *
% * Copyright (C) 1984, Sun Microsystems, Inc.
% *
% * The following procedures are supported by the protocol:
% *
% * PMAPPROC_NULL() returns ()
% * 	takes nothing, returns nothing
% *
% * PMAPPROC_SET(struct pmap) returns (bool_t)
% * 	TRUE is success, FALSE is failure.  Registers the tuple
% *	[prog, vers, prot, port].
% *
% * PMAPPROC_UNSET(struct pmap) returns (bool_t)
% *	TRUE is success, FALSE is failure.  Un-registers pair
% *	[prog, vers].  prot and port are ignored.
% *
% * PMAPPROC_GETPORT(struct pmap) returns (rpcport_t).
% *	0 is failure.  Otherwise returns the port number where the pair
% *	[prog, vers] is registered.  It may lie!
% *
% * PMAPPROC_DUMP() RETURNS (struct pmaplist_ptr)
% *
% * PMAPPROC_CALLIT(unsigned, unsigned, unsigned, string<>)
% * 	RETURNS (port, string<>);
% * usage: encapsulatedresults = PMAPPROC_CALLIT(prog, vers, proc,
% *						encapsulatedargs);
% * 	Calls the procedure on the local machine.  If it is not registered,
% *	this procedure is quite; ie it does not return error information!!!
% *	This procedure only is supported on rpc/udp and calls via
% *	rpc/udp.  This routine only passes null authentication parameters.
% *	This file has no interface to xdr routines for PMAPPROC_CALLIT.
% *
% * The service supports remote procedure calls on udp/ip or tcp/ip socket 111.
% */
%
const PMAPPORT = 111;	/* portmapper port number */
%
%
%/*
% * A mapping of (program, version, protocol) to port number
% */

struct pmap {
	rpcprog_t pm_prog;
	rpcvers_t pm_vers;
	rpcprot_t pm_prot;
	rpcport_t pm_port;
};
#ifdef RPC_HDR
%
%typedef pmap PMAP;
%
#endif
%
%/*
% * Supported values for the "prot" field
% */
%
const PMAP_IPPROTO_TCP = 6;	/* protocol number for TCP/IP */
const PMAP_IPPROTO_UDP = 17;	/* protocol number for UDP/IP */
%
%
%/*
% * A list of mappings
% *
% * Below are two definitions for the pmaplist structure.  This is done because
% * xdr_pmaplist() is specified to take a struct pmaplist **, rather than a
% * struct pmaplist * that rpcgen would produce.  One version of the pmaplist
% * structure (actually called pm__list) is used with rpcgen, and the other is
% * defined only in the header file for compatibility with the specified
% * interface.
% */

struct pm__list {
	pmap pml_map;
	struct pm__list *pml_next;
};

typedef pm__list *pmaplist_ptr;		/* results of PMAPPROC_DUMP */

#ifdef RPC_HDR
%
%struct pmaplist {
%	PMAP pml_map;
%	struct pmaplist *pml_next;
%};
%
%typedef struct pmaplist pmaplist;
%typedef struct pmaplist PMAPLIST;
%
%#ifdef __cplusplus
%extern "C" {
%#endif
%#ifdef __STDC__
%extern  bool_t xdr_pmaplist(XDR *, pmaplist**);
%#else /* K&R C */
%bool_t xdr_pmaplist();
%#endif
%#ifdef	__cplusplus
%}
%#endif
%
#endif

%
%/*
% * Arguments to callit
% */

struct rmtcallargs {
	rpcprog_t prog;
	rpcvers_t vers;
	rpcproc_t proc;
	opaque args<>;
};
#ifdef RPC_HDR
%
%/*
% * Client-side only representation of rmtcallargs structure.
% *
% * The routine that XDRs the rmtcallargs structure must deal with the
% * opaque arguments in the "args" structure.  xdr_rmtcall_args() needs to be
% * passed the XDR routine that knows the args' structure.  This routine
% * doesn't need to go over-the-wire (and it wouldn't make sense anyway) since
% * the application being called knows the args structure already.  So we use a
% * different "XDR" structure on the client side, p_rmtcallargs, which includes
% * the args' XDR routine.
% */
%struct p_rmtcallargs {
%	rpcprog_t prog;
%	rpcvers_t vers;
%	rpcproc_t proc;
%	struct {
%		u_int args_len;
%		char *args_val;
%	} args;
%	xdrproc_t	xdr_args;	/* encodes args */
%};
%
#endif	/* def RPC_HDR */
%
%
%/*
% * Results of callit
% */

struct rmtcallres {
	rpcport_t port;
	opaque res<>;
};
#ifdef RPC_HDR
%
%/*
% * Client-side only representation of rmtcallres structure.
% */
%struct p_rmtcallres {
%	rpcport_t port;
%	struct {
%		u_int res_len;
%		char *res_val;
%	} res;
%	xdrproc_t	xdr_res;	/* decodes res */
%};
%
#endif	/* def RPC_HDR */

/*
 * Port mapper procedures
 */

program PMAPPROG {
   version PMAPVERS {
	void
	PMAPPROC_NULL(void)	= 0;

	bool
	PMAPPROC_SET(pmap)	= 1;

	bool
	PMAPPROC_UNSET(pmap)	= 2;

	rpcport_t
	PMAPPROC_GETPORT(pmap)	= 3;

	pmaplist_ptr
	PMAPPROC_DUMP(void)	= 4;

	rmtcallres
	PMAPPROC_CALLIT(rmtcallargs)  = 5;
   } = 2;
} = 100000;
%
#ifdef RPC_HDR
%#define	PMAPVERS_PROTO		((rpcvers_t)2)
%#define	PMAPVERS_ORIG		((rpcvers_t)1)
%
%#else		/* ndef _KERNEL */
%
%#include <rpc/pmap_rmt.h>
%
%#ifdef __cplusplus
%extern "C" {
%#endif
%
%#define	PMAPPORT 111
%
%struct pmap {
%	rpcprog_t pm_prog;
%	rpcvers_t pm_vers;
%	rpcprot_t pm_prot;
%	rpcport_t pm_port;
%};
%typedef struct pmap PMAP;
%#ifdef __STDC__
%extern bool_t xdr_pmap (XDR *, struct pmap *);
%#else
%extern bool_t xdr_pmap ();
%#endif
%
%struct pmaplist {
%	struct pmap pml_map;
%	struct pmaplist *pml_next;
%};
%typedef struct pmaplist PMAPLIST;
%typedef struct pmaplist *pmaplist_ptr;
%
%
%#ifdef __cplusplus
%}
%#endif
%
%#endif		/* ndef _KERNEL */
#endif

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

#ifndef _RPC_PMAP_RMT_H
#define	_RPC_PMAP_RMT_H

#ifndef _KERNEL

#include <rpc/pmap_prot.h>

#else	/* ndef _KERNEL */

#ifdef __cplusplus
extern "C" {
#endif

/*
 * Structures and XDR routines for parameters to and replies from
 * the portmapper remote-call-service.
 */

struct rmtcallargs {
	rpcprog_t prog;
	rpcvers_t vers;
	rpcproc_t proc;
	unsigned int arglen;
	caddr_t	  args_ptr;
	xdrproc_t xdr_args;
};

#ifdef __STDC__
bool_t xdr_rmtcall_args(XDR *, struct rmtcallargs *);
#else
bool_t xdr_rmtcall_args();
#endif

struct rmtcallres {
	rpcport_t *port_ptr;
	uint_t resultslen;
	caddr_t results_ptr;
	xdrproc_t xdr_results;
};
typedef struct rmtcallres rmtcallres;
#ifdef __STDC__
bool_t xdr_rmtcall_args(XDR *, struct rmtcallargs *);
#else
bool_t xdr_rmtcall_args();
#endif

#ifdef __cplusplus
}
#endif

#endif	/* ndef _KERNEL */

#endif	/* _RPC_PMAP_RMT_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Copyright (c) 2008, The Ohio State University. All rights reserved.
 *
 * Portions of this source code is developed by the team members of
 * The Ohio State University's Network-Based Computing Laboratory (NBCL),
 * headed by Professor Dhabaleswar K. (DK) Panda.
 *
 * Acknowledgements to contributions from developors:
 *   Ranjit Noronha: noronha@cse.ohio-state.edu
 *   Lei Chai      : chail@cse.ohio-state.edu
 *   Weikuan Yu    : yuw@cse.ohio-state.edu
 *
 */

#include <sys/systm.h>
#include <sys/kstat.h>
#include <sys/modctl.h>
#include <sys/sdt.h>
#include <rpc/rpc_rdma.h>

/* Hammerhead: IB subsystem removed — stub ibt_hw_is_present() as always-false */
#define	ibt_hw_is_present()	(0)

uint_t rdma_minchunk = RDMA_MINCHUNK;

/*
 * Globals
 */
int rdma_modloaded = 0;		/* flag to load RDMA plugin modules */
int rdma_dev_available = 0;	/* if any RDMA device is loaded */
kmutex_t rdma_modload_lock;	/* protects rdma_modloaded flag */

rdma_svc_wait_t rdma_wait;

rdma_registry_t	*rdma_mod_head = NULL;	/* head for RDMA modules */
krwlock_t	rdma_lock;		/* protects rdma_mod_head list */
ldi_ident_t rpcmod_li = NULL;	/* identifies us with ldi_ framework */

kmem_cache_t *clist_cache = NULL;

/*
 * Statics
 */
ldi_handle_t rpcib_handle = NULL;

/*
 * Externs
 */
extern	kstat_named_t	*rdmarcstat_ptr;
extern	uint_t		rdmarcstat_ndata;
extern	kstat_named_t	*rdmarsstat_ptr;
extern	uint_t		rdmarsstat_ndata;

void rdma_kstat_init();

/*
 * RDMATF module registration routine.
 * This routine is expected to be called by the init routine in
 * the plugin modules.
 */
rdma_stat
rdma_register_mod(rdma_mod_t *mod)
{
	rdma_registry_t **mp, *m;

	if (mod->rdma_version != RDMATF_VERS) {
		return (RDMA_BADVERS);
	}

	rw_enter(&rdma_lock, RW_WRITER);
	/*
	 * Ensure not already registered
	 */
	mp = &rdma_mod_head;
	while (*mp != NULL) {
		if (strncmp((*mp)->r_mod->rdma_api, mod->rdma_api,
		    KNC_STRSIZE) == 0) {
			if ((*mp)->r_mod_state == RDMA_MOD_INACTIVE) {
				(*mp)->r_mod_state = RDMA_MOD_ACTIVE;
				(*mp)->r_mod->rdma_ops = mod->rdma_ops;
				(*mp)->r_mod->rdma_count = mod->rdma_count;
				goto announce_hca;
			}
			rw_exit(&rdma_lock);
			return (RDMA_REG_EXIST);
		}
		mp = &((*mp)->r_next);
	}

	/*
	 * New one, create and add to registry
	 */
	m = kmem_alloc(sizeof (rdma_registry_t), KM_SLEEP);
	m->r_mod = kmem_alloc(sizeof (rdma_mod_t), KM_SLEEP);
	*m->r_mod = *mod;
	m->r_next = NULL;
	m->r_mod->rdma_api = kmem_zalloc(KNC_STRSIZE, KM_SLEEP);
	(void) strncpy(m->r_mod->rdma_api, mod->rdma_api, KNC_STRSIZE);
	m->r_mod->rdma_api[KNC_STRSIZE - 1] = '\0';
	m->r_mod_state = RDMA_MOD_ACTIVE;
	*mp = m;

announce_hca:
	rw_exit(&rdma_lock);
	/*
	 * Start the nfs service on the rdma xprts.
	 * (this notification mechanism will need to change when we support
	 * multiple hcas and have support for multiple rdma plugins).
	 */
	mutex_enter(&rdma_wait.svc_lock);
	rdma_wait.svc_stat = RDMA_HCA_ATTACH;
	cv_signal(&rdma_wait.svc_cv);
	mutex_exit(&rdma_wait.svc_lock);

	return (RDMA_SUCCESS);
}

/*
 * RDMATF module unregistration routine.
 * This routine is expected to be called by the fini routine in
 * the plugin modules.
 */
rdma_stat
rdma_unregister_mod(rdma_mod_t *mod)
{
	rdma_registry_t **m, *mmod = NULL;

	rw_enter(&rdma_lock, RW_WRITER);

	m = &rdma_mod_head;
	while (*m != NULL) {
		if (strncmp((*m)->r_mod->rdma_api, mod->rdma_api,
		    KNC_STRSIZE) != 0) {
			m = &((*m)->r_next);
			continue;
		}
		/*
		 * Check if any device attached, if so return error
		 */
		if (mod->rdma_count != 0) {
			rw_exit(&rdma_lock);
			return (RDMA_FAILED);
		}
		/*
		 * Found entry. Mark it inactive.
		 */
		mmod = *m;
		mmod->r_mod->rdma_count = 0;
		mmod->r_mod_state = RDMA_MOD_INACTIVE;
		break;
	}

	rdma_modloaded = 0;
	rdma_dev_available = 0;
	rw_exit(&rdma_lock);

	/*
	 * Stop the nfs service running on the rdma xprts.
	 * (this notification mechanism will need to change when we support
	 * multiple hcas and have support for multiple rdma plugins).
	 */
	mutex_enter(&rdma_wait.svc_lock);
	rdma_wait.svc_stat = RDMA_HCA_DETACH;
	cv_signal(&rdma_wait.svc_cv);
	mutex_exit(&rdma_wait.svc_lock);

	/*
	 * Not found.
	 */
	return (RDMA_SUCCESS);
}

struct clist *
clist_alloc(void)
{
	struct clist *clp;

	clp = kmem_cache_alloc(clist_cache, KM_SLEEP);

	bzero(clp, sizeof (*clp));

	return (clp);
}

uint32_t
clist_len(struct clist *cl)
{
	uint32_t len = 0;
	while (cl) {
		len += cl->c_len;
		cl = cl->c_next;
	}
	return (len);
}

void
clist_zero_len(struct clist *cl)
{
	while (cl != NULL) {
		if (cl->c_dmemhandle.mrc_rmr == 0)
			break;
		cl->c_len = 0;
		cl = cl->c_next;
	}
}

/*
 * Creates a new chunk list entry, and
 * adds it to the end of a chunk list.
 */
void
clist_add(struct clist **clp, uint32_t xdroff, int len,
    struct mrc *shandle, caddr_t saddr,
    struct mrc *dhandle, caddr_t daddr)
{
	struct clist *cl;

	/* Find the end of the list */

	while (*clp != NULL)
		clp = &((*clp)->c_next);

	cl = clist_alloc();
	cl->c_xdroff = xdroff;
	cl->c_len = len;
	cl->w.c_saddr = (uint64_t)(uintptr_t)saddr;
	if (shandle)
		cl->c_smemhandle = *shandle;
	cl->u.c_daddr = (uint64_t)(uintptr_t)daddr;
	if (dhandle)
		cl->c_dmemhandle = *dhandle;
	cl->c_next = NULL;

	*clp = cl;
}

rdma_stat
clist_register(CONN *conn, struct clist *cl, clist_dstsrc dstsrc)
{
	struct clist *c;
	int status;

	for (c = cl; c; c = c->c_next) {
		if (c->c_len <= 0)
			continue;

		c->c_regtype = dstsrc;

		switch (dstsrc) {
		case CLIST_REG_SOURCE:
			status = RDMA_REGMEMSYNC(conn,
			    (caddr_t)(struct as *)c->c_adspc,
			    (caddr_t)(uintptr_t)c->w.c_saddr3, c->c_len,
			    &c->c_smemhandle, (void **)&c->c_ssynchandle,
			    (void *)c->rb_longbuf.rb_private);
			break;
		case CLIST_REG_DST:
			status = RDMA_REGMEMSYNC(conn,
			    (caddr_t)(struct as *)c->c_adspc,
			    (caddr_t)(uintptr_t)c->u.c_daddr3, c->c_len,
			    &c->c_dmemhandle, (void **)&c->c_dsynchandle,
			    (void *)c->rb_longbuf.rb_private);
			break;
		default:
			return (RDMA_INVAL);
		}
		if (status != RDMA_SUCCESS) {
			(void) clist_deregister(conn, cl);
			return (status);
		}
	}

	return (RDMA_SUCCESS);
}

rdma_stat
clist_deregister(CONN *conn, struct clist *cl)
{
	struct clist *c;

	for (c = cl; c; c = c->c_next) {
		switch (c->c_regtype) {
		case CLIST_REG_SOURCE:
			if (c->c_smemhandle.mrc_rmr != 0) {
				(void) RDMA_DEREGMEMSYNC(conn,
				    (caddr_t)(uintptr_t)c->w.c_saddr3,
				    c->c_smemhandle,
				    (void *)(uintptr_t)c->c_ssynchandle,
				    (void *)c->rb_longbuf.rb_private);
				c->c_smemhandle.mrc_rmr = 0;
				c->c_ssynchandle = 0;
			}
			break;
		case CLIST_REG_DST:
			if (c->c_dmemhandle.mrc_rmr != 0) {
				(void) RDMA_DEREGMEMSYNC(conn,
				    (caddr_t)(uintptr_t)c->u.c_daddr3,
				    c->c_dmemhandle,
				    (void *)(uintptr_t)c->c_dsynchandle,
				    (void *)c->rb_longbuf.rb_private);
				c->c_dmemhandle.mrc_rmr = 0;
				c->c_dsynchandle = 0;
			}
			break;
		default:
			/* clist unregistered. continue */
			break;
		}
	}

	return (RDMA_SUCCESS);
}

rdma_stat
clist_syncmem(CONN *conn, struct clist *cl, clist_dstsrc dstsrc)
{
	struct clist *c;
	rdma_stat status;

	c = cl;
	switch (dstsrc) {
	case CLIST_REG_SOURCE:
		while (c != NULL) {
			if (c->c_ssynchandle) {
				status = RDMA_SYNCMEM(conn,
				    (void *)(uintptr_t)c->c_ssynchandle,
				    (caddr_t)(uintptr_t)c->w.c_saddr3,
				    c->c_len, 0);
				if (status != RDMA_SUCCESS)
					return (status);
			}
			c = c->c_next;
		}
		break;
	case CLIST_REG_DST:
		while (c != NULL) {
			if (c->c_ssynchandle) {
				status = RDMA_SYNCMEM(conn,
				    (void *)(uintptr_t)c->c_dsynchandle,
				    (caddr_t)(uintptr_t)c->u.c_daddr3,
				    c->c_len, 1);
				if (status != RDMA_SUCCESS)
					return (status);
			}
			c = c->c_next;
		}
		break;
	default:
		return (RDMA_INVAL);
	}

	return (RDMA_SUCCESS);
}

/*
 * Frees up entries in chunk list
 */
void
clist_free(struct clist *cl)
{
	struct clist *c = cl;

	while (c != NULL) {
		cl = cl->c_next;
		kmem_cache_free(clist_cache, c);
		c = cl;
	}
}

rdma_stat
rdma_clnt_postrecv(CONN *conn, uint32_t xid)
{
	struct clist *cl = NULL;
	rdma_stat retval;
	rdma_buf_t rbuf = {0};

	rbuf.type = RECV_BUFFER;
	if (RDMA_BUF_ALLOC(conn, &rbuf)) {
		return (RDMA_NORESOURCE);
	}

	clist_add(&cl, 0, rbuf.len, &rbuf.handle, rbuf.addr,
	    NULL, NULL);
	retval = RDMA_CLNT_RECVBUF(conn, cl, xid);
	clist_free(cl);

	return (retval);
}

rdma_stat
rdma_clnt_postrecv_remove(CONN *conn, uint32_t xid)
{
	return (RDMA_CLNT_RECVBUF_REMOVE(conn, xid));
}

rdma_stat
rdma_svc_postrecv(CONN *conn)
{
	struct clist *cl = NULL;
	rdma_stat retval;
	rdma_buf_t rbuf = {0};

	rbuf.type = RECV_BUFFER;
	if (RDMA_BUF_ALLOC(conn, &rbuf)) {
		retval = RDMA_NORESOURCE;
	} else {
		clist_add(&cl, 0, rbuf.len, &rbuf.handle, rbuf.addr,
		    NULL, NULL);
		retval = RDMA_SVC_RECVBUF(conn, cl);
		clist_free(cl);
	}
	return (retval);
}

rdma_stat
rdma_buf_alloc(CONN *conn, rdma_buf_t *rbuf)
{
	return (RDMA_BUF_ALLOC(conn, rbuf));
}

void
rdma_buf_free(CONN *conn, rdma_buf_t *rbuf)
{
	if (!rbuf || rbuf->addr == NULL) {
		return;
	}
	RDMA_BUF_FREE(conn, rbuf);
	bzero(rbuf, sizeof (rdma_buf_t));
}

/*
 * Caller is holding rdma_modload_lock mutex
 */
int
rdma_modload()
{
	int status;
	ASSERT(MUTEX_HELD(&rdma_modload_lock));
	/*
	 * Load all available RDMA plugins which right now is only IB plugin.
	 * If no IB hardware is present, then quit right away.
	 * ENODEV -- For no device on the system
	 * EPROTONOSUPPORT -- For module not avilable either due to failure to
	 * load or some other reason.
	 */
	rdma_modloaded = 1;
	if (ibt_hw_is_present() == 0) {
		rdma_dev_available = 0;
		return (ENODEV);
	}

	rdma_dev_available = 1;
	if (rpcmod_li == NULL)
		return (EPROTONOSUPPORT);

	status = ldi_open_by_name("/devices/ib/rpcib@0:rpcib",
	    FREAD | FWRITE, kcred,
	    &rpcib_handle, rpcmod_li);

	if (status != 0)
		return (EPROTONOSUPPORT);


	/*
	 * We will need to reload the plugin module after it was unregistered
	 * but the resources below need to allocated only the first time.
	 */
	if (!clist_cache) {
		clist_cache = kmem_cache_create("rdma_clist",
		    sizeof (struct clist), _POINTER_ALIGNMENT, NULL,
		    NULL, NULL, NULL, 0, 0);
		rdma_kstat_init();
	}

	(void) ldi_close(rpcib_handle, FREAD|FWRITE, kcred);

	return (0);
}

void
rdma_kstat_init(void)
{
	kstat_t *ksp;

	/*
	 * The RDMA framework doesn't know how to deal with Zones, and is
	 * only available in the global zone.
	 */
	ASSERT(INGLOBALZONE(curproc));
	ksp = kstat_create_zone("unix", 0, "rpc_rdma_client", "rpc",
	    KSTAT_TYPE_NAMED, rdmarcstat_ndata,
	    KSTAT_FLAG_VIRTUAL | KSTAT_FLAG_WRITABLE, GLOBAL_ZONEID);
	if (ksp) {
		ksp->ks_data = (void *) rdmarcstat_ptr;
		kstat_install(ksp);
	}

	ksp = kstat_create_zone("unix", 0, "rpc_rdma_server", "rpc",
	    KSTAT_TYPE_NAMED, rdmarsstat_ndata,
	    KSTAT_FLAG_VIRTUAL | KSTAT_FLAG_WRITABLE, GLOBAL_ZONEID);
	if (ksp) {
		ksp->ks_data = (void *) rdmarsstat_ptr;
		kstat_install(ksp);
	}
}

rdma_stat
rdma_kwait(void)
{
	int ret;
	rdma_stat stat;

	mutex_enter(&rdma_wait.svc_lock);

	ret = cv_wait_sig(&rdma_wait.svc_cv, &rdma_wait.svc_lock);

	/*
	 * If signalled by a hca attach/detach, pass the right
	 * stat back.
	 */

	if (ret)
		stat =  rdma_wait.svc_stat;
	else
		stat = RDMA_INTR;

	mutex_exit(&rdma_wait.svc_lock);

	return (stat);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

/*
 * rpc.h, Just includes the billions of rpc header files necessary to
 * do remote procedure calling.
 *
 */

#ifndef _RPC_RPC_H
#define	_RPC_RPC_H

#include <rpc/types.h>		/* some typedefs */

#ifndef _KERNEL
#include <tiuser.h>
#include <fcntl.h>
#include <memory.h>
#else
#include <sys/tiuser.h>
#include <sys/fcntl.h>
#include <netinet/in.h>
#include <sys/t_kuser.h>
#endif

#include <rpc/xdr.h>		/* generic (de)serializer */
#include <rpc/auth.h>		/* generic authenticator (client side) */
#include <rpc/clnt.h>		/* generic client side rpc */

#include <rpc/rpc_msg.h>	/* protocol for rpc messages */
#include <rpc/auth_sys.h>	/* protocol for unix style cred */
#include <rpc/auth_des.h>	/* protocol for des style cred */
#include <sys/socket.h>		/* generic socket info */
#include <rpc/rpcsec_gss.h>	/* GSS style security */

#include <rpc/svc.h>		/* service manager and multiplexer */
#include <rpc/svc_auth.h>	/* service side authenticator */

#ifndef _KERNEL
#ifndef _RPCB_PROT_H_RPCGEN	/* Don't include before rpcb_prot defined */
#include <rpc/rpcb_clnt.h>	/* rpcbind interface functions */
#endif
#include <rpc/svc_mt.h>		/* private server definitions */
#endif

#endif	/* !_RPC_RPC_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved  	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

/*
 * rpc_calmsg.c
 */

#include <sys/param.h>
#include <sys/types.h>
#include <sys/t_lock.h>
#include <sys/systm.h>

#include <rpc/types.h>
#include <rpc/xdr.h>
#include <rpc/auth.h>
#include <rpc/clnt.h>
#include <rpc/rpc_msg.h>

/*
 * XDR a call message
 */
bool_t
xdr_callmsg(XDR *xdrs, struct rpc_msg *cmsg)
{
	rpc_inline_t *buf;
	struct opaque_auth *oa;

	if (xdrs->x_op == XDR_ENCODE) {
		uint_t credrndup;
		uint_t verfrndup;

		if (cmsg->rm_call.cb_cred.oa_length > MAX_AUTH_BYTES)
			return (FALSE);
		if (cmsg->rm_call.cb_verf.oa_length > MAX_AUTH_BYTES)
			return (FALSE);
		credrndup = RNDUP(cmsg->rm_call.cb_cred.oa_length);
		verfrndup = RNDUP(cmsg->rm_call.cb_verf.oa_length);
		buf = XDR_INLINE(xdrs, 8 * BYTES_PER_XDR_UNIT +
		    credrndup + 2 * BYTES_PER_XDR_UNIT + verfrndup);
		if (buf != NULL) {
			IXDR_PUT_INT32(buf, cmsg->rm_xid);
			IXDR_PUT_ENUM(buf, cmsg->rm_direction);
			if (cmsg->rm_direction != CALL)
				return (FALSE);
			IXDR_PUT_INT32(buf, cmsg->rm_call.cb_rpcvers);
			if (cmsg->rm_call.cb_rpcvers != RPC_MSG_VERSION)
				return (FALSE);
			IXDR_PUT_INT32(buf, cmsg->rm_call.cb_prog);
			IXDR_PUT_INT32(buf, cmsg->rm_call.cb_vers);
			IXDR_PUT_INT32(buf, cmsg->rm_call.cb_proc);
			oa = &cmsg->rm_call.cb_cred;
			IXDR_PUT_ENUM(buf, oa->oa_flavor);
			IXDR_PUT_INT32(buf, oa->oa_length);
			if (oa->oa_length) {
				bcopy(oa->oa_base, buf, oa->oa_length);
				buf += credrndup / BYTES_PER_XDR_UNIT;
				if ((credrndup -= oa->oa_length) > 0)
					bzero((char *)buf - credrndup,
					    credrndup);
			}
			oa = &cmsg->rm_call.cb_verf;
			IXDR_PUT_ENUM(buf, oa->oa_flavor);
			IXDR_PUT_INT32(buf, oa->oa_length);
			if (oa->oa_length) {
				bcopy(oa->oa_base, buf, oa->oa_length);
				buf += verfrndup / BYTES_PER_XDR_UNIT;
				if ((verfrndup -= oa->oa_length) > 0)
					bzero((char *)buf - verfrndup,
					    verfrndup);
			}
			return (TRUE);
		}
	}
	if (xdrs->x_op == XDR_DECODE) {
		buf = XDR_INLINE(xdrs, 8 * BYTES_PER_XDR_UNIT);
		if (buf != NULL) {
			cmsg->rm_xid = IXDR_GET_INT32(buf);
			cmsg->rm_direction = IXDR_GET_ENUM(buf, enum msg_type);
			if (cmsg->rm_direction != CALL)
				return (FALSE);
			cmsg->rm_call.cb_rpcvers = IXDR_GET_INT32(buf);
			if (cmsg->rm_call.cb_rpcvers != RPC_MSG_VERSION)
				return (FALSE);
			cmsg->rm_call.cb_prog = IXDR_GET_INT32(buf);
			cmsg->rm_call.cb_vers = IXDR_GET_INT32(buf);
			cmsg->rm_call.cb_proc = IXDR_GET_INT32(buf);
			oa = &cmsg->rm_call.cb_cred;
			oa->oa_flavor = IXDR_GET_ENUM(buf, enum_t);
			oa->oa_length = IXDR_GET_INT32(buf);
			if (oa->oa_length) {
				if (oa->oa_length > MAX_AUTH_BYTES)
					return (FALSE);
				if (oa->oa_base == NULL)
					oa->oa_base = (caddr_t)
					    mem_alloc(oa->oa_length);
				buf = XDR_INLINE(xdrs, RNDUP(oa->oa_length));
				if (buf == NULL) {
					if (xdr_opaque(xdrs, oa->oa_base,
					    oa->oa_length) == FALSE)
						return (FALSE);
				} else {
					bcopy(buf, oa->oa_base, oa->oa_length);
				}
			}
			oa = &cmsg->rm_call.cb_verf;
			buf = XDR_INLINE(xdrs, 2 * BYTES_PER_XDR_UNIT);
			if (buf == NULL) {
				if (xdr_enum(xdrs, &oa->oa_flavor) == FALSE ||
				    xdr_u_int(xdrs, &oa->oa_length) == FALSE)
					return (FALSE);
			} else {
				oa->oa_flavor = IXDR_GET_ENUM(buf, enum_t);
				oa->oa_length = IXDR_GET_INT32(buf);
			}
			if (oa->oa_length) {
				if (oa->oa_length > MAX_AUTH_BYTES)
					return (FALSE);
				if (oa->oa_base == NULL)
					oa->oa_base = (caddr_t)
					    mem_alloc(oa->oa_length);
				buf = XDR_INLINE(xdrs, RNDUP(oa->oa_length));
				if (buf == NULL) {
					if (xdr_opaque(xdrs, oa->oa_base,
					    oa->oa_length) == FALSE)
						return (FALSE);
				} else {
					bcopy(buf, oa->oa_base, oa->oa_length);
				}
			}
			return (TRUE);
		}
	}

	if (xdr_u_int(xdrs, &(cmsg->rm_xid)) &&
	    xdr_enum(xdrs, (enum_t *)&(cmsg->rm_direction)) &&
	    cmsg->rm_direction == CALL &&
	    xdr_rpcvers(xdrs, &(cmsg->rm_call.cb_rpcvers)) &&
	    cmsg->rm_call.cb_rpcvers == RPC_MSG_VERSION &&
	    xdr_rpcprog(xdrs, &(cmsg->rm_call.cb_prog)) &&
	    xdr_rpcvers(xdrs, &(cmsg->rm_call.cb_vers)) &&
	    xdr_rpcproc(xdrs, &(cmsg->rm_call.cb_proc)) &&
	    xdr_opaque_auth(xdrs, &(cmsg->rm_call.cb_cred)))
		return (xdr_opaque_auth(xdrs, &(cmsg->rm_call.cb_verf)));

	return (FALSE);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/*
 * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

/*
 * rpc_com.h, Common definitions for both the server and client side.
 * All for the topmost layer of rpc
 *
 */

#ifndef _RPC_RPC_COM_H
#define	_RPC_RPC_COM_H

#include <sys/types.h>
#include <rpc/types.h>

#ifdef __cplusplus
extern "C" {
#endif

/*
 * File descriptor to be used on xxx_create calls to get default descriptor
 */
#define	RPC_ANYSOCK	-1
#define	RPC_ANYFD	RPC_ANYSOCK
/*
 * The max size of the transport, if the size cannot be determined
 * by other means.
 */
#define	RPC_MAXDATASIZE 9000
#define	RPC_MAXADDRSIZE 1024

/*
 * Maximum size of universal address for INET/INET6 addressing.
 * Computed as INET6_ADDRSTRLEN + (strlen(".255.255") for port)
 */
#define	RPC_INET6_MAXUADDRSIZE 54

/*
 * The type of user of the STREAMS module rpcmod.
 */
#define	RPC_CLIENT	1
#define	RPC_SERVER	2
#define	RPC_TEST	3

#ifdef __STDC__
extern uint_t __rpc_get_t_size(t_scalar_t, t_scalar_t);
extern uint_t __rpc_get_a_size(t_scalar_t);
extern int __rpc_dtbsize(void);
extern struct netconfig *__rpcfd_to_nconf(int, int);
extern int __rpc_matchserv(int, unsigned int);
extern  int  __rpc_get_default_domain(char **);
extern int __rpc_tli_set_options(int, int, int, int); /* internal use only */
#else
extern uint_t __rpc_get_t_size();
extern uint_t __rpc_get_a_size();
extern int __rpc_dtbsize();
extern struct netconfig *__rpcfd_to_nconf();
extern int __rpc_matchserv();
extern  int __rpc_get_default_domain();
extern int __rpc_tli_set_options(); /* internal use only */
#endif

#ifndef _KERNEL

#ifdef __STDC__
bool_t rpc_control(int, void *);
#else
bool_t rpc_control();
#endif

/*
 * rpc_control commands
 */
#define	RPC_SVC_MTMODE_SET	1	/* set MT mode */
#define	RPC_SVC_MTMODE_GET	2	/* get MT mode */
#define	RPC_SVC_THRMAX_SET	3	/* set maximum number of threads */
#define	RPC_SVC_THRMAX_GET	4	/* get maximum number of threads */
#define	RPC_SVC_THRTOTAL_GET	5	/* get total number of threads */
#define	RPC_SVC_THRCREATES_GET	6	/* get total threads created */
#define	RPC_SVC_THRERRORS_GET	7	/* get total thread create errors */
#define	RPC_SVC_USE_POLLFD	10	/* unlimit fd used beyond 1024 */
#define	RPC_SVC_CONNMAXREC_SET	11	/* set COT maximum record size */
#define	RPC_SVC_CONNMAXREC_GET	12	/* get COT maximum record size */
/* EXCLBIND private interface start - for internal use only */
#define	__RPC_SVC_EXCLBIND_SET  13	/* set udp/tcp exclusive port access */
#define	__RPC_SVC_EXCLBIND_GET  14	/* get udp/tcp exclusive port access */
/* EXCLBIND private interface end  - for internal use only */

/* set inter record timeout for COTS RPC */
#define	RPC_SVC_IRTIMEOUT_SET	15

/* private interface for maximum number of outstanding connection indications */
#define	__RPC_SVC_LSTNBKLOG_SET	16	/* set listen backlog */
#define	__RPC_SVC_LSTNBKLOG_GET	17	/* get listen backlog */

#endif /* !_KERNEL */

#ifdef __cplusplus
}
#endif

#endif /* _RPC_RPC_COM_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

#ifndef _RPC_RPC_MSG_H
#define	_RPC_RPC_MSG_H

#include <rpc/clnt.h>
/*
 * rpc_msg.h
 * rpc message definition
 */

#ifdef __cplusplus
extern "C" {
#endif

#define	RPC_MSG_VERSION		((uint32_t)2)
#define	RPC_SERVICE_PORT	((ushort_t)2048)

/*
 * Bottom up definition of an rpc message.
 * NOTE: call and reply use the same overall stuct but
 * different parts of unions within it.
 */

enum msg_type {
	CALL = 0,
	REPLY = 1
};

enum reply_stat {
	MSG_ACCEPTED = 0,
	MSG_DENIED = 1
};

enum accept_stat {
	SUCCESS = 0,
	PROG_UNAVAIL = 1,
	PROG_MISMATCH = 2,
	PROC_UNAVAIL = 3,
	GARBAGE_ARGS = 4,
	SYSTEM_ERR = 5
};

enum reject_stat {
	RPC_MISMATCH = 0,
	AUTH_ERROR = 1
};

/*
 * Reply part of an rpc exchange
 */

/*
 * Reply to an rpc request that was accepted by the server.
 * Note: there could be an error even though the request was
 * accepted.
 */
struct accepted_reply {
	struct opaque_auth	ar_verf;
	enum accept_stat	ar_stat;
	union {
		struct {
			rpcvers_t low;
			rpcvers_t high;
		} AR_versions;
		struct {
			caddr_t	where;
			xdrproc_t proc;
		} AR_results;
		/* and many other null cases */
	} ru;
#define	ar_results	ru.AR_results
#define	ar_vers		ru.AR_versions
};

/*
 * Reply to an rpc request that was rejected by the server.
 */
struct rejected_reply {
	enum reject_stat rj_stat;
	union {
		struct {
			rpcvers_t low;
			rpcvers_t high;
		} RJ_versions;
		enum auth_stat RJ_why;  /* why authentication did not work */
	} ru;
#define	rj_vers	ru.RJ_versions
#define	rj_why	ru.RJ_why
};

/*
 * Body of a reply to an rpc request.
 */
struct reply_body {
	enum reply_stat rp_stat;
	union {
		struct accepted_reply RP_ar;
		struct rejected_reply RP_dr;
	} ru;
#define	rp_acpt	ru.RP_ar
#define	rp_rjct	ru.RP_dr
};

/*
 * Body of an rpc request call.
 */
struct call_body {
	rpcvers_t cb_rpcvers;	/* must be equal to two */
	rpcprog_t cb_prog;
	rpcvers_t cb_vers;
	rpcproc_t cb_proc;
	struct opaque_auth cb_cred;
	struct opaque_auth cb_verf; /* protocol specific - provided by client */
};

/*
 * The rpc message
 */
struct rpc_msg {
	uint32_t		rm_xid;
	enum msg_type		rm_direction;
	union {
		struct call_body RM_cmb;
		struct reply_body RM_rmb;
	} ru;
#define	rm_call		ru.RM_cmb
#define	rm_reply	ru.RM_rmb
};
#define	acpted_rply	ru.RM_rmb.ru.RP_ar
#define	rjcted_rply	ru.RM_rmb.ru.RP_dr


/*
 * XDR routine to handle a rpc message.
 * xdr_callmsg(xdrs, cmsg)
 * 	XDR *xdrs;
 * 	struct rpc_msg *cmsg;
 */
#ifdef __STDC__
extern bool_t	xdr_callmsg(XDR *, struct rpc_msg *);
#else
extern bool_t	xdr_callmsg();
#endif


/*
 * XDR routine to pre-serialize the static part of a rpc message.
 * xdr_callhdr(xdrs, cmsg)
 * 	XDR *xdrs;
 * 	struct rpc_msg *cmsg;
 */
#ifdef __STDC__
extern bool_t	xdr_callhdr(XDR *, struct rpc_msg *);
#else
extern bool_t	xdr_callhdr();
#endif


/*
 * XDR routine to handle a rpc reply.
 * xdr_replymsg(xdrs, rmsg)
 * 	XDR *xdrs;
 * 	struct rpc_msg *rmsg;
 *
 * xdr_accepted_reply(xdrs, ar)
 *	XDR *xdrs;
 *	const struct accepted_reply *ar;
 *
 * xdr_rejected_reply(xdrs, rr)
 *	XDR *xdrs;
 *	const struct rejected_reply *rr;
 */
#ifdef __STDC__
extern bool_t	xdr_replymsg(XDR *, struct rpc_msg *);
extern bool_t	xdr_accepted_reply(XDR *, struct accepted_reply *);
extern bool_t	xdr_rejected_reply(XDR *, struct rejected_reply *);
#else
extern bool_t	xdr_replymsg();
extern bool_t	xdr_accepted_reply();
extern bool_t	xdr_rejected_reply();
#endif


#ifdef _KERNEL
/*
 * Fills in the error part of a reply message.
 * _seterr_reply(msg, error)
 * 	struct rpc_msg *msg;
 * 	struct rpc_err *error;
 */
#ifdef __STDC__
extern void	_seterr_reply(struct rpc_msg *, struct rpc_err *);
#else
extern void	_seterr_reply();
#endif
#else
/*
 * Fills in the error part of a reply message.
 * __seterr_reply(msg, error)
 * 	struct rpc_msg *msg;
 * 	struct rpc_err *error;
 */
#ifdef __STDC__
extern void	__seterr_reply(struct rpc_msg *, struct rpc_err *);
#else
extern void	__seterr_reply();
#endif
#endif

#ifdef _KERNEL
/*
 * Frees any verifier that xdr_replymsg() (DECODE) allocated.
 */
bool_t xdr_rpc_free_verifier(register XDR *xdrs, register struct rpc_msg *msg);

#endif

#ifdef __cplusplus
}
#endif

#endif	/* _RPC_RPC_MSG_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved  	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

/*
 * rpc_prot.c
 * This set of routines implements the rpc message definition,
 * its serializer and some common rpc utility routines.
 * The routines are meant for various implementations of rpc -
 * they are NOT for the rpc client or rpc service implementations!
 * Because authentication stuff is easy and is part of rpc, the opaque
 * routines are also in this program.
 */

#include <sys/param.h>

#include <sys/types.h>
#include <sys/t_lock.h>
#include <sys/systm.h>

#include <rpc/types.h>
#include <rpc/xdr.h>
#include <rpc/auth.h>
#include <rpc/clnt.h>
#include <rpc/rpc_msg.h>

/* * * * * * * * * * * * * * XDR Authentication * * * * * * * * * * * */

struct opaque_auth _null_auth;

/*
 * XDR an opaque authentication struct
 * (see auth.h)
 */
bool_t
xdr_opaque_auth(XDR *xdrs, struct opaque_auth *ap)
{
	if (xdr_enum(xdrs, &(ap->oa_flavor))) {
		return (xdr_bytes(xdrs, &ap->oa_base,
		    &ap->oa_length, MAX_AUTH_BYTES));
	}
	return (FALSE);
}

/*
 * XDR a DES block
 */
bool_t
xdr_des_block(XDR *xdrs, des_block *blkp)
{
	return (xdr_opaque(xdrs, (caddr_t)blkp, sizeof (des_block)));
}

/* * * * * * * * * * * * * * XDR RPC MESSAGE * * * * * * * * * * * * * * * */

/*
 * XDR the MSG_ACCEPTED part of a reply message union
 */
bool_t
xdr_accepted_reply(XDR *xdrs, struct accepted_reply *ar)
{
	/* personalized union, rather than calling xdr_union */
	if (!xdr_opaque_auth(xdrs, &(ar->ar_verf)))
		return (FALSE);
	if (!xdr_enum(xdrs, (enum_t *)&(ar->ar_stat)))
		return (FALSE);

	switch (ar->ar_stat) {
	case SUCCESS:
		return ((*(ar->ar_results.proc))(xdrs, ar->ar_results.where));

	case PROG_MISMATCH:
		if (!xdr_rpcvers(xdrs, &(ar->ar_vers.low)))
			return (FALSE);
		return (xdr_rpcvers(xdrs, &(ar->ar_vers.high)));
	}
	return (TRUE);  /* TRUE => open ended set of problems */
}

/*
 * XDR the MSG_DENIED part of a reply message union
 */
bool_t
xdr_rejected_reply(XDR *xdrs, struct rejected_reply *rr)
{
	/* personalized union, rather than calling xdr_union */
	if (!xdr_enum(xdrs, (enum_t *)&(rr->rj_stat)))
		return (FALSE);
	switch (rr->rj_stat) {

	case RPC_MISMATCH:
		if (!xdr_rpcvers(xdrs, &(rr->rj_vers.low)))
			return (FALSE);
		return (xdr_rpcvers(xdrs, &(rr->rj_vers.high)));

	case AUTH_ERROR:
		return (xdr_enum(xdrs, (enum_t *)&(rr->rj_why)));
	}
	return (FALSE);
}

static struct xdr_discrim reply_dscrm[3] = {
	{ MSG_ACCEPTED, xdr_accepted_reply },
	{ MSG_DENIED, xdr_rejected_reply },
	{ __dontcare__, NULL_xdrproc_t }
};

/*
 * XDR a reply message
 */
bool_t
xdr_replymsg(XDR *xdrs, struct rpc_msg *rmsg)
{
	int32_t *buf;
	struct accepted_reply *ar;
	struct opaque_auth *oa;
	uint_t rndup;

	if (xdrs->x_op == XDR_ENCODE &&
	    rmsg->rm_reply.rp_stat == MSG_ACCEPTED &&
	    rmsg->rm_direction == REPLY &&
	    (buf = XDR_INLINE(xdrs, 6 * BYTES_PER_XDR_UNIT + (rndup =
	    RNDUP(rmsg->rm_reply.rp_acpt.ar_verf.oa_length)))) != NULL) {
		IXDR_PUT_INT32(buf, rmsg->rm_xid);
		IXDR_PUT_ENUM(buf, rmsg->rm_direction);
		IXDR_PUT_ENUM(buf, rmsg->rm_reply.rp_stat);
		ar = &rmsg->rm_reply.rp_acpt;
		oa = &ar->ar_verf;
		IXDR_PUT_ENUM(buf, oa->oa_flavor);
		IXDR_PUT_INT32(buf, oa->oa_length);
		if (oa->oa_length) {
			bcopy(oa->oa_base, buf, oa->oa_length);
			buf = (int32_t *)(((caddr_t)buf) + oa->oa_length);
			if ((rndup = (rndup - oa->oa_length)) > 0) {
				bzero(buf, rndup);
				buf = (int32_t *)(((caddr_t)buf) + rndup);
			}
		}
		/*
		 * stat and rest of reply, copied from xdr_accepted_reply
		 */
		IXDR_PUT_ENUM(buf, ar->ar_stat);
		switch (ar->ar_stat) {
		case SUCCESS:
			return ((*(ar->ar_results.proc))(xdrs,
			    ar->ar_results.where));

		case PROG_MISMATCH:
			if (!xdr_rpcvers(xdrs, &(ar->ar_vers.low)))
				return (FALSE);
			return (xdr_rpcvers(xdrs, &(ar->ar_vers.high)));
		}
		return (TRUE);
	}
	if (xdrs->x_op == XDR_DECODE &&
	    (buf = XDR_INLINE(xdrs, 3 * BYTES_PER_XDR_UNIT)) != NULL) {
		rmsg->rm_xid = IXDR_GET_INT32(buf);
		rmsg->rm_direction = IXDR_GET_ENUM(buf, enum msg_type);
		if (rmsg->rm_direction != REPLY)
			return (FALSE);
		rmsg->rm_reply.rp_stat = IXDR_GET_ENUM(buf, enum reply_stat);
		if (rmsg->rm_reply.rp_stat != MSG_ACCEPTED) {
			if (rmsg->rm_reply.rp_stat == MSG_DENIED)
				return (xdr_rejected_reply(xdrs,
				    &rmsg->rm_reply.rp_rjct));
			return (FALSE);
		}
		ar = &rmsg->rm_reply.rp_acpt;
		oa = &ar->ar_verf;
		buf = XDR_INLINE(xdrs, 2 * BYTES_PER_XDR_UNIT);
		if (buf != NULL) {
			oa->oa_flavor = IXDR_GET_ENUM(buf, enum_t);
			oa->oa_length = IXDR_GET_INT32(buf);
		} else {
			if (xdr_enum(xdrs, &oa->oa_flavor) == FALSE ||
			    xdr_u_int(xdrs, &oa->oa_length) == FALSE)
				return (FALSE);
		}
		if (oa->oa_length) {
			if (oa->oa_length > MAX_AUTH_BYTES)
				return (FALSE);
			if (oa->oa_base == NULL) {
				oa->oa_base = (caddr_t)
				    mem_alloc(oa->oa_length);
			}
			buf = XDR_INLINE(xdrs, RNDUP(oa->oa_length));
			if (buf == NULL) {
				if (xdr_opaque(xdrs, oa->oa_base,
				    oa->oa_length) == FALSE)
					return (FALSE);
			} else {
				bcopy(buf, oa->oa_base, oa->oa_length);
			}
		}
		/*
		 * stat and rest of reply, copied from
		 * xdr_accepted_reply
		 */
		if (!xdr_enum(xdrs, (enum_t *)&ar->ar_stat))
			return (FALSE);
		switch (ar->ar_stat) {
		case SUCCESS:
			return ((*(ar->ar_results.proc))(xdrs,
			    ar->ar_results.where));

		case PROG_MISMATCH:
			if (!xdr_rpcvers(xdrs, &ar->ar_vers.low))
				return (FALSE);
			return (xdr_rpcvers(xdrs, &ar->ar_vers.high));
		}
		return (TRUE);
	}

	if (xdr_u_int(xdrs, &(rmsg->rm_xid)) &&
	    xdr_enum(xdrs, (enum_t *)&(rmsg->rm_direction)) &&
	    (rmsg->rm_direction == REPLY))
		return (xdr_union(xdrs, (enum_t *)&(rmsg->rm_reply.rp_stat),
		    (caddr_t)&(rmsg->rm_reply.ru), reply_dscrm,
		    NULL_xdrproc_t));
	return (FALSE);
}

/*
 * XDR a reply message header (encode only)
 */
bool_t
xdr_replymsg_hdr(XDR *xdrs, struct rpc_msg *rmsg)
{
	int32_t *buf;
	struct accepted_reply *ar;
	struct opaque_auth *oa;
	uint_t rndup;

	if (xdrs->x_op != XDR_ENCODE ||
	    rmsg->rm_reply.rp_stat != MSG_ACCEPTED ||
	    rmsg->rm_direction != REPLY)
		return (FALSE);

	if ((buf = XDR_INLINE(xdrs, 6 * BYTES_PER_XDR_UNIT + (rndup =
	    RNDUP(rmsg->rm_reply.rp_acpt.ar_verf.oa_length)))) != NULL) {
		IXDR_PUT_INT32(buf, rmsg->rm_xid);
		IXDR_PUT_ENUM(buf, rmsg->rm_direction);
		IXDR_PUT_ENUM(buf, rmsg->rm_reply.rp_stat);
		ar = &rmsg->rm_reply.rp_acpt;
		oa = &ar->ar_verf;
		IXDR_PUT_ENUM(buf, oa->oa_flavor);
		IXDR_PUT_INT32(buf, oa->oa_length);
		if (oa->oa_length) {
			bcopy(oa->oa_base, buf, oa->oa_length);
			buf = (int32_t *)(((caddr_t)buf) + oa->oa_length);
			if ((rndup = (rndup - oa->oa_length)) > 0) {
				bzero(buf, rndup);
				buf = (int32_t *)(((caddr_t)buf) + rndup);
			}
		}
		/*
		 * stat and rest of reply, copied from xdr_accepted_reply
		 */
		IXDR_PUT_ENUM(buf, ar->ar_stat);
		return (TRUE);
	}

	if (xdr_u_int(xdrs, &(rmsg->rm_xid)) &&
	    xdr_enum(xdrs, (enum_t *)&(rmsg->rm_direction)) &&
	    xdr_enum(xdrs, (enum_t *)&(rmsg->rm_reply.rp_stat)) &&
	    xdr_opaque_auth(xdrs, &rmsg->rm_reply.rp_acpt.ar_verf) &&
	    xdr_enum(xdrs, (enum_t *)&(rmsg->rm_reply.rp_acpt.ar_stat)))
		return (TRUE);
	return (FALSE);
}

/*
 * XDR a reply message body (encode only)
 */
bool_t
xdr_replymsg_body(XDR *xdrs, struct rpc_msg *rmsg)
{
	struct accepted_reply *ar;

	if (xdrs->x_op != XDR_ENCODE)
		return (FALSE);

	ar = &rmsg->rm_reply.rp_acpt;

	if (ar->ar_results.proc == NULL)
		return (TRUE);
	return ((*(ar->ar_results.proc))(xdrs, ar->ar_results.where));
}

/*
 * Serializes the "static part" of a call message header.
 * The fields include: rm_xid, rm_direction, rpcvers, prog, and vers.
 * The rm_xid is not really static, but the user can easily munge on the fly.
 */
bool_t
xdr_callhdr(XDR *xdrs, struct rpc_msg *cmsg)
{
	cmsg->rm_direction = CALL;
	cmsg->rm_call.cb_rpcvers = RPC_MSG_VERSION;
	if (xdrs->x_op == XDR_ENCODE &&
	    xdr_u_int(xdrs, &(cmsg->rm_xid)) &&
	    xdr_enum(xdrs, (enum_t *)&(cmsg->rm_direction)) &&
	    xdr_rpcvers(xdrs, &(cmsg->rm_call.cb_rpcvers)) &&
	    xdr_rpcprog(xdrs, &(cmsg->rm_call.cb_prog)))
		return (xdr_rpcvers(xdrs, &(cmsg->rm_call.cb_vers)));
	return (FALSE);
}

/* ************************** Client utility routine ************* */

static void
accepted(enum accept_stat acpt_stat, struct rpc_err *error)
{
	switch (acpt_stat) {
	case PROG_UNAVAIL:
		error->re_status = RPC_PROGUNAVAIL;
		return;

	case PROG_MISMATCH:
		error->re_status = RPC_PROGVERSMISMATCH;
		return;

	case PROC_UNAVAIL:
		error->re_status = RPC_PROCUNAVAIL;
		return;

	case GARBAGE_ARGS:
		error->re_status = RPC_CANTDECODEARGS;
		return;

	case SYSTEM_ERR:
		error->re_status = RPC_SYSTEMERROR;
		return;

	case SUCCESS:
		error->re_status = RPC_SUCCESS;
		return;
	}
	/* something's wrong, but we don't know what ... */
	error->re_status = RPC_FAILED;
	error->re_lb.s1 = (int32_t)MSG_ACCEPTED;
	error->re_lb.s2 = (int32_t)acpt_stat;
}

static void
rejected(enum reject_stat rjct_stat, struct rpc_err *error)
{
	switch (rjct_stat) {
	case RPC_VERSMISMATCH:
		error->re_status = RPC_VERSMISMATCH;
		return;

	case AUTH_ERROR:
		error->re_status = RPC_AUTHERROR;
		return;
	}
	/* something's wrong, but we don't know what ... */
	error->re_status = RPC_FAILED;
	error->re_lb.s1 = (int32_t)MSG_DENIED;
	error->re_lb.s2 = (int32_t)rjct_stat;
}

/*
 * given a reply message, fills in the error
 */
void
_seterr_reply(struct rpc_msg *msg, struct rpc_err *error)
{
	/* optimized for normal, SUCCESSful case */
	switch (msg->rm_reply.rp_stat) {
	case MSG_ACCEPTED:
		if (msg->acpted_rply.ar_stat == SUCCESS) {
			error->re_status = RPC_SUCCESS;
			return;
		};
		accepted(msg->acpted_rply.ar_stat, error);
		break;

	case MSG_DENIED:
		rejected(msg->rjcted_rply.rj_stat, error);
		break;

	default:
		error->re_status = RPC_FAILED;
		error->re_lb.s1 = (int32_t)(msg->rm_reply.rp_stat);
		break;
	}

	switch (error->re_status) {
	case RPC_VERSMISMATCH:
		error->re_vers.low = msg->rjcted_rply.rj_vers.low;
		error->re_vers.high = msg->rjcted_rply.rj_vers.high;
		break;

	case RPC_AUTHERROR:
		error->re_why = msg->rjcted_rply.rj_why;
		break;

	case RPC_PROGVERSMISMATCH:
		error->re_vers.low = msg->acpted_rply.ar_vers.low;
		error->re_vers.high = msg->acpted_rply.ar_vers.high;
		break;
	}
}

/*
 * given a reply message, frees the accepted verifier
 */
bool_t
xdr_rpc_free_verifier(XDR *xdrs, struct rpc_msg *msg)
{
	if (msg->rm_direction == REPLY &&
	    msg->rm_reply.rp_stat == MSG_ACCEPTED &&
	    msg->acpted_rply.ar_verf.oa_base != NULL) {
		xdrs->x_op = XDR_FREE;
		return (xdr_opaque_auth(xdrs, &(msg->acpted_rply.ar_verf)));
	}
	return (TRUE);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
 */

/*
 * Copyright (c) 2007, The Ohio State University. All rights reserved.
 *
 * Portions of this source code is developed by the team members of
 * The Ohio State University's Network-Based Computing Laboratory (NBCL),
 * headed by Professor Dhabaleswar K. (DK) Panda.
 *
 * Acknowledgements to contributions from developors:
 *   Ranjit Noronha: noronha@cse.ohio-state.edu
 *   Lei Chai      : chail@cse.ohio-state.edu
 *   Weikuan Yu    : yuw@cse.ohio-state.edu
 *
 */

#ifndef	_RPC_RPC_RDMA_H
#define	_RPC_RPC_RDMA_H

#include <rpc/rpc.h>
#include <rpc/rpc_sztypes.h>
#include <sys/sunddi.h>
#include <sys/sunldi.h>

#ifdef __cplusplus
extern "C" {
#endif

#define	RPCRDMA_VERS	1	/* Version of the RPC over RDMA protocol */
#define	RDMATF_VERS	1	/* Version of the API used by RPC for RDMA */
#define	RDMATF_VERS_1	1	/* Current version of RDMATF */

/*
 * The size of an RPC call or reply message
 */
#define	RPC_MSG_SZ	1024

/*
 * RDMA chunk size
 */
#define	RDMA_MINCHUNK	1024

/*
 * Storage for a chunk list
 */
#define	RPC_CL_SZ  1024

/*
 * Chunk size
 */
#define	MINCHUNK  1024

/*
 * Size of receive buffer
 */
#define	RPC_BUF_SIZE	2048

#define	NOWAIT	0	/* don't wait for operation of complete */
#define	WAIT	1	/* wait and ensure that operation is complete */

/*
 * RDMA xdr buffer control and other control flags. Add new flags here,
 * set them in private structure for xdr over RDMA in xdr_rdma.c
 */
#define	XDR_RDMA_CHUNK			0x1
#define	XDR_RDMA_WLIST_REG		0x2
#define	XDR_RDMA_RLIST_REG		0x4

#define	LONG_REPLY_LEN	65536
#define	WCL_BUF_LEN	32768
#define	RCL_BUF_LEN	32768


#define	RDMA_BUFS_RQST	34	/* Num bufs requested by client */
#define	RDMA_BUFS_GRANT	32	/* Num bufs granted by server */

struct xdr_ops *xdrrdma_xops(void);

/*
 * Credit Control Structures.
 */
typedef enum rdma_cc_type {
	RDMA_CC_CLNT,	/* CONN is for a client */
	RDMA_CC_SRV	/* CONN is for a server */
} rdma_cc_type_t;

/*
 * Client side credit control data structure.
 */
typedef struct rdma_clnt_cred_ctrl {
	uint32_t	clnt_cc_granted_ops;
	uint32_t	clnt_cc_in_flight_ops;
	kcondvar_t	clnt_cc_cv;
} rdma_clnt_cred_ctrl_t;

/*
 * Server side credit control data structure.
 */
typedef struct rdma_srv_cred_ctrl {
	uint32_t	srv_cc_buffers_granted;
	uint32_t	srv_cc_cur_buffers_used;
	uint32_t	srv_cc_posted;
	uint32_t	srv_cc_max_buf_size;	/* to be determined by CCP */
	uint32_t	srv_cc_cur_buf_size;	/* to be determined by CCP */
} rdma_srv_cred_ctrl_t;

typedef enum {
    RPCCALL_WLIST,
    RPCCALL_WCHUNK,
    RPCCALL_NOWRITE
}rpccall_write_t;

typedef enum {
	CLIST_REG_SOURCE = 1,
	CLIST_REG_DST
} clist_dstsrc;

/*
 * Return codes from RDMA operations
 */
typedef enum {

	RDMA_SUCCESS = 0,	/* successful operation */

	RDMA_INVAL = 1,		/* invalid parameter */
	RDMA_TIMEDOUT = 2,	/* operation timed out */
	RDMA_INTR = 3,		/* operation interrupted */
	RDMA_NORESOURCE = 4,	/* insufficient resource */
	/*
	 * connection errors
	 */
	RDMA_REJECT = 5,	/* connection req rejected */
	RDMA_NOLISTENER = 6,	/* no listener on server */
	RDMA_UNREACHABLE = 7,	/* host unreachable */
	RDMA_CONNLOST = 8,	/* connection lost */

	RDMA_XPRTFAILED = 9,	/* RDMA transport failed */
	RDMA_PROTECTERR = 10,	/* memory protection error */
	RDMA_OVERRUN = 11,	/* transport overrun */
	RDMA_RECVQEMPTY = 12,	/* incoming pkt dropped, recv q empty */
	RDMA_PROTFAILED = 13,	/* RDMA protocol failed */
	RDMA_NOTSUPP = 14,	/* requested feature not supported */
	RDMA_REMOTERR = 15,	/* error at remote end */
	/*
	 * RDMATF errors
	 */
	RDMA_BADVERS = 16,	/* mismatch RDMATF versions */
	RDMA_REG_EXIST = 17,	/* RDMATF registration already exists */
	RDMA_HCA_ATTACH = 18,
	RDMA_HCA_DETACH = 19,

	/*
	 * fallback error
	 */
	RDMA_FAILED = 20	/* generic error */
} rdma_stat;

/*
 * Memory region context. This is an RDMA provider generated
 * handle for a registered arbitrary size contiguous virtual
 * memory. The RDMA Interface Adapter needs this for local or
 * remote memory access.
 *
 * The mrc_rmr field holds the remote memory region context
 * which is sent over-the-wire to provide the remote host
 * with RDMA access to the memory region.
 */
struct mrc {
	uint32_t	mrc_rmr;	/* Remote MR context, sent OTW */
	union {
		struct mr {
			uint32_t	lmr; 	/* Local MR context */
			uint64_t	linfo;	/* Local memory info */
		} mr;
	} lhdl;
};

#define	mrc_lmr		lhdl.mr.lmr
#define	mrc_linfo	lhdl.mr.linfo

/*
 * Memory management for the RDMA buffers
 */
/*
 * RDMA buffer types
 */
typedef enum {
	SEND_BUFFER,	/* buf for send msg */
	SEND_DESCRIPTOR, /* buf used for send msg descriptor in plugins only */
	RECV_BUFFER,	/* buf for recv msg */
	RECV_DESCRIPTOR, /* buf used for recv msg descriptor in plugins only */
	RDMA_LONG_BUFFER /* chunk buf used in RDMATF only and not in plugins */
} rdma_btype;

/*
 * RDMA buffer information
 */
typedef struct rdma_buf {
	rdma_btype	type;	/* buffer type */
	uint_t		len;	/* length of buffer */
	caddr_t		addr;	/* buffer address */
	struct mrc	handle;	/* buffer registration handle */
	caddr_t		rb_private;
} rdma_buf_t;


/*
 * The XDR offset value is used by the XDR
 * routine to identify the position in the
 * RPC message where the opaque object would
 * normally occur. Neither the data content
 * of the chunk, nor its size field are included
 * in the RPC message.  The XDR offset is calculated
 * as if the chunks were present.
 *
 * The remaining fields identify the chunk of data
 * on the sender.  The c_memhandle identifies a
 * registered RDMA memory region and the c_addr
 * and c_len fields identify the chunk within it.
 */
struct clist {
	uint32		c_xdroff;	/* XDR offset */
	uint32		c_len;		/* Length */
	clist_dstsrc	c_regtype;	/* type of registration */
	struct mrc	c_smemhandle;	/* src memory handle */
	uint64 		c_ssynchandle;	/* src sync handle */
	union {
		uint64		c_saddr;	/* src address */
		caddr_t 	c_saddr3;
	} w;
	struct mrc	c_dmemhandle;	/* dst memory handle */
	uint64		c_dsynchandle;	/* dst sync handle */
	union {
		uint64	c_daddr;	/* dst address */
		caddr_t	c_daddr3;
	} u;
	struct as	*c_adspc;	/* address space for saddr/daddr */
	rdma_buf_t	rb_longbuf;	/* used for long requests/replies */
	struct clist	*c_next;	/* Next chunk */
};

typedef struct clist clist;

/*
 * max 4M wlist xfer size
 * This is defined because the rfs3_tsize service requires
 * svc_req struct (which we don't have that in krecv).
 */
#define	MAX_SVC_XFER_SIZE (4*1024*1024)

enum rdma_proc {
	RDMA_MSG	= 0,	/* chunk list and RPC msg follow */
	RDMA_NOMSG	= 1,	/* only chunk list follows */
	RDMA_MSGP	= 2,	/* chunk list and RPC msg with padding follow */
	RDMA_DONE	= 3	/* signal completion of chunk transfer */
};

/*
 * Listener information for a service
 */
struct rdma_svc_data {
	queue_t		q;	/* queue_t to place incoming pkts */
	int		active;	/* If active, after registeration startup */
	rdma_stat	err_code;	/* Error code from plugin layer */
	int32_t		svcid;		/* RDMA based service identifier */
};

/*
 * Per RDMA plugin module information.
 * Will be populated by each plugin
 * module during its initialization.
 */
typedef struct rdma_mod {
	char 		*rdma_api;		/* "kvipl", "ibtf", etc */
	uint_t 		rdma_version;		/* RDMATF API version */
	int		rdma_count;		/* # of devices */
	struct rdmaops 	*rdma_ops;		/* rdma op vector for api */
} rdma_mod_t;

/*
 * Registry of RDMA plugins
 */
typedef struct rdma_registry {
	rdma_mod_t	*r_mod;		/* plugin mod info */
	uint32_t	r_mod_state;
	struct rdma_registry *r_next;	/* next registered RDMA plugin */
} rdma_registry_t;

/*
 * RDMA MODULE state flags (r_mod_state).
 */
#define	RDMA_MOD_ACTIVE		1
#define	RDMA_MOD_INACTIVE	0

/*
 * RDMA transport information
 */
typedef struct rdma_info {
	uint_t	addrlen;	/* address length */
	uint_t  mts;		/* max transfer size */
	uint_t  mtu;		/* native mtu size of unlerlying network */
} rdma_info_t;

typedef enum {
	C_IDLE		= 0x00000001,
	C_CONN_PEND	= 0x00000002,
	C_CONNECTED	= 0x00000004,
	C_ERROR_CONN	= 0x00000008,
	C_DISCONN_PEND	= 0x00000010,
	C_REMOTE_DOWN	= 0x00000020
} conn_c_state;

/* c_flags */
#define	C_CLOSE_NOTNEEDED	0x00000001	/* just free the channel */
#define	C_CLOSE_PENDING		0x00000002	/* a close in progress */

/*
 * RDMA Connection information
 */
typedef struct conn {
	rdma_mod_t	*c_rdmamod;	/* RDMA transport info for conn */
	char 		*c_netid;	/* tcp or tcp6 token */
	struct netbuf	c_raddr;	/* remote address */
	struct netbuf	c_laddr;	/* local address */
	struct netbuf	c_addrmask;	/* Address Mask */
	int		c_ref;		/* no. of clients of connection */
	struct conn	*c_next;	/* next in list of connections */
	struct conn	*c_prev;	/* prev in list of connections */
	caddr_t		c_private;	/* transport specific stuff */
	conn_c_state	c_state;	/* state of connection */
	int		c_flags;	/* flags for connection management */
	rdma_cc_type_t	c_cc_type;	/* client or server, for credit cntrl */
	union {
		rdma_clnt_cred_ctrl_t	c_clnt_cc;
		rdma_srv_cred_ctrl_t	c_srv_cc;
	} rdma_conn_cred_ctrl_u;
	kmutex_t	c_lock;		/* protect c_state and c_ref fields */
	kcondvar_t	c_cv;		/* to signal when pending is done */
	timeout_id_t	c_timeout;	/* timeout id for untimeout() */
	time_t		c_last_used;	/* last time any activity on the conn */
} CONN;


/*
 * Data transferred from plugin interrupt to svc_queuereq()
 */
typedef struct rdma_recv_data {
	CONN		*conn;
	int		status;
	rdma_buf_t	rpcmsg;
} rdma_recv_data_t;

/* structure used to pass information for READ over rdma write */
typedef enum {
	RCI_WRITE_UIO_CHUNK = 1,
	RCI_WRITE_ADDR_CHUNK = 2,
	RCI_REPLY_CHUNK = 3
} rci_type_t;

typedef struct {
	rci_type_t rci_type;
	union {
		struct uio *rci_uiop;
		caddr_t    rci_addr;
	} rci_a;
	uint32	rci_len;
	struct clist	**rci_clpp; /* point to write chunk list in readargs */
} rdma_chunkinfo_t;

typedef struct {
	uint_t rcil_len;
	uint_t rcil_len_alt;
} rdma_chunkinfo_lengths_t;

typedef struct {
	struct	clist	*rwci_wlist;
	CONN		*rwci_conn;
} rdma_wlist_conn_info_t;

/*
 * Operations vector for RDMA transports.
 */
typedef struct rdmaops {
	/* Network */
	rdma_stat	(*rdma_reachable)(int addr_type, struct netbuf *,
						void **handle);
	/* Connection */
	rdma_stat	(*rdma_get_conn)(struct netbuf *, struct netbuf *,
					int addr_type, void *, CONN **);
	rdma_stat	(*rdma_rel_conn)(CONN *);
	/* Server side listner start and stop routines */
	void		(*rdma_svc_listen)(struct rdma_svc_data *);
	void		(*rdma_svc_stop)(struct rdma_svc_data *);
	/* Memory */
	rdma_stat	(*rdma_regmem)(CONN *, caddr_t, caddr_t,
			    uint_t, struct mrc *);
	rdma_stat	(*rdma_deregmem)(CONN *, caddr_t, struct mrc);
	rdma_stat	(*rdma_regmemsync)(CONN *, caddr_t, caddr_t, uint_t,
				struct mrc *, void **, void *);
	rdma_stat	(*rdma_deregmemsync)(CONN *, caddr_t, struct mrc,
			    void *, void *);
	rdma_stat	(*rdma_syncmem)(CONN *, void *, caddr_t, int, int);
	/* Buffer */
	rdma_stat	(*rdma_buf_alloc)(CONN *, rdma_buf_t *);
	void		(*rdma_buf_free)(CONN *, rdma_buf_t *);
	/* Transfer */
	rdma_stat	(*rdma_send)(CONN *, clist *, uint32_t);
	rdma_stat	(*rdma_send_resp)(CONN *, clist *, uint32_t);
	rdma_stat	(*rdma_clnt_recvbuf)(CONN *, clist *, uint32_t);
	rdma_stat	(*rdma_clnt_recvbuf_remove)(CONN *, uint32_t);
	rdma_stat	(*rdma_svc_recvbuf)(CONN *, clist *);
	rdma_stat	(*rdma_recv)(CONN *, clist **, uint32_t);
	/* RDMA */
	rdma_stat	(*rdma_read)(CONN *, clist *, int);
	rdma_stat	(*rdma_write)(CONN *, clist *, int);
	/* INFO */
	rdma_stat	(*rdma_getinfo)(rdma_info_t *info);
} rdmaops_t;

typedef struct rdma_svc_wait {
	kmutex_t svc_lock;
	kcondvar_t svc_cv;
	rdma_stat svc_stat;
} rdma_svc_wait_t;

extern rdma_svc_wait_t rdma_wait;

/*
 * RDMA operations.
 */
#define	RDMA_REACHABLE(rdma_ops, addr_type, addr, handle)	\
	(*(rdma_ops)->rdma_reachable)(addr_type, addr, handle)

#define	RDMA_GET_CONN(rdma_ops, saddr, daddr, addr_type, handle, conn)	\
	(*(rdma_ops)->rdma_get_conn)(saddr, daddr, addr_type, handle, conn)

#define	RDMA_REL_CONN(conn)	\
	(*(conn)->c_rdmamod->rdma_ops->rdma_rel_conn)(conn)

#define	RDMA_REGMEM(conn, adsp, buff, len, handle)	\
	(*(conn)->c_rdmamod->rdma_ops->rdma_regmem)(conn, adsp,	\
		buff, len, handle)

#define	RDMA_DEREGMEM(conn, buff, handle)	\
	(*(conn)->c_rdmamod->rdma_ops->rdma_deregmem)(conn, buff, handle)

#define	RDMA_REGMEMSYNC(conn, adsp, buff, len, handle, synchandle, lrc)	\
	(*(conn)->c_rdmamod->rdma_ops->rdma_regmemsync)(conn, adsp, buff, \
	len, handle, synchandle, lrc)

#define	RDMA_DEREGMEMSYNC(conn, buff, handle, synchandle, lrc)	\
	(*(conn)->c_rdmamod->rdma_ops->rdma_deregmemsync)(conn, buff,	\
	handle, synchandle, lrc)

#define	RDMA_SYNCMEM(conn, handle, buff, len, direction)	\
	(*(conn)->c_rdmamod->rdma_ops->rdma_syncmem)(conn, handle, \
	    buff, len, direction)

#define	RDMA_BUF_ALLOC(conn, rbuf)	\
	(*(conn)->c_rdmamod->rdma_ops->rdma_buf_alloc)(conn, rbuf)

#define	RDMA_BUF_FREE(conn, rbuf)	\
	(*(conn)->c_rdmamod->rdma_ops->rdma_buf_free)(conn, rbuf)

#define	RDMA_SEND(conn, sendlist, xid)	\
	(*(conn)->c_rdmamod->rdma_ops->rdma_send)(conn, sendlist, xid)

#define	RDMA_SEND_RESP(conn, sendlist, xid)	\
	(*(conn)->c_rdmamod->rdma_ops->rdma_send_resp)(conn, sendlist, xid)

#define	RDMA_CLNT_RECVBUF(conn, cl, xid)	\
	(*(conn)->c_rdmamod->rdma_ops->rdma_clnt_recvbuf)(conn, cl, xid)

#define	RDMA_CLNT_RECVBUF_REMOVE(conn, xid)	\
	(*(conn)->c_rdmamod->rdma_ops->rdma_clnt_recvbuf_remove)(conn, xid)

#define	RDMA_SVC_RECVBUF(conn, cl)	\
	(*(conn)->c_rdmamod->rdma_ops->rdma_svc_recvbuf)(conn, cl)

#define	RDMA_RECV(conn, recvlist, xid)	\
	(*(conn)->c_rdmamod->rdma_ops->rdma_recv)(conn, recvlist, xid)

#define	RDMA_READ(conn, cl, wait)	\
	(*(conn)->c_rdmamod->rdma_ops->rdma_read)(conn, cl, wait)

#define	RDMA_WRITE(conn, cl, wait)	\
	(*(conn)->c_rdmamod->rdma_ops->rdma_write)(conn, cl, wait)

#define	RDMA_GETINFO(rdma_mod, info)	\
	(*(rdma_mod)->rdma_ops->rdma_getinfo)(info)

#ifdef _KERNEL
extern rdma_registry_t	*rdma_mod_head;
extern krwlock_t rdma_lock;		/* protects rdma_mod_head list */
extern int rdma_modloaded;		/* flag for loading RDMA plugins */
extern int rdma_dev_available;		/* rdma device is loaded or not */
extern kmutex_t rdma_modload_lock;	/* protects rdma_modloaded flag */
extern uint_t rdma_minchunk;
extern ldi_ident_t rpcmod_li; 		/* needed by layed driver framework */

/*
 * General RDMA routines
 */
extern struct clist *clist_alloc(void);
extern void clist_add(struct clist **, uint32_t, int,
	struct mrc *, caddr_t, struct mrc *, caddr_t);
extern void clist_free(struct clist *);
extern uint32_t clist_len(struct clist *);
extern void clist_zero_len(struct clist *);
extern rdma_stat clist_register(CONN *conn, struct clist *cl, clist_dstsrc);
extern rdma_stat clist_deregister(CONN *conn, struct clist *cl);
extern rdma_stat clist_syncmem(CONN *conn, struct clist *cl, clist_dstsrc);
extern rdma_stat rdma_clnt_postrecv(CONN *conn, uint32_t xid);
extern rdma_stat rdma_clnt_postrecv_remove(CONN *conn, uint32_t xid);
extern rdma_stat rdma_svc_postrecv(CONN *conn);
extern rdma_stat rdma_register_mod(rdma_mod_t *mod);
extern rdma_stat rdma_unregister_mod(rdma_mod_t *mod);
extern rdma_stat rdma_buf_alloc(CONN *, rdma_buf_t *);
extern void rdma_buf_free(CONN *, rdma_buf_t *);
extern int rdma_modload();
extern bool_t   rdma_get_wchunk(struct svc_req *, iovec_t *, struct clist *);
extern rdma_stat rdma_kwait(void);
extern int rdma_setup_read_chunks(struct clist *, uint32_t, int *);

/*
 * RDMA XDR
 */
extern void xdrrdma_create(XDR *, caddr_t, uint_t, int, struct clist *,
	enum xdr_op, CONN *);
extern void xdrrdma_destroy(XDR *);

extern uint_t xdrrdma_getpos(XDR *);
extern bool_t xdrrdma_setpos(XDR *, uint_t);
extern bool_t xdr_clist(XDR *, clist *);
extern bool_t xdr_do_clist(XDR *, clist **);
extern uint_t xdr_getbufsize(XDR *);
extern unsigned int xdrrdma_sizeof(xdrproc_t, void *, int, uint_t *, uint_t *);
extern unsigned int xdrrdma_authsize(AUTH *, struct cred *, int);

extern void xdrrdma_store_wlist(XDR *, struct clist *);
extern struct clist *xdrrdma_wclist(XDR *);
extern bool_t xdr_decode_reply_wchunk(XDR *, struct clist **);
extern bool_t xdr_decode_wlist(XDR *xdrs, struct clist **, bool_t *);
extern bool_t xdr_decode_wlist_svc(XDR *xdrs, struct clist **, bool_t *,
	uint32_t *, CONN *);
extern bool_t xdr_encode_rlist_svc(XDR *, clist *);
extern bool_t xdr_encode_wlist(XDR *, clist *);
extern bool_t xdr_encode_reply_wchunk(XDR *, struct clist *,
		uint32_t seg_array_len);
bool_t xdrrdma_getrdmablk(XDR *, struct clist **, uint_t *,
	CONN **conn, const uint_t);
bool_t xdrrdma_read_from_client(struct clist *, CONN **, uint_t);
bool_t xdrrdma_send_read_data(XDR *, uint_t, struct clist *);
bool_t xdrrdma_free_clist(CONN *, struct clist *);
#endif /* _KERNEL */

#ifdef __cplusplus
}
#endif

#endif	/* _RPC_RPC_RDMA_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
 */

/*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved	*/


/*
 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/* SVr4.0 1.1 */

/*
 * Miscellaneous support routines for kernel implementation of RPC.
 */

#include <sys/param.h>
#include <sys/t_lock.h>
#include <sys/user.h>
#include <sys/vnode.h>
#include <sys/stream.h>
#include <sys/stropts.h>
#include <sys/strsubr.h>
#include <sys/socket.h>
#include <sys/tihdr.h>
#include <sys/timod.h>
#include <sys/tiuser.h>
#include <sys/systm.h>
#include <sys/cmn_err.h>
#include <sys/debug.h>
#include <sys/sdt.h>
#include <netinet/in.h>
#include <rpc/types.h>
#include <rpc/auth.h>
#include <rpc/clnt.h>
#include <rpc/rpcb_prot.h>
#include <rpc/pmap_prot.h>

static int strtoi(char *, char **);
static void grow_netbuf(struct netbuf *, size_t);
static void loopb_u2t(const char *, struct netbuf *);

#define	RPC_PMAP_TIMEOUT	5
/*
 * define for max length of an ip address and port address, the value was
 * calculated using INET6_ADDRSTRLEN (46) + max port address (12) +
 * seperator "."'s in port address (2) + null (1) = 61.
 * Then there is IPV6_TOKEN_LEN which is 64, so the value is 64 to be safe.
 */
#define	RPC_MAX_IP_LENGTH	64

/*
 * Kernel level debugging aid. The global variable "rpclog" is a bit
 * mask which allows various types of debugging messages to be printed
 * out.
 *
 *	rpclog & 1	will cause actual failures to be printed.
 *	rpclog & 2	will cause informational messages to be
 *			printed on the client side of rpc.
 *	rpclog & 4	will cause informational messages to be
 *			printed on the server side of rpc.
 *	rpclog & 8	will cause informational messages for rare events to be
 *			printed on the client side of rpc.
 *	rpclog & 16	will cause informational messages for rare events to be
 *			printed on the server side of rpc.
 *	rpclog & 32	will cause informational messages for rare events to be
 *			printed on the common client/server code paths of rpc.
 *	rpclog & 64	will cause informational messages for manipulation
 *			client-side COTS dispatch list to be printed.
 */

uint_t rpclog = 0;


void
rpc_poptimod(vnode_t *vp)
{
	int error, isfound, ret;

	error = strioctl(vp, I_FIND, (intptr_t)"timod", 0, K_TO_K, kcred,
	    &isfound);
	if (error) {
		RPCLOG(1, "rpc_poptimod: I_FIND strioctl error %d\n", error);
		return;
	}
	if (isfound) {
		/*
		 * Pop timod module
		 */
		error = strioctl(vp, I_POP, 0, 0, K_TO_K, kcred, &ret);
		if (error) {
			RPCLOG(1, "rpc_poptimod: I_POP strioctl error %d\n",
			    error);
			return;
		}
	}
}

/*
 * Check the passed in ip address for correctness (limited) and return its
 * type.
 *
 * an ipv4 looks like this:
 * "IP.IP.IP.IP.PORT[top byte].PORT[bottom byte]"
 *
 * an ipv6 looks like this:
 * fec0:A02::2:202:4FCD
 * or
 * ::10.9.2.1
 */
int
rpc_iptype(
	char	*ipaddr,
	int	*typeval)
{
	char	*cp;
	int	chcnt = 0;
	int	coloncnt = 0;
	int	dotcnt = 0;
	int	numcnt = 0;
	int	hexnumcnt = 0;
	int	othercnt = 0;

	cp = ipaddr;

	/* search for the different type of characters in the ip address */
	while ((*cp != '\0') && (chcnt < RPC_MAX_IP_LENGTH)) {
		switch (*cp) {
		case ':':
			coloncnt++;
			break;
		case '.':
			dotcnt++;
			break;
		case '0':
		case '1':
		case '2':
		case '3':
		case '4':
		case '5':
		case '6':
		case '7':
		case '8':
		case '9':
			numcnt++;
			break;
		case 'a':
		case 'A':
		case 'b':
		case 'B':
		case 'c':
		case 'C':
		case 'd':
		case 'D':
		case 'e':
		case 'E':
		case 'f':
		case 'F':
			hexnumcnt++;
			break;
		default:
			othercnt++;
			break;
		}
		chcnt++;
		cp++;
	}

	/* check for bad ip strings */
	if ((chcnt == RPC_MAX_IP_LENGTH) || (othercnt))
		return (-1);

	/* if we have a coloncnt, it can only be an ipv6 address */
	if (coloncnt) {
		if ((coloncnt < 2) || (coloncnt > 7))
			return (-1);

		*typeval = AF_INET6;
	} else {
		/* since there are no colons, make sure it is ipv4 */
		if ((hexnumcnt) || (dotcnt != 5))
			return (-1);

		*typeval = AF_INET;
	}
	return (0);
}

/*
 * Return a port number from a sockaddr_in expressed in universal address
 * format.  Note that this routine does not work for address families other
 * than INET.  Eventually, we should replace this routine with one that
 * contacts the rpcbind running locally.
 */
int
rpc_uaddr2port(int af, char *addr)
{
	int p1;
	int p2;
	char *next, *p;

	if (af == AF_INET) {
		/*
		 * A struct sockaddr_in expressed in universal address
		 * format looks like:
		 *
		 *	"IP.IP.IP.IP.PORT[top byte].PORT[bottom byte]"
		 *
		 * Where each component expresses as a character,
		 * the corresponding part of the IP address
		 * and port number.
		 * Thus 127.0.0.1, port 2345 looks like:
		 *
		 *	49 50 55 46 48 46 48 46 49 46 57 46 52 49
		 *	1  2  7  .  0  .  0  .  1  .  9  .  4  1
		 *
		 * 2345 = 929base16 = 9.32+9 = 9.41
		 */
		(void) strtoi(addr, &next);
		(void) strtoi(next, &next);
		(void) strtoi(next, &next);
		(void) strtoi(next, &next);
		p1 = strtoi(next, &next);
		p2 = strtoi(next, &next);

	} else if (af == AF_INET6) {
		/*
		 * An IPv6 address is expressed in following two formats
		 * fec0:A02::2:202:4FCD or
		 * ::10.9.2.1
		 * An universal address will have porthi.portlo appended to
		 * v6 address. So always look for the last two dots when
		 * extracting port number.
		 */
		next = addr;
		while (next = strchr(next, '.')) {
			p = ++next;
			next = strchr(next, '.');
			next++;
		}
		p1 = strtoi(p, &p);
		p2 = strtoi(p, &p);
		RPCLOG(1, "rpc_uaddr2port: IPv6 port %d\n", ((p1 << 8) + p2));
	}

	return ((p1 << 8) + p2);
}

/*
 * Modified strtol(3).  Should we be using mi_strtol() instead?
 */
static int
strtoi(char *str, char **ptr)
{
	int c;
	int val;

	for (val = 0, c = *str++; c >= '0' && c <= '9'; c = *str++) {
		val *= 10;
		val += c - '0';
	}
	*ptr = str;
	return (val);
}

/*
 * Utilities for manipulating netbuf's.
 *
 * Note that loopback addresses are not null-terminated, so these utilities
 * typically use the strn* string routines.
 */

/*
 * Utilities to patch a port number (for NC_INET protocols) or a
 *	port name (for NC_LOOPBACK) into a network address.
 */


/*
 * PSARC 2003/523 Contract Private Interface
 * put_inet_port
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
void
put_inet_port(struct netbuf *addr, ushort_t port)
{
	/*
	 * Easy - we always patch an unsigned short on top of an
	 * unsigned short.  No changes to addr's len or maxlen are
	 * necessary.
	 */
	((struct sockaddr_in *)(addr->buf))->sin_port = port;
}

void
put_inet6_port(struct netbuf *addr, ushort_t port)
{
	((struct sockaddr_in6 *)(addr->buf))->sin6_port = port;
}

void
put_loopback_port(struct netbuf *addr, char *port)
{
	char *dot;
	char *newbuf;
	int newlen;


	/*
	 * We must make sure the addr has enough space for us,
	 * patch in `port', and then adjust addr's len and maxlen
	 * to reflect the change.
	 */
	if ((dot = strnrchr(addr->buf, '.', addr->len)) == (char *)NULL)
		return;

	newlen = (int)((dot - addr->buf + 1) + strlen(port));
	if (newlen > addr->maxlen) {
		newbuf = kmem_zalloc(newlen, KM_SLEEP);
		bcopy(addr->buf, newbuf, addr->len);
		kmem_free(addr->buf, addr->maxlen);
		addr->buf = newbuf;
		addr->len = addr->maxlen = newlen;
		dot = strnrchr(addr->buf, '.', addr->len);
	} else {
		addr->len = newlen;
	}

	(void) strncpy(++dot, port, strlen(port));
}

/*
 * Convert a loopback universal address to a loopback transport address.
 */
static void
loopb_u2t(const char *ua, struct netbuf *addr)
{
	size_t stringlen = strlen(ua) + 1;
	const char *univp;		/* ptr into universal addr */
	char *transp;			/* ptr into transport addr */

	/* Make sure the netbuf will be big enough. */
	if (addr->maxlen < stringlen) {
		grow_netbuf(addr, stringlen);
	}

	univp = ua;
	transp = addr->buf;
	while (*univp != '\0') {
		if (*univp == '\\' && *(univp+1) == '\\') {
			*transp = '\\';
			univp += 2;
		} else if (*univp == '\\') {
			/* octal character */
			*transp = (((*(univp+1) - '0') & 3) << 6) +
			    (((*(univp+2) - '0') & 7) << 3) +
			    ((*(univp+3) - '0') & 7);
			univp += 4;
		} else {
			*transp = *univp;
			univp++;
		}
		transp++;
	}

	addr->len = (unsigned int)(transp - addr->buf);
	ASSERT(addr->len <= addr->maxlen);
}

/*
 * Make sure the given netbuf has a maxlen at least as big as the given
 * length.
 */
static void
grow_netbuf(struct netbuf *nb, size_t length)
{
	char *newbuf;

	if (nb->maxlen >= length)
		return;

	newbuf = kmem_zalloc(length, KM_SLEEP);
	bcopy(nb->buf, newbuf, nb->len);
	kmem_free(nb->buf, nb->maxlen);
	nb->buf = newbuf;
	nb->maxlen = (unsigned int)length;
}

/*
 * XXX: xdr_pmap is here, because it's the only XDR function
 * of portmap protocol. If there'll be more portmap functions,
 * it would be better to put them to a separate file.
 */
bool_t
xdr_pmap(XDR *xdrs, PMAP *objp)
{
	if (!xdr_rpcprog(xdrs, &objp->pm_prog))
		return (FALSE);
	if (!xdr_rpcvers(xdrs, &objp->pm_vers))
		return (FALSE);
	if (!xdr_rpcprot(xdrs, &objp->pm_prot))
		return (FALSE);
	if (!xdr_u_int(xdrs, &objp->pm_port))
		return (FALSE);

	return (TRUE);
}

/*
 * Get remote port via PORTMAP protocol version 2 (works for IPv4 only)
 * according to RFC 1833, section 3.
 */
static enum clnt_stat
portmap_getport(struct knetconfig *config, rpcprog_t prog, rpcvers_t vers,
    struct netbuf *addr, struct timeval tmo)
{
	enum clnt_stat status;
	CLIENT *client = NULL;
	k_sigset_t oldmask;
	k_sigset_t newmask;
	ushort_t port = 0;
	struct pmap parms;

	ASSERT(strcmp(config->knc_protofmly, NC_INET) == 0);

	bzero(&parms, sizeof (parms));
	parms.pm_prog = prog;
	parms.pm_vers = vers;
	if (strcmp(config->knc_proto, NC_TCP) == 0) {
		parms.pm_prot = IPPROTO_TCP;
	} else { /*  NC_UDP */
		parms.pm_prot = IPPROTO_UDP;
	}


	/*
	 * Mask all signals before doing RPC network operations
	 * in the same way rpcbind_getaddr() does (see comments
	 * there).
	 */
	sigfillset(&newmask);
	sigreplace(&newmask, &oldmask);

	if (clnt_tli_kcreate(config, addr, PMAPPROG,
	    PMAPVERS, 0, 0, CRED(), &client)) {
		sigreplace(&oldmask, (k_sigset_t *)NULL);
		return (RPC_TLIERROR);
	}

	client->cl_nosignal = 1;
	status = CLNT_CALL(client, PMAPPROC_GETPORT,
	    xdr_pmap, (char *)&parms,
	    xdr_u_short, (char *)&port, tmo);

	sigreplace(&oldmask, (k_sigset_t *)NULL);
	if (status != RPC_SUCCESS)
		goto out;
	if (port == 0) {
		status = RPC_PROGNOTREGISTERED;
		goto out;
	}

	put_inet_port(addr, ntohs(port));

out:
	auth_destroy(client->cl_auth);
	clnt_destroy(client);

	return (status);
}

enum clnt_stat
rpcbind_getaddr(struct knetconfig *config, rpcprog_t prog, rpcvers_t vers,
    struct netbuf *addr)
{
	return (rpcbind_getaddr5(config, prog, vers, addr, NULL));
}

/*
 * Try to get the address for the desired service by using the rpcbind
 * protocol.  Ignores signals.  If addr is a loopback address, it is
 * expected to be initialized to "localhost.".
 * rpcbind_getaddr() is able to work with RPCBIND protocol version 3 and 4
 * and PORTMAP protocol version 2.
 * It tries version 4 at first, then version 3 and finally (if both failed)
 * it tries portmapper protocol version 2.
 */
enum clnt_stat
rpcbind_getaddr5(struct knetconfig *config, rpcprog_t prog, rpcvers_t vers,
    struct netbuf *addr, struct netbuf *laddr)
{
	char *ua = NULL;
	enum clnt_stat status;
	RPCB parms;
	struct timeval tmo;
	k_sigset_t oldmask;
	k_sigset_t newmask;
	ushort_t port;
	int iptype;
	rpcvers_t rpcbv;

	/*
	 * Call rpcbind (local or remote) to get an address we can use
	 * in an RPC client handle.
	 */
	tmo.tv_sec = RPC_PMAP_TIMEOUT;
	tmo.tv_usec = 0;
	parms.r_prog = prog;
	parms.r_vers = vers;
	parms.r_addr = parms.r_owner = "";

	if (strcmp(config->knc_protofmly, NC_INET) == 0) {
		put_inet_port(addr, htons(PMAPPORT));

		if (strcmp(config->knc_proto, NC_TCP) == 0)
			parms.r_netid = "tcp";
		else
			parms.r_netid = "udp";

	} else if (strcmp(config->knc_protofmly, NC_INET6) == 0) {
		if (strcmp(config->knc_proto, NC_TCP) == 0)
			parms.r_netid = "tcp6";
		else
			parms.r_netid = "udp6";
		put_inet6_port(addr, htons(PMAPPORT));
	} else if (strcmp(config->knc_protofmly, NC_LOOPBACK) == 0) {
		ASSERT(strnrchr(addr->buf, '.', addr->len) != NULL);
		if (config->knc_semantics == NC_TPI_COTS_ORD)
			parms.r_netid = "ticotsord";
		else if (config->knc_semantics == NC_TPI_COTS)
			parms.r_netid = "ticots";
		else
			parms.r_netid = "ticlts";

		put_loopback_port(addr, "rpc");
	} else {
		status = RPC_UNKNOWNPROTO;
		goto out;
	}

	/*
	 * Try RPCBIND versions 4 and 3 (if 4 fails).
	 */
	for (rpcbv = RPCBVERS4; rpcbv >= RPCBVERS; rpcbv--) {
		CLIENT *client = NULL;

		if (ua != NULL) {
			xdr_free(xdr_wrapstring, (char *)&ua);
			ua = NULL;
		}

		/*
		 * Mask signals for the duration of the handle creation and
		 * RPC calls.  This allows relatively normal operation with a
		 * signal already posted to our thread (e.g., when we are
		 * sending an NLM_CANCEL in response to catching a signal).
		 *
		 * Any further exit paths from this routine must restore
		 * the original signal mask.
		 */
		sigfillset(&newmask);
		sigreplace(&newmask, &oldmask);

		if (clnt_tli_kcreate(config, addr, RPCBPROG,
		    rpcbv, 0, 0, CRED(), &client)) {
			status = RPC_TLIERROR;
			sigreplace(&oldmask, (k_sigset_t *)NULL);
			continue;
		}

		if (laddr != NULL) {
			if (!clnt_control(client, CLSET_BINDSRCADDR,
			    (char *)laddr)) {
				cmn_err(CE_WARN, "rpcbind_getaddr: "
				    "Unable to set CLSET_BINDSRCADDR\n");
			}
		}

		client->cl_nosignal = 1;
		status = CLNT_CALL(client, RPCBPROC_GETADDR,
		    xdr_rpcb, (char *)&parms,
		    xdr_wrapstring, (char *)&ua, tmo);

		sigreplace(&oldmask, (k_sigset_t *)NULL);
		auth_destroy(client->cl_auth);
		clnt_destroy(client);

		if (status == RPC_SUCCESS) {
			if (ua == NULL || *ua == '\0') {
				status = RPC_PROGNOTREGISTERED;
				continue;
			}

			break;
		}
	}
	if (status != RPC_SUCCESS)
		goto try_portmap;

	/*
	 * Convert the universal address to the transport address.
	 * Theoretically, we should call the local rpcbind to translate
	 * from the universal address to the transport address, but it gets
	 * complicated (e.g., there's no direct way to tell rpcbind that we
	 * want an IP address instead of a loopback address).  Note that
	 * the transport address is potentially host-specific, so we can't
	 * just ask the remote rpcbind, because it might give us the wrong
	 * answer.
	 */
	if (strcmp(config->knc_protofmly, NC_INET) == 0) {
		/* make sure that the ip address is the correct type */
		if (rpc_iptype(ua, &iptype) != 0) {
			status = RPC_UNKNOWNADDR;
			goto try_portmap;
		}
		port = rpc_uaddr2port(iptype, ua);
		put_inet_port(addr, ntohs(port));
	} else if (strcmp(config->knc_protofmly, NC_INET6) == 0) {
		/* make sure that the ip address is the correct type */
		if (rpc_iptype(ua, &iptype) != 0) {
			status = RPC_UNKNOWNADDR;
			goto try_portmap;
		}
		port = rpc_uaddr2port(iptype, ua);
		put_inet6_port(addr, ntohs(port));
	} else if (strcmp(config->knc_protofmly, NC_LOOPBACK) == 0) {
		loopb_u2t(ua, addr);
	} else {
		/* "can't happen" - should have been checked for above */
		cmn_err(CE_PANIC, "rpcbind_getaddr: bad protocol family");
	}

try_portmap:
	if (status != RPC_SUCCESS &&
	    strcmp(config->knc_protofmly, NC_INET) == 0) {
		/*
		 * For IPv4 try to get remote port via PORTMAP protocol.
		 * NOTE: if we're here, then all attempts to get remote
		 * port via RPCBIND protocol failed.
		 */

		DTRACE_PROBE1(try__portmap, enum clnt_stat, status);
		status = portmap_getport(config, prog, vers, addr, tmo);
	}

out:
	if (ua != NULL)
		xdr_free(xdr_wrapstring, (char *)&ua);
	return (status);
}

static const char *tpiprims[] = {
	"T_CONN_REQ      0        connection request",
	"T_CONN_RES      1        connection response",
	"T_DISCON_REQ    2        disconnect request",
	"T_DATA_REQ      3        data request",
	"T_EXDATA_REQ    4        expedited data request",
	"T_INFO_REQ      5        information request",
	"T_BIND_REQ      6        bind request",
	"T_UNBIND_REQ    7        unbind request",
	"T_UNITDATA_REQ  8        unitdata request",
	"T_OPTMGMT_REQ   9        manage options req",
	"T_ORDREL_REQ    10       orderly release req",
	"T_CONN_IND      11       connection indication",
	"T_CONN_CON      12       connection confirmation",
	"T_DISCON_IND    13       disconnect indication",
	"T_DATA_IND      14       data indication",
	"T_EXDATA_IND    15       expeditied data indication",
	"T_INFO_ACK      16       information acknowledgment",
	"T_BIND_ACK      17       bind acknowledment",
	"T_ERROR_ACK     18       error acknowledgment",
	"T_OK_ACK        19       ok acknowledgment",
	"T_UNITDATA_IND  20       unitdata indication",
	"T_UDERROR_IND   21       unitdata error indication",
	"T_OPTMGMT_ACK   22       manage options ack",
	"T_ORDREL_IND    23       orderly release ind"
};


const char *
rpc_tpiprim2name(uint_t prim)
{
	if (prim > (sizeof (tpiprims) / sizeof (tpiprims[0]) - 1))
		return ("unknown primitive");

	return (tpiprims[prim]);
}

static const char *tpierrs[] = {
	"error zero      0",
	"TBADADDR        1        incorrect addr format",
	"TBADOPT         2        incorrect option format",
	"TACCES          3        incorrect permissions",
	"TBADF           4        illegal transport fd",
	"TNOADDR         5        couldn't allocate addr",
	"TOUTSTATE       6        out of state",
	"TBADSEQ         7        bad call sequnce number",
	"TSYSERR         8        system error",
	"TLOOK           9        event requires attention",
	"TBADDATA        10       illegal amount of data",
	"TBUFOVFLW       11       buffer not large enough",
	"TFLOW           12       flow control",
	"TNODATA         13       no data",
	"TNODIS          14       discon_ind not found on q",
	"TNOUDERR        15       unitdata error not found",
	"TBADFLAG        16       bad flags",
	"TNOREL          17       no ord rel found on q",
	"TNOTSUPPORT     18       primitive not supported",
	"TSTATECHNG      19       state is in process of changing"
};


const char *
rpc_tpierr2name(uint_t err)
{
	if (err > (sizeof (tpierrs) / sizeof (tpierrs[0]) - 1))
		return ("unknown error");

	return (tpierrs[err]);
}

/*
 * derive  the code from user land inet_top6
 * convert IPv6 binary address into presentation (printable) format
 */
#define	INADDRSZ	4
#define	IN6ADDRSZ	16
#define	INT16SZ	2
const char *
kinet_ntop6(uchar_t *src, char *dst, size_t size)
{
	/*
	 * Note that int32_t and int16_t need only be "at least" large enough
	 * to contain a value of the specified size.  On some systems, like
	 * Crays, there is no such thing as an integer variable with 16 bits.
	 * Keep this in mind if you think this function should have been coded
	 * to use pointer overlays.  All the world's not a VAX.
	 */
	char tmp[sizeof ("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")];
	char *tp;
	struct { int base, len; } best, cur;
	uint_t words[IN6ADDRSZ / INT16SZ];
	int i;
	size_t len; /* this is used to track the sprintf len */

	/*
	 * Preprocess:
	 * Copy the input (bytewise) array into a wordwise array.
	 * Find the longest run of 0x00's in src[] for :: shorthanding.
	 */

	bzero(words, sizeof (words));
	for (i = 0; i < IN6ADDRSZ; i++)
		words[i / 2] |= (src[i] << ((1 - (i % 2)) << 3));
	best.base = -1;
	cur.base = -1;

	for (i = 0; i < (IN6ADDRSZ / INT16SZ); i++) {
		if (words[i] == 0) {
			if (cur.base == -1)
				cur.base = i, cur.len = 1;
			else
				cur.len++;
		} else {
			if (cur.base != -1) {
				if (best.base == -1 || cur.len > best.len)
					best = cur;
				cur.base = -1;
			}
		}
	}
	if (cur.base != -1) {
		if (best.base == -1 || cur.len > best.len)
			best = cur;
	}

	if (best.base != -1 && best.len < 2)
		best.base = -1;

	/*
	 * Format the result.
	 */
	tp = tmp;
	for (i = 0; i < (IN6ADDRSZ / INT16SZ); i++) {
		/* Are we inside the best run of 0x00's? */
		if (best.base != -1 && i >= best.base &&
		    i < (best.base + best.len)) {
			if (i == best.base)
				*tp++ = ':';
			continue;
		}
		/* Are we following an initial run of 0x00s or any real hex? */
		if (i != 0)
			*tp++ = ':';
		(void) sprintf(tp, "%x", words[i]);
		len = strlen(tp);
		tp += len;
	}
	/* Was it a trailing run of 0x00's? */
	if (best.base != -1 && (best.base + best.len) == (IN6ADDRSZ / INT16SZ))
		*tp++ = ':';
	*tp++ = '\0';

	/*
	 * Check for overflow, copy, and we're done.
	 */
	if ((int)(tp - tmp) > size) {
		return (NULL);
	}
	(void) strcpy(dst, tmp);
	return (dst);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 1993-1997 Sun Microsystems, Inc.
 * All rights reserved.
 */

/*
 * XDR routines for generic types that have explicit sizes.
 */

#include <rpc/rpc_sztypes.h>

/*
 * The new NFS protocol uses typedefs to name objects according to their
 * length (32 bits, 64 bits).  These objects appear in both the NFS and KLM
 * code, so the xdr routines live here.
 */

bool_t
xdr_uint64(XDR *xdrs, uint64 *objp)
{
	return (xdr_u_longlong_t(xdrs, objp));
}

bool_t
xdr_int64(XDR *xdrs, int64 *objp)
{
	return (xdr_longlong_t(xdrs, objp));
}

bool_t
xdr_uint32(XDR *xdrs, uint32 *objp)
{
	return (xdr_u_int(xdrs, objp));
}

bool_t
xdr_int32(XDR *xdrs, int32 *objp)
{
	return (xdr_int(xdrs, objp));
}
/*
 * Please do not edit this file.
 * It was generated using rpcgen.
 */

#ifndef _RPC_SZTYPES_H_RPCGEN
#define	_RPC_SZTYPES_H_RPCGEN

#include <rpc/rpc.h>

#ifdef __cplusplus
extern "C" {
#endif


typedef u_longlong_t uint64;

typedef longlong_t int64;

typedef u_int uint32;

typedef int int32;

/* the xdr functions */

#if defined(__STDC__) || defined(__cplusplus)
extern  bool_t xdr_uint64(XDR *, uint64*);
extern  bool_t xdr_int64(XDR *, int64*);
extern  bool_t xdr_uint32(XDR *, uint32*);
extern  bool_t xdr_int32(XDR *, int32*);

#else /* K&R C */
extern bool_t xdr_uint64();
extern bool_t xdr_int64();
extern bool_t xdr_uint32();
extern bool_t xdr_int32();

#endif /* K&R C */

#ifdef __cplusplus
}
#endif

#endif /* !_RPC_SZTYPES_H_RPCGEN */
/*
 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 *
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Definitions for primitive types that are explicitly sized.
 */

typedef unsigned hyper	uint64;
typedef hyper		int64;

typedef unsigned int	uint32;
typedef int		int32;
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */


#include <sys/param.h>
#include <sys/types.h>
#include <sys/user.h>
#include <sys/systm.h>
#include <sys/sysmacros.h>
#include <sys/errno.h>
#include <sys/kmem.h>
#include <sys/debug.h>
#include <sys/systm.h>
#include <sys/kstat.h>
#include <sys/sdt.h>
#include <sys/ddi.h>
#include <sys/cmn_err.h>
#include <sys/time.h>
#include <sys/list.h>

#include <rpc/types.h>
#include <rpc/xdr.h>
#include <rpc/clnt.h>
#include <rpc/rpc_msg.h>
#include <rpc/svc.h>
#include <rpc/rpc_tags.h>

static int rpc_cmp_tag_nolock(rpc_xprt_taglist_t *, void *);

/*
 * Initialize a global rpc tags list for a particular xprt type.
 * taglst_off is the offset of the xprt's tag list in the
 * specific xprt type.
 */

void
rpc_taghd_init(rpc_tag_hd_t *taghd, offset_t taglst_off)
{
	mutex_init(&taghd->rth_lock, NULL, MUTEX_DEFAULT, NULL);
	list_create(&taghd->rth_list, sizeof (rpc_tag_t),
	    offsetof(rpc_tag_t, rt_next));
	taghd->rth_xpoff = taglst_off;
}

void
rpc_taghd_destroy(rpc_tag_hd_t *taghd)
{
	mutex_destroy(&taghd->rth_lock);
	list_destroy(&taghd->rth_list);
}

/*
 * Initialize a xprt's tag list
 */

void
rpc_init_taglist(void **xlst)
{
	rpc_xprt_taglist_t *xptlst;

	xptlst = kmem_zalloc(sizeof (rpc_xprt_taglist_t), KM_SLEEP);

	mutex_init(&xptlst->rxtl_lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&xptlst->rxtl_cv, NULL, CV_DEFAULT, NULL);
	list_create(&xptlst->rxtl_list, sizeof (rpc_xprt_tag_t),
	    offsetof(rpc_xprt_tag_t, rxt_next));
	*xlst = (void *)xptlst;
}

void
rpc_destroy_taglist(void **xlst)
{
	rpc_xprt_taglist_t *xptlst;

	xptlst = (rpc_xprt_taglist_t *)*xlst;
	mutex_destroy(&xptlst->rxtl_lock);
	cv_destroy(&xptlst->rxtl_cv);
	ASSERT(list_is_empty(&xptlst->rxtl_list));
	list_destroy(&xptlst->rxtl_list);

	kmem_free(xptlst, sizeof (rpc_xprt_taglist_t));
	*xlst = NULL;
}

void
rpc_tag_rele_nolock(rpc_tag_t *tag)
{

	ASSERT(mutex_owned(&(tag)->rt_lock));
	ASSERT((tag)->rt_ref >= 1);
	(tag)->rt_ref--;
	DTRACE_PROBE1(rpc__tag__rele, rpc_tag_t *, tag);
	if ((tag)->rt_ref == 0)
		cv_signal(&(tag)->rt_cv);
}

void
rpc_tag_rele(rpc_tag_t *tag)
{
	mutex_enter(&tag->rt_lock);
	rpc_tag_rele_nolock(tag);
	mutex_exit(&tag->rt_lock);
}

void
rpc_tag_hold(rpc_tag_t *tag)
{
	mutex_enter(&tag->rt_lock);
	RPC_TAG_HOLD_LOCKED(tag);
	mutex_exit(&tag->rt_lock);
}

/*
 * Lookup a tag from a given tag list
 * If a tag is not found and if creat == TRUE, creates a new
 * tag and adds it to the list.
 */

rpc_tag_t *
rpc_lookup_tag(rpc_tag_hd_t *taghd, void *tgid, int creat)
{
	rpc_tag_t *tag;
	mutex_enter(&taghd->rth_lock);
	tag = list_head(&taghd->rth_list);
	while (tag) {
		if (RPC_TAG_CMP(tag->rt_id, tgid) == 0) {
			mutex_enter(&tag->rt_lock);
			RPC_TAG_HOLD_LOCKED(tag);
			mutex_exit(&tag->rt_lock);
			mutex_exit(&taghd->rth_lock);
			return (tag);
		}
		tag = list_next(&taghd->rth_list, tag);
	}

	if (creat == FALSE) {
		mutex_exit(&taghd->rth_lock);
		return (NULL);
	}

	/*
	 * Create a new one
	 */
	tag = (rpc_tag_t *)kmem_zalloc(sizeof (rpc_tag_t), KM_SLEEP);
	bcopy(tgid, tag->rt_id, sizeof (tagid));

	mutex_init(&tag->rt_lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&tag->rt_cv, NULL, CV_DEFAULT, NULL);
	list_create(&tag->rt_xplist, sizeof (rpc_tag_xprt_t),
	    offsetof(rpc_tag_xprt_t, rtx_xprt_next));

	/*
	 * Insert onto the global tags list
	 */

	list_insert_tail(&taghd->rth_list, tag);
	tag->rt_ref = 1;

	mutex_exit(&taghd->rth_lock);
	return (tag);

}

/*
 * Given a tag, return the next xprt on the tag's xprt list.
 * A cookie "last" is passed between this function and the caller.
 * Returns the head of the xprt list if the cookie is NULL.
 * Expects tag->rt_lock to be held.
 */

void *
rpc_get_next_xprt(rpc_tag_t *tag, void **last)
{
	rpc_tag_xprt_t *rtxp = (rpc_tag_xprt_t *)*last;

	if (rtxp == NULL)
		rtxp = list_head(&tag->rt_xplist);
	else
		rtxp = list_next(&tag->rt_xplist, rtxp);

	*last = (void *)rtxp;

	/* list empty */
	if (rtxp == NULL)
		return (NULL);

	return (rtxp->rtx_xprt);

}

/*
 * Given a xprt's tagslist, compare tags. Returns TRUE if a tag
 * corresponding to the given tagid value is already present, FALSE if not.
 */
int
rpc_cmp_tag(void *xlst, void *tgid)
{
	rpc_xprt_taglist_t *xtlst;
	int ret;

	xtlst = (rpc_xprt_taglist_t *)xlst;

	mutex_enter(&xtlst->rxtl_lock);
	ret = rpc_cmp_tag_nolock(xtlst, tgid);
	mutex_exit(&xtlst->rxtl_lock);
	return (ret);
}

/*
 * requires the rxtl_lock to be held
 */

static int
rpc_cmp_tag_nolock(rpc_xprt_taglist_t *xtlst, void *tgid)
{
	rpc_xprt_tag_t *xptag;

	/*
	 * If another thread is destroying xptags, wait
	 * till it finishes.
	 */
	if (xtlst->rxtl_flags & RPC_XP_TGL_DESTROY) {
		cv_wait(&xtlst->rxtl_cv, &xtlst->rxtl_lock);
	}

	xptag = list_head(&xtlst->rxtl_list);
	while (xptag) {
		if (bcmp(tgid, xptag->rxt_tag->rt_id, sizeof (tagid)) == 0) {
			return (TRUE);
		}
		xptag = list_next(&xtlst->rxtl_list, xptag);
	}
	return (FALSE);
}

/*
 * Given a tagid, add a tag. Adds xprt to the tag's xprt list
 * and tag to the xprt's tag list.
 */

void
rpc_add_tag(rpc_tag_hd_t *taghd, void *xprt, void *tgid)
{
	rpc_xprt_taglist_t *xtlst;
	rpc_xprt_tag_t *xptag;
	rpc_tag_t *tag;
	rpc_tag_xprt_t *rtxp;

	/*
	 * rpc_lookup_tag() allocates a new tag if none present
	 * for the tagid or adds a reference to the tag if already
	 * allocated.
	 */

	tag = rpc_lookup_tag(taghd, tgid, TRUE);


	xtlst = *(XPRT2TLST(xprt, taghd->rth_xpoff));

	mutex_enter(&xtlst->rxtl_lock);

	/*
	 * Verify that the tag is not already on the list
	 */

	if (rpc_cmp_tag_nolock(xtlst, tgid)) {
		mutex_exit(&xtlst->rxtl_lock);
		return;
	}

	xptag = kmem_zalloc(sizeof (rpc_xprt_tag_t), KM_SLEEP);
	xptag->rxt_tag = tag;

	/*
	 * add into the xprt's tag list
	 */
	list_insert_tail(&xtlst->rxtl_list, xptag);
	mutex_exit(&xtlst->rxtl_lock);

	/*
	 * next add the xprt to the tags conn list
	 */
	rtxp = kmem_zalloc(sizeof (rpc_tag_xprt_t), KM_SLEEP);
	rtxp->rtx_xprt = xprt;
	mutex_enter(&tag->rt_lock);
	list_insert_tail(&tag->rt_xplist, rtxp);
	mutex_exit(&tag->rt_lock);
}

/*
 * Given an xprt remove a particular tag.
 */

void
rpc_remove_tag(rpc_tag_hd_t *tghd, void *xprt, void *tgid)
{
	rpc_xprt_tag_t *xptag;
	rpc_xprt_taglist_t *xtlst;

	/*
	 * we really need a tagid
	 */
	if (tgid == NULL)
		return;

	xtlst = *(XPRT2TLST(xprt, tghd->rth_xpoff));

	mutex_enter(&xtlst->rxtl_lock);

	/*
	 * If another thread is destroying xptags, wait
	 * till it finishes.
	 */
	if (xtlst->rxtl_flags & RPC_XP_TGL_DESTROY) {
		cv_wait(&xtlst->rxtl_cv, &xtlst->rxtl_lock);
	}

	xptag = list_head(&xtlst->rxtl_list);

	while (xptag) {
		/*
		 * if different tagid, skip it.
		 */
		if (bcmp(xptag->rxt_tag->rt_id, tgid, sizeof (tagid)) != 0) {
			xptag = list_next(&xtlst->rxtl_list, xptag);
			continue;
		}

		list_remove(&xtlst->rxtl_list, xptag);

		kmem_free(xptag, sizeof (rpc_xprt_tag_t));

		break;
	}

	mutex_exit(&xtlst->rxtl_lock);

}

/*
 * Given an xprt remove all tags and for each tag, remove the xprt
 * from the tag's xprt list as well.
 */

void
rpc_remove_all_tag(rpc_tag_hd_t *tghd, void *xprt)
{
	rpc_xprt_tag_t *xptag;
	rpc_xprt_taglist_t *xtlst;
	rpc_tag_t *tag;

	xtlst = *(XPRT2TLST(xprt, tghd->rth_xpoff));

	mutex_enter(&xtlst->rxtl_lock);
	xtlst->rxtl_flags |= RPC_XP_TGL_DESTROY;
	xptag = list_head(&xtlst->rxtl_list);

	while (xptag) {
		list_remove(&xtlst->rxtl_list, xptag);
		mutex_exit(&xtlst->rxtl_lock);

		tag = xptag->rxt_tag;
		/*
		 * While we have the tag, remove the xprt
		 * from the tags conn list
		 */
		mutex_enter(&tag->rt_lock);
		rpc_remove_xprt(tghd, tag, xprt);
		mutex_exit(&tag->rt_lock);

		kmem_free(xptag, sizeof (rpc_xprt_tag_t));

		mutex_enter(&xtlst->rxtl_lock);

		/* continue removing the tags */

		xptag = list_head(&xtlst->rxtl_list);
	}

	xtlst->rxtl_flags &= ~RPC_XP_TGL_DESTROY;
	cv_signal(&xtlst->rxtl_cv);
	mutex_exit(&xtlst->rxtl_lock);
}

/*
 * Return true if xprt's tag list is empty
 */

int
rpc_is_taglist_empty(void *xlst)
{
	int ret;
	rpc_xprt_taglist_t *xtlst;

	xtlst = (rpc_xprt_taglist_t *)xlst;
	mutex_enter(&xtlst->rxtl_lock);
	ret = list_is_empty(&xtlst->rxtl_list);
	mutex_exit(&xtlst->rxtl_lock);
	return (ret);
}


/*
 * Given a tag and xprt, remove the xprt from the
 * tag. Callers must hold tag->rt_lock.
 */
/* ARGSUSED */
void
rpc_remove_xprt(rpc_tag_hd_t *taghd, rpc_tag_t *tag, void *xprt)
{
	rpc_tag_xprt_t *rtxp;

	ASSERT(MUTEX_HELD(&tag->rt_lock));

	rtxp = list_head(&tag->rt_xplist);
	ASSERT(rtxp != NULL);

	while (rtxp) {
		if (rtxp->rtx_xprt == xprt) {
			list_remove(&tag->rt_xplist, rtxp);
			kmem_free(rtxp, sizeof (rpc_tag_xprt_t));
			RPC_TAG_RELE_LOCKED(tag);
			break;
		}
		rtxp = list_next(&tag->rt_xplist, rtxp);
	}
}

/*
 * Given a tag remove all xprt from the tag, and for each xprt
 * remove the tag from the xprt's tag list. Callers must hold tag->rt_lock.
 */
void
rpc_remove_all_xprt(rpc_tag_hd_t *taghd, rpc_tag_t *tag)
{
	rpc_tag_xprt_t *rtxp;

	ASSERT(MUTEX_HELD(&tag->rt_lock));

	rtxp = list_head(&tag->rt_xplist);
	ASSERT(rtxp != NULL);

	while (rtxp) {
		list_remove(&tag->rt_xplist, rtxp);
		rpc_remove_tag(taghd, rtxp->rtx_xprt, tag->rt_id);
		kmem_free(rtxp, sizeof (rpc_tag_xprt_t));
		RPC_TAG_RELE_LOCKED(tag);
		rtxp = list_head(&tag->rt_xplist);
	}
}

/*
 * Function to swap tag values
 */

int
rpc_tag_swap(rpc_tag_hd_t *taghd, void *oldtag, void *newtag)
{
	rpc_tag_t *tag;

	tag = rpc_lookup_tag(taghd, oldtag, FALSE);

	if (tag == NULL)
		return (FALSE);

	mutex_enter(&tag->rt_lock);
	bcopy(newtag, tag->rt_id, sizeof (tagid));
	RPC_TAG_RELE_LOCKED(tag);
	mutex_exit(&tag->rt_lock);

	return (TRUE);
}

/*
 * Given a tagid, remove all connections associated with it
 * and destroy it.
 */

void
rpc_destroy_tag(rpc_tag_hd_t *taghd, void *tgid)
{
	rpc_tag_t *tag;

	tag = rpc_lookup_tag(taghd, tgid, FALSE);

	if (tag == NULL)
		return;

	mutex_enter(&tag->rt_lock);

	/*
	 * Another thread already in destroy.
	 */
	if (tag->rt_flags & RPC_TAG_DESTROY) {
		RPC_TAG_RELE_LOCKED(tag);
		mutex_exit(&tag->rt_lock);
		return;
	}
	tag->rt_flags |= RPC_TAG_DESTROY;
	mutex_exit(&tag->rt_lock);

	/*
	 * First remove from the global tag list
	 */
	mutex_enter(&taghd->rth_lock);
	list_remove(&taghd->rth_list, tag);
	mutex_exit(&taghd->rth_lock);

	/*
	 * Next remove any connections associated with this tag.
	 */
	mutex_enter(&tag->rt_lock);

	/*
	 * Release the refcnt acquired by rpc_lookup_tag()
	 */
	RPC_TAG_RELE_LOCKED(tag);

tryagain:
	/*
	 * Iterate through all the connections in this tag,
	 * dis-associating the tag from the xprt and xprt from
	 * the tag.
	 */

	rpc_remove_all_xprt(taghd, tag);

	/*
	 * Someone else has snuck in before we removed from
	 * the global tag list, wait till they finish and try
	 * again.
	 */
	if (tag->rt_ref > 1) {
		cv_wait(&tag->rt_cv, &tag->rt_lock);
		goto tryagain;
	}

	mutex_exit(&tag->rt_lock);
	mutex_destroy(&tag->rt_lock);
	cv_destroy(&tag->rt_cv);
	ASSERT(list_is_empty(&tag->rt_xplist));
	list_destroy(&tag->rt_xplist);
	kmem_free(tag, sizeof (rpc_tag_t));

}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * rpc_tags.h - tags implementation for rpc
 */

#ifndef	_RPC_TAGS_H
#define	_RPC_TAGS_H

#ifdef __cplusplus
extern "C" {
#endif

/*
 * rpc tags
 */

typedef char tagid[16];


#define	RPC_TAG_HOLD_LOCKED(tag)	{			\
	ASSERT(mutex_owned(&(tag)->rt_lock));			\
	(tag)->rt_ref++;					\
	DTRACE_PROBE1(rpc__tag__hold, rpc_tag_t *, tag);	\
}

#define	RPC_TAG_HOLD(tag)	{	\
	rpc_tag_hold(tag);		\
}

#define	RPC_TAG_RELE_LOCKED(tag)	{	\
	rpc_tag_rele_nolock(tag);		\
}

#define	RPC_TAG_RELE(tag)	{	\
	rpc_tag_rele(tag);		\
}

/*
 * Returns 0 if true
 */

#define	RPC_TAG_CMP(tag1, tag2) (bcmp(tag1, tag2, sizeof (tagid)))

/*
 * Return a xprt's tags list
 */

#define	XPRT2TLST(xprt, offset)		\
	((rpc_xprt_taglist_t **)(((char *)xprt) + offset))


/*
 * Global list of tags for a type of xprt.
 * rth_lock to be held for insertion/remove from the list
 * and while updating the tag's refcnt. rth_xpoff is the offset
 * of the pointer to the tags list (of type rpc_xprt_taglist_t)
 * in the xprt.
 */

typedef struct rpc_tag_hd {
	list_t rth_list;
	kmutex_t rth_lock;
	size_t rth_xpoff;
} rpc_tag_hd_t;


typedef struct rpc_tag {
	tagid rt_id;		/* tagid */
	kmutex_t rt_lock;	/* protects tag elements */
				/* must be held before accessing xprt list */
	/*
	 * Private to tags. tags consumers must not
	 * reference the below elements.
	 */
	int rt_flags;		/* synchronization flags */
	uint64_t rt_ref;	/* connections referring to this tag */
				/* taghd lock to be held for update */
	kcondvar_t rt_cv;
	list_node_t rt_next;	/* next on the global list of tags hd */
	list_t rt_xplist;	/* list of connections sharing the same tag */
} rpc_tag_t;


#define	RPC_TAG_DESTROY	0x01

/*
 * tag's container for connection list
 */

typedef struct rpc_tag_xprt {
	list_node_t rtx_xprt_next;
	void *rtx_xprt;	/* pointer to context specific xprt */
} rpc_tag_xprt_t;

/*
 * transport's tags list
 */

typedef struct rpc_xprt_taglist {
	int rxtl_flags;		/* synchronization flags */
	kcondvar_t rxtl_cv;
	kmutex_t rxtl_lock;	/* protects rxtl_list */
	list_t rxtl_list;
} rpc_xprt_taglist_t;

#define	RPC_XP_TGL_DESTROY	0x01

/*
 * transport's container for tags in the tags list
 */
typedef struct rpc_xprt_tag {
	list_node_t rxt_next;
	rpc_tag_t *rxt_tag;
} rpc_xprt_tag_t;

/* global taghd setup and destroy */

extern void rpc_taghd_init(rpc_tag_hd_t *, offset_t);
extern void rpc_taghd_destroy(rpc_tag_hd_t *);

/* functions for tag manipulation */

extern void rpc_add_tag(rpc_tag_hd_t *, void *, void *);
extern rpc_tag_t *rpc_lookup_tag(rpc_tag_hd_t *, void *, int);
extern void rpc_tag_hold(rpc_tag_t *);
extern void rpc_tag_rele(rpc_tag_t *);
extern void rpc_tag_rele_nolock(rpc_tag_t *);
extern int rpc_tag_swap(rpc_tag_hd_t *, void *, void *);
extern void rpc_destroy_tag(rpc_tag_hd_t *, void *);

/* functions to manipulate tags on the xprt's taglist */

extern void rpc_init_taglist(void **);
extern void rpc_destroy_taglist(void **);
extern int rpc_is_taglist_empty(void *);
extern int rpc_cmp_tag(void *, void *);
extern void rpc_remove_tag(rpc_tag_hd_t *, void *, void *);
extern void rpc_remove_all_tag(rpc_tag_hd_t *, void *);

/* functions to manipulate xprts in a tag */

extern void rpc_remove_xprt(rpc_tag_hd_t *, rpc_tag_t *, void *);
extern void rpc_remove_all_xprt(rpc_tag_hd_t *, rpc_tag_t *);
extern void * rpc_get_next_xprt(rpc_tag_t *, void **);

#ifdef __cplusplus
}
#endif


#endif	/* !_RPC_TAGS_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

/*
 * rpcb_clnt.h
 * Supplies C routines to get to rpcbind services.
 */

/*
 * Usage:
 *	success = rpcb_set(program, version, nconf, address);
 *	success = rpcb_unset(program, version, nconf);
 *	success = rpcb_getaddr(program, version, nconf, host);
 *	head = rpcb_getmaps(nconf, host);
 *	clnt_stat = rpcb_rmtcall(nconf, host, program, version, procedure,
 *		xdrargs, argsp, xdrres, resp, tout, addr_ptr)
 *	success = rpcb_gettime(host, timep)
 *	uaddr = rpcb_taddr2uaddr(nconf, taddr);
 *	taddr = rpcb_uaddr2uaddr(nconf, uaddr);
 */

#ifndef _RPC_RPCB_CLNT_H
#define	_RPC_RPCB_CLNT_H

#include <rpc/types.h>
#include <rpc/rpcb_prot.h>
#include <sys/netconfig.h>

#ifdef __cplusplus
extern "C" {
#endif

#ifdef __STDC__
extern bool_t		rpcb_set(const rpcprog_t, const rpcvers_t,
	const struct netconfig  *, const struct netbuf *);
extern bool_t		rpcb_unset(const rpcprog_t, const rpcvers_t,
	const struct netconfig *);
extern rpcblist	*rpcb_getmaps(const struct netconfig *, const char *);
extern enum clnt_stat	rpcb_rmtcall(const struct netconfig *, const char *,
const rpcprog_t, const rpcvers_t, const rpcproc_t, const xdrproc_t,
	const caddr_t, const xdrproc_t, const caddr_t,
	const struct timeval, struct netbuf *);
extern bool_t		rpcb_getaddr(const rpcprog_t, const rpcvers_t,
	const struct netconfig *, struct netbuf *, const  char *);
extern bool_t		rpcb_gettime(const char *, time_t *);
extern char		*rpcb_taddr2uaddr(struct netconfig *, struct netbuf *);
extern struct netbuf	*rpcb_uaddr2taddr(struct netconfig *, char *);
#else
extern bool_t		rpcb_set();
extern bool_t		rpcb_unset();
extern rpcblist	*rpcb_getmaps();
extern enum clnt_stat	rpcb_rmtcall();
extern bool_t		rpcb_getaddr();
extern bool_t		rpcb_gettime();
extern char		*rpcb_taddr2uaddr();
extern struct netbuf	*rpcb_uaddr2taddr();
#endif

#ifdef __cplusplus
}
#endif

#endif	/* !_RPC_RPCB_CLNT_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 1997 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved  	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

/*
 * rpcb_prot.c
 * XDR routines for the rpcbinder version 3.
 */

#include <rpc/rpc.h>
#include <rpc/types.h>
#include <rpc/xdr.h>
#include <rpc/rpcb_prot.h>


bool_t
xdr_rpcb(XDR *xdrs, RPCB *objp)
{
	if (!xdr_rpcprog(xdrs, &objp->r_prog))
		return (FALSE);
	if (!xdr_rpcvers(xdrs, &objp->r_vers))
		return (FALSE);
	if (!xdr_string(xdrs, &objp->r_netid, ~0))
		return (FALSE);
	if (!xdr_string(xdrs, &objp->r_addr, ~0))
		return (FALSE);
	if (!xdr_string(xdrs, &objp->r_owner, ~0))
		return (FALSE);
	return (TRUE);
}

/*
 * XDR remote call arguments
 * written for XDR_ENCODE direction only
 */
bool_t
xdr_rpcb_rmtcallargs(XDR *xdrs, struct rpcb_rmtcallargs *objp)
{
	uint_t lenposition, argposition, position;

	if (!xdr_rpcprog(xdrs, &objp->prog))
		return (FALSE);
	if (!xdr_rpcvers(xdrs, &objp->vers))
		return (FALSE);
	if (!xdr_rpcproc(xdrs, &objp->proc))
		return (FALSE);
	/*
	 * All the jugglery for just getting the size of the arguments
	 */
	lenposition = XDR_GETPOS(xdrs);
	if (!xdr_u_int(xdrs, &(objp->arglen)))
		return (FALSE);
	argposition = XDR_GETPOS(xdrs);
	if (!(*(objp->xdr_args))(xdrs, objp->args_ptr))
		return (FALSE);
	position = XDR_GETPOS(xdrs);
	objp->arglen = position - argposition;
	XDR_SETPOS(xdrs, lenposition);
	if (!xdr_u_int(xdrs, &(objp->arglen)))
		return (FALSE);
	XDR_SETPOS(xdrs, position);
	return (TRUE);
}

/*
 * XDR remote call results
 * written for XDR_DECODE direction only
 */
bool_t
xdr_rpcb_rmtcallres(XDR *xdrs, struct rpcb_rmtcallres *objp)
{
	if (!xdr_string(xdrs, &objp->addr_ptr, ~0))
		return (FALSE);
	if (!xdr_u_int(xdrs, &objp->resultslen))
		return (FALSE);
	return ((*(objp->xdr_results))(xdrs, objp->results_ptr));
}

bool_t
xdr_netbuf(XDR *xdrs, struct netbuf *objp)
{
	bool_t res;

	/*
	 * Save the passed in maxlen value and buf pointer.  We might
	 * need them later.
	 */
	uint_t maxlen_save = objp->maxlen;
	void *buf_save = objp->buf;

	if (!xdr_u_int(xdrs, &objp->maxlen))
		return (FALSE);

	/*
	 * We need to free maxlen, not len, so do it explicitly now.
	 */
	if (xdrs->x_op == XDR_FREE)
		return (xdr_bytes(xdrs, &objp->buf, &objp->maxlen,
		    objp->maxlen));

	/*
	 * If we're decoding and the caller has already allocated a
	 * buffer restore the maxlen value since the decoded value
	 * doesn't apply to the caller's buffer.  xdr_bytes() will
	 * return an error if the buffer isn't big enough.
	 */
	if (xdrs->x_op == XDR_DECODE && objp->buf != NULL)
		objp->maxlen = maxlen_save;

	res = xdr_bytes(xdrs, &objp->buf, &objp->len, objp->maxlen);

	/*
	 * If we are decoding and the buffer was allocated in the
	 * xdr_bytes() function we need to set maxlen properly to
	 * follow the netbuf semantics.
	 */
	if (xdrs->x_op == XDR_DECODE && objp->buf != buf_save)
		objp->maxlen = objp->len;

	return (res);
}
/*
 * Please do not edit this file.
 * It was generated using rpcgen.
 */

#ifndef _RPCB_PROT_H_RPCGEN
#define	_RPCB_PROT_H_RPCGEN

#include <rpc/rpc.h>
#ifndef _KERNEL
#include <synch.h>
#include <thread.h>
#endif /* !_KERNEL */
/*
 * Copyright (c) 1988,1994 by Sun Microsystems, Inc.
 * All rights reserved.
 */
/* from rpcb_prot.x */

#ifndef _KERNEL


/*
 * The following procedures are supported by the protocol in version 3:
 *
 * RPCBPROC_NULL() returns ()
 * 	takes nothing, returns nothing
 *
 * RPCBPROC_SET(rpcb) returns (bool_t)
 * 	TRUE is success, FALSE is failure.  Registers the tuple
 *	[prog, vers, address, owner, netid].
 *	Finds out owner and netid information on its own.
 *
 * RPCBPROC_UNSET(rpcb) returns (bool_t)
 *	TRUE is success, FALSE is failure.  Un-registers tuple
 *	[prog, vers, netid].  addresses is ignored.
 *	If netid is NULL, unregister all.
 *
 * RPCBPROC_GETADDR(rpcb) returns (string).
 *	0 is failure.  Otherwise returns the universal address where the
 *	triple [prog, vers, netid] is registered.  Ignore address and owner.
 *
 * RPCBPROC_DUMP() RETURNS (rpcblist_ptr)
 *	used to dump the entire rpcbind maps
 *
 * RPCBPROC_CALLIT(rpcb_rmtcallargs)
 * 	RETURNS (rpcb_rmtcallres);
 * 	Calls the procedure on the remote machine.  If it is not registered,
 *	this procedure is quiet; i.e. it does not return error information!!!
 *	This routine only passes null authentication parameters.
 *	It has no interface to xdr routines for RPCBPROC_CALLIT.
 *
 * RPCBPROC_GETTIME() returns (int).
 *	Gets the remote machines time
 *
 * RPCBPROC_UADDR2TADDR(strint) RETURNS (struct netbuf)
 *	Returns the netbuf address from universal address.
 *
 * RPCBPROC_TADDR2UADDR(struct netbuf) RETURNS (string)
 *	Returns the universal address from netbuf address.
 *
 * END OF RPCBIND VERSION 3 PROCEDURES
 */
/*
 * Except for RPCBPROC_CALLIT, the procedures above are carried over to
 * rpcbind version 4.  Those below are added or modified for version 4.
 * NOTE: RPCBPROC_BCAST HAS THE SAME FUNCTIONALITY AND PROCEDURE NUMBER
 * AS RPCBPROC_CALLIT.
 *
 * RPCBPROC_BCAST(rpcb_rmtcallargs)
 * 	RETURNS (rpcb_rmtcallres);
 * 	Calls the procedure on the remote machine.  If it is not registered,
 *	this procedure IS quiet; i.e. it DOES NOT return error information!!!
 *	This routine should be used for broadcasting and nothing else.
 *
 * RPCBPROC_GETVERSADDR(rpcb) returns (string).
 *	0 is failure.  Otherwise returns the universal address where the
 *	triple [prog, vers, netid] is registered.  Ignore address and owner.
 *	Same as RPCBPROC_GETADDR except that if the given version number
 *	is not available, the address is not returned.
 *
 * RPCBPROC_INDIRECT(rpcb_rmtcallargs)
 * 	RETURNS (rpcb_rmtcallres);
 * 	Calls the procedure on the remote machine.  If it is not registered,
 *	this procedure is NOT quiet; i.e. it DOES return error information!!!
 * 	as any normal application would expect.
 *
 * RPCBPROC_GETADDRLIST(rpcb) returns (rpcb_entry_list_ptr).
 *	Same as RPCBPROC_GETADDR except that it returns a list of all the
 *	addresses registered for the combination (prog, vers) (for all
 *	transports).
 *
 * RPCBPROC_GETSTAT(void) returns (rpcb_stat_byvers)
 *	Returns the statistics about the kind of requests received by rpcbind.
 */

/*
 * A mapping of (program, version, network ID) to address
 */

struct rpcb {
	rpcprog_t r_prog;
	rpcvers_t r_vers;
	char *r_netid;
	char *r_addr;
	char *r_owner;
};
typedef struct rpcb rpcb;

typedef rpcb RPCB;


/*
 * A list of mappings
 *
 * Below are two definitions for the rpcblist structure.  This is done because
 * xdr_rpcblist() is specified to take a struct rpcblist **, rather than a
 * struct rpcblist * that rpcgen would produce.  One version of the rpcblist
 * structure (actually called rp__list) is used with rpcgen, and the other is
 * defined only in the header file for compatibility with the specified
 * interface.
 */

struct rp__list {
	rpcb rpcb_map;
	struct rp__list *rpcb_next;
};
typedef struct rp__list rp__list;

typedef rp__list *rpcblist_ptr;

typedef struct rp__list rpcblist;
typedef struct rp__list RPCBLIST;

#ifndef __cplusplus
struct rpcblist {
 RPCB rpcb_map;
 struct rpcblist *rpcb_next;
};
#endif

#ifdef __cplusplus
extern "C" {
#endif
#if 1
extern bool_t xdr_rpcblist(XDR *, rpcblist**);
#else /* K&R C */
bool_t xdr_rpcblist();
#endif
#ifdef __cplusplus
}
#endif


/*
 * Arguments of remote calls
 */

struct rpcb_rmtcallargs {
	rpcprog_t prog;
	rpcvers_t vers;
	rpcproc_t proc;
	struct {
		u_int args_len;
		char *args_val;
	} args;
};
typedef struct rpcb_rmtcallargs rpcb_rmtcallargs;

/*
 * Client-side only representation of rpcb_rmtcallargs structure.
 *
 * The routine that XDRs the rpcb_rmtcallargs structure must deal with the
 * opaque arguments in the "args" structure.  xdr_rpcb_rmtcallargs() needs to
 * be passed the XDR routine that knows the args' structure.  This routine
 * doesn't need to go over-the-wire (and it wouldn't make sense anyway) since
 * the application being called already knows the args structure.  So we use a
 * different "XDR" structure on the client side, r_rpcb_rmtcallargs, which
 * includes the args' XDR routine.
 */
struct r_rpcb_rmtcallargs {
 rpcprog_t prog;
 rpcvers_t vers;
 rpcproc_t proc;
 struct {
 uint32_t args_len;
 char *args_val;
 } args;
 xdrproc_t xdr_args; /* encodes args */
};


/*
 * Results of the remote call
 */

struct rpcb_rmtcallres {
	char *addr;
	struct {
		u_int results_len;
		char *results_val;
	} results;
};
typedef struct rpcb_rmtcallres rpcb_rmtcallres;

/*
 * Client-side only representation of rpcb_rmtcallres structure.
 */
struct r_rpcb_rmtcallres {
 char *addr;
 struct {
 uint32_t results_len;
 char *results_val;
 } results;
 xdrproc_t xdr_res; /* decodes results */
};

/*
 * rpcb_entry contains a merged address of a service on a particular
 * transport, plus associated netconfig information.  A list of rpcb_entrys
 * is returned by RPCBPROC_GETADDRLIST.  See netconfig.h for values used
 * in r_nc_* fields.
 */

struct rpcb_entry {
	char *r_maddr;
	char *r_nc_netid;
	u_int r_nc_semantics;
	char *r_nc_protofmly;
	char *r_nc_proto;
};
typedef struct rpcb_entry rpcb_entry;

/*
 * A list of addresses supported by a service.
 */

struct rpcb_entry_list {
	rpcb_entry rpcb_entry_map;
	struct rpcb_entry_list *rpcb_entry_next;
};
typedef struct rpcb_entry_list rpcb_entry_list;

typedef rpcb_entry_list *rpcb_entry_list_ptr;

/*
 * rpcbind statistics
 */

#define	rpcb_highproc_2 RPCBPROC_CALLIT
#define	rpcb_highproc_3 RPCBPROC_TADDR2UADDR
#define	rpcb_highproc_4 RPCBPROC_GETSTAT
#define	RPCBSTAT_HIGHPROC 13
#define	RPCBVERS_STAT 3
#define	RPCBVERS_4_STAT 2
#define	RPCBVERS_3_STAT 1
#define	RPCBVERS_2_STAT 0

/* Link list of all the stats about getport and getaddr */

struct rpcbs_addrlist {
	rpcprog_t prog;
	rpcvers_t vers;
	int success;
	int failure;
	char *netid;
	struct rpcbs_addrlist *next;
};
typedef struct rpcbs_addrlist rpcbs_addrlist;

/* Link list of all the stats about rmtcall */

struct rpcbs_rmtcalllist {
	rpcprog_t prog;
	rpcvers_t vers;
	rpcproc_t proc;
	int success;
	int failure;
	int indirect;
	char *netid;
	struct rpcbs_rmtcalllist *next;
};
typedef struct rpcbs_rmtcalllist rpcbs_rmtcalllist;

typedef int rpcbs_proc[RPCBSTAT_HIGHPROC];

typedef rpcbs_addrlist *rpcbs_addrlist_ptr;

typedef rpcbs_rmtcalllist *rpcbs_rmtcalllist_ptr;

struct rpcb_stat {
	rpcbs_proc info;
	int setinfo;
	int unsetinfo;
	rpcbs_addrlist_ptr addrinfo;
	rpcbs_rmtcalllist_ptr rmtinfo;
};
typedef struct rpcb_stat rpcb_stat;

/*
 * One rpcb_stat structure is returned for each version of rpcbind
 * being monitored.
 */

typedef rpcb_stat rpcb_stat_byvers[RPCBVERS_STAT];

/*
 * We don't define netbuf in RPCL, since it would contain structure member
 * names that would conflict with the definition of struct netbuf in
 * <tiuser.h>.  Instead we merely declare the XDR routine xdr_netbuf() here,
 * and implement it ourselves in rpc/rpcb_prot.c.
 */
#ifdef __cplusplus
extern "C" bool_t xdr_netbuf(XDR *, struct netbuf *);

#elif 1
extern bool_t xdr_netbuf(XDR *, struct netbuf *);

#else /* K&R C */
bool_t xdr_netbuf();

#endif /* K&R C */

#define RPCBVERS_3 RPCBVERS
#define RPCBVERS_4 RPCBVERS4

#else /* ndef _KERNEL */
#ifdef __cplusplus
extern "C" {
#endif

/*
 * A mapping of (program, version, network ID) to address
 */
struct rpcb {
 rpcprog_t r_prog; /* program number */
 rpcvers_t r_vers; /* version number */
 char *r_netid; /* network id */
 char *r_addr; /* universal address */
 char *r_owner; /* owner of the mapping */
};
typedef struct rpcb RPCB;

/*
 * A list of mappings
 */
struct rpcblist {
 RPCB rpcb_map;
 struct rpcblist *rpcb_next;
};
typedef struct rpcblist RPCBLIST;
typedef struct rpcblist *rpcblist_ptr;

/*
 * Remote calls arguments
 */
struct rpcb_rmtcallargs {
 rpcprog_t prog; /* program number */
 rpcvers_t vers; /* version number */
 rpcproc_t proc; /* procedure number */
 unsigned int arglen; /* arg len */
 caddr_t args_ptr; /* argument */
 xdrproc_t xdr_args; /* XDR routine for argument */
};
typedef struct rpcb_rmtcallargs rpcb_rmtcallargs;

/*
 * Remote calls results
 */
struct rpcb_rmtcallres {
 char *addr_ptr; /* remote universal address */
 uint32_t resultslen; /* results length */
 caddr_t results_ptr; /* results */
 xdrproc_t xdr_results; /* XDR routine for result */
};
typedef struct rpcb_rmtcallres rpcb_rmtcallres;

struct rpcb_entry {
 char *r_maddr;
 char *r_nc_netid;
 unsigned int r_nc_semantics;
 char *r_nc_protofmly;
 char *r_nc_proto;
};
typedef struct rpcb_entry rpcb_entry;

/*
 * A list of addresses supported by a service.
 */

struct rpcb_entry_list {
 rpcb_entry rpcb_entry_map;
 struct rpcb_entry_list *rpcb_entry_next;
};
typedef struct rpcb_entry_list rpcb_entry_list;

typedef rpcb_entry_list *rpcb_entry_list_ptr;

/*
 * rpcbind statistics
 */

#define rpcb_highproc_2 RPCBPROC_CALLIT
#define rpcb_highproc_3 RPCBPROC_TADDR2UADDR
#define rpcb_highproc_4 RPCBPROC_GETSTAT
#define RPCBSTAT_HIGHPROC 13
#define RPCBVERS_STAT 3
#define RPCBVERS_4_STAT 2
#define RPCBVERS_3_STAT 1
#define RPCBVERS_2_STAT 0

/* Link list of all the stats about getport and getaddr */

struct rpcbs_addrlist {
 rpcprog_t prog;
 rpcvers_t vers;
 int success;
 int failure;
 char *netid;
 struct rpcbs_addrlist *next;
};
typedef struct rpcbs_addrlist rpcbs_addrlist;

/* Link list of all the stats about rmtcall */

struct rpcbs_rmtcalllist {
 rpcprog_t prog;
 rpcvers_t vers;
 rpcproc_t proc;
 int success;
 int failure;
 int indirect;
 char *netid;
 struct rpcbs_rmtcalllist *next;
};
typedef struct rpcbs_rmtcalllist rpcbs_rmtcalllist;

typedef int rpcbs_proc[RPCBSTAT_HIGHPROC];

typedef rpcbs_addrlist *rpcbs_addrlist_ptr;

typedef rpcbs_rmtcalllist *rpcbs_rmtcalllist_ptr;

struct rpcb_stat {
 rpcbs_proc info;
 int setinfo;
 int unsetinfo;
 rpcbs_addrlist_ptr addrinfo;
 rpcbs_rmtcalllist_ptr rmtinfo;
};
typedef struct rpcb_stat rpcb_stat;

/*
 * One rpcb_stat structure is returned for each version of rpcbind
 * being monitored.
 */

typedef rpcb_stat rpcb_stat_byvers[RPCBVERS_STAT];

extern bool_t xdr_netbuf(XDR *, struct netbuf *);

#ifdef __cplusplus
}
#endif

#endif /* ndef _KERNEL */

#define	RPCBPROG	100000
#define	RPCBVERS	3
#define	RPCBPROC_SET	1
extern  enum clnt_stat rpcbproc_set_3();
extern  bool_t rpcbproc_set_3_svc();
#define	RPCBPROC_UNSET	2
extern  enum clnt_stat rpcbproc_unset_3();
extern  bool_t rpcbproc_unset_3_svc();
#define	RPCBPROC_GETADDR	3
extern  enum clnt_stat rpcbproc_getaddr_3();
extern  bool_t rpcbproc_getaddr_3_svc();
#define	RPCBPROC_DUMP	4
extern  enum clnt_stat rpcbproc_dump_3();
extern  bool_t rpcbproc_dump_3_svc();
#define	RPCBPROC_CALLIT	5
extern  enum clnt_stat rpcbproc_callit_3();
extern  bool_t rpcbproc_callit_3_svc();
#define	RPCBPROC_GETTIME	6
extern  enum clnt_stat rpcbproc_gettime_3();
extern  bool_t rpcbproc_gettime_3_svc();
#define	RPCBPROC_UADDR2TADDR	7
extern  enum clnt_stat rpcbproc_uaddr2taddr_3();
extern  bool_t rpcbproc_uaddr2taddr_3_svc();
#define	RPCBPROC_TADDR2UADDR	8
extern  enum clnt_stat rpcbproc_taddr2uaddr_3();
extern  bool_t rpcbproc_taddr2uaddr_3_svc();
extern int rpcbprog_3_freeresult();
#define	RPCBVERS4	4
extern  enum clnt_stat rpcbproc_set_4();
extern  bool_t rpcbproc_set_4_svc();
extern  enum clnt_stat rpcbproc_unset_4();
extern  bool_t rpcbproc_unset_4_svc();
extern  enum clnt_stat rpcbproc_getaddr_4();
extern  bool_t rpcbproc_getaddr_4_svc();
extern  enum clnt_stat rpcbproc_dump_4();
extern  bool_t rpcbproc_dump_4_svc();
#define	RPCBPROC_BCAST	RPCBPROC_CALLIT
extern  enum clnt_stat rpcbproc_bcast_4();
extern  bool_t rpcbproc_bcast_4_svc();
extern  enum clnt_stat rpcbproc_gettime_4();
extern  bool_t rpcbproc_gettime_4_svc();
extern  enum clnt_stat rpcbproc_uaddr2taddr_4();
extern  bool_t rpcbproc_uaddr2taddr_4_svc();
extern  enum clnt_stat rpcbproc_taddr2uaddr_4();
extern  bool_t rpcbproc_taddr2uaddr_4_svc();
#define	RPCBPROC_GETVERSADDR	9
extern  enum clnt_stat rpcbproc_getversaddr_4();
extern  bool_t rpcbproc_getversaddr_4_svc();
#define	RPCBPROC_INDIRECT	10
extern  enum clnt_stat rpcbproc_indirect_4();
extern  bool_t rpcbproc_indirect_4_svc();
#define	RPCBPROC_GETADDRLIST	11
extern  enum clnt_stat rpcbproc_getaddrlist_4();
extern  bool_t rpcbproc_getaddrlist_4_svc();
#define	RPCBPROC_GETSTAT	12
extern  enum clnt_stat rpcbproc_getstat_4();
extern  bool_t rpcbproc_getstat_4_svc();
extern int rpcbprog_4_freeresult();

/* the xdr functions */
extern bool_t xdr_rpcb();
extern bool_t xdr_rp__list();
extern bool_t xdr_rpcblist_ptr();
extern bool_t xdr_rpcb_rmtcallargs();
extern bool_t xdr_rpcb_rmtcallres();
extern bool_t xdr_rpcb_entry();
extern bool_t xdr_rpcb_entry_list();
extern bool_t xdr_rpcb_entry_list_ptr();
extern bool_t xdr_rpcbs_addrlist();
extern bool_t xdr_rpcbs_rmtcalllist();
extern bool_t xdr_rpcbs_proc();
extern bool_t xdr_rpcbs_addrlist_ptr();
extern bool_t xdr_rpcbs_rmtcalllist_ptr();
extern bool_t xdr_rpcb_stat();
extern bool_t xdr_rpcb_stat_byvers();

#endif /* !_RPCB_PROT_H_RPCGEN */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
%/*
% * Copyright (c) 1988,1994 by Sun Microsystems, Inc.
% * All rights reserved.
% */

%/* from rpcb_prot.x */

#ifdef RPC_HDR
%
%#ifndef _KERNEL
%
#endif

/*
 * rpcb_prot.x
 * rpcbind protocol, versions 3 and 4, in RPC Language
 */
%
%/*
% * The following procedures are supported by the protocol in version 3:
% *
% * RPCBPROC_NULL() returns ()
% * 	takes nothing, returns nothing
% *
% * RPCBPROC_SET(rpcb) returns (bool_t)
% * 	TRUE is success, FALSE is failure.  Registers the tuple
% *	[prog, vers, address, owner, netid].
% *	Finds out owner and netid information on its own.
% *
% * RPCBPROC_UNSET(rpcb) returns (bool_t)
% *	TRUE is success, FALSE is failure.  Un-registers tuple
% *	[prog, vers, netid].  addresses is ignored.
% *	If netid is NULL, unregister all.
% *
% * RPCBPROC_GETADDR(rpcb) returns (string).
% *	0 is failure.  Otherwise returns the universal address where the
% *	triple [prog, vers, netid] is registered.  Ignore address and owner.
% *
% * RPCBPROC_DUMP() RETURNS (rpcblist_ptr)
% *	used to dump the entire rpcbind maps
% *
% * RPCBPROC_CALLIT(rpcb_rmtcallargs)
% * 	RETURNS (rpcb_rmtcallres);
% * 	Calls the procedure on the remote machine.  If it is not registered,
% *	this procedure is quiet; i.e. it does not return error information!!!
% *	This routine only passes null authentication parameters.
% *	It has no interface to xdr routines for RPCBPROC_CALLIT.
% *
% * RPCBPROC_GETTIME() returns (int).
% *	Gets the remote machines time
% *
% * RPCBPROC_UADDR2TADDR(strint) RETURNS (struct netbuf)
% *	Returns the netbuf address from universal address.
% *
% * RPCBPROC_TADDR2UADDR(struct netbuf) RETURNS (string)
% *	Returns the universal address from netbuf address.
% *
% * END OF RPCBIND VERSION 3 PROCEDURES
% */
%/*
% * Except for RPCBPROC_CALLIT, the procedures above are carried over to
% * rpcbind version 4.  Those below are added or modified for version 4.
% * NOTE: RPCBPROC_BCAST HAS THE SAME FUNCTIONALITY AND PROCEDURE NUMBER
% * AS RPCBPROC_CALLIT.
% *
% * RPCBPROC_BCAST(rpcb_rmtcallargs)
% * 	RETURNS (rpcb_rmtcallres);
% * 	Calls the procedure on the remote machine.  If it is not registered,
% *	this procedure IS quiet; i.e. it DOES NOT return error information!!!
% *	This routine should be used for broadcasting and nothing else.
% *
% * RPCBPROC_GETVERSADDR(rpcb) returns (string).
% *	0 is failure.  Otherwise returns the universal address where the
% *	triple [prog, vers, netid] is registered.  Ignore address and owner.
% *	Same as RPCBPROC_GETADDR except that if the given version number
% *	is not available, the address is not returned.
% *
% * RPCBPROC_INDIRECT(rpcb_rmtcallargs)
% * 	RETURNS (rpcb_rmtcallres);
% * 	Calls the procedure on the remote machine.  If it is not registered,
% *	this procedure is NOT quiet; i.e. it DOES return error information!!!
% * 	as any normal application would expect.
% *
% * RPCBPROC_GETADDRLIST(rpcb) returns (rpcb_entry_list_ptr).
% *	Same as RPCBPROC_GETADDR except that it returns a list of all the
% *	addresses registered for the combination (prog, vers) (for all
% *	transports).
% *
% * RPCBPROC_GETSTAT(void) returns (rpcb_stat_byvers)
% *	Returns the statistics about the kind of requests received by rpcbind.
% */
%
%/*
% * A mapping of (program, version, network ID) to address
% */
struct rpcb {
	rpcprog_t r_prog;		/* program number */
	rpcvers_t r_vers;		/* version number */
	string r_netid<>;		/* network id */
	string r_addr<>;		/* universal address */
	string r_owner<>;		/* owner of this service */
};
#ifdef RPC_HDR
%
%typedef rpcb RPCB;
%
#endif
%
%/*
% * A list of mappings
% *
% * Below are two definitions for the rpcblist structure.  This is done because
% * xdr_rpcblist() is specified to take a struct rpcblist **, rather than a
% * struct rpcblist * that rpcgen would produce.  One version of the rpcblist
% * structure (actually called rp__list) is used with rpcgen, and the other is
% * defined only in the header file for compatibility with the specified
% * interface.
% */

struct rp__list {
	rpcb rpcb_map;
	struct rp__list *rpcb_next;
};

typedef rp__list *rpcblist_ptr;		/* results of RPCBPROC_DUMP */

#ifdef RPC_HDR
%
%typedef struct rp__list rpcblist;
%typedef struct rp__list RPCBLIST;
%
%#ifndef __cplusplus
%struct rpcblist {
%	RPCB rpcb_map;
%	struct rpcblist *rpcb_next;
%};
%#endif
%
%#ifdef __cplusplus
%extern "C" {
%#endif
%#ifdef __STDC__
%extern  bool_t xdr_rpcblist(XDR *, rpcblist**);
%#else /* K&R C */
%bool_t xdr_rpcblist();
%#endif
%#ifdef	__cplusplus
%}
%#endif
%
#endif

%
%/*
% * Arguments of remote calls
% */
struct rpcb_rmtcallargs {
	rpcprog_t prog;			/* program number */
	rpcvers_t vers;			/* version number */
	rpcproc_t proc;			/* procedure number */
	opaque args<>;			/* argument */
};
#ifdef RPC_HDR
%
%/*
% * Client-side only representation of rpcb_rmtcallargs structure.
% *
% * The routine that XDRs the rpcb_rmtcallargs structure must deal with the
% * opaque arguments in the "args" structure.  xdr_rpcb_rmtcallargs() needs to
% * be passed the XDR routine that knows the args' structure.  This routine
% * doesn't need to go over-the-wire (and it wouldn't make sense anyway) since
% * the application being called already knows the args structure.  So we use a
% * different "XDR" structure on the client side, r_rpcb_rmtcallargs, which
% * includes the args' XDR routine.
% */
%struct r_rpcb_rmtcallargs {
%	rpcprog_t prog;
%	rpcvers_t vers;
%	rpcproc_t proc;
%	struct {
%		uint32_t args_len;
%		char *args_val;
%	} args;
%	xdrproc_t	xdr_args;	/* encodes args */
%};
%
#endif	/* def RPC_HDR */
%
%/*
% * Results of the remote call
% */
struct rpcb_rmtcallres {
	string addr<>;			/* remote universal address */
	opaque results<>;		/* result */
};
#ifdef RPC_HDR
%
%/*
% * Client-side only representation of rpcb_rmtcallres structure.
% */
%struct r_rpcb_rmtcallres {
%	char *addr;
%	struct {
%		uint32_t results_len;
%		char *results_val;
%	} results;
%	xdrproc_t	xdr_res;	/* decodes results */
%};
#endif RPC_HDR
%
%/*
% * rpcb_entry contains a merged address of a service on a particular
% * transport, plus associated netconfig information.  A list of rpcb_entrys
% * is returned by RPCBPROC_GETADDRLIST.  See netconfig.h for values used
% * in r_nc_* fields.
% */
struct rpcb_entry {
	string		r_maddr<>;	/* merged address of service */
	string		r_nc_netid<>;	/* netid field */
	unsigned int	r_nc_semantics;	/* semantics of transport */
	string		r_nc_protofmly<>; /* protocol family */
	string		r_nc_proto<>;	/* protocol name */
};
%
%/*
% * A list of addresses supported by a service.
% */
struct rpcb_entry_list {
	rpcb_entry rpcb_entry_map;
	struct rpcb_entry_list *rpcb_entry_next;
};

typedef rpcb_entry_list *rpcb_entry_list_ptr;

%
%/*
% * rpcbind statistics
% */
%
const rpcb_highproc_2 = RPCBPROC_CALLIT;
const rpcb_highproc_3 = RPCBPROC_TADDR2UADDR;
const rpcb_highproc_4 = RPCBPROC_GETSTAT;

const RPCBSTAT_HIGHPROC = 13;	/* # of procs in rpcbind V4 plus one */
const RPCBVERS_STAT = 3;	/* provide only for rpcbind V2, V3 and V4 */
const RPCBVERS_4_STAT = 2;
const RPCBVERS_3_STAT = 1;
const RPCBVERS_2_STAT = 0;
%
%/* Link list of all the stats about getport and getaddr */
struct rpcbs_addrlist {
	rpcprog_t prog;
	rpcvers_t vers;
	int success;
	int failure;
	string netid<>;
	struct rpcbs_addrlist *next;
};
%
%/* Link list of all the stats about rmtcall */
struct rpcbs_rmtcalllist {
	rpcprog_t prog;
	rpcvers_t vers;
	rpcproc_t proc;
	int success;
	int failure;
	int indirect;	/* whether callit or indirect */
	string netid<>;
	struct rpcbs_rmtcalllist *next;
};

typedef int rpcbs_proc[RPCBSTAT_HIGHPROC];
typedef rpcbs_addrlist *rpcbs_addrlist_ptr;
typedef rpcbs_rmtcalllist *rpcbs_rmtcalllist_ptr;

struct rpcb_stat {
	rpcbs_proc		info;
	int			setinfo;
	int			unsetinfo;
	rpcbs_addrlist_ptr	addrinfo;
	rpcbs_rmtcalllist_ptr	rmtinfo;
};
%
%/*
% * One rpcb_stat structure is returned for each version of rpcbind
% * being monitored.
% */

typedef rpcb_stat rpcb_stat_byvers[RPCBVERS_STAT];

#ifdef RPC_HDR
%
%/*
% * We don't define netbuf in RPCL, since it would contain structure member
% * names that would conflict with the definition of struct netbuf in
% * <tiuser.h>.  Instead we merely declare the XDR routine xdr_netbuf() here,
% * and implement it ourselves in rpc/rpcb_prot.c.
% */
%#ifdef __cplusplus
%extern "C" bool_t xdr_netbuf(XDR *, struct netbuf *);
%
%#elif __STDC__
%extern  bool_t xdr_netbuf(XDR *, struct netbuf *);
%
%#else /* K&R C */
%bool_t xdr_netbuf();
%
%#endif /* K&R C */
#endif /* def RPC_HDR */

/*
 * rpcbind procedures
 */
program RPCBPROG {
	version RPCBVERS {
		bool
		RPCBPROC_SET(rpcb) = 1;

		bool
		RPCBPROC_UNSET(rpcb) = 2;

		string
		RPCBPROC_GETADDR(rpcb) = 3;

		rpcblist_ptr
		RPCBPROC_DUMP(void) = 4;

		rpcb_rmtcallres
		RPCBPROC_CALLIT(rpcb_rmtcallargs) = 5;

		unsigned int
		RPCBPROC_GETTIME(void) = 6;

		struct netbuf
		RPCBPROC_UADDR2TADDR(string) = 7;

		string
		RPCBPROC_TADDR2UADDR(struct netbuf) = 8;
	} = 3;

	version RPCBVERS4 {
		bool
		RPCBPROC_SET(rpcb) = 1;

		bool
		RPCBPROC_UNSET(rpcb) = 2;

		string
		RPCBPROC_GETADDR(rpcb) = 3;

		rpcblist_ptr
		RPCBPROC_DUMP(void) = 4;

		/*
		 * NOTE: RPCBPROC_BCAST has the same functionality as CALLIT;
		 * the new name is intended to indicate that this
		 * procedure should be used for broadcast RPC, and
		 * RPCBPROC_INDIRECT should be used for indirect calls.
		 */
		rpcb_rmtcallres
		RPCBPROC_BCAST(rpcb_rmtcallargs) = RPCBPROC_CALLIT;

		unsigned int
		RPCBPROC_GETTIME(void) = 6;

		struct netbuf
		RPCBPROC_UADDR2TADDR(string) = 7;

		string
		RPCBPROC_TADDR2UADDR(struct netbuf) = 8;

		string
		RPCBPROC_GETVERSADDR(rpcb) = 9;

		rpcb_rmtcallres
		RPCBPROC_INDIRECT(rpcb_rmtcallargs) = 10;

		rpcb_entry_list_ptr
		RPCBPROC_GETADDRLIST(rpcb) = 11;

		rpcb_stat_byvers
		RPCBPROC_GETSTAT(void) = 12;
	} = 4;
} = 100000;
#ifdef RPC_HDR
%
%#define	RPCBVERS_3		RPCBVERS
%#define	RPCBVERS_4		RPCBVERS4
%
%#else		/* ndef _KERNEL */
%#ifdef __cplusplus
%extern "C" {
%#endif
%
%/*
% * A mapping of (program, version, network ID) to address
% */
%struct rpcb {
%	rpcprog_t r_prog;			/* program number */
%	rpcvers_t r_vers;			/* version number */
%	char *r_netid;			/* network id */
%	char *r_addr;			/* universal address */
%	char *r_owner;			/* owner of the mapping */
%};
%typedef struct rpcb RPCB;
%
%/*
% * A list of mappings
% */
%struct rpcblist {
%	RPCB rpcb_map;
%	struct rpcblist *rpcb_next;
%};
%typedef struct rpcblist RPCBLIST;
%typedef struct rpcblist *rpcblist_ptr;
%
%/*
% * Remote calls arguments
% */
%struct rpcb_rmtcallargs {
%	rpcprog_t prog;			/* program number */
%	rpcvers_t vers;			/* version number */
%	rpcproc_t proc;			/* procedure number */
%	unsigned int  arglen;		/* arg len */
%	caddr_t args_ptr;		/* argument */
%	xdrproc_t xdr_args;		/* XDR routine for argument */
%};
%typedef struct rpcb_rmtcallargs rpcb_rmtcallargs;
%
%/*
% * Remote calls results
% */
%struct rpcb_rmtcallres {
%	char *addr_ptr;			/* remote universal address */
%	uint32_t resultslen;		/* results length */
%	caddr_t results_ptr;		/* results */
%	xdrproc_t xdr_results;		/* XDR routine for result */
%};
%typedef struct rpcb_rmtcallres rpcb_rmtcallres;
%
%struct rpcb_entry {
%	char *r_maddr;
%	char *r_nc_netid;
%	unsigned int r_nc_semantics;
%	char *r_nc_protofmly;
%	char *r_nc_proto;
%};
%typedef struct rpcb_entry rpcb_entry;
%
%/*
% * A list of addresses supported by a service.
% */
%
%struct rpcb_entry_list {
%	rpcb_entry rpcb_entry_map;
%	struct rpcb_entry_list *rpcb_entry_next;
%};
%typedef struct rpcb_entry_list rpcb_entry_list;
%
%typedef rpcb_entry_list *rpcb_entry_list_ptr;
%
%/*
% * rpcbind statistics
% */
%
%#define	rpcb_highproc_2 RPCBPROC_CALLIT
%#define	rpcb_highproc_3 RPCBPROC_TADDR2UADDR
%#define	rpcb_highproc_4 RPCBPROC_GETSTAT
%#define	RPCBSTAT_HIGHPROC 13
%#define	RPCBVERS_STAT 3
%#define	RPCBVERS_4_STAT 2
%#define	RPCBVERS_3_STAT 1
%#define	RPCBVERS_2_STAT 0
%
%/* Link list of all the stats about getport and getaddr */
%
%struct rpcbs_addrlist {
%	rpcprog_t prog;
%	rpcvers_t vers;
%	int success;
%	int failure;
%	char *netid;
%	struct rpcbs_addrlist *next;
%};
%typedef struct rpcbs_addrlist rpcbs_addrlist;
%
%/* Link list of all the stats about rmtcall */
%
%struct rpcbs_rmtcalllist {
%	rpcprog_t prog;
%	rpcvers_t vers;
%	rpcproc_t proc;
%	int success;
%	int failure;
%	int indirect;
%	char *netid;
%	struct rpcbs_rmtcalllist *next;
%};
%typedef struct rpcbs_rmtcalllist rpcbs_rmtcalllist;
%
%typedef int rpcbs_proc[RPCBSTAT_HIGHPROC];
%
%typedef rpcbs_addrlist *rpcbs_addrlist_ptr;
%
%typedef rpcbs_rmtcalllist *rpcbs_rmtcalllist_ptr;
%
%struct rpcb_stat {
%	rpcbs_proc info;
%	int setinfo;
%	int unsetinfo;
%	rpcbs_addrlist_ptr addrinfo;
%	rpcbs_rmtcalllist_ptr rmtinfo;
%};
%typedef struct rpcb_stat rpcb_stat;
%
%/*
% * One rpcb_stat structure is returned for each version of rpcbind
% * being monitored.
% */
%
%typedef rpcb_stat rpcb_stat_byvers[RPCBVERS_STAT];
%
%extern  bool_t xdr_netbuf(XDR *, struct netbuf *);
%
%#ifdef __cplusplus
%}
%#endif
%
%#endif		/* ndef _KERNEL */
#endif		/* RPC_HDR */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 *
 * Copyright 1991 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

/*
 * rpcent.h,
 * For converting rpc program numbers to names etc.
 *
 */

#ifndef _RPC_RPCENT_H
#define	_RPC_RPCENT_H

#ifdef	__cplusplus
extern "C" {
#endif

struct rpcent {
	char	*r_name;	/* name of server for this rpc program */
	char	**r_aliases;	/* alias list */
	int	r_number;	/* rpc program number */
};

#ifdef __STDC__
extern struct rpcent *getrpcbyname_r
		(const char *,	  struct rpcent *, char *, int);
extern struct rpcent *getrpcbynumber_r
		(const int,	  struct rpcent *, char *, int);
extern struct rpcent *getrpcent_r(struct rpcent *, char *, int);

/* Old interfaces that return a pointer to a static area;  MT-unsafe */
extern struct rpcent *getrpcbyname(const char *);
extern struct rpcent *getrpcbynumber(const int);
extern struct rpcent *getrpcent(void);
extern void setrpcent(const int);
extern void endrpcent(void);
#else
extern struct rpcent *getrpcbyname_r();
extern struct rpcent *getrpcbynumber_r();
extern struct rpcent *getrpcent_r();

/* Old interfaces that return a pointer to a static area;  MT-unsafe */
extern struct rpcent *getrpcbyname();
extern struct rpcent *getrpcbynumber();
extern struct rpcent *getrpcent();
extern void setrpcent();
extern void endrpcent();
#endif

#ifdef	__cplusplus
}
#endif

#endif	/* _RPC_RPCENT_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
 */

/*
 * Copyright (c) 2007, The Ohio State University. All rights reserved.
 *
 * Portions of this source code is developed by the team members of
 * The Ohio State University's Network-Based Computing Laboratory (NBCL),
 * headed by Professor Dhabaleswar K. (DK) Panda.
 *
 * Acknowledgements to contributions from developors:
 *   Ranjit Noronha: noronha@cse.ohio-state.edu
 *   Lei Chai      : chail@cse.ohio-state.edu
 *   Weikuan Yu    : yuw@cse.ohio-state.edu
 *
 */

/*
 * The rpcib plugin. Implements the interface for RDMATF's
 * interaction with IBTF.
 */

#include <sys/param.h>
#include <sys/types.h>
#include <sys/user.h>
#include <sys/systm.h>
#include <sys/sysmacros.h>
#include <sys/proc.h>
#include <sys/socket.h>
#include <sys/file.h>
#include <sys/stream.h>
#include <sys/strsubr.h>
#include <sys/stropts.h>
#include <sys/errno.h>
#include <sys/kmem.h>
#include <sys/debug.h>
#include <sys/pathname.h>
#include <sys/kstat.h>
#include <sys/t_lock.h>
#include <sys/ddi.h>
#include <sys/cmn_err.h>
#include <sys/time.h>
#include <sys/isa_defs.h>
#include <sys/callb.h>
#include <sys/sunddi.h>
#include <sys/sunndi.h>
#include <sys/sdt.h>
#include <sys/ib/ibtl/ibti.h>
#include <rpc/rpc.h>
#include <rpc/ib.h>
#include <sys/modctl.h>
#include <sys/kstr.h>
#include <sys/sockio.h>
#include <sys/vnode.h>
#include <sys/tiuser.h>
#include <net/if.h>
#include <net/if_types.h>
#include <sys/cred.h>
#include <rpc/rpc_rdma.h>
#include <nfs/nfs.h>
#include <sys/atomic.h>

#define	NFS_RDMA_PORT	20049


/*
 * Convenience structures for connection management
 */
typedef struct rpcib_ipaddrs {
	void	*ri_list;	/* pointer to list of addresses */
	uint_t	ri_count;	/* number of addresses in list */
	uint_t	ri_size;	/* size of ri_list in bytes */
} rpcib_ipaddrs_t;


typedef struct rpcib_ping {
	rib_hca_t  *hca;
	ibt_path_info_t path;
	ibt_ip_addr_t srcip;
	ibt_ip_addr_t dstip;
} rpcib_ping_t;

/*
 * Prototype declarations for driver ops
 */
static int	rpcib_attach(dev_info_t *, ddi_attach_cmd_t);
static int	rpcib_getinfo(dev_info_t *, ddi_info_cmd_t,
				void *, void **);
static int	rpcib_detach(dev_info_t *, ddi_detach_cmd_t);
static boolean_t rpcib_rdma_capable_interface(struct lifreq *);
static int	rpcib_do_ip_ioctl(int, int, void *);
static boolean_t rpcib_get_ib_addresses(rpcib_ipaddrs_t *, rpcib_ipaddrs_t *);
static int rpcib_cache_kstat_update(kstat_t *, int);
static void rib_force_cleanup(void *);
static void rib_stop_hca_services(rib_hca_t *);
static void rib_attach_hca(void);
static int rib_find_hca_connection(rib_hca_t *hca, struct netbuf *s_svcaddr,
		struct netbuf *d_svcaddr, CONN **conn);

struct {
	kstat_named_t cache_limit;
	kstat_named_t cache_allocation;
	kstat_named_t cache_hits;
	kstat_named_t cache_misses;
	kstat_named_t cache_misses_above_the_limit;
} rpcib_kstat = {
	{"cache_limit",			KSTAT_DATA_UINT64 },
	{"cache_allocation",		KSTAT_DATA_UINT64 },
	{"cache_hits",			KSTAT_DATA_UINT64 },
	{"cache_misses",		KSTAT_DATA_UINT64 },
	{"cache_misses_above_the_limit", KSTAT_DATA_UINT64 },
};

/* rpcib cb_ops */
static struct cb_ops rpcib_cbops = {
	nulldev,		/* open */
	nulldev,		/* close */
	nodev,			/* strategy */
	nodev,			/* print */
	nodev,			/* dump */
	nodev,			/* read */
	nodev,			/* write */
	nodev,			/* ioctl */
	nodev,			/* devmap */
	nodev,			/* mmap */
	nodev,			/* segmap */
	nochpoll,		/* poll */
	ddi_prop_op,		/* prop_op */
	NULL,			/* stream */
	D_MP,			/* cb_flag */
	CB_REV,			/* rev */
	nodev,			/* int (*cb_aread)() */
	nodev			/* int (*cb_awrite)() */
};

/*
 * Device options
 */
static struct dev_ops rpcib_ops = {
	DEVO_REV,		/* devo_rev, */
	0,			/* refcnt  */
	rpcib_getinfo,		/* info */
	nulldev,		/* identify */
	nulldev,		/* probe */
	rpcib_attach,		/* attach */
	rpcib_detach,		/* detach */
	nodev,			/* reset */
	&rpcib_cbops,		    /* driver ops - devctl interfaces */
	NULL,			/* bus operations */
	NULL,			/* power */
	ddi_quiesce_not_needed,		/* quiesce */
};

/*
 * Module linkage information.
 */

static struct modldrv rib_modldrv = {
	&mod_driverops,		/* Driver module */
	"RPCIB plugin driver",	/* Driver name and version */
	&rpcib_ops,		/* Driver ops */
};

static struct modlinkage rib_modlinkage = {
	MODREV_1,
	(void *)&rib_modldrv,
	NULL
};

typedef struct rib_lrc_entry {
	struct rib_lrc_entry *forw;
	struct rib_lrc_entry *back;
	char *lrc_buf;

	uint32_t lrc_len;
	void  *avl_node;
	bool_t registered;

	struct mrc lrc_mhandle;
	bool_t lrc_on_freed_list;
} rib_lrc_entry_t;

typedef	struct cache_struct	{
	rib_lrc_entry_t		r;
	uint32_t		len;
	uint32_t		elements;
	kmutex_t		node_lock;
	avl_node_t		avl_link;
} cache_avl_struct_t;

uint64_t	cache_limit = 100 * 1024 * 1024;
static uint64_t	cache_watermark = 80 * 1024 * 1024;
static bool_t	stats_enabled = FALSE;

static uint64_t max_unsignaled_rws = 5;
int nfs_rdma_port = NFS_RDMA_PORT;

#define	RIBNETID_TCP	"tcp"
#define	RIBNETID_TCP6	"tcp6"

/*
 * rib_stat: private data pointer used when registering
 *	with the IBTF.  It is returned to the consumer
 *	in all callbacks.
 */
static rpcib_state_t *rib_stat = NULL;

#define	RNR_RETRIES	IBT_RNR_RETRY_1
#define	MAX_PORTS	2
#define	RDMA_DUMMY_WRID	0x4D3A1D4D3A1D
#define	RDMA_CONN_REAP_RETRY	10	/* 10 secs */

int preposted_rbufs = RDMA_BUFS_GRANT;
int send_threshold = 1;

/*
 * Old cards with Tavor driver have limited memory footprint
 * when booted in 32bit. The rib_max_rbufs tunable can be
 * tuned for more buffers if needed.
 */

#if !defined(_ELF64) && !defined(__sparc)
int rib_max_rbufs = MAX_BUFS;
#else
int rib_max_rbufs = 10 * MAX_BUFS;
#endif	/* !(_ELF64) && !(__sparc) */

int rib_conn_timeout = 60 * 12;		/* 12 minutes */

/*
 * State of the plugin.
 * ACCEPT = accepting new connections and requests.
 * NO_ACCEPT = not accepting new connection and requests.
 * This should eventually move to rpcib_state_t structure, since this
 * will tell in which state the plugin is for a particular type of service
 * like NFS, NLM or v4 Callback deamon. The plugin might be in accept
 * state for one and in no_accept state for the other.
 */
int		plugin_state;
kmutex_t	plugin_state_lock;

ldi_ident_t rpcib_li;

/*
 * RPCIB RDMATF operations
 */
static rdma_stat rib_reachable(int addr_type, struct netbuf *, void **handle);
static rdma_stat rib_disconnect(CONN *conn);
static void rib_listen(struct rdma_svc_data *rd);
static void rib_listen_stop(struct rdma_svc_data *rd);
static rdma_stat rib_registermem(CONN *conn, caddr_t  adsp, caddr_t buf,
	uint_t buflen, struct mrc *buf_handle);
static rdma_stat rib_deregistermem(CONN *conn, caddr_t buf,
	struct mrc buf_handle);
static rdma_stat rib_registermem_via_hca(rib_hca_t *hca, caddr_t adsp,
		caddr_t buf, uint_t buflen, struct mrc *buf_handle);
static rdma_stat rib_deregistermem_via_hca(rib_hca_t *hca, caddr_t buf,
		struct mrc buf_handle);
static rdma_stat rib_registermemsync(CONN *conn,  caddr_t adsp, caddr_t buf,
	uint_t buflen, struct mrc *buf_handle, RIB_SYNCMEM_HANDLE *sync_handle,
	void *lrc);
static rdma_stat rib_deregistermemsync(CONN *conn, caddr_t buf,
	struct mrc buf_handle, RIB_SYNCMEM_HANDLE sync_handle, void *);
static rdma_stat rib_syncmem(CONN *conn, RIB_SYNCMEM_HANDLE shandle,
	caddr_t buf, int len, int cpu);

static rdma_stat rib_reg_buf_alloc(CONN *conn, rdma_buf_t *rdbuf);

static void rib_reg_buf_free(CONN *conn, rdma_buf_t *rdbuf);
static void *rib_rbuf_alloc(CONN *, rdma_buf_t *);

static void rib_rbuf_free(CONN *conn, int ptype, void *buf);

static rdma_stat rib_send(CONN *conn, struct clist *cl, uint32_t msgid);
static rdma_stat rib_send_resp(CONN *conn, struct clist *cl, uint32_t msgid);
static rdma_stat rib_post_resp(CONN *conn, struct clist *cl, uint32_t msgid);
static rdma_stat rib_post_resp_remove(CONN *conn, uint32_t msgid);
static rdma_stat rib_post_recv(CONN *conn, struct clist *cl);
static rdma_stat rib_recv(CONN *conn, struct clist **clp, uint32_t msgid);
static rdma_stat rib_read(CONN *conn, struct clist *cl, int wait);
static rdma_stat rib_write(CONN *conn, struct clist *cl, int wait);
static rdma_stat rib_ping_srv(int addr_type, struct netbuf *, rpcib_ping_t *);
static rdma_stat rib_conn_get(struct netbuf *, struct netbuf *,
	int addr_type, void *, CONN **);
static rdma_stat rib_conn_release(CONN *conn);
static rdma_stat rib_connect(struct netbuf *, struct netbuf *, int,
	rpcib_ping_t *, CONN **);
static rdma_stat rib_getinfo(rdma_info_t *info);

static rib_lrc_entry_t *rib_get_cache_buf(CONN *conn, uint32_t len);
static void rib_free_cache_buf(CONN *conn, rib_lrc_entry_t *buf);
static void rib_destroy_cache(rib_hca_t *hca);
static	void	rib_server_side_cache_reclaim(void *argp);
static int avl_compare(const void *t1, const void *t2);

static void rib_stop_services(rib_hca_t *);
static void rib_close_channels(rib_conn_list_t *);
static void rib_conn_close(void *);
static void rib_recv_rele(rib_qp_t *);
static rdma_stat rib_conn_release_locked(CONN *conn);

/*
 * RPCIB addressing operations
 */

/*
 * RDMA operations the RPCIB module exports
 */
static rdmaops_t rib_ops = {
	rib_reachable,
	rib_conn_get,
	rib_conn_release,
	rib_listen,
	rib_listen_stop,
	rib_registermem,
	rib_deregistermem,
	rib_registermemsync,
	rib_deregistermemsync,
	rib_syncmem,
	rib_reg_buf_alloc,
	rib_reg_buf_free,
	rib_send,
	rib_send_resp,
	rib_post_resp,
	rib_post_resp_remove,
	rib_post_recv,
	rib_recv,
	rib_read,
	rib_write,
	rib_getinfo,
};

/*
 * RDMATF RPCIB plugin details
 */
static rdma_mod_t rib_mod = {
	"ibtf",		/* api name */
	RDMATF_VERS_1,
	0,
	&rib_ops,	/* rdma op vector for ibtf */
};

static rdma_stat rpcib_open_hcas(rpcib_state_t *);
static rdma_stat rib_qp_init(rib_qp_t *, int);
static void rib_svc_scq_handler(ibt_cq_hdl_t, void *);
static void rib_clnt_scq_handler(ibt_cq_hdl_t, void *);
static void rib_clnt_rcq_handler(ibt_cq_hdl_t, void *);
static void rib_svc_rcq_handler(ibt_cq_hdl_t, void *);
static rib_bufpool_t *rib_rbufpool_create(rib_hca_t *hca, int ptype, int num);
static rdma_stat rib_reg_mem(rib_hca_t *, caddr_t adsp, caddr_t, uint_t,
	ibt_mr_flags_t, ibt_mr_hdl_t *, ibt_mr_desc_t *);
static rdma_stat rib_reg_mem_user(rib_hca_t *, caddr_t, uint_t, ibt_mr_flags_t,
	ibt_mr_hdl_t *, ibt_mr_desc_t *, caddr_t);
static rdma_stat rib_conn_to_srv(rib_hca_t *, rib_qp_t *, rpcib_ping_t *);
static rdma_stat rib_clnt_create_chan(rib_hca_t *, struct netbuf *,
	rib_qp_t **);
static rdma_stat rib_svc_create_chan(rib_hca_t *, caddr_t, uint8_t,
	rib_qp_t **);
static rdma_stat rib_sendwait(rib_qp_t *, struct send_wid *);
static struct send_wid *rib_init_sendwait(uint32_t, int, rib_qp_t *);
static int rib_free_sendwait(struct send_wid *);
static struct rdma_done_list *rdma_done_add(rib_qp_t *qp, uint32_t xid);
static void rdma_done_rm(rib_qp_t *qp, struct rdma_done_list *rd);
static void rdma_done_rem_list(rib_qp_t *);
static void rdma_done_notify(rib_qp_t *qp, uint32_t xid);

static void rib_async_handler(void *,
	ibt_hca_hdl_t, ibt_async_code_t, ibt_async_event_t *);
static rdma_stat rib_rem_rep(rib_qp_t *, struct reply *);
static struct svc_recv *rib_init_svc_recv(rib_qp_t *, ibt_wr_ds_t *);
static int rib_free_svc_recv(struct svc_recv *);
static struct recv_wid *rib_create_wid(rib_qp_t *, ibt_wr_ds_t *, uint32_t);
static void rib_free_wid(struct recv_wid *);
static rdma_stat rib_disconnect_channel(CONN *, rib_conn_list_t *);
static void rib_detach_hca(ibt_hca_hdl_t);
static void rib_close_a_channel(CONN *);
static void rib_send_hold(rib_qp_t *);
static void rib_send_rele(rib_qp_t *);

/*
 * Registration with IBTF as a consumer
 */
static struct ibt_clnt_modinfo_s rib_modinfo = {
	IBTI_V_CURR,
	IBT_GENERIC,
	rib_async_handler,	/* async event handler */
	NULL,			/* Memory Region Handler */
	"nfs/ib"
};

/*
 * Global strucuture
 */

typedef struct rpcib_s {
	dev_info_t	*rpcib_dip;
	kmutex_t	rpcib_mutex;
} rpcib_t;

rpcib_t rpcib;

/*
 * /etc/system controlled variable to control
 * debugging in rpcib kernel module.
 * Set it to values greater that 1 to control
 * the amount of debugging messages required.
 */
int rib_debug = 0;

int
_init(void)
{
	int error;

	error = mod_install((struct modlinkage *)&rib_modlinkage);
	if (error != 0) {
		/*
		 * Could not load module
		 */
		return (error);
	}
	mutex_init(&plugin_state_lock, NULL, MUTEX_DRIVER, NULL);
	return (0);
}

int
_fini()
{
	int status;

	/*
	 * Remove module
	 */
	if ((status = mod_remove(&rib_modlinkage)) != 0) {
		return (status);
	}
	mutex_destroy(&plugin_state_lock);
	return (0);
}

int
_info(struct modinfo *modinfop)
{
	return (mod_info(&rib_modlinkage, modinfop));
}

/*
 * rpcib_getinfo()
 * Given the device number, return the devinfo pointer or the
 * instance number.
 * Note: always succeed DDI_INFO_DEVT2INSTANCE, even before attach.
 */

/*ARGSUSED*/
static int
rpcib_getinfo(dev_info_t *dip, ddi_info_cmd_t cmd, void *arg, void **result)
{
	int ret = DDI_SUCCESS;

	switch (cmd) {
	case DDI_INFO_DEVT2DEVINFO:
		if (rpcib.rpcib_dip != NULL)
			*result = rpcib.rpcib_dip;
		else {
			*result = NULL;
			ret = DDI_FAILURE;
		}
		break;

	case DDI_INFO_DEVT2INSTANCE:
		*result = NULL;
		break;

	default:
		ret = DDI_FAILURE;
	}
	return (ret);
}

static void
rpcib_free_hca_list()
{
	rib_hca_t *hca, *hcap;

	rw_enter(&rib_stat->hcas_list_lock, RW_WRITER);
	hca = rib_stat->hcas_list;
	rib_stat->hcas_list = NULL;
	rw_exit(&rib_stat->hcas_list_lock);
	while (hca != NULL) {
		rw_enter(&hca->state_lock, RW_WRITER);
		hcap = hca;
		hca = hca->next;
		rib_stat->nhca_inited--;
		rib_mod.rdma_count--;
		hcap->state = HCA_DETACHED;
		rw_exit(&hcap->state_lock);
		rib_stop_hca_services(hcap);

		kmem_free(hcap, sizeof (*hcap));
	}
}

static rdma_stat
rpcib_free_service_list()
{
	rib_service_t *service;
	ibt_status_t ret;

	rw_enter(&rib_stat->service_list_lock, RW_WRITER);
	while (rib_stat->service_list != NULL) {
		service = rib_stat->service_list;
		ret = ibt_unbind_all_services(service->srv_hdl);
		if (ret != IBT_SUCCESS) {
			rw_exit(&rib_stat->service_list_lock);
#ifdef DEBUG
			cmn_err(CE_NOTE, "rpcib_free_service_list: "
			    "ibt_unbind_all_services failed (%d)\n", (int)ret);
#endif
			return (RDMA_FAILED);
		}
		ret = ibt_deregister_service(rib_stat->ibt_clnt_hdl,
		    service->srv_hdl);
		if (ret != IBT_SUCCESS) {
			rw_exit(&rib_stat->service_list_lock);
#ifdef DEBUG
			cmn_err(CE_NOTE, "rpcib_free_service_list: "
			    "ibt_deregister_service failed (%d)\n", (int)ret);
#endif
			return (RDMA_FAILED);
		}
		rib_stat->service_list = service->next;
		kmem_free(service, sizeof (rib_service_t));
	}
	rw_exit(&rib_stat->service_list_lock);

	return (RDMA_SUCCESS);
}

static int
rpcib_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
{
	ibt_status_t	ibt_status;
	rdma_stat	r_status;

	switch (cmd) {
	case DDI_ATTACH:
		break;
	case DDI_RESUME:
		return (DDI_SUCCESS);
	default:
		return (DDI_FAILURE);
	}

	mutex_init(&rpcib.rpcib_mutex, NULL, MUTEX_DRIVER, NULL);

	mutex_enter(&rpcib.rpcib_mutex);
	if (rpcib.rpcib_dip != NULL) {
		mutex_exit(&rpcib.rpcib_mutex);
		return (DDI_FAILURE);
	}
	rpcib.rpcib_dip = dip;
	mutex_exit(&rpcib.rpcib_mutex);
	/*
	 * Create the "rpcib" minor-node.
	 */
	if (ddi_create_minor_node(dip,
	    "rpcib", S_IFCHR, 0, DDI_PSEUDO, 0) != DDI_SUCCESS) {
		/* Error message, no cmn_err as they print on console */
		return (DDI_FAILURE);
	}

	if (rib_stat == NULL) {
		rib_stat = kmem_zalloc(sizeof (*rib_stat), KM_SLEEP);
		mutex_init(&rib_stat->open_hca_lock, NULL, MUTEX_DRIVER, NULL);
		rw_init(&rib_stat->hcas_list_lock, NULL, RW_DRIVER, NULL);
		mutex_init(&rib_stat->listen_lock, NULL, MUTEX_DRIVER, NULL);
	}

	rib_stat->hca_count = ibt_get_hca_list(NULL);
	if (rib_stat->hca_count < 1) {
		mutex_destroy(&rib_stat->listen_lock);
		rw_destroy(&rib_stat->hcas_list_lock);
		mutex_destroy(&rib_stat->open_hca_lock);
		kmem_free(rib_stat, sizeof (*rib_stat));
		rib_stat = NULL;
		return (DDI_FAILURE);
	}

	ibt_status = ibt_attach(&rib_modinfo, dip,
	    (void *)rib_stat, &rib_stat->ibt_clnt_hdl);

	if (ibt_status != IBT_SUCCESS) {
		mutex_destroy(&rib_stat->listen_lock);
		rw_destroy(&rib_stat->hcas_list_lock);
		mutex_destroy(&rib_stat->open_hca_lock);
		kmem_free(rib_stat, sizeof (*rib_stat));
		rib_stat = NULL;
		return (DDI_FAILURE);
	}

	rib_stat->service_list = NULL;
	rw_init(&rib_stat->service_list_lock, NULL, RW_DRIVER, NULL);
	mutex_enter(&rib_stat->open_hca_lock);
	if (rpcib_open_hcas(rib_stat) != RDMA_SUCCESS) {
		mutex_exit(&rib_stat->open_hca_lock);
		goto open_fail;
	}
	mutex_exit(&rib_stat->open_hca_lock);

	if (ddi_prop_update_int(DDI_DEV_T_NONE, dip, DDI_NO_AUTODETACH, 1) !=
	    DDI_PROP_SUCCESS) {
		cmn_err(CE_WARN, "rpcib_attach: ddi-no-autodetach prop update "
		    "failed.");
		goto register_fail;
	}

	/*
	 * Register with rdmatf
	 */
	r_status = rdma_register_mod(&rib_mod);
	if (r_status != RDMA_SUCCESS && r_status != RDMA_REG_EXIST) {
		cmn_err(CE_WARN, "rpcib_attach:rdma_register_mod failed, "
		    "status = %d", r_status);
		goto register_fail;
	}

	return (DDI_SUCCESS);

register_fail:

open_fail:
	(void) ibt_detach(rib_stat->ibt_clnt_hdl);
	rpcib_free_hca_list();
	(void) rpcib_free_service_list();
	mutex_destroy(&rib_stat->listen_lock);
	rw_destroy(&rib_stat->hcas_list_lock);
	mutex_destroy(&rib_stat->open_hca_lock);
	rw_destroy(&rib_stat->service_list_lock);
	kmem_free(rib_stat, sizeof (*rib_stat));
	rib_stat = NULL;
	return (DDI_FAILURE);
}

/*ARGSUSED*/
static int
rpcib_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
{
	switch (cmd) {

	case DDI_DETACH:
		break;

	case DDI_SUSPEND:
	default:
		return (DDI_FAILURE);
	}

	/*
	 * Detach the hca and free resources
	 */
	mutex_enter(&plugin_state_lock);
	plugin_state = NO_ACCEPT;
	mutex_exit(&plugin_state_lock);

	if (rpcib_free_service_list() != RDMA_SUCCESS)
		return (DDI_FAILURE);
	rpcib_free_hca_list();

	(void) ibt_detach(rib_stat->ibt_clnt_hdl);
	mutex_destroy(&rib_stat->listen_lock);
	rw_destroy(&rib_stat->hcas_list_lock);
	mutex_destroy(&rib_stat->open_hca_lock);
	rw_destroy(&rib_stat->service_list_lock);

	kmem_free(rib_stat, sizeof (*rib_stat));
	rib_stat = NULL;

	mutex_enter(&rpcib.rpcib_mutex);
	rpcib.rpcib_dip = NULL;
	mutex_exit(&rpcib.rpcib_mutex);
	mutex_destroy(&rpcib.rpcib_mutex);
	return (DDI_SUCCESS);
}


static void rib_rbufpool_free(rib_hca_t *, int);
static void rib_rbufpool_deregister(rib_hca_t *, int);
static void rib_rbufpool_destroy(rib_hca_t *hca, int ptype);
static struct reply *rib_addreplylist(rib_qp_t *, uint32_t);
static rdma_stat rib_rem_replylist(rib_qp_t *);
static int rib_remreply(rib_qp_t *, struct reply *);
static rdma_stat rib_add_connlist(CONN *, rib_conn_list_t *);
static rdma_stat rib_rm_conn(CONN *, rib_conn_list_t *);


/*
 * One CQ pair per HCA
 */
static rdma_stat
rib_create_cq(rib_hca_t *hca, uint32_t cq_size, ibt_cq_handler_t cq_handler,
    rib_cq_t **cqp)
{
	rib_cq_t	*cq;
	ibt_cq_attr_t	cq_attr;
	uint32_t	real_size;
	ibt_status_t	status;
	rdma_stat	error = RDMA_SUCCESS;

	cq = kmem_zalloc(sizeof (rib_cq_t), KM_SLEEP);
	cq->rib_hca = hca;
	bzero(&cq_attr, sizeof (cq_attr));
	cq_attr.cq_size = cq_size;
	cq_attr.cq_flags = IBT_CQ_NO_FLAGS;
	status = ibt_alloc_cq(hca->hca_hdl, &cq_attr, &cq->rib_cq_hdl,
	    &real_size);
	if (status != IBT_SUCCESS) {
		cmn_err(CE_WARN, "rib_create_cq: ibt_alloc_cq() failed,"
		    " status=%d", status);
		error = RDMA_FAILED;
		goto fail;
	}
	ibt_set_cq_handler(cq->rib_cq_hdl, cq_handler, hca);

	/*
	 * Enable CQ callbacks. CQ Callbacks are single shot
	 * (e.g. you have to call ibt_enable_cq_notify()
	 * after each callback to get another one).
	 */
	status = ibt_enable_cq_notify(cq->rib_cq_hdl, IBT_NEXT_COMPLETION);
	if (status != IBT_SUCCESS) {
		cmn_err(CE_WARN, "rib_create_cq: "
		    "enable_cq_notify failed, status %d", status);
		error = RDMA_FAILED;
		goto fail;
	}
	*cqp = cq;

	return (error);
fail:
	if (cq->rib_cq_hdl)
		(void) ibt_free_cq(cq->rib_cq_hdl);
	if (cq)
		kmem_free(cq, sizeof (rib_cq_t));
	return (error);
}

/*
 * rpcib_find_hca
 *
 * Caller should have already locked the hcas_lock before calling
 * this function.
 */
static rib_hca_t *
rpcib_find_hca(rpcib_state_t *ribstat, ib_guid_t guid)
{
	rib_hca_t *hca = ribstat->hcas_list;

	while (hca && hca->hca_guid != guid)
		hca = hca->next;

	return (hca);
}

static rdma_stat
rpcib_open_hcas(rpcib_state_t *ribstat)
{
	rib_hca_t		*hca;
	ibt_status_t		ibt_status;
	rdma_stat		status;
	ibt_hca_portinfo_t	*pinfop;
	ibt_pd_flags_t		pd_flags = IBT_PD_NO_FLAGS;
	uint_t			size, cq_size;
	int			i;
	kstat_t *ksp;
	cache_avl_struct_t example_avl_node;
	char rssc_name[32];
	int old_nhca_inited = ribstat->nhca_inited;
	ib_guid_t		*hca_guids;

	ASSERT(MUTEX_HELD(&ribstat->open_hca_lock));

	ribstat->hca_count = ibt_get_hca_list(&hca_guids);
	if (ribstat->hca_count == 0)
		return (RDMA_FAILED);

	rw_enter(&ribstat->hcas_list_lock, RW_WRITER);
	/*
	 * Open a hca and setup for RDMA
	 */
	for (i = 0; i < ribstat->hca_count; i++) {
		if (rpcib_find_hca(ribstat, hca_guids[i]))
			continue;
		hca = kmem_zalloc(sizeof (rib_hca_t), KM_SLEEP);

		ibt_status = ibt_open_hca(ribstat->ibt_clnt_hdl,
		    hca_guids[i], &hca->hca_hdl);
		if (ibt_status != IBT_SUCCESS) {
			kmem_free(hca, sizeof (rib_hca_t));
			continue;
		}
		hca->hca_guid = hca_guids[i];
		hca->ibt_clnt_hdl = ribstat->ibt_clnt_hdl;
		hca->state = HCA_INITED;

		/*
		 * query HCA info
		 */
		ibt_status = ibt_query_hca(hca->hca_hdl, &hca->hca_attrs);
		if (ibt_status != IBT_SUCCESS) {
			goto fail1;
		}

		/*
		 * One PD (Protection Domain) per HCA.
		 * A qp is allowed to access a memory region
		 * only when it's in the same PD as that of
		 * the memory region.
		 */
		ibt_status = ibt_alloc_pd(hca->hca_hdl, pd_flags, &hca->pd_hdl);
		if (ibt_status != IBT_SUCCESS) {
			goto fail1;
		}

		/*
		 * query HCA ports
		 */
		ibt_status = ibt_query_hca_ports(hca->hca_hdl,
		    0, &pinfop, &hca->hca_nports, &size);
		if (ibt_status != IBT_SUCCESS) {
			goto fail2;
		}
		hca->hca_ports = pinfop;
		hca->hca_pinfosz = size;
		pinfop = NULL;

		cq_size = DEF_CQ_SIZE; /* default cq size */
		/*
		 * Create 2 pairs of cq's (1 pair for client
		 * and the other pair for server) on this hca.
		 * If number of qp's gets too large, then several
		 * cq's will be needed.
		 */
		status = rib_create_cq(hca, cq_size, rib_svc_rcq_handler,
		    &hca->svc_rcq);
		if (status != RDMA_SUCCESS) {
			goto fail3;
		}

		status = rib_create_cq(hca, cq_size, rib_svc_scq_handler,
		    &hca->svc_scq);
		if (status != RDMA_SUCCESS) {
			goto fail3;
		}

		status = rib_create_cq(hca, cq_size, rib_clnt_rcq_handler,
		    &hca->clnt_rcq);
		if (status != RDMA_SUCCESS) {
			goto fail3;
		}

		status = rib_create_cq(hca, cq_size, rib_clnt_scq_handler,
		    &hca->clnt_scq);
		if (status != RDMA_SUCCESS) {
			goto fail3;
		}

		/*
		 * Create buffer pools.
		 * Note rib_rbuf_create also allocates memory windows.
		 */
		hca->recv_pool = rib_rbufpool_create(hca,
		    RECV_BUFFER, rib_max_rbufs);
		if (hca->recv_pool == NULL) {
			goto fail3;
		}

		hca->send_pool = rib_rbufpool_create(hca,
		    SEND_BUFFER, rib_max_rbufs);
		if (hca->send_pool == NULL) {
			rib_rbufpool_destroy(hca, RECV_BUFFER);
			goto fail3;
		}

		if (hca->server_side_cache == NULL) {
			(void) sprintf(rssc_name,
			    "rib_srvr_cache_%llx",
			    (long long unsigned int) hca->hca_guid);
			hca->server_side_cache = kmem_cache_create(
			    rssc_name,
			    sizeof (cache_avl_struct_t), 0,
			    NULL,
			    NULL,
			    rib_server_side_cache_reclaim,
			    hca, NULL, 0);
		}

		avl_create(&hca->avl_tree,
		    avl_compare,
		    sizeof (cache_avl_struct_t),
		    (uint_t)(uintptr_t)&example_avl_node.avl_link-
		    (uint_t)(uintptr_t)&example_avl_node);

		rw_init(&hca->bound_services_lock, NULL, RW_DRIVER,
		    hca->iblock);
		rw_init(&hca->state_lock, NULL, RW_DRIVER, hca->iblock);
		rw_init(&hca->avl_rw_lock,
		    NULL, RW_DRIVER, hca->iblock);
		mutex_init(&hca->cache_allocation_lock,
		    NULL, MUTEX_DRIVER, NULL);
		hca->avl_init = TRUE;

		/* Create kstats for the cache */
		ASSERT(INGLOBALZONE(curproc));

		if (!stats_enabled) {
			ksp = kstat_create_zone("unix", 0, "rpcib_cache", "rpc",
			    KSTAT_TYPE_NAMED,
			    sizeof (rpcib_kstat) / sizeof (kstat_named_t),
			    KSTAT_FLAG_VIRTUAL | KSTAT_FLAG_WRITABLE,
			    GLOBAL_ZONEID);
			if (ksp) {
				ksp->ks_data = (void *) &rpcib_kstat;
				ksp->ks_update = rpcib_cache_kstat_update;
				kstat_install(ksp);
				stats_enabled = TRUE;
			}
		}
		if (hca->cleanup_helper == NULL) {
			char tq_name[sizeof (hca->hca_guid) * 2 + 1];

			(void) snprintf(tq_name, sizeof (tq_name), "%llX",
			    (unsigned long long int) hca->hca_guid);
			hca->cleanup_helper = ddi_taskq_create(NULL,
			    tq_name, 1, TASKQ_DEFAULTPRI, 0);
		}

		mutex_init(&hca->cb_lock, NULL, MUTEX_DRIVER, hca->iblock);
		cv_init(&hca->cb_cv, NULL, CV_DRIVER, NULL);
		rw_init(&hca->cl_conn_list.conn_lock, NULL, RW_DRIVER,
		    hca->iblock);
		rw_init(&hca->srv_conn_list.conn_lock, NULL, RW_DRIVER,
		    hca->iblock);
		mutex_init(&hca->inuse_lock, NULL, MUTEX_DRIVER, hca->iblock);
		hca->inuse = TRUE;

		hca->next = ribstat->hcas_list;
		ribstat->hcas_list = hca;
		ribstat->nhca_inited++;
		ibt_free_portinfo(hca->hca_ports, hca->hca_pinfosz);
		continue;

fail3:
		ibt_free_portinfo(hca->hca_ports, hca->hca_pinfosz);
fail2:
		(void) ibt_free_pd(hca->hca_hdl, hca->pd_hdl);
fail1:
		(void) ibt_close_hca(hca->hca_hdl);
		kmem_free(hca, sizeof (rib_hca_t));
	}
	rw_exit(&ribstat->hcas_list_lock);
	ibt_free_hca_list(hca_guids, ribstat->hca_count);
	rib_mod.rdma_count = rib_stat->nhca_inited;

	/*
	 * return success if at least one new hca has been configured.
	 */
	if (ribstat->nhca_inited != old_nhca_inited)
		return (RDMA_SUCCESS);
	else
		return (RDMA_FAILED);
}

/*
 * Callback routines
 */

/*
 * SCQ handlers
 */
/* ARGSUSED */
static void
rib_clnt_scq_handler(ibt_cq_hdl_t cq_hdl, void *arg)
{
	ibt_status_t	ibt_status;
	ibt_wc_t	wc;
	struct send_wid	*wd;
	CONN		*conn;
	rib_qp_t	*qp;
	int		i;

	/*
	 * Re-enable cq notify here to avoid missing any
	 * completion queue notification.
	 */
	(void) ibt_enable_cq_notify(cq_hdl, IBT_NEXT_COMPLETION);

	ibt_status = IBT_SUCCESS;
	while (ibt_status != IBT_CQ_EMPTY) {
		bzero(&wc, sizeof (wc));
		ibt_status = ibt_poll_cq(cq_hdl, &wc, 1, NULL);
		if (ibt_status != IBT_SUCCESS)
			return;

		/*
		 * Got a send completion
		 */
		if (wc.wc_id != RDMA_DUMMY_WRID) {
			wd = (struct send_wid *)(uintptr_t)wc.wc_id;
			qp = wd->qp;
			conn = qptoc(qp);

			mutex_enter(&wd->sendwait_lock);
			switch (wc.wc_status) {
			case IBT_WC_SUCCESS:
				wd->status = RDMA_SUCCESS;
				break;
			default:
/*
 *    RC Send Q Error Code		Local state     Remote State
 *    ====================		===========     ============
 *    IBT_WC_BAD_RESPONSE_ERR             ERROR           None
 *    IBT_WC_LOCAL_LEN_ERR                ERROR           None
 *    IBT_WC_LOCAL_CHAN_OP_ERR            ERROR           None
 *    IBT_WC_LOCAL_PROTECT_ERR            ERROR           None
 *    IBT_WC_MEM_WIN_BIND_ERR             ERROR           None
 *    IBT_WC_REMOTE_INVALID_REQ_ERR       ERROR           ERROR
 *    IBT_WC_REMOTE_ACCESS_ERR            ERROR           ERROR
 *    IBT_WC_REMOTE_OP_ERR                ERROR           ERROR
 *    IBT_WC_RNR_NAK_TIMEOUT_ERR          ERROR           None
 *    IBT_WC_TRANS_TIMEOUT_ERR            ERROR           None
 *    IBT_WC_WR_FLUSHED_ERR               ERROR           None
 */
				/*
				 * Channel in error state. Set connection to
				 * ERROR and cleanup will happen either from
				 * conn_release  or from rib_conn_get
				 */
				wd->status = RDMA_FAILED;
				mutex_enter(&conn->c_lock);
				if (conn->c_state != C_DISCONN_PEND)
					conn->c_state = C_ERROR_CONN;
				mutex_exit(&conn->c_lock);
				break;
			}

			if (wd->cv_sig == 1) {
				/*
				 * Notify poster
				 */
				cv_signal(&wd->wait_cv);
				mutex_exit(&wd->sendwait_lock);
			} else {
				/*
				 * Poster not waiting for notification.
				 * Free the send buffers and send_wid
				 */
				for (i = 0; i < wd->nsbufs; i++) {
					rib_rbuf_free(qptoc(wd->qp),
					    SEND_BUFFER,
					    (void *)(uintptr_t)wd->sbufaddr[i]);
				}

				/* decrement the send ref count */
				rib_send_rele(qp);

				mutex_exit(&wd->sendwait_lock);
				(void) rib_free_sendwait(wd);
			}
		}
	}
}

/* ARGSUSED */
static void
rib_svc_scq_handler(ibt_cq_hdl_t cq_hdl, void *arg)
{
	ibt_status_t	ibt_status;
	ibt_wc_t	wc;
	struct send_wid	*wd;
	rib_qp_t	*qp;
	CONN		*conn;
	int		i;

	/*
	 * Re-enable cq notify here to avoid missing any
	 * completion queue notification.
	 */
	(void) ibt_enable_cq_notify(cq_hdl, IBT_NEXT_COMPLETION);

	ibt_status = IBT_SUCCESS;
	while (ibt_status != IBT_CQ_EMPTY) {
		bzero(&wc, sizeof (wc));
		ibt_status = ibt_poll_cq(cq_hdl, &wc, 1, NULL);
		if (ibt_status != IBT_SUCCESS)
			return;

		/*
		 * Got a send completion
		 */
		if (wc.wc_id != RDMA_DUMMY_WRID) {
			wd = (struct send_wid *)(uintptr_t)wc.wc_id;
			qp = wd->qp;
			conn = qptoc(qp);
			mutex_enter(&wd->sendwait_lock);

			switch (wc.wc_status) {
			case IBT_WC_SUCCESS:
				wd->status = RDMA_SUCCESS;
				break;
			default:
				/*
				 * Channel in error state. Set connection to
				 * ERROR and cleanup will happen either from
				 * conn_release  or conn timeout.
				 */
				wd->status = RDMA_FAILED;
				mutex_enter(&conn->c_lock);
				if (conn->c_state != C_DISCONN_PEND)
					conn->c_state = C_ERROR_CONN;
				mutex_exit(&conn->c_lock);
				break;
			}

			if (wd->cv_sig == 1) {
				/*
				 * Update completion status and notify poster
				 */
				cv_signal(&wd->wait_cv);
				mutex_exit(&wd->sendwait_lock);
			} else {
				/*
				 * Poster not waiting for notification.
				 * Free the send buffers and send_wid
				 */
				for (i = 0; i < wd->nsbufs; i++) {
					rib_rbuf_free(qptoc(wd->qp),
					    SEND_BUFFER,
					    (void *)(uintptr_t)wd->sbufaddr[i]);
				}

				/* decrement the send ref count */
				rib_send_rele(qp);

				mutex_exit(&wd->sendwait_lock);
				(void) rib_free_sendwait(wd);
			}
		}
	}
}

/*
 * RCQ handler
 */
/* ARGSUSED */
static void
rib_clnt_rcq_handler(ibt_cq_hdl_t cq_hdl, void *arg)
{
	rib_qp_t	*qp;
	ibt_status_t	ibt_status;
	ibt_wc_t	wc;
	struct recv_wid	*rwid;

	/*
	 * Re-enable cq notify here to avoid missing any
	 * completion queue notification.
	 */
	(void) ibt_enable_cq_notify(cq_hdl, IBT_NEXT_COMPLETION);

	ibt_status = IBT_SUCCESS;
	while (ibt_status != IBT_CQ_EMPTY) {
		bzero(&wc, sizeof (wc));
		ibt_status = ibt_poll_cq(cq_hdl, &wc, 1, NULL);
		if (ibt_status != IBT_SUCCESS)
			return;

		rwid = (struct recv_wid *)(uintptr_t)wc.wc_id;
		qp = rwid->qp;

		if (wc.wc_status == IBT_WC_SUCCESS) {
			XDR	inxdrs, *xdrs;
			uint_t	xid, vers, op, find_xid = 0;
			struct reply	*r;
			CONN *conn = qptoc(qp);
			uint32_t rdma_credit = 0;

			xdrs = &inxdrs;
			xdrmem_create(xdrs, (caddr_t)(uintptr_t)rwid->addr,
			    wc.wc_bytes_xfer, XDR_DECODE);
			/*
			 * Treat xid as opaque (xid is the first entity
			 * in the rpc rdma message).
			 */
			xid = *(uint32_t *)(uintptr_t)rwid->addr;

			/* Skip xid and set the xdr position accordingly. */
			XDR_SETPOS(xdrs, sizeof (uint32_t));
			(void) xdr_u_int(xdrs, &vers);
			(void) xdr_u_int(xdrs, &rdma_credit);
			(void) xdr_u_int(xdrs, &op);
			XDR_DESTROY(xdrs);

			if (vers != RPCRDMA_VERS) {
				/*
				 * Invalid RPC/RDMA version. Cannot
				 * interoperate.  Set connection to
				 * ERROR state and bail out.
				 */
				mutex_enter(&conn->c_lock);
				if (conn->c_state != C_DISCONN_PEND)
					conn->c_state = C_ERROR_CONN;
				mutex_exit(&conn->c_lock);
				rib_rbuf_free(conn, RECV_BUFFER,
				    (void *)(uintptr_t)rwid->addr);
				rib_free_wid(rwid);
				rib_recv_rele(qp);
				continue;
			}

			mutex_enter(&qp->replylist_lock);
			for (r = qp->replylist; r != NULL; r = r->next) {
				if (r->xid == xid) {
					find_xid = 1;
					switch (op) {
					case RDMA_MSG:
					case RDMA_NOMSG:
					case RDMA_MSGP:
						r->status = RDMA_SUCCESS;
						r->vaddr_cq = rwid->addr;
						r->bytes_xfer =
						    wc.wc_bytes_xfer;
						cv_signal(&r->wait_cv);
						break;
					default:
						rib_rbuf_free(qptoc(qp),
						    RECV_BUFFER,
						    (void *)(uintptr_t)
						    rwid->addr);
						break;
					}
					break;
				}
			}
			mutex_exit(&qp->replylist_lock);
			if (find_xid == 0) {
				/* RPC caller not waiting for reply */

				DTRACE_PROBE1(rpcib__i__nomatchxid1,
				    int, xid);

				rib_rbuf_free(qptoc(qp), RECV_BUFFER,
				    (void *)(uintptr_t)rwid->addr);
			}
		} else if (wc.wc_status == IBT_WC_WR_FLUSHED_ERR) {
			CONN *conn = qptoc(qp);

			/*
			 * Connection being flushed. Just free
			 * the posted buffer
			 */
			rib_rbuf_free(conn, RECV_BUFFER,
			    (void *)(uintptr_t)rwid->addr);
		} else {
			CONN *conn = qptoc(qp);
/*
 *  RC Recv Q Error Code		Local state     Remote State
 *  ====================		===========     ============
 *  IBT_WC_LOCAL_ACCESS_ERR             ERROR           ERROR when NAK recvd
 *  IBT_WC_LOCAL_LEN_ERR                ERROR           ERROR when NAK recvd
 *  IBT_WC_LOCAL_PROTECT_ERR            ERROR           ERROR when NAK recvd
 *  IBT_WC_LOCAL_CHAN_OP_ERR            ERROR           ERROR when NAK recvd
 *  IBT_WC_REMOTE_INVALID_REQ_ERR       ERROR           ERROR when NAK recvd
 *  IBT_WC_WR_FLUSHED_ERR               None            None
 */
			/*
			 * Channel in error state. Set connection
			 * in ERROR state.
			 */
			mutex_enter(&conn->c_lock);
			if (conn->c_state != C_DISCONN_PEND)
				conn->c_state = C_ERROR_CONN;
			mutex_exit(&conn->c_lock);
			rib_rbuf_free(conn, RECV_BUFFER,
			    (void *)(uintptr_t)rwid->addr);
		}
		rib_free_wid(rwid);
		rib_recv_rele(qp);
	}
}

/* Server side */
/* ARGSUSED */
static void
rib_svc_rcq_handler(ibt_cq_hdl_t cq_hdl, void *arg)
{
	rdma_recv_data_t *rdp;
	rib_qp_t	*qp;
	ibt_status_t	ibt_status;
	ibt_wc_t	wc;
	struct svc_recv	*s_recvp;
	CONN		*conn;
	mblk_t		*mp;

	/*
	 * Re-enable cq notify here to avoid missing any
	 * completion queue notification.
	 */
	(void) ibt_enable_cq_notify(cq_hdl, IBT_NEXT_COMPLETION);

	ibt_status = IBT_SUCCESS;
	while (ibt_status != IBT_CQ_EMPTY) {
		bzero(&wc, sizeof (wc));
		ibt_status = ibt_poll_cq(cq_hdl, &wc, 1, NULL);
		if (ibt_status != IBT_SUCCESS)
			return;

		s_recvp = (struct svc_recv *)(uintptr_t)wc.wc_id;
		qp = s_recvp->qp;
		conn = qptoc(qp);

		if (wc.wc_status == IBT_WC_SUCCESS) {
			XDR	inxdrs, *xdrs;
			uint_t	xid, vers, op;
			uint32_t rdma_credit;

			xdrs = &inxdrs;
			/* s_recvp->vaddr stores data */
			xdrmem_create(xdrs, (caddr_t)(uintptr_t)s_recvp->vaddr,
			    wc.wc_bytes_xfer, XDR_DECODE);

			/*
			 * Treat xid as opaque (xid is the first entity
			 * in the rpc rdma message).
			 */
			xid = *(uint32_t *)(uintptr_t)s_recvp->vaddr;
			/* Skip xid and set the xdr position accordingly. */
			XDR_SETPOS(xdrs, sizeof (uint32_t));
			if (!xdr_u_int(xdrs, &vers) ||
			    !xdr_u_int(xdrs, &rdma_credit) ||
			    !xdr_u_int(xdrs, &op)) {
				rib_rbuf_free(conn, RECV_BUFFER,
				    (void *)(uintptr_t)s_recvp->vaddr);
				XDR_DESTROY(xdrs);
				rib_recv_rele(qp);
				(void) rib_free_svc_recv(s_recvp);
				continue;
			}
			XDR_DESTROY(xdrs);

			if (vers != RPCRDMA_VERS) {
				/*
				 * Invalid RPC/RDMA version.
				 * Drop rpc rdma message.
				 */
				rib_rbuf_free(conn, RECV_BUFFER,
				    (void *)(uintptr_t)s_recvp->vaddr);
				rib_recv_rele(qp);
				(void) rib_free_svc_recv(s_recvp);
				continue;
			}
			/*
			 * Is this for RDMA_DONE?
			 */
			if (op == RDMA_DONE) {
				rib_rbuf_free(conn, RECV_BUFFER,
				    (void *)(uintptr_t)s_recvp->vaddr);
				/*
				 * Wake up the thread waiting on
				 * a RDMA_DONE for xid
				 */
				mutex_enter(&qp->rdlist_lock);
				rdma_done_notify(qp, xid);
				mutex_exit(&qp->rdlist_lock);
				rib_recv_rele(qp);
				(void) rib_free_svc_recv(s_recvp);
				continue;
			}

			mutex_enter(&plugin_state_lock);
			mutex_enter(&conn->c_lock);
			if ((plugin_state == ACCEPT) &&
			    (conn->c_state == C_CONNECTED)) {
				conn->c_ref++;
				mutex_exit(&conn->c_lock);
				while ((mp = allocb(sizeof (*rdp), BPRI_LO))
				    == NULL)
					(void) strwaitbuf(
					    sizeof (*rdp), BPRI_LO);
				/*
				 * Plugin is in accept state, hence the master
				 * transport queue for this is still accepting
				 * requests. Hence we can call svc_queuereq to
				 * queue this recieved msg.
				 */
				rdp = (rdma_recv_data_t *)mp->b_rptr;
				rdp->conn = conn;
				rdp->rpcmsg.addr =
				    (caddr_t)(uintptr_t)s_recvp->vaddr;
				rdp->rpcmsg.type = RECV_BUFFER;
				rdp->rpcmsg.len = wc.wc_bytes_xfer;
				rdp->status = wc.wc_status;
				mp->b_wptr += sizeof (*rdp);
				(void) svc_queuereq((queue_t *)rib_stat->q, mp,
				    FALSE);
				mutex_exit(&plugin_state_lock);
			} else {
				/*
				 * The master transport for this is going
				 * away and the queue is not accepting anymore
				 * requests for krpc, so don't do anything, just
				 * free the msg.
				 */
				mutex_exit(&conn->c_lock);
				mutex_exit(&plugin_state_lock);
				rib_rbuf_free(conn, RECV_BUFFER,
				    (void *)(uintptr_t)s_recvp->vaddr);
			}
		} else {
			rib_rbuf_free(conn, RECV_BUFFER,
			    (void *)(uintptr_t)s_recvp->vaddr);
		}
		rib_recv_rele(qp);
		(void) rib_free_svc_recv(s_recvp);
	}
}

static void
rib_attach_hca()
{
	mutex_enter(&rib_stat->open_hca_lock);
	(void) rpcib_open_hcas(rib_stat);
	rib_listen(NULL);
	mutex_exit(&rib_stat->open_hca_lock);
}

/*
 * Handles DR event of IBT_HCA_DETACH_EVENT.
 */
/* ARGSUSED */
static void
rib_async_handler(void *clnt_private, ibt_hca_hdl_t hca_hdl,
    ibt_async_code_t code, ibt_async_event_t *event)
{
	switch (code) {
	case IBT_HCA_ATTACH_EVENT:
		rib_attach_hca();
		break;
	case IBT_HCA_DETACH_EVENT:
		rib_detach_hca(hca_hdl);
#ifdef DEBUG
		cmn_err(CE_NOTE, "rib_async_handler(): HCA being detached!\n");
#endif
		break;
	case IBT_EVENT_PORT_UP:
		/*
		 * A port is up. We should call rib_listen() since there is
		 * a chance that rib_listen() may have failed during
		 * rib_attach_hca() because the port had not been up yet.
		 */
		rib_listen(NULL);
#ifdef DEBUG
		cmn_err(CE_NOTE, "rib_async_handler(): IBT_EVENT_PORT_UP\n");
#endif
		break;
#ifdef DEBUG
	case IBT_EVENT_PATH_MIGRATED:
		cmn_err(CE_NOTE, "rib_async_handler(): "
		    "IBT_EVENT_PATH_MIGRATED\n");
		break;
	case IBT_EVENT_SQD:
		cmn_err(CE_NOTE, "rib_async_handler(): IBT_EVENT_SQD\n");
		break;
	case IBT_EVENT_COM_EST:
		cmn_err(CE_NOTE, "rib_async_handler(): IBT_EVENT_COM_EST\n");
		break;
	case IBT_ERROR_CATASTROPHIC_CHAN:
		cmn_err(CE_NOTE, "rib_async_handler(): "
		    "IBT_ERROR_CATASTROPHIC_CHAN\n");
		break;
	case IBT_ERROR_INVALID_REQUEST_CHAN:
		cmn_err(CE_NOTE, "rib_async_handler(): "
		    "IBT_ERROR_INVALID_REQUEST_CHAN\n");
		break;
	case IBT_ERROR_ACCESS_VIOLATION_CHAN:
		cmn_err(CE_NOTE, "rib_async_handler(): "
		    "IBT_ERROR_ACCESS_VIOLATION_CHAN\n");
		break;
	case IBT_ERROR_PATH_MIGRATE_REQ:
		cmn_err(CE_NOTE, "rib_async_handler(): "
		    "IBT_ERROR_PATH_MIGRATE_REQ\n");
		break;
	case IBT_ERROR_CQ:
		cmn_err(CE_NOTE, "rib_async_handler(): IBT_ERROR_CQ\n");
		break;
	case IBT_ERROR_PORT_DOWN:
		cmn_err(CE_NOTE, "rib_async_handler(): IBT_ERROR_PORT_DOWN\n");
		break;
	case IBT_ASYNC_OPAQUE1:
		cmn_err(CE_NOTE, "rib_async_handler(): IBT_ASYNC_OPAQUE1\n");
		break;
	case IBT_ASYNC_OPAQUE2:
		cmn_err(CE_NOTE, "rib_async_handler(): IBT_ASYNC_OPAQUE2\n");
		break;
	case IBT_ASYNC_OPAQUE3:
		cmn_err(CE_NOTE, "rib_async_handler(): IBT_ASYNC_OPAQUE3\n");
		break;
	case IBT_ASYNC_OPAQUE4:
		cmn_err(CE_NOTE, "rib_async_handler(): IBT_ASYNC_OPAQUE4\n");
		break;
#endif
	default:
		break;
	}
}

/*
 * Client's reachable function.
 */
static rdma_stat
rib_reachable(int addr_type, struct netbuf *raddr, void **handle)
{
	rdma_stat	status;
	rpcib_ping_t	rpt;
	struct netbuf	saddr;
	CONN		*conn;

	bzero(&saddr, sizeof (struct netbuf));
	status = rib_connect(&saddr, raddr, addr_type, &rpt, &conn);

	if (status == RDMA_SUCCESS) {
		*handle = (void *)rpt.hca;
		/* release the reference */
		(void) rib_conn_release(conn);
		return (RDMA_SUCCESS);
	} else {
		*handle = NULL;
		DTRACE_PROBE(rpcib__i__pingfailed);
		return (RDMA_FAILED);
	}
}

/* Client side qp creation */
static rdma_stat
rib_clnt_create_chan(rib_hca_t *hca, struct netbuf *raddr, rib_qp_t **qp)
{
	rib_qp_t	*kqp = NULL;
	CONN		*conn;
	rdma_clnt_cred_ctrl_t *cc_info;

	ASSERT(qp != NULL);
	*qp = NULL;

	kqp = kmem_zalloc(sizeof (rib_qp_t), KM_SLEEP);
	conn = qptoc(kqp);
	kqp->hca = hca;
	kqp->rdmaconn.c_rdmamod = &rib_mod;
	kqp->rdmaconn.c_private = (caddr_t)kqp;

	kqp->mode = RIB_CLIENT;
	kqp->chan_flags = IBT_BLOCKING;
	conn->c_raddr.buf = kmem_alloc(raddr->len, KM_SLEEP);
	bcopy(raddr->buf, conn->c_raddr.buf, raddr->len);
	conn->c_raddr.len = conn->c_raddr.maxlen = raddr->len;
	/*
	 * Initialize
	 */
	cv_init(&kqp->cb_conn_cv, NULL, CV_DEFAULT, NULL);
	cv_init(&kqp->posted_rbufs_cv, NULL, CV_DEFAULT, NULL);
	mutex_init(&kqp->posted_rbufs_lock, NULL, MUTEX_DRIVER, hca->iblock);
	cv_init(&kqp->send_rbufs_cv, NULL, CV_DEFAULT, NULL);
	mutex_init(&kqp->send_rbufs_lock, NULL, MUTEX_DRIVER, hca->iblock);
	mutex_init(&kqp->replylist_lock, NULL, MUTEX_DRIVER, hca->iblock);
	mutex_init(&kqp->rdlist_lock, NULL, MUTEX_DEFAULT, hca->iblock);
	mutex_init(&kqp->cb_lock, NULL, MUTEX_DRIVER, hca->iblock);
	cv_init(&kqp->rdmaconn.c_cv, NULL, CV_DEFAULT, NULL);
	mutex_init(&kqp->rdmaconn.c_lock, NULL, MUTEX_DRIVER, hca->iblock);
	/*
	 * Initialize the client credit control
	 * portion of the rdmaconn struct.
	 */
	kqp->rdmaconn.c_cc_type = RDMA_CC_CLNT;
	cc_info = &kqp->rdmaconn.rdma_conn_cred_ctrl_u.c_clnt_cc;
	cc_info->clnt_cc_granted_ops = 0;
	cc_info->clnt_cc_in_flight_ops = 0;
	cv_init(&cc_info->clnt_cc_cv, NULL, CV_DEFAULT, NULL);

	*qp = kqp;
	return (RDMA_SUCCESS);
}

/* Server side qp creation */
static rdma_stat
rib_svc_create_chan(rib_hca_t *hca, caddr_t q, uint8_t port, rib_qp_t **qp)
{
	rib_qp_t	*kqp = NULL;
	ibt_chan_sizes_t	chan_sizes;
	ibt_rc_chan_alloc_args_t	qp_attr;
	ibt_status_t		ibt_status;
	rdma_srv_cred_ctrl_t *cc_info;

	*qp = NULL;

	kqp = kmem_zalloc(sizeof (rib_qp_t), KM_SLEEP);
	kqp->hca = hca;
	kqp->port_num = port;
	kqp->rdmaconn.c_rdmamod = &rib_mod;
	kqp->rdmaconn.c_private = (caddr_t)kqp;

	/*
	 * Create the qp handle
	 */
	bzero(&qp_attr, sizeof (ibt_rc_chan_alloc_args_t));
	qp_attr.rc_scq = hca->svc_scq->rib_cq_hdl;
	qp_attr.rc_rcq = hca->svc_rcq->rib_cq_hdl;
	qp_attr.rc_pd = hca->pd_hdl;
	qp_attr.rc_hca_port_num = port;
	qp_attr.rc_sizes.cs_sq_sgl = DSEG_MAX;
	qp_attr.rc_sizes.cs_rq_sgl = RQ_DSEG_MAX;
	qp_attr.rc_sizes.cs_sq = DEF_SQ_SIZE;
	qp_attr.rc_sizes.cs_rq = DEF_RQ_SIZE;
	qp_attr.rc_clone_chan = NULL;
	qp_attr.rc_control = IBT_CEP_RDMA_RD | IBT_CEP_RDMA_WR;
	qp_attr.rc_flags = IBT_WR_SIGNALED;

	rw_enter(&hca->state_lock, RW_READER);
	if (hca->state != HCA_DETACHED) {
		ibt_status = ibt_alloc_rc_channel(hca->hca_hdl,
		    IBT_ACHAN_NO_FLAGS, &qp_attr, &kqp->qp_hdl,
		    &chan_sizes);
	} else {
		rw_exit(&hca->state_lock);
		goto fail;
	}
	rw_exit(&hca->state_lock);

	if (ibt_status != IBT_SUCCESS) {
		DTRACE_PROBE1(rpcib__i_svccreatechanfail,
		    int, ibt_status);
		goto fail;
	}

	kqp->mode = RIB_SERVER;
	kqp->chan_flags = IBT_BLOCKING;
	kqp->q = q;	/* server ONLY */

	cv_init(&kqp->cb_conn_cv, NULL, CV_DEFAULT, NULL);
	cv_init(&kqp->posted_rbufs_cv, NULL, CV_DEFAULT, NULL);
	mutex_init(&kqp->replylist_lock, NULL, MUTEX_DEFAULT, hca->iblock);
	mutex_init(&kqp->posted_rbufs_lock, NULL, MUTEX_DRIVER, hca->iblock);
	cv_init(&kqp->send_rbufs_cv, NULL, CV_DEFAULT, NULL);
	mutex_init(&kqp->send_rbufs_lock, NULL, MUTEX_DRIVER, hca->iblock);
	mutex_init(&kqp->rdlist_lock, NULL, MUTEX_DEFAULT, hca->iblock);
	mutex_init(&kqp->cb_lock, NULL, MUTEX_DRIVER, hca->iblock);
	cv_init(&kqp->rdmaconn.c_cv, NULL, CV_DEFAULT, NULL);
	mutex_init(&kqp->rdmaconn.c_lock, NULL, MUTEX_DRIVER, hca->iblock);
	/*
	 * Set the private data area to qp to be used in callbacks
	 */
	ibt_set_chan_private(kqp->qp_hdl, (void *)kqp);
	kqp->rdmaconn.c_state = C_CONNECTED;

	/*
	 * Initialize the server credit control
	 * portion of the rdmaconn struct.
	 */
	kqp->rdmaconn.c_cc_type = RDMA_CC_SRV;
	cc_info = &kqp->rdmaconn.rdma_conn_cred_ctrl_u.c_srv_cc;
	cc_info->srv_cc_buffers_granted = preposted_rbufs;
	cc_info->srv_cc_cur_buffers_used = 0;
	cc_info->srv_cc_posted = preposted_rbufs;

	*qp = kqp;

	return (RDMA_SUCCESS);
fail:
	if (kqp)
		kmem_free(kqp, sizeof (rib_qp_t));

	return (RDMA_FAILED);
}

/* ARGSUSED */
ibt_cm_status_t
rib_clnt_cm_handler(void *clnt_hdl, ibt_cm_event_t *event,
    ibt_cm_return_args_t *ret_args, void *priv_data,
    ibt_priv_data_len_t len)
{
	rib_hca_t	*hca;

	hca = (rib_hca_t *)clnt_hdl;

	switch (event->cm_type) {

	/* got a connection close event */
	case IBT_CM_EVENT_CONN_CLOSED:
	{
		CONN	*conn;
		rib_qp_t *qp;

		/* check reason why connection was closed */
		switch (event->cm_event.closed) {
		case IBT_CM_CLOSED_DREP_RCVD:
		case IBT_CM_CLOSED_DREQ_TIMEOUT:
		case IBT_CM_CLOSED_DUP:
		case IBT_CM_CLOSED_ABORT:
		case IBT_CM_CLOSED_ALREADY:
			/*
			 * These cases indicate the local end initiated
			 * the closing of the channel. Nothing to do here.
			 */
			break;
		default:
			/*
			 * Reason for CONN_CLOSED event must be one of
			 * IBT_CM_CLOSED_DREQ_RCVD or IBT_CM_CLOSED_REJ_RCVD
			 * or IBT_CM_CLOSED_STALE. These indicate cases were
			 * the remote end is closing the channel. In these
			 * cases free the channel and transition to error
			 * state
			 */
			qp = ibt_get_chan_private(event->cm_channel);
			conn = qptoc(qp);
			mutex_enter(&conn->c_lock);
			if (conn->c_state == C_DISCONN_PEND) {
				mutex_exit(&conn->c_lock);
				break;
			}

			conn->c_state = C_ERROR_CONN;

			/*
			 * Free the conn if c_ref is down to 0 already
			 */
			if (conn->c_ref == 0) {
				/*
				 * Remove from list and free conn
				 */
				conn->c_state = C_DISCONN_PEND;
				mutex_exit(&conn->c_lock);
				rw_enter(&hca->state_lock, RW_READER);
				if (hca->state != HCA_DETACHED)
					(void) rib_disconnect_channel(conn,
					    &hca->cl_conn_list);
				rw_exit(&hca->state_lock);
			} else {
				/*
				 * conn will be freed when c_ref goes to 0.
				 * Indicate to cleaning thread not to close
				 * the connection, but just free the channel.
				 */
				conn->c_flags |= C_CLOSE_NOTNEEDED;
				mutex_exit(&conn->c_lock);
			}
#ifdef DEBUG
			if (rib_debug)
				cmn_err(CE_NOTE, "rib_clnt_cm_handler: "
				    "(CONN_CLOSED) channel disconnected");
#endif
			break;
		}
		break;
	}
	default:
		break;
	}
	return (IBT_CM_ACCEPT);
}

/*
 * Connect to the server.
 */
rdma_stat
rib_conn_to_srv(rib_hca_t *hca, rib_qp_t *qp, rpcib_ping_t *rptp)
{
	ibt_chan_open_args_t	chan_args;	/* channel args */
	ibt_chan_sizes_t	chan_sizes;
	ibt_rc_chan_alloc_args_t	qp_attr;
	ibt_status_t		ibt_status;
	ibt_rc_returns_t	ret_args;	/* conn reject info */
	int refresh = REFRESH_ATTEMPTS;	/* refresh if IBT_CM_CONN_STALE */
	ibt_ip_cm_info_t	ipcm_info;
	uint8_t cmp_ip_pvt[IBT_IP_HDR_PRIV_DATA_SZ];


	(void) bzero(&chan_args, sizeof (chan_args));
	(void) bzero(&qp_attr, sizeof (ibt_rc_chan_alloc_args_t));
	(void) bzero(&ipcm_info, sizeof (ibt_ip_cm_info_t));

	ipcm_info.src_addr.family = rptp->srcip.family;
	switch (ipcm_info.src_addr.family) {
	case AF_INET:
		ipcm_info.src_addr.un.ip4addr = rptp->srcip.un.ip4addr;
		break;
	case AF_INET6:
		ipcm_info.src_addr.un.ip6addr = rptp->srcip.un.ip6addr;
		break;
	}

	ipcm_info.dst_addr.family = rptp->srcip.family;
	switch (ipcm_info.dst_addr.family) {
	case AF_INET:
		ipcm_info.dst_addr.un.ip4addr = rptp->dstip.un.ip4addr;
		break;
	case AF_INET6:
		ipcm_info.dst_addr.un.ip6addr = rptp->dstip.un.ip6addr;
		break;
	}

	ipcm_info.src_port = (in_port_t)nfs_rdma_port;

	ibt_status = ibt_format_ip_private_data(&ipcm_info,
	    IBT_IP_HDR_PRIV_DATA_SZ, cmp_ip_pvt);

	if (ibt_status != IBT_SUCCESS) {
		cmn_err(CE_WARN, "ibt_format_ip_private_data failed\n");
		return (-1);
	}

	qp_attr.rc_hca_port_num = rptp->path.pi_prim_cep_path.cep_hca_port_num;
	/* Alloc a RC channel */
	qp_attr.rc_scq = hca->clnt_scq->rib_cq_hdl;
	qp_attr.rc_rcq = hca->clnt_rcq->rib_cq_hdl;
	qp_attr.rc_pd = hca->pd_hdl;
	qp_attr.rc_sizes.cs_sq_sgl = DSEG_MAX;
	qp_attr.rc_sizes.cs_rq_sgl = RQ_DSEG_MAX;
	qp_attr.rc_sizes.cs_sq = DEF_SQ_SIZE;
	qp_attr.rc_sizes.cs_rq = DEF_RQ_SIZE;
	qp_attr.rc_clone_chan = NULL;
	qp_attr.rc_control = IBT_CEP_RDMA_RD | IBT_CEP_RDMA_WR;
	qp_attr.rc_flags = IBT_WR_SIGNALED;

	rptp->path.pi_sid = ibt_get_ip_sid(IPPROTO_TCP, nfs_rdma_port);
	chan_args.oc_path = &rptp->path;

	chan_args.oc_cm_handler = rib_clnt_cm_handler;
	chan_args.oc_cm_clnt_private = (void *)hca;
	chan_args.oc_rdma_ra_out = 4;
	chan_args.oc_rdma_ra_in = 4;
	chan_args.oc_path_retry_cnt = 2;
	chan_args.oc_path_rnr_retry_cnt = RNR_RETRIES;
	chan_args.oc_priv_data = cmp_ip_pvt;
	chan_args.oc_priv_data_len = IBT_IP_HDR_PRIV_DATA_SZ;

refresh:
	rw_enter(&hca->state_lock, RW_READER);
	if (hca->state != HCA_DETACHED) {
		ibt_status = ibt_alloc_rc_channel(hca->hca_hdl,
		    IBT_ACHAN_NO_FLAGS,
		    &qp_attr, &qp->qp_hdl,
		    &chan_sizes);
	} else {
		rw_exit(&hca->state_lock);
		return (RDMA_FAILED);
	}
	rw_exit(&hca->state_lock);

	if (ibt_status != IBT_SUCCESS) {
		DTRACE_PROBE1(rpcib__i_conntosrv,
		    int, ibt_status);
		return (RDMA_FAILED);
	}

	/* Connect to the Server */
	(void) bzero(&ret_args, sizeof (ret_args));
	mutex_enter(&qp->cb_lock);
	ibt_status = ibt_open_rc_channel(qp->qp_hdl, IBT_OCHAN_NO_FLAGS,
	    IBT_BLOCKING, &chan_args, &ret_args);
	if (ibt_status != IBT_SUCCESS) {
		DTRACE_PROBE2(rpcib__i_openrctosrv,
		    int, ibt_status, int, ret_args.rc_status);

		(void) ibt_free_channel(qp->qp_hdl);
		qp->qp_hdl = NULL;
		mutex_exit(&qp->cb_lock);
		if (refresh-- && ibt_status == IBT_CM_FAILURE &&
		    ret_args.rc_status == IBT_CM_CONN_STALE) {
			/*
			 * Got IBT_CM_CONN_STALE probably because of stale
			 * data on the passive end of a channel that existed
			 * prior to reboot. Retry establishing a channel
			 * REFRESH_ATTEMPTS times, during which time the
			 * stale conditions on the server might clear up.
			 */
			goto refresh;
		}
		return (RDMA_FAILED);
	}
	mutex_exit(&qp->cb_lock);
	/*
	 * Set the private data area to qp to be used in callbacks
	 */
	ibt_set_chan_private(qp->qp_hdl, (void *)qp);
	return (RDMA_SUCCESS);
}

rdma_stat
rib_ping_srv(int addr_type, struct netbuf *raddr, rpcib_ping_t *rptp)
{
	uint_t			i, addr_count;
	ibt_status_t		ibt_status;
	uint8_t			num_paths_p;
	ibt_ip_path_attr_t	ipattr;
	ibt_path_ip_src_t	srcip;
	rpcib_ipaddrs_t		addrs4;
	rpcib_ipaddrs_t		addrs6;
	struct sockaddr_in	*sinp;
	struct sockaddr_in6	*sin6p;
	rdma_stat		retval = RDMA_FAILED;
	rib_hca_t *hca;

	if ((addr_type != AF_INET) && (addr_type != AF_INET6))
		return (RDMA_INVAL);
	ASSERT(raddr->buf != NULL);

	bzero(&ipattr, sizeof (ibt_ip_path_attr_t));

	if (!rpcib_get_ib_addresses(&addrs4, &addrs6) ||
	    (addrs4.ri_count == 0 && addrs6.ri_count == 0)) {
		retval = RDMA_FAILED;
		goto done2;
	}

	if (addr_type == AF_INET) {
		addr_count = addrs4.ri_count;
		sinp = (struct sockaddr_in *)raddr->buf;
		rptp->dstip.family = AF_INET;
		rptp->dstip.un.ip4addr = sinp->sin_addr.s_addr;
		sinp = addrs4.ri_list;
	} else {
		addr_count = addrs6.ri_count;
		sin6p = (struct sockaddr_in6 *)raddr->buf;
		rptp->dstip.family = AF_INET6;
		rptp->dstip.un.ip6addr = sin6p->sin6_addr;
		sin6p = addrs6.ri_list;
	}

	rw_enter(&rib_stat->hcas_list_lock, RW_READER);
	for (hca = rib_stat->hcas_list; hca; hca = hca->next) {
		rw_enter(&hca->state_lock, RW_READER);
		if (hca->state == HCA_DETACHED) {
			rw_exit(&hca->state_lock);
			continue;
		}

		ipattr.ipa_dst_ip	= &rptp->dstip;
		ipattr.ipa_hca_guid	= hca->hca_guid;
		ipattr.ipa_ndst		= 1;
		ipattr.ipa_max_paths	= 1;
		ipattr.ipa_src_ip.family = rptp->dstip.family;
		for (i = 0; i < addr_count; i++) {
			num_paths_p = 0;
			if (addr_type == AF_INET) {
				ipattr.ipa_src_ip.un.ip4addr =
				    sinp[i].sin_addr.s_addr;
			} else {
				ipattr.ipa_src_ip.un.ip6addr =
				    sin6p[i].sin6_addr;
			}
			bzero(&srcip, sizeof (ibt_path_ip_src_t));

			ibt_status = ibt_get_ip_paths(rib_stat->ibt_clnt_hdl,
			    IBT_PATH_NO_FLAGS, &ipattr, &rptp->path,
			    &num_paths_p, &srcip);
			if (ibt_status == IBT_SUCCESS &&
			    num_paths_p != 0 &&
			    rptp->path.pi_hca_guid == hca->hca_guid) {
				rptp->hca = hca;
				rw_exit(&hca->state_lock);
				if (addr_type == AF_INET) {
					rptp->srcip.family = AF_INET;
					rptp->srcip.un.ip4addr =
					    srcip.ip_primary.un.ip4addr;
				} else {
					rptp->srcip.family = AF_INET6;
					rptp->srcip.un.ip6addr =
					    srcip.ip_primary.un.ip6addr;

				}
				retval = RDMA_SUCCESS;
				goto done1;
			}
		}
		rw_exit(&hca->state_lock);
	}
done1:
	rw_exit(&rib_stat->hcas_list_lock);
done2:
	if (addrs4.ri_size > 0)
		kmem_free(addrs4.ri_list, addrs4.ri_size);
	if (addrs6.ri_size > 0)
		kmem_free(addrs6.ri_list, addrs6.ri_size);
	return (retval);
}

/*
 * Close channel, remove from connection list and
 * free up resources allocated for that channel.
 */
rdma_stat
rib_disconnect_channel(CONN *conn, rib_conn_list_t *conn_list)
{
	rib_qp_t	*qp = ctoqp(conn);
	rib_hca_t	*hca;

	mutex_enter(&conn->c_lock);
	if (conn->c_timeout != NULL) {
		mutex_exit(&conn->c_lock);
		(void) untimeout(conn->c_timeout);
		mutex_enter(&conn->c_lock);
	}

	while (conn->c_flags & C_CLOSE_PENDING) {
		cv_wait(&conn->c_cv, &conn->c_lock);
	}
	mutex_exit(&conn->c_lock);

	/*
	 * c_ref == 0 and connection is in C_DISCONN_PEND
	 */
	hca = qp->hca;
	if (conn_list != NULL)
		(void) rib_rm_conn(conn, conn_list);

	/*
	 * There is only one case where we get here with
	 * qp_hdl = NULL, which is during connection setup on
	 * the client. In such a case there are no posted
	 * send/recv buffers.
	 */
	if (qp->qp_hdl != NULL) {
		mutex_enter(&qp->posted_rbufs_lock);
		while (qp->n_posted_rbufs)
			cv_wait(&qp->posted_rbufs_cv, &qp->posted_rbufs_lock);
		mutex_exit(&qp->posted_rbufs_lock);

		mutex_enter(&qp->send_rbufs_lock);
		while (qp->n_send_rbufs)
			cv_wait(&qp->send_rbufs_cv, &qp->send_rbufs_lock);
		mutex_exit(&qp->send_rbufs_lock);

		(void) ibt_free_channel(qp->qp_hdl);
			qp->qp_hdl = NULL;
	}

	ASSERT(qp->rdlist == NULL);

	if (qp->replylist != NULL) {
		(void) rib_rem_replylist(qp);
	}

	cv_destroy(&qp->cb_conn_cv);
	cv_destroy(&qp->posted_rbufs_cv);
	cv_destroy(&qp->send_rbufs_cv);
	mutex_destroy(&qp->cb_lock);
	mutex_destroy(&qp->replylist_lock);
	mutex_destroy(&qp->posted_rbufs_lock);
	mutex_destroy(&qp->send_rbufs_lock);
	mutex_destroy(&qp->rdlist_lock);

	cv_destroy(&conn->c_cv);
	mutex_destroy(&conn->c_lock);

	if (conn->c_raddr.buf != NULL) {
		kmem_free(conn->c_raddr.buf, conn->c_raddr.len);
	}
	if (conn->c_laddr.buf != NULL) {
		kmem_free(conn->c_laddr.buf, conn->c_laddr.len);
	}
	if (conn->c_netid != NULL) {
		kmem_free(conn->c_netid, (strlen(conn->c_netid) + 1));
	}
	if (conn->c_addrmask.buf != NULL) {
		kmem_free(conn->c_addrmask.buf, conn->c_addrmask.len);
	}

	/*
	 * Credit control cleanup.
	 */
	if (qp->rdmaconn.c_cc_type == RDMA_CC_CLNT) {
		rdma_clnt_cred_ctrl_t *cc_info;
		cc_info = &qp->rdmaconn.rdma_conn_cred_ctrl_u.c_clnt_cc;
		cv_destroy(&cc_info->clnt_cc_cv);
	}

	kmem_free(qp, sizeof (rib_qp_t));

	/*
	 * If HCA has been DETACHED and the srv/clnt_conn_list is NULL,
	 * then the hca is no longer being used.
	 */
	if (conn_list != NULL) {
		rw_enter(&hca->state_lock, RW_READER);
		if (hca->state == HCA_DETACHED) {
			rw_enter(&hca->srv_conn_list.conn_lock, RW_READER);
			if (hca->srv_conn_list.conn_hd == NULL) {
				rw_enter(&hca->cl_conn_list.conn_lock,
				    RW_READER);

				if (hca->cl_conn_list.conn_hd == NULL) {
					mutex_enter(&hca->inuse_lock);
					hca->inuse = FALSE;
					cv_signal(&hca->cb_cv);
					mutex_exit(&hca->inuse_lock);
				}
				rw_exit(&hca->cl_conn_list.conn_lock);
			}
			rw_exit(&hca->srv_conn_list.conn_lock);
		}
		rw_exit(&hca->state_lock);
	}

	return (RDMA_SUCCESS);
}

/*
 * All sends are done under the protection of
 * the wdesc->sendwait_lock. n_send_rbufs count
 * is protected using the send_rbufs_lock.
 * lock ordering is:
 * sendwait_lock -> send_rbufs_lock
 */

void
rib_send_hold(rib_qp_t *qp)
{
	mutex_enter(&qp->send_rbufs_lock);
	qp->n_send_rbufs++;
	mutex_exit(&qp->send_rbufs_lock);
}

void
rib_send_rele(rib_qp_t *qp)
{
	mutex_enter(&qp->send_rbufs_lock);
	qp->n_send_rbufs--;
	if (qp->n_send_rbufs == 0)
		cv_signal(&qp->send_rbufs_cv);
	mutex_exit(&qp->send_rbufs_lock);
}

void
rib_recv_rele(rib_qp_t *qp)
{
	mutex_enter(&qp->posted_rbufs_lock);
	qp->n_posted_rbufs--;
	if (qp->n_posted_rbufs == 0)
		cv_signal(&qp->posted_rbufs_cv);
	mutex_exit(&qp->posted_rbufs_lock);
}

/*
 * Wait for send completion notification. Only on receiving a
 * notification be it a successful or error completion, free the
 * send_wid.
 */
static rdma_stat
rib_sendwait(rib_qp_t *qp, struct send_wid *wd)
{
	clock_t timout, cv_wait_ret;
	rdma_stat error = RDMA_SUCCESS;
	int	i;

	/*
	 * Wait for send to complete
	 */
	ASSERT(wd != NULL);
	mutex_enter(&wd->sendwait_lock);
	if (wd->status == (uint_t)SEND_WAIT) {
		timout = drv_usectohz(SEND_WAIT_TIME * 1000000) +
		    ddi_get_lbolt();

		if (qp->mode == RIB_SERVER) {
			while ((cv_wait_ret = cv_timedwait(&wd->wait_cv,
			    &wd->sendwait_lock, timout)) > 0 &&
			    wd->status == (uint_t)SEND_WAIT)
				;
			switch (cv_wait_ret) {
			case -1:	/* timeout */
				DTRACE_PROBE(rpcib__i__srvsendwait__timeout);

				wd->cv_sig = 0;		/* no signal needed */
				error = RDMA_TIMEDOUT;
				break;
			default:	/* got send completion */
				break;
			}
		} else {
			while ((cv_wait_ret = cv_timedwait_sig(&wd->wait_cv,
			    &wd->sendwait_lock, timout)) > 0 &&
			    wd->status == (uint_t)SEND_WAIT)
				;
			switch (cv_wait_ret) {
			case -1:	/* timeout */
				DTRACE_PROBE(rpcib__i__clntsendwait__timeout);

				wd->cv_sig = 0;		/* no signal needed */
				error = RDMA_TIMEDOUT;
				break;
			case 0:		/* interrupted */
				DTRACE_PROBE(rpcib__i__clntsendwait__intr);

				wd->cv_sig = 0;		/* no signal needed */
				error = RDMA_INTR;
				break;
			default:	/* got send completion */
				break;
			}
		}
	}

	if (wd->status != (uint_t)SEND_WAIT) {
		/* got send completion */
		if (wd->status != RDMA_SUCCESS) {
			switch (wd->status) {
			case RDMA_CONNLOST:
				error = RDMA_CONNLOST;
				break;
			default:
				error = RDMA_FAILED;
				break;
			}
		}
		for (i = 0; i < wd->nsbufs; i++) {
			rib_rbuf_free(qptoc(qp), SEND_BUFFER,
			    (void *)(uintptr_t)wd->sbufaddr[i]);
		}

		rib_send_rele(qp);

		mutex_exit(&wd->sendwait_lock);
		(void) rib_free_sendwait(wd);

	} else {
		mutex_exit(&wd->sendwait_lock);
	}
	return (error);
}

static struct send_wid *
rib_init_sendwait(uint32_t xid, int cv_sig, rib_qp_t *qp)
{
	struct send_wid	*wd;

	wd = kmem_zalloc(sizeof (struct send_wid), KM_SLEEP);
	wd->xid = xid;
	wd->cv_sig = cv_sig;
	wd->qp = qp;
	cv_init(&wd->wait_cv, NULL, CV_DEFAULT, NULL);
	mutex_init(&wd->sendwait_lock, NULL, MUTEX_DRIVER, NULL);
	wd->status = (uint_t)SEND_WAIT;

	return (wd);
}

static int
rib_free_sendwait(struct send_wid *wdesc)
{
	cv_destroy(&wdesc->wait_cv);
	mutex_destroy(&wdesc->sendwait_lock);
	kmem_free(wdesc, sizeof (*wdesc));

	return (0);
}

static rdma_stat
rib_rem_rep(rib_qp_t *qp, struct reply *rep)
{
	mutex_enter(&qp->replylist_lock);
	if (rep != NULL) {
		(void) rib_remreply(qp, rep);
		mutex_exit(&qp->replylist_lock);
		return (RDMA_SUCCESS);
	}
	mutex_exit(&qp->replylist_lock);
	return (RDMA_FAILED);
}

/*
 * Send buffers are freed here only in case of error in posting
 * on QP. If the post succeeded, the send buffers are freed upon
 * send completion in rib_sendwait() or in the scq_handler.
 */
rdma_stat
rib_send_and_wait(CONN *conn, struct clist *cl, uint32_t msgid,
    int send_sig, int cv_sig, caddr_t *swid)
{
	struct send_wid	*wdesc;
	struct clist	*clp;
	ibt_status_t	ibt_status = IBT_SUCCESS;
	rdma_stat	ret = RDMA_SUCCESS;
	ibt_send_wr_t	tx_wr;
	int		i, nds;
	ibt_wr_ds_t	sgl[DSEG_MAX];
	uint_t		total_msg_size;
	rib_qp_t	*qp;

	qp = ctoqp(conn);

	ASSERT(cl != NULL);

	bzero(&tx_wr, sizeof (ibt_send_wr_t));

	nds = 0;
	total_msg_size = 0;
	clp = cl;
	while (clp != NULL) {
		if (nds >= DSEG_MAX) {
			DTRACE_PROBE(rpcib__i__sendandwait_dsegmax_exceeded);
			return (RDMA_FAILED);
		}
		sgl[nds].ds_va = clp->w.c_saddr;
		sgl[nds].ds_key = clp->c_smemhandle.mrc_lmr; /* lkey */
		sgl[nds].ds_len = clp->c_len;
		total_msg_size += clp->c_len;
		clp = clp->c_next;
		nds++;
	}

	if (send_sig) {
		/* Set SEND_SIGNAL flag. */
		tx_wr.wr_flags = IBT_WR_SEND_SIGNAL;
		wdesc = rib_init_sendwait(msgid, cv_sig, qp);
		*swid = (caddr_t)wdesc;
		tx_wr.wr_id = (ibt_wrid_t)(uintptr_t)wdesc;
		mutex_enter(&wdesc->sendwait_lock);
		wdesc->nsbufs = nds;
		for (i = 0; i < nds; i++) {
			wdesc->sbufaddr[i] = sgl[i].ds_va;
		}
	} else {
		tx_wr.wr_flags = IBT_WR_NO_FLAGS;
		*swid = NULL;
		tx_wr.wr_id = (ibt_wrid_t)RDMA_DUMMY_WRID;
	}

	tx_wr.wr_opcode = IBT_WRC_SEND;
	tx_wr.wr_trans = IBT_RC_SRV;
	tx_wr.wr_nds = nds;
	tx_wr.wr_sgl = sgl;

	mutex_enter(&conn->c_lock);
	if (conn->c_state == C_CONNECTED) {
		ibt_status = ibt_post_send(qp->qp_hdl, &tx_wr, 1, NULL);
	}
	if (conn->c_state != C_CONNECTED ||
	    ibt_status != IBT_SUCCESS) {
		if (conn->c_state != C_DISCONN_PEND)
			conn->c_state = C_ERROR_CONN;
		mutex_exit(&conn->c_lock);
		if (send_sig) {
			for (i = 0; i < nds; i++) {
				rib_rbuf_free(conn, SEND_BUFFER,
				    (void *)(uintptr_t)wdesc->sbufaddr[i]);
			}
			mutex_exit(&wdesc->sendwait_lock);
			(void) rib_free_sendwait(wdesc);
		}
		return (RDMA_CONNLOST);
	}

	mutex_exit(&conn->c_lock);

	if (send_sig) {
		rib_send_hold(qp);
		mutex_exit(&wdesc->sendwait_lock);
		if (cv_sig) {
			/*
			 * cv_wait for send to complete.
			 * We can fail due to a timeout or signal or
			 * unsuccessful send.
			 */
			ret = rib_sendwait(qp, wdesc);

			return (ret);
		}
	}

	return (RDMA_SUCCESS);
}


rdma_stat
rib_send(CONN *conn, struct clist *cl, uint32_t msgid)
{
	rdma_stat	ret;
	caddr_t		wd;

	/* send-wait & cv_signal */
	ret = rib_send_and_wait(conn, cl, msgid, 1, 1, &wd);
	return (ret);
}

/*
 * Deprecated/obsolete interface not used currently
 * but earlier used for READ-READ protocol.
 * Send RPC reply and wait for RDMA_DONE.
 */
rdma_stat
rib_send_resp(CONN *conn, struct clist *cl, uint32_t msgid)
{
	rdma_stat ret = RDMA_SUCCESS;
	struct rdma_done_list *rd;
	clock_t cv_wait_ret;
	caddr_t *wid = NULL;
	rib_qp_t *qp = ctoqp(conn);

	mutex_enter(&qp->rdlist_lock);
	rd = rdma_done_add(qp, msgid);

	/* No cv_signal (whether send-wait or no-send-wait) */
	ret = rib_send_and_wait(conn, cl, msgid, 1, 0, wid);

	if (ret != RDMA_SUCCESS) {
		rdma_done_rm(qp, rd);
	} else {
		/*
		 * Wait for RDMA_DONE from remote end
		 */
		cv_wait_ret = cv_reltimedwait(&rd->rdma_done_cv,
		    &qp->rdlist_lock, drv_usectohz(REPLY_WAIT_TIME * 1000000),
		    TR_CLOCK_TICK);

		rdma_done_rm(qp, rd);

		if (cv_wait_ret < 0) {
			ret = RDMA_TIMEDOUT;
		}
	}

	mutex_exit(&qp->rdlist_lock);
	return (ret);
}

static struct recv_wid *
rib_create_wid(rib_qp_t *qp, ibt_wr_ds_t *sgl, uint32_t msgid)
{
	struct recv_wid	*rwid;

	rwid = kmem_zalloc(sizeof (struct recv_wid), KM_SLEEP);
	rwid->xid = msgid;
	rwid->addr = sgl->ds_va;
	rwid->qp = qp;

	return (rwid);
}

static void
rib_free_wid(struct recv_wid *rwid)
{
	kmem_free(rwid, sizeof (struct recv_wid));
}

rdma_stat
rib_clnt_post(CONN* conn, struct clist *cl, uint32_t msgid)
{
	rib_qp_t	*qp = ctoqp(conn);
	struct clist	*clp = cl;
	struct reply	*rep;
	struct recv_wid	*rwid;
	int		nds;
	ibt_wr_ds_t	sgl[DSEG_MAX];
	ibt_recv_wr_t	recv_wr;
	rdma_stat	ret;
	ibt_status_t	ibt_status;

	/*
	 * rdma_clnt_postrecv uses RECV_BUFFER.
	 */

	nds = 0;
	while (cl != NULL) {
		if (nds >= DSEG_MAX) {
			ret = RDMA_FAILED;
			goto done;
		}
		sgl[nds].ds_va = cl->w.c_saddr;
		sgl[nds].ds_key = cl->c_smemhandle.mrc_lmr; /* lkey */
		sgl[nds].ds_len = cl->c_len;
		cl = cl->c_next;
		nds++;
	}

	if (nds != 1) {
		ret = RDMA_FAILED;
		goto done;
	}

	bzero(&recv_wr, sizeof (ibt_recv_wr_t));
	recv_wr.wr_nds = nds;
	recv_wr.wr_sgl = sgl;

	rwid = rib_create_wid(qp, &sgl[0], msgid);
	if (rwid) {
		recv_wr.wr_id = (ibt_wrid_t)(uintptr_t)rwid;
	} else {
		ret = RDMA_NORESOURCE;
		goto done;
	}
	rep = rib_addreplylist(qp, msgid);
	if (!rep) {
		rib_free_wid(rwid);
		ret = RDMA_NORESOURCE;
		goto done;
	}

	mutex_enter(&conn->c_lock);

	if (conn->c_state == C_CONNECTED) {
		ibt_status = ibt_post_recv(qp->qp_hdl, &recv_wr, 1, NULL);
	}

	if (conn->c_state != C_CONNECTED ||
	    ibt_status != IBT_SUCCESS) {
		if (conn->c_state != C_DISCONN_PEND)
			conn->c_state = C_ERROR_CONN;
		mutex_exit(&conn->c_lock);
		rib_free_wid(rwid);
		(void) rib_rem_rep(qp, rep);
		ret = RDMA_CONNLOST;
		goto done;
	}

	mutex_enter(&qp->posted_rbufs_lock);
	qp->n_posted_rbufs++;
	mutex_exit(&qp->posted_rbufs_lock);

	mutex_exit(&conn->c_lock);
	return (RDMA_SUCCESS);

done:
	while (clp != NULL) {
		rib_rbuf_free(conn, RECV_BUFFER,
		    (void *)(uintptr_t)clp->w.c_saddr3);
		clp = clp->c_next;
	}
	return (ret);
}

rdma_stat
rib_svc_post(CONN* conn, struct clist *cl)
{
	rib_qp_t	*qp = ctoqp(conn);
	struct svc_recv	*s_recvp;
	int		nds;
	ibt_wr_ds_t	sgl[DSEG_MAX];
	ibt_recv_wr_t	recv_wr;
	ibt_status_t	ibt_status;

	nds = 0;
	while (cl != NULL) {
		if (nds >= DSEG_MAX) {
			return (RDMA_FAILED);
		}
		sgl[nds].ds_va = cl->w.c_saddr;
		sgl[nds].ds_key = cl->c_smemhandle.mrc_lmr; /* lkey */
		sgl[nds].ds_len = cl->c_len;
		cl = cl->c_next;
		nds++;
	}

	if (nds != 1) {
		rib_rbuf_free(conn, RECV_BUFFER,
		    (caddr_t)(uintptr_t)sgl[0].ds_va);

		return (RDMA_FAILED);
	}

	bzero(&recv_wr, sizeof (ibt_recv_wr_t));
	recv_wr.wr_nds = nds;
	recv_wr.wr_sgl = sgl;

	s_recvp = rib_init_svc_recv(qp, &sgl[0]);
	/* Use s_recvp's addr as wr id */
	recv_wr.wr_id = (ibt_wrid_t)(uintptr_t)s_recvp;
	mutex_enter(&conn->c_lock);
	if (conn->c_state == C_CONNECTED) {
		ibt_status = ibt_post_recv(qp->qp_hdl, &recv_wr, 1, NULL);
	}
	if (conn->c_state != C_CONNECTED ||
	    ibt_status != IBT_SUCCESS) {
		if (conn->c_state != C_DISCONN_PEND)
			conn->c_state = C_ERROR_CONN;
		mutex_exit(&conn->c_lock);
		rib_rbuf_free(conn, RECV_BUFFER,
		    (caddr_t)(uintptr_t)sgl[0].ds_va);
		(void) rib_free_svc_recv(s_recvp);

		return (RDMA_CONNLOST);
	}
	mutex_exit(&conn->c_lock);

	return (RDMA_SUCCESS);
}

/* Client */
rdma_stat
rib_post_resp(CONN* conn, struct clist *cl, uint32_t msgid)
{
	return (rib_clnt_post(conn, cl, msgid));
}

/* Client */
rdma_stat
rib_post_resp_remove(CONN* conn, uint32_t msgid)
{
	rib_qp_t	*qp = ctoqp(conn);
	struct reply	*rep;

	mutex_enter(&qp->replylist_lock);
	for (rep = qp->replylist; rep != NULL; rep = rep->next) {
		if (rep->xid == msgid) {
			if (rep->vaddr_cq) {
				rib_rbuf_free(conn, RECV_BUFFER,
				    (caddr_t)(uintptr_t)rep->vaddr_cq);
			}
			(void) rib_remreply(qp, rep);
			break;
		}
	}
	mutex_exit(&qp->replylist_lock);

	return (RDMA_SUCCESS);
}

/* Server */
rdma_stat
rib_post_recv(CONN *conn, struct clist *cl)
{
	rib_qp_t	*qp = ctoqp(conn);

	if (rib_svc_post(conn, cl) == RDMA_SUCCESS) {
		mutex_enter(&qp->posted_rbufs_lock);
		qp->n_posted_rbufs++;
		mutex_exit(&qp->posted_rbufs_lock);
		return (RDMA_SUCCESS);
	}
	return (RDMA_FAILED);
}

/*
 * Client side only interface to "recv" the rpc reply buf
 * posted earlier by rib_post_resp(conn, cl, msgid).
 */
rdma_stat
rib_recv(CONN *conn, struct clist **clp, uint32_t msgid)
{
	struct reply *rep = NULL;
	clock_t timout, cv_wait_ret;
	rdma_stat ret = RDMA_SUCCESS;
	rib_qp_t *qp = ctoqp(conn);

	/*
	 * Find the reply structure for this msgid
	 */
	mutex_enter(&qp->replylist_lock);

	for (rep = qp->replylist; rep != NULL; rep = rep->next) {
		if (rep->xid == msgid)
			break;
	}

	if (rep != NULL) {
		/*
		 * If message not yet received, wait.
		 */
		if (rep->status == (uint_t)REPLY_WAIT) {
			timout = ddi_get_lbolt() +
			    drv_usectohz(REPLY_WAIT_TIME * 1000000);

			while ((cv_wait_ret = cv_timedwait_sig(&rep->wait_cv,
			    &qp->replylist_lock, timout)) > 0 &&
			    rep->status == (uint_t)REPLY_WAIT)
				;

			switch (cv_wait_ret) {
			case -1:	/* timeout */
				ret = RDMA_TIMEDOUT;
				break;
			case 0:
				ret = RDMA_INTR;
				break;
			default:
				break;
			}
		}

		if (rep->status == RDMA_SUCCESS) {
			struct clist *cl = NULL;

			/*
			 * Got message successfully
			 */
			clist_add(&cl, 0, rep->bytes_xfer, NULL,
			    (caddr_t)(uintptr_t)rep->vaddr_cq, NULL, NULL);
			*clp = cl;
		} else {
			if (rep->status != (uint_t)REPLY_WAIT) {
				/*
				 * Got error in reply message. Free
				 * recv buffer here.
				 */
				ret = rep->status;
				rib_rbuf_free(conn, RECV_BUFFER,
				    (caddr_t)(uintptr_t)rep->vaddr_cq);
			}
		}
		(void) rib_remreply(qp, rep);
	} else {
		/*
		 * No matching reply structure found for given msgid on the
		 * reply wait list.
		 */
		ret = RDMA_INVAL;
		DTRACE_PROBE(rpcib__i__nomatchxid2);
	}

	/*
	 * Done.
	 */
	mutex_exit(&qp->replylist_lock);
	return (ret);
}

/*
 * RDMA write a buffer to the remote address.
 */
rdma_stat
rib_write(CONN *conn, struct clist *cl, int wait)
{
	ibt_send_wr_t	tx_wr;
	int		cv_sig;
	ibt_wr_ds_t	sgl[DSEG_MAX];
	struct send_wid	*wdesc;
	ibt_status_t	ibt_status;
	rdma_stat	ret = RDMA_SUCCESS;
	rib_qp_t	*qp = ctoqp(conn);
	uint64_t	n_writes = 0;

	if (cl == NULL) {
		return (RDMA_FAILED);
	}

	while ((cl != NULL)) {
		if (cl->c_len > 0) {
			bzero(&tx_wr, sizeof (ibt_send_wr_t));
			tx_wr.wr.rc.rcwr.rdma.rdma_raddr = cl->u.c_daddr;
			tx_wr.wr.rc.rcwr.rdma.rdma_rkey =
			    cl->c_dmemhandle.mrc_rmr; /* rkey */
			sgl[0].ds_va = cl->w.c_saddr;
			sgl[0].ds_key = cl->c_smemhandle.mrc_lmr; /* lkey */
			sgl[0].ds_len = cl->c_len;

			if (wait) {
				cv_sig = 1;
			} else {
				if (n_writes > max_unsignaled_rws) {
					n_writes = 0;
					cv_sig = 1;
				} else {
					cv_sig = 0;
				}
			}

			if (cv_sig) {
				tx_wr.wr_flags = IBT_WR_SEND_SIGNAL;
				wdesc = rib_init_sendwait(0, cv_sig, qp);
				tx_wr.wr_id = (ibt_wrid_t)(uintptr_t)wdesc;
				mutex_enter(&wdesc->sendwait_lock);
			} else {
				tx_wr.wr_flags = IBT_WR_NO_FLAGS;
				tx_wr.wr_id = (ibt_wrid_t)RDMA_DUMMY_WRID;
			}
			tx_wr.wr_opcode = IBT_WRC_RDMAW;
			tx_wr.wr_trans = IBT_RC_SRV;
			tx_wr.wr_nds = 1;
			tx_wr.wr_sgl = sgl;

			mutex_enter(&conn->c_lock);
			if (conn->c_state == C_CONNECTED) {
				ibt_status =
				    ibt_post_send(qp->qp_hdl, &tx_wr, 1, NULL);
			}
			if (conn->c_state != C_CONNECTED ||
			    ibt_status != IBT_SUCCESS) {
				if (conn->c_state != C_DISCONN_PEND)
					conn->c_state = C_ERROR_CONN;
				mutex_exit(&conn->c_lock);
				if (cv_sig) {
					mutex_exit(&wdesc->sendwait_lock);
					(void) rib_free_sendwait(wdesc);
				}
				return (RDMA_CONNLOST);
			}

			mutex_exit(&conn->c_lock);

			/*
			 * Wait for send to complete
			 */
			if (cv_sig) {

				rib_send_hold(qp);
				mutex_exit(&wdesc->sendwait_lock);

				ret = rib_sendwait(qp, wdesc);
				if (ret != 0)
					return (ret);
			}
			n_writes ++;
		}
		cl = cl->c_next;
	}
	return (RDMA_SUCCESS);
}

/*
 * RDMA Read a buffer from the remote address.
 */
rdma_stat
rib_read(CONN *conn, struct clist *cl, int wait)
{
	ibt_send_wr_t	rx_wr;
	int		cv_sig = 0;
	ibt_wr_ds_t	sgl;
	struct send_wid	*wdesc;
	ibt_status_t	ibt_status = IBT_SUCCESS;
	rdma_stat	ret = RDMA_SUCCESS;
	rib_qp_t	*qp = ctoqp(conn);

	if (cl == NULL) {
		return (RDMA_FAILED);
	}

	while (cl != NULL) {
		bzero(&rx_wr, sizeof (ibt_send_wr_t));
		/*
		 * Remote address is at the head chunk item in list.
		 */
		rx_wr.wr.rc.rcwr.rdma.rdma_raddr = cl->w.c_saddr;
		rx_wr.wr.rc.rcwr.rdma.rdma_rkey = cl->c_smemhandle.mrc_rmr;

		sgl.ds_va = cl->u.c_daddr;
		sgl.ds_key = cl->c_dmemhandle.mrc_lmr; /* lkey */
		sgl.ds_len = cl->c_len;

		/*
		 * If there are multiple chunks to be read, and
		 * wait is set, ask for signal only for the last chunk
		 * and wait only on the last chunk. The completion of
		 * RDMA_READ on last chunk ensures that reads on all
		 * previous chunks are also completed.
		 */
		if (wait && (cl->c_next == NULL)) {
			cv_sig = 1;
			wdesc = rib_init_sendwait(0, cv_sig, qp);
			rx_wr.wr_flags = IBT_WR_SEND_SIGNAL;
			rx_wr.wr_id = (ibt_wrid_t)(uintptr_t)wdesc;
			mutex_enter(&wdesc->sendwait_lock);
		} else {
			rx_wr.wr_flags = IBT_WR_NO_FLAGS;
			rx_wr.wr_id = (ibt_wrid_t)RDMA_DUMMY_WRID;
		}
		rx_wr.wr_opcode = IBT_WRC_RDMAR;
		rx_wr.wr_trans = IBT_RC_SRV;
		rx_wr.wr_nds = 1;
		rx_wr.wr_sgl = &sgl;

		mutex_enter(&conn->c_lock);
		if (conn->c_state == C_CONNECTED) {
			ibt_status = ibt_post_send(qp->qp_hdl, &rx_wr, 1, NULL);
		}
		if (conn->c_state != C_CONNECTED ||
		    ibt_status != IBT_SUCCESS) {
			if (conn->c_state != C_DISCONN_PEND)
				conn->c_state = C_ERROR_CONN;
			mutex_exit(&conn->c_lock);
			if (wait && (cl->c_next == NULL)) {
				mutex_exit(&wdesc->sendwait_lock);
				(void) rib_free_sendwait(wdesc);
			}
			return (RDMA_CONNLOST);
		}

		mutex_exit(&conn->c_lock);

		/*
		 * Wait for send to complete if this is the
		 * last item in the list.
		 */
		if (wait && cl->c_next == NULL) {
			rib_send_hold(qp);
			mutex_exit(&wdesc->sendwait_lock);

			ret = rib_sendwait(qp, wdesc);

			if (ret != 0)
				return (ret);
		}
		cl = cl->c_next;
	}
	return (RDMA_SUCCESS);
}

/*
 * rib_srv_cm_handler()
 *    Connection Manager callback to handle RC connection requests.
 */
/* ARGSUSED */
static ibt_cm_status_t
rib_srv_cm_handler(void *any, ibt_cm_event_t *event,
    ibt_cm_return_args_t *ret_args, void *priv_data,
    ibt_priv_data_len_t len)
{
	queue_t		*q;
	rib_qp_t	*qp;
	rib_hca_t	*hca;
	rdma_stat	status = RDMA_SUCCESS;
	int		i;
	struct clist	cl;
	rdma_buf_t	rdbuf = {0};
	void		*buf = NULL;
	CONN		*conn;
	ibt_ip_cm_info_t	ipinfo;
	struct sockaddr_in *s;
	struct sockaddr_in6 *s6;
	int sin_size = sizeof (struct sockaddr_in);
	int in_size = sizeof (struct in_addr);
	int sin6_size = sizeof (struct sockaddr_in6);

	ASSERT(any != NULL);
	ASSERT(event != NULL);

	hca = (rib_hca_t *)any;

	/* got a connection request */
	switch (event->cm_type) {
	case IBT_CM_EVENT_REQ_RCV:
		/*
		 * If the plugin is in the NO_ACCEPT state, bail out.
		 */
		mutex_enter(&plugin_state_lock);
		if (plugin_state == NO_ACCEPT) {
			mutex_exit(&plugin_state_lock);
			return (IBT_CM_REJECT);
		}
		mutex_exit(&plugin_state_lock);

		/*
		 * Need to send a MRA MAD to CM so that it does not
		 * timeout on us.
		 */
		(void) ibt_cm_delay(IBT_CM_DELAY_REQ, event->cm_session_id,
		    event->cm_event.req.req_timeout * 8, NULL, 0);

		mutex_enter(&rib_stat->open_hca_lock);
		q = rib_stat->q;
		mutex_exit(&rib_stat->open_hca_lock);

		status = rib_svc_create_chan(hca, (caddr_t)q,
		    event->cm_event.req.req_prim_hca_port, &qp);

		if (status) {
			return (IBT_CM_REJECT);
		}

		ret_args->cm_ret.rep.cm_channel = qp->qp_hdl;
		ret_args->cm_ret.rep.cm_rdma_ra_out = 4;
		ret_args->cm_ret.rep.cm_rdma_ra_in = 4;
		ret_args->cm_ret.rep.cm_rnr_retry_cnt = RNR_RETRIES;

		/*
		 * Pre-posts RECV buffers
		 */
		conn = qptoc(qp);
		for (i = 0; i < preposted_rbufs; i++) {
			bzero(&rdbuf, sizeof (rdbuf));
			rdbuf.type = RECV_BUFFER;
			buf = rib_rbuf_alloc(conn, &rdbuf);
			if (buf == NULL) {
				/*
				 * A connection is not established yet.
				 * Just flush the channel. Buffers
				 * posted till now will error out with
				 * IBT_WC_WR_FLUSHED_ERR.
				 */
				(void) ibt_flush_channel(qp->qp_hdl);
				(void) rib_disconnect_channel(conn, NULL);
				return (IBT_CM_REJECT);
			}

			bzero(&cl, sizeof (cl));
			cl.w.c_saddr3 = (caddr_t)rdbuf.addr;
			cl.c_len = rdbuf.len;
			cl.c_smemhandle.mrc_lmr =
			    rdbuf.handle.mrc_lmr; /* lkey */
			cl.c_next = NULL;
			status = rib_post_recv(conn, &cl);
			if (status != RDMA_SUCCESS) {
				/*
				 * A connection is not established yet.
				 * Just flush the channel. Buffers
				 * posted till now will error out with
				 * IBT_WC_WR_FLUSHED_ERR.
				 */
				(void) ibt_flush_channel(qp->qp_hdl);
				(void) rib_disconnect_channel(conn, NULL);
				return (IBT_CM_REJECT);
			}
		}
		(void) rib_add_connlist(conn, &hca->srv_conn_list);

		/*
		 * Get the address translation
		 */
		rw_enter(&hca->state_lock, RW_READER);
		if (hca->state == HCA_DETACHED) {
			rw_exit(&hca->state_lock);
			return (IBT_CM_REJECT);
		}
		rw_exit(&hca->state_lock);

		bzero(&ipinfo, sizeof (ibt_ip_cm_info_t));

		if (ibt_get_ip_data(event->cm_priv_data_len,
		    event->cm_priv_data,
		    &ipinfo) != IBT_SUCCESS) {

			return (IBT_CM_REJECT);
		}

		switch (ipinfo.src_addr.family) {
		case AF_INET:

			conn->c_netid = kmem_zalloc(strlen(RIBNETID_TCP) + 1,
			    KM_SLEEP);
			(void) strcpy(conn->c_netid, RIBNETID_TCP);

			conn->c_raddr.maxlen =
			    conn->c_raddr.len = sin_size;
			conn->c_raddr.buf = kmem_zalloc(sin_size, KM_SLEEP);

			s = (struct sockaddr_in *)conn->c_raddr.buf;
			s->sin_family = AF_INET;
			bcopy((void *)&ipinfo.src_addr.un.ip4addr,
			    &s->sin_addr, in_size);

			conn->c_laddr.maxlen =
			    conn->c_laddr.len = sin_size;
			conn->c_laddr.buf = kmem_zalloc(sin_size, KM_SLEEP);

			s = (struct sockaddr_in *)conn->c_laddr.buf;
			s->sin_family = AF_INET;
			bcopy((void *)&ipinfo.dst_addr.un.ip4addr,
			    &s->sin_addr, in_size);

			conn->c_addrmask.maxlen = conn->c_addrmask.len =
			    sizeof (struct sockaddr_in);
			conn->c_addrmask.buf =
			    kmem_zalloc(conn->c_addrmask.len, KM_SLEEP);
			((struct sockaddr_in *)
			    conn->c_addrmask.buf)->sin_addr.s_addr =
			    (uint32_t)~0;
			((struct sockaddr_in *)
			    conn->c_addrmask.buf)->sin_family =
			    (sa_family_t)~0;
			break;

		case AF_INET6:

			conn->c_netid = kmem_zalloc(strlen(RIBNETID_TCP6) + 1,
			    KM_SLEEP);
			(void) strcpy(conn->c_netid, RIBNETID_TCP6);

			conn->c_raddr.maxlen =
			    conn->c_raddr.len = sin6_size;
			conn->c_raddr.buf = kmem_zalloc(sin6_size, KM_SLEEP);

			s6 = (struct sockaddr_in6 *)conn->c_raddr.buf;
			s6->sin6_family = AF_INET6;
			bcopy((void *)&ipinfo.src_addr.un.ip6addr,
			    &s6->sin6_addr,
			    sizeof (struct in6_addr));

			conn->c_laddr.maxlen =
			    conn->c_laddr.len = sin6_size;
			conn->c_laddr.buf = kmem_zalloc(sin6_size, KM_SLEEP);

			s6 = (struct sockaddr_in6 *)conn->c_laddr.buf;
			s6->sin6_family = AF_INET6;
			bcopy((void *)&ipinfo.dst_addr.un.ip6addr,
			    &s6->sin6_addr,
			    sizeof (struct in6_addr));

			conn->c_addrmask.maxlen = conn->c_addrmask.len =
			    sizeof (struct sockaddr_in6);
			conn->c_addrmask.buf =
			    kmem_zalloc(conn->c_addrmask.len, KM_SLEEP);
			(void) memset(&((struct sockaddr_in6 *)
			    conn->c_addrmask.buf)->sin6_addr, (uchar_t)~0,
			    sizeof (struct in6_addr));
			((struct sockaddr_in6 *)
			    conn->c_addrmask.buf)->sin6_family =
			    (sa_family_t)~0;
			break;

		default:
			return (IBT_CM_REJECT);
		}

		break;

	case IBT_CM_EVENT_CONN_CLOSED:
	{
		CONN		*conn;
		rib_qp_t	*qp;

		switch (event->cm_event.closed) {
		case IBT_CM_CLOSED_DREP_RCVD:
		case IBT_CM_CLOSED_DREQ_TIMEOUT:
		case IBT_CM_CLOSED_DUP:
		case IBT_CM_CLOSED_ABORT:
		case IBT_CM_CLOSED_ALREADY:
			/*
			 * These cases indicate the local end initiated
			 * the closing of the channel. Nothing to do here.
			 */
			break;
		default:
			/*
			 * Reason for CONN_CLOSED event must be one of
			 * IBT_CM_CLOSED_DREQ_RCVD or IBT_CM_CLOSED_REJ_RCVD
			 * or IBT_CM_CLOSED_STALE. These indicate cases were
			 * the remote end is closing the channel. In these
			 * cases free the channel and transition to error
			 * state
			 */
			qp = ibt_get_chan_private(event->cm_channel);
			conn = qptoc(qp);
			mutex_enter(&conn->c_lock);
			if (conn->c_state == C_DISCONN_PEND) {
				mutex_exit(&conn->c_lock);
				break;
			}
			conn->c_state = C_ERROR_CONN;

			/*
			 * Free the conn if c_ref goes down to 0
			 */
			if (conn->c_ref == 0) {
				/*
				 * Remove from list and free conn
				 */
				conn->c_state = C_DISCONN_PEND;
				mutex_exit(&conn->c_lock);
				(void) rib_disconnect_channel(conn,
				    &hca->srv_conn_list);
			} else {
				/*
				 * conn will be freed when c_ref goes to 0.
				 * Indicate to cleaning thread not to close
				 * the connection, but just free the channel.
				 */
				conn->c_flags |= C_CLOSE_NOTNEEDED;
				mutex_exit(&conn->c_lock);
			}
			DTRACE_PROBE(rpcib__i__srvcm_chandisconnect);
			break;
		}
		break;
	}
	case IBT_CM_EVENT_CONN_EST:
		/*
		 * RTU received, hence connection established.
		 */
		if (rib_debug > 1)
			cmn_err(CE_NOTE, "rib_srv_cm_handler: "
			    "(CONN_EST) channel established");
		break;

	default:
		if (rib_debug > 2) {
			/* Let CM handle the following events. */
			if (event->cm_type == IBT_CM_EVENT_REP_RCV) {
				cmn_err(CE_NOTE, "rib_srv_cm_handler: "
				    "server recv'ed IBT_CM_EVENT_REP_RCV\n");
			} else if (event->cm_type == IBT_CM_EVENT_LAP_RCV) {
				cmn_err(CE_NOTE, "rib_srv_cm_handler: "
				    "server recv'ed IBT_CM_EVENT_LAP_RCV\n");
			} else if (event->cm_type == IBT_CM_EVENT_MRA_RCV) {
				cmn_err(CE_NOTE, "rib_srv_cm_handler: "
				    "server recv'ed IBT_CM_EVENT_MRA_RCV\n");
			} else if (event->cm_type == IBT_CM_EVENT_APR_RCV) {
				cmn_err(CE_NOTE, "rib_srv_cm_handler: "
				    "server recv'ed IBT_CM_EVENT_APR_RCV\n");
			} else if (event->cm_type == IBT_CM_EVENT_FAILURE) {
				cmn_err(CE_NOTE, "rib_srv_cm_handler: "
				    "server recv'ed IBT_CM_EVENT_FAILURE\n");
			}
		}
		return (IBT_CM_DEFAULT);
	}

	/* accept all other CM messages (i.e. let the CM handle them) */
	return (IBT_CM_ACCEPT);
}

static rdma_stat
rib_register_service(rib_hca_t *hca, int service_type,
    uint8_t protocol_num, in_port_t dst_port)
{
	ibt_srv_desc_t		sdesc;
	ibt_hca_portinfo_t	*port_infop;
	ib_svc_id_t		srv_id;
	ibt_srv_hdl_t		srv_hdl;
	uint_t			port_size;
	uint_t			pki, i, num_ports, nbinds;
	ibt_status_t		ibt_status;
	rib_service_t		*service;
	ib_pkey_t		pkey;

	/*
	 * Query all ports for the given HCA
	 */
	rw_enter(&hca->state_lock, RW_READER);
	if (hca->state != HCA_DETACHED) {
		ibt_status = ibt_query_hca_ports(hca->hca_hdl, 0, &port_infop,
		    &num_ports, &port_size);
		rw_exit(&hca->state_lock);
	} else {
		rw_exit(&hca->state_lock);
		return (RDMA_FAILED);
	}
	if (ibt_status != IBT_SUCCESS) {
		return (RDMA_FAILED);
	}

	DTRACE_PROBE1(rpcib__i__regservice_numports,
	    int, num_ports);

	for (i = 0; i < num_ports; i++) {
		if (port_infop[i].p_linkstate != IBT_PORT_ACTIVE) {
			DTRACE_PROBE1(rpcib__i__regservice__portinactive,
			    int, i+1);
		} else if (port_infop[i].p_linkstate == IBT_PORT_ACTIVE) {
			DTRACE_PROBE1(rpcib__i__regservice__portactive,
			    int, i+1);
		}
	}

	/*
	 * Get all the IP addresses on this system to register the
	 * given "service type" on all DNS recognized IP addrs.
	 * Each service type such as NFS will have all the systems
	 * IP addresses as its different names. For now the only
	 * type of service we support in RPCIB is NFS.
	 */
	rw_enter(&rib_stat->service_list_lock, RW_WRITER);
	/*
	 * Start registering and binding service to active
	 * on active ports on this HCA.
	 */
	nbinds = 0;
	for (service = rib_stat->service_list;
	    service && (service->srv_type != service_type);
	    service = service->next)
		;

	if (service == NULL) {
		/*
		 * We use IP addresses as the service names for
		 * service registration.  Register each of them
		 * with CM to obtain a svc_id and svc_hdl.  We do not
		 * register the service with machine's loopback address.
		 */
		(void) bzero(&srv_id, sizeof (ib_svc_id_t));
		(void) bzero(&srv_hdl, sizeof (ibt_srv_hdl_t));
		(void) bzero(&sdesc, sizeof (ibt_srv_desc_t));
		sdesc.sd_handler = rib_srv_cm_handler;
		sdesc.sd_flags = 0;
		ibt_status = ibt_register_service(hca->ibt_clnt_hdl,
		    &sdesc, ibt_get_ip_sid(protocol_num, dst_port),
		    1, &srv_hdl, &srv_id);
		if ((ibt_status != IBT_SUCCESS) &&
		    (ibt_status != IBT_CM_SERVICE_EXISTS)) {
			rw_exit(&rib_stat->service_list_lock);
			DTRACE_PROBE1(rpcib__i__regservice__ibtres,
			    int, ibt_status);
			ibt_free_portinfo(port_infop, port_size);
			return (RDMA_FAILED);
		}

		/*
		 * Allocate and prepare a service entry
		 */
		service = kmem_zalloc(sizeof (rib_service_t), KM_SLEEP);

		service->srv_type = service_type;
		service->srv_hdl = srv_hdl;
		service->srv_id = srv_id;

		service->next = rib_stat->service_list;
		rib_stat->service_list = service;
		DTRACE_PROBE1(rpcib__i__regservice__new__service,
		    int, service->srv_type);
	} else {
		srv_hdl = service->srv_hdl;
		srv_id = service->srv_id;
		DTRACE_PROBE1(rpcib__i__regservice__existing__service,
		    int, service->srv_type);
	}

	for (i = 0; i < num_ports; i++) {
		ibt_sbind_hdl_t		sbp;
		rib_hca_service_t	*hca_srv;
		ib_gid_t		gid;

		if (port_infop[i].p_linkstate != IBT_PORT_ACTIVE)
			continue;

		for (pki = 0; pki < port_infop[i].p_pkey_tbl_sz; pki++) {
			pkey = port_infop[i].p_pkey_tbl[pki];

			rw_enter(&hca->bound_services_lock, RW_READER);
			gid = port_infop[i].p_sgid_tbl[0];
			for (hca_srv = hca->bound_services; hca_srv;
			    hca_srv = hca_srv->next) {
				if ((hca_srv->srv_id == service->srv_id) &&
				    (hca_srv->gid.gid_prefix ==
				    gid.gid_prefix) &&
				    (hca_srv->gid.gid_guid == gid.gid_guid))
					break;
			}
			rw_exit(&hca->bound_services_lock);
			if (hca_srv != NULL) {
				/*
				 * port is alreay bound the the service
				 */
				DTRACE_PROBE1(
				    rpcib__i__regservice__already__bound,
				    int, i+1);
				nbinds++;
				continue;
			}

			if ((pkey & IBSRM_HB) &&
			    (pkey != IB_PKEY_INVALID_FULL)) {

				sbp = NULL;
				ibt_status = ibt_bind_service(srv_hdl,
				    gid, NULL, hca, &sbp);

				if (ibt_status == IBT_SUCCESS) {
					hca_srv = kmem_zalloc(
					    sizeof (rib_hca_service_t),
					    KM_SLEEP);
					hca_srv->srv_id = srv_id;
					hca_srv->gid = gid;
					hca_srv->sbind_hdl = sbp;

					rw_enter(&hca->bound_services_lock,
					    RW_WRITER);
					hca_srv->next = hca->bound_services;
					hca->bound_services = hca_srv;
					rw_exit(&hca->bound_services_lock);
					nbinds++;
				}

				DTRACE_PROBE1(rpcib__i__regservice__bindres,
				    int, ibt_status);
			}
		}
	}
	rw_exit(&rib_stat->service_list_lock);

	ibt_free_portinfo(port_infop, port_size);

	if (nbinds == 0) {
		return (RDMA_FAILED);
	} else {
		/*
		 * Put this plugin into accept state, since atleast
		 * one registration was successful.
		 */
		mutex_enter(&plugin_state_lock);
		plugin_state = ACCEPT;
		mutex_exit(&plugin_state_lock);
		return (RDMA_SUCCESS);
	}
}

void
rib_listen(struct rdma_svc_data *rd)
{
	rdma_stat status;
	int n_listening = 0;
	rib_hca_t *hca;

	mutex_enter(&rib_stat->listen_lock);
	/*
	 * if rd parameter is NULL then it means that rib_stat->q is
	 * already initialized by a call from RDMA and we just want to
	 * add a newly attached HCA to the same listening state as other
	 * HCAs.
	 */
	if (rd == NULL) {
		if (rib_stat->q == NULL) {
			mutex_exit(&rib_stat->listen_lock);
			return;
		}
	} else {
		rib_stat->q = &rd->q;
	}
	rw_enter(&rib_stat->hcas_list_lock, RW_READER);
	for (hca = rib_stat->hcas_list; hca; hca = hca->next) {
		/*
		 * First check if a hca is still attached
		 */
		rw_enter(&hca->state_lock, RW_READER);
		if (hca->state != HCA_INITED) {
			rw_exit(&hca->state_lock);
			continue;
		}
		rw_exit(&hca->state_lock);

		/*
		 * Right now the only service type is NFS. Hence
		 * force feed this value. Ideally to communicate
		 * the service type it should be passed down in
		 * rdma_svc_data.
		 */
		status = rib_register_service(hca, NFS,
		    IPPROTO_TCP, nfs_rdma_port);
		if (status == RDMA_SUCCESS)
			n_listening++;
	}
	rw_exit(&rib_stat->hcas_list_lock);

	/*
	 * Service active on an HCA, check rd->err_code for more
	 * explainable errors.
	 */
	if (rd) {
		if (n_listening > 0) {
			rd->active = 1;
			rd->err_code = RDMA_SUCCESS;
		} else {
			rd->active = 0;
			rd->err_code = RDMA_FAILED;
		}
	}
	mutex_exit(&rib_stat->listen_lock);
}

/* XXXX */
/* ARGSUSED */
static void
rib_listen_stop(struct rdma_svc_data *svcdata)
{
	rib_hca_t		*hca;

	mutex_enter(&rib_stat->listen_lock);
	/*
	 * KRPC called the RDMATF to stop the listeners, this means
	 * stop sending incomming or recieved requests to KRPC master
	 * transport handle for RDMA-IB. This is also means that the
	 * master transport handle, responsible for us, is going away.
	 */
	mutex_enter(&plugin_state_lock);
	plugin_state = NO_ACCEPT;
	if (svcdata != NULL)
		svcdata->active = 0;
	mutex_exit(&plugin_state_lock);

	rw_enter(&rib_stat->hcas_list_lock, RW_READER);
	for (hca = rib_stat->hcas_list; hca; hca = hca->next) {
		/*
		 * First check if a hca is still attached
		 */
		rw_enter(&hca->state_lock, RW_READER);
		if (hca->state == HCA_DETACHED) {
			rw_exit(&hca->state_lock);
			continue;
		}
		rib_close_channels(&hca->srv_conn_list);
		rib_stop_services(hca);
		rw_exit(&hca->state_lock);
	}
	rw_exit(&rib_stat->hcas_list_lock);

	/*
	 * Avoid rib_listen() using the stale q field.
	 * This could happen if a port goes up after all services
	 * are already unregistered.
	 */
	rib_stat->q = NULL;
	mutex_exit(&rib_stat->listen_lock);
}

/*
 * Traverse the HCA's service list to unbind and deregister services.
 * For each bound service of HCA to be removed, first find the corresponding
 * service handle (srv_hdl) and then unbind the service by calling
 * ibt_unbind_service().
 */
static void
rib_stop_services(rib_hca_t *hca)
{
	rib_hca_service_t *srv_list, *to_remove;

	/*
	 * unbind and deregister the services for this service type.
	 * Right now there is only one service type. In future it will
	 * be passed down to this function.
	 */
	rw_enter(&hca->bound_services_lock, RW_READER);
	srv_list = hca->bound_services;
	hca->bound_services = NULL;
	rw_exit(&hca->bound_services_lock);

	while (srv_list != NULL) {
		rib_service_t *sc;

		to_remove = srv_list;
		srv_list = to_remove->next;
		rw_enter(&rib_stat->service_list_lock, RW_READER);
		for (sc = rib_stat->service_list;
		    sc && (sc->srv_id != to_remove->srv_id);
		    sc = sc->next)
			;
		/*
		 * if sc is NULL then the service doesn't exist anymore,
		 * probably just removed completely through rib_stat.
		 */
		if (sc != NULL)
			(void) ibt_unbind_service(sc->srv_hdl,
			    to_remove->sbind_hdl);
		rw_exit(&rib_stat->service_list_lock);
		kmem_free(to_remove, sizeof (rib_hca_service_t));
	}
}

static struct svc_recv *
rib_init_svc_recv(rib_qp_t *qp, ibt_wr_ds_t *sgl)
{
	struct svc_recv	*recvp;

	recvp = kmem_zalloc(sizeof (struct svc_recv), KM_SLEEP);
	recvp->vaddr = sgl->ds_va;
	recvp->qp = qp;
	recvp->bytes_xfer = 0;
	return (recvp);
}

static int
rib_free_svc_recv(struct svc_recv *recvp)
{
	kmem_free(recvp, sizeof (*recvp));

	return (0);
}

static struct reply *
rib_addreplylist(rib_qp_t *qp, uint32_t msgid)
{
	struct reply	*rep;


	rep = kmem_zalloc(sizeof (struct reply), KM_NOSLEEP);
	if (rep == NULL) {
		DTRACE_PROBE(rpcib__i__addrreply__nomem);
		return (NULL);
	}
	rep->xid = msgid;
	rep->vaddr_cq = 0;
	rep->bytes_xfer = 0;
	rep->status = (uint_t)REPLY_WAIT;
	rep->prev = NULL;
	cv_init(&rep->wait_cv, NULL, CV_DEFAULT, NULL);

	mutex_enter(&qp->replylist_lock);
	if (qp->replylist) {
		rep->next = qp->replylist;
		qp->replylist->prev = rep;
	}
	qp->rep_list_size++;

	DTRACE_PROBE1(rpcib__i__addrreply__listsize,
	    int, qp->rep_list_size);

	qp->replylist = rep;
	mutex_exit(&qp->replylist_lock);

	return (rep);
}

static rdma_stat
rib_rem_replylist(rib_qp_t *qp)
{
	struct reply	*r, *n;

	mutex_enter(&qp->replylist_lock);
	for (r = qp->replylist; r != NULL; r = n) {
		n = r->next;
		(void) rib_remreply(qp, r);
	}
	mutex_exit(&qp->replylist_lock);

	return (RDMA_SUCCESS);
}

static int
rib_remreply(rib_qp_t *qp, struct reply *rep)
{

	ASSERT(MUTEX_HELD(&qp->replylist_lock));
	if (rep->prev) {
		rep->prev->next = rep->next;
	}
	if (rep->next) {
		rep->next->prev = rep->prev;
	}
	if (qp->replylist == rep)
		qp->replylist = rep->next;

	cv_destroy(&rep->wait_cv);
	qp->rep_list_size--;

	DTRACE_PROBE1(rpcib__i__remreply__listsize,
	    int, qp->rep_list_size);

	kmem_free(rep, sizeof (*rep));

	return (0);
}

rdma_stat
rib_registermem(CONN *conn,  caddr_t adsp, caddr_t buf, uint_t buflen,
    struct mrc *buf_handle)
{
	ibt_mr_hdl_t	mr_hdl = NULL;	/* memory region handle */
	ibt_mr_desc_t	mr_desc;	/* vaddr, lkey, rkey */
	rdma_stat	status;
	rib_hca_t	*hca = (ctoqp(conn))->hca;

	/*
	 * Note: ALL buffer pools use the same memory type RDMARW.
	 */
	status = rib_reg_mem(hca, adsp, buf, buflen, 0, &mr_hdl, &mr_desc);
	if (status == RDMA_SUCCESS) {
		buf_handle->mrc_linfo = (uintptr_t)mr_hdl;
		buf_handle->mrc_lmr = (uint32_t)mr_desc.md_lkey;
		buf_handle->mrc_rmr = (uint32_t)mr_desc.md_rkey;
	} else {
		buf_handle->mrc_linfo = (uintptr_t)NULL;
		buf_handle->mrc_lmr = 0;
		buf_handle->mrc_rmr = 0;
	}
	return (status);
}

static rdma_stat
rib_reg_mem(rib_hca_t *hca, caddr_t adsp, caddr_t buf, uint_t size,
    ibt_mr_flags_t spec,
    ibt_mr_hdl_t *mr_hdlp, ibt_mr_desc_t *mr_descp)
{
	ibt_mr_attr_t	mem_attr;
	ibt_status_t	ibt_status;
	mem_attr.mr_vaddr = (uintptr_t)buf;
	mem_attr.mr_len = (ib_msglen_t)size;
	mem_attr.mr_as = (struct as *)(caddr_t)adsp;
	mem_attr.mr_flags = IBT_MR_SLEEP | IBT_MR_ENABLE_LOCAL_WRITE |
	    IBT_MR_ENABLE_REMOTE_READ | IBT_MR_ENABLE_REMOTE_WRITE |
	    IBT_MR_ENABLE_WINDOW_BIND | spec;

	rw_enter(&hca->state_lock, RW_READER);
	if (hca->state != HCA_DETACHED) {
		ibt_status = ibt_register_mr(hca->hca_hdl, hca->pd_hdl,
		    &mem_attr, mr_hdlp, mr_descp);
		rw_exit(&hca->state_lock);
	} else {
		rw_exit(&hca->state_lock);
		return (RDMA_FAILED);
	}

	if (ibt_status != IBT_SUCCESS) {
		return (RDMA_FAILED);
	}
	return (RDMA_SUCCESS);
}

rdma_stat
rib_registermemsync(CONN *conn,  caddr_t adsp, caddr_t buf, uint_t buflen,
    struct mrc *buf_handle, RIB_SYNCMEM_HANDLE *sync_handle, void *lrc)
{
	ibt_mr_hdl_t	mr_hdl = NULL;	/* memory region handle */
	rib_lrc_entry_t *l;
	ibt_mr_desc_t	mr_desc;	/* vaddr, lkey, rkey */
	rdma_stat	status;
	rib_hca_t	*hca = (ctoqp(conn))->hca;

	/*
	 * Non-coherent memory registration.
	 */
	l = (rib_lrc_entry_t *)lrc;
	if (l) {
		if (l->registered) {
			buf_handle->mrc_linfo =
			    (uintptr_t)l->lrc_mhandle.mrc_linfo;
			buf_handle->mrc_lmr =
			    (uint32_t)l->lrc_mhandle.mrc_lmr;
			buf_handle->mrc_rmr =
			    (uint32_t)l->lrc_mhandle.mrc_rmr;
			*sync_handle = (RIB_SYNCMEM_HANDLE)
			    (uintptr_t)l->lrc_mhandle.mrc_linfo;
			return (RDMA_SUCCESS);
		} else {
			/* Always register the whole buffer */
			buf = (caddr_t)l->lrc_buf;
			buflen = l->lrc_len;
		}
	}
	status = rib_reg_mem(hca, adsp, buf, buflen, 0, &mr_hdl, &mr_desc);

	if (status == RDMA_SUCCESS) {
		if (l) {
			l->lrc_mhandle.mrc_linfo = (uintptr_t)mr_hdl;
			l->lrc_mhandle.mrc_lmr   = (uint32_t)mr_desc.md_lkey;
			l->lrc_mhandle.mrc_rmr   = (uint32_t)mr_desc.md_rkey;
			l->registered		 = TRUE;
		}
		buf_handle->mrc_linfo = (uintptr_t)mr_hdl;
		buf_handle->mrc_lmr = (uint32_t)mr_desc.md_lkey;
		buf_handle->mrc_rmr = (uint32_t)mr_desc.md_rkey;
		*sync_handle = (RIB_SYNCMEM_HANDLE)mr_hdl;
	} else {
		buf_handle->mrc_linfo = (uintptr_t)NULL;
		buf_handle->mrc_lmr = 0;
		buf_handle->mrc_rmr = 0;
	}
	return (status);
}

/* ARGSUSED */
rdma_stat
rib_deregistermem(CONN *conn, caddr_t buf, struct mrc buf_handle)
{
	rib_hca_t *hca = (ctoqp(conn))->hca;
	/*
	 * Allow memory deregistration even if HCA is
	 * getting detached. Need all outstanding
	 * memory registrations to be deregistered
	 * before HCA_DETACH_EVENT can be accepted.
	 */
	(void) ibt_deregister_mr(hca->hca_hdl,
	    (ibt_mr_hdl_t)(uintptr_t)buf_handle.mrc_linfo);
	return (RDMA_SUCCESS);
}

/* ARGSUSED */
rdma_stat
rib_deregistermemsync(CONN *conn, caddr_t buf, struct mrc buf_handle,
    RIB_SYNCMEM_HANDLE sync_handle, void *lrc)
{
	rib_lrc_entry_t *l;
	l = (rib_lrc_entry_t *)lrc;
	if (l)
		if (l->registered)
			return (RDMA_SUCCESS);

	(void) rib_deregistermem(conn, buf, buf_handle);

	return (RDMA_SUCCESS);
}

/* ARGSUSED */
rdma_stat
rib_syncmem(CONN *conn, RIB_SYNCMEM_HANDLE shandle, caddr_t buf,
    int len, int cpu)
{
	ibt_status_t	status;
	rib_hca_t *hca = (ctoqp(conn))->hca;
	ibt_mr_sync_t	mr_segment;

	mr_segment.ms_handle = (ibt_mr_hdl_t)shandle;
	mr_segment.ms_vaddr = (ib_vaddr_t)(uintptr_t)buf;
	mr_segment.ms_len = (ib_memlen_t)len;
	if (cpu) {
		/* make incoming data visible to memory */
		mr_segment.ms_flags = IBT_SYNC_WRITE;
	} else {
		/* make memory changes visible to IO */
		mr_segment.ms_flags = IBT_SYNC_READ;
	}
	rw_enter(&hca->state_lock, RW_READER);
	if (hca->state != HCA_DETACHED) {
		status = ibt_sync_mr(hca->hca_hdl, &mr_segment, 1);
		rw_exit(&hca->state_lock);
	} else {
		rw_exit(&hca->state_lock);
		return (RDMA_FAILED);
	}

	if (status == IBT_SUCCESS)
		return (RDMA_SUCCESS);
	else {
		return (RDMA_FAILED);
	}
}

/*
 * XXXX	????
 */
static rdma_stat
rib_getinfo(rdma_info_t *info)
{
	/*
	 * XXXX	Hack!
	 */
	info->addrlen = 16;
	info->mts = 1000000;
	info->mtu = 1000000;

	return (RDMA_SUCCESS);
}

rib_bufpool_t *
rib_rbufpool_create(rib_hca_t *hca, int ptype, int num)
{
	rib_bufpool_t	*rbp = NULL;
	bufpool_t	*bp = NULL;
	caddr_t		buf;
	ibt_mr_attr_t	mem_attr;
	ibt_status_t	ibt_status;
	int		i, j;

	rbp = (rib_bufpool_t *)kmem_zalloc(sizeof (rib_bufpool_t), KM_SLEEP);

	bp = (bufpool_t *)kmem_zalloc(sizeof (bufpool_t) +
	    num * sizeof (void *), KM_SLEEP);

	mutex_init(&bp->buflock, NULL, MUTEX_DRIVER, hca->iblock);
	bp->numelems = num;


	switch (ptype) {
	case SEND_BUFFER:
		mem_attr.mr_flags = IBT_MR_SLEEP | IBT_MR_ENABLE_LOCAL_WRITE;
		bp->rsize = RPC_MSG_SZ;
		break;
	case RECV_BUFFER:
		mem_attr.mr_flags = IBT_MR_SLEEP | IBT_MR_ENABLE_LOCAL_WRITE;
		bp->rsize = RPC_BUF_SIZE;
		break;
	default:
		goto fail;
	}

	/*
	 * Register the pool.
	 */
	bp->bufsize = num * bp->rsize;
	bp->buf = kmem_zalloc(bp->bufsize, KM_SLEEP);
	rbp->mr_hdl = (ibt_mr_hdl_t *)kmem_zalloc(num *
	    sizeof (ibt_mr_hdl_t), KM_SLEEP);
	rbp->mr_desc = (ibt_mr_desc_t *)kmem_zalloc(num *
	    sizeof (ibt_mr_desc_t), KM_SLEEP);
	rw_enter(&hca->state_lock, RW_READER);

	if (hca->state == HCA_DETACHED) {
		rw_exit(&hca->state_lock);
		goto fail;
	}

	for (i = 0, buf = bp->buf; i < num; i++, buf += bp->rsize) {
		bzero(&rbp->mr_desc[i], sizeof (ibt_mr_desc_t));
		mem_attr.mr_vaddr = (uintptr_t)buf;
		mem_attr.mr_len = (ib_msglen_t)bp->rsize;
		mem_attr.mr_as = NULL;
		ibt_status = ibt_register_mr(hca->hca_hdl,
		    hca->pd_hdl, &mem_attr,
		    &rbp->mr_hdl[i],
		    &rbp->mr_desc[i]);
		if (ibt_status != IBT_SUCCESS) {
			for (j = 0; j < i; j++) {
				(void) ibt_deregister_mr(hca->hca_hdl,
				    rbp->mr_hdl[j]);
			}
			rw_exit(&hca->state_lock);
			goto fail;
		}
	}
	rw_exit(&hca->state_lock);
	buf = (caddr_t)bp->buf;
	for (i = 0; i < num; i++, buf += bp->rsize) {
		bp->buflist[i] = (void *)buf;
	}
	bp->buffree = num - 1;	/* no. of free buffers */
	rbp->bpool = bp;

	return (rbp);
fail:
	if (bp) {
		if (bp->buf)
			kmem_free(bp->buf, bp->bufsize);
		kmem_free(bp, sizeof (bufpool_t) + num*sizeof (void *));
	}
	if (rbp) {
		if (rbp->mr_hdl)
			kmem_free(rbp->mr_hdl, num*sizeof (ibt_mr_hdl_t));
		if (rbp->mr_desc)
			kmem_free(rbp->mr_desc, num*sizeof (ibt_mr_desc_t));
		kmem_free(rbp, sizeof (rib_bufpool_t));
	}
	return (NULL);
}

static void
rib_rbufpool_deregister(rib_hca_t *hca, int ptype)
{
	int i;
	rib_bufpool_t *rbp = NULL;
	bufpool_t *bp;

	/*
	 * Obtain pool address based on type of pool
	 */
	switch (ptype) {
		case SEND_BUFFER:
			rbp = hca->send_pool;
			break;
		case RECV_BUFFER:
			rbp = hca->recv_pool;
			break;
		default:
			return;
	}
	if (rbp == NULL)
		return;

	bp = rbp->bpool;

	/*
	 * Deregister the pool memory and free it.
	 */
	for (i = 0; i < bp->numelems; i++) {
		(void) ibt_deregister_mr(hca->hca_hdl, rbp->mr_hdl[i]);
	}
}

static void
rib_rbufpool_free(rib_hca_t *hca, int ptype)
{

	rib_bufpool_t *rbp = NULL;
	bufpool_t *bp;

	/*
	 * Obtain pool address based on type of pool
	 */
	switch (ptype) {
		case SEND_BUFFER:
			rbp = hca->send_pool;
			break;
		case RECV_BUFFER:
			rbp = hca->recv_pool;
			break;
		default:
			return;
	}
	if (rbp == NULL)
		return;

	bp = rbp->bpool;

	/*
	 * Free the pool memory.
	 */
	if (rbp->mr_hdl)
		kmem_free(rbp->mr_hdl, bp->numelems*sizeof (ibt_mr_hdl_t));

	if (rbp->mr_desc)
		kmem_free(rbp->mr_desc, bp->numelems*sizeof (ibt_mr_desc_t));
	if (bp->buf)
		kmem_free(bp->buf, bp->bufsize);
	mutex_destroy(&bp->buflock);
	kmem_free(bp, sizeof (bufpool_t) + bp->numelems*sizeof (void *));
	kmem_free(rbp, sizeof (rib_bufpool_t));
}

void
rib_rbufpool_destroy(rib_hca_t *hca, int ptype)
{
	/*
	 * Deregister the pool memory and free it.
	 */
	rib_rbufpool_deregister(hca, ptype);
	rib_rbufpool_free(hca, ptype);
}

/*
 * Fetch a buffer from the pool of type specified in rdbuf->type.
 */
static rdma_stat
rib_reg_buf_alloc(CONN *conn, rdma_buf_t *rdbuf)
{
	rib_lrc_entry_t *rlep;

	if (rdbuf->type ==  RDMA_LONG_BUFFER) {
		rlep = rib_get_cache_buf(conn, rdbuf->len);
		rdbuf->rb_private =  (caddr_t)rlep;
		rdbuf->addr = rlep->lrc_buf;
		rdbuf->handle = rlep->lrc_mhandle;
		return (RDMA_SUCCESS);
	}

	rdbuf->addr = rib_rbuf_alloc(conn, rdbuf);
	if (rdbuf->addr) {
		switch (rdbuf->type) {
		case SEND_BUFFER:
			rdbuf->len = RPC_MSG_SZ;	/* 1K */
			break;
		case RECV_BUFFER:
			rdbuf->len = RPC_BUF_SIZE; /* 2K */
			break;
		default:
			rdbuf->len = 0;
		}
		return (RDMA_SUCCESS);
	} else
		return (RDMA_FAILED);
}

/*
 * Fetch a buffer of specified type.
 * Note that rdbuf->handle is mw's rkey.
 */
static void *
rib_rbuf_alloc(CONN *conn, rdma_buf_t *rdbuf)
{
	rib_qp_t	*qp = ctoqp(conn);
	rib_hca_t	*hca = qp->hca;
	rdma_btype	ptype = rdbuf->type;
	void		*buf;
	rib_bufpool_t	*rbp = NULL;
	bufpool_t	*bp;
	int		i;

	/*
	 * Obtain pool address based on type of pool
	 */
	switch (ptype) {
	case SEND_BUFFER:
		rbp = hca->send_pool;
		break;
	case RECV_BUFFER:
		rbp = hca->recv_pool;
		break;
	default:
		return (NULL);
	}
	if (rbp == NULL)
		return (NULL);

	bp = rbp->bpool;

	mutex_enter(&bp->buflock);
	if (bp->buffree < 0) {
		mutex_exit(&bp->buflock);
		return (NULL);
	}

	/* XXXX put buf, rdbuf->handle.mrc_rmr, ... in one place. */
	buf = bp->buflist[bp->buffree];
	rdbuf->addr = buf;
	rdbuf->len = bp->rsize;
	for (i = bp->numelems - 1; i >= 0; i--) {
		if ((ib_vaddr_t)(uintptr_t)buf == rbp->mr_desc[i].md_vaddr) {
			rdbuf->handle.mrc_rmr =
			    (uint32_t)rbp->mr_desc[i].md_rkey;
			rdbuf->handle.mrc_linfo =
			    (uintptr_t)rbp->mr_hdl[i];
			rdbuf->handle.mrc_lmr =
			    (uint32_t)rbp->mr_desc[i].md_lkey;
			bp->buffree--;

			mutex_exit(&bp->buflock);

			return (buf);
		}
	}

	mutex_exit(&bp->buflock);

	return (NULL);
}

static void
rib_reg_buf_free(CONN *conn, rdma_buf_t *rdbuf)
{

	if (rdbuf->type == RDMA_LONG_BUFFER) {
		rib_free_cache_buf(conn, (rib_lrc_entry_t *)rdbuf->rb_private);
		rdbuf->rb_private = NULL;
		return;
	}
	rib_rbuf_free(conn, rdbuf->type, rdbuf->addr);
}

static void
rib_rbuf_free(CONN *conn, int ptype, void *buf)
{
	rib_qp_t *qp = ctoqp(conn);
	rib_hca_t *hca = qp->hca;
	rib_bufpool_t *rbp = NULL;
	bufpool_t *bp;

	/*
	 * Obtain pool address based on type of pool
	 */
	switch (ptype) {
	case SEND_BUFFER:
		rbp = hca->send_pool;
		break;
	case RECV_BUFFER:
		rbp = hca->recv_pool;
		break;
	default:
		return;
	}
	if (rbp == NULL)
		return;

	bp = rbp->bpool;

	mutex_enter(&bp->buflock);
	if (++bp->buffree >= bp->numelems) {
		/*
		 * Should never happen
		 */
		bp->buffree--;
	} else {
		bp->buflist[bp->buffree] = buf;
	}
	mutex_exit(&bp->buflock);
}

static rdma_stat
rib_add_connlist(CONN *cn, rib_conn_list_t *connlist)
{
	rw_enter(&connlist->conn_lock, RW_WRITER);
	if (connlist->conn_hd) {
		cn->c_next = connlist->conn_hd;
		connlist->conn_hd->c_prev = cn;
	}
	connlist->conn_hd = cn;
	rw_exit(&connlist->conn_lock);

	return (RDMA_SUCCESS);
}

static rdma_stat
rib_rm_conn(CONN *cn, rib_conn_list_t *connlist)
{
	rw_enter(&connlist->conn_lock, RW_WRITER);
	if (cn->c_prev) {
		cn->c_prev->c_next = cn->c_next;
	}
	if (cn->c_next) {
		cn->c_next->c_prev = cn->c_prev;
	}
	if (connlist->conn_hd == cn)
		connlist->conn_hd = cn->c_next;
	rw_exit(&connlist->conn_lock);

	return (RDMA_SUCCESS);
}

/* ARGSUSED */
static rdma_stat
rib_conn_get(struct netbuf *s_svcaddr, struct netbuf *d_svcaddr,
    int addr_type, void *handle, CONN **conn)
{
	rdma_stat status;
	rpcib_ping_t rpt;

	status = rib_connect(s_svcaddr, d_svcaddr, addr_type, &rpt, conn);
	return (status);
}

/*
 * rib_find_hca_connection
 *
 * if there is an existing connection to the specified address then
 * it will be returned in conn, otherwise conn will be set to NULL.
 * Also cleans up any connection that is in error state.
 */
static int
rib_find_hca_connection(rib_hca_t *hca, struct netbuf *s_svcaddr,
    struct netbuf *d_svcaddr, CONN **conn)
{
	CONN *cn;
	clock_t cv_stat, timout;

	*conn = NULL;
again:
	rw_enter(&hca->cl_conn_list.conn_lock, RW_READER);
	cn = hca->cl_conn_list.conn_hd;
	while (cn != NULL) {
		/*
		 * First, clear up any connection in the ERROR state
		 */
		mutex_enter(&cn->c_lock);
		if (cn->c_state == C_ERROR_CONN) {
			if (cn->c_ref == 0) {
				/*
				 * Remove connection from list and destroy it.
				 */
				cn->c_state = C_DISCONN_PEND;
				mutex_exit(&cn->c_lock);
				rw_exit(&hca->cl_conn_list.conn_lock);
				rib_conn_close((void *)cn);
				goto again;
			}
			mutex_exit(&cn->c_lock);
			cn = cn->c_next;
			continue;
		}
		if (cn->c_state == C_DISCONN_PEND) {
			mutex_exit(&cn->c_lock);
			cn = cn->c_next;
			continue;
		}

		/*
		 * source address is only checked for if there is one,
		 * this is the case for retries.
		 */
		if ((cn->c_raddr.len == d_svcaddr->len) &&
		    (bcmp(d_svcaddr->buf, cn->c_raddr.buf,
		    d_svcaddr->len) == 0) &&
		    ((s_svcaddr->len == 0) ||
		    ((cn->c_laddr.len == s_svcaddr->len) &&
		    (bcmp(s_svcaddr->buf, cn->c_laddr.buf,
		    s_svcaddr->len) == 0)))) {
			/*
			 * Our connection. Give up conn list lock
			 * as we are done traversing the list.
			 */
			rw_exit(&hca->cl_conn_list.conn_lock);
			if (cn->c_state == C_CONNECTED) {
				cn->c_ref++;	/* sharing a conn */
				mutex_exit(&cn->c_lock);
				*conn = cn;
				return (RDMA_SUCCESS);
			}
			if (cn->c_state == C_CONN_PEND) {
				/*
				 * Hold a reference to this conn before
				 * we give up the lock.
				 */
				cn->c_ref++;
				timout =  ddi_get_lbolt() +
				    drv_usectohz(CONN_WAIT_TIME * 1000000);
				while ((cv_stat = cv_timedwait_sig(&cn->c_cv,
				    &cn->c_lock, timout)) > 0 &&
				    cn->c_state == C_CONN_PEND)
					;
				if (cv_stat == 0) {
					(void) rib_conn_release_locked(cn);
					return (RDMA_INTR);
				}
				if (cv_stat < 0) {
					(void) rib_conn_release_locked(cn);
					return (RDMA_TIMEDOUT);
				}
				if (cn->c_state == C_CONNECTED) {
					*conn = cn;
					mutex_exit(&cn->c_lock);
					return (RDMA_SUCCESS);
				} else {
					(void) rib_conn_release_locked(cn);
					return (RDMA_TIMEDOUT);
				}
			}
		}
		mutex_exit(&cn->c_lock);
		cn = cn->c_next;
	}
	rw_exit(&hca->cl_conn_list.conn_lock);
	*conn = NULL;
	return (RDMA_FAILED);
}

/*
 * Connection management.
 * IBTF does not support recycling of channels. So connections are only
 * in four states - C_CONN_PEND, or C_CONNECTED, or C_ERROR_CONN or
 * C_DISCONN_PEND state. No C_IDLE state.
 * C_CONN_PEND state: Connection establishment in progress to the server.
 * C_CONNECTED state: A connection when created is in C_CONNECTED state.
 * It has an RC channel associated with it. ibt_post_send/recv are allowed
 * only in this state.
 * C_ERROR_CONN state: A connection transitions to this state when WRs on the
 * channel are completed in error or an IBT_CM_EVENT_CONN_CLOSED event
 * happens on the channel or a IBT_HCA_DETACH_EVENT occurs on the HCA.
 * C_DISCONN_PEND state: When a connection is in C_ERROR_CONN state and when
 * c_ref drops to 0 (this indicates that RPC has no more references to this
 * connection), the connection should be destroyed. A connection transitions
 * into this state when it is being destroyed.
 */
/* ARGSUSED */
static rdma_stat
rib_connect(struct netbuf *s_svcaddr, struct netbuf *d_svcaddr,
    int addr_type, rpcib_ping_t *rpt, CONN **conn)
{
	CONN *cn;
	int status;
	rib_hca_t *hca;
	rib_qp_t *qp;
	int s_addr_len;
	char *s_addr_buf;

	rw_enter(&rib_stat->hcas_list_lock, RW_READER);
	for (hca = rib_stat->hcas_list; hca; hca = hca->next) {
		rw_enter(&hca->state_lock, RW_READER);
		if (hca->state != HCA_DETACHED) {
			status = rib_find_hca_connection(hca, s_svcaddr,
			    d_svcaddr, conn);
			rw_exit(&hca->state_lock);
			if ((status == RDMA_INTR) || (status == RDMA_SUCCESS)) {
				rw_exit(&rib_stat->hcas_list_lock);
				return (status);
			}
		} else
			rw_exit(&hca->state_lock);
	}
	rw_exit(&rib_stat->hcas_list_lock);

	/*
	 * No existing connection found, establish a new connection.
	 */
	bzero(rpt, sizeof (rpcib_ping_t));

	status = rib_ping_srv(addr_type, d_svcaddr, rpt);
	if (status != RDMA_SUCCESS) {
		return (RDMA_FAILED);
	}
	hca = rpt->hca;

	if (rpt->srcip.family == AF_INET) {
		s_addr_len = sizeof (rpt->srcip.un.ip4addr);
		s_addr_buf = (char *)&rpt->srcip.un.ip4addr;
	} else if (rpt->srcip.family == AF_INET6) {
		s_addr_len = sizeof (rpt->srcip.un.ip6addr);
		s_addr_buf = (char *)&rpt->srcip.un.ip6addr;
	} else {
		return (RDMA_FAILED);
	}

	/*
	 * Channel to server doesn't exist yet, create one.
	 */
	if (rib_clnt_create_chan(hca, d_svcaddr, &qp) != RDMA_SUCCESS) {
		return (RDMA_FAILED);
	}
	cn = qptoc(qp);
	cn->c_state = C_CONN_PEND;
	cn->c_ref = 1;

	cn->c_laddr.buf = kmem_alloc(s_addr_len, KM_SLEEP);
	bcopy(s_addr_buf, cn->c_laddr.buf, s_addr_len);
	cn->c_laddr.len = cn->c_laddr.maxlen = s_addr_len;

	if (rpt->srcip.family == AF_INET) {
		cn->c_netid = kmem_zalloc(strlen(RIBNETID_TCP) + 1, KM_SLEEP);
		(void) strcpy(cn->c_netid, RIBNETID_TCP);

		cn->c_addrmask.len = cn->c_addrmask.maxlen =
		    sizeof (struct sockaddr_in);
		cn->c_addrmask.buf = kmem_zalloc(cn->c_addrmask.len, KM_SLEEP);

		((struct sockaddr_in *)cn->c_addrmask.buf)->sin_addr.s_addr =
		    (uint32_t)~0;
		((struct sockaddr_in *)cn->c_addrmask.buf)->sin_family =
		    (ushort_t)~0;

	} else {
		cn->c_netid = kmem_zalloc(strlen(RIBNETID_TCP6) + 1, KM_SLEEP);
		(void) strcpy(cn->c_netid, RIBNETID_TCP6);

		cn->c_addrmask.len = cn->c_addrmask.maxlen =
		    sizeof (struct sockaddr_in6);
		cn->c_addrmask.buf = kmem_zalloc(cn->c_addrmask.len, KM_SLEEP);

		(void) memset(
		    &((struct sockaddr_in6 *)cn->c_addrmask.buf)->sin6_addr,
		    (uchar_t)~0, sizeof (struct in6_addr));
		((struct sockaddr_in6 *)cn->c_addrmask.buf)->sin6_family =
		    (sa_family_t)~0;
	}

	/*
	 * Add to conn list.
	 * We had given up the READER lock. In the time since then,
	 * another thread might have created the connection we are
	 * trying here. But for now, that is quiet alright - there
	 * might be two connections between a pair of hosts instead
	 * of one. If we really want to close that window,
	 * then need to check the list after acquiring the
	 * WRITER lock.
	 */
	(void) rib_add_connlist(cn, &hca->cl_conn_list);
	status = rib_conn_to_srv(hca, qp, rpt);
	mutex_enter(&cn->c_lock);

	if (cn->c_flags & C_CLOSE_PENDING) {
		/*
		 * This handles a case where the module or
		 * HCA detached in the time a connection is
		 * established. In such a case close the
		 * connection immediately if this is the
		 * only reference.
		 */
		if (cn->c_ref == 1) {
			cn->c_ref--;
			cn->c_state = C_DISCONN_PEND;
			mutex_exit(&cn->c_lock);
			rib_conn_close((void *)cn);
			return (RDMA_FAILED);
		}

		/*
		 * Connection to be closed later when c_ref = 0
		 */
		status = RDMA_FAILED;
	}

	if (status == RDMA_SUCCESS) {
		cn->c_state = C_CONNECTED;
		*conn = cn;
	} else {
		cn->c_state = C_ERROR_CONN;
		cn->c_ref--;
	}
	cv_signal(&cn->c_cv);
	mutex_exit(&cn->c_lock);
	return (status);
}

static void
rib_conn_close(void *rarg)
{
	CONN *conn = (CONN *)rarg;
	rib_qp_t *qp = ctoqp(conn);

	mutex_enter(&conn->c_lock);
	if (!(conn->c_flags & C_CLOSE_NOTNEEDED)) {

		conn->c_flags |= (C_CLOSE_NOTNEEDED | C_CLOSE_PENDING);

		/*
		 * Live connection in CONNECTED state.
		 */
		if (conn->c_state == C_CONNECTED) {
			conn->c_state = C_ERROR_CONN;
		}
		mutex_exit(&conn->c_lock);

		rib_close_a_channel(conn);

		mutex_enter(&conn->c_lock);
		conn->c_flags &= ~C_CLOSE_PENDING;
	}

	mutex_exit(&conn->c_lock);

	if (qp->mode == RIB_SERVER)
		(void) rib_disconnect_channel(conn,
		    &qp->hca->srv_conn_list);
	else
		(void) rib_disconnect_channel(conn,
		    &qp->hca->cl_conn_list);
}

static void
rib_conn_timeout_call(void *carg)
{
	time_t idle_time;
	CONN *conn = (CONN *)carg;
	rib_hca_t *hca = ctoqp(conn)->hca;
	int error;

	mutex_enter(&conn->c_lock);
	if ((conn->c_ref > 0) ||
	    (conn->c_state == C_DISCONN_PEND)) {
		conn->c_timeout = NULL;
		mutex_exit(&conn->c_lock);
		return;
	}

	idle_time = (gethrestime_sec() - conn->c_last_used);

	if ((idle_time <= rib_conn_timeout) &&
	    (conn->c_state != C_ERROR_CONN)) {
		/*
		 * There was activity after the last timeout.
		 * Extend the conn life. Unless the conn is
		 * already in error state.
		 */
		conn->c_timeout = timeout(rib_conn_timeout_call, conn,
		    SEC_TO_TICK(rib_conn_timeout - idle_time));
		mutex_exit(&conn->c_lock);
		return;
	}

	error = ddi_taskq_dispatch(hca->cleanup_helper, rib_conn_close,
	    (void *)conn, DDI_NOSLEEP);

	/*
	 * If taskq dispatch fails above, then reset the timeout
	 * to try again after 10 secs.
	 */

	if (error != DDI_SUCCESS) {
		conn->c_timeout = timeout(rib_conn_timeout_call, conn,
		    SEC_TO_TICK(RDMA_CONN_REAP_RETRY));
		mutex_exit(&conn->c_lock);
		return;
	}

	conn->c_state = C_DISCONN_PEND;
	mutex_exit(&conn->c_lock);
}

static rdma_stat
rib_conn_release(CONN *conn)
{
	mutex_enter(&conn->c_lock);
	return (rib_conn_release_locked(conn));
}

/*
 * Expects conn->c_lock to be held on entry.
 * c_lock released on return
 */
static rdma_stat
rib_conn_release_locked(CONN *conn)
{
	conn->c_ref--;

	conn->c_last_used = gethrestime_sec();
	if (conn->c_ref > 0) {
		mutex_exit(&conn->c_lock);
		return (RDMA_SUCCESS);
	}

	/*
	 * If a conn is C_ERROR_CONN, close the channel.
	 */
	if (conn->c_ref == 0 && conn->c_state == C_ERROR_CONN) {
		conn->c_state = C_DISCONN_PEND;
		mutex_exit(&conn->c_lock);
		rib_conn_close((void *)conn);
		return (RDMA_SUCCESS);
	}

	/*
	 * c_ref == 0, set a timeout for conn release
	 */

	if (conn->c_timeout == NULL) {
		conn->c_timeout = timeout(rib_conn_timeout_call, conn,
		    SEC_TO_TICK(rib_conn_timeout));
	}

	mutex_exit(&conn->c_lock);
	return (RDMA_SUCCESS);
}

/*
 * Add at front of list
 */
static struct rdma_done_list *
rdma_done_add(rib_qp_t *qp, uint32_t xid)
{
	struct rdma_done_list *rd;

	ASSERT(MUTEX_HELD(&qp->rdlist_lock));

	rd = kmem_alloc(sizeof (*rd), KM_SLEEP);
	rd->xid = xid;
	cv_init(&rd->rdma_done_cv, NULL, CV_DEFAULT, NULL);

	rd->prev = NULL;
	rd->next = qp->rdlist;
	if (qp->rdlist != NULL)
		qp->rdlist->prev = rd;
	qp->rdlist = rd;

	return (rd);
}

static void
rdma_done_rm(rib_qp_t *qp, struct rdma_done_list *rd)
{
	struct rdma_done_list *r;

	ASSERT(MUTEX_HELD(&qp->rdlist_lock));

	r = rd->next;
	if (r != NULL) {
		r->prev = rd->prev;
	}

	r = rd->prev;
	if (r != NULL) {
		r->next = rd->next;
	} else {
		qp->rdlist = rd->next;
	}

	cv_destroy(&rd->rdma_done_cv);
	kmem_free(rd, sizeof (*rd));
}

static void
rdma_done_rem_list(rib_qp_t *qp)
{
	struct rdma_done_list	*r, *n;

	mutex_enter(&qp->rdlist_lock);
	for (r = qp->rdlist; r != NULL; r = n) {
		n = r->next;
		rdma_done_rm(qp, r);
	}
	mutex_exit(&qp->rdlist_lock);
}

static void
rdma_done_notify(rib_qp_t *qp, uint32_t xid)
{
	struct rdma_done_list *r = qp->rdlist;

	ASSERT(MUTEX_HELD(&qp->rdlist_lock));

	while (r) {
		if (r->xid == xid) {
			cv_signal(&r->rdma_done_cv);
			return;
		} else {
			r = r->next;
		}
	}
	DTRACE_PROBE1(rpcib__i__donenotify__nomatchxid,
	    int, xid);
}

/*
 * Expects conn->c_lock to be held by the caller.
 */

static void
rib_close_a_channel(CONN *conn)
{
	rib_qp_t	*qp;
	qp = ctoqp(conn);

	if (qp->qp_hdl == NULL) {
		/* channel already freed */
		return;
	}

	/*
	 * Call ibt_close_rc_channel in blocking mode
	 * with no callbacks.
	 */
	(void) ibt_close_rc_channel(qp->qp_hdl, IBT_NOCALLBACKS,
	    NULL, 0, NULL, NULL, 0);
}

/*
 * Goes through all connections and closes the channel
 * This will cause all the WRs on those channels to be
 * flushed.
 */
static void
rib_close_channels(rib_conn_list_t *connlist)
{
	CONN		*conn, *tmp;

	rw_enter(&connlist->conn_lock, RW_READER);
	conn = connlist->conn_hd;
	while (conn != NULL) {
		mutex_enter(&conn->c_lock);
		tmp = conn->c_next;
		if (!(conn->c_flags & C_CLOSE_NOTNEEDED)) {

			if (conn->c_state == C_CONN_PEND) {
				conn->c_flags |= C_CLOSE_PENDING;
				goto next;
			}

			conn->c_flags |= (C_CLOSE_NOTNEEDED | C_CLOSE_PENDING);

			/*
			 * Live connection in CONNECTED state.
			 */
			if (conn->c_state == C_CONNECTED)
				conn->c_state = C_ERROR_CONN;
			mutex_exit(&conn->c_lock);

			rib_close_a_channel(conn);

			mutex_enter(&conn->c_lock);
			conn->c_flags &= ~C_CLOSE_PENDING;
			/* Signal a pending rib_disconnect_channel() */
			cv_signal(&conn->c_cv);
		}
next:
		mutex_exit(&conn->c_lock);
		conn = tmp;
	}
	rw_exit(&connlist->conn_lock);
}

/*
 * Frees up all connections that are no longer being referenced
 */
static void
rib_purge_connlist(rib_conn_list_t *connlist)
{
	CONN		*conn;

top:
	rw_enter(&connlist->conn_lock, RW_READER);
	conn = connlist->conn_hd;
	while (conn != NULL) {
		mutex_enter(&conn->c_lock);

		/*
		 * At this point connection is either in ERROR
		 * or DISCONN_PEND state. If in DISCONN_PEND state
		 * then some other thread is culling that connection.
		 * If not and if c_ref is 0, then destroy the connection.
		 */
		if (conn->c_ref == 0 &&
		    conn->c_state != C_DISCONN_PEND) {
			/*
			 * Cull the connection
			 */
			conn->c_state = C_DISCONN_PEND;
			mutex_exit(&conn->c_lock);
			rw_exit(&connlist->conn_lock);
			(void) rib_disconnect_channel(conn, connlist);
			goto top;
		} else {
			/*
			 * conn disconnect already scheduled or will
			 * happen from conn_release when c_ref drops to 0.
			 */
			mutex_exit(&conn->c_lock);
		}
		conn = conn->c_next;
	}
	rw_exit(&connlist->conn_lock);

	/*
	 * At this point, only connections with c_ref != 0 are on the list
	 */
}

/*
 * Free all the HCA resources and close
 * the hca.
 */

static void
rib_free_hca(rib_hca_t *hca)
{
	(void) ibt_free_cq(hca->clnt_rcq->rib_cq_hdl);
	(void) ibt_free_cq(hca->clnt_scq->rib_cq_hdl);
	(void) ibt_free_cq(hca->svc_rcq->rib_cq_hdl);
	(void) ibt_free_cq(hca->svc_scq->rib_cq_hdl);

	kmem_free(hca->clnt_rcq, sizeof (rib_cq_t));
	kmem_free(hca->clnt_scq, sizeof (rib_cq_t));
	kmem_free(hca->svc_rcq, sizeof (rib_cq_t));
	kmem_free(hca->svc_scq, sizeof (rib_cq_t));

	rib_rbufpool_destroy(hca, RECV_BUFFER);
	rib_rbufpool_destroy(hca, SEND_BUFFER);
	rib_destroy_cache(hca);
	if (rib_mod.rdma_count == 0)
		(void) rdma_unregister_mod(&rib_mod);
	(void) ibt_free_pd(hca->hca_hdl, hca->pd_hdl);
	(void) ibt_close_hca(hca->hca_hdl);
	hca->hca_hdl = NULL;
}


static void
rib_stop_hca_services(rib_hca_t *hca)
{
	rib_stop_services(hca);
	rib_close_channels(&hca->cl_conn_list);
	rib_close_channels(&hca->srv_conn_list);

	rib_purge_connlist(&hca->cl_conn_list);
	rib_purge_connlist(&hca->srv_conn_list);

	if ((rib_stat->hcas_list == NULL) && stats_enabled) {
		kstat_delete_byname_zone("unix", 0, "rpcib_cache",
		    GLOBAL_ZONEID);
		stats_enabled = FALSE;
	}

	rw_enter(&hca->srv_conn_list.conn_lock, RW_READER);
	rw_enter(&hca->cl_conn_list.conn_lock, RW_READER);
	if (hca->srv_conn_list.conn_hd == NULL &&
	    hca->cl_conn_list.conn_hd == NULL) {
		/*
		 * conn_lists are NULL, so destroy
		 * buffers, close hca and be done.
		 */
		rib_free_hca(hca);
	}
	rw_exit(&hca->cl_conn_list.conn_lock);
	rw_exit(&hca->srv_conn_list.conn_lock);

	if (hca->hca_hdl != NULL) {
		mutex_enter(&hca->inuse_lock);
		while (hca->inuse)
			cv_wait(&hca->cb_cv, &hca->inuse_lock);
		mutex_exit(&hca->inuse_lock);

		rib_free_hca(hca);
	}
	rw_destroy(&hca->bound_services_lock);

	if (hca->cleanup_helper != NULL) {
		ddi_taskq_destroy(hca->cleanup_helper);
		hca->cleanup_helper = NULL;
	}
}

/*
 * Cleans and closes up all uses of the HCA
 */
static void
rib_detach_hca(ibt_hca_hdl_t hca_hdl)
{
	rib_hca_t *hca = NULL;
	rib_hca_t **hcap;

	rw_enter(&rib_stat->hcas_list_lock, RW_WRITER);
	for (hcap = &rib_stat->hcas_list; *hcap; hcap = &(*hcap)->next) {
		hca = *hcap;
		rw_enter(&hca->state_lock, RW_WRITER);
		if (hca->hca_hdl == hca_hdl) {
			/*
			 * Mark as detached and remove from
			 * hca list.
			 */
			hca->state = HCA_DETACHED;
			*hcap = hca->next;
			rib_stat->nhca_inited--;
			rib_mod.rdma_count--;
			rw_exit(&hca->state_lock);
			break;
		}
		rw_exit(&hca->state_lock);
	}
	rw_exit(&rib_stat->hcas_list_lock);

	if (hca == NULL)
		return;
	ASSERT(hca->hca_hdl == hca_hdl);

	/*
	 * Stop all services on the HCA
	 * Go through cl_conn_list and close all rc_channels
	 * Go through svr_conn_list and close all rc_channels
	 * Free connections whose c_ref has dropped to 0
	 * Destroy all CQs
	 * Deregister and released all buffer pool memory after all
	 * connections are destroyed
	 * Free the protection domain
	 * ibt_close_hca()
	 */
	rib_stop_hca_services(hca);

	kmem_free(hca, sizeof (*hca));
}

static void
rib_server_side_cache_reclaim(void *argp)
{
	cache_avl_struct_t    *rcas;
	rib_lrc_entry_t		*rb;
	rib_hca_t *hca = (rib_hca_t *)argp;

	rw_enter(&hca->avl_rw_lock, RW_WRITER);
	rcas = avl_first(&hca->avl_tree);
	if (rcas != NULL)
		avl_remove(&hca->avl_tree, rcas);

	while (rcas != NULL) {
		while (rcas->r.forw != &rcas->r) {
			rcas->elements--;
			rb = rcas->r.forw;
			remque(rb);
			if (rb->registered)
				(void) rib_deregistermem_via_hca(hca,
				    rb->lrc_buf, rb->lrc_mhandle);

			hca->cache_allocation -= rb->lrc_len;
			kmem_free(rb->lrc_buf, rb->lrc_len);
			kmem_free(rb, sizeof (rib_lrc_entry_t));
		}
		mutex_destroy(&rcas->node_lock);
		kmem_cache_free(hca->server_side_cache, rcas);
		rcas = avl_first(&hca->avl_tree);
		if (rcas != NULL)
			avl_remove(&hca->avl_tree, rcas);
	}
	rw_exit(&hca->avl_rw_lock);
}

static void
rib_server_side_cache_cleanup(void *argp)
{
	cache_avl_struct_t    *rcas;
	rib_lrc_entry_t		*rb;
	rib_hca_t *hca = (rib_hca_t *)argp;

	mutex_enter(&hca->cache_allocation_lock);
	if (hca->cache_allocation < cache_limit) {
		mutex_exit(&hca->cache_allocation_lock);
		return;
	}
	mutex_exit(&hca->cache_allocation_lock);

	rw_enter(&hca->avl_rw_lock, RW_WRITER);
	rcas = avl_last(&hca->avl_tree);
	if (rcas != NULL)
		avl_remove(&hca->avl_tree, rcas);

	while (rcas != NULL) {
		while (rcas->r.forw != &rcas->r) {
			rcas->elements--;
			rb = rcas->r.forw;
			remque(rb);
			if (rb->registered)
				(void) rib_deregistermem_via_hca(hca,
				    rb->lrc_buf, rb->lrc_mhandle);

			hca->cache_allocation -= rb->lrc_len;

			kmem_free(rb->lrc_buf, rb->lrc_len);
			kmem_free(rb, sizeof (rib_lrc_entry_t));
		}
		mutex_destroy(&rcas->node_lock);
		if (hca->server_side_cache) {
			kmem_cache_free(hca->server_side_cache, rcas);
		}

		if (hca->cache_allocation < cache_limit) {
			rw_exit(&hca->avl_rw_lock);
			return;
		}

		rcas = avl_last(&hca->avl_tree);
		if (rcas != NULL)
			avl_remove(&hca->avl_tree, rcas);
	}
	rw_exit(&hca->avl_rw_lock);
}

static int
avl_compare(const void *t1, const void *t2)
{
	if (((cache_avl_struct_t *)t1)->len == ((cache_avl_struct_t *)t2)->len)
		return (0);

	if (((cache_avl_struct_t *)t1)->len < ((cache_avl_struct_t *)t2)->len)
		return (-1);

	return (1);
}

static void
rib_destroy_cache(rib_hca_t *hca)
{
	if (hca->avl_init) {
		rib_server_side_cache_reclaim((void *)hca);
		if (hca->server_side_cache) {
			kmem_cache_destroy(hca->server_side_cache);
			hca->server_side_cache = NULL;
		}
		avl_destroy(&hca->avl_tree);
		mutex_destroy(&hca->cache_allocation_lock);
		rw_destroy(&hca->avl_rw_lock);
	}
	hca->avl_init = FALSE;
}

static void
rib_force_cleanup(void *hca)
{
	if (((rib_hca_t *)hca)->cleanup_helper != NULL)
		(void) ddi_taskq_dispatch(
		    ((rib_hca_t *)hca)->cleanup_helper,
		    rib_server_side_cache_cleanup,
		    (void *)hca, DDI_NOSLEEP);
}

static rib_lrc_entry_t *
rib_get_cache_buf(CONN *conn, uint32_t len)
{
	cache_avl_struct_t	cas, *rcas;
	rib_hca_t	*hca = (ctoqp(conn))->hca;
	rib_lrc_entry_t *reply_buf;
	avl_index_t where = (uintptr_t)NULL;
	uint64_t c_alloc = 0;

	if (!hca->avl_init)
		goto  error_alloc;

	cas.len = len;

	rw_enter(&hca->avl_rw_lock, RW_READER);

	mutex_enter(&hca->cache_allocation_lock);
	c_alloc = hca->cache_allocation;
	mutex_exit(&hca->cache_allocation_lock);

	if ((rcas = (cache_avl_struct_t *)avl_find(&hca->avl_tree, &cas,
	    &where)) == NULL) {
		/* Am I above the cache limit */
		if ((c_alloc + len) >= cache_limit) {
			rib_force_cleanup((void *)hca);
			rw_exit(&hca->avl_rw_lock);
			mutex_enter(&hca->cache_allocation_lock);
			hca->cache_misses_above_the_limit ++;
			mutex_exit(&hca->cache_allocation_lock);

			/* Allocate and register the buffer directly */
			goto error_alloc;
		}

		rw_exit(&hca->avl_rw_lock);
		rw_enter(&hca->avl_rw_lock, RW_WRITER);

		/* Recheck to make sure no other thread added the entry in */
		if ((rcas = (cache_avl_struct_t *)avl_find(&hca->avl_tree,
		    &cas, &where)) == NULL) {
			/* Allocate an avl tree entry */
			rcas = (cache_avl_struct_t *)
			    kmem_cache_alloc(hca->server_side_cache, KM_SLEEP);

			bzero(rcas, sizeof (cache_avl_struct_t));
			rcas->elements = 0;
			rcas->r.forw = &rcas->r;
			rcas->r.back = &rcas->r;
			rcas->len = len;
			mutex_init(&rcas->node_lock, NULL, MUTEX_DEFAULT, NULL);
			avl_insert(&hca->avl_tree, rcas, where);
		}
	}

	mutex_enter(&rcas->node_lock);

	if (rcas->r.forw != &rcas->r && rcas->elements > 0) {
		reply_buf = rcas->r.forw;
		remque(reply_buf);
		rcas->elements--;
		mutex_exit(&rcas->node_lock);
		rw_exit(&hca->avl_rw_lock);

		mutex_enter(&hca->cache_allocation_lock);
		hca->cache_hits++;
		hca->cache_allocation -= len;
		mutex_exit(&hca->cache_allocation_lock);
	} else {
		/* Am I above the cache limit */
		mutex_exit(&rcas->node_lock);
		if ((c_alloc + len) >= cache_limit) {
			rib_force_cleanup((void *)hca);
			rw_exit(&hca->avl_rw_lock);

			mutex_enter(&hca->cache_allocation_lock);
			hca->cache_misses_above_the_limit++;
			mutex_exit(&hca->cache_allocation_lock);
			/* Allocate and register the buffer directly */
			goto error_alloc;
		}
		rw_exit(&hca->avl_rw_lock);
		mutex_enter(&hca->cache_allocation_lock);
		hca->cache_misses++;
		mutex_exit(&hca->cache_allocation_lock);
		/* Allocate a reply_buf entry */
		reply_buf = (rib_lrc_entry_t *)
		    kmem_zalloc(sizeof (rib_lrc_entry_t), KM_SLEEP);
		bzero(reply_buf, sizeof (rib_lrc_entry_t));
		reply_buf->lrc_buf  = kmem_alloc(len, KM_SLEEP);
		reply_buf->lrc_len  = len;
		reply_buf->registered = FALSE;
		reply_buf->avl_node = (void *)rcas;
	}

	return (reply_buf);

error_alloc:
	reply_buf = (rib_lrc_entry_t *)
	    kmem_zalloc(sizeof (rib_lrc_entry_t), KM_SLEEP);
	bzero(reply_buf, sizeof (rib_lrc_entry_t));
	reply_buf->lrc_buf = kmem_alloc(len, KM_SLEEP);
	reply_buf->lrc_len = len;
	reply_buf->registered = FALSE;
	reply_buf->avl_node = NULL;

	return (reply_buf);
}

/*
 * Return a pre-registered back to the cache (without
 * unregistering the buffer)..
 */

static void
rib_free_cache_buf(CONN *conn, rib_lrc_entry_t *reg_buf)
{
	cache_avl_struct_t    cas, *rcas;
	avl_index_t where = (uintptr_t)NULL;
	rib_hca_t	*hca = (ctoqp(conn))->hca;

	if (!hca->avl_init)
		goto  error_free;

	cas.len = reg_buf->lrc_len;
	rw_enter(&hca->avl_rw_lock, RW_READER);
	if ((rcas = (cache_avl_struct_t *)
	    avl_find(&hca->avl_tree, &cas, &where)) == NULL) {
		rw_exit(&hca->avl_rw_lock);
		goto error_free;
	} else {
		cas.len = reg_buf->lrc_len;
		mutex_enter(&rcas->node_lock);
		insque(reg_buf, &rcas->r);
		rcas->elements ++;
		mutex_exit(&rcas->node_lock);
		rw_exit(&hca->avl_rw_lock);
		mutex_enter(&hca->cache_allocation_lock);
		hca->cache_allocation += cas.len;
		mutex_exit(&hca->cache_allocation_lock);
	}

	return;

error_free:

	if (reg_buf->registered)
		(void) rib_deregistermem_via_hca(hca,
		    reg_buf->lrc_buf, reg_buf->lrc_mhandle);
	kmem_free(reg_buf->lrc_buf, reg_buf->lrc_len);
	kmem_free(reg_buf, sizeof (rib_lrc_entry_t));
}

static rdma_stat
rib_registermem_via_hca(rib_hca_t *hca, caddr_t adsp, caddr_t buf,
    uint_t buflen, struct mrc *buf_handle)
{
	ibt_mr_hdl_t	mr_hdl = NULL;	/* memory region handle */
	ibt_mr_desc_t	mr_desc;	/* vaddr, lkey, rkey */
	rdma_stat	status;


	/*
	 * Note: ALL buffer pools use the same memory type RDMARW.
	 */
	status = rib_reg_mem(hca, adsp, buf, buflen, 0, &mr_hdl, &mr_desc);
	if (status == RDMA_SUCCESS) {
		buf_handle->mrc_linfo = (uint64_t)(uintptr_t)mr_hdl;
		buf_handle->mrc_lmr = (uint32_t)mr_desc.md_lkey;
		buf_handle->mrc_rmr = (uint32_t)mr_desc.md_rkey;
	} else {
		buf_handle->mrc_linfo = (uintptr_t)NULL;
		buf_handle->mrc_lmr = 0;
		buf_handle->mrc_rmr = 0;
	}
	return (status);
}

/* ARGSUSED */
static rdma_stat
rib_deregistermemsync_via_hca(rib_hca_t *hca, caddr_t buf,
    struct mrc buf_handle, RIB_SYNCMEM_HANDLE sync_handle)
{

	(void) rib_deregistermem_via_hca(hca, buf, buf_handle);
	return (RDMA_SUCCESS);
}

/* ARGSUSED */
static rdma_stat
rib_deregistermem_via_hca(rib_hca_t *hca, caddr_t buf, struct mrc buf_handle)
{

	(void) ibt_deregister_mr(hca->hca_hdl,
	    (ibt_mr_hdl_t)(uintptr_t)buf_handle.mrc_linfo);
	return (RDMA_SUCCESS);
}

/*
 * Check if the IP interface named by `lifrp' is RDMA-capable.
 */
static boolean_t
rpcib_rdma_capable_interface(struct lifreq *lifrp)
{
	char ifname[LIFNAMSIZ];
	char *cp;

	if (lifrp->lifr_type == IFT_IB)
		return (B_TRUE);

	/*
	 * Strip off the logical interface portion before getting
	 * intimate with the name.
	 */
	(void) strlcpy(ifname, lifrp->lifr_name, LIFNAMSIZ);
	if ((cp = strchr(ifname, ':')) != NULL)
		*cp = '\0';

	return (strcmp("lo0", ifname) == 0);
}

static int
rpcib_do_ip_ioctl(int cmd, int len, void *arg)
{
	vnode_t *kkvp, *vp;
	TIUSER  *tiptr;
	struct  strioctl iocb;
	k_sigset_t smask;
	int	err = 0;

	if (lookupname("/dev/udp", UIO_SYSSPACE, FOLLOW, NULLVPP, &kkvp) == 0) {
		if (t_kopen(NULL, kkvp->v_rdev, FREAD|FWRITE,
		    &tiptr, CRED()) == 0) {
			vp = tiptr->fp->f_vnode;
		} else {
			VN_RELE(kkvp);
			return (EPROTO);
		}
	} else {
		return (EPROTO);
	}

	iocb.ic_cmd = cmd;
	iocb.ic_timout = 0;
	iocb.ic_len = len;
	iocb.ic_dp = (caddr_t)arg;
	sigintr(&smask, 0);
	err = kstr_ioctl(vp, I_STR, (intptr_t)&iocb);
	sigunintr(&smask);
	(void) t_kclose(tiptr, 0);
	VN_RELE(kkvp);
	return (err);
}

/*
 * Issue an SIOCGLIFCONF down to IP and return the result in `lifcp'.
 * lifcp->lifc_buf is dynamically allocated to be *bufsizep bytes.
 */
static int
rpcib_do_lifconf(struct lifconf *lifcp, uint_t *bufsizep)
{
	int err;
	struct lifnum lifn;

	bzero(&lifn, sizeof (struct lifnum));
	lifn.lifn_family = AF_UNSPEC;

	err = rpcib_do_ip_ioctl(SIOCGLIFNUM, sizeof (struct lifnum), &lifn);
	if (err != 0)
		return (err);

	/*
	 * Pad the interface count to account for additional interfaces that
	 * may have been configured between the SIOCGLIFNUM and SIOCGLIFCONF.
	 */
	lifn.lifn_count += 4;

	bzero(lifcp, sizeof (struct lifconf));
	lifcp->lifc_family = AF_UNSPEC;
	lifcp->lifc_len = *bufsizep = lifn.lifn_count * sizeof (struct lifreq);
	lifcp->lifc_buf = kmem_zalloc(*bufsizep, KM_SLEEP);

	err = rpcib_do_ip_ioctl(SIOCGLIFCONF, sizeof (struct lifconf), lifcp);
	if (err != 0) {
		kmem_free(lifcp->lifc_buf, *bufsizep);
		return (err);
	}
	return (0);
}

static boolean_t
rpcib_get_ib_addresses(rpcib_ipaddrs_t *addrs4, rpcib_ipaddrs_t *addrs6)
{
	uint_t i, nifs;
	uint_t bufsize;
	struct lifconf lifc;
	struct lifreq *lifrp;
	struct sockaddr_in *sinp;
	struct sockaddr_in6 *sin6p;

	bzero(addrs4, sizeof (rpcib_ipaddrs_t));
	bzero(addrs6, sizeof (rpcib_ipaddrs_t));

	if (rpcib_do_lifconf(&lifc, &bufsize) != 0)
		return (B_FALSE);

	if ((nifs = lifc.lifc_len / sizeof (struct lifreq)) == 0) {
		kmem_free(lifc.lifc_buf, bufsize);
		return (B_FALSE);
	}

	/*
	 * Worst case is that all of the addresses are IB-capable and have
	 * the same address family, so size our buffers accordingly.
	 */
	addrs4->ri_size = nifs * sizeof (struct sockaddr_in);
	addrs4->ri_list = kmem_zalloc(addrs4->ri_size, KM_SLEEP);
	addrs6->ri_size = nifs * sizeof (struct sockaddr_in6);
	addrs6->ri_list = kmem_zalloc(addrs6->ri_size, KM_SLEEP);

	for (lifrp = lifc.lifc_req, i = 0; i < nifs; i++, lifrp++) {
		if (!rpcib_rdma_capable_interface(lifrp))
			continue;

		if (lifrp->lifr_addr.ss_family == AF_INET) {
			sinp = addrs4->ri_list;
			bcopy(&lifrp->lifr_addr, &sinp[addrs4->ri_count++],
			    sizeof (struct sockaddr_in));
		} else if (lifrp->lifr_addr.ss_family == AF_INET6) {
			sin6p = addrs6->ri_list;
			bcopy(&lifrp->lifr_addr, &sin6p[addrs6->ri_count++],
			    sizeof (struct sockaddr_in6));
		}
	}

	kmem_free(lifc.lifc_buf, bufsize);
	return (B_TRUE);
}

/* ARGSUSED */
static int
rpcib_cache_kstat_update(kstat_t *ksp, int rw)
{
	rib_hca_t *hca;

	if (KSTAT_WRITE == rw) {
		return (EACCES);
	}

	rpcib_kstat.cache_limit.value.ui64 =
	    (uint64_t)cache_limit;
	rw_enter(&rib_stat->hcas_list_lock, RW_READER);
	for (hca = rib_stat->hcas_list; hca; hca = hca->next) {
		rpcib_kstat.cache_allocation.value.ui64 +=
		    (uint64_t)hca->cache_allocation;
		rpcib_kstat.cache_hits.value.ui64 +=
		    (uint64_t)hca->cache_hits;
		rpcib_kstat.cache_misses.value.ui64 +=
		    (uint64_t)hca->cache_misses;
		rpcib_kstat.cache_misses_above_the_limit.value.ui64 +=
		    (uint64_t)hca->cache_misses_above_the_limit;
	}
	rw_exit(&rib_stat->hcas_list_lock);
	return (0);
}
#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License, Version 1.0 only
# (the "License").  You may not use this file except in compliance
# with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#
#
# Copyright 2004 Sun Microsystems, Inc.
# All rights reserved.
# Use is subject to license terms.
#

name="rpcib" parent="ib" unit-address="0";
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/*
 * Copyright 2012 Milan Jurik. All rights reserved.
 * Copyright 2012 Marcel Telka <marcel@telka.sk>
 * Copyright 2018 OmniOS Community Edition (OmniOSce) Association.
 * Copyright 2020 Tintri by DDN. All rights reserved.
 */
/* Copyright (c) 1990 Mentat Inc. */

/*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
/*	All Rights Reserved	*/

/*
 * Kernel RPC filtering module
 */

#include <sys/param.h>
#include <sys/types.h>
#include <sys/stream.h>
#include <sys/stropts.h>
#include <sys/strsubr.h>
#include <sys/tihdr.h>
#include <sys/timod.h>
#include <sys/tiuser.h>
#include <sys/debug.h>
#include <sys/signal.h>
#include <sys/pcb.h>
#include <sys/user.h>
#include <sys/errno.h>
#include <sys/cred.h>
#include <sys/policy.h>
#include <sys/inline.h>
#include <sys/cmn_err.h>
#include <sys/kmem.h>
#include <sys/file.h>
#include <sys/sysmacros.h>
#include <sys/systm.h>
#include <sys/t_lock.h>
#include <sys/ddi.h>
#include <sys/vtrace.h>
#include <sys/callb.h>
#include <sys/strsun.h>

#include <sys/strlog.h>
#include <rpc/rpc_com.h>
#include <inet/common.h>
#include <rpc/types.h>
#include <sys/time.h>
#include <rpc/xdr.h>
#include <rpc/auth.h>
#include <rpc/clnt.h>
#include <rpc/rpc_msg.h>
#include <rpc/clnt.h>
#include <rpc/svc.h>
#include <rpc/rpcsys.h>
#include <rpc/rpc_rdma.h>

/*
 * This is the loadable module wrapper.
 */
#include <sys/conf.h>
#include <sys/modctl.h>
#include <sys/syscall.h>

extern struct streamtab rpcinfo;

static struct fmodsw fsw = {
	"rpcmod",
	&rpcinfo,
	D_NEW|D_MP,
};

/*
 * Module linkage information for the kernel.
 */

static struct modlstrmod modlstrmod = {
	&mod_strmodops, "rpc interface str mod", &fsw
};

/*
 * For the RPC system call.
 */
static struct sysent rpcsysent = {
	2,
	SE_32RVAL1 | SE_ARGC | SE_NOUNLOAD,
	rpcsys
};

static struct modlsys modlsys = {
	&mod_syscallops,
	"RPC syscall",
	&rpcsysent
};

#ifdef _SYSCALL32_IMPL
static struct modlsys modlsys32 = {
	&mod_syscallops32,
	"32-bit RPC syscall",
	&rpcsysent
};
#endif /* _SYSCALL32_IMPL */

static struct modlinkage modlinkage = {
	MODREV_1,
	{
		&modlsys,
#ifdef _SYSCALL32_IMPL
		&modlsys32,
#endif
		&modlstrmod,
		NULL
	}
};

int
_init(void)
{
	int error = 0;
	callb_id_t cid;
	int status;

	svc_init();
	clnt_init();
	cid = callb_add(connmgr_cpr_reset, 0, CB_CL_CPR_RPC, "rpc");

	if (error = mod_install(&modlinkage)) {
		/*
		 * Could not install module, cleanup previous
		 * initialization work.
		 */
		clnt_fini();
		if (cid != NULL)
			(void) callb_delete(cid);

		return (error);
	}

	/*
	 * Load up the RDMA plugins and initialize the stats. Even if the
	 * plugins loadup fails, but rpcmod was successfully installed the
	 * counters still get initialized.
	 */
	rw_init(&rdma_lock, NULL, RW_DEFAULT, NULL);
	mutex_init(&rdma_modload_lock, NULL, MUTEX_DEFAULT, NULL);

	cv_init(&rdma_wait.svc_cv, NULL, CV_DEFAULT, NULL);
	mutex_init(&rdma_wait.svc_lock, NULL, MUTEX_DEFAULT, NULL);

	mt_kstat_init();

	/*
	 * Get our identification into ldi.  This is used for loading
	 * other modules, e.g. rpcib.
	 */
	status = ldi_ident_from_mod(&modlinkage, &rpcmod_li);
	if (status != 0) {
		cmn_err(CE_WARN, "ldi_ident_from_mod fails with %d", status);
		rpcmod_li = NULL;
	}

	return (error);
}

/*
 * The unload entry point fails, because we advertise entry points into
 * rpcmod from the rest of kRPC: rpcmod_release().
 */
int
_fini(void)
{
	return (EBUSY);
}

int
_info(struct modinfo *modinfop)
{
	return (mod_info(&modlinkage, modinfop));
}

extern int nulldev();

#define	RPCMOD_ID	2049

int rmm_open(queue_t *, dev_t *, int, int, cred_t *);
int rmm_close(queue_t *, int, cred_t *);

/*
 * To save instructions, since STREAMS ignores the return value
 * from these functions, they are defined as void here. Kind of icky, but...
 */
int rmm_rput(queue_t *, mblk_t *);
int rmm_wput(queue_t *, mblk_t *);
int rmm_rsrv(queue_t *);
int rmm_wsrv(queue_t *);

int rpcmodopen(queue_t *, dev_t *, int, int, cred_t *);
int rpcmodclose(queue_t *, int, cred_t *);
void rpcmodrput(queue_t *, mblk_t *);
void rpcmodwput(queue_t *, mblk_t *);
void rpcmodrsrv();
void rpcmodwsrv(queue_t *);

static	void	rpcmodwput_other(queue_t *, mblk_t *);
static	int	mir_close(queue_t *q);
static	int	mir_open(queue_t *q, dev_t *devp, int flag, int sflag,
		    cred_t *credp);
static	void	mir_rput(queue_t *q, mblk_t *mp);
static	void	mir_rsrv(queue_t *q);
static	void	mir_wput(queue_t *q, mblk_t *mp);
static	void	mir_wsrv(queue_t *q);

static struct module_info rpcmod_info =
	{RPCMOD_ID, "rpcmod", 0, INFPSZ, 256*1024, 1024};

static struct qinit rpcmodrinit = {
	rmm_rput,
	rmm_rsrv,
	rmm_open,
	rmm_close,
	nulldev,
	&rpcmod_info,
	NULL
};

/*
 * The write put procedure is simply putnext to conserve stack space.
 * The write service procedure is not used to queue data, but instead to
 * synchronize with flow control.
 */
static struct qinit rpcmodwinit = {
	rmm_wput,
	rmm_wsrv,
	rmm_open,
	rmm_close,
	nulldev,
	&rpcmod_info,
	NULL
};
struct streamtab rpcinfo = { &rpcmodrinit, &rpcmodwinit, NULL, NULL };

struct xprt_style_ops {
	int (*xo_open)();
	int (*xo_close)();
	void (*xo_wput)();
	void (*xo_wsrv)();
	void (*xo_rput)();
	void (*xo_rsrv)();
};

/*
 * Read side has no service procedure.
 */
static struct xprt_style_ops xprt_clts_ops = {
	rpcmodopen,
	rpcmodclose,
	rpcmodwput,
	rpcmodwsrv,
	rpcmodrput,
	NULL
};

static struct xprt_style_ops xprt_cots_ops = {
	mir_open,
	mir_close,
	mir_wput,
	mir_wsrv,
	mir_rput,
	mir_rsrv
};

/*
 * Per rpcmod "slot" data structure. q->q_ptr points to one of these.
 */
struct rpcm {
	void		*rm_krpc_cell;	/* Reserved for use by kRPC */
	struct		xprt_style_ops	*rm_ops;
	int		rm_type;	/* Client or server side stream */
#define	RM_CLOSING	0x1		/* somebody is trying to close slot */
	uint_t		rm_state;	/* state of the slot. see above */
	uint_t		rm_ref;		/* cnt of external references to slot */
	kmutex_t	rm_lock;	/* mutex protecting above fields */
	kcondvar_t	rm_cwait;	/* condition for closing */
	zoneid_t	rm_zoneid;	/* zone which pushed rpcmod */
};

struct temp_slot {
	void *cell;
	struct xprt_style_ops *ops;
	int type;
	mblk_t *info_ack;
	kmutex_t lock;
	kcondvar_t wait;
};

typedef struct mir_s {
	void	*mir_krpc_cell;	/* Reserved for kRPC use. This field */
					/* must be first in the structure. */
	struct xprt_style_ops	*rm_ops;
	int	mir_type;		/* Client or server side stream */

	mblk_t	*mir_head_mp;		/* RPC msg in progress */
		/*
		 * mir_head_mp points the first mblk being collected in
		 * the current RPC message.  Record headers are removed
		 * before data is linked into mir_head_mp.
		 */
	mblk_t	*mir_tail_mp;		/* Last mblk in mir_head_mp */
		/*
		 * mir_tail_mp points to the last mblk in the message
		 * chain starting at mir_head_mp.  It is only valid
		 * if mir_head_mp is non-NULL and is used to add new
		 * data blocks to the end of chain quickly.
		 */

	int32_t	mir_frag_len;		/* Bytes seen in the current frag */
		/*
		 * mir_frag_len starts at -4 for beginning of each fragment.
		 * When this length is negative, it indicates the number of
		 * bytes that rpcmod needs to complete the record marker
		 * header.  When it is positive or zero, it holds the number
		 * of bytes that have arrived for the current fragment and
		 * are held in mir_header_mp.
		 */

	int32_t	mir_frag_header;
		/*
		 * Fragment header as collected for the current fragment.
		 * It holds the last-fragment indicator and the number
		 * of bytes in the fragment.
		 */

	unsigned int
		mir_ordrel_pending : 1,	/* Sent T_ORDREL_REQ */
		mir_hold_inbound : 1,	/* Hold inbound messages on server */
					/* side until outbound flow control */
					/* is relieved. */
		mir_closing : 1,	/* The stream is being closed */
		mir_inrservice : 1,	/* data queued or rd srv proc running */
		mir_inwservice : 1,	/* data queued or wr srv proc running */
		mir_inwflushdata : 1,	/* flush M_DATAs when srv runs */
		/*
		 * On client streams, mir_clntreq is 0 or 1; it is set
		 * to 1 whenever a new request is sent out (mir_wput)
		 * and cleared when the timer fires (mir_timer).  If
		 * the timer fires with this value equal to 0, then the
		 * stream is considered idle and kRPC is notified.
		 */
		mir_clntreq : 1,
		/*
		 * On server streams, stop accepting messages
		 */
		mir_svc_no_more_msgs : 1,
		mir_listen_stream : 1,	/* listen end point */
		mir_unused : 1,	/* no longer used */
		mir_timer_call : 1,
		mir_junk_fill_thru_bit_31 : 21;

	int	mir_setup_complete;	/* server has initialized everything */
	timeout_id_t mir_timer_id;	/* Timer for idle checks */
	clock_t	mir_idle_timeout;	/* Allowed idle time before shutdown */
		/*
		 * This value is copied from clnt_idle_timeout or
		 * svc_idle_timeout during the appropriate ioctl.
		 * Kept in milliseconds
		 */
	clock_t	mir_use_timestamp;	/* updated on client with each use */
		/*
		 * This value is set to lbolt
		 * every time a client stream sends or receives data.
		 * Even if the timer message arrives, we don't shutdown
		 * client unless:
		 *    lbolt >= MSEC_TO_TICK(mir_idle_timeout)+mir_use_timestamp.
		 * This value is kept in HZ.
		 */

	uint_t	*mir_max_msg_sizep;	/* Reference to sanity check size */
		/*
		 * This pointer is set to &clnt_max_msg_size or
		 * &svc_max_msg_size during the appropriate ioctl.
		 */
	zoneid_t mir_zoneid;	/* zone which pushed rpcmod */
	/* Server-side fields. */
	int	mir_ref_cnt;		/* Reference count: server side only */
					/* counts the number of references */
					/* that a kernel RPC server thread */
					/* (see svc_run()) has on this rpcmod */
					/* slot. Effectively, it is the */
					/* number of unprocessed messages */
					/* that have been passed up to the */
					/* kRPC layer */

	mblk_t	*mir_svc_pend_mp;	/* Pending T_ORDREL_IND or */
					/* T_DISCON_IND */

	/*
	 * these fields are for both client and server, but for debugging,
	 * it is easier to have these last in the structure.
	 */
	kmutex_t	mir_mutex;	/* Mutex and condvar for close */
	kcondvar_t	mir_condvar;	/* synchronization. */
	kcondvar_t	mir_timer_cv;	/* Timer routine sync. */
} mir_t;

void tmp_rput(queue_t *q, mblk_t *mp);

struct xprt_style_ops tmpops = {
	NULL,
	NULL,
	putnext,
	NULL,
	tmp_rput,
	NULL
};

void
tmp_rput(queue_t *q, mblk_t *mp)
{
	struct temp_slot *t = (struct temp_slot *)(q->q_ptr);
	struct T_info_ack *pptr;

	switch (mp->b_datap->db_type) {
	case M_PCPROTO:
		pptr = (struct T_info_ack *)mp->b_rptr;
		switch (pptr->PRIM_type) {
		case T_INFO_ACK:
			mutex_enter(&t->lock);
			t->info_ack = mp;
			cv_signal(&t->wait);
			mutex_exit(&t->lock);
			return;
		default:
			break;
		}
	default:
		break;
	}

	/*
	 * Not an info-ack, so free it. This is ok because we should
	 * not be receiving data until the open finishes: rpcmod
	 * is pushed well before the end-point is bound to an address.
	 */
	freemsg(mp);
}

int
rmm_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *crp)
{
	mblk_t *bp;
	struct temp_slot ts, *t;
	struct T_info_ack *pptr;
	int error = 0;

	ASSERT(q != NULL);
	/*
	 * Check for re-opens.
	 */
	if (q->q_ptr) {
		TRACE_1(TR_FAC_KRPC, TR_RPCMODOPEN_END,
		    "rpcmodopen_end:(%s)", "q->qptr");
		return (0);
	}

	t = &ts;
	bzero(t, sizeof (*t));
	q->q_ptr = (void *)t;
	WR(q)->q_ptr = (void *)t;

	/*
	 * Allocate the required messages upfront.
	 */
	if ((bp = allocb_cred(sizeof (struct T_info_req) +
	    sizeof (struct T_info_ack), crp, curproc->p_pid)) == NULL) {
		return (ENOBUFS);
	}

	mutex_init(&t->lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&t->wait, NULL, CV_DEFAULT, NULL);

	t->ops = &tmpops;

	qprocson(q);
	bp->b_datap->db_type = M_PCPROTO;
	*(int32_t *)bp->b_wptr = (int32_t)T_INFO_REQ;
	bp->b_wptr += sizeof (struct T_info_req);
	putnext(WR(q), bp);

	mutex_enter(&t->lock);
	while (t->info_ack == NULL) {
		if (cv_wait_sig(&t->wait, &t->lock) == 0) {
			error = EINTR;
			break;
		}
	}
	mutex_exit(&t->lock);

	if (error)
		goto out;

	pptr = (struct T_info_ack *)t->info_ack->b_rptr;

	if (pptr->SERV_type == T_CLTS) {
		if ((error = rpcmodopen(q, devp, flag, sflag, crp)) == 0)
			((struct rpcm *)q->q_ptr)->rm_ops = &xprt_clts_ops;
	} else {
		if ((error = mir_open(q, devp, flag, sflag, crp)) == 0)
			((mir_t *)q->q_ptr)->rm_ops = &xprt_cots_ops;
	}

out:
	if (error)
		qprocsoff(q);

	freemsg(t->info_ack);
	mutex_destroy(&t->lock);
	cv_destroy(&t->wait);

	return (error);
}

int
rmm_rput(queue_t *q, mblk_t  *mp)
{
	(*((struct temp_slot *)q->q_ptr)->ops->xo_rput)(q, mp);
	return (0);
}

int
rmm_rsrv(queue_t *q)
{
	(*((struct temp_slot *)q->q_ptr)->ops->xo_rsrv)(q);
	return (0);
}

int
rmm_wput(queue_t *q, mblk_t *mp)
{
	(*((struct temp_slot *)q->q_ptr)->ops->xo_wput)(q, mp);
	return (0);
}

int
rmm_wsrv(queue_t *q)
{
	(*((struct temp_slot *)q->q_ptr)->ops->xo_wsrv)(q);
	return (0);
}

int
rmm_close(queue_t *q, int flag, cred_t *crp)
{
	return ((*((struct temp_slot *)q->q_ptr)->ops->xo_close)(q, flag, crp));
}

/*
 * rpcmodopen -	open routine gets called when the module gets pushed
 *		onto the stream.
 */
/*ARGSUSED*/
int
rpcmodopen(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *crp)
{
	struct rpcm *rmp;

	TRACE_0(TR_FAC_KRPC, TR_RPCMODOPEN_START, "rpcmodopen_start:");

	/*
	 * Only sufficiently privileged users can use this module, and it
	 * is assumed that they will use this module properly, and NOT send
	 * bulk data from downstream.
	 */
	if (secpolicy_rpcmod_open(crp) != 0)
		return (EPERM);

	/*
	 * Allocate slot data structure.
	 */
	rmp = kmem_zalloc(sizeof (*rmp), KM_SLEEP);

	mutex_init(&rmp->rm_lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&rmp->rm_cwait, NULL, CV_DEFAULT, NULL);
	rmp->rm_zoneid = rpc_zoneid();
	/*
	 * slot type will be set by kRPC client and server ioctl's
	 */
	rmp->rm_type = 0;

	q->q_ptr = (void *)rmp;
	WR(q)->q_ptr = (void *)rmp;

	TRACE_1(TR_FAC_KRPC, TR_RPCMODOPEN_END, "rpcmodopen_end:(%s)", "end");
	return (0);
}

/*
 * rpcmodclose - This routine gets called when the module gets popped
 * off of the stream.
 */
/*ARGSUSED*/
int
rpcmodclose(queue_t *q, int flag, cred_t *crp)
{
	struct rpcm *rmp;

	ASSERT(q != NULL);
	rmp = (struct rpcm *)q->q_ptr;

	/*
	 * Mark our state as closing.
	 */
	mutex_enter(&rmp->rm_lock);
	rmp->rm_state |= RM_CLOSING;

	/*
	 * Check and see if there are any messages on the queue.  If so, send
	 * the messages, regardless whether the downstream module is ready to
	 * accept data.
	 */
	if (rmp->rm_type == RPC_SERVER) {
		flushq(q, FLUSHDATA);

		qenable(WR(q));

		if (rmp->rm_ref) {
			mutex_exit(&rmp->rm_lock);
			/*
			 * call into SVC to clean the queue
			 */
			svc_queueclean(q);
			mutex_enter(&rmp->rm_lock);

			/*
			 * Block while there are kRPC threads with a reference
			 * to this message.
			 */
			while (rmp->rm_ref)
				cv_wait(&rmp->rm_cwait, &rmp->rm_lock);
		}

		mutex_exit(&rmp->rm_lock);

		/*
		 * It is now safe to remove this queue from the stream. No kRPC
		 * threads have a reference to the stream, and none ever will,
		 * because RM_CLOSING is set.
		 */
		qprocsoff(q);

		/* Notify kRPC that this stream is going away. */
		svc_queueclose(q);
	} else {
		mutex_exit(&rmp->rm_lock);
		qprocsoff(q);
	}

	q->q_ptr = NULL;
	WR(q)->q_ptr = NULL;
	mutex_destroy(&rmp->rm_lock);
	cv_destroy(&rmp->rm_cwait);
	kmem_free(rmp, sizeof (*rmp));
	return (0);
}

/*
 * rpcmodrput -	Module read put procedure.  This is called from
 *		the module, driver, or stream head downstream.
 */
void
rpcmodrput(queue_t *q, mblk_t *mp)
{
	struct rpcm *rmp;
	union T_primitives *pptr;
	int hdrsz;

	TRACE_0(TR_FAC_KRPC, TR_RPCMODRPUT_START, "rpcmodrput_start:");

	ASSERT(q != NULL);
	rmp = (struct rpcm *)q->q_ptr;

	if (rmp->rm_type == 0) {
		freemsg(mp);
		return;
	}

	switch (mp->b_datap->db_type) {
	default:
		putnext(q, mp);
		break;

	case M_PROTO:
	case M_PCPROTO:
		ASSERT((mp->b_wptr - mp->b_rptr) >= sizeof (int32_t));
		pptr = (union T_primitives *)mp->b_rptr;

		/*
		 * Forward this message to kRPC if it is data.
		 */
		if (pptr->type == T_UNITDATA_IND) {
			/*
			 * Check if the module is being popped.
			 */
			mutex_enter(&rmp->rm_lock);
			if (rmp->rm_state & RM_CLOSING) {
				mutex_exit(&rmp->rm_lock);
				putnext(q, mp);
				break;
			}

			switch (rmp->rm_type) {
			case RPC_CLIENT:
				mutex_exit(&rmp->rm_lock);
				hdrsz = mp->b_wptr - mp->b_rptr;

				/*
				 * Make sure the header is sane.
				 */
				if (hdrsz < TUNITDATAINDSZ ||
				    hdrsz < (pptr->unitdata_ind.OPT_length +
				    pptr->unitdata_ind.OPT_offset) ||
				    hdrsz < (pptr->unitdata_ind.SRC_length +
				    pptr->unitdata_ind.SRC_offset)) {
					freemsg(mp);
					return;
				}

				/*
				 * Call clnt_clts_dispatch_notify, so that it
				 * can pass the message to the proper caller.
				 * Don't discard the header just yet since the
				 * client may need the sender's address.
				 */
				clnt_clts_dispatch_notify(mp, hdrsz,
				    rmp->rm_zoneid);
				return;
			case RPC_SERVER:
				/*
				 * rm_krpc_cell is exclusively used by the kRPC
				 * CLTS server. Try to submit the message to
				 * kRPC. Since this is an unreliable channel, we
				 * can just free the message in case the kRPC
				 * does not accept new messages.
				 */
				if (rmp->rm_krpc_cell &&
				    svc_queuereq(q, mp, TRUE)) {
					/*
					 * Raise the reference count on this
					 * module to prevent it from being
					 * popped before kRPC generates the
					 * reply.
					 */
					rmp->rm_ref++;
					mutex_exit(&rmp->rm_lock);
				} else {
					mutex_exit(&rmp->rm_lock);
					freemsg(mp);
				}
				return;
			default:
				mutex_exit(&rmp->rm_lock);
				freemsg(mp);
				return;
			} /* end switch(rmp->rm_type) */
		} else if (pptr->type == T_UDERROR_IND) {
			mutex_enter(&rmp->rm_lock);
			hdrsz = mp->b_wptr - mp->b_rptr;

			/*
			 * Make sure the header is sane
			 */
			if (hdrsz < TUDERRORINDSZ ||
			    hdrsz < (pptr->uderror_ind.OPT_length +
			    pptr->uderror_ind.OPT_offset) ||
			    hdrsz < (pptr->uderror_ind.DEST_length +
			    pptr->uderror_ind.DEST_offset)) {
				mutex_exit(&rmp->rm_lock);
				freemsg(mp);
				return;
			}

			/*
			 * In the case where a unit data error has been
			 * received, all we need to do is clear the message from
			 * the queue.
			 */
			mutex_exit(&rmp->rm_lock);
			freemsg(mp);
			RPCLOG(32, "rpcmodrput: unitdata error received at "
			    "%ld\n", gethrestime_sec());
			return;
		} /* end else if (pptr->type == T_UDERROR_IND) */

		putnext(q, mp);
		break;
	} /* end switch (mp->b_datap->db_type) */

	TRACE_0(TR_FAC_KRPC, TR_RPCMODRPUT_END,
	    "rpcmodrput_end:");
	/*
	 * Return codes are not looked at by the STREAMS framework.
	 */
}

/*
 * write put procedure
 */
void
rpcmodwput(queue_t *q, mblk_t *mp)
{
	struct rpcm	*rmp;

	ASSERT(q != NULL);

	switch (mp->b_datap->db_type) {
		case M_PROTO:
		case M_PCPROTO:
			break;
		default:
			rpcmodwput_other(q, mp);
			return;
	}

	/*
	 * Check to see if we can send the message downstream.
	 */
	if (canputnext(q)) {
		putnext(q, mp);
		return;
	}

	rmp = (struct rpcm *)q->q_ptr;
	ASSERT(rmp != NULL);

	/*
	 * The first canputnext failed.  Try again except this time with the
	 * lock held, so that we can check the state of the stream to see if
	 * it is closing.  If either of these conditions evaluate to true
	 * then send the meesage.
	 */
	mutex_enter(&rmp->rm_lock);
	if (canputnext(q) || (rmp->rm_state & RM_CLOSING)) {
		mutex_exit(&rmp->rm_lock);
		putnext(q, mp);
	} else {
		/*
		 * canputnext failed again and the stream is not closing.
		 * Place the message on the queue and let the service
		 * procedure handle the message.
		 */
		mutex_exit(&rmp->rm_lock);
		(void) putq(q, mp);
	}
}

static void
rpcmodwput_other(queue_t *q, mblk_t *mp)
{
	struct rpcm	*rmp;
	struct iocblk	*iocp;

	rmp = (struct rpcm *)q->q_ptr;
	ASSERT(rmp != NULL);

	switch (mp->b_datap->db_type) {
		case M_IOCTL:
			iocp = (struct iocblk *)mp->b_rptr;
			ASSERT(iocp != NULL);
			switch (iocp->ioc_cmd) {
				case RPC_CLIENT:
				case RPC_SERVER:
					mutex_enter(&rmp->rm_lock);
					rmp->rm_type = iocp->ioc_cmd;
					mutex_exit(&rmp->rm_lock);
					mp->b_datap->db_type = M_IOCACK;
					qreply(q, mp);
					return;
				default:
				/*
				 * pass the ioctl downstream and hope someone
				 * down there knows how to handle it.
				 */
					putnext(q, mp);
					return;
			}
		default:
			break;
	}
	/*
	 * This is something we definitely do not know how to handle, just
	 * pass the message downstream
	 */
	putnext(q, mp);
}

/*
 * Module write service procedure. This is called by downstream modules
 * for back enabling during flow control.
 */
void
rpcmodwsrv(queue_t *q)
{
	struct rpcm	*rmp;
	mblk_t		*mp = NULL;

	rmp = (struct rpcm *)q->q_ptr;
	ASSERT(rmp != NULL);

	/*
	 * Get messages that may be queued and send them down stream
	 */
	while ((mp = getq(q)) != NULL) {
		/*
		 * Optimize the service procedure for the server-side, by
		 * avoiding a call to canputnext().
		 */
		if (rmp->rm_type == RPC_SERVER || canputnext(q)) {
			putnext(q, mp);
			continue;
		}
		(void) putbq(q, mp);
		return;
	}
}

void
rpcmod_hold(queue_t *q)
{
	struct rpcm *rmp = (struct rpcm *)q->q_ptr;

	mutex_enter(&rmp->rm_lock);
	rmp->rm_ref++;
	mutex_exit(&rmp->rm_lock);
}

void
rpcmod_release(queue_t *q, mblk_t *bp, bool_t enable __unused)
{
	struct rpcm *rmp;

	/*
	 * For now, just free the message.
	 */
	if (bp)
		freemsg(bp);
	rmp = (struct rpcm *)q->q_ptr;

	mutex_enter(&rmp->rm_lock);
	rmp->rm_ref--;

	if (rmp->rm_ref == 0 && (rmp->rm_state & RM_CLOSING)) {
		cv_broadcast(&rmp->rm_cwait);
	}

	mutex_exit(&rmp->rm_lock);
}

/*
 * This part of rpcmod is pushed on a connection-oriented transport for use
 * by RPC.  It serves to bypass the Stream head, implements
 * the record marking protocol, and dispatches incoming RPC messages.
 */

/* Default idle timer values */
#define	MIR_CLNT_IDLE_TIMEOUT	(5 * (60 * 1000L))	/* 5 minutes */
#define	MIR_SVC_IDLE_TIMEOUT	(6 * (60 * 1000L))	/* 6 minutes */
#define	MIR_SVC_ORDREL_TIMEOUT	(10 * (60 * 1000L))	/* 10 minutes */
#define	MIR_LASTFRAG	0x80000000	/* Record marker */

#define	MIR_SVC_QUIESCED(mir)	\
	(mir->mir_ref_cnt == 0 && mir->mir_inrservice == 0)

#define	MIR_CLEAR_INRSRV(mir_ptr)	{	\
	(mir_ptr)->mir_inrservice = 0;	\
	if ((mir_ptr)->mir_type == RPC_SERVER &&	\
		(mir_ptr)->mir_closing)	\
		cv_signal(&(mir_ptr)->mir_condvar);	\
}

/*
 * Don't block service procedure (and mir_close) if
 * we are in the process of closing.
 */
#define	MIR_WCANPUTNEXT(mir_ptr, write_q)	\
	(canputnext(write_q) || ((mir_ptr)->mir_svc_no_more_msgs == 1))

static int	mir_clnt_dup_request(queue_t *q, mblk_t *mp);
static void	mir_rput_proto(queue_t *q, mblk_t *mp);
static int	mir_svc_policy_notify(queue_t *q, int event);
static void	mir_svc_start(queue_t *wq);
static void	mir_svc_idle_start(queue_t *, mir_t *);
static void	mir_svc_idle_stop(queue_t *, mir_t *);
static void	mir_svc_start_close(queue_t *, mir_t *);
static void	mir_clnt_idle_do_stop(queue_t *);
static void	mir_clnt_idle_stop(queue_t *, mir_t *);
static void	mir_clnt_idle_start(queue_t *, mir_t *);
static void	mir_wput(queue_t *q, mblk_t *mp);
static void	mir_wput_other(queue_t *q, mblk_t *mp);
static void	mir_wsrv(queue_t *q);
static	void	mir_disconnect(queue_t *, mir_t *ir);
static	int	mir_check_len(queue_t *, mblk_t *);
static	void	mir_timer(void *);

extern void	(*mir_start)(queue_t *);
extern void	(*clnt_stop_idle)(queue_t *);

clock_t	clnt_idle_timeout = MIR_CLNT_IDLE_TIMEOUT;
clock_t	svc_idle_timeout = MIR_SVC_IDLE_TIMEOUT;

/*
 * Timeout for subsequent notifications of idle connection.  This is
 * typically used to clean up after a wedged orderly release.
 */
clock_t	svc_ordrel_timeout = MIR_SVC_ORDREL_TIMEOUT; /* milliseconds */

extern	uint_t	*clnt_max_msg_sizep;
extern	uint_t	*svc_max_msg_sizep;
uint_t	clnt_max_msg_size = RPC_MAXDATASIZE;
uint_t	svc_max_msg_size = RPC_MAXDATASIZE;
uint_t	mir_krpc_cell_null;

static void
mir_timer_stop(mir_t *mir)
{
	timeout_id_t tid;

	ASSERT(MUTEX_HELD(&mir->mir_mutex));

	/*
	 * Since the mir_mutex lock needs to be released to call
	 * untimeout(), we need to make sure that no other thread
	 * can start/stop the timer (changing mir_timer_id) during
	 * that time.  The mir_timer_call bit and the mir_timer_cv
	 * condition variable are used to synchronize this.  Setting
	 * mir_timer_call also tells mir_timer() (refer to the comments
	 * in mir_timer()) that it does not need to do anything.
	 */
	while (mir->mir_timer_call)
		cv_wait(&mir->mir_timer_cv, &mir->mir_mutex);
	mir->mir_timer_call = B_TRUE;

	if ((tid = mir->mir_timer_id) != 0) {
		mir->mir_timer_id = 0;
		mutex_exit(&mir->mir_mutex);
		(void) untimeout(tid);
		mutex_enter(&mir->mir_mutex);
	}
	mir->mir_timer_call = B_FALSE;
	cv_broadcast(&mir->mir_timer_cv);
}

static void
mir_timer_start(queue_t *q, mir_t *mir, clock_t intrvl)
{
	timeout_id_t tid;

	ASSERT(MUTEX_HELD(&mir->mir_mutex));

	while (mir->mir_timer_call)
		cv_wait(&mir->mir_timer_cv, &mir->mir_mutex);
	mir->mir_timer_call = B_TRUE;

	if ((tid = mir->mir_timer_id) != 0) {
		mutex_exit(&mir->mir_mutex);
		(void) untimeout(tid);
		mutex_enter(&mir->mir_mutex);
	}
	/* Only start the timer when it is not closing. */
	if (!mir->mir_closing) {
		mir->mir_timer_id = timeout(mir_timer, q,
		    MSEC_TO_TICK(intrvl));
	}
	mir->mir_timer_call = B_FALSE;
	cv_broadcast(&mir->mir_timer_cv);
}

static int
mir_clnt_dup_request(queue_t *q, mblk_t *mp)
{
	mblk_t  *mp1;
	uint32_t  new_xid;
	uint32_t  old_xid;

	ASSERT(MUTEX_HELD(&((mir_t *)q->q_ptr)->mir_mutex));
	new_xid = BE32_TO_U32(&mp->b_rptr[4]);
	/*
	 * This loop is a bit tacky -- it walks the STREAMS list of
	 * flow-controlled messages.
	 */
	if ((mp1 = q->q_first) != NULL) {
		do {
			old_xid = BE32_TO_U32(&mp1->b_rptr[4]);
			if (new_xid == old_xid)
				return (1);
		} while ((mp1 = mp1->b_next) != NULL);
	}
	return (0);
}

static int
mir_close(queue_t *q)
{
	mir_t	*mir = q->q_ptr;
	mblk_t	*mp;
	bool_t queue_cleaned = FALSE;

	RPCLOG(32, "rpcmod: mir_close of q 0x%p\n", (void *)q);
	ASSERT(MUTEX_NOT_HELD(&mir->mir_mutex));
	mutex_enter(&mir->mir_mutex);
	if ((mp = mir->mir_head_mp) != NULL) {
		mir->mir_head_mp = NULL;
		mir->mir_tail_mp = NULL;
		freemsg(mp);
	}
	/*
	 * Set mir_closing so we get notified when MIR_SVC_QUIESCED()
	 * is TRUE.  And mir_timer_start() won't start the timer again.
	 */
	mir->mir_closing = B_TRUE;
	mir_timer_stop(mir);

	if (mir->mir_type == RPC_SERVER) {
		flushq(q, FLUSHDATA);	/* Ditch anything waiting on read q */

		/*
		 * This will prevent more requests from arriving and
		 * will force rpcmod to ignore flow control.
		 */
		mir_svc_start_close(WR(q), mir);

		while ((!MIR_SVC_QUIESCED(mir)) || mir->mir_inwservice == 1) {

			if (mir->mir_ref_cnt && !mir->mir_inrservice &&
			    (queue_cleaned == FALSE)) {
				/*
				 * call into SVC to clean the queue
				 */
				mutex_exit(&mir->mir_mutex);
				svc_queueclean(q);
				queue_cleaned = TRUE;
				mutex_enter(&mir->mir_mutex);
				continue;
			}

			/*
			 * Bugid 1253810 - Force the write service
			 * procedure to send its messages, regardless
			 * whether the downstream  module is ready
			 * to accept data.
			 */
			if (mir->mir_inwservice == 1)
				qenable(WR(q));

			cv_wait(&mir->mir_condvar, &mir->mir_mutex);
		}

		mutex_exit(&mir->mir_mutex);
		/*
		 * Destroy the cm_entry
		 */
		connmgr_cb_destroy(WR(q));
		connmgr_destroy(WR(q));
		qprocsoff(q);

		/* Notify kRPC that this stream is going away. */
		svc_queueclose(q);
	} else {
		mutex_exit(&mir->mir_mutex);
		qprocsoff(q);
	}

	mutex_destroy(&mir->mir_mutex);
	cv_destroy(&mir->mir_condvar);
	cv_destroy(&mir->mir_timer_cv);
	kmem_free(mir, sizeof (mir_t));
	return (0);
}

/*
 * This is server side only (RPC_SERVER).
 *
 * Exit idle mode.
 */
static void
mir_svc_idle_stop(queue_t *q, mir_t *mir)
{
	ASSERT(MUTEX_HELD(&mir->mir_mutex));
	ASSERT((q->q_flag & QREADR) == 0);
	ASSERT(mir->mir_type == RPC_SERVER);
	RPCLOG(16, "rpcmod: mir_svc_idle_stop of q 0x%p\n", (void *)q);

	mir_timer_stop(mir);
}

/*
 * This is server side only (RPC_SERVER).
 *
 * Start idle processing, which will include setting idle timer if the
 * stream is not being closed.
 */
static void
mir_svc_idle_start(queue_t *q, mir_t *mir)
{
	ASSERT(MUTEX_HELD(&mir->mir_mutex));
	ASSERT((q->q_flag & QREADR) == 0);
	ASSERT(mir->mir_type == RPC_SERVER);
	RPCLOG(16, "rpcmod: mir_svc_idle_start q 0x%p\n", (void *)q);

	/*
	 * Don't re-start idle timer if we are closing queues.
	 */
	if (mir->mir_closing) {
		RPCLOG(16, "mir_svc_idle_start - closing: 0x%p\n",
		    (void *)q);

		/*
		 * We will call mir_svc_idle_start() whenever MIR_SVC_QUIESCED()
		 * is true.  When it is true, and we are in the process of
		 * closing the stream, signal any thread waiting in
		 * mir_close().
		 */
		if (mir->mir_inwservice == 0)
			cv_signal(&mir->mir_condvar);

	} else {
		RPCLOG(16, "mir_svc_idle_start - reset %s timer\n",
		    mir->mir_ordrel_pending ? "ordrel" : "normal");
		/*
		 * Normal condition, start the idle timer.  If an orderly
		 * release has been sent, set the timeout to wait for the
		 * client to close its side of the connection.  Otherwise,
		 * use the normal idle timeout.
		 */
		mir_timer_start(q, mir, mir->mir_ordrel_pending ?
		    svc_ordrel_timeout : mir->mir_idle_timeout);
	}
}

/*
 * Copy out the RPC transaction id and RPC Direction
 * from the mblk chain. Leave the mblk intact.
 */
bool_t
mir_dir_xid(mblk_t *mp, uint32_t *dir, uint32_t *xid)
{
	unsigned char	*p;
	unsigned char	*rptr;
	mblk_t		*tmp;
	int		i, get_rpcdir;
	uint32_t	d_tmp = 0;

	/*
	 * If we can just grab the XID and RPC direction flag great.
	 */
	if ((IS_P2ALIGNED(mp->b_rptr, (sizeof (uint64_t)))) &&
	    (mp->b_wptr - mp->b_rptr) >= (sizeof (uint64_t))) {
		*xid = *((uint32_t *)mp->b_rptr);
		*dir = ntohl(*((uint32_t *)(mp->b_rptr + sizeof (uint32_t))));
		return (TRUE);
	}

	/*
	 * Otherwise we need to copy byte-by-byte
	 */
	DTRACE_PROBE(krpc__i__bytecopy);

	i = get_rpcdir = 0;
	p = (unsigned char *)xid;
	tmp = mp;

	/*
	 * While we have not exhausted the entire mblk chain:
	 * copy the first sizeof uint32_t value into xid, and
	 * then the second sizeof uint32_t value into a temporary
	 * so that we can convert from network byte order.
	 *
	 * Should we exhaust the entire mblk chain in attempting
	 * to do this, return FALSE.
	 */
	while (tmp) {
		rptr = tmp->b_rptr;
		while (rptr < tmp->b_wptr) {
			*p++ = *rptr++;
			/*
			 * Have we collected enough bytes for
			 * a uint32_t ?
			 */
			if (++i == sizeof (uint32_t)) {
				/*
				 * If yes, do we need to switch to
				 * RPC Direction or are we all done ?
				 */
				if (get_rpcdir) {
					/* Got it all */
					*dir = ntohl(d_tmp);
					return (TRUE);
				}
				/* start to collect RPC Direction */
				get_rpcdir++;
				i = 0;
				p = (unsigned char *)&d_tmp;
			}
		}
		tmp = tmp->b_cont;
	}

	/* We didn't get both of them.. */
	DTRACE_PROBE(krpc__e__mblk_exhausted);
	return (FALSE);
}

static int
mir_open(queue_t *q, dev_t *devp __unused, int flag __unused,
    int sflag __unused, cred_t *credp __unused)
{
	mir_t	*mir;

	RPCLOG(32, "rpcmod: mir_open of q 0x%p\n", (void *)q);
	/* Set variables used directly by kRPC. */
	if (!mir_start)
		mir_start = mir_svc_start;
	if (!clnt_stop_idle)
		clnt_stop_idle = mir_clnt_idle_do_stop;
	if (!clnt_max_msg_sizep)
		clnt_max_msg_sizep = &clnt_max_msg_size;
	if (!svc_max_msg_sizep)
		svc_max_msg_sizep = &svc_max_msg_size;

	/* Allocate a zero'ed out mir structure for this stream. */
	mir = kmem_zalloc(sizeof (mir_t), KM_SLEEP);

	/*
	 * We set hold inbound here so that incoming messages will
	 * be held on the read-side queue until the stream is completely
	 * initialized with a RPC_CLIENT or RPC_SERVER ioctl.  During
	 * the ioctl processing, the flag is cleared and any messages that
	 * arrived between the open and the ioctl are delivered to kRPC.
	 *
	 * Early data should never arrive on a client stream since
	 * servers only respond to our requests and we do not send any.
	 * until after the stream is initialized.  Early data is
	 * very common on a server stream where the client will start
	 * sending data as soon as the connection is made (and this
	 * is especially true with TCP where the protocol accepts the
	 * connection before nfsd or kRPC is notified about it).
	 */

	mir->mir_hold_inbound = 1;

	/*
	 * Start the record marker looking for a 4-byte header.  When
	 * this length is negative, it indicates that rpcmod is looking
	 * for bytes to consume for the record marker header.  When it
	 * is positive, it holds the number of bytes that have arrived
	 * for the current fragment and are being held in mir_header_mp.
	 */

	mir->mir_frag_len = -(int32_t)sizeof (uint32_t);

	mir->mir_zoneid = rpc_zoneid();
	mutex_init(&mir->mir_mutex, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&mir->mir_condvar, NULL, CV_DRIVER, NULL);
	cv_init(&mir->mir_timer_cv, NULL, CV_DRIVER, NULL);

	q->q_ptr = (char *)mir;
	WR(q)->q_ptr = (char *)mir;

	/*
	 * We noenable the read-side queue because we don't want it
	 * automatically enabled by putq.  We enable it explicitly
	 * in mir_wsrv when appropriate. (See additional comments on
	 * flow control at the beginning of mir_rsrv.)
	 */
	noenable(q);

	qprocson(q);
	return (0);
}

/*
 * Read-side put routine for both the client and server side.  Does the
 * record marking for incoming RPC messages, and when complete, dispatches
 * the message to either the client or server.
 */
static void
mir_rput(queue_t *q, mblk_t *mp)
{
	int	excess;
	int32_t	frag_len, frag_header;
	mblk_t	*cont_mp, *head_mp, *tail_mp, *mp1;
	mir_t	*mir = q->q_ptr;
	boolean_t stop_timer = B_FALSE;
	uint32_t	xid;
	uint32_t	dir;

	ASSERT(mir != NULL);

	/*
	 * If the stream has not been set up as a RPC_CLIENT or RPC_SERVER
	 * with the corresponding ioctl, then don't accept
	 * any inbound data.  This should never happen for streams
	 * created by nfsd or client-side kRPC because they are careful
	 * to set the mode of the stream before doing anything else.
	 */
	if (mir->mir_type == 0) {
		freemsg(mp);
		return;
	}

	ASSERT(MUTEX_NOT_HELD(&mir->mir_mutex));

	switch (mp->b_datap->db_type) {
	case M_DATA:
		break;
	case M_PROTO:
	case M_PCPROTO:
		if (MBLKL(mp) < sizeof (t_scalar_t)) {
			RPCLOG(1, "mir_rput: runt TPI message (%d bytes)\n",
			    (int)MBLKL(mp));
			freemsg(mp);
			return;
		}
		if (((union T_primitives *)mp->b_rptr)->type != T_DATA_IND) {
			mir_rput_proto(q, mp);
			return;
		}

		/* Throw away the T_DATA_IND block and continue with data. */
		mp1 = mp;
		mp = mp->b_cont;
		freeb(mp1);
		break;
	case M_SETOPTS:
		/*
		 * If a module on the stream is trying set the Stream head's
		 * high water mark, then set our hiwater to the requested
		 * value.  We are the "stream head" for all inbound
		 * data messages since messages are passed directly to kRPC.
		 */
		if (MBLKL(mp) >= sizeof (struct stroptions)) {
			struct stroptions	*stropts;

			stropts = (struct stroptions *)mp->b_rptr;
			if ((stropts->so_flags & SO_HIWAT) &&
			    !(stropts->so_flags & SO_BAND)) {
				(void) strqset(q, QHIWAT, 0, stropts->so_hiwat);
			}
		}
		putnext(q, mp);
		return;
	case M_FLUSH:
		RPCLOG(32, "mir_rput: ignoring M_FLUSH %x ", *mp->b_rptr);
		RPCLOG(32, "on q 0x%p\n", (void *)q);
		putnext(q, mp);
		return;
	default:
		putnext(q, mp);
		return;
	}

	mutex_enter(&mir->mir_mutex);

	/*
	 * If this connection is closing, don't accept any new messages.
	 */
	if (mir->mir_svc_no_more_msgs) {
		ASSERT(mir->mir_type == RPC_SERVER);
		mutex_exit(&mir->mir_mutex);
		freemsg(mp);
		return;
	}

	/* Get local copies for quicker access. */
	frag_len = mir->mir_frag_len;
	frag_header = mir->mir_frag_header;
	head_mp = mir->mir_head_mp;
	tail_mp = mir->mir_tail_mp;

	/* Loop, processing each message block in the mp chain separately. */
	do {
		cont_mp = mp->b_cont;
		mp->b_cont = NULL;

		/*
		 * Drop zero-length mblks to prevent unbounded kernel memory
		 * consumption.
		 */
		if (MBLKL(mp) == 0) {
			freeb(mp);
			continue;
		}

		/*
		 * If frag_len is negative, we're still in the process of
		 * building frag_header -- try to complete it with this mblk.
		 */
		while (frag_len < 0 && mp->b_rptr < mp->b_wptr) {
			frag_len++;
			frag_header <<= 8;
			frag_header += *mp->b_rptr++;
		}

		if (MBLKL(mp) == 0 && frag_len < 0) {
			/*
			 * We consumed this mblk while trying to complete the
			 * fragment header.  Free it and move on.
			 */
			freeb(mp);
			continue;
		}

		ASSERT(frag_len >= 0);

		/*
		 * Now frag_header has the number of bytes in this fragment
		 * and we're just waiting to collect them all.  Chain our
		 * latest mblk onto the list and see if we now have enough
		 * bytes to complete the fragment.
		 */
		if (head_mp == NULL) {
			ASSERT(tail_mp == NULL);
			head_mp = tail_mp = mp;
		} else {
			tail_mp->b_cont = mp;
			tail_mp = mp;
		}

		frag_len += MBLKL(mp);
		excess = frag_len - (frag_header & ~MIR_LASTFRAG);
		if (excess < 0) {
			/*
			 * We still haven't received enough data to complete
			 * the fragment, so continue on to the next mblk.
			 */
			continue;
		}

		/*
		 * We've got a complete fragment.  If there are excess bytes,
		 * then they're part of the next fragment's header (of either
		 * this RPC message or the next RPC message).  Split that part
		 * into its own mblk so that we can safely freeb() it when
		 * building frag_header above.
		 */
		if (excess > 0) {
			if ((mp1 = dupb(mp)) == NULL &&
			    (mp1 = copyb(mp)) == NULL) {
				freemsg(head_mp);
				freemsg(cont_mp);
				RPCLOG0(1, "mir_rput: dupb/copyb failed\n");
				mir->mir_frag_header = 0;
				mir->mir_frag_len = -(int32_t)sizeof (uint32_t);
				mir->mir_head_mp = NULL;
				mir->mir_tail_mp = NULL;
				mir_disconnect(q, mir);	/* drops mir_mutex */
				return;
			}

			/*
			 * Relink the message chain so that the next mblk is
			 * the next fragment header, followed by the rest of
			 * the message chain.
			 */
			mp1->b_cont = cont_mp;
			cont_mp = mp1;

			/*
			 * Data in the new mblk begins at the next fragment,
			 * and data in the old mblk ends at the next fragment.
			 */
			mp1->b_rptr = mp1->b_wptr - excess;
			mp->b_wptr -= excess;
		}

		/*
		 * Reset frag_len and frag_header for the next fragment.
		 */
		frag_len = -(int32_t)sizeof (uint32_t);
		if (!(frag_header & MIR_LASTFRAG)) {
			/*
			 * The current fragment is complete, but more
			 * fragments need to be processed before we can
			 * pass along the RPC message headed at head_mp.
			 */
			frag_header = 0;
			continue;
		}
		frag_header = 0;

		/*
		 * Get msg direction and handle to the appropriate ctxt
		 */
		if (!mir_dir_xid(head_mp, &dir, &xid)) {
			/* XXX - if we can't get the dir, we're hosed */
			mutex_exit(&mir->mir_mutex);
			freemsg(head_mp);
			return;
		}

		/*
		 * We've got a complete RPC message; pass it to the
		 * appropriate consumer.
		 */
		switch (mir->mir_type) {
		case RPC_CLIENT:
			switch (dir) {
			case REPLY:
				if (clnt_dispatch_notify(head_mp,
				    mir->mir_zoneid, xid)) {
					/*
					 * Mark this stream as active.
					 * This marker is used in mir_timer().
					 */
					mir->mir_clntreq = 1;
					mir->mir_use_timestamp =
					    ddi_get_lbolt();
				} else {
					freemsg(head_mp);
				}
				break;
			case CALL:
				/* TBD: client is now a callback server */
			default:
				RPCLOG(1, "mir_rput: TBD callback server %d\n",
				    dir);
				break;
			}
			break;
		case RPC_SERVER:
			switch (dir) {
			case REPLY:
				/*
				 * RPC Server initiated a Callback RPC and
				 * is receiving a reply from the RPC Client.
				 */
				if (clnt_dispatch_notify(head_mp,
				    mir->mir_zoneid, xid)) {
					mir->mir_clntreq = 1;
					mir->mir_use_timestamp =
					    ddi_get_lbolt();
				} else {
					freemsg(head_mp);
				}
				break;

			case CALL:
			default:
				/*
				 * Check for flow control before passing the
				 * message to kRPC.
				 */
				if (!mir->mir_hold_inbound) {
					if (!mir->mir_krpc_cell) {
						/*
						 * Count # of times this
						 * happens. Should be never,
						 * but experience shows
						 * otherwise.
						 * break;
						 */
						mir_krpc_cell_null++;
						freemsg(head_mp);
						break;
					}
					if (mir_check_len(q, head_mp))
						return;

					if (q->q_first == NULL &&
					    svc_queuereq(q, head_mp, TRUE)) {
						/*
						 * If the reference count is 0
						 * (not including this
						 * request), then the stream is
						 * transitioning from idle to
						 * non-idle.  In this case, we
						 * cancel the idle timer.
						 */
						if (mir->mir_ref_cnt++ == 0)
							stop_timer = B_TRUE;
					} else {
						(void) putq(q, head_mp);
						mir->mir_inrservice = B_TRUE;
					}
				} else {
					/*
					 * If the outbound side of the stream
					 * is flow controlled, then hold this
					 * message until client catches up.
					 * mir_hold_inbound is set in mir_wput
					 * and cleared in mir_wsrv.
					 */
					(void) putq(q, head_mp);
					mir->mir_inrservice = B_TRUE;
				}
			}
			break;
		default:
			RPCLOG(1, "mir_rput: unknown mir_type %d\n",
			    mir->mir_type);
			freemsg(head_mp);
			break;
		}

		/*
		 * Reset the chain since we're starting on a new RPC message.
		 */
		head_mp = tail_mp = NULL;
	} while ((mp = cont_mp) != NULL);

	/*
	 * Sanity check the message length; if it's too large mir_check_len()
	 * will shutdown the connection, drop mir_mutex, and return non-zero.
	 */
	if (head_mp != NULL && mir->mir_setup_complete &&
	    mir_check_len(q, head_mp))
		return;

	/* Save our local copies back in the mir structure. */
	mir->mir_frag_header = frag_header;
	mir->mir_frag_len = frag_len;
	mir->mir_head_mp = head_mp;
	mir->mir_tail_mp = tail_mp;

	/*
	 * The timer is stopped after the whole message chain is processed.
	 * The reason is that stopping the timer releases the mir_mutex
	 * lock temporarily.  This means that the request can be serviced
	 * while we are still processing the message chain.  This is not
	 * good.  So we stop the timer here instead.
	 *
	 * Note that if the timer fires before we stop it, it will not
	 * do any harm as MIR_SVC_QUIESCED() is false and mir_timer()
	 * will just return.
	 */
	if (stop_timer) {
		RPCLOG(16, "mir_rput: stopping idle timer on 0x%p because "
		    "ref cnt going to non zero\n", (void *)WR(q));
		mir_svc_idle_stop(WR(q), mir);
	}
	mutex_exit(&mir->mir_mutex);
}

static void
mir_rput_proto(queue_t *q, mblk_t *mp)
{
	mir_t	*mir = (mir_t *)q->q_ptr;
	uint32_t	type;
	uint32_t reason = 0;

	ASSERT(MUTEX_NOT_HELD(&mir->mir_mutex));

	type = ((union T_primitives *)mp->b_rptr)->type;
	switch (mir->mir_type) {
	case RPC_CLIENT:
		switch (type) {
		case T_DISCON_IND:
			reason = ((struct T_discon_ind *)
			    (mp->b_rptr))->DISCON_reason;
			/*FALLTHROUGH*/
		case T_ORDREL_IND:
			mutex_enter(&mir->mir_mutex);
			if (mir->mir_head_mp) {
				freemsg(mir->mir_head_mp);
				mir->mir_head_mp = (mblk_t *)0;
				mir->mir_tail_mp = (mblk_t *)0;
			}
			/*
			 * We are disconnecting, but not necessarily
			 * closing. By not closing, we will fail to
			 * pick up a possibly changed global timeout value,
			 * unless we store it now.
			 */
			mir->mir_idle_timeout = clnt_idle_timeout;
			mir_clnt_idle_stop(WR(q), mir);

			/*
			 * Even though we are unconnected, we still
			 * leave the idle timer going on the client. The
			 * reason for is that if we've disconnected due
			 * to a server-side disconnect, reset, or connection
			 * timeout, there is a possibility the client may
			 * retry the RPC request. This retry needs to done on
			 * the same bound address for the server to interpret
			 * it as such. However, we don't want
			 * to wait forever for that possibility. If the
			 * end-point stays unconnected for mir_idle_timeout
			 * units of time, then that is a signal to the
			 * connection manager to give up waiting for the
			 * application (eg. NFS) to send a retry.
			 */
			mir_clnt_idle_start(WR(q), mir);
			mutex_exit(&mir->mir_mutex);
			clnt_dispatch_notifyall(WR(q), type, reason);
			freemsg(mp);
			return;
		case T_ERROR_ACK:
		{
			struct T_error_ack	*terror;

			terror = (struct T_error_ack *)mp->b_rptr;
			RPCLOG(1, "mir_rput_proto T_ERROR_ACK for queue 0x%p",
			    (void *)q);
			RPCLOG(1, " ERROR_prim: %s,",
			    rpc_tpiprim2name(terror->ERROR_prim));
			RPCLOG(1, " TLI_error: %s,",
			    rpc_tpierr2name(terror->TLI_error));
			RPCLOG(1, " UNIX_error: %d\n", terror->UNIX_error);
			if (terror->ERROR_prim == T_DISCON_REQ)  {
				clnt_dispatch_notifyall(WR(q), type, reason);
				freemsg(mp);
				return;
			} else {
				if (clnt_dispatch_notifyconn(WR(q), mp))
					return;
			}
			break;
		}
		case T_OK_ACK:
		{
			struct T_ok_ack	*tok = (struct T_ok_ack *)mp->b_rptr;

			if (tok->CORRECT_prim == T_DISCON_REQ) {
				clnt_dispatch_notifyall(WR(q), type, reason);
				freemsg(mp);
				return;
			} else {
				if (clnt_dispatch_notifyconn(WR(q), mp))
					return;
			}
			break;
		}
		case T_CONN_CON:
		case T_INFO_ACK:
		case T_OPTMGMT_ACK:
			if (clnt_dispatch_notifyconn(WR(q), mp))
				return;
			break;
		case T_BIND_ACK:
			break;
		default:
			RPCLOG(1, "mir_rput: unexpected message %d "
			    "for kRPC client\n",
			    ((union T_primitives *)mp->b_rptr)->type);
			break;
		}
		break;

	case RPC_SERVER:
		switch (type) {
		case T_BIND_ACK:
		{
			struct T_bind_ack	*tbind;

			/*
			 * If this is a listening stream, then shut
			 * off the idle timer.
			 */
			tbind = (struct T_bind_ack *)mp->b_rptr;
			if (tbind->CONIND_number > 0) {
				mutex_enter(&mir->mir_mutex);
				mir_svc_idle_stop(WR(q), mir);

				/*
				 * mark this as a listen endpoint
				 * for special handling.
				 */

				mir->mir_listen_stream = 1;
				mutex_exit(&mir->mir_mutex);
			}
			break;
		}
		case T_DISCON_IND:
		case T_ORDREL_IND:
			RPCLOG(16, "mir_rput_proto: got %s indication\n",
			    type == T_DISCON_IND ? "disconnect"
			    : "orderly release");

			/*
			 * For listen endpoint just pass
			 * on the message.
			 */

			if (mir->mir_listen_stream)
				break;

			mutex_enter(&mir->mir_mutex);

			/*
			 * If client wants to break off connection, record
			 * that fact.
			 */
			mir_svc_start_close(WR(q), mir);

			/*
			 * If we are idle, then send the orderly release
			 * or disconnect indication to nfsd.
			 */
			if (MIR_SVC_QUIESCED(mir)) {
				mutex_exit(&mir->mir_mutex);
				break;
			}

			RPCLOG(16, "mir_rput_proto: not idle, so "
			    "disconnect/ord rel indication not passed "
			    "upstream on 0x%p\n", (void *)q);

			/*
			 * Hold the indication until we get idle
			 * If there already is an indication stored,
			 * replace it if the new one is a disconnect. The
			 * reasoning is that disconnection takes less time
			 * to process, and once a client decides to
			 * disconnect, we should do that.
			 */
			if (mir->mir_svc_pend_mp) {
				if (type == T_DISCON_IND) {
					RPCLOG(16, "mir_rput_proto: replacing"
					    " held disconnect/ord rel"
					    " indication with disconnect on"
					    " 0x%p\n", (void *)q);

					freemsg(mir->mir_svc_pend_mp);
					mir->mir_svc_pend_mp = mp;
				} else {
					RPCLOG(16, "mir_rput_proto: already "
					    "held a disconnect/ord rel "
					    "indication. freeing ord rel "
					    "ind on 0x%p\n", (void *)q);
					freemsg(mp);
				}
			} else
				mir->mir_svc_pend_mp = mp;

			mutex_exit(&mir->mir_mutex);
			return;

		default:
			/* nfsd handles server-side non-data messages. */
			break;
		}
		break;

	default:
		break;
	}

	putnext(q, mp);
}

/*
 * The server-side read queues are used to hold inbound messages while
 * outbound flow control is exerted.  When outbound flow control is
 * relieved, mir_wsrv qenables the read-side queue.  Read-side queues
 * are not enabled by STREAMS and are explicitly noenable'ed in mir_open.
 */
static void
mir_rsrv(queue_t *q)
{
	mir_t	*mir;
	mblk_t	*mp;
	boolean_t stop_timer = B_FALSE;

	mir = (mir_t *)q->q_ptr;
	mutex_enter(&mir->mir_mutex);

	mp = NULL;
	switch (mir->mir_type) {
	case RPC_SERVER:
		if (mir->mir_ref_cnt == 0)
			mir->mir_hold_inbound = 0;
		if (mir->mir_hold_inbound)
			break;

		while (mp = getq(q)) {
			if (mir->mir_krpc_cell &&
			    (mir->mir_svc_no_more_msgs == 0)) {

				if (mir_check_len(q, mp))
					return;

				if (svc_queuereq(q, mp, TRUE)) {
					/*
					 * If we were idle, turn off idle timer
					 * since we aren't idle any more.
					 */
					if (mir->mir_ref_cnt++ == 0)
						stop_timer = B_TRUE;
				} else {
					(void) putbq(q, mp);
					break;
				}
			} else {
				/*
				 * Count # of times this happens. Should be
				 * never, but experience shows otherwise.
				 */
				if (mir->mir_krpc_cell == NULL)
					mir_krpc_cell_null++;
				freemsg(mp);
			}
		}
		break;
	case RPC_CLIENT:
		break;
	default:
		RPCLOG(1, "mir_rsrv: unexpected mir_type %d\n", mir->mir_type);

		if (q->q_first == NULL)
			MIR_CLEAR_INRSRV(mir);

		mutex_exit(&mir->mir_mutex);

		return;
	}

	/*
	 * The timer is stopped after all the messages are processed.
	 * The reason is that stopping the timer releases the mir_mutex
	 * lock temporarily.  This means that the request can be serviced
	 * while we are still processing the message queue.  This is not
	 * good.  So we stop the timer here instead.
	 */
	if (stop_timer)  {
		RPCLOG(16, "mir_rsrv stopping idle timer on 0x%p because ref "
		    "cnt going to non zero\n", (void *)WR(q));
		mir_svc_idle_stop(WR(q), mir);
	}

	if (q->q_first == NULL) {
		mblk_t	*cmp = NULL;

		MIR_CLEAR_INRSRV(mir);

		if (mir->mir_type == RPC_SERVER && MIR_SVC_QUIESCED(mir)) {
			cmp = mir->mir_svc_pend_mp;
			mir->mir_svc_pend_mp = NULL;
		}

		mutex_exit(&mir->mir_mutex);

		if (cmp != NULL) {
			RPCLOG(16, "mir_rsrv: line %d: sending a held "
			    "disconnect/ord rel indication upstream\n",
			    __LINE__);
			putnext(q, cmp);
		}

		return;
	}
	mutex_exit(&mir->mir_mutex);
}

static int mir_svc_policy_fails;

/*
 * Called to send an event code to nfsd/lockd so that it initiates
 * connection close.
 */
static int
mir_svc_policy_notify(queue_t *q, int event)
{
	mblk_t	*mp;
#ifdef DEBUG
	mir_t *mir = (mir_t *)q->q_ptr;
	ASSERT(MUTEX_NOT_HELD(&mir->mir_mutex));
#endif
	ASSERT(q->q_flag & QREADR);

	/*
	 * Create an M_DATA message with the event code and pass it to the
	 * Stream head (nfsd or whoever created the stream will consume it).
	 */
	mp = allocb(sizeof (int), BPRI_HI);

	if (!mp) {

		mir_svc_policy_fails++;
		RPCLOG(16, "mir_svc_policy_notify: could not allocate event "
		    "%d\n", event);
		return (ENOMEM);
	}

	U32_TO_BE32(event, mp->b_rptr);
	mp->b_wptr = mp->b_rptr + sizeof (int);
	putnext(q, mp);
	return (0);
}

/*
 * Server side: start the close phase. We want to get this rpcmod slot in an
 * idle state before mir_close() is called.
 */
static void
mir_svc_start_close(queue_t *wq, mir_t *mir)
{
	ASSERT(MUTEX_HELD(&mir->mir_mutex));
	ASSERT((wq->q_flag & QREADR) == 0);
	ASSERT(mir->mir_type == RPC_SERVER);

	/*
	 * Do not accept any more messages.
	 */
	mir->mir_svc_no_more_msgs = 1;

	/*
	 * Next two statements will make the read service procedure
	 * free everything stuck in the streams read queue.
	 * It's not necessary because enabling the write queue will
	 * have the same effect, but why not speed the process along?
	 */
	mir->mir_hold_inbound = 0;
	qenable(RD(wq));

	/*
	 * Meanwhile force the write service procedure to send the
	 * responses downstream, regardless of flow control.
	 */
	qenable(wq);
}

void
mir_svc_hold(queue_t *wq)
{
	mir_t *mir = (mir_t *)wq->q_ptr;

	mutex_enter(&mir->mir_mutex);
	mir->mir_ref_cnt++;
	mutex_exit(&mir->mir_mutex);
}

/*
 * This routine is called directly by kRPC after a request is completed,
 * whether a reply was sent or the request was dropped.
 */
void
mir_svc_release(queue_t *wq, mblk_t *mp, bool_t enable)
{
	mir_t   *mir = (mir_t *)wq->q_ptr;
	mblk_t	*cmp = NULL;

	ASSERT((wq->q_flag & QREADR) == 0);
	if (mp)
		freemsg(mp);

	if (enable)
		qenable(RD(wq));

	mutex_enter(&mir->mir_mutex);

	/*
	 * Start idle processing if this is the last reference.
	 */
	if ((mir->mir_ref_cnt == 1) && (mir->mir_inrservice == 0)) {
		cmp = mir->mir_svc_pend_mp;
		mir->mir_svc_pend_mp = NULL;
	}

	if (cmp) {
		RPCLOG(16, "mir_svc_release: sending a held "
		    "disconnect/ord rel indication upstream on queue 0x%p\n",
		    (void *)RD(wq));

		mutex_exit(&mir->mir_mutex);

		putnext(RD(wq), cmp);

		mutex_enter(&mir->mir_mutex);
	}

	/*
	 * Start idle processing if this is the last reference.
	 */
	if (mir->mir_ref_cnt == 1 && mir->mir_inrservice == 0) {

		RPCLOG(16, "mir_svc_release starting idle timer on 0x%p "
		    "because ref cnt is zero\n", (void *) wq);

		mir_svc_idle_start(wq, mir);
	}

	mir->mir_ref_cnt--;
	ASSERT(mir->mir_ref_cnt >= 0);

	/*
	 * Wake up the thread waiting to close.
	 */

	if ((mir->mir_ref_cnt == 0) && mir->mir_closing)
		cv_signal(&mir->mir_condvar);

	mutex_exit(&mir->mir_mutex);
}

/*
 * This routine is called by server-side kRPC when it is ready to
 * handle inbound messages on the stream.
 */
static void
mir_svc_start(queue_t *wq)
{
	mir_t   *mir = (mir_t *)wq->q_ptr;

	/*
	 * no longer need to take the mir_mutex because the
	 * mir_setup_complete field has been moved out of
	 * the binary field protected by the mir_mutex.
	 */

	mir->mir_setup_complete = 1;
	qenable(RD(wq));
}

/*
 * client side wrapper for stopping timer with normal idle timeout.
 */
static void
mir_clnt_idle_stop(queue_t *wq, mir_t *mir)
{
	ASSERT(MUTEX_HELD(&mir->mir_mutex));
	ASSERT((wq->q_flag & QREADR) == 0);
	ASSERT(mir->mir_type == RPC_CLIENT);

	mir_timer_stop(mir);
}

/*
 * client side wrapper for stopping timer with normal idle timeout.
 */
static void
mir_clnt_idle_start(queue_t *wq, mir_t *mir)
{
	ASSERT(MUTEX_HELD(&mir->mir_mutex));
	ASSERT((wq->q_flag & QREADR) == 0);
	ASSERT(mir->mir_type == RPC_CLIENT);

	mir_timer_start(wq, mir, mir->mir_idle_timeout);
}

/*
 * client side only. Forces rpcmod to stop sending T_ORDREL_REQs on
 * end-points that aren't connected.
 */
static void
mir_clnt_idle_do_stop(queue_t *wq)
{
	mir_t   *mir = (mir_t *)wq->q_ptr;

	RPCLOG(1, "mir_clnt_idle_do_stop: wq 0x%p\n", (void *)wq);
	ASSERT(MUTEX_NOT_HELD(&mir->mir_mutex));
	mutex_enter(&mir->mir_mutex);
	mir_clnt_idle_stop(wq, mir);
	mutex_exit(&mir->mir_mutex);
}

/*
 * Timer handler.  It handles idle timeout and memory shortage problem.
 */
static void
mir_timer(void *arg)
{
	queue_t *wq = (queue_t *)arg;
	mir_t *mir = (mir_t *)wq->q_ptr;
	boolean_t notify;
	clock_t now;

	mutex_enter(&mir->mir_mutex);

	/*
	 * mir_timer_call is set only when either mir_timer_[start|stop]
	 * is progressing.  And mir_timer() can only be run while they
	 * are progressing if the timer is being stopped.  So just
	 * return.
	 */
	if (mir->mir_timer_call) {
		mutex_exit(&mir->mir_mutex);
		return;
	}
	mir->mir_timer_id = 0;

	switch (mir->mir_type) {
	case RPC_CLIENT:

		/*
		 * For clients, the timer fires at clnt_idle_timeout
		 * intervals.  If the activity marker (mir_clntreq) is
		 * zero, then the stream has been idle since the last
		 * timer event and we notify kRPC.  If mir_clntreq is
		 * non-zero, then the stream is active and we just
		 * restart the timer for another interval.  mir_clntreq
		 * is set to 1 in mir_wput for every request passed
		 * downstream.
		 *
		 * If this was a memory shortage timer reset the idle
		 * timeout regardless; the mir_clntreq will not be a
		 * valid indicator.
		 *
		 * The timer is initially started in mir_wput during
		 * RPC_CLIENT ioctl processing.
		 *
		 * The timer interval can be changed for individual
		 * streams with the ND variable "mir_idle_timeout".
		 */
		now = ddi_get_lbolt();
		if (mir->mir_clntreq > 0 && mir->mir_use_timestamp +
		    MSEC_TO_TICK(mir->mir_idle_timeout) - now >= 0) {
			clock_t tout;

			tout = mir->mir_idle_timeout -
			    TICK_TO_MSEC(now - mir->mir_use_timestamp);
			if (tout < 0)
				tout = 1000;
#if 0
			printf("mir_timer[%d < %d + %d]: reset client timer "
			    "to %d (ms)\n", TICK_TO_MSEC(now),
			    TICK_TO_MSEC(mir->mir_use_timestamp),
			    mir->mir_idle_timeout, tout);
#endif
			mir->mir_clntreq = 0;
			mir_timer_start(wq, mir, tout);
			mutex_exit(&mir->mir_mutex);
			return;
		}
#if 0
printf("mir_timer[%d]: doing client timeout\n", now / hz);
#endif
		/*
		 * We are disconnecting, but not necessarily
		 * closing. By not closing, we will fail to
		 * pick up a possibly changed global timeout value,
		 * unless we store it now.
		 */
		mir->mir_idle_timeout = clnt_idle_timeout;
		mir_clnt_idle_start(wq, mir);

		mutex_exit(&mir->mir_mutex);
		/*
		 * We pass T_ORDREL_REQ as an integer value
		 * to kRPC as the indication that the stream
		 * is idle.  This is not a T_ORDREL_REQ message,
		 * it is just a convenient value since we call
		 * the same kRPC routine for T_ORDREL_INDs and
		 * T_DISCON_INDs.
		 */
		clnt_dispatch_notifyall(wq, T_ORDREL_REQ, 0);
		return;

	case RPC_SERVER:

		/*
		 * For servers, the timer is only running when the stream
		 * is really idle or memory is short.  The timer is started
		 * by mir_wput when mir_type is set to RPC_SERVER and
		 * by mir_svc_idle_start whenever the stream goes idle
		 * (mir_ref_cnt == 0).  The timer is cancelled in
		 * mir_rput whenever a new inbound request is passed to kRPC
		 * and the stream was previously idle.
		 *
		 * The timer interval can be changed for individual
		 * streams with the ND variable "mir_idle_timeout".
		 *
		 * If the stream is not idle do nothing.
		 */
		if (!MIR_SVC_QUIESCED(mir)) {
			mutex_exit(&mir->mir_mutex);
			return;
		}

		notify = !mir->mir_inrservice;
		mutex_exit(&mir->mir_mutex);

		/*
		 * If there is no packet queued up in read queue, the stream
		 * is really idle so notify nfsd to close it.
		 */
		if (notify) {
			RPCLOG(16, "mir_timer: telling stream head listener "
			    "to close stream (0x%p)\n", (void *) RD(wq));
			(void) mir_svc_policy_notify(RD(wq), 1);
		}
		return;
	default:
		RPCLOG(1, "mir_timer: unexpected mir_type %d\n",
		    mir->mir_type);
		mutex_exit(&mir->mir_mutex);
		return;
	}
}

/*
 * Called by the RPC package to send either a call or a return, or a
 * transport connection request.  Adds the record marking header.
 */
static void
mir_wput(queue_t *q, mblk_t *mp)
{
	uint_t	frag_header;
	mir_t	*mir = (mir_t *)q->q_ptr;
	uchar_t	*rptr = mp->b_rptr;

	if (!mir) {
		freemsg(mp);
		return;
	}

	if (mp->b_datap->db_type != M_DATA) {
		mir_wput_other(q, mp);
		return;
	}

	if (mir->mir_ordrel_pending == 1) {
		freemsg(mp);
		RPCLOG(16, "mir_wput wq 0x%p: got data after T_ORDREL_REQ\n",
		    (void *)q);
		return;
	}

	frag_header = (uint_t)DLEN(mp);
	frag_header |= MIR_LASTFRAG;

	/* Stick in the 4 byte record marking header. */
	if ((rptr - mp->b_datap->db_base) < sizeof (uint32_t) ||
	    !IS_P2ALIGNED(mp->b_rptr, sizeof (uint32_t))) {
		/*
		 * Since we know that M_DATA messages are created exclusively
		 * by kRPC, we expect that kRPC will leave room for our header
		 * and 4 byte align which is normal for XDR.
		 * If kRPC (or someone else) does not cooperate, then we
		 * just throw away the message.
		 */
		RPCLOG(1, "mir_wput: kRPC did not leave space for record "
		    "fragment header (%d bytes left)\n",
		    (int)(rptr - mp->b_datap->db_base));
		freemsg(mp);
		return;
	}
	rptr -= sizeof (uint32_t);
	*(uint32_t *)rptr = htonl(frag_header);
	mp->b_rptr = rptr;

	mutex_enter(&mir->mir_mutex);
	if (mir->mir_type == RPC_CLIENT) {
		/*
		 * For the client, set mir_clntreq to indicate that the
		 * connection is active.
		 */
		mir->mir_clntreq = 1;
		mir->mir_use_timestamp = ddi_get_lbolt();
	}

	/*
	 * If we haven't already queued some data and the downstream module
	 * can accept more data, send it on, otherwise we queue the message
	 * and take other actions depending on mir_type.
	 */
	if (!mir->mir_inwservice && MIR_WCANPUTNEXT(mir, q)) {
		mutex_exit(&mir->mir_mutex);

		/*
		 * Now we pass the RPC message downstream.
		 */
		putnext(q, mp);
		return;
	}

	switch (mir->mir_type) {
	case RPC_CLIENT:
		/*
		 * Check for a previous duplicate request on the
		 * queue.  If there is one, then we throw away
		 * the current message and let the previous one
		 * go through.  If we can't find a duplicate, then
		 * send this one.  This tap dance is an effort
		 * to reduce traffic and processing requirements
		 * under load conditions.
		 */
		if (mir_clnt_dup_request(q, mp)) {
			mutex_exit(&mir->mir_mutex);
			freemsg(mp);
			return;
		}
		break;
	case RPC_SERVER:
		/*
		 * Set mir_hold_inbound so that new inbound RPC
		 * messages will be held until the client catches
		 * up on the earlier replies.  This flag is cleared
		 * in mir_wsrv after flow control is relieved;
		 * the read-side queue is also enabled at that time.
		 */
		mir->mir_hold_inbound = 1;
		break;
	default:
		RPCLOG(1, "mir_wput: unexpected mir_type %d\n", mir->mir_type);
		break;
	}
	mir->mir_inwservice = 1;
	(void) putq(q, mp);
	mutex_exit(&mir->mir_mutex);
}

static void
mir_wput_other(queue_t *q, mblk_t *mp)
{
	mir_t	*mir = (mir_t *)q->q_ptr;
	struct iocblk	*iocp;
	uchar_t	*rptr = mp->b_rptr;
	bool_t	flush_in_svc = FALSE;

	ASSERT(MUTEX_NOT_HELD(&mir->mir_mutex));
	switch (mp->b_datap->db_type) {
	case M_IOCTL:
		iocp = (struct iocblk *)rptr;
		switch (iocp->ioc_cmd) {
		case RPC_CLIENT:
			mutex_enter(&mir->mir_mutex);
			if (mir->mir_type != 0 &&
			    mir->mir_type != iocp->ioc_cmd) {
ioc_eperm:
				mutex_exit(&mir->mir_mutex);
				iocp->ioc_error = EPERM;
				iocp->ioc_count = 0;
				mp->b_datap->db_type = M_IOCACK;
				qreply(q, mp);
				return;
			}

			mir->mir_type = iocp->ioc_cmd;

			/*
			 * Clear mir_hold_inbound which was set to 1 by
			 * mir_open.  This flag is not used on client
			 * streams.
			 */
			mir->mir_hold_inbound = 0;
			mir->mir_max_msg_sizep = &clnt_max_msg_size;

			/*
			 * Start the idle timer.  See mir_timer() for more
			 * information on how client timers work.
			 */
			mir->mir_idle_timeout = clnt_idle_timeout;
			mir_clnt_idle_start(q, mir);
			mutex_exit(&mir->mir_mutex);

			mp->b_datap->db_type = M_IOCACK;
			qreply(q, mp);
			return;
		case RPC_SERVER:
			mutex_enter(&mir->mir_mutex);
			if (mir->mir_type != 0 &&
			    mir->mir_type != iocp->ioc_cmd)
				goto ioc_eperm;

			/*
			 * We don't clear mir_hold_inbound here because
			 * mir_hold_inbound is used in the flow control
			 * model. If we cleared it here, then we'd commit
			 * a small violation to the model where the transport
			 * might immediately block downstream flow.
			 */

			mir->mir_type = iocp->ioc_cmd;
			mir->mir_max_msg_sizep = &svc_max_msg_size;

			/*
			 * Start the idle timer.  See mir_timer() for more
			 * information on how server timers work.
			 *
			 * Note that it is important to start the idle timer
			 * here so that connections time out even if we
			 * never receive any data on them.
			 */
			mir->mir_idle_timeout = svc_idle_timeout;
			RPCLOG(16, "mir_wput_other starting idle timer on 0x%p "
			    "because we got RPC_SERVER ioctl\n", (void *)q);
			mir_svc_idle_start(q, mir);
			mutex_exit(&mir->mir_mutex);

			mp->b_datap->db_type = M_IOCACK;
			qreply(q, mp);
			return;
		default:
			break;
		}
		break;

	case M_PROTO:
		if (mir->mir_type == RPC_CLIENT) {
			/*
			 * We are likely being called from the context of a
			 * service procedure. So we need to enqueue. However
			 * enqueing may put our message behind data messages.
			 * So flush the data first.
			 */
			flush_in_svc = TRUE;
		}
		if ((mp->b_wptr - rptr) < sizeof (uint32_t) ||
		    !IS_P2ALIGNED(rptr, sizeof (uint32_t)))
			break;

		switch (((union T_primitives *)rptr)->type) {
		case T_DATA_REQ:
			/* Don't pass T_DATA_REQ messages downstream. */
			freemsg(mp);
			return;
		case T_ORDREL_REQ:
			RPCLOG(8, "mir_wput_other wq 0x%p: got T_ORDREL_REQ\n",
			    (void *)q);
			mutex_enter(&mir->mir_mutex);
			if (mir->mir_type != RPC_SERVER) {
				/*
				 * We are likely being called from
				 * clnt_dispatch_notifyall(). Sending
				 * a T_ORDREL_REQ will result in
				 * a some kind of _IND message being sent,
				 * will be another call to
				 * clnt_dispatch_notifyall(). To keep the stack
				 * lean, queue this message.
				 */
				mir->mir_inwservice = 1;
				(void) putq(q, mp);
				mutex_exit(&mir->mir_mutex);
				return;
			}

			/*
			 * Mark the structure such that we don't accept any
			 * more requests from client. We could defer this
			 * until we actually send the orderly release
			 * request downstream, but all that does is delay
			 * the closing of this stream.
			 */
			RPCLOG(16, "mir_wput_other wq 0x%p: got T_ORDREL_REQ "
			    " so calling mir_svc_start_close\n", (void *)q);

			mir_svc_start_close(q, mir);

			/*
			 * If we have sent down a T_ORDREL_REQ, don't send
			 * any more.
			 */
			if (mir->mir_ordrel_pending) {
				freemsg(mp);
				mutex_exit(&mir->mir_mutex);
				return;
			}

			/*
			 * If the stream is not idle, then we hold the
			 * orderly release until it becomes idle.  This
			 * ensures that kRPC will be able to reply to
			 * all requests that we have passed to it.
			 *
			 * We also queue the request if there is data already
			 * queued, because we cannot allow the T_ORDREL_REQ
			 * to go before data. When we had a separate reply
			 * count, this was not a problem, because the
			 * reply count was reconciled when mir_wsrv()
			 * completed.
			 */
			if (!MIR_SVC_QUIESCED(mir) ||
			    mir->mir_inwservice == 1) {
				mir->mir_inwservice = 1;
				(void) putq(q, mp);

				RPCLOG(16, "mir_wput_other: queuing "
				    "T_ORDREL_REQ on 0x%p\n", (void *)q);

				mutex_exit(&mir->mir_mutex);
				return;
			}

			/*
			 * Mark the structure so that we know we sent
			 * an orderly release request, and reset the idle timer.
			 */
			mir->mir_ordrel_pending = 1;

			RPCLOG(16, "mir_wput_other: calling mir_svc_idle_start"
			    " on 0x%p because we got T_ORDREL_REQ\n",
			    (void *)q);

			mir_svc_idle_start(q, mir);
			mutex_exit(&mir->mir_mutex);

			/*
			 * When we break, we will putnext the T_ORDREL_REQ.
			 */
			break;

		case T_CONN_REQ:
			mutex_enter(&mir->mir_mutex);
			if (mir->mir_head_mp != NULL) {
				freemsg(mir->mir_head_mp);
				mir->mir_head_mp = NULL;
				mir->mir_tail_mp = NULL;
			}
			mir->mir_frag_len = -(int32_t)sizeof (uint32_t);
			/*
			 * Restart timer in case mir_clnt_idle_do_stop() was
			 * called.
			 */
			mir->mir_idle_timeout = clnt_idle_timeout;
			mir_clnt_idle_stop(q, mir);
			mir_clnt_idle_start(q, mir);
			mutex_exit(&mir->mir_mutex);
			break;

		default:
			/*
			 * T_DISCON_REQ is one of the interesting default
			 * cases here. Ideally, an M_FLUSH is done before
			 * T_DISCON_REQ is done. However, that is somewhat
			 * cumbersome for clnt_cots.c to do. So we queue
			 * T_DISCON_REQ, and let the service procedure
			 * flush all M_DATA.
			 */
			break;
		}
		/* FALLTHROUGH */
	default:
		if (mp->b_datap->db_type >= QPCTL) {
			if (mp->b_datap->db_type == M_FLUSH) {
				if (mir->mir_type == RPC_CLIENT &&
				    *mp->b_rptr & FLUSHW) {
					RPCLOG(32, "mir_wput_other: flushing "
					    "wq 0x%p\n", (void *)q);
					if (*mp->b_rptr & FLUSHBAND) {
						flushband(q, *(mp->b_rptr + 1),
						    FLUSHDATA);
					} else {
						flushq(q, FLUSHDATA);
					}
				} else {
					RPCLOG(32, "mir_wput_other: ignoring "
					    "M_FLUSH on wq 0x%p\n", (void *)q);
				}
			}
			break;
		}

		mutex_enter(&mir->mir_mutex);
		if (mir->mir_inwservice == 0 && MIR_WCANPUTNEXT(mir, q)) {
			mutex_exit(&mir->mir_mutex);
			break;
		}
		mir->mir_inwservice = 1;
		mir->mir_inwflushdata = flush_in_svc;
		(void) putq(q, mp);
		mutex_exit(&mir->mir_mutex);
		qenable(q);

		return;
	}
	putnext(q, mp);
}

static void
mir_wsrv(queue_t *q)
{
	mblk_t	*mp;
	mir_t	*mir;
	bool_t flushdata;

	mir = (mir_t *)q->q_ptr;
	mutex_enter(&mir->mir_mutex);

	flushdata = mir->mir_inwflushdata;
	mir->mir_inwflushdata = 0;

	while (mp = getq(q)) {
		if (mp->b_datap->db_type == M_DATA) {
			/*
			 * Do not send any more data if we have sent
			 * a T_ORDREL_REQ.
			 */
			if (flushdata || mir->mir_ordrel_pending == 1) {
				freemsg(mp);
				continue;
			}

			/*
			 * Make sure that the stream can really handle more
			 * data.
			 */
			if (!MIR_WCANPUTNEXT(mir, q)) {
				(void) putbq(q, mp);
				mutex_exit(&mir->mir_mutex);
				return;
			}

			/*
			 * Now we pass the RPC message downstream.
			 */
			mutex_exit(&mir->mir_mutex);
			putnext(q, mp);
			mutex_enter(&mir->mir_mutex);
			continue;
		}

		/*
		 * This is not an RPC message, pass it downstream
		 * (ignoring flow control) if the server side is not sending a
		 * T_ORDREL_REQ downstream.
		 */
		if (mir->mir_type != RPC_SERVER ||
		    ((union T_primitives *)mp->b_rptr)->type !=
		    T_ORDREL_REQ) {
			mutex_exit(&mir->mir_mutex);
			putnext(q, mp);
			mutex_enter(&mir->mir_mutex);
			continue;
		}

		if (mir->mir_ordrel_pending == 1) {
			/*
			 * Don't send two T_ORDRELs
			 */
			freemsg(mp);
			continue;
		}

		/*
		 * Mark the structure so that we know we sent an orderly
		 * release request.  We will check to see slot is idle at the
		 * end of this routine, and if so, reset the idle timer to
		 * handle orderly release timeouts.
		 */
		mir->mir_ordrel_pending = 1;
		RPCLOG(16, "mir_wsrv: sending ordrel req on q 0x%p\n",
		    (void *)q);
		/*
		 * Send the orderly release downstream. If there are other
		 * pending replies we won't be able to send them.  However,
		 * the only reason we should send the orderly release is if
		 * we were idle, or if an unusual event occurred.
		 */
		mutex_exit(&mir->mir_mutex);
		putnext(q, mp);
		mutex_enter(&mir->mir_mutex);
	}

	if (q->q_first == NULL)
		/*
		 * If we call mir_svc_idle_start() below, then
		 * clearing mir_inwservice here will also result in
		 * any thread waiting in mir_close() to be signaled.
		 */
		mir->mir_inwservice = 0;

	if (mir->mir_type != RPC_SERVER) {
		mutex_exit(&mir->mir_mutex);
		return;
	}

	/*
	 * If idle we call mir_svc_idle_start to start the timer (or wakeup
	 * a close). Also make sure not to start the idle timer on the
	 * listener stream. This can cause nfsd to send an orderly release
	 * command on the listener stream.
	 */
	if (MIR_SVC_QUIESCED(mir) && !(mir->mir_listen_stream)) {
		RPCLOG(16, "mir_wsrv: calling mir_svc_idle_start on 0x%p "
		    "because mir slot is idle\n", (void *)q);
		mir_svc_idle_start(q, mir);
	}

	/*
	 * If outbound flow control has been relieved, then allow new
	 * inbound requests to be processed.
	 */
	if (mir->mir_hold_inbound) {
		mir->mir_hold_inbound = 0;
		qenable(RD(q));
	}
	mutex_exit(&mir->mir_mutex);
}

static void
mir_disconnect(queue_t *q, mir_t *mir)
{
	ASSERT(MUTEX_HELD(&mir->mir_mutex));

	switch (mir->mir_type) {
	case RPC_CLIENT:
		/*
		 * We are disconnecting, but not necessarily
		 * closing. By not closing, we will fail to
		 * pick up a possibly changed global timeout value,
		 * unless we store it now.
		 */
		mir->mir_idle_timeout = clnt_idle_timeout;
		mir_clnt_idle_start(WR(q), mir);
		mutex_exit(&mir->mir_mutex);

		/*
		 * T_DISCON_REQ is passed to kRPC as an integer value
		 * (this is not a TPI message).  It is used as a
		 * convenient value to indicate a sanity check
		 * failure -- the same kRPC routine is also called
		 * for T_DISCON_INDs and T_ORDREL_INDs.
		 */
		clnt_dispatch_notifyall(WR(q), T_DISCON_REQ, 0);
		break;

	case RPC_SERVER:
		mir->mir_svc_no_more_msgs = 1;
		mir_svc_idle_stop(WR(q), mir);
		mutex_exit(&mir->mir_mutex);
		RPCLOG(16, "mir_disconnect: telling "
		    "stream head listener to disconnect stream "
		    "(0x%p)\n", (void *) q);
		(void) mir_svc_policy_notify(q, 2);
		break;

	default:
		mutex_exit(&mir->mir_mutex);
		break;
	}
}

/*
 * Sanity check the message length, and if it's too large, shutdown the
 * connection.  Returns 1 if the connection is shutdown; 0 otherwise.
 */
static int
mir_check_len(queue_t *q, mblk_t *head_mp)
{
	mir_t *mir = q->q_ptr;
	uint_t maxsize = 0;
	size_t msg_len = msgdsize(head_mp);

	if (mir->mir_max_msg_sizep != NULL)
		maxsize = *mir->mir_max_msg_sizep;

	if (maxsize == 0 || msg_len <= maxsize)
		return (0);

	freemsg(head_mp);
	mir->mir_head_mp = NULL;
	mir->mir_tail_mp = NULL;
	mir->mir_frag_header = 0;
	mir->mir_frag_len = -(int32_t)sizeof (uint32_t);
	if (mir->mir_type != RPC_SERVER || mir->mir_setup_complete) {
		cmn_err(CE_NOTE,
		    "kRPC: record fragment from %s of size(%lu) exceeds "
		    "maximum (%u). Disconnecting",
		    (mir->mir_type == RPC_CLIENT) ? "server" :
		    (mir->mir_type == RPC_SERVER) ? "client" :
		    "test tool", msg_len, maxsize);
	}

	mir_disconnect(q, mir);
	return (1);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 1996,1997-1998 by Sun Microsystems, Inc.
 * All rights reserved.
 */

#ifndef	_RPCSEC_DEFS_H
#define	_RPCSEC_DEFS_H

/*
 * Copyright 1993 OpenVision Technologies, Inc., All Rights Reserved.
 *
 * $Id: auth_gssapi.h,v 1.11 1994/10/27 12:39:14 jik Exp $
 */

#ifndef _KERNEL
#include <libintl.h>
#include <locale.h>
#endif
#include <gssapi/gssapi.h>
#include <rpc/types.h>

#ifdef	__cplusplus
extern "C" {
#endif

#ifdef _KERNEL

#if defined(DEBUG) && !defined(RPCGSS_DEBUG)
#define	RPCGSS_DEBUG
#endif

#ifdef RPCGSS_DEBUG
extern uint_t rpcgss_log;

#define	RPCGSS_LOG1(A, B, C, D) \
	((void)((rpcgss_log) && (rpcgss_log & (A)) && (printf((B), \
	    (C), (D)), TRUE)))
#define	RPCGSS_LOG(A, B, C) \
	((void)((rpcgss_log) && (rpcgss_log & (A)) && (printf((B), (C)), TRUE)))
#define	RPCGSS_LOG0(A, B)   \
	((void)((rpcgss_log) && (rpcgss_log & (A)) && (printf(B), TRUE)))
#else
#define	RPCGSS_LOG1(A, B, C, D)
#define	RPCGSS_LOG(A, B, C)
#define	RPCGSS_LOG0(A, B)
#endif

#else /* _KERNEL */

extern bool_t locale_set;
#if !defined(TEXT_DOMAIN)
#define	TEXT_DOMAIN "SUNW_OST_OSCMD"
#endif

#endif /* _KERNEL */


typedef struct _rpc_gss_creds {
	uint_t version;
	uint_t gss_proc;
	uint_t seq_num;
	rpc_gss_service_t service;
	gss_buffer_desc ctx_handle;
} rpc_gss_creds;

typedef gss_buffer_desc rpc_gss_init_arg;

typedef struct _rpc_gss_init_res {
	gss_buffer_desc ctx_handle;
	OM_uint32 gss_major, gss_minor;
	OM_uint32 seq_window;
	gss_buffer_desc token;
} rpc_gss_init_res;


/*
 * Convenience macros.
 */

#define	GSS_COPY_BUFFER(dest, src) { \
	(dest).length = (src).length; \
	(dest).value = (src).value; }

#define	GSS_DUP_BUFFER(dest, src) { \
	(dest).length = (src).length; \
	(dest).value = (void *) mem_alloc((dest).length); \
	bcopy((src).value, (dest).value, (dest).length); }

#define	GSS_BUFFERS_EQUAL(b1, b2) (((b1).length == (b2).length) && \
			(bcmp((b1).value, (b2).value, (b1.length)) == 0))

#define	GSS_OIDS_EQUAL(o1, o2) \
	((((gss_OID)(o1))->length == ((gss_OID)(o2))->length) && \
		(bcmp(((gss_OID)(o1))->elements, ((gss_OID)(o2))->elements, \
			((gss_OID)(o1))->length) == 0))

#define	MAX_GSS_NAME			128

/*
 * Private interfaces for user and kernel space.
 */
bool_t __xdr_gss_buf();
bool_t __xdr_rpc_gss_creds();
bool_t __xdr_rpc_gss_init_arg();
bool_t __xdr_rpc_gss_init_res();

bool_t __rpc_gss_wrap_data();
bool_t __rpc_gss_unwrap_data();

#ifdef	_KERNEL
/*
 * kernel-level RPCSEC_GSS definitions.
 */

void __rpc_gss_dup_oid(gss_OID, gss_OID *);
bool_t __rpc_gss_oids_equal(gss_OID oid1, gss_OID oid2);
void rpc_gss_display_status(OM_uint32 major, OM_uint32 minor,
			    rpc_gss_OID mechanism, uid_t uid,
			    char *function_name);
#else
/*
 * user-level RPCSEC_GSS definitions.
 */

#define	MAX_MECH_OID_PAIRS		32

typedef struct _rpc_gss_name {
	char *name;
	rpc_gss_OID type;
} rpc_gss_name;

#ifdef	_REENTRANT
extern rpc_gss_error_t	*__rpc_gss_err();
#define	rpc_gss_err	(*(__rpc_gss_err()))
#else
extern rpc_gss_error_t rpc_gss_err;
#endif	/* _REENTRANT */

/*
 * Private interfaces in user space.
 */
bool_t __rpc_gss_qop_to_num();
char *__rpc_gss_num_to_qop();
bool_t __rpc_gss_mech_to_oid();
char *__rpc_gss_oid_to_mech();
bool_t __rpc_gss_svc_to_num();
char *__rpc_gss_num_to_svc();

void __rpc_gss_xdrdynamic_create();
caddr_t __rpc_gss_xdrdynamic_getdata();

bool_t __rpcsec_init();
rpc_gss_OID __get_gss_oid();
void __rpc_gss_bind_error();
int __find_max_data_length(rpc_gss_service_t service, gss_ctx_id_t context,
	OM_uint32 qop, int max_tp_unit_len);

#endif /* _KERNEL */

#ifdef	__cplusplus
}
#endif

#endif	/* _RPCSEC_DEFS_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Copyright 1993 OpenVision Technologies, Inc., All Rights Reserved.
 */

/*
 * rpcsec_gss.h, RPCSEC_GSS security service interface.
 */

#ifndef	_RPCSEC_GSS_H
#define	_RPCSEC_GSS_H

#ifdef	__cplusplus
extern "C" {
#endif

#include <rpc/auth.h>
#include <rpc/clnt.h>
#include <gssapi/gssapi.h>

/*
 * Interface definitions.
 */
#define	MAX_NAME_LEN			 64
#define	MAX_GSS_MECH			128
#define	MAX_GSS_NAME			128

typedef enum {
	rpc_gss_svc_default = 0,
	rpc_gss_svc_none = 1,
	rpc_gss_svc_integrity = 2,
	rpc_gss_svc_privacy = 3
} rpc_gss_service_t;

/*
 * GSS-API based security mechanism type specified as
 * object identifiers (OIDs).
 * This type is derived from gss_OID_desc/gss_OID.
 */
#define	rpc_gss_OID_s	gss_OID_desc_struct
typedef struct rpc_gss_OID_s rpc_gss_OID_desc, *rpc_gss_OID;

/*
 * Interface data.
 * This is already suitable for both LP64 and ILP32.
 */
typedef struct rpc_gss_principal {
	int	len;
	char	name[1];
} *rpc_gss_principal_t;

typedef struct {
	int			req_flags;
	int			time_req;
	gss_cred_id_t		my_cred;
	gss_channel_bindings_t	input_channel_bindings;
} rpc_gss_options_req_t;

typedef struct {
	int			major_status;
	int			minor_status;
	uint_t			rpcsec_version;
	int			ret_flags;
	int			time_ret;
	gss_ctx_id_t		gss_context;
#ifdef _KERNEL
	rpc_gss_OID		actual_mechanism;
#else
	char			actual_mechanism[MAX_GSS_MECH];
#endif
} rpc_gss_options_ret_t;

/*
 * raw credentials
 */
typedef struct {
	uint_t			version;
#ifdef _KERNEL
	rpc_gss_OID		mechanism;
	uint_t			qop;
#else
	char			*mechanism;
	char			*qop;
#endif
	rpc_gss_principal_t	client_principal;
	char	*svc_principal;	/* service@server, e.g. nfs@caribe */
	rpc_gss_service_t	service;
} rpc_gss_rawcred_t;

/*
 * unix credentials
 */
typedef struct {
	uid_t			uid;
	gid_t			gid;
	short			gidlen;
	gid_t			*gidlist;
} rpc_gss_ucred_t;

/*
 * for callback routine
 */
typedef struct {
	uint_t			program;
	uint_t			version;
	bool_t			(*callback)();
} rpc_gss_callback_t;

/*
 * lock used for the callback routine
 */
typedef struct {
	bool_t			locked;
	rpc_gss_rawcred_t	*raw_cred;
} rpc_gss_lock_t;


/*
 * This is for user RPC applications.
 * Structure used to fetch the error code when one of
 * the rpc_gss_* routines fails.
 */
typedef struct {
	int	rpc_gss_error;
	int	system_error;
} rpc_gss_error_t;

#define	RPC_GSS_ER_SUCCESS	0	/* no error */
#define	RPC_GSS_ER_SYSTEMERROR	1	/* system error */


#ifdef _SYSCALL32
struct gss_clnt_data32 {
	gss_OID_desc32	mechanism;
	rpc_gss_service_t	service;
	char		uname[MAX_NAME_LEN];	/* server's service name */
	char		inst[MAX_NAME_LEN];	/* server's instance name */
	char		realm[MAX_NAME_LEN];	/* server's realm */
	uint_t		qop;
};
#endif

/*
 * This is for Kernel RPC applications.
 * RPCSEC_GSS flavor specific data in sec_data opaque field.
 */
typedef struct gss_clnt_data {
	rpc_gss_OID_desc	mechanism;
	rpc_gss_service_t	service;
	char		uname[MAX_NAME_LEN];	/* server's service name */
	char		inst[MAX_NAME_LEN];	/* server's instance name */
	char		realm[MAX_NAME_LEN];	/* server's realm */
	uint_t		qop;
} gss_clntdata_t;


struct svc_req;
/*
 *  KERNEL rpc_gss_* interfaces.
 */
#ifdef _KERNEL
int rpc_gss_secget(CLIENT *, char *, rpc_gss_OID,
			rpc_gss_service_t, uint_t, rpc_gss_options_req_t *,
			rpc_gss_options_ret_t *, void *, cred_t *, AUTH **);

void rpc_gss_secfree(AUTH *);

int rpc_gss_seccreate(CLIENT *, char *, rpc_gss_OID,
			rpc_gss_service_t, uint_t, rpc_gss_options_req_t *,
			rpc_gss_options_ret_t *, cred_t *, AUTH **);

int rpc_gss_revauth(uid_t, rpc_gss_OID);
void rpc_gss_secpurge(void *);
enum auth_stat __svcrpcsec_gss(struct svc_req *,
			struct rpc_msg *, bool_t *);
bool_t rpc_gss_set_defaults(AUTH *, rpc_gss_service_t, uint_t);
rpc_gss_service_t rpc_gss_get_service_type(AUTH *);


#else
/*
 *  USER rpc_gss_* public interfaces
 */
AUTH *
rpc_gss_seccreate(
	CLIENT			*clnt,		/* associated client handle */
	char			*principal,	/* server service principal */
	char			*mechanism,	/* security mechanism */
	rpc_gss_service_t	service_type,	/* security service */
	char			*qop,		/* requested QOP */
	rpc_gss_options_req_t	*options_req,	/* requested options */
	rpc_gss_options_ret_t   *options_ret    /* returned options */
);

bool_t
rpc_gss_get_principal_name(
	rpc_gss_principal_t	*principal,
	char			*mechanism,
	char			*user_name,
	char			*node,
	char			*secdomain
);

char **rpc_gss_get_mechanisms();

char **rpc_gss_get_mech_info(
	char			*mechanism,
	rpc_gss_service_t	*service
);

bool_t
rpc_gss_is_installed(
	char	*mechanism
);

bool_t
rpc_gss_mech_to_oid(
	char		*mech,
	rpc_gss_OID	*oid
);

bool_t
rpc_gss_qop_to_num(
	char	*qop,
	char	*mech,
	uint_t	*num
);

bool_t
rpc_gss_set_svc_name(
	char			*principal,
	char			*mechanism,
	uint_t			req_time,
	uint_t			program,
	uint_t			version
);

bool_t
rpc_gss_set_defaults(
	AUTH			*auth,
	rpc_gss_service_t	service,
	char			*qop
);

void
rpc_gss_get_error(
	rpc_gss_error_t		*error
);

/*
 * User level private interfaces
 */
enum auth_stat __svcrpcsec_gss();
bool_t	__rpc_gss_wrap();
bool_t	__rpc_gss_unwrap();

#endif

/*
 *  USER and KERNEL rpc_gss_* interfaces.
 */
bool_t
rpc_gss_set_callback(
	rpc_gss_callback_t	*cb
);

bool_t
rpc_gss_getcred(
	struct svc_req		*req,
	rpc_gss_rawcred_t	**rcred,
	rpc_gss_ucred_t		**ucred,
	void			**cookie
);

int
rpc_gss_max_data_length(
	AUTH			*rpcgss_handle,
	int			max_tp_unit_len
);

int
rpc_gss_svc_max_data_length(
	struct	svc_req		*req,
	int			max_tp_unit_len
);

bool_t
rpc_gss_get_versions(
	uint_t	*vers_hi,
	uint_t	*vers_lo
);

#define	RPCSEC_GSS_REFRESH_ATTEMPTS 	20

/*
 * Protocol data.
 *
 * The reason to put these definition in this header file
 * is for 2.6 snoop to handle the RPCSEC_GSS protocol
 * interpretation.
 */
#define	RPCSEC_GSS_DATA			0
#define	RPCSEC_GSS_INIT			1
#define	RPCSEC_GSS_CONTINUE_INIT	2
#define	RPCSEC_GSS_DESTROY		3

#define	RPCSEC_GSS_VERSION		1

#ifdef	__cplusplus
}
#endif

#endif	/* !_RPCSEC_GSS_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 1995 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 *  	Copyright (c) 1983,1984,1985,1986,1987,1988,1989  AT&T.
 *	All rights reserved.
 */

#include <sys/types.h>
#include <rpc/types.h>
#include <sys/systm.h>
#include <sys/vfs.h>
#include <sys/errno.h>
#include <sys/cred.h>
#include <rpc/rpcsys.h>
#include <sys/model.h>


/*ARGSUSED*/
int
rpcsys(enum rpcsys_op opcode, void *arg)
{
	switch (opcode) {
	case KRPC_REVAUTH:
		/* revoke the cached credentials for the given uid */
		{
		STRUCT_DECL(krpc_revauth, nra);
		int result;

		STRUCT_INIT(nra, get_udatamodel());
		if (copyin(arg, STRUCT_BUF(nra), STRUCT_SIZE(nra)))
			return (set_errno(EFAULT));

		result = sec_clnt_revoke(STRUCT_FGET(nra, rpcsec_flavor_1),
				STRUCT_FGET(nra, uid_1), CRED(),
				STRUCT_FGETP(nra, flavor_data_1),
				get_udatamodel());
		return ((result != 0) ? set_errno(result) : 0);
		}

	default:
		return (set_errno(EINVAL));
	}
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#ifndef	_RPC_RPCSYS_H
#define	_RPC_RPCSYS_H

#include <sys/types.h>

#ifdef	__cplusplus
extern "C" {
#endif

enum rpcsys_op  { KRPC_REVAUTH };

/*
 * Private definitions for the krpc_sys/rpcsys system call.
 *
 * flavor_data for AUTH_DES and AUTH_KERB is NULL.
 * flavor_data for RPCSEC_GSS is rpc_gss_OID.
 *
 */
struct krpc_revauth_1 {
	uid_t	uid;
	int	rpcsec_flavor;
	void	*flavor_data;
};

#ifdef _SYSCALL32
struct krpc_revauth_132 {
	uid32_t	uid;
	int32_t	rpcsec_flavor;
	caddr32_t flavor_data;
};
#endif /* _SYSCALL32 */

struct krpc_revauth {
	int	version;	/* initially 1 */
	union	{
		struct krpc_revauth_1 r;
	} krpc_revauth_u;
};
#define	uid_1		krpc_revauth_u.r.uid
#define	rpcsec_flavor_1	krpc_revauth_u.r.rpcsec_flavor
#define	flavor_data_1	krpc_revauth_u.r.flavor_data

#ifdef _SYSCALL32
struct krpc_revauth32 {
	int32_t	version;	/* initially 1 */
	union	{
		struct krpc_revauth_132 r;
	} krpc_revauth_u;
};
#endif /* _SYSCALL32 */


#ifdef _KERNEL

extern	int	rpcsys(enum rpcsys_op opcode, void *arg);
extern	int	sec_clnt_revoke(int, uid_t, cred_t *, void *, model_t);

#endif

#ifdef	__cplusplus
}
#endif

#endif	/* _RPC_RPCSYS_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2003 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved  	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

/*
 * auth_des.c, client-side implementation of DES authentication
 */

#include <sys/types.h>
#include <sys/t_lock.h>
#include <sys/time.h>
#include <sys/systm.h>
#include <sys/socket.h>
#include <sys/tiuser.h>
#include <sys/errno.h>
#include <rpc/des_crypt.h>
#include <rpc/types.h>
#include <rpc/auth.h>
#include <rpc/auth_des.h>
#include <rpc/xdr.h>
#include <rpc/clnt.h>
#include <rpc/rpc_msg.h>
#include <netinet/in.h>	/* XXX: just to get htonl() and ntohl() */
#include <sys/cmn_err.h>
#include <sys/debug.h>

#define	MILLION		1000000
#define	RTIME_TIMEOUT	5		/* seconds to wait for sync */

#define	AUTH_PRIVATE(auth)	(struct ad_private *)auth->ah_private
#define	ALLOC(object_type)	(object_type *) mem_alloc(sizeof (object_type))
#define	FREE(ptr, size)		mem_free((char *)(ptr), (int)size)
#define	ATTEMPT(xdr_op)		if (!(xdr_op))\
					return (FALSE)

#define	gettimeofday(tvp, tzp)	uniqtime(tvp)

static void	authdes_nextverf(AUTH *);
static bool_t	authdes_marshal(AUTH *, XDR *, struct cred *);
static bool_t	authdes_validate(AUTH *, struct opaque_auth *);
static bool_t	authdes_refresh(AUTH *, struct rpc_msg *, cred_t *);
static void	authdes_destroy(AUTH *);
static bool_t	synchronize(struct knetconfig *, struct netbuf *,
			int, struct timeval *);

static struct auth_ops *authdes_ops(void);

/*
 * This struct is pointed to by the ah_private field of an "AUTH *"
 */
struct ad_private {
	char *ad_fullname; 		/* client's full name */
	uint_t ad_fullnamelen;		/* length of name, rounded up */
	char *ad_servername; 		/* server's full name */
	uint_t ad_servernamelen;	/* length of name, rounded up */
	uint_t ad_window;		/* client specified window */
	bool_t ad_dosync;		/* synchronize? */
	struct netbuf ad_syncaddr;	/* remote host to synch with */
	struct knetconfig ad_synconfig; /* netconfig for the synch host */
	int   ad_calltype;		/* use rpc or straight call for sync */
	struct timeval ad_timediff;	/* server's time - client's time */
	uint32_t ad_nickname;		/* server's nickname for client */
	struct authdes_cred ad_cred;	/* storage for credential */
	struct authdes_verf ad_verf;	/* storage for verifier */
	struct timeval ad_timestamp;	/* timestamp sent */
	des_block ad_xkey;		/* encrypted conversation key */
};


/*
 * Create the client des authentication object
 */
/* ARGSUSED */
int
authdes_create(char *servername, uint_t window, struct netbuf *syncaddr,
	struct knetconfig *synconfig, des_block *ckey, int calltype,
	AUTH **retauth)
{
	AUTH *auth;
	struct ad_private *ad;
	char namebuf[MAXNETNAMELEN+1];
	int error = 0;
	enum clnt_stat stat;

	if (retauth == NULL)
		return (EINVAL);

	*retauth = NULL;

	/*
	 * Allocate everything now
	 */
	auth = ALLOC(AUTH);
	ad = ALLOC(struct ad_private);
	bzero(ad, sizeof (struct ad_private));
	if ((stat = kgetnetname(namebuf)) != 0) {
		cmn_err(CE_NOTE,
	"authdes_create: unable to get client's netname: %s (error %d)",
		    clnt_sperrno(stat), stat);
		goto failed;
	}

	ad->ad_fullnamelen = (uint_t)RNDUP(strlen(namebuf));
	ad->ad_fullname = mem_alloc(ad->ad_fullnamelen + 1);

	ad->ad_servernamelen = (uint_t)strlen(servername);
	ad->ad_servername = mem_alloc(ad->ad_servernamelen + 1);

	if (auth == NULL || ad == NULL || ad->ad_fullname == NULL ||
	    ad->ad_servername == NULL) {
		cmn_err(CE_NOTE, "authdes_create: out of memory");
		error = ENOMEM;
		goto failed;
	}

	/*
	 * Set up private data
	 */
	bcopy(namebuf, ad->ad_fullname, ad->ad_fullnamelen + 1);
	bcopy(servername, ad->ad_servername, ad->ad_servernamelen + 1);
	if (syncaddr != NULL) {
		ad->ad_syncaddr = *syncaddr;
		ad->ad_synconfig = *synconfig;
		ad->ad_dosync = TRUE;
		ad->ad_calltype = calltype;
	} else {
		ad->ad_timediff.tv_sec = 0;
		ad->ad_timediff.tv_usec = 0;
		ad->ad_dosync = FALSE;
	}
	ad->ad_window = window;
	if (ckey == NULL) {
		if ((stat = key_gendes(&auth->ah_key)) != RPC_SUCCESS) {
			cmn_err(CE_NOTE,
	"authdes_create: unable to gen conversation key: %s (error %d)",
			    clnt_sperrno(stat), stat);
			if (stat == RPC_INTR)
				error = EINTR;
			else if (stat == RPC_TIMEDOUT)
				error = ETIMEDOUT;
			else
				error = EINVAL;		/* XXX */
			goto failed;
		}
	} else
		auth->ah_key = *ckey;

	/*
	 * Set up auth handle
	 */
	auth->ah_cred.oa_flavor = AUTH_DES;
	auth->ah_verf.oa_flavor = AUTH_DES;
	auth->ah_ops = authdes_ops();
	auth->ah_private = (caddr_t)ad;

	if (!authdes_refresh(auth, NULL, CRED()))
		goto failed;

	*retauth = auth;
	return (0);

failed:
	if (ad != NULL && ad->ad_fullname != NULL)
		FREE(ad->ad_fullname, ad->ad_fullnamelen + 1);
	if (ad != NULL && ad->ad_servername != NULL)
		FREE(ad->ad_servername, ad->ad_servernamelen + 1);
	if (ad != NULL)
		FREE(ad, sizeof (struct ad_private));
	if (auth != NULL)
		FREE(auth, sizeof (AUTH));
	return ((error == 0) ? EINVAL : error);		/* XXX */
}

/*
 * Implement the five authentication operations
 */

/*
 * 1. Next Verifier
 */
/* ARGSUSED */
static void
authdes_nextverf(AUTH *auth)
{
	/* what the heck am I supposed to do??? */
}

/*
 * 2. Marshal
 */
/* ARGSUSED */
static bool_t
authdes_marshal(AUTH *auth, XDR *xdrs, struct cred *cr)
{
	/* LINTED pointer alignment */
	struct ad_private *ad = AUTH_PRIVATE(auth);
	struct authdes_cred *cred = &ad->ad_cred;
	struct authdes_verf *verf = &ad->ad_verf;
	des_block cryptbuf[2];
	des_block ivec;
	int status;
	int len;
	int32_t *ixdr;

	/*
	 * Figure out the "time", accounting for any time difference
	 * with the server if necessary.
	 */
	(void) gettimeofday(&ad->ad_timestamp, (struct timezone *)NULL);
	ad->ad_timestamp.tv_sec += ad->ad_timediff.tv_sec;
	ad->ad_timestamp.tv_usec += ad->ad_timediff.tv_usec;
	if (ad->ad_timestamp.tv_usec >= MILLION) {
		ad->ad_timestamp.tv_usec -= MILLION;
		ad->ad_timestamp.tv_sec += 1;
	}

	/*
	 * XDR the timestamp and possibly some other things, then
	 * encrypt them.
	 */
	ixdr = (int32_t *)cryptbuf;
	IXDR_PUT_INT32(ixdr, ad->ad_timestamp.tv_sec);
	IXDR_PUT_INT32(ixdr, ad->ad_timestamp.tv_usec);
	if (ad->ad_cred.adc_namekind == ADN_FULLNAME) {
		IXDR_PUT_U_INT32(ixdr, ad->ad_window);
		IXDR_PUT_U_INT32(ixdr, ad->ad_window - 1);
		ivec.key.high = ivec.key.low = 0;
		status = cbc_crypt((char *)&auth->ah_key, (char *)cryptbuf,
		    2 * sizeof (des_block), DES_ENCRYPT, (char *)&ivec);
	} else {
		status = ecb_crypt((char *)&auth->ah_key, (char *)cryptbuf,
		    sizeof (des_block), DES_ENCRYPT);
	}
	if (DES_FAILED(status)) {
		cmn_err(CE_NOTE, "authdes_marshal: DES encryption failure");
		return (FALSE);
	}
	ad->ad_verf.adv_xtimestamp = cryptbuf[0];
	if (ad->ad_cred.adc_namekind == ADN_FULLNAME) {
		ad->ad_cred.adc_fullname.window = cryptbuf[1].key.high;
		ad->ad_verf.adv_winverf = cryptbuf[1].key.low;
	} else {
		ad->ad_cred.adc_nickname = ad->ad_nickname;
		ad->ad_verf.adv_winverf = 0;
	}

	/*
	 * Serialize the credential and verifier into opaque
	 * authentication data.
	 */
	if (ad->ad_cred.adc_namekind == ADN_FULLNAME) {
		len = ((1 + 1 + 2 + 1) * BYTES_PER_XDR_UNIT +
		    ad->ad_fullnamelen);
	} else
		len = (1 + 1) * BYTES_PER_XDR_UNIT;

	if (ixdr = xdr_inline(xdrs, 2 * BYTES_PER_XDR_UNIT)) {
		IXDR_PUT_INT32(ixdr, AUTH_DES);
		IXDR_PUT_INT32(ixdr, len);
	} else {
		ATTEMPT(xdr_putint32(xdrs,
		    (int32_t *)&auth->ah_cred.oa_flavor));
		ATTEMPT(xdr_putint32(xdrs, (int32_t *)&len));
	}
	ATTEMPT(xdr_authdes_cred(xdrs, cred));

	len = (2 + 1) * BYTES_PER_XDR_UNIT;
	if (ixdr = xdr_inline(xdrs, 2 * BYTES_PER_XDR_UNIT)) {
		IXDR_PUT_INT32(ixdr, AUTH_DES);
		IXDR_PUT_INT32(ixdr, len);
	} else {
		ATTEMPT(xdr_putint32(xdrs,
		    (int32_t *)&auth->ah_verf.oa_flavor));
		ATTEMPT(xdr_putint32(xdrs, (int32_t *)&len));
	}
	ATTEMPT(xdr_authdes_verf(xdrs, verf));
	return (TRUE);
}

/*
 * 3. Validate
 */
static bool_t
authdes_validate(AUTH *auth, struct opaque_auth *rverf)
{
	/* LINTED pointer alignment */
	struct ad_private *ad = AUTH_PRIVATE(auth);
	struct authdes_verf verf;
	int status;
	uint32_t *ixdr;
	des_block buf;

	if (rverf->oa_length != (2 + 1) * BYTES_PER_XDR_UNIT)
		return (FALSE);

	/* LINTED pointer alignment */
	ixdr = (uint32_t *)rverf->oa_base;
	buf.key.high = (uint32_t)*ixdr++;
	buf.key.low = (uint32_t)*ixdr++;
	verf.adv_int_u = IXDR_GET_U_INT32(ixdr);

	/*
	 * Decrypt the timestamp
	 */
	status = ecb_crypt((char *)&auth->ah_key, (char *)&buf,
	    sizeof (des_block), DES_DECRYPT);

	if (DES_FAILED(status)) {
		cmn_err(CE_NOTE, "authdes_validate: DES decryption failure");
		return (FALSE);
	}

	/*
	 * xdr the decrypted timestamp
	 */
	/* LINTED pointer alignment */
	ixdr = (uint32_t *)buf.c;
	verf.adv_timestamp.tv_sec = IXDR_GET_INT32(ixdr) + 1;
	verf.adv_timestamp.tv_usec = IXDR_GET_INT32(ixdr);

	/*
	 * validate
	 */
	if (bcmp((char *)&ad->ad_timestamp, (char *)&verf.adv_timestamp,
	    sizeof (struct timeval)) != 0) {
		cmn_err(CE_NOTE, "authdes_validate: verifier mismatch");
		return (FALSE);
	}

	/*
	 * We have a nickname now, let's use it
	 */
	ad->ad_nickname = verf.adv_nickname;
	ad->ad_cred.adc_namekind = ADN_NICKNAME;
	return (TRUE);
}

/*
 * 4. Refresh
 *
 *  msg is a dummy argument here.
 */
/* ARGSUSED */
static bool_t
authdes_refresh(AUTH *auth, struct rpc_msg *msg, cred_t *cr)
{
	/* LINTED pointer alignment */
	struct ad_private *ad = AUTH_PRIVATE(auth);
	struct authdes_cred *cred = &ad->ad_cred;
	enum clnt_stat stat;

	if (ad->ad_dosync &&
	    !synchronize(&ad->ad_synconfig, &ad->ad_syncaddr,
	    ad->ad_calltype, &ad->ad_timediff)) {
		/*
		 * Hope the clocks are synced!
		 */
		timerclear(&ad->ad_timediff);
		cmn_err(CE_NOTE,
"authdes_refresh: unable to synchronize with server %s", ad->ad_servername);
	}
	ad->ad_xkey = auth->ah_key;
	if ((stat = key_encryptsession(ad->ad_servername, &ad->ad_xkey, cr)) !=
	    RPC_SUCCESS) {
		cmn_err(CE_NOTE,
"authdes_refresh: unable to encrypt conversation key for user (uid %d): "
		    "%s (error %d)",
		    (int)crgetuid(cr), clnt_sperrno(stat), stat);
		return (FALSE);
	}
	cred->adc_fullname.key = ad->ad_xkey;
	cred->adc_namekind = ADN_FULLNAME;
	cred->adc_fullname.name = ad->ad_fullname;
	return (TRUE);
}

/*
 * 5. Destroy
 */
static void
authdes_destroy(AUTH *auth)
{
	/* LINTED pointer alignment */
	struct ad_private *ad = AUTH_PRIVATE(auth);

	FREE(ad->ad_fullname, ad->ad_fullnamelen + 1);
	FREE(ad->ad_servername, ad->ad_servernamelen + 1);
	FREE(ad, sizeof (struct ad_private));
	FREE(auth, sizeof (AUTH));
}


/*
 * Synchronize with the server at the given address, that is,
 * adjust timep to reflect the delta between our clocks
 */
static bool_t
synchronize(struct knetconfig *synconfig, struct netbuf *syncaddr, int calltype,
	struct timeval *timep)
{
	struct timeval mytime;
	struct timeval timout;

	timout.tv_sec = RTIME_TIMEOUT;
	timout.tv_usec = 0;
	if (rtime(synconfig, syncaddr, calltype, timep, &timout) < 0)
		return (FALSE);
	(void) gettimeofday(&mytime, (struct timezone *)NULL);
	timep->tv_sec -= mytime.tv_sec;
	if (mytime.tv_usec > timep->tv_usec) {
		timep->tv_sec -= 1;
		timep->tv_usec += MILLION;
	}
	timep->tv_usec -= mytime.tv_usec;
	return (TRUE);
}

static struct auth_ops *
authdes_ops(void)
{
	static struct auth_ops ops;

	mutex_enter(&authdes_ops_lock);
	if (ops.ah_nextverf == NULL) {
		ops.ah_nextverf = authdes_nextverf;
		ops.ah_marshal = authdes_marshal;
		ops.ah_validate = authdes_validate;
		ops.ah_refresh = authdes_refresh;
		ops.ah_destroy = authdes_destroy;
		ops.ah_wrap = authany_wrap;
		ops.ah_unwrap = authany_unwrap;
	}
	mutex_exit(&authdes_ops_lock);
	return (&ops);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved  	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

/*
 * auth_kern.c, implements UNIX style authentication parameters in the kernel.
 * Interfaces with svc_auth_unix on the server.  See auth_unix.c for the user
 * level implementation of unix auth.
 *
 */

#include <sys/param.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/systm.h>
#include <sys/user.h>
#include <sys/proc.h>
#include <sys/cred.h>
#include <sys/kmem.h>
#include <sys/sysmacros.h>
#include <sys/cmn_err.h>
#include <sys/utsname.h>

#include <rpc/types.h>
#include <rpc/xdr.h>
#include <rpc/auth.h>
#include <rpc/auth_unix.h>
#include <rpc/clnt.h>
#include <rpc/rpc_msg.h>

/*
 * Unix authenticator operations vector
 */
static void	authkern_nextverf(AUTH *);
static bool_t	authkern_marshal(AUTH *, XDR *, struct cred *);
static bool_t	authkern_validate(AUTH *, struct opaque_auth *);
static bool_t	authkern_refresh(AUTH *, struct rpc_msg *, cred_t *);
static void	authkern_destroy(AUTH *);

static struct auth_ops auth_kern_ops = {
	authkern_nextverf,
	authkern_marshal,
	authkern_validate,
	authkern_refresh,
	authkern_destroy,
	authany_wrap,
	authany_unwrap
};

/*
 * Create a kernel unix style authenticator.
 * Returns an auth handle.
 */
AUTH *
authkern_create(void)
{
	/*
	 * Allocate and set up auth handle
	 */
	return (kmem_cache_alloc(authkern_cache, KM_SLEEP));
}

/*
 *  The constructor of the authkern_cache.
 */
/* ARGSUSED */
int
authkern_init(void *buf, void *cdrarg, int kmflags)
{
	AUTH *auth = (AUTH *)buf;

	auth->ah_ops = &auth_kern_ops;
	auth->ah_cred.oa_flavor = AUTH_UNIX;
	auth->ah_verf = _null_auth;

	return (0);
}

/*
 * authkern operations
 */
/* ARGSUSED */
static void
authkern_nextverf(AUTH *auth)
{
	/* no action necessary */
}

static bool_t
authkern_marshal(AUTH *auth, XDR *xdrs, struct cred *cr)
{
	char *sercred;
	XDR xdrm;
	bool_t ret;
	uint32_t gidlen, credsize, namelen, rounded_namelen;
	int32_t *ptr;
	char *nodename = uts_nodename();
	uint_t startpos;

	ASSERT(xdrs->x_op == XDR_ENCODE);
	ASSERT(auth->ah_cred.oa_flavor == AUTH_SYS);
	ASSERT(auth->ah_verf.oa_flavor == AUTH_NONE);
	ASSERT(auth->ah_verf.oa_length == 0);

	/*
	 * First we try a fast path to get through
	 * this very common operation.
	 */
	namelen = (uint32_t)strlen(nodename);
	if (namelen > MAX_MACHINE_NAME)
		return (FALSE);
	rounded_namelen = RNDUP(namelen);

	/*
	 * NFIELDS is a number of the following fields we are going to encode:
	 *   - stamp
	 *   - strlen(machinename)
	 *   - uid
	 *   - gid
	 *   - the number of gids
	 */
#define	NFIELDS	5
	CTASSERT((NFIELDS + NGRPS) * BYTES_PER_XDR_UNIT +
	    RNDUP(MAX_MACHINE_NAME) <= MAX_AUTH_BYTES);

	gidlen = crgetngroups(cr);
	if (gidlen > NGRPS)
		gidlen = NGRPS;

	credsize = NFIELDS * BYTES_PER_XDR_UNIT + rounded_namelen +
	    gidlen * BYTES_PER_XDR_UNIT;
	ASSERT(credsize <= MAX_AUTH_BYTES);
#undef	NFIELDS

	/*
	 * We need to marshal both cred and verf parts of the rpc_msg body
	 * (call_body).  For the cred part we need to inline the auth_flavor
	 * and the opaque auth body size.  Then we inline the credsize bytes of
	 * the opaque auth body for the cred part.  Finally we add the
	 * AUTH_NONE verifier (its auth_flavor and the opaque auth body size).
	 */
	ptr = XDR_INLINE(xdrs, 2 * BYTES_PER_XDR_UNIT + credsize +
	    2 * BYTES_PER_XDR_UNIT);
	if (ptr != NULL) {
		/*
		 * We can do the fast path.
		 */
		const gid_t *gp = crgetgroups(cr);

		IXDR_PUT_U_INT32(ptr, AUTH_SYS);	/* cred flavor */
		IXDR_PUT_U_INT32(ptr, credsize);	/* cred len */

		IXDR_PUT_INT32(ptr, gethrestime_sec());
		IXDR_PUT_U_INT32(ptr, namelen);
		bcopy(nodename, ptr, namelen);
		if ((rounded_namelen - namelen) > 0)
			bzero((char *)ptr + namelen, rounded_namelen - namelen);
		ptr += rounded_namelen / BYTES_PER_XDR_UNIT;
		IXDR_PUT_U_INT32(ptr, crgetuid(cr));
		IXDR_PUT_U_INT32(ptr, crgetgid(cr));
		IXDR_PUT_U_INT32(ptr, gidlen);
		while (gidlen-- > 0)
			IXDR_PUT_U_INT32(ptr, *gp++);

		IXDR_PUT_U_INT32(ptr, AUTH_NULL);	/* verf flavor */
		IXDR_PUT_U_INT32(ptr, 0);		/* verf len */

		return (TRUE);
	}

	sercred = kmem_alloc(MAX_AUTH_BYTES, KM_SLEEP);

	/*
	 * Serialize the auth body data into sercred.
	 */
	xdrmem_create(&xdrm, sercred, MAX_AUTH_BYTES, XDR_ENCODE);
	startpos = XDR_GETPOS(&xdrm);
	if (!xdr_authkern(&xdrm, cr)) {
		printf("authkern_marshal: xdr_authkern failed\n");
		ret = FALSE;
		goto done;
	}

	/*
	 * Make opaque auth credentials to point at the serialized auth body
	 * data.
	 */
	auth->ah_cred.oa_base = sercred;
	auth->ah_cred.oa_length = XDR_GETPOS(&xdrm) - startpos;
	ASSERT(auth->ah_cred.oa_length <= MAX_AUTH_BYTES);

	/*
	 * serialize credentials and verifier (null)
	 */
	if ((xdr_opaque_auth(xdrs, &(auth->ah_cred))) &&
	    (xdr_opaque_auth(xdrs, &(auth->ah_verf))))
		ret = TRUE;
	else
		ret = FALSE;

done:
	XDR_DESTROY(&xdrm);
	kmem_free(sercred, MAX_AUTH_BYTES);

	return (ret);
}

/* ARGSUSED */
static bool_t
authkern_validate(AUTH *auth, struct opaque_auth *verf)
{
	return (TRUE);
}

/* ARGSUSED */
static bool_t
authkern_refresh(AUTH *auth, struct rpc_msg *msg, cred_t *cr)
{
	return (FALSE);
}

static void
authkern_destroy(AUTH *auth)
{
	kmem_cache_free(authkern_cache, auth);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2003 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved  	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

/*
 * auth_loopb.c, implements UNIX style authentication parameters in the
 * kernel.  Interfaces with svc_auth_loopback on the server.  See
 * auth_loopb.c for the user level implementation of the loopback auth.
 *
 */

#include <sys/param.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/systm.h>
#include <sys/user.h>
#include <sys/proc.h>
#include <sys/utsname.h>
#include <sys/cred.h>
#include <sys/kmem.h>
#include <sys/sysmacros.h>
#include <sys/cmn_err.h>

#include <rpc/types.h>
#include <rpc/xdr.h>
#include <rpc/auth.h>
#include <rpc/auth_unix.h>
#include <rpc/clnt.h>
#include <rpc/rpc_msg.h>

/*
 * Unix authenticator operations vector
 */
static void	authloopback_nextverf(AUTH *);
static bool_t	authloopback_marshal(AUTH *, XDR *, struct cred *);
static bool_t	authloopback_validate(AUTH *, struct opaque_auth *);
static bool_t	authloopback_refresh(AUTH *, struct rpc_msg *, cred_t *);
static void	authloopback_destroy(AUTH *);

static struct auth_ops authloopback_ops = {
	authloopback_nextverf,
	authloopback_marshal,
	authloopback_validate,
	authloopback_refresh,
	authloopback_destroy,
	authany_wrap,
	authany_unwrap
};

/*
 * Create a kernel unix style authenticator.
 * Returns an auth handle.
 */
AUTH *
authloopback_create(void)
{
	/*
	 * Allocate and set up auth handle
	 */
	return (kmem_cache_alloc(authloopback_cache, KM_SLEEP));
}

/*
 *  The constructor of the authloopback_cache.
 */
/* ARGSUSED */
int
authloopback_init(void *buf, void *cdrarg, int kmflags)
{
	AUTH *auth = (AUTH *)buf;

	auth->ah_ops = &authloopback_ops;
	auth->ah_cred.oa_flavor = AUTH_LOOPBACK;
	auth->ah_verf = _null_auth;

	return (0);
}

/*
 * authloopback operations
 */
/* ARGSUSED */
static void
authloopback_nextverf(AUTH *auth)
{

	/* no action necessary */
}

static bool_t
authloopback_marshal(AUTH *auth, XDR *xdrs, struct cred *cr)
{
	char *sercred;
	XDR xdrm;
	bool_t ret;
	uint32_t gidlen, credsize, namelen, rounded_namelen;
	int32_t *ptr;
	char *nodename = uts_nodename();
	uint32_t maxgidlen;
	uint_t startpos;

	ASSERT(xdrs->x_op == XDR_ENCODE);
	ASSERT(auth->ah_cred.oa_flavor == AUTH_LOOPBACK);
	ASSERT(auth->ah_verf.oa_flavor == AUTH_NONE);
	ASSERT(auth->ah_verf.oa_length == 0);

	/*
	 * First we try a fast path to get through
	 * this very common operation.
	 */
	namelen = (uint32_t)strlen(nodename);
	if (namelen > MAX_MACHINE_NAME)
		return (FALSE);
	rounded_namelen = RNDUP(namelen);

	/*
	 * NFIELDS is a number of the following fields we are going to encode:
	 *   - stamp
	 *   - strlen(machinename)
	 *   - uid
	 *   - gid
	 *   - the number of gids
	 */
#define	NFIELDS	5
	CTASSERT(NFIELDS * BYTES_PER_XDR_UNIT + RNDUP(MAX_MACHINE_NAME) <=
	    MAX_AUTH_BYTES);
	maxgidlen = (MAX_AUTH_BYTES - NFIELDS * BYTES_PER_XDR_UNIT -
	    rounded_namelen) / BYTES_PER_XDR_UNIT;

	gidlen = crgetngroups(cr);
	if (gidlen > maxgidlen)
		return (FALSE);

	credsize = NFIELDS * BYTES_PER_XDR_UNIT + rounded_namelen +
	    gidlen * BYTES_PER_XDR_UNIT;
	ASSERT(credsize <= MAX_AUTH_BYTES);
#undef	NFIELDS

	/*
	 * We need to marshal both cred and verf parts of the rpc_msg body
	 * (call_body).  For the cred part we need to inline the auth_flavor
	 * and the opaque auth body size.  Then we inline the credsize bytes of
	 * the opaque auth body for the cred part.  Finally we add the
	 * AUTH_NONE verifier (its auth_flavor and the opaque auth body size).
	 */
	ptr = XDR_INLINE(xdrs, 2 * BYTES_PER_XDR_UNIT + credsize +
	    2 * BYTES_PER_XDR_UNIT);
	if (ptr != NULL) {
		/*
		 * We can do the fast path.
		 */
		const gid_t *gp = crgetgroups(cr);

		IXDR_PUT_U_INT32(ptr, AUTH_LOOPBACK);	/* cred flavor */
		IXDR_PUT_U_INT32(ptr, credsize);	/* cred len */

		IXDR_PUT_INT32(ptr, gethrestime_sec());
		IXDR_PUT_U_INT32(ptr, namelen);
		bcopy(nodename, ptr, namelen);
		if ((rounded_namelen - namelen) > 0)
			bzero((char *)ptr + namelen, rounded_namelen - namelen);
		ptr += rounded_namelen / BYTES_PER_XDR_UNIT;
		IXDR_PUT_U_INT32(ptr, crgetuid(cr));
		IXDR_PUT_U_INT32(ptr, crgetgid(cr));
		IXDR_PUT_U_INT32(ptr, gidlen);
		while (gidlen-- > 0)
			IXDR_PUT_U_INT32(ptr, *gp++);

		IXDR_PUT_U_INT32(ptr, AUTH_NONE);	/* verf flavor */
		IXDR_PUT_U_INT32(ptr, 0);		/* verf len */

		return (TRUE);
	}

	sercred = kmem_alloc(MAX_AUTH_BYTES, KM_SLEEP);

	/*
	 * Serialize the auth body data into sercred.
	 */
	xdrmem_create(&xdrm, sercred, MAX_AUTH_BYTES, XDR_ENCODE);
	startpos = XDR_GETPOS(&xdrm);
	if (!xdr_authloopback(&xdrm, cr)) {
		printf("authloopback_marshal: xdr_authloopback failed\n");
		ret = FALSE;
		goto done;
	}

	/*
	 * Make opaque auth credentials to point at the serialized auth body
	 * data.
	 */
	auth->ah_cred.oa_base = sercred;
	auth->ah_cred.oa_length = XDR_GETPOS(&xdrm) - startpos;
	ASSERT(auth->ah_cred.oa_length <= MAX_AUTH_BYTES);

	/*
	 * serialize credentials and verifier (null)
	 */
	if ((xdr_opaque_auth(xdrs, &(auth->ah_cred))) &&
	    (xdr_opaque_auth(xdrs, &(auth->ah_verf))))
		ret = TRUE;
	else
		ret = FALSE;

done:
	XDR_DESTROY(&xdrm);
	kmem_free(sercred, MAX_AUTH_BYTES);

	return (ret);
}

/* ARGSUSED */
static bool_t
authloopback_validate(AUTH *auth, struct opaque_auth *verf)
{
	return (TRUE);
}

/* ARGSUSED */
static bool_t
authloopback_refresh(AUTH *auth, struct rpc_msg *msg, cred_t *cr)
{
	return (FALSE);
}

static void
authloopback_destroy(register AUTH *auth)
{
	kmem_cache_free(authloopback_cache, auth);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * auth_none.c implements routines used to pass "null" credentials
 * and "null" verifiers in kernel RPC.
 */

#include <rpc/auth.h>

/*
 * Null authenticator operations vector
 */
static void	authnone_nextverf(AUTH *);
static bool_t	authnone_marshal(AUTH *, XDR *, struct cred *);
static bool_t	authnone_validate(AUTH *, struct opaque_auth *);
static bool_t	authnone_refresh(AUTH *, struct rpc_msg *, cred_t *);
static void	authnone_destroy(AUTH *);

static struct auth_ops auth_none_ops = {
	authnone_nextverf,
	authnone_marshal,
	authnone_validate,
	authnone_refresh,
	authnone_destroy,
	authany_wrap,
	authany_unwrap
};

/*
 * Create a kernel null style authenticator.
 * Returns an auth handle.
 */
AUTH *
authnone_create(void)
{
	/*
	 * Allocate and set up auth handle
	 */
	return (kmem_cache_alloc(authnone_cache, KM_SLEEP));
}

/*
 *  The constructor of the authnone_cache.
 */
/* ARGSUSED */
int
authnone_init(void *buf, void *cdrarg, int kmflags)
{
	AUTH *auth = (AUTH *)buf;

	auth->ah_ops = &auth_none_ops;

	/*
	 * Flavor of RPC message's credential and verifier should be set to
	 * AUTH_NONE. Opaque data associated with AUTH_NONE is undefined.
	 * The length of the opaque data should be zero.
	 *	oa_flavor = AUTH_NONE
	 *	oa_base = NULL
	 *	oa_length = 0
	 */
	auth->ah_cred = auth->ah_verf = _null_auth;

	return (0);
}

/*
 * authnone operations
 */
/* ARGSUSED */
static void
authnone_nextverf(AUTH *auth)
{
	/* no action necessary */
}

/* ARGSUSED */
static bool_t
authnone_marshal(AUTH *auth, XDR *xdrs, struct cred *cr)
{
	int32_t	*ptr;

	/*
	 * auth_none has no opaque data. Encode auth_none
	 * value with 0 len data for both cred and verf.
	 * We first try a fast path to complete this operation.
	 */
	ptr = XDR_INLINE(xdrs, 4 + 4 + 4 + 4);
	if (ptr) {
		IXDR_PUT_INT32(ptr, AUTH_NONE);
		IXDR_PUT_INT32(ptr, 0);
		IXDR_PUT_INT32(ptr, AUTH_NONE);
		IXDR_PUT_INT32(ptr, 0);
		return (TRUE);
	}

	/*
	 * serialize AUTH_NONE credential and AUTH_NONE verifier
	 */
	if ((xdr_opaque_auth(xdrs, &(auth->ah_cred))) &&
	    (xdr_opaque_auth(xdrs, &(auth->ah_verf))))
		return (TRUE);
	else
		return (FALSE);
}

/* ARGSUSED */
static bool_t
authnone_validate(AUTH *auth, struct opaque_auth *verf)
{
	return (TRUE);
}

/* ARGSUSED */
static bool_t
authnone_refresh(AUTH *auth, struct rpc_msg *msg, cred_t *cr)
{
	return (FALSE);
}

static void
authnone_destroy(AUTH *auth)
{
	kmem_cache_free(authnone_cache, auth);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 1989 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved  	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

/*
 * authdesprt.c, XDR routines for DES authentication
 */

#include <rpc/types.h>
#include <rpc/xdr.h>
#include <rpc/auth.h>
#include <rpc/clnt.h>
#include <rpc/auth_des.h>

#define	ATTEMPT(xdr_op) if (!(xdr_op))\
				return (FALSE)

bool_t
xdr_authdes_cred(XDR *xdrs, struct authdes_cred *cred)
{
	/*
	 * Unrolled xdr
	 */
	ATTEMPT(xdr_enum(xdrs, (enum_t *)&cred->adc_namekind));
	switch (cred->adc_namekind) {
	case ADN_FULLNAME:
		ATTEMPT(xdr_string(xdrs, &cred->adc_fullname.name,
		    MAXNETNAMELEN));
		ATTEMPT(xdr_opaque(xdrs, (caddr_t)&cred->adc_fullname.key,
		    sizeof (des_block)));
		ATTEMPT(xdr_opaque(xdrs, (caddr_t)&cred->adc_fullname.window,
		    sizeof (cred->adc_fullname.window)));
		return (TRUE);
	case ADN_NICKNAME:
		ATTEMPT(xdr_int(xdrs, (int *)&cred->adc_nickname));
		return (TRUE);
	default:
		return (FALSE);
	}
}

bool_t
xdr_authdes_verf(XDR *xdrs, struct authdes_verf *verf)
{
	/*
	 * Unrolled xdr
	 */
	ATTEMPT(xdr_opaque(xdrs, (caddr_t)&verf->adv_xtimestamp,
	    sizeof (des_block)));
	ATTEMPT(xdr_opaque(xdrs, (caddr_t)&verf->adv_int_u,
	    sizeof (verf->adv_int_u)));
	return (TRUE);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2014 Gary Mills
 * Copyright 2001 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 * Copyright (c) 2018, Joyent, Inc.
 */

/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved  	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

/*
 * Miscellaneous support routines for kernel implentation of AUTH_DES
 */

/*
 *  rtime - get time from remote machine
 *
 *  sets time, obtaining value from host
 *  on the udp/time socket.  Since timeserver returns
 *  with time of day in seconds since Jan 1, 1900,  must
 *  subtract 86400(365*70 + 17) to get time
 *  since Jan 1, 1970, which is what get/settimeofday
 *  uses.
 */
#include <sys/param.h>
#include <sys/types.h>
#include <sys/time.h>
#include <sys/systm.h>
#include <sys/errno.h>
#include <sys/proc.h>
#include <sys/user.h>
#include <sys/socket.h>
#include <sys/sysmacros.h>
#include <netinet/in.h>
#include <rpc/rpc.h>
#include <sys/stream.h>
#include <sys/strsubr.h>
#include <sys/cred.h>
#include <sys/utsname.h>
#include <sys/vnode.h>
#include <sys/file.h>
#include <sys/uio.h>
#include <sys/systeminfo.h>
#include <rpc/rpcb_prot.h>
#include <sys/cmn_err.h>

#define	TOFFSET ((uint32_t)86400 * (365 * 70 + (70 / 4)))
#define	WRITTEN ((uint32_t)86400 * (365 * 86 + (86 / 4)))

#define	NC_INET	"inet"		/* XXX */

int
rtime(struct knetconfig *synconfig, struct netbuf *addrp, int calltype,
	struct timeval *timep, struct timeval *wait)
{
	int			error;
	int			timo;
	time_t			thetime;
	int32_t			srvtime;
	uint32_t		dummy;
	struct t_kunitdata	*unitdata;
	struct t_call		*server;
	TIUSER			*tiptr;
	int			type;
	int			uderr;
	int			i;
	int			retries;
	mblk_t			*mp;
	mblk_t			*mp2;

	retries = 5;
	if (calltype == 0) {
again:
		RPCLOG0(8, "rtime: using old method\n");
		if ((error = t_kopen(NULL, synconfig->knc_rdev,
		    FREAD|FWRITE, &tiptr, CRED())) != 0) {
			RPCLOG(1, "rtime: t_kopen %d\n", error);
			return (-1);
		}

		if ((error = t_kbind(tiptr, NULL, NULL)) != 0) {
			(void) t_kclose(tiptr, 1);
			RPCLOG(1, "rtime: t_kbind %d\n", error);
			return (-1);
		}

		if (synconfig->knc_semantics == NC_TPI_CLTS) {
			if ((error = t_kalloc(tiptr, T_UNITDATA,
			    T_UDATA|T_ADDR, (char **)&unitdata)) != 0) {
				RPCLOG(1, "rtime: t_kalloc %d\n", error);
				(void) t_kclose(tiptr, 1);
				return (-1);
			}

			unitdata->addr.len = addrp->len;
			bcopy(addrp->buf, unitdata->addr.buf,
			    unitdata->addr.len);

			dummy = 0;
			unitdata->udata.buf = (caddr_t)&dummy;
			unitdata->udata.len = sizeof (dummy);

			if ((error = t_ksndudata(tiptr, unitdata, NULL)) !=
			    0) {
				RPCLOG(1, "rtime: t_ksndudata %d\n", error);
				(void) t_kfree(tiptr, (char *)unitdata,
				    T_UNITDATA);
				(void) t_kclose(tiptr, 1);
				return (-1);
			}

			timo = TIMEVAL_TO_TICK(wait);

			RPCLOG(8, "rtime: timo %x\n", timo);
			if ((error = t_kspoll(tiptr, timo, READWAIT,
			    &type)) != 0) {
				RPCLOG(1, "rtime: t_kspoll %d\n", error);
				(void) t_kfree(tiptr, (char *)unitdata,
				    T_UNITDATA);
				(void) t_kclose(tiptr, 1);
				return (-1);
			}

			if (type == 0) {
				RPCLOG0(1, "rtime: t_kspoll timed out\n");
				(void) t_kfree(tiptr, (char *)unitdata,
				    T_UNITDATA);
				(void) t_kclose(tiptr, 1);
				return (-1);
			}

			error = t_krcvudata(tiptr, unitdata, &type, &uderr);
			if (error != 0) {
				RPCLOG(1, "rtime: t_krcvudata %d\n", error);
				(void) t_kfree(tiptr, (char *)unitdata,
				    T_UNITDATA);
				(void) t_kclose(tiptr, 1);
				if (error == EBADMSG && retries-- > 0)
					goto again;
				return (-1);
			}

			if (type == T_UDERR) {
				if (bcmp(addrp->buf, unitdata->addr.buf,
				    unitdata->addr.len) != 0) {
				/*
				 * Response comes from some other
				 * destination:
				 * ignore it since it's not related to the
				 * request we just sent out.
				 */
					(void) t_kfree(tiptr, (char *)unitdata,
					    T_UNITDATA);
					(void) t_kclose(tiptr, 1);
					goto again;
				}
			}

			if (type != T_DATA) {
				RPCLOG(1,
				    "rtime: t_krcvudata returned type %d\n",
				    type);
				(void) t_kfree(tiptr, (char *)unitdata,
				    T_UNITDATA);
				(void) t_kclose(tiptr, 1);
				if (retries-- == 0)
					return (-1);
				goto again;
			}

			if (unitdata->udata.len < sizeof (uint32_t)) {
				RPCLOG(1, "rtime: bad rcvd length %d\n",
				    unitdata->udata.len);
				(void) t_kfree(tiptr, (char *)unitdata,
				    T_UNITDATA);
				(void) t_kclose(tiptr, 1);
				if (retries-- == 0)
					return (-1);
				goto again;
			}

			thetime = (time_t)ntohl(
			    /* LINTED pointer alignment */
			    *(uint32_t *)unitdata->udata.buf);
			(void) t_kfree(tiptr, (char *)unitdata, T_UNITDATA);

		} else {

			if ((error = t_kalloc(tiptr, T_CALL, T_ADDR,
			    (char **)&server)) != 0) {
				RPCLOG(1, "rtime: t_kalloc %d\n", error);
				(void) t_kclose(tiptr, 1);
				return (-1);
			}

			server->addr.len = addrp->len;
			bcopy(addrp->buf, server->addr.buf, server->addr.len);

			if ((error = t_kconnect(tiptr, server, NULL)) != 0) {
				RPCLOG(1, "rtime: t_kconnect %d\n", error);
				(void) t_kfree(tiptr, (char *)server, T_CALL);
				(void) t_kclose(tiptr, 1);
				return (-1);
			}
			(void) t_kfree(tiptr, (char *)server, T_CALL);

			timo = TIMEVAL_TO_TICK(wait);

			RPCLOG(8, "rtime: timo %x\n", timo);

			i = 0;
			dummy = 0;

			/* now read up to 4 bytes from the TIME server */
			while (i < sizeof (dummy)) {

				error = t_kspoll(tiptr, timo, READWAIT, &type);
				if (error != 0) {
					RPCLOG(1, "rtime: t_kspoll %d\n",
					    error);
					(void) t_kclose(tiptr, 1);
					return (-1);
				}

				if (type == 0) {
					RPCLOG0(1,
					    "rtime: t_kspoll timed out\n");
					(void) t_kclose(tiptr, 1);
					return (-1);
				}

				error = tli_recv(tiptr, &mp,
				    tiptr->fp->f_flag);
				if (error != 0) {
					RPCLOG(1, "rtime: tli_recv %d\n",
					    error);
					(void) t_kclose(tiptr, 1);
					return (-1);
				}

				if (mp->b_datap->db_type != M_DATA) {
					RPCLOG(1, "rtime: wrong msg type %d\n",
					    mp->b_datap->db_type);
					RPCLOG(1,
					    "rtime: wrong msg type: read %d"
					    " bytes\n", i);
					(void) t_kclose(tiptr, 1);
					freemsg(mp);
					return (-1);
				}

				mp2 = mp;

				/*
				 * The outer loop iterates until we reach the
				 * end of the mblk chain.
				 */
				while (mp2 != NULL) {

					/*
					 * The inner loop iterates until
					 * we've gotten 4 bytes or until
					 * the mblk is exhausted.
					 */
					while (i < sizeof (dummy) &&
					    mp2->b_rptr < mp2->b_wptr) {

						i++;

					/*
					 * We avoid big-endian/little-endian
					 * issues by serializing the result
					 * one byte at a time.
					 */
						dummy <<= 8;
						dummy += ((*mp2->b_rptr) &
						    0xFF);

						mp2->b_rptr++;
					}

					mp2 = mp2->b_cont;
				}

				freemsg(mp);
			}

			thetime = (time_t)dummy;
		}

		(void) t_kclose(tiptr, 1);

	} else {
		CLIENT			*client;
		struct timeval		timout;

		RPCLOG0(8, "rtime: using new method\n");

new_again:
		/*
		 *	We talk to rpcbind.
		 */
		error = clnt_tli_kcreate(synconfig, addrp, (rpcprog_t)RPCBPROG,
		    (rpcvers_t)RPCBVERS, 0, retries, CRED(), &client);

		if (error != 0) {
			RPCLOG(1,
			    "rtime: clnt_tli_kcreate returned %d\n", error);
			return (-1);
		}
		timout.tv_sec = 60;
		timout.tv_usec = 0;
		error = clnt_call(client, RPCBPROC_GETTIME, (xdrproc_t)xdr_void,
		    NULL, (xdrproc_t)xdr_u_int,
		    (caddr_t)&srvtime, timout);
		thetime = srvtime;
		auth_destroy(client->cl_auth);
		clnt_destroy(client);
		if (error == RPC_UDERROR) {
			if (retries-- > 0)
				goto new_again;
		}
		if (error != RPC_SUCCESS) {
			RPCLOG(1, "rtime: time sync clnt_call returned %d\n",
			    error);
			error = EIO;
			return (-1);
		}
	}

	if (calltype != 0)
		thetime += TOFFSET;

	RPCLOG(8, "rtime: thetime = %lx\n", thetime);

	if (thetime < WRITTEN) {
		RPCLOG(1, "rtime: time returned is too far in past %lx",
		    thetime);
		RPCLOG(1, "rtime: WRITTEN %x", WRITTEN);
		return (-1);
	}
	thetime -= TOFFSET;

	timep->tv_sec = thetime;
	RPCLOG(8, "rtime: timep->tv_sec = %lx\n", timep->tv_sec);
	RPCLOG(8, "rtime: machine time  = %lx\n", gethrestime_sec());
	timep->tv_usec = 0;
	RPCLOG0(8, "rtime: returning success\n");
	return (0);
}

/*
 * What is my network name?
 * WARNING: this gets the network name in sun unix format.
 * Other operating systems (non-unix) are free to put something else
 * here.
 *
 * Return 0 on success
 * Return RPC errors (non-zero values) if failed.
 */
enum clnt_stat
kgetnetname(char *netname)
{
	return (key_getnetname(netname, CRED()));
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved  	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

/*
 * authunix_prot.c
 * XDR for UNIX style authentication parameters for RPC
 */

#include <sys/param.h>
#include <sys/time.h>
#include <sys/cred.h>
#include <sys/proc.h>
#include <sys/user.h>
#include <sys/utsname.h>

#include <rpc/types.h>
#include <rpc/rpc_sztypes.h>
#include <rpc/xdr.h>
#include <rpc/auth.h>
#include <rpc/auth_unix.h>
#include <rpc/clnt.h>

/*
 * XDR for unix authentication parameters.
 */
bool_t
xdr_authunix_parms(XDR *xdrs, struct authunix_parms *p)
{
	if (xdr_u_int(xdrs, &p->aup_time) &&
	    xdr_string(xdrs, &p->aup_machname, MAX_MACHINE_NAME) &&
	    xdr_int(xdrs, (int *)&(p->aup_uid)) &&
	    xdr_int(xdrs, (int *)&(p->aup_gid)) &&
	    xdr_array(xdrs, (caddr_t *)&(p->aup_gids),
	    &(p->aup_len), NGRPS, sizeof (int),
	    (xdrproc_t)xdr_int)) {
		return (TRUE);
	}
	return (FALSE);
}

/*
 * XDR user id types (uid_t)
 */
bool_t
xdr_uid_t(XDR *xdrs, uid_t *ip)
{
#ifdef lint
	(void) (xdr_short(xdrs, (short *)ip));
	return (xdr_int32(xdrs, (int32_t *)ip));
#else
	if (sizeof (uid_t) == sizeof (int32_t)) {
		return (xdr_int(xdrs, (int32_t *)ip));
	} else {
		return (xdr_short(xdrs, (short *)ip));
	}
#endif
}

/*
 * XDR group id types (gid_t)
 */
bool_t
xdr_gid_t(XDR *xdrs, gid_t *ip)
{
#ifdef lint
	(void) (xdr_short(xdrs, (short *)ip));
	return (xdr_int32(xdrs, (int32_t *)ip));
#else
	if (sizeof (gid_t) == sizeof (int32_t)) {
		return (xdr_int32(xdrs, (int32_t *)ip));
	} else {
		return (xdr_short(xdrs, (short *)ip));
	}
#endif
}

/*
 * XDR kernel unix auth parameters.
 * Goes out of the u struct directly.
 * NOTE: this is an XDR_ENCODE only routine.
 */
bool_t
xdr_authkern(XDR *xdrs, cred_t *cr)
{
	uid_t uid;
	gid_t gid;
	uint_t len;
	caddr_t groups;
	char *name = uts_nodename();
	time_t now;

	if (xdrs->x_op != XDR_ENCODE)
		return (FALSE);

	uid = crgetuid(cr);
	gid = crgetgid(cr);
	len = crgetngroups(cr);

	if (len > NGRPS)
		len = NGRPS;

	groups = (caddr_t)crgetgroups(cr);
	now = gethrestime_sec();
	if (xdr_uint32(xdrs, (uint32_t *)&now) &&
	    xdr_string(xdrs, &name, MAX_MACHINE_NAME) &&
	    xdr_uid_t(xdrs, &uid) &&
	    xdr_gid_t(xdrs, &gid) &&
	    xdr_array(xdrs, &groups, &len, NGRPS, sizeof (gid_t), xdr_gid_t))
		return (TRUE);
	return (FALSE);
}

/*
 * XDR loopback unix auth parameters.
 * NOTE: this is an XDR_ENCODE only routine.
 */
bool_t
xdr_authloopback(XDR *xdrs, cred_t *cr)
{
	uid_t uid;
	gid_t gid;
	uint_t len;
	caddr_t groups;
	char *name = uts_nodename();
	time_t now;

	if (xdrs->x_op != XDR_ENCODE)
		return (FALSE);

	uid = crgetuid(cr);
	gid = crgetgid(cr);
	len = crgetngroups(cr);
	groups = (caddr_t)crgetgroups(cr);
	now = gethrestime_sec();
	if (xdr_uint32(xdrs, (uint32_t *)&now) &&
	    xdr_string(xdrs, &name, MAX_MACHINE_NAME) &&
	    xdr_uid_t(xdrs, &uid) &&
	    xdr_gid_t(xdrs, &gid) &&
	    xdr_array(xdrs, &groups, &len, NGROUPS_UMAX, sizeof (gid_t),
	    xdr_gid_t))
		return (TRUE);
	return (FALSE);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
 */

/*
 * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved  	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

/*
 * key_call.c, Interface to keyserver
 * key_encryptsession(agent, deskey, cr)-encrypt a session key to talk to agent
 * key_decryptsession(agent, deskey) - decrypt ditto
 * key_gendes(deskey) - generate a secure des key
 * key_getnetname(netname, cr) - get the netname from the keyserv
 * netname2user(...) - get unix credential for given name (kernel only)
 */

#include <sys/param.h>
#include <sys/types.h>
#include <sys/time.h>
#include <sys/systm.h>
#include <sys/user.h>
#include <sys/proc.h>
#include <sys/pathname.h>
#include <sys/sysmacros.h>
#include <sys/vnode.h>
#include <sys/uio.h>
#include <sys/debug.h>
#include <sys/cmn_err.h>

#include <rpc/rpc.h>
#include <rpc/key_prot.h>

#define	KEY_TIMEOUT	30	/* per-try timeout in seconds */
#define	KEY_NRETRY	6	/* number of retries */

struct auth_globals {
	struct knetconfig	auth_config;
};

static struct timeval keytrytimeout = { KEY_TIMEOUT, 0 };

static enum clnt_stat key_call(rpcproc_t, xdrproc_t, char *, xdrproc_t, char *,
    cred_t *);

/* ARGSUSED */
void *
auth_zone_init(zoneid_t zoneid)
{
	struct auth_globals *authg;

	authg = kmem_zalloc(sizeof (*authg), KM_SLEEP);
	return (authg);
}

/* ARGSUSED */
void
auth_zone_fini(zoneid_t zoneid, void *data)
{
	struct auth_globals *authg = data;

	kmem_free(authg, sizeof (*authg));
}

enum clnt_stat
key_encryptsession(char *remotename, des_block *deskey, cred_t *cr)
{
	cryptkeyarg arg;
	cryptkeyres res;
	enum clnt_stat stat;

	RPCLOG(8, "key_encryptsession(%s, ", remotename);
	RPCLOG(8, "%x", *(uint32_t *)deskey);
	RPCLOG(8, "%x)\n", *(((uint32_t *)(deskey))+1));

	arg.remotename = remotename;
	arg.deskey = *deskey;
	if ((stat = key_call(KEY_ENCRYPT, xdr_cryptkeyarg, (char *)&arg,
	    xdr_cryptkeyres, (char *)&res, cr)) != RPC_SUCCESS) {
		RPCLOG(1, "key_encryptsession(%d, ", (int)crgetuid(cr));
		RPCLOG(1, "%s): ", remotename);
		RPCLOG(1, "rpc status %d ", stat);
		RPCLOG(1, "(%s)\n", clnt_sperrno(stat));
		return (stat);
	}

	if (res.status != KEY_SUCCESS) {
		RPCLOG(1, "key_encryptsession(%d, ", (int)crgetuid(cr));
		RPCLOG(1, "%s): ", remotename);
		RPCLOG(1, "key status %d\n", res.status);
		return (RPC_FAILED);	/* XXX */
	}
	*deskey = res.cryptkeyres_u.deskey;
	return (RPC_SUCCESS);
}

enum clnt_stat
key_decryptsession(char *remotename, des_block *deskey)
{
	cryptkeyarg arg;
	cryptkeyres res;
	enum clnt_stat stat;

	RPCLOG(8, "key_decryptsession(%s, ", remotename);
	RPCLOG(2, "%x", *(uint32_t *)deskey);
	RPCLOG(2, "%x)\n", *(((uint32_t *)(deskey))+1));

	arg.remotename = remotename;
	arg.deskey = *deskey;
	if ((stat = key_call(KEY_DECRYPT, xdr_cryptkeyarg, (char *)&arg,
	    xdr_cryptkeyres, (char *)&res, kcred)) != RPC_SUCCESS) {
		RPCLOG(1, "key_decryptsession(%s): ", remotename);
		RPCLOG(1, "rpc status %d ", stat);
		RPCLOG(1, "(%s)\n", clnt_sperrno(stat));
		return (stat);
	}

	if (res.status != KEY_SUCCESS) {
		RPCLOG(1, "key_decryptsession(%s): ", remotename);
		RPCLOG(1, "key status %d\n", res.status);
		return (RPC_FAILED);	/* XXX */
	}
	*deskey = res.cryptkeyres_u.deskey;
	return (RPC_SUCCESS);
}

enum clnt_stat
key_gendes(des_block *key)
{

	return (key_call(KEY_GEN, xdr_void, NULL, xdr_des_block, (char *)key,
	    CRED()));
}

/*
 *  Call up to keyserv to get the netname of the client based
 *  on its uid.  The netname is written into the string that "netname"
 *  points to; the caller is responsible for ensuring that sufficient space
 *  is available.
 */
enum clnt_stat
key_getnetname(netname, cr)
	char *netname;
	cred_t *cr;
{
	key_netstres kres;
	enum clnt_stat stat;

	/*
	 * Look up the keyserv interface routines to see if
	 * netname is stored there.
	 */
	kres.key_netstres_u.knet.st_netname = netname;
	if ((stat = key_call((rpcproc_t)KEY_NET_GET, xdr_void, NULL,
	    xdr_key_netstres, (char *)&kres, cr)) != RPC_SUCCESS) {
		RPCLOG(1, "key_getnetname(%d): ", (int)crgetuid(cr));
		RPCLOG(1, "rpc status %d ", stat);
		RPCLOG(1, "(%s)\n", clnt_sperrno(stat));
		return (stat);
	}

	if (kres.status != KEY_SUCCESS) {
		RPCLOG(1, "key_getnetname(%d): ", (int)crgetuid(cr));
		RPCLOG(1, "key status %d\n", kres.status);
		return (RPC_FAILED);
	}

	return (RPC_SUCCESS);
}

enum clnt_stat
netname2user(char *name, uid_t *uid, gid_t *gid, int *len, gid_t *groups)
{
	struct getcredres res;
	enum clnt_stat stat;

	res.getcredres_u.cred.gids.gids_val = (uint_t *)groups;
	if ((stat = key_call(KEY_GETCRED, xdr_netnamestr, (char *)&name,
	    xdr_getcredres, (char *)&res, CRED())) != RPC_SUCCESS) {
		RPCLOG(1, "netname2user(%s): ", name);
		RPCLOG(1, "rpc status %d ", stat);
		RPCLOG(1, "(%s)\n", clnt_sperrno(stat));
		return (stat);
	}

	if (res.status != KEY_SUCCESS) {
		RPCLOG(1, "netname2user(%s): ", name);
		RPCLOG(1, "key status %d\n", res.status);
		return (RPC_FAILED);	/* XXX */
	}
	*uid = res.getcredres_u.cred.uid;
	*gid = res.getcredres_u.cred.gid;
	*len = res.getcredres_u.cred.gids.gids_len;
	return (RPC_SUCCESS);
}

#define	NC_LOOPBACK		"loopback"	/* XXX */
char loopback_name[] = NC_LOOPBACK;

static enum clnt_stat
key_call(rpcproc_t procn, xdrproc_t xdr_args, caddr_t args,
	xdrproc_t xdr_rslt, caddr_t rslt, cred_t *cr)
{
	struct netbuf netaddr;
	CLIENT *client;
	enum clnt_stat stat;
	vnode_t *vp;
	int error;
	struct auth_globals *authg;
	struct knetconfig *configp;
	k_sigset_t smask;

	authg = zone_getspecific(auth_zone_key, curproc->p_zone);
	configp = &authg->auth_config;

	/* strlen("localhost.keyserv") is 17 */
	netaddr.len = netaddr.maxlen = 17;
	netaddr.buf = "localhost.keyserv";

	/*
	 * filch a knetconfig structure.
	 */
	if (configp->knc_rdev == 0) {
		if ((error = lookupname("/dev/ticlts", UIO_SYSSPACE,
		    FOLLOW, NULLVPP, &vp)) != 0) {
			RPCLOG(1, "key_call: lookupname: %d\n", error);
			return (RPC_UNKNOWNPROTO);
		}
		configp->knc_rdev = vp->v_rdev;
		configp->knc_protofmly = loopback_name;
		VN_RELE(vp);
	}
	configp->knc_semantics = NC_TPI_CLTS;
	RPCLOG(8, "key_call: procn %d, ", procn);
	RPCLOG(8, "rdev %lx, ", configp->knc_rdev);
	RPCLOG(8, "len %d, ", netaddr.len);
	RPCLOG(8, "maxlen %d, ", netaddr.maxlen);
	RPCLOG(8, "name %p\n", (void *)netaddr.buf);

	/*
	 * now call the proper stuff.
	 */
	error = clnt_tli_kcreate(configp, &netaddr, KEY_PROG, KEY_VERS,
	    0, KEY_NRETRY, cr, &client);

	if (error != 0) {
		RPCLOG(1, "key_call: clnt_tli_kcreate: error %d\n", error);
		switch (error) {
		case EINTR:
			return (RPC_INTR);
		case ETIMEDOUT:
			return (RPC_TIMEDOUT);
		default:
			return (RPC_FAILED);	/* XXX */
		}
	}

	auth_destroy(client->cl_auth);
	client->cl_auth = authloopback_create();
	if (client->cl_auth == NULL) {
		clnt_destroy(client);
		RPCLOG(1, "key_call: authloopback_create: error %d\n", EINTR);
		return (RPC_INTR);
	}

	/* Mask out all signals except SIGHUP, SIGQUIT, and SIGTERM. */
	sigintr(&smask, 0);
	stat = clnt_call(client, procn, xdr_args, args, xdr_rslt, rslt,
	    keytrytimeout);
	sigunintr(&smask);

	auth_destroy(client->cl_auth);
	clnt_destroy(client);
	if (stat != RPC_SUCCESS) {
		RPCLOG(1, "key_call: keyserver clnt_call failed: stat %d ",
		    stat);
		RPCLOG(1, "(%s)\n", clnt_sperrno(stat));
		RPCLOG0(1, "\n");
		return (stat);
	}
	RPCLOG(8, "key call: (%d) ok\n", procn);
	return (RPC_SUCCESS);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Please do not edit this file.
 * It was generated using rpcgen.
 */

#include <rpc/key_prot.h>
/* @(#)key_prot.x	1.10 90/01/03 Copyright (c)  1990, 1991 SMI */

/*
 * Compiled from key_prot.x using rpcgen.
 * DO NOT EDIT THIS FILE!
 * This is NOT source code!
 */

bool_t
xdr_keystatus(XDR *xdrs, keystatus *objp)
{
	if (!xdr_enum(xdrs, (enum_t *)objp))
		return (FALSE);
	return (TRUE);
}

bool_t
xdr_keybuf(XDR *xdrs, keybuf objp)
{
	if (!xdr_opaque(xdrs, objp, HEXKEYBYTES))
		return (FALSE);
	return (TRUE);
}

bool_t
xdr_netnamestr(XDR *xdrs, netnamestr *objp)
{
	if (!xdr_string(xdrs, objp, MAXNETNAMELEN))
		return (FALSE);

	return (TRUE);
}

bool_t
xdr_cryptkeyarg(XDR *xdrs, cryptkeyarg *objp)
{
	if (!xdr_netnamestr(xdrs, &objp->remotename))
		return (FALSE);
	if (!xdr_des_block(xdrs, &objp->deskey))
		return (FALSE);
	return (TRUE);
}

bool_t
xdr_cryptkeyarg2(XDR *xdrs, cryptkeyarg2 *objp)
{
	if (!xdr_netnamestr(xdrs, &objp->remotename))
		return (FALSE);
	if (!xdr_netobj(xdrs, &objp->remotekey))
		return (FALSE);
	if (!xdr_des_block(xdrs, &objp->deskey))
		return (FALSE);
	return (TRUE);
}

bool_t
xdr_cryptkeyres(XDR *xdrs, cryptkeyres *objp)
{
	if (!xdr_keystatus(xdrs, &objp->status))
		return (FALSE);
	switch (objp->status) {
	case KEY_SUCCESS:
		if (!xdr_des_block(xdrs, &objp->cryptkeyres_u.deskey))
			return (FALSE);
		break;
	default:
		break;
	}
	return (TRUE);
}

bool_t
xdr_unixcred(XDR *xdrs, unixcred *objp)
{
	if (!xdr_u_int(xdrs, &objp->uid))
		return (FALSE);
	if (!xdr_u_int(xdrs, &objp->gid))
		return (FALSE);
	if (!xdr_array(xdrs, (char **)&objp->gids.gids_val,
	    (uint_t *)&objp->gids.gids_len, MAXGIDS,
	    sizeof (uint_t), (xdrproc_t)xdr_u_int))
		return (FALSE);
	return (TRUE);
}

bool_t
xdr_getcredres(XDR *xdrs, getcredres *objp)
{
	if (!xdr_keystatus(xdrs, &objp->status))
		return (FALSE);
	switch (objp->status) {
	case KEY_SUCCESS:
		if (!xdr_unixcred(xdrs, &objp->getcredres_u.cred))
			return (FALSE);
		break;
	default:
		break;
	}
	return (TRUE);
}

bool_t
xdr_key_netstarg(XDR *xdrs, key_netstarg *objp)
{
	if (!xdr_keybuf(xdrs, objp->st_priv_key))
		return (FALSE);
	if (!xdr_keybuf(xdrs, objp->st_pub_key))
		return (FALSE);


	if (!xdr_netnamestr(xdrs, &objp->st_netname))
		return (FALSE);

	return (TRUE);
}

bool_t
xdr_key_netstres(XDR *xdrs, key_netstres *objp)
{
	if (!xdr_keystatus(xdrs, &objp->status))
		return (FALSE);
	switch (objp->status) {
	case KEY_SUCCESS:
		if (!xdr_key_netstarg(xdrs, &objp->key_netstres_u.knet))
			return (FALSE);
		break;
	default:
		break;
	}
	return (TRUE);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
 */

#include <sys/param.h>
#include <sys/types.h>
#include <sys/systm.h>
#include <sys/cred.h>
#include <sys/proc.h>
#include <sys/user.h>
#include <sys/time.h>
#include <sys/buf.h>
#include <sys/vfs.h>
#include <sys/vnode.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/uio.h>
#include <sys/tiuser.h>
#include <sys/swap.h>
#include <sys/errno.h>
#include <sys/debug.h>
#include <sys/kmem.h>
#include <sys/kstat.h>
#include <sys/cmn_err.h>
#include <sys/vtrace.h>
#include <sys/session.h>
#include <sys/dnlc.h>
#include <sys/bitmap.h>
#include <sys/thread.h>
#include <sys/policy.h>

#include <netinet/in.h>
#include <rpc/types.h>
#include <rpc/xdr.h>
#include <rpc/auth.h>
#include <rpc/auth_des.h>	/* for authdes_create() */
#include <rpc/clnt.h>
#include <rpc/rpcsec_gss.h>

#define	MAXCLIENTS	16

/*
 * Currently there is no maximum length defined withing the gss
 * specification. Because of security issues the maximum gss
 * authentication length is checked to be under the MAXAUTHLEN
 * defined below. The value was chosen because it will be a safe
 * maximum value for some time.  Currently lengths are generally
 * under the 16 byte length
 */
#define	MINAUTHLEN	1	/* minimum gss authentication length */
#define	MAXAUTHLEN	65535	/* maximum gss authentication length */
static int clnt_authdes_cachesz = 64;

static uint_t authdes_win = 5*60;  /* 5 minutes -- should be mount option */

struct kmem_cache *authkern_cache;

struct kmem_cache *authnone_cache;

struct kmem_cache *authloopback_cache;

static struct desauthent {
	struct	sec_data *da_data;
	uid_t da_uid;
	zoneid_t da_zoneid;
	short da_inuse;
	AUTH *da_auth;
} *desauthtab;
static int nextdesvictim;
static kmutex_t desauthtab_lock;	/* Lock to protect DES auth cache */

/* RPC stuff */
kmutex_t authdes_ops_lock;   /* auth_ops initialization in authdes_ops() */

static void  purge_authtab(struct sec_data *);

/* Zone stuff */
zone_key_t auth_zone_key;

/*
 *  Load RPCSEC_GSS specific data from user space to kernel space.
 */
/*ARGSUSED*/
static int
gss_clnt_loadinfo(caddr_t usrdata, caddr_t *kdata, model_t model)
{
	struct gss_clnt_data *data;
	caddr_t	elements;
	int error = 0;

	/* map opaque data to gss specific structure */
	data = kmem_alloc(sizeof (*data), KM_SLEEP);

#ifdef _SYSCALL32_IMPL
	if (model != DATAMODEL_NATIVE) {
		struct gss_clnt_data32 gd32;

		if (copyin(usrdata, &gd32, sizeof (gd32)) == -1) {
			error = EFAULT;
		} else {
			data->mechanism.length = gd32.mechanism.length;
			data->mechanism.elements =
			    (caddr_t)(uintptr_t)gd32.mechanism.elements;
			data->service = gd32.service;
			bcopy(gd32.uname, data->uname, sizeof (gd32.uname));
			bcopy(gd32.inst, data->inst, sizeof (gd32.inst));
			bcopy(gd32.realm, data->realm, sizeof (gd32.realm));
			data->qop = gd32.qop;
		}
	} else
#endif /* _SYSCALL32_IMPL */
	if (copyin(usrdata, data, sizeof (*data)))
		error = EFAULT;

	if (error == 0) {
		if (data->mechanism.length >= MINAUTHLEN &&
		    data->mechanism.length <= MAXAUTHLEN) {
			elements = kmem_alloc(data->mechanism.length, KM_SLEEP);
			if (!(copyin(data->mechanism.elements, elements,
			    data->mechanism.length))) {
				data->mechanism.elements = elements;
				*kdata = (caddr_t)data;
				return (0);
			}
			kmem_free(elements, data->mechanism.length);
		}
	}
	*kdata = NULL;
	kmem_free(data, sizeof (*data));

	return (EFAULT);
}


/*
 *  Load AUTH_DES specific data from user space to kernel space.
 */
/*ARGSUSED2*/
int
dh_k4_clnt_loadinfo(caddr_t usrdata, caddr_t *kdata, model_t model)
{
	size_t nlen;
	int error = 0;
	char *userbufptr;
	dh_k4_clntdata_t *data;
	char netname[MAXNETNAMELEN+1];
	struct netbuf *syncaddr;
	struct knetconfig *knconf;

	/* map opaque data to des specific strucutre */
	data = kmem_alloc(sizeof (*data), KM_SLEEP);

#ifdef _SYSCALL32_IMPL
	if (model != DATAMODEL_NATIVE) {
		struct des_clnt_data32 data32;

		if (copyin(usrdata, &data32, sizeof (data32)) == -1) {
			error = EFAULT;
		} else {
			data->syncaddr.maxlen = data32.syncaddr.maxlen;
			data->syncaddr.len = data32.syncaddr.len;
			data->syncaddr.buf =
			    (caddr_t)(uintptr_t)data32.syncaddr.buf;
			data->knconf =
			    (struct knetconfig *)(uintptr_t)data32.knconf;
			data->netname = (caddr_t)(uintptr_t)data32.netname;
			data->netnamelen = data32.netnamelen;
		}
	} else
#endif /* _SYSCALL32_IMPL */
	if (copyin(usrdata, data, sizeof (*data)))
		error = EFAULT;

	if (error == 0) {
		syncaddr = &data->syncaddr;
		if (syncaddr->len < MINAUTHLEN || syncaddr->len > MAXAUTHLEN)
			error = EINVAL;
		else {
			userbufptr = syncaddr->buf;
			syncaddr->buf = kmem_alloc(syncaddr->len, KM_SLEEP);
			syncaddr->maxlen = syncaddr->len;
			if (copyin(userbufptr, syncaddr->buf, syncaddr->len)) {
				kmem_free(syncaddr->buf, syncaddr->len);
				syncaddr->buf = NULL;
				error = EFAULT;
			} else {
				(void) copyinstr(data->netname, netname,
				    sizeof (netname), &nlen);
				if (nlen != 0) {
					data->netname =
					    kmem_alloc(nlen, KM_SLEEP);
					bcopy(netname, data->netname, nlen);
					data->netnamelen = (int)nlen;
				}
			}
		}
	}

	if (!error) {
		/*
		 * Allocate space for a knetconfig structure and
		 * its strings and copy in from user-land.
		 */
		knconf = kmem_alloc(sizeof (*knconf), KM_SLEEP);
#ifdef _SYSCALL32_IMPL
		if (model != DATAMODEL_NATIVE) {
			struct knetconfig32 knconf32;

			if (copyin(data->knconf, &knconf32,
			    sizeof (knconf32)) == -1) {
				kmem_free(knconf, sizeof (*knconf));
				kmem_free(syncaddr->buf, syncaddr->len);
				syncaddr->buf = NULL;
				kmem_free(data->netname, nlen);
				error = EFAULT;
			} else {
				knconf->knc_semantics = knconf32.knc_semantics;
				knconf->knc_protofmly =
				    (caddr_t)(uintptr_t)knconf32.knc_protofmly;
				knconf->knc_proto =
				    (caddr_t)(uintptr_t)knconf32.knc_proto;
				knconf->knc_rdev = expldev(knconf32.knc_rdev);
			}
		} else
#endif /* _SYSCALL32_IMPL */
		if (copyin(data->knconf, knconf, sizeof (*knconf))) {
			kmem_free(knconf, sizeof (*knconf));
			kmem_free(syncaddr->buf, syncaddr->len);
			syncaddr->buf = NULL;
			kmem_free(data->netname, nlen);
			error = EFAULT;
		}
	}

	if (!error) {
		size_t nmoved_tmp;
		char *p, *pf;

		pf = kmem_alloc(KNC_STRSIZE, KM_SLEEP);
		p = kmem_alloc(KNC_STRSIZE, KM_SLEEP);
		error = copyinstr(knconf->knc_protofmly, pf,
		    KNC_STRSIZE, &nmoved_tmp);
		if (error) {
			kmem_free(pf, KNC_STRSIZE);
			kmem_free(p, KNC_STRSIZE);
			kmem_free(knconf, sizeof (*knconf));
			kmem_free(syncaddr->buf, syncaddr->len);
			kmem_free(data->netname, nlen);
		}

		if (!error) {
			error = copyinstr(knconf->knc_proto,
			    p, KNC_STRSIZE, &nmoved_tmp);
			if (error) {
				kmem_free(pf, KNC_STRSIZE);
				kmem_free(p, KNC_STRSIZE);
				kmem_free(knconf, sizeof (*knconf));
				kmem_free(syncaddr->buf, syncaddr->len);
				kmem_free(data->netname, nlen);
			}
		}

		if (!error) {
			knconf->knc_protofmly = pf;
			knconf->knc_proto = p;
		}
	}

	if (error) {
		*kdata = NULL;
		kmem_free(data, sizeof (*data));
		return (error);
	}

	data->knconf = knconf;
	*kdata = (caddr_t)data;
	return (0);
}

/*
 *  Free up AUTH_DES specific data.
 */
void
dh_k4_clnt_freeinfo(caddr_t cdata)
{
	dh_k4_clntdata_t *data;

	data = (dh_k4_clntdata_t *)cdata;
	if (data->netnamelen > 0) {
		kmem_free(data->netname, data->netnamelen);
	}
	if (data->syncaddr.buf != NULL) {
		kmem_free(data->syncaddr.buf, data->syncaddr.len);
	}
	if (data->knconf != NULL) {
		kmem_free(data->knconf->knc_protofmly, KNC_STRSIZE);
		kmem_free(data->knconf->knc_proto, KNC_STRSIZE);
		kmem_free(data->knconf, sizeof (*data->knconf));
	}

	kmem_free(data, sizeof (*data));
}

/*
 *  Load application auth related data from user land to kernel.
 *  Map opaque data field to dh_k4_clntdata_t for AUTH_DES
 *
 */
int
sec_clnt_loadinfo(struct sec_data *in, struct sec_data **out, model_t model)
{
	struct	sec_data	*secdata;
	int	error = 0;

	secdata = kmem_alloc(sizeof (*secdata), KM_SLEEP);

#ifdef _SYSCALL32_IMPL
	if (model != DATAMODEL_NATIVE) {
		struct sec_data32 sd32;

		if (copyin(in, &sd32, sizeof (sd32)) == -1) {
			error = EFAULT;
		} else {
			secdata->secmod = sd32.secmod;
			secdata->rpcflavor = sd32.rpcflavor;
			secdata->uid = sd32.uid;
			secdata->flags = sd32.flags;
			secdata->data = (caddr_t)(uintptr_t)sd32.data;
		}
	} else
#endif /* _SYSCALL32_IMPL */

	if (copyin(in, secdata, sizeof (*secdata)) == -1) {
		error = EFAULT;
	}
	/*
	 * Copy in opaque data field per flavor.
	 */
	if (!error) {
		switch (secdata->rpcflavor) {
		case AUTH_NONE:
		case AUTH_UNIX:
		case AUTH_LOOPBACK:
			break;

		case AUTH_DES:
			error = dh_k4_clnt_loadinfo(secdata->data,
			    &secdata->data, model);
			break;

		case RPCSEC_GSS:
			error = gss_clnt_loadinfo(secdata->data,
			    &secdata->data, model);
			break;

		default:
			error = EINVAL;
			break;
		}
	}

	if (!error) {
		*out = secdata;
	} else {
		kmem_free(secdata, sizeof (*secdata));
		*out = (struct sec_data *)NULL;
	}

	return (error);
}

/*
 * Null the sec_data index in the cache table, and
 * free the memory allocated by sec_clnt_loadinfo.
 */
void
sec_clnt_freeinfo(struct sec_data *secdata)
{
	switch (secdata->rpcflavor) {
	case AUTH_DES:
		purge_authtab(secdata);
		if (secdata->data)
			dh_k4_clnt_freeinfo(secdata->data);
		break;

	case RPCSEC_GSS:
		rpc_gss_secpurge((void *)secdata);
		if (secdata->data) {
			gss_clntdata_t *gss_data;

			gss_data = (gss_clntdata_t *)secdata->data;
			if (gss_data->mechanism.elements) {
				kmem_free(gss_data->mechanism.elements,
				    gss_data->mechanism.length);
			}
			kmem_free(secdata->data, sizeof (gss_clntdata_t));
		}
		break;

	case AUTH_NONE:
	case AUTH_UNIX:
	case AUTH_LOOPBACK:
	default:
		break;
	}
	kmem_free(secdata, sizeof (*secdata));
}

/*
 *  Get an AUTH handle for a RPC client based on the given sec_data.
 *  If an AUTH handle exists for the same sec_data, use that AUTH handle,
 *  otherwise create a new one.
 */
int
sec_clnt_geth(CLIENT *client, struct sec_data *secdata, cred_t *cr, AUTH **ap)
{
	int i;
	struct desauthent *da;
	int authflavor;
	cred_t *savecred;
	int stat;			/* return (errno) status */
	char gss_svc_name[MAX_GSS_NAME];
	dh_k4_clntdata_t	*desdata;
	AUTH *auth;
	gss_clntdata_t *gssdata;
	zoneid_t zoneid = getzoneid();

	if ((client == NULL) || (secdata == NULL) || (ap == NULL))
		return (EINVAL);
	*ap = (AUTH *)NULL;

	authflavor = secdata->rpcflavor;
	for (;;) {
		int nlen;
		char *netname;

		switch (authflavor) {
		case AUTH_NONE:
			*ap = (AUTH *) authnone_create();
			return ((*ap != NULL) ? 0 : EINTR);

		case AUTH_UNIX:
			*ap = (AUTH *) authkern_create();
			return ((*ap != NULL) ? 0 : EINTR);

		case AUTH_LOOPBACK:
			*ap = (AUTH *) authloopback_create();
			return ((*ap != NULL) ? 0 : EINTR);

		case AUTH_DES:
			mutex_enter(&desauthtab_lock);
			if (desauthtab == NULL) {
				desauthtab = kmem_zalloc(clnt_authdes_cachesz *
				    sizeof (struct desauthent), KM_SLEEP);
			}
			for (da = desauthtab;
			    da < &desauthtab[clnt_authdes_cachesz];
			    da++) {
				if (da->da_data == secdata &&
				    da->da_uid == crgetuid(cr) &&
				    da->da_zoneid == zoneid &&
				    !da->da_inuse &&
				    da->da_auth != NULL) {
					da->da_inuse = 1;
					mutex_exit(&desauthtab_lock);
					*ap = da->da_auth;
					return (0);
				}
			}
			mutex_exit(&desauthtab_lock);

			/*
			 *  A better way would be to have a cred paramater to
			 *  authdes_create.
			 */
			savecred = curthread->t_cred;
			curthread->t_cred = cr;

			/*
			 * Note that authdes_create() expects a
			 * NUL-terminated string for netname, but
			 * dh_k4_clntdata_t gives us netname & netnamelen.
			 *
			 * We must create a string for authdes_create();
			 * the latter takes a copy of it, so we may
			 * immediately free it.
			 */
			desdata = (dh_k4_clntdata_t *)secdata->data;
			nlen = desdata->netnamelen;
			/* must be NUL-terminated */
			netname = kmem_zalloc(nlen + 1, KM_SLEEP);
			bcopy(desdata->netname, netname, nlen);
			stat = authdes_create(netname, authdes_win,
			    &desdata->syncaddr, desdata->knconf,
			    (des_block *)NULL,
			    (secdata->flags & AUTH_F_RPCTIMESYNC) ? 1 : 0,
			    &auth);
			kmem_free(netname, nlen + 1);

			curthread->t_cred = savecred;
			*ap = auth;

			if (stat != 0) {
				/*
				 *  If AUTH_F_TRYNONE is on, try again
				 *  with AUTH_NONE.  See bug 1180236.
				 */
				if (secdata->flags & AUTH_F_TRYNONE) {
					authflavor = AUTH_NONE;
					continue;
				} else
					return (stat);
			}

			i = clnt_authdes_cachesz;
			mutex_enter(&desauthtab_lock);
			do {
				da = &desauthtab[nextdesvictim++];
				nextdesvictim %= clnt_authdes_cachesz;
			} while (da->da_inuse && --i > 0);

			if (da->da_inuse) {
				mutex_exit(&desauthtab_lock);
				/* overflow of des auths */
				return (stat);
			}
			da->da_inuse = 1;
			mutex_exit(&desauthtab_lock);

			if (da->da_auth != NULL)
				auth_destroy(da->da_auth);

			da->da_auth = auth;
			da->da_uid = crgetuid(cr);
			da->da_zoneid = zoneid;
			da->da_data = secdata;
			return (stat);

		case RPCSEC_GSS:
			/*
			 *  For RPCSEC_GSS, cache is done in rpc_gss_secget().
			 *  For every rpc_gss_secget(),  it should have
			 *  a corresponding rpc_gss_secfree() call.
			 */
			gssdata = (gss_clntdata_t *)secdata->data;
			(void) sprintf(gss_svc_name, "%s@%s", gssdata->uname,
			    gssdata->inst);

			stat = rpc_gss_secget(client, gss_svc_name,
			    &gssdata->mechanism,
			    gssdata->service,
			    gssdata->qop,
			    NULL, NULL,
			    (caddr_t)secdata, cr, &auth);
			*ap = auth;

			/* success */
			if (stat == 0)
				return (stat);

			/*
			 * let the caller retry if connection timedout
			 * or reset.
			 */
			if (stat == ETIMEDOUT || stat == ECONNRESET)
				return (stat);

			/*
			 *  If AUTH_F_TRYNONE is on, try again
			 *  with AUTH_NONE.  See bug 1180236.
			 */
			if (secdata->flags & AUTH_F_TRYNONE) {
				authflavor = AUTH_NONE;
				continue;
			}

			RPCLOG(1, "sec_clnt_geth: rpc_gss_secget"
			    " failed with %d", stat);
			return (stat);

		default:
			/*
			 * auth create must have failed, try AUTH_NONE
			 * (this relies on AUTH_NONE never failing)
			 */
			cmn_err(CE_NOTE, "sec_clnt_geth: unknown "
			    "authflavor %d, trying AUTH_NONE", authflavor);
			authflavor = AUTH_NONE;
		}
	}
}

void
sec_clnt_freeh(AUTH *auth)
{
	struct desauthent *da;

	switch (auth->ah_cred.oa_flavor) {
	case AUTH_NONE: /* XXX: do real AUTH_NONE */
	case AUTH_UNIX:
	case AUTH_LOOPBACK:
		auth_destroy(auth);	/* was overflow */
		break;

	case AUTH_DES:
		mutex_enter(&desauthtab_lock);
		if (desauthtab != NULL) {
			for (da = desauthtab;
			    da < &desauthtab[clnt_authdes_cachesz]; da++) {
				if (da->da_auth == auth) {
					da->da_inuse = 0;
					mutex_exit(&desauthtab_lock);
					return;
				}
			}
		}
		mutex_exit(&desauthtab_lock);
		auth_destroy(auth);	/* was overflow */
		break;

	case RPCSEC_GSS:
		(void) rpc_gss_secfree(auth);
		break;

	default:
		cmn_err(CE_NOTE, "sec_clnt_freeh: unknown authflavor %d",
		    auth->ah_cred.oa_flavor);
		break;
	}
}

/*
 *  Revoke the authentication key in the given AUTH handle by setting
 *  it to NULL.  If newkey is true, then generate a new key instead of
 *  nulling out the old one.  This is necessary for AUTH_DES because
 *  the new key will be used next time the user does a keylogin.  If
 *  the zero'd key is used as actual key, then it cannot be revoked
 *  again!
 */
void
revoke_key(AUTH *auth, int newkey)
{
	if (auth == NULL)
		return;

	if (newkey) {
		if (key_gendes(&auth->ah_key) != RPC_SUCCESS) {
			/* failed to get new key, munge the old one */
			auth->ah_key.key.high ^= auth->ah_key.key.low;
			auth->ah_key.key.low  += auth->ah_key.key.high;
		}
	} else {
		/* null out old key */
		auth->ah_key.key.high = 0;
		auth->ah_key.key.low  = 0;
	}
}

/*
 *  Revoke all rpc credentials (of the selected auth type) for the given uid
 *  from the auth cache.  Must be root to do this if the requested uid is not
 *  the effective uid of the requestor.
 *
 *  Called from nfssys() for backward compatibility, and also
 *  called from krpc_sys().
 *
 *  AUTH_DES does not refer to the "mechanism" information.
 *  RPCSEC_GSS requires the "mechanism" input.
 *  The input argument, mechanism, is a user-space address and needs
 *  to be copied into the kernel address space.
 *
 *  Returns error number.
 */
/*ARGSUSED*/
int
sec_clnt_revoke(int rpcflavor, uid_t uid, cred_t *cr, void *mechanism,
						model_t model)
{
	struct desauthent *da;
	int error = 0;
	zoneid_t zoneid = getzoneid();

	if (uid != crgetuid(cr) && secpolicy_nfs(cr) != 0)
		return (EPERM);

	switch (rpcflavor) {
	case AUTH_DES:
		mutex_enter(&desauthtab_lock);
		if (desauthtab != NULL) {
			for (da = desauthtab;
			    da < &desauthtab[clnt_authdes_cachesz]; da++) {
				if (uid == da->da_uid &&
				    zoneid == da->da_zoneid)
					revoke_key(da->da_auth, 1);
			}
		}
		mutex_exit(&desauthtab_lock);
		return (0);

	case RPCSEC_GSS: {
		rpc_gss_OID	mech;
		caddr_t		elements;

		if (!mechanism)
			return (EINVAL);

		/* copyin the gss mechanism type */
		mech = kmem_alloc(sizeof (rpc_gss_OID_desc), KM_SLEEP);
#ifdef _SYSCALL32_IMPL
		if (model != DATAMODEL_NATIVE) {
			gss_OID_desc32 mech32;

			if (copyin(mechanism, &mech32,
			    sizeof (gss_OID_desc32))) {
				kmem_free(mech, sizeof (rpc_gss_OID_desc));
				return (EFAULT);
			}
			mech->length = mech32.length;
			mech->elements = (caddr_t)(uintptr_t)mech32.elements;
		} else
#endif /* _SYSCALL32_IMPL */
		if (copyin(mechanism, mech, sizeof (rpc_gss_OID_desc))) {
			kmem_free(mech, sizeof (rpc_gss_OID_desc));
			return (EFAULT);
		}

		if (mech->length < MINAUTHLEN ||
		    mech->length > MAXAUTHLEN) {
			kmem_free(mech, sizeof (rpc_gss_OID_desc));
			return (EINVAL);
		}

		elements = kmem_alloc(mech->length, KM_SLEEP);
		if (copyin(mech->elements, elements, mech->length)) {
			kmem_free(elements, mech->length);
			kmem_free(mech, sizeof (rpc_gss_OID_desc));
			return (EFAULT);
		}
		mech->elements = elements;

		error = rpc_gss_revauth(uid, mech);

		kmem_free(elements, mech->length);
		kmem_free(mech, sizeof (rpc_gss_OID_desc));

		return (error);
	}

	default:
		/* not an auth type with cached creds */
		return (EINVAL);
	}
}

/*
 *  Since sec_data is the index for the client auth handles
 *  cache table,  whenever the sec_data is freed, the index needs
 *  to be nulled.
 */
void
purge_authtab(struct sec_data *secdata)
{
	struct desauthent *da;

	switch (secdata->rpcflavor) {

	case AUTH_DES:
		mutex_enter(&desauthtab_lock);
		if (desauthtab != NULL) {
			for (da = desauthtab;
			    da < &desauthtab[clnt_authdes_cachesz]; da++) {
				if (da->da_data == secdata) {
					da->da_data = NULL;
					da->da_inuse = 0;
				}
			}
		}
		mutex_exit(&desauthtab_lock);
		return;

	case RPCSEC_GSS:
		rpc_gss_secpurge((void *)secdata);
		return;

	default:
		return;
	}
}

void
sec_subrinit(void)
{
	authkern_cache = kmem_cache_create("authkern_cache",
	    sizeof (AUTH), 0, authkern_init, NULL, NULL, NULL, NULL, 0);
	authnone_cache = kmem_cache_create("authnone_cache",
	    sizeof (AUTH), 0, authnone_init, NULL, NULL, NULL, NULL, 0);
	authloopback_cache = kmem_cache_create("authloopback_cache",
	    sizeof (AUTH), 0, authloopback_init, NULL, NULL, NULL, NULL, 0);
	mutex_init(&desauthtab_lock, NULL, MUTEX_DEFAULT, NULL);

	/* RPC stuff */
	mutex_init(&authdes_ops_lock, NULL, MUTEX_DEFAULT, NULL);
	zone_key_create(&auth_zone_key, auth_zone_init, NULL, auth_zone_fini);
}

/*
 * Destroys the caches and mutexes previously allocated and initialized
 * in sec_subrinit().
 * This routine is called by _init() if mod_install() failed.
 */
void
sec_subrfini(void)
{
	mutex_destroy(&desauthtab_lock);
	kmem_cache_destroy(authkern_cache);
	kmem_cache_destroy(authnone_cache);
	kmem_cache_destroy(authloopback_cache);

	/* RPC stuff */
	mutex_destroy(&authdes_ops_lock);
	(void) zone_key_delete(auth_zone_key);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 1994-1999 by Sun Microsystems, Inc.
 * All rights reserved.
 */

/*
 *  From  common/syscall/systeminfo.c
 */

#include <sys/types.h>
#include <sys/systeminfo.h>	/* for SI_KERB stuff */

#include <sys/errno.h>
#include <rpc/types.h>
#include <rpc/xdr.h>
#include <rpc/auth.h>
#include <rpc/clnt.h>
#include <rpc/svc_auth.h>


/*
 * authany_wrap() is a NO-OP routines for ah_wrap().
 */
/* ARGSUSED */
int
authany_wrap(AUTH *auth, caddr_t buf, u_int buflen,
    XDR *xdrs, xdrproc_t xfunc, caddr_t xwhere)
{
	return (*xfunc)(xdrs, xwhere);
}

/*
 * authany_unwrap() is a NO-OP routines for ah_unwrap().
 */
/* ARGSUSED */
int
authany_unwrap(AUTH *auth, XDR *xdrs, xdrproc_t xfunc, caddr_t xwhere)
{
	return (*xfunc)(xdrs, xwhere);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 *  sec_svc.c, Server-side rpc security interface.
 */
#ifdef _KERNEL
#include <sys/param.h>
#include <sys/types.h>
#include <sys/debug.h>
#include <sys/systm.h>
#include <rpc/types.h>
#include <netinet/in.h>
#include <rpc/xdr.h>
#include <rpc/auth.h>
#include <rpc/clnt.h>
#include <rpc/rpc_msg.h>
#include <sys/tiuser.h>
#include <sys/tihdr.h>
#include <sys/t_kuser.h>
#include <sys/cmn_err.h>
#include <rpc/auth_des.h>
#include <rpc/auth_sys.h>
#include <rpc/rpcsec_gss.h>
#include <rpc/svc_auth.h>
#include <rpc/svc.h>
#else
#include <rpc/rpc.h>
#endif


enum auth_stat _svcauth_null(struct svc_req *, struct rpc_msg *);

/*
 *  NO-OP server wrap/unwrap svc_authany_ops using no-op svc_authany_wrap().
 */
/* ARGSUSED */
static int
svc_authany_wrap(SVCAUTH *auth, XDR *xdrs, xdrproc_t xfunc, caddr_t xwhere)
{
	return (*xfunc)(xdrs, xwhere);
}

struct svc_auth_ops svc_authany_ops = {
	svc_authany_wrap,
	svc_authany_wrap
};


/*
 * The call rpc message, msg has been obtained from the wire.  The msg contains
 * the raw form of credentials and verifiers.  authenticate returns AUTH_OK
 * if the msg is successfully authenticated.  If AUTH_OK then the routine also
 * does the following things:
 * set rqst->rq_xprt->verf to the appropriate response verifier;
 * sets rqst->rq_client_cred to the "cooked" form of the credentials.
 *
 * NB: rqst->rq_cxprt->verf must be pre-alloctaed;
 * its length is set appropriately.
 *
 * The caller still owns and is responsible for msg->u.cmb.cred and
 * msg->u.cmb.verf.  The authentication system retains ownership of
 * rqst->rq_client_cred, the cooked credentials.
 *
 * There is an assumption that any flavor less than AUTH_NULL is
 * invalid.
 */
enum auth_stat
sec_svc_msg(struct svc_req *rqst, struct rpc_msg *msg, bool_t *no_dispatch)
{
	int cred_flavor;

	rqst->rq_cred = msg->rm_call.cb_cred;
	rqst->rq_xprt->xp_verf.oa_flavor = _null_auth.oa_flavor;
	rqst->rq_xprt->xp_verf.oa_length = 0;
	/*
	 * Init the xp_auth to be no-op for all the flavors.
	 * Flavor specific routines will revise this when appropriate.
	 */
	rqst->rq_xprt->xp_auth.svc_ah_ops = svc_authany_ops;
	rqst->rq_xprt->xp_auth.svc_ah_private = NULL;
	*no_dispatch = FALSE;

	cred_flavor = rqst->rq_cred.oa_flavor;

	switch (cred_flavor) {
	case AUTH_NULL:
		rqst->rq_xprt->xp_cookie = (void *) AUTH_NULL;
		return (_svcauth_null(rqst, msg));

	case AUTH_UNIX:
		rqst->rq_xprt->xp_cookie = (void *) AUTH_UNIX;
		return (_svcauth_unix(rqst, msg));

	case AUTH_SHORT:
		rqst->rq_xprt->xp_cookie = (void *) AUTH_SHORT;
		return (_svcauth_short(rqst, msg));

	case AUTH_DES:
		rqst->rq_xprt->xp_cookie = (void *) AUTH_DES;
		return (_svcauth_des(rqst, msg));

	case RPCSEC_GSS:
		/*
		 * RPCSEC_GSS flavor routine takes an additional
		 * boolean parameter that gets set to TRUE when
		 * the call is not to be dispatched to the server.
		 */
		return (__svcrpcsec_gss(rqst, msg, no_dispatch));
	}
	return (AUTH_REJECTEDCRED);
}

/*
 *  sec_svc_getcred() gets unix cred of incoming security rpc requests.
 *  It also returns the prinicipal name and a cookie which is application
 *  dependent e.g. for nfs, it is the pseudo flavor.
 *
 *  return 0 on failure
 */
int
sec_svc_getcred(struct svc_req *req, cred_t *cr, caddr_t *principal,
	int *secmod)
{
	struct authunix_parms *aup;
	struct authdes_cred *adc;
	int flavor, stat;
	rpc_gss_rawcred_t *rcred;
	rpc_gss_ucred_t	*ucred;
	void *cookie;

	stat = 1;
	flavor = req->rq_cred.oa_flavor;

	*principal = NULL;
	switch (flavor) {
	case AUTH_UNIX:
		*secmod = AUTH_UNIX;
		aup = (struct authunix_parms *)req->rq_clntcred;
		if (crsetugid(cr, aup->aup_uid, aup->aup_gid) != 0)
			(void) crsetugid(cr, UID_NOBODY, GID_NOBODY);
		if (crsetgroups(cr, aup->aup_len, aup->aup_gids) != 0)
			(void) crsetgroups(cr, 0, NULL);
		break;

	case AUTH_NONE:
		*secmod = AUTH_NONE;
		break;

	case AUTH_DES:
		*secmod = AUTH_DES;
		adc = (struct authdes_cred *)req->rq_clntcred;
		stat = kauthdes_getucred(adc, cr);
		*principal = adc->adc_fullname.name;
		break;

	case RPCSEC_GSS:
		stat = rpc_gss_getcred(req, &rcred, &ucred, &cookie);
		*secmod = (int)(uintptr_t)cookie;	/* XX64 */
		if (ucred != NULL) {
			if (crsetugid(cr, ucred->uid, ucred->gid) != 0 ||
			    crsetgroups(cr, ucred->gidlen, ucred->gidlist) != 0)
				stat = 0;
		} else {
			(void) crsetugid(cr, UID_NOBODY, GID_NOBODY);
			(void) crsetgroups(cr, 0, NULL);
		}
		*principal = (caddr_t)rcred->client_principal;
		break;

	default:
		stat = 0;
		break;
	}

	return (stat);
}


/* ARGSUSED */
enum auth_stat
_svcauth_null(struct svc_req *rqst, struct rpc_msg *msg)
{
	return (AUTH_OK);
}


/*
 *  Load root principal names from user space to kernel space.
 *
 *  flavor - security flavor
 *  count - number of principal names to be loaded
 *  proots - address of the array of root names.
 *		input is the array address in the user space,
 *		output is the kernel address.
 *
 *  return 0 on failure.
 */
int
sec_svc_loadrootnames(int flavor, int count, caddr_t **proots, model_t model)
{
	caddr_t *roots, *oroots, root;
	char netname[MAXNETNAMELEN+1];
	struct rpc_gss_principal gsstmp, *gssname;
	uint_t i, j;
	size_t len, allocsz, oallocsz;

#ifdef lint
	model = model;
#endif

	/*
	 * Get list of names from user space
	 */
	allocsz = count * sizeof (caddr_t);
	oallocsz = count * SIZEOF_PTR(model);

	/*
	 * And now copy each individual principal name
	 */
	switch (flavor) {
	case AUTH_DES:
		roots = kmem_zalloc(allocsz, KM_SLEEP);
		oroots = kmem_alloc(oallocsz, KM_SLEEP);

		if (copyin(*proots, oroots, oallocsz))
			goto done;

		for (i = 0; i < count; i++) {
			/*
			 * copyinstr copies the complete string (including the
			 * NULL) and returns the len with the NULL byte
			 * included in the calculation as long as the max
			 * length is not exceeded.
			 */
#ifdef _SYSCALL32_IMPL
			if (model != DATAMODEL_NATIVE) {
				caddr32_t *tmp;

				tmp = (caddr32_t *)oroots;
				root = (caddr_t)(uintptr_t)tmp[i];
			} else
#endif
				root = oroots[i];
			if (copyinstr(root, netname, sizeof (netname), &len)) {
				for (j = 0; j < i; j++) {
					if (roots[j] != NULL)
						kmem_free(roots[j],
						    strlen(roots[j]) + 1);
				}
				goto done;
			}
			roots[i] = kmem_alloc(len, KM_SLEEP);
			bcopy(netname, roots[i], len);
		}
		kmem_free(oroots, oallocsz);
		*proots = roots;
		return (1);

	case RPCSEC_GSS:
		roots = kmem_alloc(allocsz, KM_SLEEP);
		oroots = kmem_alloc(oallocsz, KM_SLEEP);

		if (copyin(*proots, oroots, oallocsz))
			goto done;

		for (i = 0; i < count; i++) {
#ifdef _SYSCALL32_IMPL
			if (model != DATAMODEL_NATIVE) {
				caddr32_t *tmp;

				tmp = (caddr32_t *)oroots;
				root = (caddr_t)(uintptr_t)tmp[i];
			} else
#endif
				root = oroots[i];

			if (copyin(root, &gsstmp, sizeof (gsstmp))) {
				kmem_free(oroots, oallocsz);
				goto gssfreeup;
			}
			len = sizeof (gsstmp.len) + gsstmp.len;
			gssname = kmem_alloc(len, KM_SLEEP);
			if (copyin(root, gssname, len)) {
				kmem_free(gssname, len);
				kmem_free(oroots, oallocsz);
				goto gssfreeup;
			}
			roots[i] = (caddr_t)gssname;
		}
		kmem_free(oroots, oallocsz);
		*proots = roots;
		return (1);

	default:
		return (0);
	}

gssfreeup:
	for (j = 0; j < i; j++) {
		if (roots[j] != NULL) {
			gssname = (rpc_gss_principal_t)roots[j];
			kmem_free(roots[j], gssname->len +
			    sizeof (gssname->len));
		}
	}
done:
	kmem_free(roots, allocsz);
	return (0);
}


/*
 * Figure out everything we allocated in a root principal name list in
 * order to free it up.
 */
void
sec_svc_freerootnames(int flavor, int count, caddr_t *proots)
{
	int i;
	rpc_gss_principal_t gssname;

	switch (flavor) {
	case AUTH_DES:
		for (i = 0; i < count; i++)
			if (proots[i] != NULL)
				kmem_free(proots[i], strlen(proots[i]) + 1);
		break;

	case RPCSEC_GSS:
		for (i = 0; i < count; i++) {
			if (proots[i] == NULL)
				continue;
			gssname = (rpc_gss_principal_t)proots[i];
			kmem_free(proots[i], gssname->len + sizeof (int));
		}
		break;

	}
	kmem_free(proots, count * sizeof (caddr_t));
}

/*
 * Check if the  given principal name is in the root principal list
 */
bool_t
sec_svc_inrootlist(int flavor, caddr_t rootname, int count, caddr_t *roots)
{
	int i, tmp_len;
	rpc_gss_principal_t gssp, tmp_gssp;
	size_t namelen;

	switch (flavor) {
	case AUTH_DES:
		namelen = strlen(rootname) + 1;
		for (i = 0; i < count; i++)
			if (bcmp(rootname, roots[i], namelen) == 0)
				return (TRUE);
		break;

	case RPCSEC_GSS:
		gssp = (rpc_gss_principal_t)rootname;
		namelen = gssp->len;
		for (i = 0; i < count; i++) {
			tmp_gssp = (rpc_gss_principal_t)roots[i];
			tmp_len = tmp_gssp->len;
			if ((namelen == tmp_len) &&
			    (bcmp(&gssp->name[0],
			    &tmp_gssp->name[0], namelen) == 0))
				return (TRUE);
		}
		break;
	}
	return (FALSE);
}

/*
 * Miscellaneout "control" functions manipulating global RPC security
 * attributes for server applications.
 */
bool_t
sec_svc_control(uint_t cmd, void *argp)
{
	bool_t result = FALSE;		/* be paranoid */

	switch (cmd) {
	case RPC_SVC_SET_GSS_CALLBACK:
		result = rpc_gss_set_callback((rpc_gss_callback_t *)argp);
		break;
	default:
		cmn_err(CE_WARN, "sec_svc_control: bad command (%d)", cmd);
		result = FALSE;
		break;
	}

	return (result);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 * Copyright (c) 2011 Bayard G. Bell. All rights reserved.
 */

#include <sys/types.h>
#include <sys/modctl.h>
#include <sys/errno.h>

/*
 * Module linkage information for the kernel.
 */

static struct modlmisc modlmisc = {
	&mod_miscops, "kernel RPC security module."
};

static struct modlinkage modlinkage = {
	MODREV_1,
	(void *)&modlmisc,
	NULL
};

extern void sec_subrinit();
extern void sec_subrfini();
extern void svcauthdes_init();
extern void svcauthdes_fini();

int
_init()
{
	int retval = 0;

	sec_subrinit();
	svcauthdes_init();

	if ((retval = mod_install(&modlinkage)) != 0) {
		/*
		 * Failed to load module, cleanup previous
		 * initialization work.
		 */
		sec_subrfini();
		svcauthdes_fini();
	}

	return (retval);
}

int
_fini()
{
	return (EBUSY);
}

int
_info(struct modinfo *modinfop)
{
	return (mod_info(&modlinkage, modinfop));
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 1989 Sun Microsystems, Inc.  All rights reserved.
 * Copyright 2017 Joyent Inc
 * Use is subject to license terms.
 */

/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved  	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

/*
 * svc_auth_unix.c
 * Handles UNIX flavor authentication parameters on the service side of rpc.
 * There are two svc auth implementations here: AUTH_UNIX and AUTH_SHORT.
 * _svcauth_unix does full blown unix style uid, gid+gids auth,
 * _svcauth_short uses a shorthand auth to index into a cache of longhand auths.
 * Note: the shorthand has been gutted for efficiency.
 */

#include <sys/param.h>
#include <sys/types.h>
#include <sys/time.h>
#include <sys/systm.h>
#include <sys/stream.h>
#include <sys/stropts.h>
#include <sys/strsubr.h>
#include <sys/tiuser.h>
#include <sys/tihdr.h>
#include <sys/t_kuser.h>
#include <sys/cmn_err.h>
#include <sys/debug.h>

#include <rpc/types.h>
#include <rpc/xdr.h>
#include <rpc/auth.h>
#include <rpc/clnt.h>
#include <rpc/rpc_msg.h>
#include <rpc/svc.h>
#include <rpc/auth_unix.h>
#include <rpc/svc_auth.h>


/*
 * Unix longhand authenticator
 */
enum auth_stat
_svcauth_unix(struct svc_req *rqst, struct rpc_msg *msg)
{
	struct authunix_parms *aup;
	int32_t *buf;
	struct area {
		struct authunix_parms area_aup;
		char area_machname[MAX_MACHINE_NAME+1];
		gid_t area_gids[NGRPS];
	} *area;
	uint_t auth_len;
	uint_t str_len, gid_len;
	int i;

	CTASSERT(sizeof (struct area) <= RQCRED_SIZE);
	/* LINTED pointer alignment */
	area = (struct area *)rqst->rq_clntcred;
	aup = &area->area_aup;
	aup->aup_machname = area->area_machname;
	aup->aup_gids = area->area_gids;
	auth_len = msg->rm_call.cb_cred.oa_length;
	if (auth_len == 0)
		return (AUTH_BADCRED);

	/* LINTED pointer cast */
	buf = (int32_t *)msg->rm_call.cb_cred.oa_base;

	aup->aup_time = IXDR_GET_INT32(buf);
	str_len = IXDR_GET_U_INT32(buf);
	if (str_len > MAX_MACHINE_NAME)
		return (AUTH_BADCRED);
	bcopy((caddr_t)buf, aup->aup_machname, str_len);
	aup->aup_machname[str_len] = 0;
	str_len = RNDUP(str_len);
	buf += str_len / sizeof (int32_t);
	aup->aup_uid = IXDR_GET_INT32(buf);
	aup->aup_gid = IXDR_GET_INT32(buf);
	gid_len = IXDR_GET_U_INT32(buf);
	if (gid_len > NGRPS)
		return (AUTH_BADCRED);
	aup->aup_len = gid_len;
	for (i = 0; i < gid_len; i++) {
		aup->aup_gids[i] = IXDR_GET_INT32(buf);
	}
	/*
	 * five is the smallest unix credentials structure -
	 * timestamp, hostname len (0), uid, gid, and gids len (0).
	 */
	if ((5 + gid_len) * BYTES_PER_XDR_UNIT + str_len > auth_len)
		return (AUTH_BADCRED);

	rqst->rq_xprt->xp_verf.oa_flavor = AUTH_NULL;
	rqst->rq_xprt->xp_verf.oa_length = 0;

	return (AUTH_OK);
}


/*
 * Shorthand unix authenticator
 * Looks up longhand in a cache.
 */
/* ARGSUSED */
enum auth_stat
_svcauth_short(struct svc_req *rqst, struct rpc_msg *msg)
{
	return (AUTH_REJECTEDCRED);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2017 Joyent Inc
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved  	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

/*
 * svcauth_des.c, server-side des authentication
 *
 * We insure for the service the following:
 * (1) The timestamp microseconds do not exceed 1 million.
 * (2) The timestamp plus the window is less than the current time.
 * (3) The timestamp is not less than the one previously
 *	seen in the current session.
 *
 * It is up to the server to determine if the window size is
 * too small.
 */

#include <sys/types.h>
#include <sys/time.h>
#include <sys/systm.h>
#include <sys/param.h>
#include <sys/stream.h>
#include <sys/stropts.h>
#include <sys/strsubr.h>
#include <sys/tiuser.h>
#include <sys/tihdr.h>
#include <sys/t_kuser.h>
#include <sys/t_lock.h>
#include <sys/debug.h>
#include <sys/kmem.h>
#include <sys/time.h>
#include <sys/cmn_err.h>
#include <sys/debug.h>

#include <rpc/types.h>
#include <rpc/xdr.h>
#include <rpc/auth.h>
#include <rpc/auth_des.h>
#include <rpc/rpc_msg.h>
#include <rpc/svc.h>
#include <rpc/svc_auth.h>
#include <rpc/clnt.h>
#include <rpc/des_crypt.h>

#define	USEC_PER_SEC 1000000
#define	BEFORE(t1, t2) timercmp(t1, t2, < /* COMMENT HERE TO DEFEAT CSTYLE */)

/*
 * Cache of conversation keys and some other useful items.
 * The hash table size is controled via authdes_cachesz variable.
 * The authdes_cachesz has to be the power of 2.
 */
#define	AUTHDES_CACHE_TABLE_SZ 1024
static int authdes_cachesz = AUTHDES_CACHE_TABLE_SZ;
#define	HASH(key) ((key) & (authdes_cachesz - 1))

/* low water mark for the number of cache entries */
static int low_cache_entries = 128;

struct authdes_cache_entry {
	uint32_t nickname;		/* nick name id */
	uint32_t window;		/* credential lifetime window */
	des_block key;			/* conversation key */
	time_t	ref_time;		/* time referenced previously */
	char *rname;			/* client's name */
	caddr_t localcred;		/* generic local credential */
	struct authdes_cache_entry *prev, *next;  /* hash table linked list */
	struct authdes_cache_entry *lru_prev, *lru_next; /* LRU linked list */
	kmutex_t lock;			/* cache entry lock */
};
static struct authdes_cache_entry **authdes_cache; /* [authdes_cachesz] */
static struct authdes_cache_entry *lru_first = NULL;
static struct authdes_cache_entry *lru_last = NULL;
static kmutex_t authdes_lock;		/* cache table lock */

static struct kmem_cache *authdes_cache_handle;
static uint32_t	Nickname = 0;

static struct authdes_cache_entry *authdes_cache_new(char *,
					des_block *, uint32_t);
static struct authdes_cache_entry *authdes_cache_get(uint32_t);
static void authdes_cache_reclaim(void *);
static void sweep_cache();

/*
 * After 12 hours, check and delete cache entries that have been
 * idled for more than 10 hours.
 */
static time_t authdes_sweep_interval = 12*60*60;
static time_t authdes_cache_time = 10*60*60;
static time_t authdes_last_swept = 0;

/*
 * cache statistics
 */
static int authdes_ncache = 0; /* number of current cached entries */
static int authdes_ncachehits = 0; /* #times cache hit */
static int authdes_ncachemisses = 0; /* #times cache missed */

#define	NOT_DEAD(ptr)   ASSERT((((intptr_t)(ptr)) != 0xdeadbeef))
#define	IS_ALIGNED(ptr) ASSERT((((intptr_t)(ptr)) & 3) == 0)

/*
 * Service side authenticator for AUTH_DES
 */
enum auth_stat
_svcauth_des(struct svc_req *rqst, struct rpc_msg *msg)
{
	int32_t *ixdr;
	des_block cryptbuf[2];
	struct authdes_cred *cred;
	struct authdes_verf verf;
	int status;
	des_block *sessionkey;
	des_block ivec;
	uint32_t window, winverf, namelen;
	bool_t nick;
	struct timeval timestamp, current_time;
	struct authdes_cache_entry *nick_entry;
	struct area {
		struct authdes_cred area_cred;
		char area_netname[MAXNETNAMELEN+1];
	} *area;
	timestruc_t now;

	mutex_enter(&authdes_lock);
	if (authdes_cache == NULL) {
		authdes_cache = kmem_zalloc(
			sizeof (struct authdes_cache_entry *) * authdes_cachesz,
			KM_SLEEP);
	}
	mutex_exit(&authdes_lock);

	CTASSERT(sizeof (struct area) <= RQCRED_SIZE);
	/* LINTED pointer alignment */
	area = (struct area *)rqst->rq_clntcred;
	cred = (struct authdes_cred *)&area->area_cred;

	/*
	 * Get the credential
	 */
	/* LINTED pointer alignment */
	ixdr = (int32_t *)msg->rm_call.cb_cred.oa_base;
	cred->adc_namekind = IXDR_GET_ENUM(ixdr, enum authdes_namekind);
	switch (cred->adc_namekind) {
	case ADN_FULLNAME:
		namelen = IXDR_GET_U_INT32(ixdr);
		if (namelen > MAXNETNAMELEN)
			return (AUTH_BADCRED);
		cred->adc_fullname.name = area->area_netname;
		bcopy(ixdr, cred->adc_fullname.name, namelen);
		cred->adc_fullname.name[namelen] = 0;
		ixdr += (RNDUP(namelen) / BYTES_PER_XDR_UNIT);
		cred->adc_fullname.key.key.high = (uint32_t)*ixdr++;
		cred->adc_fullname.key.key.low = (uint32_t)*ixdr++;
		cred->adc_fullname.window = (uint32_t)*ixdr++;
		nick = FALSE;
		break;
	case ADN_NICKNAME:
		cred->adc_nickname = (uint32_t)*ixdr++;
		nick = TRUE;
		break;
	default:
		return (AUTH_BADCRED);
	}

	/*
	 * Get the verifier
	 */
	/* LINTED pointer alignment */
	ixdr = (int32_t *)msg->rm_call.cb_verf.oa_base;
	verf.adv_xtimestamp.key.high = (uint32_t)*ixdr++;
	verf.adv_xtimestamp.key.low =  (uint32_t)*ixdr++;
	verf.adv_int_u = (uint32_t)*ixdr++;


	/*
	 * Get the conversation key
	 */
	if (!nick) { /* ADN_FULLNAME */
		sessionkey = &cred->adc_fullname.key;
		if (key_decryptsession(cred->adc_fullname.name, sessionkey) !=
		    RPC_SUCCESS) {
		    return (AUTH_BADCRED); /* key not found */
		}
	} else { /* ADN_NICKNAME */
		mutex_enter(&authdes_lock);
		if (!(nick_entry = authdes_cache_get(cred->adc_nickname))) {
		    RPCLOG(1, "_svcauth_des: nickname %d not in the cache\n",
						cred->adc_nickname);
		    mutex_exit(&authdes_lock);
		    return (AUTH_BADCRED);	/* need refresh */
		}
		sessionkey = &nick_entry->key;
		mutex_enter(&nick_entry->lock);
		mutex_exit(&authdes_lock);
	}

	/*
	 * Decrypt the timestamp
	 */
	cryptbuf[0] = verf.adv_xtimestamp;
	if (!nick) { /* ADN_FULLNAME */
		cryptbuf[1].key.high = cred->adc_fullname.window;
		cryptbuf[1].key.low = verf.adv_winverf;
		ivec.key.high = ivec.key.low = 0;
		status = cbc_crypt((char *)sessionkey, (char *)cryptbuf,
		    2 * sizeof (des_block), DES_DECRYPT, (char *)&ivec);
	} else { /* ADN_NICKNAME */
		status = ecb_crypt((char *)sessionkey, (char *)cryptbuf,
		    sizeof (des_block), DES_DECRYPT);
	}
	if (DES_FAILED(status)) {
		RPCLOG0(1, "_svcauth_des: decryption failure\n");
		if (nick) {
			mutex_exit(&nick_entry->lock);
		}
		return (AUTH_FAILED);	/* system error */
	}

	/*
	 * XDR the decrypted timestamp
	 */
	ixdr = (int32_t *)cryptbuf;
	timestamp.tv_sec = IXDR_GET_INT32(ixdr);
	timestamp.tv_usec = IXDR_GET_INT32(ixdr);

	/*
	 * Check for valid credentials and verifiers.
	 * They could be invalid because the key was flushed
	 * out of the cache, and so a new session should begin.
	 * Be sure and send AUTH_REJECTED{CRED, VERF} if this is the case.
	 */
	if (!nick) { /* ADN_FULLNAME */
		window = IXDR_GET_U_INT32(ixdr);
		winverf = IXDR_GET_U_INT32(ixdr);
		if (winverf != window - 1) {
			RPCLOG(1, "_svcauth_des: window verifier mismatch %d\n",
				winverf);
			return (AUTH_BADCRED);	/* garbled credential */
		}
	} else { /* ADN_NICKNAME */
		window = nick_entry->window;
	}

	if (timestamp.tv_usec >= USEC_PER_SEC) {
		RPCLOG(1, "_svcauth_des: invalid usecs %ld\n",
					timestamp.tv_usec);
		/* cached out (bad key), or garbled verifier */
		if (nick) {
			mutex_exit(&nick_entry->lock);
		}
		return (nick ? AUTH_REJECTEDVERF : AUTH_BADVERF);
	}

	gethrestime(&now);
	current_time.tv_sec = now.tv_sec;
	current_time.tv_usec = now.tv_nsec / 1000;

	current_time.tv_sec -= window;	/* allow for expiration */
	if (!BEFORE(&current_time, &timestamp)) {
		RPCLOG0(1, "_svcauth_des: timestamp expired\n");
		/* replay, or garbled credential */
		if (nick) {
			mutex_exit(&nick_entry->lock);
		}
		return (nick ? AUTH_REJECTEDVERF : AUTH_BADCRED);
	}

	/*
	 * xdr the timestamp before encrypting
	 */
	ixdr = (int32_t *)cryptbuf;
	IXDR_PUT_INT32(ixdr, timestamp.tv_sec - 1);
	IXDR_PUT_INT32(ixdr, timestamp.tv_usec);

	/*
	 * encrypt the timestamp
	 */
	status = ecb_crypt((char *)sessionkey, (char *)cryptbuf,
	    sizeof (des_block), DES_ENCRYPT);
	if (DES_FAILED(status)) {
		RPCLOG0(1, "_svcauth_des: encryption failure\n");
		if (nick) {
			mutex_exit(&nick_entry->lock);
		}
		return (AUTH_FAILED);	/* system error */
	}
	verf.adv_xtimestamp = cryptbuf[0];

	/*
	 * If a ADN_FULLNAME, create a new nickname cache entry.
	 */
	if (!nick) {
	    mutex_enter(&authdes_lock);
	    if (!(nick_entry = authdes_cache_new(cred->adc_fullname.name,
					sessionkey, window))) {
		RPCLOG0(1, "_svcauth_des: can not create new cache entry\n");
		mutex_exit(&authdes_lock);
		return (AUTH_FAILED);
	    }
	    mutex_enter(&nick_entry->lock);
	    mutex_exit(&authdes_lock);
	}
	verf.adv_nickname = nick_entry->nickname;

	/*
	 * Serialize the reply verifier, and update rqst
	 */
	/* LINTED pointer alignment */
	ixdr = (int32_t *)msg->rm_call.cb_verf.oa_base;
	*ixdr++ = (int32_t)verf.adv_xtimestamp.key.high;
	*ixdr++ = (int32_t)verf.adv_xtimestamp.key.low;
	*ixdr++ = (int32_t)verf.adv_int_u;

	rqst->rq_xprt->xp_verf.oa_flavor = AUTH_DES;
	rqst->rq_xprt->xp_verf.oa_base = msg->rm_call.cb_verf.oa_base;
	rqst->rq_xprt->xp_verf.oa_length =
	    (uint_t)((char *)ixdr - msg->rm_call.cb_verf.oa_base);
	if (rqst->rq_xprt->xp_verf.oa_length > MAX_AUTH_BYTES) {
		RPCLOG0(1, "_svcauth_des: invalid oa length\n");
		mutex_exit(&nick_entry->lock);
		return (AUTH_BADVERF);
	}

	/*
	 * We succeeded and finish cooking the credential.
	 * nicknames are cooked into fullnames
	 */
	if (!nick) {
		cred->adc_nickname = nick_entry->nickname;
		cred->adc_fullname.window = window;
	} else { /* ADN_NICKNAME */
		cred->adc_namekind = ADN_FULLNAME;
		cred->adc_fullname.name = nick_entry->rname;
		cred->adc_fullname.key = nick_entry->key;
		cred->adc_fullname.window = nick_entry->window;
	}
	mutex_exit(&nick_entry->lock);

	/*
	 * For every authdes_sweep_interval, delete cache entries that have been
	 * idled for authdes_cache_time.
	 */
	mutex_enter(&authdes_lock);
	if ((gethrestime_sec() - authdes_last_swept) > authdes_sweep_interval)
		sweep_cache();

	mutex_exit(&authdes_lock);

	return (AUTH_OK);	/* we made it! */
}

/*
 * Initialization upon loading the rpcsec module.
 */
void
svcauthdes_init(void)
{
	mutex_init(&authdes_lock, NULL, MUTEX_DEFAULT, NULL);
	/*
	 * Allocate des cache handle
	 */
	authdes_cache_handle = kmem_cache_create("authdes_cache_handle",
			sizeof (struct authdes_cache_entry), 0, NULL, NULL,
			authdes_cache_reclaim, NULL, NULL, 0);
}

/*
 * Final actions upon exiting the rpcsec module.
 */
void
svcauthdes_fini(void)
{
	mutex_destroy(&authdes_lock);
	kmem_cache_destroy(authdes_cache_handle);
}

/*
 * Local credential handling stuff.
 * NOTE: bsd unix dependent.
 * Other operating systems should put something else here.
 */

struct bsdcred {
	uid_t uid;		/* cached uid */
	gid_t gid;		/* cached gid */
	short valid;		/* valid creds */
	short grouplen;	/* length of cached groups */
	gid_t groups[1];	/* cached groups - allocate ngroups_max */
};

/*
 * Map a des credential into a unix cred.
 * We cache the credential here so the application does
 * not have to make an rpc call every time to interpret
 * the credential.
 */
int
kauthdes_getucred(const struct authdes_cred *adc, cred_t *cr)
{
	uid_t i_uid;
	gid_t i_gid;
	int i_grouplen;
	struct bsdcred *cred;
	struct authdes_cache_entry *nickentry;

	mutex_enter(&authdes_lock);
	if (!(nickentry = authdes_cache_get(adc->adc_nickname))) {
		RPCLOG0(1, "authdes_getucred:  invalid nickname\n");
		mutex_exit(&authdes_lock);
		return (0);
	}

	mutex_enter(&nickentry->lock);
	mutex_exit(&authdes_lock);
	/* LINTED pointer alignment */
	cred = (struct bsdcred *)nickentry->localcred;
	if (!cred->valid) {
		/*
		 * not in cache: lookup
		 */
		if (netname2user(adc->adc_fullname.name, &i_uid, &i_gid,
		    &i_grouplen, &cred->groups[0]) != RPC_SUCCESS) {
			/*
			 * Probably a host principal, since at this
			 * point we have valid keys. Note that later
			 * if the principal is not in the root list
			 * for NFS, we will be mapped to that exported
			 * file system's anonymous user, typically
			 * NOBODY. keyserv KEY_GETCRED will fail for a
			 * root-netnames so we assume root here.
			 * Currently NFS is the only caller of this
			 * routine. If other RPC services call this
			 * routine, it is up to that service to
			 * differentiate between local and remote
			 * roots.
			 */
			i_uid = 0;
			i_gid = 0;
			i_grouplen = 0;
		}
		RPCLOG0(2, "authdes_getucred:  missed ucred cache\n");
		cred->uid = i_uid;
		cred->gid = i_gid;
		cred->grouplen = (short)i_grouplen;
		cred->valid = 1;
	}

	/*
	 * cached credentials
	 */
	if (crsetugid(cr, cred->uid, cred->gid) != 0 ||
	    crsetgroups(cr, cred->grouplen, &cred->groups[0]) != 0) {
		mutex_exit(&nickentry->lock);
		return (0);
	}
	mutex_exit(&nickentry->lock);
	return (1);
}

/*
 * Create a new cache_entry and put it in authdes_cache table.
 * Caller should have already locked the authdes_cache table.
 */
struct authdes_cache_entry *
authdes_cache_new(char *fullname, des_block *sessionkey, uint32_t window) {

	struct authdes_cache_entry *new, *head;
	struct bsdcred *ucred;
	int index;

	if (!(new = kmem_cache_alloc(authdes_cache_handle, KM_SLEEP))) {
		return (NULL);
	}

	if (!(new->rname = kmem_alloc(strlen(fullname) + 1, KM_NOSLEEP))) {
		kmem_cache_free(authdes_cache_handle, new);
		return (NULL);
	}

	if (!(ucred = kmem_alloc(sizeof (struct bsdcred) +
	    (ngroups_max - 1) * sizeof (gid_t), KM_NOSLEEP))) {
		kmem_free(new->rname, strlen(fullname) + 1);
		kmem_cache_free(authdes_cache_handle, new);
		return (NULL);
	}

	(void) strcpy(new->rname, fullname);
	ucred->valid = 0;
	new->localcred = (caddr_t)ucred;
	new->key = *sessionkey;
	new->window = window;
	new->ref_time = gethrestime_sec();
	new->nickname = Nickname++;
	mutex_init(&new->lock, NULL, MUTEX_DEFAULT, NULL);

	/* put new into the hash table */
	index = HASH(new->nickname);
	head = authdes_cache[index];
	if ((new->next = head) != NULL) {
		head->prev = new;
	}
	authdes_cache[index] = new;
	new->prev = NULL;

	/* update the LRU list */
	new->lru_prev = NULL;
	if ((new->lru_next = lru_first) != NULL) {
		lru_first->lru_prev = new;
	} else {
		lru_last = new;
	}
	lru_first = new;

	authdes_ncache++;
	return (new);
}

/*
 * Get an existing cache entry from authdes_cache table.
 * The caller should have locked the authdes_cache table.
 */
struct authdes_cache_entry *
authdes_cache_get(uint32_t nickname) {

	struct authdes_cache_entry *cur = NULL;
	int index = HASH(nickname);

	ASSERT(MUTEX_HELD(&authdes_lock));
	for (cur = authdes_cache[index]; cur; cur = cur->next) {
		if ((cur->nickname == nickname)) {
			/* find it, update the LRU list */
			if (cur != lru_first) {
			    cur->lru_prev->lru_next = cur->lru_next;
			    if (cur->lru_next != NULL) {
				cur->lru_next->lru_prev = cur->lru_prev;
			    } else {
				lru_last = cur->lru_prev;
			    }
			    cur->lru_prev = NULL;
			    cur->lru_next = lru_first;
			    lru_first->lru_prev = cur;
			    lru_first = cur;
			}

			cur->ref_time = gethrestime_sec();
			authdes_ncachehits++;
			return (cur);
		}
	}

	authdes_ncachemisses++;
	return (NULL);
}

/*
 * authdes_cache_reclaim() is called by the kernel memory allocator
 * when memory is low. This routine will reclaim 25% of the least recent
 * used cache entries above the low water mark (low_cache_entries).
 * If the cache entries have already hit the low water mark, it will
 * return 1 cache entry.
 */
/*ARGSUSED*/
void
authdes_cache_reclaim(void *pdata) {
	struct authdes_cache_entry *p;
	int n, i;

	mutex_enter(&authdes_lock);
	n = authdes_ncache - low_cache_entries;
	n = n > 0 ? n/4 : 1;

	for (i = 0; i < n; i++) {
		if ((p = lru_last) == lru_first)
			break;

		/* Update the hash linked list */
		if (p->prev == NULL) {
			authdes_cache[HASH(p->nickname)] = p->next;
		} else {
			p->prev->next = p->next;
		}
		if (p->next != NULL) {
			p->next->prev = p->prev;
		}

		/* update the LRU linked list */
		p->lru_prev->lru_next = NULL;
		lru_last = p->lru_prev;

		kmem_free(p->rname, strlen(p->rname) + 1);
		kmem_free(p->localcred, sizeof (struct bsdcred) +
		    (ngroups_max - 1) * sizeof (gid_t));
		mutex_destroy(&p->lock);
		kmem_cache_free(authdes_cache_handle, p);

		authdes_ncache--;
	}
	mutex_exit(&authdes_lock);
	RPCLOG(4, "_svcauth_des: %d cache entries reclaimed...\n",
				authdes_ncache);
}

/*
 *  Walk through the LRU doubly-linked list and delete the cache
 *  entries that have not been used for more than authdes_cache_time.
 *
 *  Caller should have locked the cache table.
 */
void
sweep_cache() {
	struct authdes_cache_entry *p;

	ASSERT(MUTEX_HELD(&authdes_lock));
	while ((p = lru_last) != lru_first) {
		IS_ALIGNED(p);
		NOT_DEAD(p);

		/*
		 * If the last LRU entry idled less than authdes_cache_time,
		 * we are done with the sweeping.
		 */
		if (p->ref_time + authdes_cache_time > gethrestime_sec())
			break;

		/* update the hash linked list */
		if (p->prev == NULL) {
			authdes_cache[HASH(p->nickname)] = p->next;
		} else {
			p->prev->next = p->next;
		}
		if (p->next != NULL) {
			p->next->prev = p->prev;
		}

		/* update the LRU linked list */
		p->lru_prev->lru_next = NULL;
		lru_last = p->lru_prev;

		kmem_free(p->rname, strlen(p->rname) + 1);
		kmem_free(p->localcred, sizeof (struct bsdcred) +
		    (ngroups_max - 1) * sizeof (gid_t));
		mutex_destroy(&p->lock);
		kmem_cache_free(authdes_cache_handle, p);

		authdes_ncache--;
	}

	authdes_last_swept = gethrestime_sec();
	RPCLOG(4, "_svcauth_des: sweeping cache...#caches left = %d\n",
				authdes_ncache);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Copyright (c) 2018, Joyent, Inc.
 * Copyright 2021 Tintri by DDN, Inc. All rights reserved.
 */

/*
 * Copyright 1993 OpenVision Technologies, Inc., All Rights Reserved.
 *
 * $Header:
 * /afs/gza.com/product/secure/rel-eng/src/1.1/rpc/RCS/auth_gssapi.c,v
 * 1.14 1995/03/22 22:07:55 jik Exp $
 */

#include  <sys/systm.h>
#include  <sys/types.h>
#include  <gssapi/gssapi.h>
#include  <rpc/rpc.h>
#include  <rpc/rpcsec_defs.h>
#include  <sys/debug.h>
#include  <sys/cmn_err.h>
#include  <sys/ddi.h>

static	void	rpc_gss_nextverf();
static	bool_t	rpc_gss_marshall();
static	bool_t	rpc_gss_validate();
static	bool_t	rpc_gss_refresh();
static	void	rpc_gss_destroy();
#if 0
static	void	rpc_gss_destroy_pvt();
#endif
static	void	rpc_gss_free_pvt();
static	int	rpc_gss_seccreate_pvt();
static  bool_t	rpc_gss_wrap();
static  bool_t	rpc_gss_unwrap();
static	bool_t	validate_seqwin();


#ifdef	DEBUG
#include <sys/promif.h>
#endif

static struct auth_ops rpc_gss_ops = {
	rpc_gss_nextverf,
	rpc_gss_marshall,
	rpc_gss_validate,
	rpc_gss_refresh,
	rpc_gss_destroy,
	rpc_gss_wrap,
	rpc_gss_unwrap,
};

/*
 * Private data for RPCSEC_GSS.
 */
typedef struct _rpc_gss_data {
	bool_t		established;	/* TRUE when established */
	CLIENT		*clnt;		/* associated client handle */
	int		version;	/* RPCSEC version */
	gss_ctx_id_t	context;	/* GSS context id */
	gss_buffer_desc	ctx_handle;	/* RPCSEC GSS context handle */
	uint_t		seq_num;	/* last sequence number rcvd */
	gss_cred_id_t	my_cred;	/* caller's GSS credentials */
	OM_uint32	qop;		/* requested QOP */
	rpc_gss_service_t	service;	/* requested service */
	uint_t		gss_proc;	/* GSS control procedure */
	gss_name_t	target_name;	/* target server */
	int		req_flags;	/* GSS request bits */
	gss_OID		mech_type;	/* GSS mechanism */
	OM_uint32	time_req;	/* requested cred lifetime */
	bool_t		invalid;	/* can't use this any more */
	OM_uint32	seq_window;	/* server sequence window */
	struct opaque_auth *verifier;	/* rpc reply verifier saved for */
					/* validating the sequence window */
	gss_channel_bindings_t	icb;
} rpc_gss_data;
#define	AUTH_PRIVATE(auth)	((rpc_gss_data *)auth->ah_private)

#define	INTERRUPT_OK	1	/* allow interrupt */

/*
 *  RPCSEC_GSS auth cache definitions.
 */

/* The table size must be a power of two. */
#define	GSSAUTH_TABLESIZE 16
#define	HASH(keynum, uid_num) \
	((((intptr_t)(keynum)) ^ ((int)uid_num)) & (GSSAUTH_TABLESIZE - 1))

/*
 * gss auth cache entry.
 */
typedef struct ga_cache_entry {
	void	*cache_key;
	uid_t	uid;
	zoneid_t zoneid;
	bool_t	in_use;
	time_t	ref_time; /* the time referenced previously */
	time_t	ctx_expired_time; /* when the context will be expired */
	AUTH	*auth;
	struct ga_cache_entry *next;
} *ga_cache_list;

struct ga_cache_entry	*ga_cache_table[GSSAUTH_TABLESIZE];
static krwlock_t	ga_cache_table_lock;
static struct kmem_cache *ga_cache_handle;
static void gssauth_cache_reclaim(void *);

static void gssauth_zone_fini(zoneid_t, void *);
static zone_key_t	gssauth_zone_key;

int ga_cache_hit;
int ga_cache_miss;
int ga_cache_reclaim;

#define	NOT_DEAD(ptr)	ASSERT((((intptr_t)(ptr)) != 0xdeadbeef))

void
gssauth_init(void)
{
	/*
	 * Initialize gss auth cache table lock
	 */
	rw_init(&ga_cache_table_lock, NULL, RW_DEFAULT, NULL);

	/*
	 * Allocate gss auth cache handle
	 */
	ga_cache_handle = kmem_cache_create("ga_cache_handle",
	    sizeof (struct ga_cache_entry), 0, NULL, NULL,
	    gssauth_cache_reclaim, NULL, NULL, 0);
	zone_key_create(&gssauth_zone_key, NULL, NULL, gssauth_zone_fini);
}

/*
 * Destroy the structures previously initialized in gssauth_init()
 * This routine is called by _init() if mod_install() failed.
 */
void
gssauth_fini(void)
{
	(void) zone_key_delete(gssauth_zone_key);
	kmem_cache_destroy(ga_cache_handle);
	rw_destroy(&ga_cache_table_lock);
}

/*
 * This is a cleanup routine to release cached entries when a zone is being
 * destroyed.  The code is also used when kmem calls us to free up memory, at
 * which point ``zoneid'' will be ALL_ZONES.  We don't honor the cache timeout
 * when the zone is going away, since the zoneid (and all associated cached
 * entries) are invalid.
 */
time_t rpc_gss_cache_time = 60 * 60;

/* ARGSUSED */
static void
gssauth_zone_fini(zoneid_t zoneid, void *unused)
{
	struct ga_cache_entry *p, *prev, *next;
	int i;
	time_t now;

	rw_enter(&ga_cache_table_lock, RW_WRITER);

	for (i = 0; i < GSSAUTH_TABLESIZE; i++) {
		prev = NULL;
		for (p = ga_cache_table[i]; p; p = next) {
			NOT_DEAD(p->next);
			next = p->next;
			NOT_DEAD(next);
			if (zoneid == ALL_ZONES) {	/* kmem callback */
				/*
				 * Free entries that have not been
				 * used for rpc_gss_cache_time seconds.
				 */
				now = gethrestime_sec();
				if ((p->ref_time + rpc_gss_cache_time >
				    now) || p->in_use) {
					if ((p->ref_time + rpc_gss_cache_time <=
					    now) && p->in_use) {
						RPCGSS_LOG0(2, "gssauth_cache_"
						    "reclaim: in_use\n");
					}
					prev = p;
					continue;
				}
			} else {
				if (p->zoneid != zoneid) {
					prev = p;
					continue;
				}
				ASSERT(!p->in_use);
			}

			RPCGSS_LOG(2, "gssauth_cache_reclaim: destroy auth "
			    "%p\n", (void *)p->auth);
			rpc_gss_destroy(p->auth);
			kmem_cache_free(ga_cache_handle, (void *)p);
			if (prev == NULL) {
				ga_cache_table[i] = next;
			} else {
				NOT_DEAD(prev->next);
				prev->next = next;
			}
		}
	}

	rw_exit(&ga_cache_table_lock);

}

/*
 * Called by the kernel memory allocator when
 * memory is low. Free unused cache entries.
 * If that's not enough, the VM system will
 * call again for some more.
 */
/*ARGSUSED*/
static void
gssauth_cache_reclaim(void *cdrarg)
{
	gssauth_zone_fini(ALL_ZONES, NULL);
}

#define	NOT_NULL(ptr)	ASSERT(ptr)
#define	IS_ALIGNED(ptr)	ASSERT((((intptr_t)(ptr)) & 3) == 0)

/*
 *  Get the client gss security service handle.
 *  If it is in the cache table, get it, otherwise, create
 *  a new one by calling rpc_gss_seccreate().
 */
int
rpc_gss_secget(CLIENT *clnt,
	char	*principal,
	rpc_gss_OID	mechanism,
	rpc_gss_service_t service_type,
	uint_t	qop,
	rpc_gss_options_req_t *options_req,
	rpc_gss_options_ret_t *options_ret,
	void *cache_key,
	cred_t *cr,
	AUTH **retauth)
{
	struct ga_cache_entry **head, *current, *new, *prev;
	AUTH *auth = NULL;
	rpc_gss_data	*ap;
	rpc_gss_options_ret_t opt_ret;
	int status = 0;
	uid_t uid = crgetuid(cr);
	zoneid_t zoneid = getzoneid();

	if (retauth == NULL)
		return (EINVAL);
	*retauth = NULL;

	NOT_NULL(cr);
	IS_ALIGNED(cr);
#ifdef DEBUG
	if (HASH(cache_key, uid) < 0) {
		prom_printf("cache_key %p, cr %p\n", cache_key, (void *)cr);
	}
#endif

	/*
	 *  Get a valid gss auth handle from the cache table.
	 *  If auth in cache is invalid and not in use, destroy it.
	 */
	prev = NULL;
	rw_enter(&ga_cache_table_lock, RW_WRITER);

	ASSERT(HASH(cache_key, uid) >= 0);
	head = &ga_cache_table[HASH(cache_key, uid)];
	NOT_NULL(head);
	IS_ALIGNED(head);

	for (current = *head; current; current = current->next) {
		NOT_NULL(current);
		IS_ALIGNED(current);
		if ((cache_key == current->cache_key) &&
			(uid == current->uid) && (zoneid == current->zoneid) &&
			!current->in_use) {
			current->in_use = TRUE;
			current->ref_time = gethrestime_sec();
			ap = AUTH_PRIVATE(current->auth);
			ap->clnt = clnt;
			ga_cache_hit++;
			if (ap->invalid ||
			    ((current->ctx_expired_time != GSS_C_INDEFINITE) &&
			    (gethrestime_sec() >=
			    current->ctx_expired_time))) {
			    RPCGSS_LOG0(1, "NOTICE: rpc_gss_secget: time to "
					"refresh the auth\n");
			    if (prev == NULL) {
				*head = current->next;
			    } else {
				prev->next = current->next;
			    }
			    rpc_gss_destroy(current->auth);
			    kmem_cache_free(ga_cache_handle, (void *) current);
			    auth = NULL;
			} else {
			    auth = current->auth;
			}
			break;
		} else {
			prev = current;
		}
	}
	rw_exit(&ga_cache_table_lock);

	/*
	 *  If no valid gss auth handle can be found in the cache, create
	 *  a new one.
	 */
	if (!auth) {
		ga_cache_miss++;
		if (options_ret == NULL)
			options_ret = &opt_ret;

		status = rpc_gss_seccreate(clnt, principal, mechanism,
			service_type, qop, options_req, options_ret, cr, &auth);
		if (status == 0) {
			RPCGSS_LOG(2, "rpc_gss_secget: new auth %p\n",
					(void *)auth);
			new = kmem_cache_alloc(ga_cache_handle, KM_NOSLEEP);
			IS_ALIGNED(new);
			NOT_DEAD(new);
			if (new) {
				new->cache_key = cache_key;
				new->uid = uid;
				new->zoneid = zoneid;
				new->in_use = TRUE;
				new->ref_time = gethrestime_sec();
				if (options_ret->time_ret != GSS_C_INDEFINITE) {
				    new->ctx_expired_time = new->ref_time +
					options_ret->time_ret;
				} else {
				    new->ctx_expired_time = GSS_C_INDEFINITE;
				}
				new->auth = auth;
				rw_enter(&ga_cache_table_lock, RW_WRITER);
				NOT_DEAD(*head);
				NOT_DEAD(new->next);
				new->next = *head;
				*head = new;
				rw_exit(&ga_cache_table_lock);
			}
			/* done with opt_ret */
			if (options_ret == &opt_ret) {
			    kgss_free_oid((gss_OID) opt_ret.actual_mechanism);
			}
		}
	}

	*retauth = auth;
	return (status);
}



/*
 *  rpc_gss_secfree will destroy a rpcsec_gss context only if
 *  the auth handle is not in the cache table.
 */
void
rpc_gss_secfree(AUTH *auth)
{
	struct ga_cache_entry *next, *cur;
	int i;

	/*
	 *  Check the cache table to find the auth.
	 *  Marked it unused.
	 */
	rw_enter(&ga_cache_table_lock, RW_WRITER);
	for (i = 0; i < GSSAUTH_TABLESIZE; i++) {
		for (cur = ga_cache_table[i]; cur; cur = next) {
			NOT_DEAD(cur);
			next = cur->next;
			NOT_DEAD(next);
			if (cur->auth == auth) {
				ASSERT(cur->in_use == TRUE);
				cur->in_use = FALSE;
				rw_exit(&ga_cache_table_lock);
				return;
			}
		}
	}
	rw_exit(&ga_cache_table_lock);
	RPCGSS_LOG(2, "rpc_gss_secfree: destroy auth %p\n", (void *)auth);
	rpc_gss_destroy(auth);
}


/*
 *  Create a gss security service context.
 */
int
rpc_gss_seccreate(CLIENT *clnt,
	char			*principal,	/* target service@server */
	rpc_gss_OID		mechanism,	/* security mechanism */
	rpc_gss_service_t	service_type,	/* security service */
	uint_t			qop,		/* requested QOP */
	rpc_gss_options_req_t	*options_req,	/* requested options */
	rpc_gss_options_ret_t	*options_ret,	/* returned options */
	cred_t			*cr,		/* client's unix cred */
	AUTH			**retauth)	/* auth handle */
{
	OM_uint32		gssstat;
	OM_uint32		minor_stat;
	gss_name_t		target_name;
	int			ret_flags;
	OM_uint32		time_rec;
	gss_buffer_desc		input_name;
	AUTH			*auth = NULL;
	rpc_gss_data		*ap = NULL;
	int			error;

	/*
	 * convert name to GSS internal type
	 */
	input_name.value = principal;
	input_name.length = strlen(principal);

	if (options_ret != NULL) {
		options_ret->major_status = 0;
		options_ret->minor_status = 0;
	}

	gssstat = gss_import_name(&minor_stat, &input_name,
	    (gss_OID)GSS_C_NT_HOSTBASED_SERVICE, &target_name);

	if (gssstat != GSS_S_COMPLETE) {
		RPCGSS_LOG0(1,
		    "rpc_gss_seccreate: unable to import gss name\n");
		if (options_ret != NULL) {
			options_ret->major_status = gssstat;
			options_ret->minor_status = minor_stat;
		}
		return (ENOMEM);
	}

	/*
	 * Create AUTH handle.  Save the necessary interface information
	 * so that the client can refresh the handle later if needed.
	 */
	if ((auth = (AUTH *) kmem_alloc(sizeof (*auth), KM_SLEEP)) != NULL)
		ap = (rpc_gss_data *) kmem_alloc(sizeof (*ap), KM_SLEEP);
	if (auth == NULL || ap == NULL) {
		RPCGSS_LOG0(1, "rpc_gss_seccreate: out of memory\n");
		if (auth != NULL)
			kmem_free((char *)auth, sizeof (*auth));
		(void) gss_release_name(&minor_stat, &target_name);
		return (ENOMEM);
	}

	bzero((char *)ap, sizeof (*ap));
	ap->clnt = clnt;
	ap->version = RPCSEC_GSS_VERSION;
	if (options_req != NULL) {
		ap->my_cred = options_req->my_cred;
		ap->req_flags = options_req->req_flags;
		ap->time_req = options_req->time_req;
		ap->icb = options_req->input_channel_bindings;
	} else {
		ap->my_cred = GSS_C_NO_CREDENTIAL;
		ap->req_flags = GSS_C_MUTUAL_FLAG;
		ap->time_req = 0;
		ap->icb = GSS_C_NO_CHANNEL_BINDINGS;
	}
	if ((ap->service = service_type) == rpc_gss_svc_default)
		ap->service = rpc_gss_svc_integrity;
	ap->qop = qop;
	ap->target_name = target_name;

	/*
	 * Now invoke the real interface that sets up the context from
	 * the information stashed away in the private data.
	 */
	if (error = rpc_gss_seccreate_pvt(&gssstat, &minor_stat, auth, ap,
	    mechanism, &ap->mech_type, &ret_flags, &time_rec, cr, 0)) {
		if (ap->target_name) {
			(void) gss_release_name(&minor_stat, &ap->target_name);
		}
		if (options_ret != NULL) {
			options_ret->major_status = gssstat;
			options_ret->minor_status = minor_stat;
		}
		kmem_free((char *)ap, sizeof (*ap));
		kmem_free((char *)auth, sizeof (*auth));
		RPCGSS_LOG(1, "rpc_gss_seccreate: init context failed"
		    " errno=%d\n", error);
		return (error);
	}

	/*
	 * Make sure that the requested service is supported.  In all
	 * cases, integrity service must be available.
	 */
	if ((ap->service == rpc_gss_svc_privacy &&
	    !(ret_flags & GSS_C_CONF_FLAG)) ||
	    !(ret_flags & GSS_C_INTEG_FLAG)) {
		rpc_gss_destroy(auth);
		RPCGSS_LOG0(1, "rpc_gss_seccreate: service not supported\n");
		return (EPROTONOSUPPORT);
	}

	/*
	 * return option values if requested
	 */
	if (options_ret != NULL) {
		options_ret->major_status = gssstat;
		options_ret->minor_status = minor_stat;
		options_ret->rpcsec_version = ap->version;
		options_ret->ret_flags = ret_flags;
		options_ret->time_ret = time_rec;
		options_ret->gss_context = ap->context;
		/*
		 *  Caller's responsibility to free this.
		 */
		NOT_NULL(ap->mech_type);
		__rpc_gss_dup_oid(ap->mech_type,
		    (gss_OID *)&options_ret->actual_mechanism);
	}

	*retauth = auth;
	return (0);
}

/*
 * Private interface to create a context.  This is the interface
 * that's invoked when the context has to be refreshed.
 */
static int
rpc_gss_seccreate_pvt(gssstat, minor_stat, auth, ap, desired_mech_type,
			actual_mech_type, ret_flags, time_rec, cr, isrefresh)
	OM_uint32		*gssstat;
	OM_uint32		*minor_stat;
	AUTH			*auth;
	rpc_gss_data		*ap;
	gss_OID			desired_mech_type;
	gss_OID			*actual_mech_type;
	int			*ret_flags;
	OM_uint32		*time_rec;
	cred_t			*cr;
	int			isrefresh;
{
	CLIENT			*clnt = ap->clnt;
	AUTH			*save_auth;
	enum clnt_stat		callstat;
	rpc_gss_init_arg	call_arg;
	rpc_gss_init_res	call_res;
	gss_buffer_desc		*input_token_p, input_token, process_token;
	int			free_results = 0;
	k_sigset_t		smask;
	int			error = 0;

	/*
	 * (re)initialize AUTH handle and private data.
	 */
	bzero((char *)auth, sizeof (*auth));
	auth->ah_ops = &rpc_gss_ops;
	auth->ah_private = (caddr_t)ap;
	auth->ah_cred.oa_flavor = RPCSEC_GSS;

	ap->established = FALSE;
	ap->ctx_handle.length = 0;
	ap->ctx_handle.value = NULL;
	ap->context = NULL;
	ap->seq_num = 0;
	ap->gss_proc = RPCSEC_GSS_INIT;

	/*
	 * should not change clnt->cl_auth at this time, so save
	 * old handle
	 */
	save_auth = clnt->cl_auth;
	clnt->cl_auth = auth;

	/*
	 * set state for starting context setup
	 */
	bzero((char *)&call_arg, sizeof (call_arg));
	input_token_p = GSS_C_NO_BUFFER;

next_token:
	*gssstat = kgss_init_sec_context(minor_stat,
					ap->my_cred,
					&ap->context,
					ap->target_name,
					desired_mech_type,
					ap->req_flags,
					ap->time_req,
					NULL,
					input_token_p,
					actual_mech_type,
					&call_arg,
					ret_flags,
					time_rec,
					crgetuid(cr));

	if (input_token_p != GSS_C_NO_BUFFER) {
		OM_uint32 minor_stat2;

		(void) gss_release_buffer(&minor_stat2, input_token_p);
		input_token_p = GSS_C_NO_BUFFER;
	}

	if (*gssstat != GSS_S_COMPLETE && *gssstat != GSS_S_CONTINUE_NEEDED) {
		rpc_gss_display_status(*gssstat, *minor_stat,
			desired_mech_type, crgetuid(cr),
			"rpcsec_gss_secreate_pvt:gss_init_sec_context");
		error = EACCES;
		goto cleanup;
	}

	/*
	 * if we got a token, pass it on
	 */
	if (call_arg.length != 0) {
		struct timeval timeout = {30, 0};
		int	 rpcsec_retry = isrefresh ?
			RPCSEC_GSS_REFRESH_ATTEMPTS : 1;
		uint32_t oldxid;
		uint32_t zeroxid = 0;

		bzero((char *)&call_res, sizeof (call_res));

		(void) CLNT_CONTROL(clnt, CLGET_XID, (char *)&oldxid);
		(void) CLNT_CONTROL(clnt, CLSET_XID, (char *)&zeroxid);


		while (rpcsec_retry > 0) {
			struct rpc_err rpcerr;

			sigintr(&smask, INTERRUPT_OK);

			callstat = clnt_call(clnt, NULLPROC,
				__xdr_rpc_gss_init_arg, (caddr_t)&call_arg,
				__xdr_rpc_gss_init_res, (caddr_t)&call_res,
				timeout);

			sigunintr(&smask);

			if (callstat == RPC_SUCCESS) {
				error = 0;
				if (isrefresh &&
				    call_res.gss_major == GSS_S_FAILURE) {

					clock_t one_sec = drv_usectohz(1000000);

					rpcsec_retry--;

					/*
					 * Pause a little and try again.
					 */

					if (clnt->cl_nosignal == TRUE) {
						delay(one_sec);
					} else {
						if (delay_sig(one_sec)) {
							error = EINTR;
							break;
						}
					}
					continue;
				}
				break;
			}

			if (callstat == RPC_TIMEDOUT) {
				error = ETIMEDOUT;
				break;
			}

			if (callstat == RPC_XPRTFAILED) {
				error = ECONNRESET;
				break;
			}

			if (callstat == RPC_INTR) {
				error = EINTR;
				break;
			}

			if (callstat == RPC_INPROGRESS) {
				continue;
			}

			clnt_geterr(clnt, &rpcerr);
			error = rpcerr.re_errno;
			break;
		}

		(void) CLNT_CONTROL(clnt, CLSET_XID, (char *)&oldxid);

		(void) gss_release_buffer(minor_stat, &call_arg);

		if (callstat != RPC_SUCCESS) {
			RPCGSS_LOG(1,
			    "rpc_gss_seccreate_pvt: clnt_call failed %d\n",
			    callstat);
			goto cleanup;
		}

		/*
		 * we have results - note that these need to be freed
		 */
		free_results = 1;

		if ((call_res.gss_major != GSS_S_COMPLETE) &&
		    (call_res.gss_major != GSS_S_CONTINUE_NEEDED)) {
			RPCGSS_LOG1(1, "rpc_gss_seccreate_pvt: "
				"call_res gss_major %x, gss_minor %x\n",
				call_res.gss_major, call_res.gss_minor);
			error = EACCES;
			goto cleanup;
		}

		ap->gss_proc = RPCSEC_GSS_CONTINUE_INIT;

		/*
		 * check for ctx_handle
		 */
		if (ap->ctx_handle.length == 0) {
			if (call_res.ctx_handle.length == 0) {
				RPCGSS_LOG0(1, "rpc_gss_seccreate_pvt: zero "
					"length handle in response\n");
				error = EACCES;
				goto cleanup;
			}
			GSS_DUP_BUFFER(ap->ctx_handle,
					call_res.ctx_handle);
		} else if (!GSS_BUFFERS_EQUAL(ap->ctx_handle,
						call_res.ctx_handle)) {
			RPCGSS_LOG0(1,
			"rpc_gss_seccreate_pvt: ctx_handle not the same\n");
			error = EACCES;
			goto cleanup;
		}

		/*
		 * check for token
		 */
		if (call_res.token.length != 0) {
			if (*gssstat == GSS_S_COMPLETE) {
				RPCGSS_LOG0(1, "rpc_gss_seccreate_pvt: non "
					"zero length token in response, but "
					"gsstat == GSS_S_COMPLETE\n");
				error = EACCES;
				goto cleanup;
			}
			GSS_DUP_BUFFER(input_token, call_res.token);
			input_token_p = &input_token;

		} else if (*gssstat != GSS_S_COMPLETE) {
			RPCGSS_LOG0(1, "rpc_gss_seccreate_pvt:zero length "
				"token in response, but "
				"gsstat != GSS_S_COMPLETE\n");
			error = EACCES;
			goto cleanup;
		}

		/* save the sequence window value; validate later */
		ap->seq_window = call_res.seq_window;
		xdr_free(__xdr_rpc_gss_init_res, (caddr_t)&call_res);
		free_results = 0;
	}

	/*
	 * results were okay.. continue if necessary
	 */
	if (*gssstat == GSS_S_CONTINUE_NEEDED) {
		goto next_token;
	}

	/*
	 * Context is established. Now use kgss_export_sec_context and
	 * kgss_import_sec_context to transfer the context from the user
	 * land to kernel if the mechanism specific kernel module is
	 * available.
	 */
	*gssstat  = kgss_export_sec_context(minor_stat, ap->context,
						&process_token);
	if (*gssstat == GSS_S_NAME_NOT_MN) {
		RPCGSS_LOG(2, "rpc_gss_seccreate_pvt: export_sec_context "
			"Kernel Module unavailable  gssstat = 0x%x\n",
			*gssstat);
		goto done;
	} else if (*gssstat != GSS_S_COMPLETE) {
		(void) rpc_gss_display_status(*gssstat, *minor_stat,
			isrefresh ? GSS_C_NULL_OID : *actual_mech_type,
					crgetuid(cr),
			"rpcsec_gss_secreate_pvt:gss_export_sec_context");
		(void) kgss_delete_sec_context(minor_stat,
					&ap->context, NULL);
		error = EACCES;
		goto cleanup;
	} else if (process_token.length == 0) {
		RPCGSS_LOG0(1, "rpc_gss_seccreate_pvt:zero length "
				"token in response for export_sec_context, but "
				"gsstat == GSS_S_COMPLETE\n");
		(void) kgss_delete_sec_context(minor_stat,
					&ap->context, NULL);
		error = EACCES;
		goto cleanup;
	} else
		*gssstat = kgss_import_sec_context(minor_stat, &process_token,
							ap->context);

	if (*gssstat == GSS_S_COMPLETE) {
		(void) gss_release_buffer(minor_stat, &process_token);
	} else {
		rpc_gss_display_status(*gssstat, *minor_stat,
			desired_mech_type, crgetuid(cr),
			"rpcsec_gss_secreate_pvt:gss_import_sec_context");
		(void) kgss_delete_sec_context(minor_stat,
					&ap->context, NULL);
		(void) gss_release_buffer(minor_stat, &process_token);
		error = EACCES;
		goto cleanup;
	}

done:
	/*
	 * Validate the sequence window - RFC 2203 section 5.2.3.1
	 */
	if (!validate_seqwin(ap)) {
		error = EACCES;
		goto cleanup;
	}

	/*
	 * Done!  Security context creation is successful.
	 * Ready for exchanging data.
	 */
	ap->established = TRUE;
	ap->seq_num = 1;
	ap->gss_proc = RPCSEC_GSS_DATA;
	ap->invalid = FALSE;

	clnt->cl_auth = save_auth;	/* restore cl_auth */

	return (0);

cleanup:
	if (free_results)
		xdr_free(__xdr_rpc_gss_init_res, (caddr_t)&call_res);
	clnt->cl_auth = save_auth;	/* restore cl_auth */

	/*
	 * If need to retry for AUTH_REFRESH, do not cleanup the
	 * auth private data.
	 */
	if (isrefresh && (error == ETIMEDOUT || error == ECONNRESET)) {
		return (error);
	}

	if (ap->context != NULL) {
		rpc_gss_free_pvt(auth);
	}

	return (error? error : EACCES);
}

/*
 * Marshall credentials.
 */
static bool_t
marshall_creds(ap, xdrs, cred_buf_len)
	rpc_gss_data		*ap;
	XDR			*xdrs;
	uint_t			cred_buf_len;
{
	rpc_gss_creds		ag_creds;
	char			*cred_buf;
	struct opaque_auth	creds;
	XDR			cred_xdrs;

	ag_creds.version = ap->version;
	ag_creds.gss_proc = ap->gss_proc;
	ag_creds.seq_num = ap->seq_num;
	ag_creds.service = ap->service;

	/*
	 * If context has not been set up yet, use NULL handle.
	 */
	if (ap->ctx_handle.length > 0)
		ag_creds.ctx_handle = ap->ctx_handle;
	else {
		ag_creds.ctx_handle.length = 0;
		ag_creds.ctx_handle.value = NULL;
	}

	cred_buf = kmem_alloc(cred_buf_len, KM_SLEEP);
	xdrmem_create(&cred_xdrs, (caddr_t)cred_buf, cred_buf_len,
								XDR_ENCODE);
	if (!__xdr_rpc_gss_creds(&cred_xdrs, &ag_creds)) {
		kmem_free(cred_buf, MAX_AUTH_BYTES);
		XDR_DESTROY(&cred_xdrs);
		return (FALSE);
	}

	creds.oa_flavor = RPCSEC_GSS;
	creds.oa_base = cred_buf;
	creds.oa_length = xdr_getpos(&cred_xdrs);
	XDR_DESTROY(&cred_xdrs);

	if (!xdr_opaque_auth(xdrs, &creds)) {
		kmem_free(cred_buf, cred_buf_len);
		return (FALSE);
	}

	kmem_free(cred_buf, cred_buf_len);
	return (TRUE);
}

/*
 * Marshall verifier.  The verifier is the checksum of the RPC header
 * up to and including the credential field.  The XDR handle that's
 * passed in has the header up to and including the credential field
 * encoded.  A pointer to the transmit buffer is also passed in.
 */
static bool_t
marshall_verf(ap, xdrs, buf)
	rpc_gss_data		*ap;
	XDR			*xdrs;	/* send XDR */
	char			*buf;	/* pointer of send buffer */
{
	struct opaque_auth	verf;
	OM_uint32		major, minor;
	gss_buffer_desc		in_buf, out_buf;
	bool_t			ret = FALSE;

	/*
	 * If context is not established yet, use NULL verifier.
	 */
	if (!ap->established) {
		verf.oa_flavor = AUTH_NONE;
		verf.oa_base = NULL;
		verf.oa_length = 0;
		return (xdr_opaque_auth(xdrs, &verf));
	}

	verf.oa_flavor = RPCSEC_GSS;
	in_buf.length = xdr_getpos(xdrs);
	in_buf.value = buf;
	if ((major = kgss_sign(&minor, ap->context, ap->qop, &in_buf,
				&out_buf)) != GSS_S_COMPLETE) {
		if (major == GSS_S_CONTEXT_EXPIRED) {
			ap->invalid = TRUE;
		}
		RPCGSS_LOG1(1,
		    "marshall_verf: kgss_sign failed GSS Major %x Minor %x\n",
		    major, minor);
		return (FALSE);
	}
	verf.oa_base = out_buf.value;
	verf.oa_length = out_buf.length;
	ret = xdr_opaque_auth(xdrs, &verf);
	(void) gss_release_buffer(&minor, &out_buf);

	return (ret);
}

/*
 * Validate sequence window upon a successful RPCSEC_GSS INIT session.
 * The sequence window sent back by the server should be verifiable by
 * the verifier which is a checksum of the sequence window.
 */
static bool_t
validate_seqwin(rpc_gss_data *ap)
{
	uint_t			seq_win_net;
	OM_uint32		major = 0, minor = 0;
	gss_buffer_desc		msg_buf, tok_buf;
	int			qop_state = 0;

	ASSERT(ap->verifier);
	ASSERT(ap->context);
	seq_win_net = (uint_t)htonl(ap->seq_window);
	msg_buf.length = sizeof (seq_win_net);
	msg_buf.value = (char *)&seq_win_net;
	tok_buf.length = ap->verifier->oa_length;
	tok_buf.value = ap->verifier->oa_base;
	major = kgss_verify(&minor, ap->context, &msg_buf, &tok_buf,
	    &qop_state);

	if (major != GSS_S_COMPLETE) {
		RPCGSS_LOG1(1,
		    "validate_seqwin: kgss_verify failed GSS Major "
		    "%x Minor %x\n", major, minor);
		RPCGSS_LOG1(1, "seq_window %d, verf len %d ", ap->seq_window,
		    ap->verifier->oa_length);
		return (FALSE);
	}
	return (TRUE);
}

/*
 * Validate RPC response verifier from server.  The response verifier
 * is the checksum of the request sequence number.
 */
static bool_t
rpc_gss_validate(auth, verf)
	AUTH			*auth;
	struct opaque_auth	*verf;
{
	rpc_gss_data		*ap = AUTH_PRIVATE(auth);
	uint_t			seq_num_net;
	OM_uint32		major, minor;
	gss_buffer_desc		msg_buf, tok_buf;
	int			qop_state;

	/*
	 * If context is not established yet, save the verifier for
	 * validating the sequence window later at the end of context
	 * creation session.
	 */
	if (!ap->established) {
	    if (ap->verifier == NULL) {
		ap->verifier = kmem_zalloc(sizeof (struct opaque_auth),
						KM_SLEEP);
		if (verf->oa_length > 0)
		    ap->verifier->oa_base = kmem_zalloc(verf->oa_length,
						KM_SLEEP);
	    } else {
		if (ap->verifier->oa_length > 0)
		    kmem_free(ap->verifier->oa_base, ap->verifier->oa_length);
		if (verf->oa_length > 0)
		    ap->verifier->oa_base = kmem_zalloc(verf->oa_length,
						KM_SLEEP);
	    }
	    ap->verifier->oa_length = verf->oa_length;
	    bcopy(verf->oa_base, ap->verifier->oa_base, verf->oa_length);
	    return (TRUE);
	}

	seq_num_net = (uint_t)htonl(ap->seq_num);
	msg_buf.length = sizeof (seq_num_net);
	msg_buf.value = (char *)&seq_num_net;
	tok_buf.length = verf->oa_length;
	tok_buf.value = verf->oa_base;
	major = kgss_verify(&minor, ap->context, &msg_buf, &tok_buf,
				&qop_state);
	if (major != GSS_S_COMPLETE) {
		RPCGSS_LOG1(1,
		"rpc_gss_validate: kgss_verify failed GSS Major %x Minor %x\n",
		major, minor);
		return (FALSE);
	}
	return (TRUE);
}

/*
 * Refresh client context.  This is necessary sometimes because the
 * server will ocassionally destroy contexts based on LRU method, or
 * because of expired credentials.
 */
static bool_t
rpc_gss_refresh(auth, msg, cr)
	AUTH		*auth;
	struct rpc_msg	*msg;
	cred_t		*cr;
{
	rpc_gss_data	*ap = AUTH_PRIVATE(auth);
	gss_ctx_id_t	ctx_sav = NULL;
	gss_buffer_desc	ctx_hdle_sav = {0, NULL};
	uint_t		sn_sav, proc_sav;
	bool_t		est_sav;
	OM_uint32	gssstat, minor_stat;
	int error;

	/*
	 * The context needs to be recreated only when the error status
	 * returned from the server is one of the following:
	 *	RPCSEC_GSS_NOCRED and RPCSEC_GSS_FAILED
	 * The existing context should not be destroyed unless the above
	 * error status codes are received or if the context has not
	 * been set up.
	 */

	if (msg->rjcted_rply.rj_why == RPCSEC_GSS_NOCRED ||
			msg->rjcted_rply.rj_why == RPCSEC_GSS_FAILED ||
							!ap->established) {
		/*
		 * Destroy the context if necessary.  Use the same memory
		 * for the new context since we've already passed a pointer
		 * to it to the user.
		 */
		if (ap->context != NULL) {
			ctx_sav = ap->context;
			ap->context = NULL;
		}
		if (ap->ctx_handle.length != 0) {
			ctx_hdle_sav.length = ap->ctx_handle.length;
			ctx_hdle_sav.value = ap->ctx_handle.value;
			ap->ctx_handle.length = 0;
			ap->ctx_handle.value = NULL;
		}

		/*
		 * If the context was not already established, don't try to
		 * recreate it.
		 */
		if (!ap->established) {
			ap->invalid = TRUE;
			RPCGSS_LOG0(1,
			"rpc_gss_refresh: context was not established\n");
			error = EINVAL;
			goto out;
		}

		est_sav = ap->established;
		sn_sav = ap->seq_num;
		proc_sav = ap->gss_proc;

		/*
		 * Recreate context.
		 */
		error = rpc_gss_seccreate_pvt(&gssstat, &minor_stat, auth,
				ap, ap->mech_type, (gss_OID *)NULL, (int *)NULL,
				(OM_uint32 *)NULL, cr, 1);

		switch (error) {
		case 0:
			RPCGSS_LOG(1,
			"rpc_gss_refresh: auth %p refreshed\n", (void *)auth);
			goto out;

		case ETIMEDOUT:
		case ECONNRESET:
			RPCGSS_LOG0(1, "rpc_gss_refresh: try again\n");

			if (ap->context != NULL) {
			    (void) kgss_delete_sec_context(&minor_stat,
					&ap->context, NULL);
			}
			if (ap->ctx_handle.length != 0) {
			    (void) gss_release_buffer(&minor_stat,
					&ap->ctx_handle);
			}

			/*
			 * Restore the original value for the caller to
			 * try again later.
			 */
			ap->context = ctx_sav;
			ap->ctx_handle.length = ctx_hdle_sav.length;
			ap->ctx_handle.value = ctx_hdle_sav.value;
			ap->established = est_sav;
			ap->seq_num = sn_sav;
			ap->gss_proc = proc_sav;

			return (FALSE);

		default:
			ap->invalid = TRUE;
			RPCGSS_LOG(1, "rpc_gss_refresh: can't refresh this "
				"auth, error=%d\n", error);
			goto out;
		}
	}
	RPCGSS_LOG0(1, "rpc_gss_refresh: don't refresh");
	return (FALSE);

out:
	if (ctx_sav != NULL) {
		(void) kgss_delete_sec_context(&minor_stat,
				&ctx_sav, NULL);
	}
	if (ctx_hdle_sav.length != 0) {
		(void) gss_release_buffer(&minor_stat, &ctx_hdle_sav);
	}

	return (error == 0);
}

/*
 * Destroy a context.
 */
static void
rpc_gss_destroy(auth)
	AUTH		*auth;
{
	rpc_gss_data	*ap = AUTH_PRIVATE(auth);

	/*
	 *  XXX Currently, we do not ping the server (rpc_gss_destroy_pvt)
	 *  to destroy the context in the server cache.
	 *  We assume there is a good LRU/aging mechanism for the
	 *  context cache on the server side.
	 */
	rpc_gss_free_pvt(auth);
	kmem_free((char *)ap, sizeof (*ap));
	kmem_free(auth, sizeof (*auth));
}

/*
 * Private interface to free memory allocated in the rpcsec_gss private
 * data structure (rpc_gss_data).
 */
static void
rpc_gss_free_pvt(auth)
	AUTH		*auth;
{
	OM_uint32	minor_stat;
	rpc_gss_data	*ap = AUTH_PRIVATE(auth);

	if (ap->ctx_handle.length != 0) {
		(void) gss_release_buffer(&minor_stat, &ap->ctx_handle);
		ap->ctx_handle.length = 0;
		ap->ctx_handle.value = NULL;
	}

	/*
	 * Destroy local GSS context.
	 */
	if (ap->context != NULL) {
		(void) kgss_delete_sec_context(&minor_stat, &ap->context, NULL);
		ap->context = NULL;
	}

	/*
	 * Looks like we need to release default credentials if we use it.
	 * Non-default creds need to be released by user.
	 */
	if (ap->my_cred == GSS_C_NO_CREDENTIAL)
		(void) kgss_release_cred(&minor_stat, &ap->my_cred,
					crgetuid(CRED()));

	/*
	 * Release any internal name structures.
	 */
	if (ap->target_name != NULL) {
		(void) gss_release_name(&minor_stat, &ap->target_name);
		ap->target_name = NULL;
	}

	/*
	 * Free mech_type oid structure.
	 */
	if (ap->mech_type != NULL) {
		kgss_free_oid(ap->mech_type);
		ap->mech_type = NULL;
	}

	/*
	 * Free the verifier saved for sequence window checking.
	 */
	if (ap->verifier != NULL) {
	    if (ap->verifier->oa_length > 0) {
		kmem_free(ap->verifier->oa_base, ap->verifier->oa_length);
	    }
	    kmem_free(ap->verifier, sizeof (struct opaque_auth));
	    ap->verifier = NULL;
	}
}

#if 0
/*
 * XXX this function is not used right now.
 * There is a client handle issue needs to be resolved.
 *
 * This is a private interface which will destroy a context
 * without freeing up the memory used by it.  We need to do this when
 * a refresh fails, for example, so the user will still have a handle.
 */
static void
rpc_gss_destroy_pvt(auth)
	AUTH		*auth;
{
	struct timeval	timeout;
	rpc_gss_data	*ap = AUTH_PRIVATE(auth);

	/*
	 * If we have a server context id, inform server that we are
	 * destroying the context.
	 */
	if (ap->ctx_handle.length != 0) {
		uint32_t oldxid;
		uint32_t zeroxid = 0;

		ap->gss_proc = RPCSEC_GSS_DESTROY;
		timeout.tv_sec = 10;
		timeout.tv_usec = 0;
		(void) CLNT_CONTROL(ap->clnt, CLGET_XID, (char *)&oldxid);
		(void) CLNT_CONTROL(ap->clnt, CLSET_XID, (char *)&zeroxid);
		(void) clnt_call(ap->clnt, NULLPROC, xdr_void, NULL,
						xdr_void, NULL, timeout);
		(void) CLNT_CONTROL(ap->clnt, CLSET_XID, (char *)&oldxid);
	}

	rpc_gss_free_pvt(auth);
}
#endif

/*
 * Wrap client side data.  The encoded header is passed in through
 * buf and buflen.  The header is up to but not including the
 * credential field.
 */
bool_t
rpc_gss_wrap(auth, buf, buflen, out_xdrs, xdr_func, xdr_ptr)
	AUTH			*auth;
	char			*buf;		/* encoded header */
/* has been changed to u_int in the user land */
	uint_t			buflen;		/* encoded header length */
	XDR			*out_xdrs;
	xdrproc_t		xdr_func;
	caddr_t			xdr_ptr;
{
	rpc_gss_data		*ap = AUTH_PRIVATE(auth);
	XDR			xdrs;
	char			*tmp_buf;
	uint_t			xdr_buf_len, cred_buf_len;

/*
 *  Here is how MAX_SIGNED_LEN is estimated.
 *  Signing a 48 bytes buffer using des_cbc_md5 would end up with
 *  a buffer length 33 (padded data + 16 bytes of seq_num/checksum).
 *  Current known max seq_num/checksum size is 24 bytes.
 *  88 is derived from RNDUP(33+(24-16)) * 2.
 */
#define	MAX_SIGNED_LEN	88

	/*
	 * Reject an invalid context.
	 */
	if (ap->invalid) {
		RPCGSS_LOG0(1, "rpc_gss_wrap: reject an invalid context\n");
		return (FALSE);
	}

	/*
	 * If context is established, bump up sequence number.
	 */
	if (ap->established)
		ap->seq_num++;

	/*
	 * Create the header in a temporary XDR context and buffer
	 * before putting it out.
	 */
	cred_buf_len = RNDUP(sizeof (ap->version) + sizeof (ap->gss_proc) +
			sizeof (ap->seq_num) + sizeof (ap->service) +
			sizeof (ap->ctx_handle) + ap->ctx_handle.length);

	xdr_buf_len = buflen + cred_buf_len + sizeof (struct opaque_auth) +
			MAX_SIGNED_LEN;
	tmp_buf = kmem_alloc(xdr_buf_len, KM_SLEEP);
	xdrmem_create(&xdrs, tmp_buf, xdr_buf_len, XDR_ENCODE);
	if (!XDR_PUTBYTES(&xdrs, buf, buflen)) {
		kmem_free(tmp_buf, xdr_buf_len);
		RPCGSS_LOG0(1, "rpc_gss_wrap: xdr putbytes failed\n");
		return (FALSE);
	}

	/*
	 * create cred field
	 */
	if (!marshall_creds(ap, &xdrs, cred_buf_len)) {
		kmem_free(tmp_buf, xdr_buf_len);
		RPCGSS_LOG0(1, "rpc_gss_wrap: marshall_creds failed\n");
		return (FALSE);
	}

	/*
	 * create verifier
	 */
	if (!marshall_verf(ap, &xdrs, tmp_buf)) {
		kmem_free(tmp_buf, xdr_buf_len);
		RPCGSS_LOG0(1, "rpc_gss_wrap: marshall_verf failed\n");
		return (FALSE);
	}

	/*
	 * write out header and destroy temp structures
	 */
	if (!XDR_PUTBYTES(out_xdrs, tmp_buf, XDR_GETPOS(&xdrs))) {
		kmem_free(tmp_buf, xdr_buf_len);
		RPCGSS_LOG0(1, "rpc_gss_wrap: write out header failed\n");
		return (FALSE);
	}
	XDR_DESTROY(&xdrs);
	kmem_free(tmp_buf, xdr_buf_len);

	/*
	 * If context is not established, or if neither integrity
	 * nor privacy is used, just XDR encode data.
	 */
	if (!ap->established || ap->service == rpc_gss_svc_none) {
		return ((*xdr_func)(out_xdrs, xdr_ptr));
	}

	return (__rpc_gss_wrap_data(ap->service, ap->qop, ap->context,
				ap->seq_num, out_xdrs, xdr_func, xdr_ptr));
}

/*
 * Unwrap received data.
 */
bool_t
rpc_gss_unwrap(auth, in_xdrs, xdr_func, xdr_ptr)
	AUTH			*auth;
	XDR			*in_xdrs;
	bool_t			(*xdr_func)();
	caddr_t			xdr_ptr;
{
	rpc_gss_data		*ap = AUTH_PRIVATE(auth);

	/*
	 * If context is not established, of if neither integrity
	 * nor privacy is used, just XDR encode data.
	 */
	if (!ap->established || ap->service == rpc_gss_svc_none)
		return ((*xdr_func)(in_xdrs, xdr_ptr));

	return (__rpc_gss_unwrap_data(ap->service,
				ap->context,
				ap->seq_num,
				ap->qop,
				in_xdrs, xdr_func, xdr_ptr));
}

/*
 *  Revoke an GSSAPI based security credentials
 *  from the cache table.
 */
int
rpc_gss_revauth(uid_t uid, rpc_gss_OID mech)
{
	struct ga_cache_entry *next, *prev, *cur;
	rpc_gss_data *ap;
	zoneid_t zoneid = getzoneid();
	int i;

	/*
	 *  Check the cache table against the uid and the
	 *  mechanism type.
	 */
	rw_enter(&ga_cache_table_lock, RW_WRITER);
	for (i = 0; i < GSSAUTH_TABLESIZE; i++) {
		prev = NULL;
		for (cur = ga_cache_table[i]; cur; cur = next) {
			NOT_DEAD(cur);
			next = cur->next;
			NOT_DEAD(next);
			ap = AUTH_PRIVATE(cur->auth);
			if (__rpc_gss_oids_equal(ap->mech_type,
			    (gss_OID) mech) && (cur->uid == uid) &&
			    (cur->zoneid == zoneid)) {
				if (cur->in_use) {
					RPCGSS_LOG(2, "rpc_gss_revauth:invalid "
					    "auth %p\n", (void *)cur->auth);
					ap->invalid = TRUE;
				} else {
					RPCGSS_LOG(2, "rpc_gss_revauth:destroy "
					    "auth %p\n", (void *)cur->auth);
					rpc_gss_destroy(cur->auth);
					kmem_cache_free(ga_cache_handle,
					    (void *)cur);
				}
				if (prev == NULL) {
					ga_cache_table[i] = next;
				} else {
					prev->next = next;
					NOT_DEAD(prev->next);
				}
			} else {
				prev = cur;
			}
		}
	}
	rw_exit(&ga_cache_table_lock);

	return (0);
}


/*
 *  Delete all the entries indexed by the cache_key.
 *
 *  For example, the cache_key used for NFS is the address of the
 *  security entry for each mount point.  When the file system is unmounted,
 *  all the cache entries indexed by this key should be deleted.
 */
void
rpc_gss_secpurge(void *cache_key)
{
	struct ga_cache_entry *next, *prev, *cur;
	int i;

	/*
	 *  Check the cache table against the cache_key.
	 */
	rw_enter(&ga_cache_table_lock, RW_WRITER);
	for (i = 0; i < GSSAUTH_TABLESIZE; i++) {
		prev = NULL;
		for (cur = ga_cache_table[i]; cur; cur = next) {
			NOT_DEAD(cur);
			next = cur->next;
			NOT_DEAD(next);
			if (cache_key == cur->cache_key) {
				RPCGSS_LOG(2, "rpc_gss_secpurge: destroy auth "
				    "%p\n", (void *)cur->auth);
				if (cur->in_use == FALSE)
					rpc_gss_destroy(cur->auth);
				kmem_cache_free(ga_cache_handle, (void *)cur);
				if (prev == NULL) {
					ga_cache_table[i] = next;
				} else {
					NOT_DEAD(prev->next);
					prev->next = next;
				}
			} else {
				prev = cur;
			}
		}
	}
	rw_exit(&ga_cache_table_lock);
}

/*
 * Function: rpc_gss_nextverf.  Not used.
 */
static void
rpc_gss_nextverf()
{
}

/*
 * Function: rpc_gss_marshall - no op routine.
 *		rpc_gss_wrap() is doing the marshalling.
 */
/*ARGSUSED*/
static bool_t
rpc_gss_marshall(auth, xdrs)
	AUTH		*auth;
	XDR		*xdrs;
{
	return (TRUE);
}

/*
 * Set service defaults.
 * Not supported yet.
 */
/* ARGSUSED */
bool_t
rpc_gss_set_defaults(auth, service, qop)
	AUTH			*auth;
	rpc_gss_service_t	service;
	uint_t			qop;
{
	return (FALSE);
}

/* ARGSUSED */
int
rpc_gss_max_data_length(AUTH *rpcgss_handle, int max_tp_unit_len)
{
	return (0);
}

rpc_gss_service_t
rpc_gss_get_service_type(AUTH *auth)
{
	rpc_gss_data		*ap = AUTH_PRIVATE(auth);

	return (ap->service);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 1996,1997,1999,2002-2003 Sun Microsystems, Inc.
 * All rights reserved.  Use is subject to license terms.
 */

/*
 * Copyright 1993 OpenVision Technologies, Inc., All Rights Reserved.
 *
 * $Header:
 * /afs/gza.com/product/secure/rel-eng/src/1.1/rpc/RCS/auth_gssapi_misc.c,v 1.10
 * 1994/10/27 12:39:23 jik Exp $
 */

/*
 * Copyright (c) 2013 by Delphix. All rights reserved.
 */

#include <sys/param.h>
#include <sys/types.h>
#include <sys/stream.h>
#include <sys/strsubr.h>
#include <sys/cmn_err.h>
#include <gssapi/gssapi.h>
#include <rpc/rpc.h>
#include <rpc/rpcsec_defs.h>

/*
 * The initial allocation size for dynamic allocation.
 */
#define	CKU_INITSIZE    2048

/*
 * The size of additional allocations, if required.  It is larger to
 * reduce the number of actual allocations.
 */
#define	CKU_ALLOCSIZE   8192


/*
 * Miscellaneous XDR routines.
 */
bool_t
__xdr_gss_buf(xdrs, buf)
	XDR		*xdrs;
	gss_buffer_t	buf;
{
	uint_t cast_len, bound_len;

	/*
	 * We go through this contortion because size_t is a now a ulong,
	 * GSS-API uses ulongs.
	 */

	if (xdrs->x_op != XDR_DECODE) {
		bound_len = cast_len = (uint_t)buf->length;
	} else {
		bound_len = (uint_t)-1;
	}

	if (xdr_bytes(xdrs, (char **)&buf->value, &cast_len,
	    bound_len) == TRUE) {
		if (xdrs->x_op == XDR_DECODE)
			buf->length = cast_len;

		return (TRUE);
	}

	return (FALSE);
}

bool_t
__xdr_rpc_gss_creds(xdrs, creds)
	XDR			*xdrs;
	rpc_gss_creds		*creds;
{
	if (!xdr_u_int(xdrs, (uint_t *)&creds->version) ||
				!xdr_u_int(xdrs, (uint_t *)&creds->gss_proc) ||
				!xdr_u_int(xdrs, (uint_t *)&creds->seq_num) ||
				!xdr_u_int(xdrs, (uint_t *)&creds->service) ||
				!__xdr_gss_buf(xdrs, &creds->ctx_handle))
		return (FALSE);
	return (TRUE);
}

bool_t
__xdr_rpc_gss_init_arg(xdrs, init_arg)
	XDR			*xdrs;
	rpc_gss_init_arg	*init_arg;
{
	if (!__xdr_gss_buf(xdrs, init_arg))
		return (FALSE);
	return (TRUE);
}

bool_t
__xdr_rpc_gss_init_res(xdrs, init_res)
	XDR			*xdrs;
	rpc_gss_init_res	*init_res;
{
	if (!__xdr_gss_buf(xdrs, &init_res->ctx_handle) ||
			!xdr_u_int(xdrs, (uint_t *)&init_res->gss_major) ||
			!xdr_u_int(xdrs, (uint_t *)&init_res->gss_minor) ||
			!xdr_u_int(xdrs, (uint_t *)&init_res->seq_window) ||
			!__xdr_gss_buf(xdrs, &init_res->token))
		return (FALSE);
	return (TRUE);
}

/*
 * Generic routine to wrap data used by client and server sides.
 */
bool_t
__rpc_gss_wrap_data(service, qop, context, seq_num, out_xdrs,
			xdr_func, xdr_ptr)
	OM_uint32		qop;
	rpc_gss_service_t	service;
	gss_ctx_id_t		context;
	uint_t			seq_num;
	XDR			*out_xdrs;
	bool_t			(*xdr_func)();
	caddr_t			xdr_ptr;
{
	OM_uint32		major, minor;
	gss_buffer_desc		in_buf, out_buf;
	XDR			temp_xdrs;
	char			*temp_data;
	bool_t			conf_state;
	bool_t			ret = FALSE;
	int			size;

	/*
	 * Create a temporary XDR/buffer to hold the data to be wrapped.
	 * We need an extra bit for the sequence number serialized first.
	 */
	size = xdr_sizeof(xdr_func, xdr_ptr) + BYTES_PER_XDR_UNIT;
	temp_data = kmem_alloc(size, KM_SLEEP);
	out_buf.length = 0;

	xdrmem_create(&temp_xdrs, temp_data, size, XDR_ENCODE);

	/*
	 * serialize the sequence number into tmp memory
	 */
	if (!xdr_u_int(&temp_xdrs, &seq_num))
		goto fail;

	/*
	 * serialize the arguments into tmp memory
	 */
	if (!(*xdr_func)(&temp_xdrs, xdr_ptr))
		goto fail;

	/*
	 * Data to be wrapped goes in in_buf.  If privacy is used,
	 * out_buf will have wrapped data (in_buf will no longer be
	 * needed).  If integrity is used, out_buf will have checksum
	 * which will follow the data in in_buf.
	 */
	in_buf.length = xdr_getpos(&temp_xdrs);
	in_buf.value = (char *)temp_xdrs.x_base;

	switch (service) {
	case rpc_gss_svc_privacy:

		if ((major = kgss_seal(&minor, context, TRUE, qop, &in_buf,
				&conf_state, &out_buf)) != GSS_S_COMPLETE) {
			RPCGSS_LOG1(1, "rpc_gss_wrap: kgss_seal failed."
				"major = %x, minor = %x", major, minor);
			goto fail;
		}
		in_buf.length = 0;	/* in_buf not needed */
		if (!conf_state)
			goto fail;
		break;
	case rpc_gss_svc_integrity:
		if ((major = kgss_sign(&minor, context, qop, &in_buf,
				&out_buf)) != GSS_S_COMPLETE) {
			RPCGSS_LOG1(1, "rpc_gss_wrap: kgss_sign failed."
				"major = %x, minor = %x", major, minor);
			goto fail;
		}
		break;
	default:
		goto fail;
	}

	/*
	 * write out in_buf and out_buf as needed
	 */
	if (in_buf.length != 0) {
		if (!__xdr_gss_buf(out_xdrs, &in_buf))
			goto fail;
	}

	if (!__xdr_gss_buf(out_xdrs, &out_buf))
		goto fail;
	ret = TRUE;
fail:
	kmem_free(temp_data, size);
	if (out_buf.length != 0)
		(void) gss_release_buffer(&minor, &out_buf);
	return (ret);
}

/*
 * Generic routine to unwrap data used by client and server sides.
 */
bool_t
__rpc_gss_unwrap_data(service, context, seq_num, qop_check, in_xdrs,
			xdr_func, xdr_ptr)
	rpc_gss_service_t	service;
	gss_ctx_id_t		context;
	uint_t			seq_num;
	OM_uint32		qop_check;
	XDR			*in_xdrs;
	bool_t			(*xdr_func)();
	caddr_t			xdr_ptr;
{
	gss_buffer_desc		in_buf, out_buf;
	XDR			temp_xdrs;
	uint_t			seq_num2;
	bool_t			conf = FALSE;
	OM_uint32		major = GSS_S_COMPLETE, minor = 0;
	int			qop = 0;

	in_buf.value = NULL;
	out_buf.value = NULL;

	/*
	 * Pull out wrapped data.  For privacy service, this is the
	 * encrypted data.  For integrity service, this is the data
	 * followed by a checksum.
	 */
	if (!__xdr_gss_buf(in_xdrs, &in_buf)) {
		return (FALSE);
	}

	if (service == rpc_gss_svc_privacy) {
		major = GSS_S_FAILURE;
		major = kgss_unseal(&minor, context, &in_buf, &out_buf, &conf,
					&qop);
		kmem_free(in_buf.value, in_buf.length);
		if (major != GSS_S_COMPLETE) {
			RPCGSS_LOG1(1, "rpc_gss_unwrap: kgss_unseal failed."
				"major = %x, minor = %x", major, minor);
			return (FALSE);
		}
		/*
		 * Keep the returned token (unencrypted data) in in_buf.
		 */
		in_buf.length = out_buf.length;
		in_buf.value = out_buf.value;

		/*
		 * If privacy was not used, or if QOP is not what we are
		 * expecting, fail.
		 */
		if (!conf || qop != qop_check)
			goto fail;

	} else if (service == rpc_gss_svc_integrity) {
		if (!__xdr_gss_buf(in_xdrs, &out_buf)) {
			return (FALSE);
		}
		major = kgss_verify(&minor, context, &in_buf, &out_buf,
				&qop);
		kmem_free(out_buf.value, out_buf.length);
		if (major != GSS_S_COMPLETE) {
			kmem_free(in_buf.value, in_buf.length);
			RPCGSS_LOG1(1, "rpc_gss_unwrap: kgss_verify failed."
				"major = %x, minor = %x", major, minor);
			return (FALSE);
		}

		/*
		 * If QOP is not what we are expecting, fail.
		 */
		if (qop != qop_check)
			goto fail;
	}

	xdrmem_create(&temp_xdrs, in_buf.value, in_buf.length, XDR_DECODE);

	/*
	 * The data consists of the sequence number followed by the
	 * arguments.  Make sure sequence number is what we are
	 * expecting (i.e., the value in the header).
	 */
	if (!xdr_u_int(&temp_xdrs, &seq_num2))
		goto fail;
	if (seq_num2 != seq_num)
		goto fail;

	/*
	 * Deserialize the arguments into xdr_ptr, and release in_buf.
	 */
	if (!(*xdr_func)(&temp_xdrs, xdr_ptr)) {
		goto fail;
	}

	if (service == rpc_gss_svc_privacy)
		(void) gss_release_buffer(&minor, &in_buf);
	else
		kmem_free(in_buf.value, in_buf.length);
	XDR_DESTROY(&temp_xdrs);
	return (TRUE);
fail:
	XDR_DESTROY(&temp_xdrs);
	if (service == rpc_gss_svc_privacy)
		(void) gss_release_buffer(&minor, &in_buf);
	else
		kmem_free(in_buf.value, in_buf.length);
	return (FALSE);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 1996-1997,2003 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#include <sys/systm.h>
#include <sys/errno.h>
#include <sys/cmn_err.h>
#include <gssapi/gssapi.h>
#include <rpc/rpc.h>
#include <rpc/rpcsec_defs.h>

#ifdef RPCGSS_DEBUG
/*
 * Kernel rpcsec_gss module debugging aid. The global variable "rpcgss_log"
 * is a bit mask which allows various types of debugging messages to be printed
 * out.
 *
 *	  rpcgss_log & 1	will cause actual failures to be printed.
 *	  rpcgss_log & 2 	will cause informational messages to be
 *			printed on the client side of rpcsec_gss.
 *	  rpcgss_log & 4	will cause informational messages to be
 *			printed on the server side of rpcsec_gss.
 *	  rpcgss_log & 8	will cause informational messages to be
 *			printed on both client and server side of rpcsec_gss.
 */

uint_t rpcgss_log = 0;

#endif /* RPCGSS_DEBUG */

/*
 * Internal utility routines.
 */

/*
 *  Duplicate a gss_OID value.
 */
void
__rpc_gss_dup_oid(gss_OID oid, gss_OID *ret)
{
	gss_OID tmp;

	if (oid == GSS_C_NULL_OID || oid->length == 0) {
		*ret = NULL;
		return;
	}

	tmp = (gss_OID) kmem_alloc(sizeof (gss_OID_desc), KM_SLEEP);
	if (tmp) {
	    tmp->elements = kmem_alloc((oid->length), KM_SLEEP);
	    bcopy((char *)oid->elements, (char *)tmp->elements, oid->length);
	    tmp->length = oid->length;
	    *ret = tmp;
	} else {
	    *ret = NULL;
	}
}

/*
 *  Check if 2 gss_OID are the same.
 */
bool_t
__rpc_gss_oids_equal(oid1, oid2)
	gss_OID	oid1, oid2;
{
	if ((oid1->length == 0) && (oid2->length == 0))
		return (TRUE);

	if (oid1->length != oid2->length)
		return (FALSE);

	return (bcmp(oid1->elements, oid2->elements, oid1->length) == 0);
}

void
__rpc_gss_convert_name(principal, name, name_type)
	rpc_gss_principal_t	principal;
	gss_buffer_desc		*name;
	gss_OID			*name_type;
{
	char			*cp;

	cp = principal->name;
	if (*(int *)cp == 0)
		*name_type = GSS_C_NULL_OID;
	else {
		(*name_type)->length = *(int *)cp;
		(*name_type)->elements = (void *)(cp + sizeof (int));
	}
	cp += RNDUP(*(int *)cp) + sizeof (int);
	if ((name->length = *(int *)cp) == 0)
		name->value = NULL;
	else
		name->value = cp + sizeof (int);
}

/*
 *  Make a client principal name from a flat exported gss name.
 */
bool_t
__rpc_gss_make_principal(principal, name)
	rpc_gss_principal_t	*principal;
	gss_buffer_desc		*name;
{
	int			plen;
	char			*s;

	RPCGSS_LOG(8, "name-length = %lu\n", name->length);
	RPCGSS_LOG(8, "name-value = 0x%p\n", (void *)name->value);

	plen = RNDUP(name->length) + sizeof (int);
	(*principal) = (rpc_gss_principal_t)kmem_alloc(plen, KM_SLEEP);
	if ((*principal) == NULL)
		return (FALSE);
	bzero((caddr_t)(*principal), plen);
	(*principal)->len = RNDUP(name->length);
	s = (*principal)->name;
	bcopy(name->value, s, name->length);
	return (TRUE);
}


/*
 * Make a copy of a principal name.
 */
rpc_gss_principal_t
__rpc_gss_dup_principal(principal)
	rpc_gss_principal_t	principal;
{
	rpc_gss_principal_t	pdup;
	int			len;

	if (principal == NULL)
		return (NULL);
	len = principal->len + sizeof (int);
	if ((pdup = (rpc_gss_principal_t)mem_alloc(len)) == NULL)
		return (NULL);
	pdup->len = len;
	bcopy(principal->name, pdup->name, len);
	return (pdup);
}

/*
 * Returns highest and lowest versions of RPCSEC_GSS flavor supported.
 */
bool_t
rpc_gss_get_versions(vers_hi, vers_lo)
	uint_t	*vers_hi;
	uint_t	*vers_lo;
{
	*vers_hi = RPCSEC_GSS_VERSION;
	*vers_lo = RPCSEC_GSS_VERSION;
	return (TRUE);
}

void
rpc_gss_display_status(major, minor, mech_type,
		uid, gss_function_name)
	OM_uint32	major, minor;
	gss_OID		mech_type;
	uid_t		uid;
	char		*gss_function_name;

{
	int message_context;
	int major_stat;
	uint_t minor_stat;
	gss_buffer_desc status_string;

	/*
	 * Before we return let us see
	 * whether we can log more meaningful error
	 * string using kgss_display_status
	 * If we can not just log the gssstat in hex
	 * and return.
	 */
	message_context = 0;

	/*
	 * First get the status string out of gss_major_code
	 */

	do {
	    major_stat = kgss_display_status(&minor_stat, major,
		GSS_C_GSS_CODE, mech_type,
		&message_context, &status_string, uid);
		/*
		 * If we failed just log the original error codes
		 */
	    if (major_stat != GSS_S_COMPLETE &&
		major != GSS_S_CONTINUE_NEEDED) {

		RPCGSS_LOG1(1, "%s GSS major error 0x%x\n",
			gss_function_name, major);
		RPCGSS_LOG1(1, "%s GSS minor error 0x%x\n",
			gss_function_name, minor);

		return;
	    } else {
		RPCGSS_LOG1(1, "%s GSS Error %s\n",
			(char *)gss_function_name,
			(char *)status_string.value);
		(void) gss_release_buffer(&minor_stat, &status_string);
	    }
	} while (message_context != 0);
	/*
	 * Now get the status string out of gss_minor_code
	 * This is mechanism specific error which is most
	 * useful
	 */
	message_context = 0;
	do {
	    major_stat = kgss_display_status(&minor_stat, minor,
		GSS_C_MECH_CODE, mech_type,
		&message_context, &status_string, uid);
	    if (major_stat != GSS_S_COMPLETE &&
		major_stat != GSS_S_CONTINUE_NEEDED) {
		RPCGSS_LOG1(1, "%s GSS minor error 0x%x\n",
		gss_function_name, minor);
		return;
	    } else {
		RPCGSS_LOG1(1,
		    "%s GSS Minor Error %s\n",
		    (char *)gss_function_name, (char *)status_string.value);
		(void) gss_release_buffer(&minor_stat,
		    &status_string);
	    }
	} while (message_context != 0);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 * Copyright (c) 2011 Bayard G. Bell. All rights reserved.
 */

#include <sys/types.h>
#include <sys/modctl.h>
#include <sys/errno.h>

/*
 * Module linkage information for the kernel.
 */
static struct modlmisc modlmisc = {
	&mod_miscops, "kernel RPCSEC_GSS security service."
};

static struct modlinkage modlinkage = {
	MODREV_1, &modlmisc, NULL
};

int
_init()
{
	int retval = 0;
	extern void gssauth_init();
	extern void svc_gss_init();
	extern void gssauth_fini();
	extern void svc_gss_fini();

	gssauth_init();
	svc_gss_init();

	if ((retval = mod_install(&modlinkage)) != 0) {
		gssauth_fini();
		svc_gss_fini();
	}

	return (retval);
}

int
_fini()
{
	return (EBUSY);
}

int
_info(struct modinfo *modinfop)
{
	return (mod_info(&modlinkage, modinfop));
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2021 Tintri by DDN, Inc. All rights reserved.
 * Copyright (c) 1996, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright 2012 Milan Jurik. All rights reserved.
 * Copyright 2012 Marcel Telka <marcel@telka.sk>
 * Copyright 2018 OmniOS Community Edition (OmniOSce) Association.
 */

/*
 * Copyright 1993 OpenVision Technologies, Inc., All Rights Reserved.
 *
 * $Id: svc_auth_gssapi.c,v 1.19 1994/10/27 12:38:51 jik Exp $
 */

/*
 * Server side handling of RPCSEC_GSS flavor.
 */

#include <sys/systm.h>
#include <sys/kstat.h>
#include <sys/cmn_err.h>
#include <sys/debug.h>
#include <sys/types.h>
#include <sys/time.h>
#include <gssapi/gssapi.h>
#include <gssapi/gssapi_ext.h>
#include <rpc/rpc.h>
#include <rpc/rpcsec_defs.h>
#include <sys/sunddi.h>
#include <sys/atomic.h>
#include <sys/disp.h>

extern bool_t __rpc_gss_make_principal(rpc_gss_principal_t *, gss_buffer_t);

#ifdef	DEBUG
extern void prom_printf(const char *, ...);
#endif

#ifdef  _KERNEL
#define	memcmp(a, b, l) bcmp((a), (b), (l))
#endif


/*
 * Sequence window definitions.
 */
#define	SEQ_ARR_SIZE	4
#define	SEQ_WIN		(SEQ_ARR_SIZE*32)
#define	SEQ_HI_BIT	0x80000000
#define	SEQ_LO_BIT	1
#define	DIV_BY_32	5
#define	SEQ_MASK	0x1f
#define	SEQ_MAX		((unsigned int)0x80000000)


/* cache retransmit data */
typedef struct _retrans_entry {
	uint32_t	xid;
	rpc_gss_init_res result;
} retrans_entry;

/*
 * Server side RPCSEC_GSS context information.
 */
typedef struct _svc_rpc_gss_data {
	struct _svc_rpc_gss_data	*next, *prev;
	struct _svc_rpc_gss_data	*lru_next, *lru_prev;
	bool_t				established;
	gss_ctx_id_t			context;
	gss_buffer_desc			client_name;
	time_t				expiration;
	uint_t				seq_num;
	uint_t				seq_bits[SEQ_ARR_SIZE];
	uint_t				key;
	OM_uint32			qop;
	bool_t				done_docallback;
	bool_t				locked;
	rpc_gss_rawcred_t		raw_cred;
	rpc_gss_ucred_t			u_cred;
	time_t				u_cred_set;
	void				*cookie;
	gss_cred_id_t			deleg;
	kmutex_t			clm;
	int				ref_cnt;
	time_t				last_ref_time;
	bool_t				stale;
	retrans_entry			*retrans_data;
} svc_rpc_gss_data;

/*
 * Data structures used for LRU based context management.
 */


#define	HASH(key) ((key) % svc_rpc_gss_hashmod)
/* Size of hash table for svc_rpc_gss_data structures */
#define	GSS_DATA_HASH_SIZE	1024

/*
 * The following two defines specify a time delta that is used in
 * sweep_clients. When the last_ref_time of a context is older than
 * than the current time minus the delta, i.e, the context has not
 * been referenced in the last delta seconds, we will return the
 * context back to the cache if the ref_cnt is zero. The first delta
 * value will be used when sweep_clients is called from
 * svc_data_reclaim, the kmem_cache reclaim call back. We will reclaim
 * all entries except those that are currently "active". By active we
 * mean those that have been referenced in the last ACTIVE_DELTA
 * seconds. If sweep_client is not being called from reclaim, then we
 * will reclaim all entries that are "inactive". By inactive we mean
 * those entries that have not been accessed in INACTIVE_DELTA
 * seconds.  Note we always assume that ACTIVE_DELTA is less than
 * INACTIVE_DELTA, so that reaping entries from a reclaim operation
 * will necessarily imply reaping all "inactive" entries and then
 * some.
 */

/*
 * If low on memory reap cache entries that have not been active for
 * ACTIVE_DELTA seconds and have a ref_cnt equal to zero.
 */
#define	ACTIVE_DELTA		30*60		/* 30 minutes */

/*
 * If in sweeping contexts we find contexts with a ref_cnt equal to zero
 * and the context has not been referenced in INACTIVE_DELTA seconds, return
 * the entry to the cache.
 */
#define	INACTIVE_DELTA		8*60*60		/* 8 hours */

int				svc_rpc_gss_hashmod = GSS_DATA_HASH_SIZE;
static svc_rpc_gss_data		**clients;
static svc_rpc_gss_data		*lru_first, *lru_last;
static time_t			sweep_interval = 60*60;
static time_t			last_swept = 0;
static int			num_gss_contexts = 0;
static time_t			svc_rpcgss_gid_timeout = 60*60*12;
static kmem_cache_t		*svc_data_handle;
static time_t			svc_rpc_gss_active_delta = ACTIVE_DELTA;
static time_t			svc_rpc_gss_inactive_delta = INACTIVE_DELTA;

/*
 * lock used with context/lru variables
 */
static kmutex_t			ctx_mutex;

/*
 * Data structure to contain cache statistics
 */

static struct {
	int64_t total_entries_allocated;
	int64_t no_reclaims;
	int64_t no_returned_by_reclaim;
} svc_rpc_gss_cache_stats;


/*
 * lock used with server credential variables list
 *
 * server cred list locking guidelines:
 * - Writer's lock holder has exclusive access to the list
 */
static krwlock_t		cred_lock;

/*
 * server callback list
 */
typedef struct rpc_gss_cblist_s {
	struct rpc_gss_cblist_s		*next;
	rpc_gss_callback_t	cb;
} rpc_gss_cblist_t;

static rpc_gss_cblist_t			*rpc_gss_cblist = NULL;

/*
 * lock used with callback variables
 */
static kmutex_t			cb_mutex;

/*
 * forward declarations
 */
static bool_t			svc_rpc_gss_wrap();
static bool_t			svc_rpc_gss_unwrap();
static svc_rpc_gss_data		*create_client();
static svc_rpc_gss_data		*get_client();
static svc_rpc_gss_data		*find_client();
static void			destroy_client();
static void			sweep_clients(bool_t);
static void			insert_client();
static bool_t			check_verf(struct rpc_msg *, gss_ctx_id_t,
					int *, uid_t);
static bool_t			set_response_verf();
static void			retrans_add(svc_rpc_gss_data *, uint32_t,
					rpc_gss_init_res *);
static void			retrans_del(svc_rpc_gss_data *);
static bool_t			transfer_sec_context(svc_rpc_gss_data *);
static void			common_client_data_free(svc_rpc_gss_data *);

/*
 * server side wrap/unwrap routines
 */
struct svc_auth_ops svc_rpc_gss_ops = {
	svc_rpc_gss_wrap,
	svc_rpc_gss_unwrap,
};

/* taskq(9F) */
typedef struct svcrpcsec_gss_taskq_arg {
	SVCXPRT			*rq_xprt;
	rpc_gss_init_arg	*rpc_call_arg;
	struct rpc_msg		*msg;
	svc_rpc_gss_data	*client_data;
	uint_t			cr_version;
	rpc_gss_service_t	cr_service;
} svcrpcsec_gss_taskq_arg_t;

/* gssd is single threaded, so 1 thread for the taskq is probably good/ok */
int rpcsec_gss_init_taskq_nthreads = 1;

extern struct rpc_msg *rpc_msg_dup(struct rpc_msg *);
extern void rpc_msg_free(struct rpc_msg **, int);

/*
 * from svc_clts.c:
 * Transport private data.
 * Kept in xprt->xp_p2buf.
 */
struct udp_data {
	mblk_t	*ud_resp;			/* buffer for response */
	mblk_t	*ud_inmp;			/* mblk chain of request */
};

static zone_key_t svc_gss_zone_key;
static uint_t svc_gss_tsd_key;

typedef struct svc_gss_zsd {
	zoneid_t sgz_zoneid;
	kmutex_t sgz_lock;
	taskq_t *sgz_init_taskq;
} svc_gss_zsd_t;

static taskq_t *
svc_gss_create_taskq(zone_t *zone)
{
	taskq_t *tq;

	if (zone == NULL) {
		cmn_err(CE_NOTE, "%s: couldn't find zone", __func__);
		return (NULL);
	}

	/* Like ddi_taskq_create(), but for zones, just for now */
	tq = taskq_create_proc("rpcsec_gss_init_taskq",
	    rpcsec_gss_init_taskq_nthreads, minclsyspri,
	    rpcsec_gss_init_taskq_nthreads, INT_MAX, zone->zone_zsched,
	    TASKQ_PREPOPULATE);

	if (tq == NULL)
		cmn_err(CE_NOTE, "%s: taskq_create_proc failed", __func__);

	return (tq);
}

static void *
svc_gss_zone_init(zoneid_t zoneid)
{
	svc_gss_zsd_t *zsd;
	zone_t *zone = curzone;

	zsd = kmem_alloc(sizeof (*zsd), KM_SLEEP);
	mutex_init(&zsd->sgz_lock, NULL, MUTEX_DEFAULT, NULL);
	zsd->sgz_zoneid = zoneid;

	if (zone->zone_id != zoneid)
		zone = zone_find_by_id_nolock(zoneid);

	zsd->sgz_init_taskq = svc_gss_create_taskq(zone);
	return (zsd);
}

/*
 * taskq_destroy() wakes all taskq threads and tells them to exit.
 * It then cv_wait()'s for all of them to finish exiting.
 * cv_wait() calls resume(), which accesses the target's process.
 * That may be one of our taskq threads, which are attached to zone_zsched.
 *
 * If we do taskq_destroy() in the zsd_destroy callback, then zone_zsched
 * will have exited and been destroyed before it runs, and we can panic
 * in resume(). Our taskq threads are not accounted for in either
 * zone_ntasks or zone_kthreads, which means zsched does not wait for
 * taskq threads attached to it to complete before exiting.
 *
 * We therefore need to do this at shutdown time. At the point where
 * the zsd_shutdown callback is invoked, all other zone tasks (processes)
 * have exited, but zone_kthreads and other taskqs hanging off zsched have not.
 *
 * We need to be careful not to allow RPC services to be ran from
 * zsched-attached taskqs or zone_kthreads.
 */
static void
svc_gss_zone_shutdown(zoneid_t zoneid, void *arg)
{
	svc_gss_zsd_t *zsd = arg;

	/* All non-zsched-hung threads should be finished. */
	mutex_enter(&zsd->sgz_lock);
	if (zsd->sgz_init_taskq != NULL) {
		taskq_destroy(zsd->sgz_init_taskq);
		zsd->sgz_init_taskq = NULL;
	}
	mutex_exit(&zsd->sgz_lock);
}

static void
svc_gss_zone_fini(zoneid_t zoneid, void *arg)
{
	svc_gss_zsd_t *zsd = arg;

	mutex_destroy(&zsd->sgz_lock);
	kmem_free(zsd, sizeof (*zsd));
}

static svc_gss_zsd_t *
svc_gss_get_zsd(void)
{
	svc_gss_zsd_t *zsd;

	zsd = tsd_get(svc_gss_tsd_key);
	if (zsd == NULL) {
		zsd = zone_getspecific(svc_gss_zone_key, curzone);
		(void) tsd_set(svc_gss_tsd_key, zsd);
	}

	return (zsd);
}

/*ARGSUSED*/
static int
svc_gss_data_create(void *buf, void *pdata, int kmflag)
{
	svc_rpc_gss_data *client_data = (svc_rpc_gss_data *)buf;

	mutex_init(&client_data->clm, NULL, MUTEX_DEFAULT, NULL);

	return (0);
}

/*ARGSUSED*/
static void
svc_gss_data_destroy(void *buf, void *pdata)
{
	svc_rpc_gss_data *client_data = (svc_rpc_gss_data *)buf;

	mutex_destroy(&client_data->clm);
}


/*ARGSUSED*/
static void
svc_gss_data_reclaim(void *pdata)
{
	mutex_enter(&ctx_mutex);

	svc_rpc_gss_cache_stats.no_reclaims++;
	sweep_clients(TRUE);

	mutex_exit(&ctx_mutex);
}

/*
 *  Init stuff on the server side.
 */
void
svc_gss_init()
{
	mutex_init(&cb_mutex, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&ctx_mutex, NULL, MUTEX_DEFAULT, NULL);
	rw_init(&cred_lock, NULL, RW_DEFAULT, NULL);
	clients = (svc_rpc_gss_data **)
	    kmem_zalloc(svc_rpc_gss_hashmod * sizeof (svc_rpc_gss_data *),
	    KM_SLEEP);
	svc_data_handle = kmem_cache_create("rpc_gss_data_cache",
	    sizeof (svc_rpc_gss_data), 0,
	    svc_gss_data_create,
	    svc_gss_data_destroy,
	    svc_gss_data_reclaim,
	    NULL, NULL, 0);

	tsd_create(&svc_gss_tsd_key, NULL);
	zone_key_create(&svc_gss_zone_key, svc_gss_zone_init,
	    svc_gss_zone_shutdown, svc_gss_zone_fini);
}

/*
 * Destroy structures allocated in svc_gss_init().
 * This routine is called by _init() if mod_install() failed.
 */
void
svc_gss_fini()
{
	if (zone_key_delete(svc_gss_zone_key) != 0)
		cmn_err(CE_WARN, "%s: failed to delete zone key", __func__);
	tsd_destroy(&svc_gss_tsd_key);
	mutex_destroy(&cb_mutex);
	mutex_destroy(&ctx_mutex);
	rw_destroy(&cred_lock);
	kmem_free(clients, svc_rpc_gss_hashmod * sizeof (svc_rpc_gss_data *));
	kmem_cache_destroy(svc_data_handle);
}

/*
 * Cleanup routine for destroying context, called after service
 * procedure is executed. Actually we just decrement the reference count
 * associated with this context. If the reference count is zero and the
 * context is marked as stale, we would then destroy the context. Additionally,
 * we check if its been longer than sweep_interval since the last sweep_clients
 * was run, and if so run sweep_clients to free all stale contexts with zero
 * reference counts or contexts that are old. (Haven't been access in
 * svc_rpc_inactive_delta seconds).
 */
void
rpc_gss_cleanup(SVCXPRT *clone_xprt)
{
	svc_rpc_gss_data	*cl;
	SVCAUTH			*svcauth;

	/*
	 * First check if current context needs to be cleaned up.
	 * There might be other threads stale this client data
	 * in between.
	 */
	svcauth = &clone_xprt->xp_auth;
	mutex_enter(&ctx_mutex);
	if ((cl = (svc_rpc_gss_data *)svcauth->svc_ah_private) != NULL) {
		mutex_enter(&cl->clm);
		ASSERT(cl->ref_cnt > 0);
		if (--cl->ref_cnt == 0 && cl->stale) {
			mutex_exit(&cl->clm);
			destroy_client(cl);
			svcauth->svc_ah_private = NULL;
		} else
			mutex_exit(&cl->clm);
	}

	/*
	 * Check for other expired contexts.
	 */
	if ((gethrestime_sec() - last_swept) > sweep_interval)
		sweep_clients(FALSE);

	mutex_exit(&ctx_mutex);
}

/*
 * Shift the array arr of length arrlen right by nbits bits.
 */
static void
shift_bits(uint_t *arr, int arrlen, int nbits)
{
	int	i, j;
	uint_t	lo, hi;

	/*
	 * If the number of bits to be shifted exceeds SEQ_WIN, just
	 * zero out the array.
	 */
	if (nbits < SEQ_WIN) {
		for (i = 0; i < nbits; i++) {
			hi = 0;
			for (j = 0; j < arrlen; j++) {
				lo = arr[j] & SEQ_LO_BIT;
				arr[j] >>= 1;
				if (hi)
					arr[j] |= SEQ_HI_BIT;
				hi = lo;
			}
		}
	} else {
		for (j = 0; j < arrlen; j++)
			arr[j] = 0;
	}
}

/*
 * Check that the received sequence number seq_num is valid.
 */
static bool_t
check_seq(svc_rpc_gss_data *cl, uint_t seq_num, bool_t *kill_context)
{
	int			i, j;
	uint_t			bit;

	/*
	 * If it exceeds the maximum, kill context.
	 */
	if (seq_num >= SEQ_MAX) {
		*kill_context = TRUE;
		RPCGSS_LOG0(4, "check_seq: seq_num not valid\n");
		return (FALSE);
	}

	/*
	 * If greater than the last seen sequence number, just shift
	 * the sequence window so that it starts at the new sequence
	 * number and extends downwards by SEQ_WIN.
	 */
	if (seq_num > cl->seq_num) {
		(void) shift_bits(cl->seq_bits, SEQ_ARR_SIZE,
		    (int)(seq_num - cl->seq_num));
		cl->seq_bits[0] |= SEQ_HI_BIT;
		cl->seq_num = seq_num;
		return (TRUE);
	}

	/*
	 * If it is outside the sequence window, return failure.
	 */
	i = cl->seq_num - seq_num;
	if (i >= SEQ_WIN) {
		RPCGSS_LOG0(4, "check_seq: seq_num is outside the window\n");
		return (FALSE);
	}

	/*
	 * If within sequence window, set the bit corresponding to it
	 * if not already seen;  if already seen, return failure.
	 */
	j = SEQ_MASK - (i & SEQ_MASK);
	bit = j > 0 ? (1 << j) : 1;
	i >>= DIV_BY_32;
	if (cl->seq_bits[i] & bit) {
		RPCGSS_LOG0(4, "check_seq: sequence number already seen\n");
		return (FALSE);
	}
	cl->seq_bits[i] |= bit;
	return (TRUE);
}

/*
 * Set server callback.
 */
bool_t
rpc_gss_set_callback(rpc_gss_callback_t *cb)
{
	rpc_gss_cblist_t		*cbl, *tmp;

	if (cb->callback == NULL) {
		RPCGSS_LOG0(1, "rpc_gss_set_callback: no callback to set\n");
		return (FALSE);
	}

	/* check if there is already an entry in the rpc_gss_cblist. */
	mutex_enter(&cb_mutex);
	if (rpc_gss_cblist) {
		for (tmp = rpc_gss_cblist; tmp != NULL; tmp = tmp->next) {
			if ((tmp->cb.callback == cb->callback) &&
			    (tmp->cb.version == cb->version) &&
			    (tmp->cb.program == cb->program)) {
				mutex_exit(&cb_mutex);
				return (TRUE);
			}
		}
	}

	/* Not in rpc_gss_cblist.  Create a new entry. */
	if ((cbl = (rpc_gss_cblist_t *)kmem_alloc(sizeof (*cbl), KM_SLEEP))
	    == NULL) {
		mutex_exit(&cb_mutex);
		return (FALSE);
	}
	cbl->cb = *cb;
	cbl->next = rpc_gss_cblist;
	rpc_gss_cblist = cbl;
	mutex_exit(&cb_mutex);
	return (TRUE);
}

/*
 * Locate callback (if specified) and call server.  Release any
 * delegated credentials unless passed to server and the server
 * accepts the context.  If a callback is not specified, accept
 * the incoming context.
 */
static bool_t
do_callback(struct svc_req *req, svc_rpc_gss_data *client_data)
{
	rpc_gss_cblist_t		*cbl;
	bool_t			ret = TRUE, found = FALSE;
	rpc_gss_lock_t		lock;
	OM_uint32		minor;
	mutex_enter(&cb_mutex);
	for (cbl = rpc_gss_cblist; cbl != NULL; cbl = cbl->next) {
		if (req->rq_prog != cbl->cb.program ||
		    req->rq_vers != cbl->cb.version)
			continue;
		found = TRUE;
		lock.locked = FALSE;
		lock.raw_cred = &client_data->raw_cred;
		ret = (*cbl->cb.callback)(req, client_data->deleg,
		    client_data->context, &lock, &client_data->cookie);
		req->rq_xprt->xp_cookie = client_data->cookie;

		if (ret) {
			client_data->locked = lock.locked;
			client_data->deleg = GSS_C_NO_CREDENTIAL;
		}
		break;
	}
	if (!found) {
		if (client_data->deleg != GSS_C_NO_CREDENTIAL) {
			(void) kgss_release_cred(&minor, &client_data->deleg,
			    crgetuid(CRED()));
			client_data->deleg = GSS_C_NO_CREDENTIAL;
		}
	}
	mutex_exit(&cb_mutex);
	return (ret);
}

/*
 * Get caller credentials.
 */
bool_t
rpc_gss_getcred(struct svc_req *req, rpc_gss_rawcred_t **rcred,
    rpc_gss_ucred_t **ucred, void **cookie)
{
	SVCAUTH			*svcauth;
	svc_rpc_gss_data	*client_data;
	int			gssstat, gidlen;

	svcauth = &req->rq_xprt->xp_auth;
	client_data = (svc_rpc_gss_data *)svcauth->svc_ah_private;

	mutex_enter(&client_data->clm);

	if (rcred != NULL) {
		svcauth->raw_cred = client_data->raw_cred;
		*rcred = &svcauth->raw_cred;
	}
	if (ucred != NULL) {
		*ucred = &client_data->u_cred;

		if (client_data->u_cred_set == 0 ||
		    client_data->u_cred_set < gethrestime_sec()) {
			if (client_data->u_cred_set == 0) {
				if ((gssstat = kgsscred_expname_to_unix_cred(
				    &client_data->client_name,
				    &client_data->u_cred.uid,
				    &client_data->u_cred.gid,
				    &client_data->u_cred.gidlist,
				    &gidlen, crgetuid(CRED())))
				    != GSS_S_COMPLETE) {
					RPCGSS_LOG(1, "rpc_gss_getcred: "
					    "kgsscred_expname_to_unix_cred "
					    "failed %x\n", gssstat);
					*ucred = NULL;
				} else {
					client_data->u_cred.gidlen =
					    (short)gidlen;
					client_data->u_cred_set =
					    gethrestime_sec() +
					    svc_rpcgss_gid_timeout;
				}
			} else if (client_data->u_cred_set
			    < gethrestime_sec()) {
				if ((gssstat = kgss_get_group_info(
				    client_data->u_cred.uid,
				    &client_data->u_cred.gid,
				    &client_data->u_cred.gidlist,
				    &gidlen, crgetuid(CRED())))
				    != GSS_S_COMPLETE) {
					RPCGSS_LOG(1, "rpc_gss_getcred: "
					    "kgss_get_group_info failed %x\n",
					    gssstat);
					*ucred = NULL;
				} else {
					client_data->u_cred.gidlen =
					    (short)gidlen;
					client_data->u_cred_set =
					    gethrestime_sec() +
					    svc_rpcgss_gid_timeout;
				}
			}
		}
	}

	if (cookie != NULL)
		*cookie = client_data->cookie;
	req->rq_xprt->xp_cookie = client_data->cookie;

	mutex_exit(&client_data->clm);

	return (TRUE);
}

/*
 * Transfer the context data from the user land to the kernel.
 */
bool_t transfer_sec_context(svc_rpc_gss_data *client_data) {

	gss_buffer_desc process_token;
	OM_uint32 gssstat, minor;

	/*
	 * Call kgss_export_sec_context
	 * if an error is returned log a message
	 * go to error handling
	 * Otherwise call kgss_import_sec_context to
	 * convert the token into a context
	 */
	gssstat  = kgss_export_sec_context(&minor, client_data->context,
				&process_token);
	/*
	 * if export_sec_context returns an error we delete the
	 * context just to be safe.
	 */
	if (gssstat == GSS_S_NAME_NOT_MN) {
		RPCGSS_LOG0(4, "svc_rpcsec_gss: export sec context "
				"Kernel mod unavailable\n");

	} else if (gssstat != GSS_S_COMPLETE) {
		RPCGSS_LOG(1, "svc_rpcsec_gss: export sec context failed  "
				" gssstat = 0x%x\n", gssstat);
		(void) gss_release_buffer(&minor, &process_token);
		(void) kgss_delete_sec_context(&minor, &client_data->context,
				NULL);
		return (FALSE);

	} else if (process_token.length == 0) {
		RPCGSS_LOG0(1, "svc_rpcsec_gss:zero length token in response "
				"for export_sec_context, but "
				"gsstat == GSS_S_COMPLETE\n");
		(void) kgss_delete_sec_context(&minor, &client_data->context,
				NULL);
		return (FALSE);

	} else {
		gssstat = kgss_import_sec_context(&minor, &process_token,
					client_data->context);
		if (gssstat != GSS_S_COMPLETE) {
			RPCGSS_LOG(1, "svc_rpcsec_gss: import sec context "
				" failed gssstat = 0x%x\n", gssstat);
			(void) kgss_delete_sec_context(&minor,
				&client_data->context, NULL);
			(void) gss_release_buffer(&minor, &process_token);
			return (FALSE);
		}

		RPCGSS_LOG0(4, "gss_import_sec_context successful\n");
		(void) gss_release_buffer(&minor, &process_token);
	}

	return (TRUE);
}

/*
 * do_gss_accept is called from a taskq and does all the work for a
 * RPCSEC_GSS_INIT call (mostly calling kgss_accept_sec_context()).
 */
static enum auth_stat
do_gss_accept(
	SVCXPRT *xprt,
	rpc_gss_init_arg *call_arg,
	struct rpc_msg *msg,
	svc_rpc_gss_data *client_data,
	uint_t cr_version,
	rpc_gss_service_t cr_service)
{
	rpc_gss_init_res	call_res;
	gss_buffer_desc		output_token;
	OM_uint32		gssstat, minor, minor_stat, time_rec;
	int			ret_flags, ret;
	gss_OID			mech_type = GSS_C_NULL_OID;
	int			free_mech_type = 1;
	struct svc_req		r, *rqst;

	rqst = &r;
	rqst->rq_xprt = xprt;

	/*
	 * Initialize output_token.
	 */
	output_token.length = 0;
	output_token.value = NULL;

	bzero((char *)&call_res, sizeof (call_res));

	mutex_enter(&client_data->clm);
	if (client_data->stale) {
		ret = RPCSEC_GSS_NOCRED;
		RPCGSS_LOG0(1, "_svcrpcsec_gss: client data stale\n");
		goto error2;
	}

	/*
	 * Any response we send will use ctx_handle, so set it now;
	 * also set seq_window since this won't change.
	 */
	call_res.ctx_handle.length = sizeof (client_data->key);
	call_res.ctx_handle.value = (char *)&client_data->key;
	call_res.seq_window = SEQ_WIN;

	gssstat = GSS_S_FAILURE;
	minor = 0;
	minor_stat = 0;
	rw_enter(&cred_lock, RW_READER);

	if (client_data->client_name.length) {
		(void) gss_release_buffer(&minor,
		    &client_data->client_name);
	}
	gssstat = kgss_accept_sec_context(&minor_stat,
	    &client_data->context,
	    GSS_C_NO_CREDENTIAL,
	    call_arg,
	    GSS_C_NO_CHANNEL_BINDINGS,
	    &client_data->client_name,
	    &mech_type,
	    &output_token,
	    &ret_flags,
	    &time_rec,
	    NULL,		/* don't need a delegated cred back */
	    crgetuid(CRED()));

	RPCGSS_LOG(4, "gssstat 0x%x \n", gssstat);

	if (gssstat == GSS_S_COMPLETE) {
		/*
		 * Set the raw and unix credentials at this
		 * point.  This saves a lot of computation
		 * later when credentials are retrieved.
		 */
		client_data->raw_cred.version = cr_version;
		client_data->raw_cred.service = cr_service;

		if (client_data->raw_cred.mechanism) {
			kgss_free_oid(client_data->raw_cred.mechanism);
			client_data->raw_cred.mechanism = NULL;
		}
		client_data->raw_cred.mechanism = (rpc_gss_OID) mech_type;
		/*
		 * client_data is now responsible for freeing
		 * the data of 'mech_type'.
		 */
		free_mech_type = 0;

		if (client_data->raw_cred.client_principal) {
			kmem_free((caddr_t)client_data->\
			    raw_cred.client_principal,
			    client_data->raw_cred.\
			    client_principal->len + sizeof (int));
			client_data->raw_cred.client_principal = NULL;
		}

		/*
		 *  The client_name returned from
		 *  kgss_accept_sec_context() is in an
		 *  exported flat format.
		 */
		if (! __rpc_gss_make_principal(
		    &client_data->raw_cred.client_principal,
		    &client_data->client_name)) {
			RPCGSS_LOG0(1, "_svcrpcsec_gss: "
			    "make principal failed\n");
			gssstat = GSS_S_FAILURE;
			(void) gss_release_buffer(&minor_stat, &output_token);
		}
	}

	rw_exit(&cred_lock);

	call_res.gss_major = gssstat;
	call_res.gss_minor = minor_stat;

	if (gssstat != GSS_S_COMPLETE &&
	    gssstat != GSS_S_CONTINUE_NEEDED) {
		call_res.ctx_handle.length = 0;
		call_res.ctx_handle.value = NULL;
		call_res.seq_window = 0;
		rpc_gss_display_status(gssstat, minor_stat, mech_type,
		    crgetuid(CRED()),
		    "_svc_rpcsec_gss gss_accept_sec_context");
		(void) svc_sendreply(rqst->rq_xprt,
		    __xdr_rpc_gss_init_res, (caddr_t)&call_res);
		client_data->stale = TRUE;
		ret = AUTH_OK;
		goto error2;
	}

	/*
	 * If appropriate, set established to TRUE *after* sending
	 * response (otherwise, the client will receive the final
	 * token encrypted)
	 */
	if (gssstat == GSS_S_COMPLETE) {
		/*
		 * Context is established.  Set expiration time
		 * for the context.
		 */
		client_data->seq_num = 1;
		if ((time_rec == GSS_C_INDEFINITE) || (time_rec == 0)) {
			client_data->expiration = GSS_C_INDEFINITE;
		} else {
			client_data->expiration =
			    time_rec + gethrestime_sec();
		}

		if (!transfer_sec_context(client_data)) {
			ret = RPCSEC_GSS_FAILED;
			client_data->stale = TRUE;
			RPCGSS_LOG0(1,
			    "_svc_rpcsec_gss: transfer sec context failed\n");
			goto error2;
		}

		client_data->established = TRUE;
	}

	/*
	 * This step succeeded.  Send a response, along with
	 * a token if there's one.  Don't dispatch.
	 */

	if (output_token.length != 0)
		GSS_COPY_BUFFER(call_res.token, output_token);

	/*
	 * If GSS_S_COMPLETE: set response verifier to
	 * checksum of SEQ_WIN
	 */
	if (gssstat == GSS_S_COMPLETE) {
		if (!set_response_verf(rqst, msg, client_data,
		    (uint_t)SEQ_WIN)) {
			ret = RPCSEC_GSS_FAILED;
			client_data->stale = TRUE;
			RPCGSS_LOG0(1,
			    "_svc_rpcsec_gss:set response verifier failed\n");
			goto error2;
		}
	}

	if (!svc_sendreply(rqst->rq_xprt, __xdr_rpc_gss_init_res,
	    (caddr_t)&call_res)) {
		ret = RPCSEC_GSS_FAILED;
		client_data->stale = TRUE;
		RPCGSS_LOG0(1, "_svc_rpcsec_gss:send reply failed\n");
		goto error2;
	}

	/*
	 * Cache last response in case it is lost and the client
	 * retries on an established context.
	 */
	(void) retrans_add(client_data, msg->rm_xid, &call_res);
	ASSERT(client_data->ref_cnt > 0);
	client_data->ref_cnt--;
	mutex_exit(&client_data->clm);

	(void) gss_release_buffer(&minor_stat, &output_token);

	return (AUTH_OK);

error2:
	ASSERT(client_data->ref_cnt > 0);
	client_data->ref_cnt--;
	mutex_exit(&client_data->clm);
	(void) gss_release_buffer(&minor_stat, &output_token);
	if (free_mech_type && mech_type)
		kgss_free_oid(mech_type);

	return (ret);
}

static void
svcrpcsec_gss_taskq_func(void *svcrpcsecgss_taskq_arg)
{
	enum auth_stat retval;
	svcrpcsec_gss_taskq_arg_t *arg = svcrpcsecgss_taskq_arg;

	retval = do_gss_accept(arg->rq_xprt, arg->rpc_call_arg, arg->msg,
	    arg->client_data, arg->cr_version, arg->cr_service);
	if (retval != AUTH_OK) {
		cmn_err(CE_NOTE,
		    "svcrpcsec_gss_taskq_func:  do_gss_accept fail 0x%x",
		    retval);
	}
	rpc_msg_free(&arg->msg, MAX_AUTH_BYTES);
	SVC_RELE(arg->rq_xprt, NULL, FALSE);
	svc_clone_unlink(arg->rq_xprt);
	svc_clone_free(arg->rq_xprt);
	xdr_free(__xdr_rpc_gss_init_arg, (caddr_t)arg->rpc_call_arg);
	kmem_free(arg->rpc_call_arg, sizeof (*arg->rpc_call_arg));

	kmem_free(arg, sizeof (*arg));
}

static enum auth_stat
rpcsec_gss_init(
	struct svc_req		*rqst,
	struct rpc_msg		*msg,
	rpc_gss_creds		creds,
	bool_t			*no_dispatch,
	svc_rpc_gss_data	*c_d) /* client data, can be NULL */
{
	svc_rpc_gss_data	*client_data;
	int ret;
	svcrpcsec_gss_taskq_arg_t *arg;
	svc_gss_zsd_t *zsd = svc_gss_get_zsd();
	taskq_t *tq = zsd->sgz_init_taskq;

	if (tq == NULL) {
		mutex_enter(&zsd->sgz_lock);
		if (zsd->sgz_init_taskq == NULL)
			zsd->sgz_init_taskq = svc_gss_create_taskq(curzone);
		tq = zsd->sgz_init_taskq;
		mutex_exit(&zsd->sgz_lock);
		if (tq == NULL) {
			cmn_err(CE_NOTE, "%s: no taskq available", __func__);
			return (RPCSEC_GSS_FAILED);
		}
	}

	if (creds.ctx_handle.length != 0) {
		RPCGSS_LOG0(1, "_svcrpcsec_gss: ctx_handle not null\n");
		ret = AUTH_BADCRED;
		return (ret);
	}

	client_data = c_d ? c_d : create_client();
	if (client_data == NULL) {
		RPCGSS_LOG0(1,
		    "_svcrpcsec_gss: can't create a new cache entry\n");
		ret = AUTH_FAILED;
		return (ret);
	}

	mutex_enter(&client_data->clm);
	if (client_data->stale) {
		ret = RPCSEC_GSS_NOCRED;
		RPCGSS_LOG0(1, "_svcrpcsec_gss: client data stale\n");
		goto error2;
	}

	/*
	 * kgss_accept_sec_context()/gssd(8) can be overly time
	 * consuming so let's queue it and return asap.
	 *
	 * taskq func must free arg.
	 */
	arg = kmem_alloc(sizeof (*arg), KM_SLEEP);

	/* taskq func must free rpc_call_arg & deserialized arguments */
	arg->rpc_call_arg = kmem_zalloc(sizeof (*arg->rpc_call_arg), KM_SLEEP);

	/* deserialize arguments */
	if (!SVC_GETARGS(rqst->rq_xprt, __xdr_rpc_gss_init_arg,
	    (caddr_t)arg->rpc_call_arg)) {
		ret = RPCSEC_GSS_FAILED;
		client_data->stale = TRUE;
		goto error2;
	}

	/* get a xprt clone for taskq thread, taskq func must free it */
	arg->rq_xprt = svc_clone_init();
	svc_clone_link(rqst->rq_xprt->xp_master, arg->rq_xprt, rqst->rq_xprt);
	arg->rq_xprt->xp_xid = rqst->rq_xprt->xp_xid;

	/*
	 * Increment the reference count on the rpcmod slot so that is not
	 * freed before the task has finished.
	 */
	SVC_HOLD(arg->rq_xprt);

	/* set the appropriate wrap/unwrap routine for RPCSEC_GSS */
	arg->rq_xprt->xp_auth.svc_ah_ops = svc_rpc_gss_ops;
	arg->rq_xprt->xp_auth.svc_ah_private = (caddr_t)client_data;

	/* get a dup of rpc msg for taskq thread */
	arg->msg = rpc_msg_dup(msg);  /* taskq func must free msg dup */

	arg->client_data = client_data;
	arg->cr_version = creds.version;
	arg->cr_service = creds.service;

	/* should be ok to hold clm lock as taskq will have new thread(s) */
	if (taskq_dispatch(tq, svcrpcsec_gss_taskq_func, arg, TQ_SLEEP)
	    == DDI_FAILURE) {
		cmn_err(CE_NOTE, "%s: taskq dispatch fail", __func__);
		ret = RPCSEC_GSS_FAILED;
		rpc_msg_free(&arg->msg, MAX_AUTH_BYTES);
		SVC_RELE(arg->rq_xprt, NULL, FALSE);
		svc_clone_unlink(arg->rq_xprt);
		svc_clone_free(arg->rq_xprt);
		kmem_free(arg, sizeof (*arg));
		goto error2;
	}

	mutex_exit(&client_data->clm);
	*no_dispatch = TRUE;
	return (AUTH_OK);

error2:
	ASSERT(client_data->ref_cnt > 0);
	client_data->ref_cnt--;
	mutex_exit(&client_data->clm);
	cmn_err(CE_NOTE, "rpcsec_gss_init: error 0x%x", ret);
	return (ret);
}

static enum auth_stat
rpcsec_gss_continue_init(
	struct svc_req		*rqst,
	struct rpc_msg		*msg,
	rpc_gss_creds		creds,
	bool_t			*no_dispatch)
{
	int ret;
	svc_rpc_gss_data	*client_data;
	svc_rpc_gss_parms_t	*gss_parms;
	rpc_gss_init_res	*retrans_result;

	if (creds.ctx_handle.length == 0) {
		RPCGSS_LOG0(1, "_svcrpcsec_gss: no ctx_handle\n");
		ret = AUTH_BADCRED;
		return (ret);
	}
	if ((client_data = get_client(&creds.ctx_handle)) == NULL) {
		ret = RPCSEC_GSS_NOCRED;
		RPCGSS_LOG0(1, "_svcrpcsec_gss: no security context\n");
		return (ret);
	}

	mutex_enter(&client_data->clm);
	if (client_data->stale) {
		ret = RPCSEC_GSS_NOCRED;
		RPCGSS_LOG0(1, "_svcrpcsec_gss: client data stale\n");
		goto error2;
	}

	/*
	 * If context not established, go thru INIT code but with
	 * this client handle.
	 */
	if (!client_data->established) {
		mutex_exit(&client_data->clm);
		return (rpcsec_gss_init(rqst, msg, creds, no_dispatch,
		    client_data));
	}

	/*
	 * Set the appropriate wrap/unwrap routine for RPCSEC_GSS.
	 */
	rqst->rq_xprt->xp_auth.svc_ah_ops = svc_rpc_gss_ops;
	rqst->rq_xprt->xp_auth.svc_ah_private = (caddr_t)client_data;

	/*
	 * Keep copy of parameters we'll need for response, for the
	 * sake of reentrancy (we don't want to look in the context
	 * data because when we are sending a response, another
	 * request may have come in).
	 */
	gss_parms = &rqst->rq_xprt->xp_auth.svc_gss_parms;
	gss_parms->established = client_data->established;
	gss_parms->service = creds.service;
	gss_parms->qop_rcvd = (uint_t)client_data->qop;
	gss_parms->context = (void *)client_data->context;
	gss_parms->seq_num = creds.seq_num;

	/*
	 * This is an established context. Continue to
	 * satisfy retried continue init requests out of
	 * the retransmit cache.  Throw away any that don't
	 * have a matching xid or the cach is empty.
	 * Delete the retransmit cache once the client sends
	 * a data request.
	 */
	if (client_data->retrans_data &&
	    (client_data->retrans_data->xid == msg->rm_xid)) {
		retrans_result = &client_data->retrans_data->result;
		if (set_response_verf(rqst, msg, client_data,
		    (uint_t)retrans_result->seq_window)) {
			gss_parms->established = FALSE;
			(void) svc_sendreply(rqst->rq_xprt,
			    __xdr_rpc_gss_init_res, (caddr_t)retrans_result);
			*no_dispatch = TRUE;
			ASSERT(client_data->ref_cnt > 0);
			client_data->ref_cnt--;
		}
	}
	mutex_exit(&client_data->clm);

	return (AUTH_OK);

error2:
	ASSERT(client_data->ref_cnt > 0);
	client_data->ref_cnt--;
	mutex_exit(&client_data->clm);
	return (ret);
}

static enum auth_stat
rpcsec_gss_data(
	struct svc_req		*rqst,
	struct rpc_msg		*msg,
	rpc_gss_creds		creds,
	bool_t			*no_dispatch)
{
	int ret;
	svc_rpc_gss_parms_t	*gss_parms;
	svc_rpc_gss_data	*client_data;

	switch (creds.service) {
	case rpc_gss_svc_none:
	case rpc_gss_svc_integrity:
	case rpc_gss_svc_privacy:
		break;
	default:
		cmn_err(CE_NOTE, "__svcrpcsec_gss: unknown service type=0x%x",
		    creds.service);
		RPCGSS_LOG(1, "_svcrpcsec_gss: unknown service type: 0x%x\n",
		    creds.service);
		ret = AUTH_BADCRED;
		return (ret);
	}

	if (creds.ctx_handle.length == 0) {
		RPCGSS_LOG0(1, "_svcrpcsec_gss: no ctx_handle\n");
		ret = AUTH_BADCRED;
		return (ret);
	}
	if ((client_data = get_client(&creds.ctx_handle)) == NULL) {
		ret = RPCSEC_GSS_NOCRED;
		RPCGSS_LOG0(1, "_svcrpcsec_gss: no security context\n");
		return (ret);
	}


	mutex_enter(&client_data->clm);
	if (!client_data->established) {
		ret = AUTH_FAILED;
		goto error2;
	}
	if (client_data->stale) {
		ret = RPCSEC_GSS_NOCRED;
		RPCGSS_LOG0(1, "_svcrpcsec_gss: client data stale\n");
		goto error2;
	}

	/*
	 * Once the context is established and there is no more
	 * retransmission of last continue init request, it is safe
	 * to delete the retransmit cache entry.
	 */
	if (client_data->retrans_data)
		retrans_del(client_data);

	/*
	 * Set the appropriate wrap/unwrap routine for RPCSEC_GSS.
	 */
	rqst->rq_xprt->xp_auth.svc_ah_ops = svc_rpc_gss_ops;
	rqst->rq_xprt->xp_auth.svc_ah_private = (caddr_t)client_data;

	/*
	 * Keep copy of parameters we'll need for response, for the
	 * sake of reentrancy (we don't want to look in the context
	 * data because when we are sending a response, another
	 * request may have come in).
	 */
	gss_parms = &rqst->rq_xprt->xp_auth.svc_gss_parms;
	gss_parms->established = client_data->established;
	gss_parms->service = creds.service;
	gss_parms->qop_rcvd = (uint_t)client_data->qop;
	gss_parms->context = (void *)client_data->context;
	gss_parms->seq_num = creds.seq_num;

	/*
	 * Context is already established.  Check verifier, and
	 * note parameters we will need for response in gss_parms.
	 */
	if (!check_verf(msg, client_data->context,
	    (int *)&gss_parms->qop_rcvd, client_data->u_cred.uid)) {
		ret = RPCSEC_GSS_NOCRED;
		RPCGSS_LOG0(1, "_svcrpcsec_gss: check verf failed\n");
		goto error2;
	}

	/*
	 *  Check and invoke callback if necessary.
	 */
	if (!client_data->done_docallback) {
		client_data->done_docallback = TRUE;
		client_data->qop = gss_parms->qop_rcvd;
		client_data->raw_cred.qop = gss_parms->qop_rcvd;
		client_data->raw_cred.service = creds.service;
		if (!do_callback(rqst, client_data)) {
			ret = AUTH_FAILED;
			RPCGSS_LOG0(1, "_svc_rpcsec_gss:callback failed\n");
			goto error2;
		}
	}

	/*
	 * If the context was locked, make sure that the client
	 * has not changed QOP.
	 */
	if (client_data->locked && gss_parms->qop_rcvd != client_data->qop) {
		ret = AUTH_BADVERF;
		RPCGSS_LOG0(1, "_svcrpcsec_gss: can not change qop\n");
		goto error2;
	}

	/*
	 * Validate sequence number.
	 */
	if (!check_seq(client_data, creds.seq_num, &client_data->stale)) {
		if (client_data->stale) {
			ret = RPCSEC_GSS_FAILED;
			RPCGSS_LOG0(1,
			    "_svc_rpcsec_gss:check seq failed\n");
		} else {
			RPCGSS_LOG0(4, "_svc_rpcsec_gss:check seq "
			    "failed on good context. Ignoring "
			    "request\n");
			/*
			 * Operational error, drop packet silently.
			 * The client will recover after timing out,
			 * assuming this is a client error and not
			 * a relpay attack.  Don't dispatch.
			 */
			ret = AUTH_OK;
			*no_dispatch = TRUE;
		}
		goto error2;
	}

	/*
	 * set response verifier
	 */
	if (!set_response_verf(rqst, msg, client_data, creds.seq_num)) {
		ret = RPCSEC_GSS_FAILED;
		client_data->stale = TRUE;
		RPCGSS_LOG0(1,
		    "_svc_rpcsec_gss:set response verifier failed\n");
		goto error2;
	}

	/*
	 * If context is locked, make sure that the client
	 * has not changed the security service.
	 */
	if (client_data->locked &&
	    client_data->raw_cred.service != creds.service) {
		RPCGSS_LOG0(1, "_svc_rpcsec_gss: "
		    "security service changed.\n");
		ret = AUTH_FAILED;
		goto error2;
	}

	/*
	 * Set client credentials to raw credential
	 * structure in context.  This is okay, since
	 * this will not change during the lifetime of
	 * the context (so it's MT safe).
	 */
	rqst->rq_clntcred = (char *)&client_data->raw_cred;

	mutex_exit(&client_data->clm);
	return (AUTH_OK);

error2:
	ASSERT(client_data->ref_cnt > 0);
	client_data->ref_cnt--;
	mutex_exit(&client_data->clm);
	return (ret);
}

/*
 * Note we don't have a client yet to use this routine and test it.
 */
static enum auth_stat
rpcsec_gss_destroy(
	struct svc_req		*rqst,
	rpc_gss_creds		creds,
	bool_t			*no_dispatch)
{
	svc_rpc_gss_data	*client_data;
	int ret;

	if (creds.ctx_handle.length == 0) {
		RPCGSS_LOG0(1, "_svcrpcsec_gss: no ctx_handle\n");
		ret = AUTH_BADCRED;
		return (ret);
	}
	if ((client_data = get_client(&creds.ctx_handle)) == NULL) {
		ret = RPCSEC_GSS_NOCRED;
		RPCGSS_LOG0(1, "_svcrpcsec_gss: no security context\n");
		return (ret);
	}

	mutex_enter(&client_data->clm);
	if (!client_data->established) {
		ret = AUTH_FAILED;
		goto error2;
	}
	if (client_data->stale) {
		ret = RPCSEC_GSS_NOCRED;
		RPCGSS_LOG0(1, "_svcrpcsec_gss: client data stale\n");
		goto error2;
	}

	(void) svc_sendreply(rqst->rq_xprt, xdr_void, NULL);
	*no_dispatch = TRUE;
	ASSERT(client_data->ref_cnt > 0);
	client_data->ref_cnt--;
	client_data->stale = TRUE;
	mutex_exit(&client_data->clm);
	return (AUTH_OK);

error2:
	ASSERT(client_data->ref_cnt > 0);
	client_data->ref_cnt--;
	client_data->stale = TRUE;
	mutex_exit(&client_data->clm);
	return (ret);
}

/*
 * Server side authentication for RPCSEC_GSS.
 */
enum auth_stat
__svcrpcsec_gss(
	struct svc_req		*rqst,
	struct rpc_msg		*msg,
	bool_t			*no_dispatch)
{
	XDR			xdrs;
	rpc_gss_creds		creds;
	struct opaque_auth	*cred;
	int			ret;

	*no_dispatch = FALSE;

	/*
	 * Initialize response verifier to NULL verifier.  If
	 * necessary, this will be changed later.
	 */
	rqst->rq_xprt->xp_verf.oa_flavor = AUTH_NONE;
	rqst->rq_xprt->xp_verf.oa_base = NULL;
	rqst->rq_xprt->xp_verf.oa_length = 0;

	/*
	 * Pull out and check credential and verifier.
	 */
	cred = &msg->rm_call.cb_cred;

	if (cred->oa_length == 0) {
		RPCGSS_LOG0(1, "_svcrpcsec_gss: zero length cred\n");
		return (AUTH_BADCRED);
	}

	xdrmem_create(&xdrs, cred->oa_base, cred->oa_length, XDR_DECODE);
	bzero((char *)&creds, sizeof (creds));
	if (!__xdr_rpc_gss_creds(&xdrs, &creds)) {
		XDR_DESTROY(&xdrs);
		RPCGSS_LOG0(1, "_svcrpcsec_gss: can't decode creds\n");
		ret = AUTH_BADCRED;
		return (AUTH_BADCRED);
	}
	XDR_DESTROY(&xdrs);

	switch (creds.gss_proc) {
	case RPCSEC_GSS_INIT:
		ret = rpcsec_gss_init(rqst, msg, creds, no_dispatch, NULL);
		break;
	case RPCSEC_GSS_CONTINUE_INIT:
		ret = rpcsec_gss_continue_init(rqst, msg, creds, no_dispatch);
		break;
	case RPCSEC_GSS_DATA:
		ret = rpcsec_gss_data(rqst, msg, creds, no_dispatch);
		break;
	case RPCSEC_GSS_DESTROY:
		ret = rpcsec_gss_destroy(rqst, creds, no_dispatch);
		break;
	default:
		cmn_err(CE_NOTE, "__svcrpcsec_gss: bad proc=%d",
		    creds.gss_proc);
		ret = AUTH_BADCRED;
	}

	if (creds.ctx_handle.length != 0)
		xdr_free(__xdr_rpc_gss_creds, (caddr_t)&creds);
	return (ret);
}

/*
 * Check verifier.  The verifier is the checksum of the RPC header
 * upto and including the credentials field.
 */

/* ARGSUSED */
static bool_t
check_verf(struct rpc_msg *msg, gss_ctx_id_t context, int *qop_state, uid_t uid)
{
	int			*buf, *tmp;
	char			hdr[128];
	struct opaque_auth	*oa;
	int			len;
	gss_buffer_desc		msg_buf;
	gss_buffer_desc		tok_buf;
	OM_uint32		gssstat, minor_stat;

	/*
	 * We have to reconstruct the RPC header from the previously
	 * parsed information, since we haven't kept the header intact.
	 */

	oa = &msg->rm_call.cb_cred;
	if (oa->oa_length > MAX_AUTH_BYTES)
		return (FALSE);

	/* 8 XDR units from the IXDR macro calls. */
	if (sizeof (hdr) < (8 * BYTES_PER_XDR_UNIT +
	    RNDUP(oa->oa_length)))
		return (FALSE);
	buf = (int *)hdr;
	IXDR_PUT_U_INT32(buf, msg->rm_xid);
	IXDR_PUT_ENUM(buf, msg->rm_direction);
	IXDR_PUT_U_INT32(buf, msg->rm_call.cb_rpcvers);
	IXDR_PUT_U_INT32(buf, msg->rm_call.cb_prog);
	IXDR_PUT_U_INT32(buf, msg->rm_call.cb_vers);
	IXDR_PUT_U_INT32(buf, msg->rm_call.cb_proc);
	IXDR_PUT_ENUM(buf, oa->oa_flavor);
	IXDR_PUT_U_INT32(buf, oa->oa_length);
	if (oa->oa_length) {
		len = RNDUP(oa->oa_length);
		tmp = buf;
		buf += len / sizeof (int);
		*(buf - 1) = 0;
		(void) bcopy(oa->oa_base, (caddr_t)tmp, oa->oa_length);
	}
	len = ((char *)buf) - hdr;
	msg_buf.length = len;
	msg_buf.value = hdr;
	oa = &msg->rm_call.cb_verf;
	tok_buf.length = oa->oa_length;
	tok_buf.value = oa->oa_base;

	gssstat = kgss_verify(&minor_stat, context, &msg_buf, &tok_buf,
	    qop_state);
	if (gssstat != GSS_S_COMPLETE) {
		RPCGSS_LOG(1, "check_verf: kgss_verify status 0x%x\n", gssstat);

		RPCGSS_LOG(4, "check_verf: msg_buf length %d\n", len);
		RPCGSS_LOG(4, "check_verf: msg_buf value 0x%x\n", *(int *)hdr);
		RPCGSS_LOG(4, "check_verf: tok_buf length %ld\n",
		    tok_buf.length);
		RPCGSS_LOG(4, "check_verf: tok_buf value 0x%p\n",
		    (void *)oa->oa_base);
		RPCGSS_LOG(4, "check_verf: context 0x%p\n", (void *)context);

		return (FALSE);
	}
	return (TRUE);
}


/*
 * Set response verifier.  This is the checksum of the given number.
 * (e.g. sequence number or sequence window)
 */
static bool_t
set_response_verf(struct svc_req *rqst, struct rpc_msg *msg,
    svc_rpc_gss_data *cl, uint_t num)
{
	OM_uint32		minor;
	gss_buffer_desc		in_buf, out_buf;
	uint_t			num_net;

	num_net = (uint_t)htonl(num);
	in_buf.length = sizeof (num);
	in_buf.value = (char *)&num_net;
/* XXX uid ? */

	if ((kgss_sign(&minor, cl->context, cl->qop, &in_buf, &out_buf))
	    != GSS_S_COMPLETE)
		return (FALSE);

	rqst->rq_xprt->xp_verf.oa_flavor = RPCSEC_GSS;
	rqst->rq_xprt->xp_verf.oa_base = msg->rm_call.cb_verf.oa_base;
	rqst->rq_xprt->xp_verf.oa_length = out_buf.length;
	bcopy(out_buf.value, rqst->rq_xprt->xp_verf.oa_base, out_buf.length);
	(void) gss_release_buffer(&minor, &out_buf);
	return (TRUE);
}

/*
 * Create client context.
 */
static svc_rpc_gss_data *
create_client()
{
	svc_rpc_gss_data	*client_data;
	static uint_t		key = 1;

	client_data = (svc_rpc_gss_data *) kmem_cache_alloc(svc_data_handle,
	    KM_SLEEP);
	if (client_data == NULL)
		return (NULL);

	/*
	 * set up client data structure
	 */
	client_data->next = NULL;
	client_data->prev = NULL;
	client_data->lru_next = NULL;
	client_data->lru_prev = NULL;
	client_data->client_name.length = 0;
	client_data->client_name.value = NULL;
	client_data->seq_num = 0;
	bzero(client_data->seq_bits, sizeof (client_data->seq_bits));
	client_data->key = 0;
	client_data->cookie = NULL;
	bzero(&client_data->u_cred, sizeof (client_data->u_cred));
	client_data->established = FALSE;
	client_data->locked = FALSE;
	client_data->u_cred_set = 0;
	client_data->context = GSS_C_NO_CONTEXT;
	client_data->expiration = GSS_C_INDEFINITE;
	client_data->deleg = GSS_C_NO_CREDENTIAL;
	client_data->ref_cnt = 1;
	client_data->last_ref_time = gethrestime_sec();
	client_data->qop = GSS_C_QOP_DEFAULT;
	client_data->done_docallback = FALSE;
	client_data->stale = FALSE;
	client_data->retrans_data = NULL;
	bzero(&client_data->raw_cred, sizeof (client_data->raw_cred));

	/*
	 * The client context handle is a 32-bit key (unsigned int).
	 * The key is incremented until there is no duplicate for it.
	 */

	svc_rpc_gss_cache_stats.total_entries_allocated++;
	mutex_enter(&ctx_mutex);
	for (;;) {
		client_data->key = key++;
		if (find_client(client_data->key) == NULL) {
			insert_client(client_data);
			mutex_exit(&ctx_mutex);
			return (client_data);
		}
	}
	/*NOTREACHED*/
}

/*
 * Insert client context into hash list and LRU list.
 */
static void
insert_client(svc_rpc_gss_data *client_data)
{
	svc_rpc_gss_data	*cl;
	int			index = HASH(client_data->key);

	ASSERT(mutex_owned(&ctx_mutex));

	client_data->prev = NULL;
	cl = clients[index];
	if ((client_data->next = cl) != NULL)
		cl->prev = client_data;
	clients[index] = client_data;

	client_data->lru_prev = NULL;
	if ((client_data->lru_next = lru_first) != NULL)
		lru_first->lru_prev = client_data;
	else
		lru_last = client_data;
	lru_first = client_data;

	num_gss_contexts++;
}

/*
 * Fetch a client, given the client context handle.  Move it to the
 * top of the LRU list since this is the most recently used context.
 */
static svc_rpc_gss_data *
get_client(gss_buffer_t ctx_handle)
{
	uint_t			key = *(uint_t *)ctx_handle->value;
	svc_rpc_gss_data	*cl;

	mutex_enter(&ctx_mutex);
	if ((cl = find_client(key)) != NULL) {
		mutex_enter(&cl->clm);
		if (cl->stale) {
			if (cl->ref_cnt == 0) {
				mutex_exit(&cl->clm);
				destroy_client(cl);
			} else {
				mutex_exit(&cl->clm);
			}
			mutex_exit(&ctx_mutex);
			return (NULL);
		}
		cl->ref_cnt++;
		cl->last_ref_time = gethrestime_sec();
		mutex_exit(&cl->clm);
		if (cl != lru_first) {
			cl->lru_prev->lru_next = cl->lru_next;
			if (cl->lru_next != NULL)
				cl->lru_next->lru_prev = cl->lru_prev;
			else
				lru_last = cl->lru_prev;
			cl->lru_prev = NULL;
			cl->lru_next = lru_first;
			lru_first->lru_prev = cl;
			lru_first = cl;
		}
	}
	mutex_exit(&ctx_mutex);
	return (cl);
}

/*
 * Given the client context handle, find the context corresponding to it.
 * Don't change its LRU state since it may not be used.
 */
static svc_rpc_gss_data *
find_client(uint_t key)
{
	int			index = HASH(key);
	svc_rpc_gss_data	*cl = NULL;

	ASSERT(mutex_owned(&ctx_mutex));

	for (cl = clients[index]; cl != NULL; cl = cl->next) {
		if (cl->key == key)
			break;
	}
	return (cl);
}

/*
 * Destroy a client context.
 */
static void
destroy_client(svc_rpc_gss_data *client_data)
{
	OM_uint32		minor;
	int			index = HASH(client_data->key);

	ASSERT(mutex_owned(&ctx_mutex));

	/*
	 * remove from hash list
	 */
	if (client_data->prev == NULL)
		clients[index] = client_data->next;
	else
		client_data->prev->next = client_data->next;
	if (client_data->next != NULL)
		client_data->next->prev = client_data->prev;

	/*
	 * remove from LRU list
	 */
	if (client_data->lru_prev == NULL)
		lru_first = client_data->lru_next;
	else
		client_data->lru_prev->lru_next = client_data->lru_next;
	if (client_data->lru_next != NULL)
		client_data->lru_next->lru_prev = client_data->lru_prev;
	else
		lru_last = client_data->lru_prev;

	/*
	 * If there is a GSS context, clean up GSS state.
	 */
	if (client_data->context != GSS_C_NO_CONTEXT) {
		(void) kgss_delete_sec_context(&minor, &client_data->context,
		    NULL);

		common_client_data_free(client_data);

		if (client_data->deleg != GSS_C_NO_CREDENTIAL) {
			(void) kgss_release_cred(&minor, &client_data->deleg,
			    crgetuid(CRED()));
		}
	}

	if (client_data->u_cred.gidlist != NULL) {
		kmem_free((char *)client_data->u_cred.gidlist,
		    client_data->u_cred.gidlen * sizeof (gid_t));
		client_data->u_cred.gidlist = NULL;
	}
	if (client_data->retrans_data != NULL)
		retrans_del(client_data);

	kmem_cache_free(svc_data_handle, client_data);
	num_gss_contexts--;
}

/*
 * Check for expired and stale client contexts.
 */
static void
sweep_clients(bool_t from_reclaim)
{
	svc_rpc_gss_data	*cl, *next;
	time_t			last_reference_needed;
	time_t			now = gethrestime_sec();

	ASSERT(mutex_owned(&ctx_mutex));

	last_reference_needed = now - (from_reclaim ?
	    svc_rpc_gss_active_delta : svc_rpc_gss_inactive_delta);

	cl = lru_last;
	while (cl) {
		/*
		 * We assume here that any manipulation of the LRU pointers
		 * and hash bucket pointers are only done when holding the
		 * ctx_mutex.
		 */
		next = cl->lru_prev;

		mutex_enter(&cl->clm);

		if ((cl->expiration != GSS_C_INDEFINITE &&
		    cl->expiration <= now) || cl->stale ||
		    cl->last_ref_time <= last_reference_needed) {

			if ((cl->expiration != GSS_C_INDEFINITE &&
			    cl->expiration <= now) || cl->stale ||
			    (cl->last_ref_time <= last_reference_needed &&
			    cl->ref_cnt == 0)) {

				cl->stale = TRUE;

				if (cl->ref_cnt == 0) {
					mutex_exit(&cl->clm);
					if (from_reclaim)
						svc_rpc_gss_cache_stats.
						    no_returned_by_reclaim++;
					destroy_client(cl);
				} else
					mutex_exit(&cl->clm);
			} else
				mutex_exit(&cl->clm);
		} else
			mutex_exit(&cl->clm);

		cl = next;
	}

	last_swept = gethrestime_sec();
}

/*
 * Encrypt the serialized arguments from xdr_func applied to xdr_ptr
 * and write the result to xdrs.
 */
static bool_t
svc_rpc_gss_wrap(SVCAUTH *auth, XDR *out_xdrs, bool_t (*xdr_func)(),
    caddr_t xdr_ptr)
{
	svc_rpc_gss_parms_t	*gss_parms = SVCAUTH_GSSPARMS(auth);
	bool_t ret;

	/*
	 * If context is not established, or if neither integrity nor
	 * privacy service is used, don't wrap - just XDR encode.
	 * Otherwise, wrap data using service and QOP parameters.
	 */
	if (!gss_parms->established || gss_parms->service == rpc_gss_svc_none)
		return ((*xdr_func)(out_xdrs, xdr_ptr));

	ret = __rpc_gss_wrap_data(gss_parms->service,
	    (OM_uint32)gss_parms->qop_rcvd,
	    (gss_ctx_id_t)gss_parms->context,
	    gss_parms->seq_num,
	    out_xdrs, xdr_func, xdr_ptr);
	return (ret);
}

/*
 * Decrypt the serialized arguments and XDR decode them.
 */
static bool_t
svc_rpc_gss_unwrap(SVCAUTH *auth, XDR *in_xdrs, bool_t (*xdr_func)(),
    caddr_t xdr_ptr)
{
	svc_rpc_gss_parms_t	*gss_parms = SVCAUTH_GSSPARMS(auth);

	/*
	 * If context is not established, or if neither integrity nor
	 * privacy service is used, don't unwrap - just XDR decode.
	 * Otherwise, unwrap data.
	 */
	if (!gss_parms->established || gss_parms->service == rpc_gss_svc_none)
		return ((*xdr_func)(in_xdrs, xdr_ptr));

	return (__rpc_gss_unwrap_data(gss_parms->service,
	    (gss_ctx_id_t)gss_parms->context,
	    gss_parms->seq_num,
	    gss_parms->qop_rcvd,
	    in_xdrs, xdr_func, xdr_ptr));
}


/* ARGSUSED */
int
rpc_gss_svc_max_data_length(struct svc_req *req, int max_tp_unit_len)
{
	return (0);
}

/*
 * Add retransmit entry to the context cache entry for a new xid.
 * If there is already an entry, delete it before adding the new one.
 */
static void retrans_add(client, xid, result)
	svc_rpc_gss_data *client;
	uint32_t	xid;
	rpc_gss_init_res *result;
{
	retrans_entry	*rdata;

	if (client->retrans_data && client->retrans_data->xid == xid)
		return;

	rdata = kmem_zalloc(sizeof (*rdata), KM_SLEEP);

	if (rdata == NULL)
		return;

	rdata->xid = xid;
	rdata->result = *result;

	if (result->token.length != 0) {
		GSS_DUP_BUFFER(rdata->result.token, result->token);
	}

	if (client->retrans_data)
		retrans_del(client);

	client->retrans_data = rdata;
}

/*
 * Delete the retransmit data from the context cache entry.
 */
static void retrans_del(client)
	svc_rpc_gss_data *client;
{
	retrans_entry *rdata;
	OM_uint32 minor_stat;

	if (client->retrans_data == NULL)
		return;

	rdata = client->retrans_data;
	if (rdata->result.token.length != 0) {
	    (void) gss_release_buffer(&minor_stat, &rdata->result.token);
	}

	kmem_free((caddr_t)rdata, sizeof (*rdata));
	client->retrans_data = NULL;
}

/*
 * This function frees the following fields of svc_rpc_gss_data:
 *	client_name, raw_cred.client_principal, raw_cred.mechanism.
 */
static void
common_client_data_free(svc_rpc_gss_data *client_data)
{
	if (client_data->client_name.length > 0) {
		(void) gss_release_buffer(NULL, &client_data->client_name);
	}

	if (client_data->raw_cred.client_principal) {
		kmem_free((caddr_t)client_data->raw_cred.client_principal,
		    client_data->raw_cred.client_principal->len +
		    sizeof (int));
		client_data->raw_cred.client_principal = NULL;
	}

	/*
	 * In the user GSS-API library, mechanism (mech_type returned
	 * by gss_accept_sec_context) is static storage, however
	 * since all the work is done for gss_accept_sec_context under
	 * gssd, what is returned in the kernel, is a copy from the oid
	 * obtained under from gssd, so need to free it when destroying
	 * the client data.
	 */

	if (client_data->raw_cred.mechanism) {
		kgss_free_oid(client_data->raw_cred.mechanism);
		client_data->raw_cred.mechanism = NULL;
	}
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2012 Marcel Telka <marcel@telka.sk>
 * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
 * Copyright 2018 OmniOS Community Edition (OmniOSce) Association.
 * Copyright 2021 Racktop Systems, Inc.
 */

/*
 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Copyright 1993 OpenVision Technologies, Inc., All Rights Reserved.
 */

/*	Copyright (c) 1983, 1984, 1985,  1986, 1987, 1988, 1989 AT&T	*/
/*	All Rights Reserved	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

/*
 * Server-side remote procedure call interface.
 *
 * Master transport handle (SVCMASTERXPRT).
 *   The master transport handle structure is shared among service
 *   threads processing events on the transport. Some fields in the
 *   master structure are protected by locks
 *   - xp_req_lock protects the request queue:
 *	xp_req_head, xp_req_tail, xp_reqs, xp_size, xp_full, xp_enable
 *   - xp_thread_lock protects the thread (clone) counts
 *	xp_threads, xp_detached_threads, xp_wq
 *   Each master transport is registered to exactly one thread pool.
 *
 * Clone transport handle (SVCXPRT)
 *   The clone transport handle structure is a per-service-thread handle
 *   to the transport. The structure carries all the fields/buffers used
 *   for request processing. A service thread or, in other words, a clone
 *   structure, can be linked to an arbitrary master structure to process
 *   requests on this transport. The master handle keeps track of reference
 *   counts of threads (clones) linked to it. A service thread can switch
 *   to another transport by unlinking its clone handle from the current
 *   transport and linking to a new one. Switching is relatively inexpensive
 *   but it involves locking (master's xprt->xp_thread_lock).
 *
 * Pools.
 *   A pool represents a kernel RPC service (NFS, Lock Manager, etc.).
 *   Transports related to the service are registered to the service pool.
 *   Service threads can switch between different transports in the pool.
 *   Thus, each service has its own pool of service threads. The maximum
 *   number of threads in a pool is pool->p_maxthreads. This limit allows
 *   to restrict resource usage by the service. Some fields are protected
 *   by locks:
 *   - p_req_lock protects several counts and flags:
 *	p_reqs, p_size, p_walkers, p_asleep, p_drowsy, p_req_cv
 *   - p_thread_lock governs other thread counts:
 *	p_threads, p_detached_threads, p_reserved_threads, p_closing
 *
 *   In addition, each pool contains a doubly-linked list of transports,
 *   an `xprt-ready' queue and a creator thread (see below). Threads in
 *   the pool share some other parameters such as stack size and
 *   polling timeout.
 *
 *   Pools are initialized through the svc_pool_create() function called from
 *   the nfssys() system call. However, thread creation must be done by
 *   the userland agent. This is done by using SVCPOOL_WAIT and
 *   SVCPOOL_RUN arguments to nfssys(), which call svc_wait() and
 *   svc_do_run(), respectively. Once the pool has been initialized,
 *   the userland process must set up a 'creator' thread. This thread
 *   should park itself in the kernel by calling svc_wait(). If
 *   svc_wait() returns successfully, it should fork off a new worker
 *   thread, which then calls svc_do_run() in order to get work. When
 *   that thread is complete, svc_do_run() will return, and the user
 *   program should call thr_exit().
 *
 *   When we try to register a new pool and there is an old pool with
 *   the same id in the doubly linked pool list (this happens when we kill
 *   and restart nfsd or lockd), then we unlink the old pool from the list
 *   and mark its state as `closing'. After that the transports can still
 *   process requests but new transports won't be registered. When all the
 *   transports and service threads associated with the pool are gone the
 *   creator thread (see below) will clean up the pool structure and exit.
 *
 * svc_queuereq() and svc_run().
 *   The kernel RPC server is interrupt driven. The svc_queuereq() interrupt
 *   routine is called to deliver an RPC request. The service threads
 *   loop in svc_run(). The interrupt function queues a request on the
 *   transport's queue and it makes sure that the request is serviced.
 *   It may either wake up one of sleeping threads, or ask for a new thread
 *   to be created, or, if the previous request is just being picked up, do
 *   nothing. In the last case the service thread that is picking up the
 *   previous request will wake up or create the next thread. After a service
 *   thread processes a request and sends a reply it returns to svc_run()
 *   and svc_run() calls svc_poll() to find new input.
 *
 * svc_poll().
 *   In order to avoid unnecessary locking, which causes performance
 *   problems, we always look for a pending request on the current transport.
 *   If there is none we take a hint from the pool's `xprt-ready' queue.
 *   If the queue had an overflow we switch to the `drain' mode checking
 *   each transport  in the pool's transport list. Once we find a
 *   master transport handle with a pending request we latch the request
 *   lock on this transport and return to svc_run(). If the request
 *   belongs to a transport different than the one the service thread is
 *   linked to we need to unlink and link again.
 *
 *   A service thread goes asleep when there are no pending
 *   requests on the transports registered on the pool's transports.
 *   All the pool's threads sleep on the same condition variable.
 *   If a thread has been sleeping for too long period of time
 *   (by default 5 seconds) it wakes up and exits.  Also when a transport
 *   is closing sleeping threads wake up to unlink from this transport.
 *
 * The `xprt-ready' queue.
 *   If a service thread finds no request on a transport it is currently linked
 *   to it will find another transport with a pending request. To make
 *   this search more efficient each pool has an `xprt-ready' queue.
 *   The queue is a FIFO. When the interrupt routine queues a request it also
 *   inserts a pointer to the transport into the `xprt-ready' queue. A
 *   thread looking for a transport with a pending request can pop up a
 *   transport and check for a request. The request can be already gone
 *   since it could be taken by a thread linked to that transport. In such a
 *   case we try the next hint. The `xprt-ready' queue has fixed size (by
 *   default 256 nodes). If it overflows svc_poll() has to switch to the
 *   less efficient but safe `drain' mode and walk through the pool's
 *   transport list.
 *
 *   Both the svc_poll() loop and the `xprt-ready' queue are optimized
 *   for the peak load case that is for the situation when the queue is not
 *   empty, there are all the time few pending requests, and a service
 *   thread which has just processed a request does not go asleep but picks
 *   up immediately the next request.
 *
 * Thread creator.
 *   Each pool has a thread creator associated with it. The creator thread
 *   sleeps on a condition variable and waits for a signal to create a
 *   service thread. The actual thread creation is done in userland by
 *   the method described in "Pools" above.
 *
 *   Signaling threads should turn on the `creator signaled' flag, and
 *   can avoid sending signals when the flag is on. The flag is cleared
 *   when the thread is created.
 *
 *   When the pool is in closing state (ie it has been already unregistered
 *   from the pool list) the last thread on the last transport in the pool
 *   should turn the p_creator_exit flag on. The creator thread will
 *   clean up the pool structure and exit.
 *
 * Thread reservation; Detaching service threads.
 *   A service thread can detach itself to block for an extended amount
 *   of time. However, to keep the service active we need to guarantee
 *   at least pool->p_redline non-detached threads that can process incoming
 *   requests. This, the maximum number of detached and reserved threads is
 *   p->p_maxthreads - p->p_redline. A service thread should first acquire
 *   a reservation, and if the reservation was granted it can detach itself.
 *   If a reservation was granted but the thread does not detach itself
 *   it should cancel the reservation before it returns to svc_run().
 */

#include <sys/param.h>
#include <sys/types.h>
#include <rpc/types.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <sys/tiuser.h>
#include <sys/t_kuser.h>
#include <netinet/in.h>
#include <rpc/xdr.h>
#include <rpc/auth.h>
#include <rpc/clnt.h>
#include <rpc/rpc_msg.h>
#include <rpc/svc.h>
#include <sys/proc.h>
#include <sys/user.h>
#include <sys/stream.h>
#include <sys/strsubr.h>
#include <sys/strsun.h>
#include <sys/tihdr.h>
#include <sys/debug.h>
#include <sys/cmn_err.h>
#include <sys/file.h>
#include <sys/systm.h>
#include <sys/callb.h>
#include <sys/vtrace.h>
#include <sys/zone.h>
#include <nfs/nfs.h>
#include <sys/tsol/label_macro.h>

/*
 * Defines for svc_poll()
 */
#define	SVC_EXPRTGONE ((SVCMASTERXPRT *)1)	/* Transport is closing */
#define	SVC_ETIMEDOUT ((SVCMASTERXPRT *)2)	/* Timeout */
#define	SVC_EINTR ((SVCMASTERXPRT *)3)		/* Interrupted by signal */

/*
 * Default stack size for service threads.
 */
#define	DEFAULT_SVC_RUN_STKSIZE		(0)	/* default kernel stack */

int    svc_default_stksize = DEFAULT_SVC_RUN_STKSIZE;

/*
 * Default polling timeout for service threads.
 * Multiplied by hz when used.
 */
#define	DEFAULT_SVC_POLL_TIMEOUT	(5)	/* seconds */

clock_t svc_default_timeout = DEFAULT_SVC_POLL_TIMEOUT;

/*
 * Size of the `xprt-ready' queue.
 */
#define	DEFAULT_SVC_QSIZE		(256)	/* qnodes */

size_t svc_default_qsize = DEFAULT_SVC_QSIZE;

/*
 * Default limit for the number of service threads.
 */
#define	DEFAULT_SVC_MAXTHREADS		(INT16_MAX)

int    svc_default_maxthreads = DEFAULT_SVC_MAXTHREADS;

/*
 * Maximum number of requests from the same transport (in `drain' mode).
 */
#define	DEFAULT_SVC_MAX_SAME_XPRT	(8)

int    svc_default_max_same_xprt = DEFAULT_SVC_MAX_SAME_XPRT;


/*
 * Default `Redline' of non-detached threads.
 * Total number of detached and reserved threads in an RPC server
 * thread pool is limited to pool->p_maxthreads - svc_redline.
 */
#define	DEFAULT_SVC_REDLINE		(1)

int    svc_default_redline = DEFAULT_SVC_REDLINE;

/*
 * A node for the `xprt-ready' queue.
 * See below.
 */
struct __svcxprt_qnode {
	__SVCXPRT_QNODE	*q_next;
	SVCMASTERXPRT	*q_xprt;
};

/*
 * Global SVC variables (private).
 */
struct svc_globals {
	SVCPOOL		*svc_pools;
	kmutex_t	svc_plock;
};

/*
 * Debug variable to check for rdma based
 * transport startup and cleanup. Contorlled
 * through /etc/system. Off by default.
 */
int rdma_check = 0;

/*
 * This allows disabling flow control in svc_queuereq().
 */
volatile int svc_flowcontrol_disable = 0;

/*
 * Authentication parameters list.
 */
static caddr_t rqcred_head;
static kmutex_t rqcred_lock;

/*
 * If true, then keep quiet about version mismatch.
 * This macro is for broadcast RPC only. We have no broadcast RPC in
 * kernel now but one may define a flag in the transport structure
 * and redefine this macro.
 */
#define	version_keepquiet(xprt)	(FALSE)

/*
 * ZSD key used to retrieve zone-specific svc globals
 */
static zone_key_t svc_zone_key;

static void svc_callout_free(SVCMASTERXPRT *);
static void svc_xprt_qinit(SVCPOOL *, size_t);
static void svc_xprt_qdestroy(SVCPOOL *);
static void svc_thread_creator(SVCPOOL *);
static void svc_creator_signal(SVCPOOL *);
static void svc_creator_signalexit(SVCPOOL *);
static void svc_pool_unregister(struct svc_globals *, SVCPOOL *);
static int svc_run(SVCPOOL *);

/* ARGSUSED */
static void *
svc_zoneinit(zoneid_t zoneid)
{
	struct svc_globals *svc;

	svc = kmem_alloc(sizeof (*svc), KM_SLEEP);
	mutex_init(&svc->svc_plock, NULL, MUTEX_DEFAULT, NULL);
	svc->svc_pools = NULL;
	return (svc);
}

/* ARGSUSED */
static void
svc_zoneshutdown(zoneid_t zoneid, void *arg)
{
	struct svc_globals *svc = arg;
	SVCPOOL *pool;

	mutex_enter(&svc->svc_plock);
	while ((pool = svc->svc_pools) != NULL) {
		svc_pool_unregister(svc, pool);
	}
	mutex_exit(&svc->svc_plock);
}

/* ARGSUSED */
static void
svc_zonefini(zoneid_t zoneid, void *arg)
{
	struct svc_globals *svc = arg;

	ASSERT(svc->svc_pools == NULL);
	mutex_destroy(&svc->svc_plock);
	kmem_free(svc, sizeof (*svc));
}

/*
 * Global SVC init routine.
 * Initialize global generic and transport type specific structures
 * used by the kernel RPC server side. This routine is called only
 * once when the module is being loaded.
 */
void
svc_init()
{
	zone_key_create(&svc_zone_key, svc_zoneinit, svc_zoneshutdown,
	    svc_zonefini);
	svc_cots_init();
	svc_clts_init();
}

/*
 * Destroy the SVCPOOL structure.
 */
static void
svc_pool_cleanup(SVCPOOL *pool)
{
	ASSERT(pool->p_threads + pool->p_detached_threads == 0);
	ASSERT(pool->p_lcount == 0);
	ASSERT(pool->p_closing);

	/*
	 * Call the user supplied shutdown function.  This is done
	 * here so the user of the pool will be able to cleanup
	 * service related resources.
	 */
	if (pool->p_shutdown != NULL)
		(pool->p_shutdown)();

	/* Destroy `xprt-ready' queue */
	svc_xprt_qdestroy(pool);

	/* Destroy transport list */
	rw_destroy(&pool->p_lrwlock);

	/* Destroy locks and condition variables */
	mutex_destroy(&pool->p_thread_lock);
	mutex_destroy(&pool->p_req_lock);
	cv_destroy(&pool->p_req_cv);

	/* Destroy creator's locks and condition variables */
	mutex_destroy(&pool->p_creator_lock);
	cv_destroy(&pool->p_creator_cv);
	mutex_destroy(&pool->p_user_lock);
	cv_destroy(&pool->p_user_cv);

	/* Free pool structure */
	kmem_free(pool, sizeof (SVCPOOL));
}

/*
 * If all the transports and service threads are already gone
 * signal the creator thread to clean up and exit.
 */
static bool_t
svc_pool_tryexit(SVCPOOL *pool)
{
	ASSERT(MUTEX_HELD(&pool->p_thread_lock));
	ASSERT(pool->p_closing);

	if (pool->p_threads + pool->p_detached_threads == 0) {
		rw_enter(&pool->p_lrwlock, RW_READER);
		if (pool->p_lcount == 0) {
			/*
			 * Release the locks before sending a signal.
			 */
			rw_exit(&pool->p_lrwlock);
			mutex_exit(&pool->p_thread_lock);

			/*
			 * Notify the creator thread to clean up and exit
			 *
			 * NOTICE: No references to the pool beyond this point!
			 *		   The pool is being destroyed.
			 */
			ASSERT(!MUTEX_HELD(&pool->p_thread_lock));
			svc_creator_signalexit(pool);

			return (TRUE);
		}
		rw_exit(&pool->p_lrwlock);
	}

	ASSERT(MUTEX_HELD(&pool->p_thread_lock));
	return (FALSE);
}

/*
 * Find a pool with a given id.
 */
static SVCPOOL *
svc_pool_find(struct svc_globals *svc, int id)
{
	SVCPOOL *pool;

	ASSERT(MUTEX_HELD(&svc->svc_plock));

	/*
	 * Search the list for a pool with a matching id
	 * and register the transport handle with that pool.
	 */
	for (pool = svc->svc_pools; pool; pool = pool->p_next)
		if (pool->p_id == id)
			return (pool);

	return (NULL);
}

/*
 * PSARC 2003/523 Contract Private Interface
 * svc_do_run
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
int
svc_do_run(int id)
{
	SVCPOOL *pool;
	int err = 0;
	struct svc_globals *svc;

	svc = zone_getspecific(svc_zone_key, curproc->p_zone);
	mutex_enter(&svc->svc_plock);

	pool = svc_pool_find(svc, id);

	mutex_exit(&svc->svc_plock);

	if (pool == NULL)
		return (ENOENT);

	/*
	 * Increment counter of pool threads now
	 * that a thread has been created.
	 */
	mutex_enter(&pool->p_thread_lock);
	pool->p_threads++;
	mutex_exit(&pool->p_thread_lock);

	/* Give work to the new thread. */
	err = svc_run(pool);

	return (err);
}

/*
 * Unregister a pool from the pool list.
 * Set the closing state. If all the transports and service threads
 * are already gone signal the creator thread to clean up and exit.
 */
static void
svc_pool_unregister(struct svc_globals *svc, SVCPOOL *pool)
{
	SVCPOOL *next = pool->p_next;
	SVCPOOL *prev = pool->p_prev;

	ASSERT(MUTEX_HELD(&svc->svc_plock));

	/* Remove from the list */
	if (pool == svc->svc_pools)
		svc->svc_pools = next;
	if (next)
		next->p_prev = prev;
	if (prev)
		prev->p_next = next;
	pool->p_next = pool->p_prev = NULL;

	/*
	 * Offline the pool. Mark the pool as closing.
	 * If there are no transports in this pool notify
	 * the creator thread to clean it up and exit.
	 */
	mutex_enter(&pool->p_thread_lock);
	if (pool->p_offline != NULL)
		(pool->p_offline)();
	pool->p_closing = TRUE;
	if (svc_pool_tryexit(pool))
		return;
	mutex_exit(&pool->p_thread_lock);
}

/*
 * Register a pool with a given id in the global doubly linked pool list.
 * - if there is a pool with the same id in the list then unregister it
 * - insert the new pool into the list.
 */
static void
svc_pool_register(struct svc_globals *svc, SVCPOOL *pool, int id)
{
	SVCPOOL *old_pool;

	/*
	 * If there is a pool with the same id then remove it from
	 * the list and mark the pool as closing.
	 */
	mutex_enter(&svc->svc_plock);

	if (old_pool = svc_pool_find(svc, id))
		svc_pool_unregister(svc, old_pool);

	/* Insert into the doubly linked list */
	pool->p_id = id;
	pool->p_next = svc->svc_pools;
	pool->p_prev = NULL;
	if (svc->svc_pools)
		svc->svc_pools->p_prev = pool;
	svc->svc_pools = pool;

	mutex_exit(&svc->svc_plock);
}

/*
 * Initialize a newly created pool structure
 */
static int
svc_pool_init(SVCPOOL *pool, uint_t maxthreads, uint_t redline,
    uint_t qsize, uint_t timeout, uint_t stksize, uint_t max_same_xprt)
{
	klwp_t *lwp = ttolwp(curthread);

	ASSERT(pool);

	if (maxthreads == 0)
		maxthreads = svc_default_maxthreads;
	if (redline == 0)
		redline = svc_default_redline;
	if (qsize == 0)
		qsize = svc_default_qsize;
	if (timeout == 0)
		timeout = svc_default_timeout;
	if (stksize == 0)
		stksize = svc_default_stksize;
	if (max_same_xprt == 0)
		max_same_xprt = svc_default_max_same_xprt;

	if (maxthreads < redline)
		return (EINVAL);

	/* Allocate and initialize the `xprt-ready' queue */
	svc_xprt_qinit(pool, qsize);

	/* Initialize doubly-linked xprt list */
	rw_init(&pool->p_lrwlock, NULL, RW_DEFAULT, NULL);

	/*
	 * Setting lwp_childstksz on the current lwp so that
	 * descendants of this lwp get the modified stacksize, if
	 * it is defined. It is important that either this lwp or
	 * one of its descendants do the actual servicepool thread
	 * creation to maintain the stacksize inheritance.
	 */
	if (lwp != NULL)
		lwp->lwp_childstksz = stksize;

	/* Initialize thread limits, locks and condition variables */
	pool->p_maxthreads = maxthreads;
	pool->p_redline = redline;
	pool->p_timeout = timeout * hz;
	pool->p_stksize = stksize;
	pool->p_max_same_xprt = max_same_xprt;
	mutex_init(&pool->p_thread_lock, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&pool->p_req_lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&pool->p_req_cv, NULL, CV_DEFAULT, NULL);

	/* Initialize userland creator */
	pool->p_user_exit = FALSE;
	pool->p_signal_create_thread = FALSE;
	pool->p_user_waiting = FALSE;
	mutex_init(&pool->p_user_lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&pool->p_user_cv, NULL, CV_DEFAULT, NULL);

	/* Initialize the creator and start the creator thread */
	pool->p_creator_exit = FALSE;
	mutex_init(&pool->p_creator_lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&pool->p_creator_cv, NULL, CV_DEFAULT, NULL);

	(void) zthread_create(NULL, pool->p_stksize, svc_thread_creator,
	    pool, 0, minclsyspri);

	return (0);
}

/*
 * PSARC 2003/523 Contract Private Interface
 * svc_pool_create
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 *
 * Create an kernel RPC server-side thread/transport pool.
 *
 * This is public interface for creation of a server RPC thread pool
 * for a given service provider. Transports registered with the pool's id
 * will be served by a pool's threads. This function is called from the
 * nfssys() system call.
 */
int
svc_pool_create(struct svcpool_args *args)
{
	SVCPOOL *pool;
	int error;
	struct svc_globals *svc;

	/*
	 * Caller should check credentials in a way appropriate
	 * in the context of the call.
	 */

	svc = zone_getspecific(svc_zone_key, curproc->p_zone);
	/* Allocate a new pool */
	pool = kmem_zalloc(sizeof (SVCPOOL), KM_SLEEP);

	/*
	 * Initialize the pool structure and create a creator thread.
	 */
	error = svc_pool_init(pool, args->maxthreads, args->redline,
	    args->qsize, args->timeout, args->stksize, args->max_same_xprt);

	if (error) {
		kmem_free(pool, sizeof (SVCPOOL));
		return (error);
	}

	/* Register the pool with the global pool list */
	svc_pool_register(svc, pool, args->id);

	return (0);
}

int
svc_pool_control(int id, int cmd, void *arg)
{
	SVCPOOL *pool;
	struct svc_globals *svc;

	svc = zone_getspecific(svc_zone_key, curproc->p_zone);

	switch (cmd) {
	case SVCPSET_SHUTDOWN_PROC:
		/*
		 * Search the list for a pool with a matching id
		 * and register the transport handle with that pool.
		 */
		mutex_enter(&svc->svc_plock);

		if ((pool = svc_pool_find(svc, id)) == NULL) {
			mutex_exit(&svc->svc_plock);
			return (ENOENT);
		}
		/*
		 * Grab the transport list lock before releasing the
		 * pool list lock
		 */
		rw_enter(&pool->p_lrwlock, RW_WRITER);
		mutex_exit(&svc->svc_plock);

		pool->p_shutdown = *((void (*)())arg);

		rw_exit(&pool->p_lrwlock);

		return (0);
	case SVCPSET_UNREGISTER_PROC:
		/*
		 * Search the list for a pool with a matching id
		 * and register the unregister callback handle with that pool.
		 */
		mutex_enter(&svc->svc_plock);

		if ((pool = svc_pool_find(svc, id)) == NULL) {
			mutex_exit(&svc->svc_plock);
			return (ENOENT);
		}
		/*
		 * Grab the transport list lock before releasing the
		 * pool list lock
		 */
		rw_enter(&pool->p_lrwlock, RW_WRITER);
		mutex_exit(&svc->svc_plock);

		pool->p_offline = *((void (*)())arg);

		rw_exit(&pool->p_lrwlock);

		return (0);
	default:
		return (EINVAL);
	}
}

/*
 * Pool's transport list manipulation routines.
 * - svc_xprt_register()
 * - svc_xprt_unregister()
 *
 * svc_xprt_register() is called from svc_tli_kcreate() to
 * insert a new master transport handle into the doubly linked
 * list of server transport handles (one list per pool).
 *
 * The list is used by svc_poll(), when it operates in `drain'
 * mode, to search for a next transport with a pending request.
 */

int
svc_xprt_register(SVCMASTERXPRT *xprt, int id)
{
	SVCMASTERXPRT *prev, *next;
	SVCPOOL *pool;
	struct svc_globals *svc;

	svc = zone_getspecific(svc_zone_key, curproc->p_zone);
	/*
	 * Search the list for a pool with a matching id
	 * and register the transport handle with that pool.
	 */
	mutex_enter(&svc->svc_plock);

	if ((pool = svc_pool_find(svc, id)) == NULL) {
		mutex_exit(&svc->svc_plock);
		return (ENOENT);
	}

	/* Grab the transport list lock before releasing the pool list lock */
	rw_enter(&pool->p_lrwlock, RW_WRITER);
	mutex_exit(&svc->svc_plock);

	/* Don't register new transports when the pool is in closing state */
	if (pool->p_closing) {
		rw_exit(&pool->p_lrwlock);
		return (EBUSY);
	}

	/*
	 * Initialize xp_pool to point to the pool.
	 * We don't want to go through the pool list every time.
	 */
	xprt->xp_pool = pool;

	/*
	 * Insert a transport handle into the list.
	 * The list head points to the most recently inserted transport.
	 */
	if (pool->p_lhead == NULL)
		pool->p_lhead = xprt->xp_prev = xprt->xp_next = xprt;
	else {
		next = pool->p_lhead;
		prev = pool->p_lhead->xp_prev;

		xprt->xp_next = next;
		xprt->xp_prev = prev;

		pool->p_lhead = prev->xp_next = next->xp_prev = xprt;
	}

	/* Increment the transports count */
	pool->p_lcount++;

	rw_exit(&pool->p_lrwlock);
	return (0);
}

/*
 * Called from svc_xprt_cleanup() to remove a master transport handle
 * from the pool's list of server transports (when a transport is
 * being destroyed).
 */
void
svc_xprt_unregister(SVCMASTERXPRT *xprt)
{
	SVCPOOL *pool = xprt->xp_pool;

	/*
	 * Unlink xprt from the list.
	 * If the list head points to this xprt then move it
	 * to the next xprt or reset to NULL if this is the last
	 * xprt in the list.
	 */
	rw_enter(&pool->p_lrwlock, RW_WRITER);

	if (xprt == xprt->xp_next)
		pool->p_lhead = NULL;
	else {
		SVCMASTERXPRT *next = xprt->xp_next;
		SVCMASTERXPRT *prev = xprt->xp_prev;

		next->xp_prev = prev;
		prev->xp_next = next;

		if (pool->p_lhead == xprt)
			pool->p_lhead = next;
	}

	xprt->xp_next = xprt->xp_prev = NULL;

	/* Decrement list count */
	pool->p_lcount--;

	rw_exit(&pool->p_lrwlock);
}

static void
svc_xprt_qdestroy(SVCPOOL *pool)
{
	mutex_destroy(&pool->p_qend_lock);
	kmem_free(pool->p_qbody, pool->p_qsize * sizeof (__SVCXPRT_QNODE));
}

/*
 * Initialize an `xprt-ready' queue for a given pool.
 */
static void
svc_xprt_qinit(SVCPOOL *pool, size_t qsize)
{
	int i;

	pool->p_qsize = qsize;
	pool->p_qbody = kmem_zalloc(pool->p_qsize * sizeof (__SVCXPRT_QNODE),
	    KM_SLEEP);

	for (i = 0; i < pool->p_qsize - 1; i++)
		pool->p_qbody[i].q_next = &(pool->p_qbody[i+1]);

	pool->p_qbody[pool->p_qsize-1].q_next = &(pool->p_qbody[0]);
	pool->p_qtop = &(pool->p_qbody[0]);
	pool->p_qend = &(pool->p_qbody[0]);

	mutex_init(&pool->p_qend_lock, NULL, MUTEX_DEFAULT, NULL);
}

/*
 * Called from the svc_queuereq() interrupt routine to queue
 * a hint for svc_poll() which transport has a pending request.
 * - insert a pointer to xprt into the xprt-ready queue (FIFO)
 * - if the xprt-ready queue is full turn the overflow flag on.
 *
 * NOTICE: pool->p_qtop is protected by the pool's request lock
 * and the caller (svc_queuereq()) must hold the lock.
 */
static void
svc_xprt_qput(SVCPOOL *pool, SVCMASTERXPRT *xprt)
{
	ASSERT(MUTEX_HELD(&pool->p_req_lock));

	/* If the overflow flag is on there is nothing we can do */
	if (pool->p_qoverflow)
		return;

	/* If the queue is full turn the overflow flag on and exit */
	if (pool->p_qtop->q_next == pool->p_qend) {
		mutex_enter(&pool->p_qend_lock);
		if (pool->p_qtop->q_next == pool->p_qend) {
			pool->p_qoverflow = TRUE;
			mutex_exit(&pool->p_qend_lock);
			return;
		}
		mutex_exit(&pool->p_qend_lock);
	}

	/* Insert a hint and move pool->p_qtop */
	pool->p_qtop->q_xprt = xprt;
	pool->p_qtop = pool->p_qtop->q_next;
}

/*
 * Called from svc_poll() to get a hint which transport has a
 * pending request. Returns a pointer to a transport or NULL if the
 * `xprt-ready' queue is empty.
 *
 * Since we do not acquire the pool's request lock while checking if
 * the queue is empty we may miss a request that is just being delivered.
 * However this is ok since svc_poll() will retry again until the
 * count indicates that there are pending requests for this pool.
 */
static SVCMASTERXPRT *
svc_xprt_qget(SVCPOOL *pool)
{
	SVCMASTERXPRT *xprt;

	mutex_enter(&pool->p_qend_lock);
	do {
		/*
		 * If the queue is empty return NULL.
		 * Since we do not acquire the pool's request lock which
		 * protects pool->p_qtop this is not exact check. However,
		 * this is safe - if we miss a request here svc_poll()
		 * will retry again.
		 */
		if (pool->p_qend == pool->p_qtop) {
			mutex_exit(&pool->p_qend_lock);
			return (NULL);
		}

		/* Get a hint and move pool->p_qend */
		xprt = pool->p_qend->q_xprt;
		pool->p_qend = pool->p_qend->q_next;

		/* Skip fields deleted by svc_xprt_qdelete()	 */
	} while (xprt == NULL);
	mutex_exit(&pool->p_qend_lock);

	return (xprt);
}

/*
 * Delete all the references to a transport handle that
 * is being destroyed from the xprt-ready queue.
 * Deleted pointers are replaced with NULLs.
 */
static void
svc_xprt_qdelete(SVCPOOL *pool, SVCMASTERXPRT *xprt)
{
	__SVCXPRT_QNODE *q;

	mutex_enter(&pool->p_req_lock);
	for (q = pool->p_qend; q != pool->p_qtop; q = q->q_next) {
		if (q->q_xprt == xprt)
			q->q_xprt = NULL;
	}
	mutex_exit(&pool->p_req_lock);
}

/*
 * Destructor for a master server transport handle.
 * - if there are no more non-detached threads linked to this transport
 *   then, if requested, call xp_closeproc (we don't wait for detached
 *   threads linked to this transport to complete).
 * - if there are no more threads linked to this
 *   transport then
 *   a) remove references to this transport from the xprt-ready queue
 *   b) remove a reference to this transport from the pool's transport list
 *   c) call a transport specific `destroy' function
 *   d) cancel remaining thread reservations.
 *
 * NOTICE: Caller must hold the transport's thread lock.
 */
static void
svc_xprt_cleanup(SVCMASTERXPRT *xprt, bool_t detached)
{
	ASSERT(MUTEX_HELD(&xprt->xp_thread_lock));
	ASSERT(xprt->xp_wq == NULL);

	/*
	 * If called from the last non-detached thread
	 * it should call the closeproc on this transport.
	 */
	if (!detached && xprt->xp_threads == 0 && xprt->xp_closeproc) {
		(*(xprt->xp_closeproc)) (xprt);
	}

	if (xprt->xp_threads + xprt->xp_detached_threads > 0)
		mutex_exit(&xprt->xp_thread_lock);
	else {
		/* Remove references to xprt from the `xprt-ready' queue */
		svc_xprt_qdelete(xprt->xp_pool, xprt);

		/* Unregister xprt from the pool's transport list */
		svc_xprt_unregister(xprt);
		svc_callout_free(xprt);
		SVC_DESTROY(xprt);
	}
}

/*
 * Find a dispatch routine for a given prog/vers pair.
 * This function is called from svc_getreq() to search the callout
 * table for an entry with a matching RPC program number `prog'
 * and a version range that covers `vers'.
 * - if it finds a matching entry it returns pointer to the dispatch routine
 * - otherwise it returns NULL and fills both vers_min and vers_max
 *   with, respectively, lowest version and highest version
 *   supported for the program `prog'
 */
static SVC_DISPATCH *
svc_callout_find(SVCXPRT *xprt, rpcprog_t prog, rpcvers_t vers,
    rpcvers_t *vers_min, rpcvers_t *vers_max)
{
	SVC_CALLOUT_TABLE *sct = xprt->xp_sct;
	int i;

	*vers_min = ~(rpcvers_t)0;
	*vers_max = 0;

	for (i = 0; i < sct->sct_size; i++) {
		SVC_CALLOUT *sc = &sct->sct_sc[i];

		if (prog == sc->sc_prog) {
			if (vers >= sc->sc_versmin && vers <= sc->sc_versmax)
				return (sc->sc_dispatch);

			if (*vers_max < sc->sc_versmax)
				*vers_max = sc->sc_versmax;
			if (*vers_min > sc->sc_versmin)
				*vers_min = sc->sc_versmin;
		}
	}

	return (NULL);
}

/*
 * Optionally free callout table allocated for this transport by
 * the service provider.
 */
static void
svc_callout_free(SVCMASTERXPRT *xprt)
{
	SVC_CALLOUT_TABLE *sct = xprt->xp_sct;

	if (sct->sct_free) {
		kmem_free(sct->sct_sc, sct->sct_size * sizeof (SVC_CALLOUT));
		kmem_free(sct, sizeof (SVC_CALLOUT_TABLE));
	}
}

/*
 * Send a reply to an RPC request
 *
 * PSARC 2003/523 Contract Private Interface
 * svc_sendreply
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
bool_t
svc_sendreply(const SVCXPRT *clone_xprt, const xdrproc_t xdr_results,
    const caddr_t xdr_location)
{
	struct rpc_msg rply;

	rply.rm_direction = REPLY;
	rply.rm_reply.rp_stat = MSG_ACCEPTED;
	rply.acpted_rply.ar_verf = clone_xprt->xp_verf;
	rply.acpted_rply.ar_stat = SUCCESS;
	rply.acpted_rply.ar_results.where = xdr_location;
	rply.acpted_rply.ar_results.proc = xdr_results;

	return (SVC_REPLY((SVCXPRT *)clone_xprt, &rply));
}

/*
 * No procedure error reply
 *
 * PSARC 2003/523 Contract Private Interface
 * svcerr_noproc
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
void
svcerr_noproc(const SVCXPRT *clone_xprt)
{
	struct rpc_msg rply;

	rply.rm_direction = REPLY;
	rply.rm_reply.rp_stat = MSG_ACCEPTED;
	rply.acpted_rply.ar_verf = clone_xprt->xp_verf;
	rply.acpted_rply.ar_stat = PROC_UNAVAIL;
	SVC_FREERES((SVCXPRT *)clone_xprt);
	SVC_REPLY((SVCXPRT *)clone_xprt, &rply);
}

/*
 * Can't decode arguments error reply
 *
 * PSARC 2003/523 Contract Private Interface
 * svcerr_decode
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
void
svcerr_decode(const SVCXPRT *clone_xprt)
{
	struct rpc_msg rply;

	rply.rm_direction = REPLY;
	rply.rm_reply.rp_stat = MSG_ACCEPTED;
	rply.acpted_rply.ar_verf = clone_xprt->xp_verf;
	rply.acpted_rply.ar_stat = GARBAGE_ARGS;
	SVC_FREERES((SVCXPRT *)clone_xprt);
	SVC_REPLY((SVCXPRT *)clone_xprt, &rply);
}

/*
 * Some system error
 */
void
svcerr_systemerr(const SVCXPRT *clone_xprt)
{
	struct rpc_msg rply;

	rply.rm_direction = REPLY;
	rply.rm_reply.rp_stat = MSG_ACCEPTED;
	rply.acpted_rply.ar_verf = clone_xprt->xp_verf;
	rply.acpted_rply.ar_stat = SYSTEM_ERR;
	SVC_FREERES((SVCXPRT *)clone_xprt);
	SVC_REPLY((SVCXPRT *)clone_xprt, &rply);
}

/*
 * Authentication error reply
 */
void
svcerr_auth(const SVCXPRT *clone_xprt, const enum auth_stat why)
{
	struct rpc_msg rply;

	rply.rm_direction = REPLY;
	rply.rm_reply.rp_stat = MSG_DENIED;
	rply.rjcted_rply.rj_stat = AUTH_ERROR;
	rply.rjcted_rply.rj_why = why;
	SVC_FREERES((SVCXPRT *)clone_xprt);
	SVC_REPLY((SVCXPRT *)clone_xprt, &rply);
}

/*
 * Authentication too weak error reply
 */
void
svcerr_weakauth(const SVCXPRT *clone_xprt)
{
	svcerr_auth((SVCXPRT *)clone_xprt, AUTH_TOOWEAK);
}

/*
 * Authentication error; bad credentials
 */
void
svcerr_badcred(const SVCXPRT *clone_xprt)
{
	struct rpc_msg rply;

	rply.rm_direction = REPLY;
	rply.rm_reply.rp_stat = MSG_DENIED;
	rply.rjcted_rply.rj_stat = AUTH_ERROR;
	rply.rjcted_rply.rj_why = AUTH_BADCRED;
	SVC_FREERES((SVCXPRT *)clone_xprt);
	SVC_REPLY((SVCXPRT *)clone_xprt, &rply);
}

/*
 * Program unavailable error reply
 *
 * PSARC 2003/523 Contract Private Interface
 * svcerr_noprog
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
void
svcerr_noprog(const SVCXPRT *clone_xprt)
{
	struct rpc_msg rply;

	rply.rm_direction = REPLY;
	rply.rm_reply.rp_stat = MSG_ACCEPTED;
	rply.acpted_rply.ar_verf = clone_xprt->xp_verf;
	rply.acpted_rply.ar_stat = PROG_UNAVAIL;
	SVC_FREERES((SVCXPRT *)clone_xprt);
	SVC_REPLY((SVCXPRT *)clone_xprt, &rply);
}

/*
 * Program version mismatch error reply
 *
 * PSARC 2003/523 Contract Private Interface
 * svcerr_progvers
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
void
svcerr_progvers(const SVCXPRT *clone_xprt,
    const rpcvers_t low_vers, const rpcvers_t high_vers)
{
	struct rpc_msg rply;

	rply.rm_direction = REPLY;
	rply.rm_reply.rp_stat = MSG_ACCEPTED;
	rply.acpted_rply.ar_verf = clone_xprt->xp_verf;
	rply.acpted_rply.ar_stat = PROG_MISMATCH;
	rply.acpted_rply.ar_vers.low = low_vers;
	rply.acpted_rply.ar_vers.high = high_vers;
	SVC_FREERES((SVCXPRT *)clone_xprt);
	SVC_REPLY((SVCXPRT *)clone_xprt, &rply);
}

/*
 * Get server side input from some transport.
 *
 * Statement of authentication parameters management:
 * This function owns and manages all authentication parameters, specifically
 * the "raw" parameters (msg.rm_call.cb_cred and msg.rm_call.cb_verf) and
 * the "cooked" credentials (rqst->rq_clntcred).
 * However, this function does not know the structure of the cooked
 * credentials, so it make the following assumptions:
 *   a) the structure is contiguous (no pointers), and
 *   b) the cred structure size does not exceed RQCRED_SIZE bytes.
 * In all events, all three parameters are freed upon exit from this routine.
 * The storage is trivially managed on the call stack in user land, but
 * is malloced in kernel land.
 *
 * Note: the xprt's xp_svc_lock is not held while the service's dispatch
 * routine is running.	If we decide to implement svc_unregister(), we'll
 * need to decide whether it's okay for a thread to unregister a service
 * while a request is being processed.	If we decide that this is a
 * problem, we can probably use some sort of reference counting scheme to
 * keep the callout entry from going away until the request has completed.
 */
static void
svc_getreq(
	SVCXPRT *clone_xprt,	/* clone transport handle */
	mblk_t *mp)
{
	struct rpc_msg msg;
	struct svc_req r;
	char  *cred_area;	/* too big to allocate on call stack */

	TRACE_0(TR_FAC_KRPC, TR_SVC_GETREQ_START,
	    "svc_getreq_start:");

	ASSERT(clone_xprt->xp_master != NULL);
	ASSERT(!is_system_labeled() || msg_getcred(mp, NULL) != NULL ||
	    mp->b_datap->db_type != M_DATA);

	/*
	 * Firstly, allocate the authentication parameters' storage
	 */
	mutex_enter(&rqcred_lock);
	if (rqcred_head) {
		cred_area = rqcred_head;

		/* LINTED pointer alignment */
		rqcred_head = *(caddr_t *)rqcred_head;
		mutex_exit(&rqcred_lock);
	} else {
		mutex_exit(&rqcred_lock);
		cred_area = kmem_alloc(2 * MAX_AUTH_BYTES + RQCRED_SIZE,
		    KM_SLEEP);
	}
	msg.rm_call.cb_cred.oa_base = cred_area;
	msg.rm_call.cb_verf.oa_base = &(cred_area[MAX_AUTH_BYTES]);
	r.rq_clntcred = &(cred_area[2 * MAX_AUTH_BYTES]);

	/*
	 * underlying transport recv routine may modify mblk data
	 * and make it difficult to extract label afterwards. So
	 * get the label from the raw mblk data now.
	 */
	if (is_system_labeled()) {
		cred_t *cr;

		r.rq_label = kmem_alloc(sizeof (bslabel_t), KM_SLEEP);
		cr = msg_getcred(mp, NULL);
		ASSERT(cr != NULL);

		bcopy(label2bslabel(crgetlabel(cr)), r.rq_label,
		    sizeof (bslabel_t));
	} else {
		r.rq_label = NULL;
	}

	/*
	 * Now receive a message from the transport.
	 */
	if (SVC_RECV(clone_xprt, mp, &msg)) {
		void (*dispatchroutine) (struct svc_req *, SVCXPRT *);
		rpcvers_t vers_min;
		rpcvers_t vers_max;
		bool_t no_dispatch;
		enum auth_stat why;

		/*
		 * Find the registered program and call its
		 * dispatch routine.
		 */
		r.rq_xprt = clone_xprt;
		r.rq_prog = msg.rm_call.cb_prog;
		r.rq_vers = msg.rm_call.cb_vers;
		r.rq_proc = msg.rm_call.cb_proc;
		r.rq_cred = msg.rm_call.cb_cred;

		/*
		 * First authenticate the message.
		 */
		TRACE_0(TR_FAC_KRPC, TR_SVC_GETREQ_AUTH_START,
		    "svc_getreq_auth_start:");
		if ((why = sec_svc_msg(&r, &msg, &no_dispatch)) != AUTH_OK) {
			TRACE_1(TR_FAC_KRPC, TR_SVC_GETREQ_AUTH_END,
			    "svc_getreq_auth_end:(%S)", "failed");
			svcerr_auth(clone_xprt, why);
			/*
			 * Free the arguments.
			 */
			(void) SVC_FREEARGS(clone_xprt, NULL, NULL);
		} else if (no_dispatch) {
			/*
			 * XXX - when bug id 4053736 is done, remove
			 * the SVC_FREEARGS() call.
			 */
			(void) SVC_FREEARGS(clone_xprt, NULL, NULL);
		} else {
			TRACE_1(TR_FAC_KRPC, TR_SVC_GETREQ_AUTH_END,
			    "svc_getreq_auth_end:(%S)", "good");

			dispatchroutine = svc_callout_find(clone_xprt,
			    r.rq_prog, r.rq_vers, &vers_min, &vers_max);

			if (dispatchroutine) {
				(*dispatchroutine) (&r, clone_xprt);
			} else {
				/*
				 * If we got here, the program or version
				 * is not served ...
				 */
				if (vers_max == 0 ||
				    version_keepquiet(clone_xprt))
					svcerr_noprog(clone_xprt);
				else
					svcerr_progvers(clone_xprt, vers_min,
					    vers_max);

				/*
				 * Free the arguments. For successful calls
				 * this is done by the dispatch routine.
				 */
				(void) SVC_FREEARGS(clone_xprt, NULL, NULL);
				/* Fall through to ... */
			}
			/*
			 * Call cleanup procedure for RPCSEC_GSS.
			 * This is a hack since there is currently no
			 * op, such as SVC_CLEANAUTH. rpc_gss_cleanup
			 * should only be called for a non null proc.
			 * Null procs in RPC GSS are overloaded to
			 * provide context setup and control. The main
			 * purpose of rpc_gss_cleanup is to decrement the
			 * reference count associated with the cached
			 * GSS security context. We should never get here
			 * for an RPCSEC_GSS null proc since *no_dispatch
			 * would have been set to true from sec_svc_msg above.
			 */
			if (r.rq_cred.oa_flavor == RPCSEC_GSS)
				rpc_gss_cleanup(clone_xprt);
		}
	}

	if (r.rq_label != NULL)
		kmem_free(r.rq_label, sizeof (bslabel_t));

	/*
	 * Free authentication parameters' storage
	 */
	mutex_enter(&rqcred_lock);
	/* LINTED pointer alignment */
	*(caddr_t *)cred_area = rqcred_head;
	rqcred_head = cred_area;
	mutex_exit(&rqcred_lock);
}

/*
 * Allocate new clone transport handle.
 */
SVCXPRT *
svc_clone_init(void)
{
	SVCXPRT *clone_xprt;

	clone_xprt = kmem_zalloc(sizeof (SVCXPRT), KM_SLEEP);
	clone_xprt->xp_cred = crget();
	return (clone_xprt);
}

void
svc_init_clone_xprt(SVCXPRT *clone_xprt, queue_t *wq)
{
	extern struct svc_ops svc_cots_op;
	clone_xprt->xp_ops = &svc_cots_op;
	clone_xprt->xp_wq = wq;
}

/*
 * Free memory allocated by svc_clone_init.
 */
void
svc_clone_free(SVCXPRT *clone_xprt)
{
	/* Fre credentials from crget() */
	if (clone_xprt->xp_cred)
		crfree(clone_xprt->xp_cred);
	kmem_free(clone_xprt, sizeof (SVCXPRT));
}

/*
 * Link a per-thread clone transport handle to a master
 * - increment a thread reference count on the master
 * - copy some of the master's fields to the clone
 * - call a transport specific clone routine.
 */
void
svc_clone_link(SVCMASTERXPRT *xprt, SVCXPRT *clone_xprt, SVCXPRT *clone_xprt2)
{
	cred_t *cred = clone_xprt->xp_cred;

	ASSERT(cred);

	/*
	 * Bump up master's thread count.
	 * Linking a per-thread clone transport handle to a master
	 * associates a service thread with the master.
	 */
	mutex_enter(&xprt->xp_thread_lock);
	xprt->xp_threads++;
	mutex_exit(&xprt->xp_thread_lock);

	/* Clear everything */
	bzero(clone_xprt, sizeof (SVCXPRT));

	/* Set pointer to the master transport stucture */
	clone_xprt->xp_master = xprt;

	/* Structure copy of all the common fields */
	clone_xprt->xp_xpc = xprt->xp_xpc;

	/* Restore per-thread fields (xp_cred) */
	clone_xprt->xp_cred = cred;

	if (clone_xprt2)
		SVC_CLONE_XPRT(clone_xprt2, clone_xprt);
}

/*
 * Unlink a non-detached clone transport handle from a master
 * - decrement a thread reference count on the master
 * - if the transport is closing (xp_wq is NULL) call svc_xprt_cleanup();
 *   if this is the last non-detached/absolute thread on this transport
 *   then it will close/destroy the transport
 * - call transport specific function to destroy the clone handle
 * - clear xp_master to avoid recursion.
 */
void
svc_clone_unlink(SVCXPRT *clone_xprt)
{
	SVCMASTERXPRT *xprt = clone_xprt->xp_master;

	/* This cannot be a detached thread */
	ASSERT(!clone_xprt->xp_detached);
	ASSERT(xprt->xp_threads > 0);

	/* Decrement a reference count on the transport */
	mutex_enter(&xprt->xp_thread_lock);
	xprt->xp_threads--;

	/* svc_xprt_cleanup() unlocks xp_thread_lock or destroys xprt */
	if (xprt->xp_wq)
		mutex_exit(&xprt->xp_thread_lock);
	else
		svc_xprt_cleanup(xprt, FALSE);

	/* Call a transport specific clone `destroy' function */
	SVC_CLONE_DESTROY(clone_xprt);

	/* Clear xp_master */
	clone_xprt->xp_master = NULL;
}

/*
 * Unlink a detached clone transport handle from a master
 * - decrement the thread count on the master
 * - if the transport is closing (xp_wq is NULL) call svc_xprt_cleanup();
 *   if this is the last thread on this transport then it will destroy
 *   the transport.
 * - call a transport specific function to destroy the clone handle
 * - clear xp_master to avoid recursion.
 */
static void
svc_clone_unlinkdetached(SVCXPRT *clone_xprt)
{
	SVCMASTERXPRT *xprt = clone_xprt->xp_master;

	/* This must be a detached thread */
	ASSERT(clone_xprt->xp_detached);
	ASSERT(xprt->xp_detached_threads > 0);
	ASSERT(xprt->xp_threads + xprt->xp_detached_threads > 0);

	/* Grab xprt->xp_thread_lock and decrement link counts */
	mutex_enter(&xprt->xp_thread_lock);
	xprt->xp_detached_threads--;

	/* svc_xprt_cleanup() unlocks xp_thread_lock or destroys xprt */
	if (xprt->xp_wq)
		mutex_exit(&xprt->xp_thread_lock);
	else
		svc_xprt_cleanup(xprt, TRUE);

	/* Call transport specific clone `destroy' function */
	SVC_CLONE_DESTROY(clone_xprt);

	/* Clear xp_master */
	clone_xprt->xp_master = NULL;
}

/*
 * Try to exit a non-detached service thread
 * - check if there are enough threads left
 * - if this thread (ie its clone transport handle) are linked
 *   to a master transport then unlink it
 * - free the clone structure
 * - return to userland for thread exit
 *
 * If this is the last non-detached or the last thread on this
 * transport then the call to svc_clone_unlink() will, respectively,
 * close and/or destroy the transport.
 */
static void
svc_thread_exit(SVCPOOL *pool, SVCXPRT *clone_xprt)
{
	if (clone_xprt->xp_master)
		svc_clone_unlink(clone_xprt);
	svc_clone_free(clone_xprt);

	mutex_enter(&pool->p_thread_lock);
	pool->p_threads--;
	if (pool->p_closing && svc_pool_tryexit(pool))
		/* return -  thread exit will be handled at user level */
		return;
	mutex_exit(&pool->p_thread_lock);

	/* return -  thread exit will be handled at user level */
}

/*
 * Exit a detached service thread that returned to svc_run
 * - decrement the `detached thread' count for the pool
 * - unlink the detached clone transport handle from the master
 * - free the clone structure
 * - return to userland for thread exit
 *
 * If this is the last thread on this transport then the call
 * to svc_clone_unlinkdetached() will destroy the transport.
 */
static void
svc_thread_exitdetached(SVCPOOL *pool, SVCXPRT *clone_xprt)
{
	/* This must be a detached thread */
	ASSERT(clone_xprt->xp_master);
	ASSERT(clone_xprt->xp_detached);
	ASSERT(!MUTEX_HELD(&pool->p_thread_lock));

	svc_clone_unlinkdetached(clone_xprt);
	svc_clone_free(clone_xprt);

	mutex_enter(&pool->p_thread_lock);

	ASSERT(pool->p_reserved_threads >= 0);
	ASSERT(pool->p_detached_threads > 0);

	pool->p_detached_threads--;
	if (pool->p_closing && svc_pool_tryexit(pool))
		/* return -  thread exit will be handled at user level */
		return;
	mutex_exit(&pool->p_thread_lock);

	/* return -  thread exit will be handled at user level */
}

/*
 * PSARC 2003/523 Contract Private Interface
 * svc_wait
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
int
svc_wait(int id)
{
	SVCPOOL *pool;
	int	err = 0;
	struct svc_globals *svc;

	svc = zone_getspecific(svc_zone_key, curproc->p_zone);
	mutex_enter(&svc->svc_plock);
	pool = svc_pool_find(svc, id);
	mutex_exit(&svc->svc_plock);

	if (pool == NULL)
		return (ENOENT);

	mutex_enter(&pool->p_user_lock);

	/* Check if there's already a user thread waiting on this pool */
	if (pool->p_user_waiting) {
		mutex_exit(&pool->p_user_lock);
		return (EBUSY);
	}

	pool->p_user_waiting = TRUE;

	/* Go to sleep, waiting for the signaled flag. */
	while (!pool->p_signal_create_thread && !pool->p_user_exit) {
		if (cv_wait_sig(&pool->p_user_cv, &pool->p_user_lock) == 0) {
			/* Interrupted, return to handle exit or signal */
			pool->p_user_waiting = FALSE;
			pool->p_signal_create_thread = FALSE;
			mutex_exit(&pool->p_user_lock);

			/*
			 * Thread has been interrupted and therefore
			 * the service daemon is leaving as well so
			 * let's go ahead and remove the service
			 * pool at this time.
			 */
			mutex_enter(&svc->svc_plock);
			svc_pool_unregister(svc, pool);
			mutex_exit(&svc->svc_plock);

			return (EINTR);
		}
	}

	pool->p_signal_create_thread = FALSE;
	pool->p_user_waiting = FALSE;

	/*
	 * About to exit the service pool. Set return value
	 * to let the userland code know our intent. Signal
	 * svc_thread_creator() so that it can clean up the
	 * pool structure.
	 */
	if (pool->p_user_exit) {
		err = ECANCELED;
		cv_signal(&pool->p_user_cv);
	}

	mutex_exit(&pool->p_user_lock);

	/* Return to userland with error code, for possible thread creation. */
	return (err);
}

/*
 * `Service threads' creator thread.
 * The creator thread waits for a signal to create new thread.
 */
static void
svc_thread_creator(SVCPOOL *pool)
{
	callb_cpr_t cpr_info;	/* CPR info for the creator thread */

	CALLB_CPR_INIT(&cpr_info, &pool->p_creator_lock, callb_generic_cpr,
	    "svc_thread_creator");

	for (;;) {
		mutex_enter(&pool->p_creator_lock);

		/* Check if someone set the exit flag */
		if (pool->p_creator_exit)
			break;

		/* Clear the `signaled' flag and go asleep */
		pool->p_creator_signaled = FALSE;

		CALLB_CPR_SAFE_BEGIN(&cpr_info);
		cv_wait(&pool->p_creator_cv, &pool->p_creator_lock);
		CALLB_CPR_SAFE_END(&cpr_info, &pool->p_creator_lock);

		/* Check if someone signaled to exit */
		if (pool->p_creator_exit)
			break;

		mutex_exit(&pool->p_creator_lock);

		mutex_enter(&pool->p_thread_lock);

		/*
		 * When the pool is in closing state and all the transports
		 * are gone the creator should not create any new threads.
		 */
		if (pool->p_closing) {
			rw_enter(&pool->p_lrwlock, RW_READER);
			if (pool->p_lcount == 0) {
				rw_exit(&pool->p_lrwlock);
				mutex_exit(&pool->p_thread_lock);
				continue;
			}
			rw_exit(&pool->p_lrwlock);
		}

		/*
		 * Create a new service thread now.
		 */
		ASSERT(pool->p_reserved_threads >= 0);
		ASSERT(pool->p_detached_threads >= 0);

		if (pool->p_threads + pool->p_detached_threads <
		    pool->p_maxthreads) {
			/*
			 * Signal the service pool wait thread
			 * only if it hasn't already been signaled.
			 */
			mutex_enter(&pool->p_user_lock);
			if (pool->p_signal_create_thread == FALSE) {
				pool->p_signal_create_thread = TRUE;
				cv_signal(&pool->p_user_cv);
			}
			mutex_exit(&pool->p_user_lock);

		}

		mutex_exit(&pool->p_thread_lock);
	}

	/*
	 * Pool is closed. Cleanup and exit.
	 */

	/* Signal userland creator thread that it can stop now. */
	mutex_enter(&pool->p_user_lock);
	pool->p_user_exit = TRUE;
	cv_broadcast(&pool->p_user_cv);
	mutex_exit(&pool->p_user_lock);

	/* Wait for svc_wait() to be done with the pool */
	mutex_enter(&pool->p_user_lock);
	while (pool->p_user_waiting) {
		CALLB_CPR_SAFE_BEGIN(&cpr_info);
		cv_wait(&pool->p_user_cv, &pool->p_user_lock);
		CALLB_CPR_SAFE_END(&cpr_info, &pool->p_creator_lock);
	}
	mutex_exit(&pool->p_user_lock);

	CALLB_CPR_EXIT(&cpr_info);
	svc_pool_cleanup(pool);
	zthread_exit();
}

/*
 * If the creator thread  is idle signal it to create
 * a new service thread.
 */
static void
svc_creator_signal(SVCPOOL *pool)
{
	mutex_enter(&pool->p_creator_lock);
	if (pool->p_creator_signaled == FALSE) {
		pool->p_creator_signaled = TRUE;
		cv_signal(&pool->p_creator_cv);
	}
	mutex_exit(&pool->p_creator_lock);
}

/*
 * Notify the creator thread to clean up and exit.
 */
static void
svc_creator_signalexit(SVCPOOL *pool)
{
	mutex_enter(&pool->p_creator_lock);
	pool->p_creator_exit = TRUE;
	cv_signal(&pool->p_creator_cv);
	mutex_exit(&pool->p_creator_lock);
}

/*
 * Polling part of the svc_run().
 * - search for a transport with a pending request
 * - when one is found then latch the request lock and return to svc_run()
 * - if there is no request go asleep and wait for a signal
 * - handle two exceptions:
 *   a) current transport is closing
 *   b) timeout waiting for a new request
 *   in both cases return to svc_run()
 */
static SVCMASTERXPRT *
svc_poll(SVCPOOL *pool, SVCMASTERXPRT *xprt, SVCXPRT *clone_xprt)
{
	/*
	 * Main loop iterates until
	 * a) we find a pending request,
	 * b) detect that the current transport is closing
	 * c) time out waiting for a new request.
	 */
	for (;;) {
		SVCMASTERXPRT *next;
		clock_t timeleft;

		/*
		 * Step 1.
		 * Check if there is a pending request on the current
		 * transport handle so that we can avoid cloning.
		 * If so then decrement the `pending-request' count for
		 * the pool and return to svc_run().
		 *
		 * We need to prevent a potential starvation. When
		 * a selected transport has all pending requests coming in
		 * all the time then the service threads will never switch to
		 * another transport. With a limited number of service
		 * threads some transports may be never serviced.
		 * To prevent such a scenario we pick up at most
		 * pool->p_max_same_xprt requests from the same transport
		 * and then take a hint from the xprt-ready queue or walk
		 * the transport list.
		 */
		if (xprt && xprt->xp_req_head && (!pool->p_qoverflow ||
		    clone_xprt->xp_same_xprt++ < pool->p_max_same_xprt)) {
			mutex_enter(&xprt->xp_req_lock);
			if (xprt->xp_req_head)
				return (xprt);
			mutex_exit(&xprt->xp_req_lock);
		}
		clone_xprt->xp_same_xprt = 0;

		/*
		 * Step 2.
		 * If there is no request on the current transport try to
		 * find another transport with a pending request.
		 */
		mutex_enter(&pool->p_req_lock);
		pool->p_walkers++;
		mutex_exit(&pool->p_req_lock);

		/*
		 * Make sure that transports will not be destroyed just
		 * while we are checking them.
		 */
		rw_enter(&pool->p_lrwlock, RW_READER);

		for (;;) {
			SVCMASTERXPRT *hint;

			/*
			 * Get the next transport from the xprt-ready queue.
			 * This is a hint. There is no guarantee that the
			 * transport still has a pending request since it
			 * could be picked up by another thread in step 1.
			 *
			 * If the transport has a pending request then keep
			 * it locked. Decrement the `pending-requests' for
			 * the pool and `walking-threads' counts, and return
			 * to svc_run().
			 */
			hint = svc_xprt_qget(pool);

			if (hint && hint->xp_req_head) {
				mutex_enter(&hint->xp_req_lock);
				if (hint->xp_req_head) {
					rw_exit(&pool->p_lrwlock);

					mutex_enter(&pool->p_req_lock);
					pool->p_walkers--;
					mutex_exit(&pool->p_req_lock);

					return (hint);
				}
				mutex_exit(&hint->xp_req_lock);
			}

			/*
			 * If there was no hint in the xprt-ready queue then
			 * - if there is less pending requests than polling
			 *   threads go asleep
			 * - otherwise check if there was an overflow in the
			 *   xprt-ready queue; if so, then we need to break
			 *   the `drain' mode
			 */
			if (hint == NULL) {
				if (pool->p_reqs < pool->p_walkers) {
					mutex_enter(&pool->p_req_lock);
					if (pool->p_reqs < pool->p_walkers)
						goto sleep;
					mutex_exit(&pool->p_req_lock);
				}
				if (pool->p_qoverflow) {
					break;
				}
			}
		}

		/*
		 * If there was an overflow in the xprt-ready queue then we
		 * need to switch to the `drain' mode, i.e. walk through the
		 * pool's transport list and search for a transport with a
		 * pending request. If we manage to drain all the pending
		 * requests then we can clear the overflow flag. This will
		 * switch svc_poll() back to taking hints from the xprt-ready
		 * queue (which is generally more efficient).
		 *
		 * If there are no registered transports simply go asleep.
		 */
		if (xprt == NULL && pool->p_lhead == NULL) {
			mutex_enter(&pool->p_req_lock);
			goto sleep;
		}

		/*
		 * `Walk' through the pool's list of master server
		 * transport handles. Continue to loop until there are less
		 * looping threads then pending requests.
		 */
		next = xprt ? xprt->xp_next : pool->p_lhead;

		for (;;) {
			/*
			 * Check if there is a request on this transport.
			 *
			 * Since blocking on a locked mutex is very expensive
			 * check for a request without a lock first. If we miss
			 * a request that is just being delivered but this will
			 * cost at most one full walk through the list.
			 */
			if (next->xp_req_head) {
				/*
				 * Check again, now with a lock.
				 */
				mutex_enter(&next->xp_req_lock);
				if (next->xp_req_head) {
					rw_exit(&pool->p_lrwlock);

					mutex_enter(&pool->p_req_lock);
					pool->p_walkers--;
					mutex_exit(&pool->p_req_lock);

					return (next);
				}
				mutex_exit(&next->xp_req_lock);
			}

			/*
			 * Continue to `walk' through the pool's
			 * transport list until there is less requests
			 * than walkers. Check this condition without
			 * a lock first to avoid contention on a mutex.
			 */
			if (pool->p_reqs < pool->p_walkers) {
				/* Check again, now with the lock. */
				mutex_enter(&pool->p_req_lock);
				if (pool->p_reqs < pool->p_walkers)
					break;	/* goto sleep */
				mutex_exit(&pool->p_req_lock);
			}

			next = next->xp_next;
		}

	sleep:
		/*
		 * No work to do. Stop the `walk' and go asleep.
		 * Decrement the `walking-threads' count for the pool.
		 */
		pool->p_walkers--;
		rw_exit(&pool->p_lrwlock);

		/*
		 * Count us as asleep, mark this thread as safe
		 * for suspend and wait for a request.
		 */
		pool->p_asleep++;
		timeleft = cv_reltimedwait_sig(&pool->p_req_cv,
		    &pool->p_req_lock, pool->p_timeout, TR_CLOCK_TICK);

		/*
		 * If the drowsy flag is on this means that
		 * someone has signaled a wakeup. In such a case
		 * the `asleep-threads' count has already updated
		 * so just clear the flag.
		 *
		 * If the drowsy flag is off then we need to update
		 * the `asleep-threads' count.
		 */
		if (pool->p_drowsy) {
			pool->p_drowsy = FALSE;
			/*
			 * If the thread is here because it timedout,
			 * instead of returning SVC_ETIMEDOUT, it is
			 * time to do some more work.
			 */
			if (timeleft == -1)
				timeleft = 1;
		} else {
			pool->p_asleep--;
		}
		mutex_exit(&pool->p_req_lock);

		/*
		 * If we received a signal while waiting for a
		 * request, inform svc_run(), so that we can return
		 * to user level and exit.
		 */
		if (timeleft == 0)
			return (SVC_EINTR);

		/*
		 * If the current transport is gone then notify
		 * svc_run() to unlink from it.
		 */
		if (xprt && xprt->xp_wq == NULL)
			return (SVC_EXPRTGONE);

		/*
		 * If we have timed out waiting for a request inform
		 * svc_run() that we probably don't need this thread.
		 */
		if (timeleft == -1)
			return (SVC_ETIMEDOUT);
	}
}

/*
 * calculate memory space used by message
 */
static size_t
svc_msgsize(mblk_t *mp)
{
	size_t count = 0;

	for (; mp; mp = mp->b_cont)
		count += MBLKSIZE(mp);

	return (count);
}

/*
 * svc_flowcontrol() attempts to turn the flow control on or off for the
 * transport.
 *
 * On input the xprt->xp_full determines whether the flow control is currently
 * off (FALSE) or on (TRUE).  If it is off we do tests to see whether we should
 * turn it on, and vice versa.
 *
 * There are two conditions considered for the flow control.  Both conditions
 * have the low and the high watermark.  Once the high watermark is reached in
 * EITHER condition the flow control is turned on.  For turning the flow
 * control off BOTH conditions must be below the low watermark.
 *
 * Condition #1 - Number of requests queued:
 *
 * The max number of threads working on the pool is roughly pool->p_maxthreads.
 * Every thread could handle up to pool->p_max_same_xprt requests from one
 * transport before it moves to another transport.  See svc_poll() for details.
 * In case all threads in the pool are working on a transport they will handle
 * no more than enough_reqs (pool->p_maxthreads * pool->p_max_same_xprt)
 * requests in one shot from that transport.  We are turning the flow control
 * on once the high watermark is reached for a transport so that the underlying
 * queue knows the rate of incoming requests is higher than we are able to
 * handle.
 *
 * The high watermark: 2 * enough_reqs
 * The low watermark: enough_reqs
 *
 * Condition #2 - Length of the data payload for the queued messages/requests:
 *
 * We want to prevent a particular pool exhausting the memory, so once the
 * total length of queued requests for the whole pool reaches the high
 * watermark we start to turn on the flow control for significant memory
 * consumers (individual transports).  To keep the implementation simple
 * enough, this condition is not exact, because we count only the data part of
 * the queued requests and we ignore the overhead.  For our purposes this
 * should be enough.  We should also consider that up to pool->p_maxthreads
 * threads for the pool might work on large requests (this is not counted for
 * this condition).  We need to leave some space for rest of the system and for
 * other big memory consumers (like ZFS).  Also, after the flow control is
 * turned on (on cots transports) we can start to accumulate a few megabytes in
 * queues for each transport.
 *
 * Usually, the big memory consumers are NFS WRITE requests, so we do not
 * expect to see this condition met for other than NFS pools.
 *
 * The high watermark: 1/5 of available memory
 * The low watermark: 1/6 of available memory
 *
 * Once the high watermark is reached we turn the flow control on only for
 * transports exceeding a per-transport memory limit.  The per-transport
 * fraction of memory is calculated as:
 *
 * the high watermark / number of transports
 *
 * For transports with less than the per-transport fraction of memory consumed,
 * the flow control is not turned on, so they are not blocked by a few "hungry"
 * transports.  Because of this, the total memory consumption for the
 * particular pool might grow up to 2 * the high watermark.
 *
 * The individual transports are unblocked once their consumption is below:
 *
 * per-transport fraction of memory / 2
 *
 * or once the total memory consumption for the whole pool falls below the low
 * watermark.
 *
 */
static void
svc_flowcontrol(SVCMASTERXPRT *xprt)
{
	SVCPOOL *pool = xprt->xp_pool;
	size_t totalmem = ptob(physmem);
	int enough_reqs = pool->p_maxthreads * pool->p_max_same_xprt;

	ASSERT(MUTEX_HELD(&xprt->xp_req_lock));

	/* Should we turn the flow control on? */
	if (xprt->xp_full == FALSE) {
		/* Is flow control disabled? */
		if (svc_flowcontrol_disable != 0)
			return;

		/* Is there enough requests queued? */
		if (xprt->xp_reqs >= enough_reqs * 2) {
			xprt->xp_full = TRUE;
			return;
		}

		/*
		 * If this pool uses over 20% of memory and this transport is
		 * significant memory consumer then we are full
		 */
		if (pool->p_size >= totalmem / 5 &&
		    xprt->xp_size >= totalmem / 5 / pool->p_lcount)
			xprt->xp_full = TRUE;

		return;
	}

	/* We might want to turn the flow control off */

	/* Do we still have enough requests? */
	if (xprt->xp_reqs > enough_reqs)
		return;

	/*
	 * If this pool still uses over 16% of memory and this transport is
	 * still significant memory consumer then we are still full
	 */
	if (pool->p_size >= totalmem / 6 &&
	    xprt->xp_size >= totalmem / 5 / pool->p_lcount / 2)
		return;

	/* Turn the flow control off and make sure rpcmod is notified */
	xprt->xp_full = FALSE;
	xprt->xp_enable = TRUE;
}

/*
 * Main loop of the kernel RPC server
 * - wait for input (find a transport with a pending request).
 * - dequeue the request
 * - call a registered server routine to process the requests
 *
 * There can many threads running concurrently in this loop
 * on the same or on different transports.
 */
static int
svc_run(SVCPOOL *pool)
{
	SVCMASTERXPRT *xprt = NULL;	/* master transport handle  */
	SVCXPRT *clone_xprt;	/* clone for this thread    */
	proc_t *p = ttoproc(curthread);

	/* Allocate a clone transport handle for this thread */
	clone_xprt = svc_clone_init();

	/*
	 * The loop iterates until the thread becomes
	 * idle too long or the transport is gone.
	 */
	for (;;) {
		SVCMASTERXPRT *next;
		mblk_t *mp;
		bool_t enable;
		size_t size;

		TRACE_0(TR_FAC_KRPC, TR_SVC_RUN, "svc_run");

		/*
		 * If the process is exiting/killed, return
		 * immediately without processing any more
		 * requests.
		 */
		if (p->p_flag & (SEXITING | SKILLED)) {
			svc_thread_exit(pool, clone_xprt);
			return (EINTR);
		}

		/* Find a transport with a pending request */
		next = svc_poll(pool, xprt, clone_xprt);

		/*
		 * If svc_poll() finds a transport with a request
		 * it latches xp_req_lock on it. Therefore we need
		 * to dequeue the request and release the lock as
		 * soon as possible.
		 */
		ASSERT(next != NULL &&
		    (next == SVC_EXPRTGONE ||
		    next == SVC_ETIMEDOUT ||
		    next == SVC_EINTR ||
		    MUTEX_HELD(&next->xp_req_lock)));

		/* Ooops! Current transport is closing. Unlink now */
		if (next == SVC_EXPRTGONE) {
			svc_clone_unlink(clone_xprt);
			xprt = NULL;
			continue;
		}

		/* Ooops! Timeout while waiting for a request. Exit */
		if (next == SVC_ETIMEDOUT) {
			svc_thread_exit(pool, clone_xprt);
			return (0);
		}

		/*
		 * Interrupted by a signal while waiting for a
		 * request. Return to userspace and exit.
		 */
		if (next == SVC_EINTR) {
			svc_thread_exit(pool, clone_xprt);
			return (EINTR);
		}

		/*
		 * De-queue the request and release the request lock
		 * on this transport (latched by svc_poll()).
		 */
		mp = next->xp_req_head;
		next->xp_req_head = mp->b_next;
		mp->b_next = (mblk_t *)0;
		size = svc_msgsize(mp);

		mutex_enter(&pool->p_req_lock);
		pool->p_reqs--;
		if (pool->p_reqs == 0)
			pool->p_qoverflow = FALSE;
		pool->p_size -= size;
		mutex_exit(&pool->p_req_lock);

		next->xp_reqs--;
		next->xp_size -= size;

		if (next->xp_full)
			svc_flowcontrol(next);

		TRACE_2(TR_FAC_KRPC, TR_NFSFP_QUE_REQ_DEQ,
		    "rpc_que_req_deq:pool %p mp %p", pool, mp);
		mutex_exit(&next->xp_req_lock);

		/*
		 * If this is a new request on a current transport then
		 * the clone structure is already properly initialized.
		 * Otherwise, if the request is on a different transport,
		 * unlink from the current master and link to
		 * the one we got a request on.
		 */
		if (next != xprt) {
			if (xprt)
				svc_clone_unlink(clone_xprt);
			svc_clone_link(next, clone_xprt, NULL);
			xprt = next;
		}

		/*
		 * If there are more requests and req_cv hasn't
		 * been signaled yet then wake up one more thread now.
		 *
		 * We avoid signaling req_cv until the most recently
		 * signaled thread wakes up and gets CPU to clear
		 * the `drowsy' flag.
		 */
		if (!(pool->p_drowsy || pool->p_reqs <= pool->p_walkers ||
		    pool->p_asleep == 0)) {
			mutex_enter(&pool->p_req_lock);

			if (pool->p_drowsy || pool->p_reqs <= pool->p_walkers ||
			    pool->p_asleep == 0)
				mutex_exit(&pool->p_req_lock);
			else {
				pool->p_asleep--;
				pool->p_drowsy = TRUE;

				cv_signal(&pool->p_req_cv);
				mutex_exit(&pool->p_req_lock);
			}
		}

		/*
		 * If there are no asleep/signaled threads, we are
		 * still below pool->p_maxthreads limit, and no thread is
		 * currently being created then signal the creator
		 * for one more service thread.
		 *
		 * The asleep and drowsy checks are not protected
		 * by a lock since it hurts performance and a wrong
		 * decision is not essential.
		 */
		if (pool->p_asleep == 0 && !pool->p_drowsy &&
		    pool->p_threads + pool->p_detached_threads <
		    pool->p_maxthreads)
			svc_creator_signal(pool);

		/*
		 * Process the request.
		 */
		svc_getreq(clone_xprt, mp);

		/* If thread had a reservation it should have been canceled */
		ASSERT(!clone_xprt->xp_reserved);

		/*
		 * If the clone is marked detached then exit.
		 * The rpcmod slot has already been released
		 * when we detached this thread.
		 */
		if (clone_xprt->xp_detached) {
			svc_thread_exitdetached(pool, clone_xprt);
			return (0);
		}

		/*
		 * Release our reference on the rpcmod
		 * slot attached to xp_wq->q_ptr.
		 */
		mutex_enter(&xprt->xp_req_lock);
		enable = xprt->xp_enable;
		if (enable)
			xprt->xp_enable = FALSE;
		mutex_exit(&xprt->xp_req_lock);
		SVC_RELE(clone_xprt, NULL, enable);
	}
	/* NOTREACHED */
}

/*
 * Flush any pending requests for the queue and
 * free the associated mblks.
 */
void
svc_queueclean(queue_t *q)
{
	SVCMASTERXPRT *xprt = ((void **) q->q_ptr)[0];
	mblk_t *mp;
	SVCPOOL *pool;

	/*
	 * clean up the requests
	 */
	mutex_enter(&xprt->xp_req_lock);
	pool = xprt->xp_pool;
	while ((mp = xprt->xp_req_head) != NULL) {
		/* remove the request from the list */
		xprt->xp_req_head = mp->b_next;
		mp->b_next = (mblk_t *)0;
		SVC_RELE(xprt, mp, FALSE);
	}

	mutex_enter(&pool->p_req_lock);
	pool->p_reqs -= xprt->xp_reqs;
	pool->p_size -= xprt->xp_size;
	mutex_exit(&pool->p_req_lock);

	xprt->xp_reqs = 0;
	xprt->xp_size = 0;
	xprt->xp_full = FALSE;
	xprt->xp_enable = FALSE;
	mutex_exit(&xprt->xp_req_lock);
}

/*
 * This routine is called by rpcmod to inform kernel RPC that a
 * queue is closing. It is called after all the requests have been
 * picked up (that is after all the slots on the queue have
 * been released by kernel RPC). It is also guaranteed that no more
 * request will be delivered on this transport.
 *
 * - clear xp_wq to mark the master server transport handle as closing
 * - if there are no more threads on this transport close/destroy it
 * - otherwise, leave the linked threads to close/destroy the transport
 *   later.
 */
void
svc_queueclose(queue_t *q)
{
	SVCMASTERXPRT *xprt = ((void **) q->q_ptr)[0];

	if (xprt == NULL) {
		/*
		 * If there is no master xprt associated with this stream,
		 * then there is nothing to do.  This happens regularly
		 * with connection-oriented listening streams created by
		 * nfsd.
		 */
		return;
	}

	mutex_enter(&xprt->xp_thread_lock);

	ASSERT(xprt->xp_req_head == NULL);
	ASSERT(xprt->xp_wq != NULL);

	xprt->xp_wq = NULL;

	if (xprt->xp_threads == 0) {
		SVCPOOL *pool = xprt->xp_pool;

		/*
		 * svc_xprt_cleanup() destroys the transport
		 * or releases the transport thread lock
		 */
		svc_xprt_cleanup(xprt, FALSE);

		mutex_enter(&pool->p_thread_lock);

		/*
		 * If the pool is in closing state and this was
		 * the last transport in the pool then signal the creator
		 * thread to clean up and exit.
		 */
		if (pool->p_closing && svc_pool_tryexit(pool)) {
			return;
		}
		mutex_exit(&pool->p_thread_lock);
	} else {
		/*
		 * There are still some threads linked to the transport.  They
		 * are very likely sleeping in svc_poll().  We could wake up
		 * them by broadcasting on the p_req_cv condition variable, but
		 * that might give us a performance penalty if there are too
		 * many sleeping threads.
		 *
		 * Instead, we do nothing here.  The linked threads will unlink
		 * themselves and destroy the transport once they are woken up
		 * on timeout, or by new request.  There is no reason to hurry
		 * up now with the thread wake up.
		 */

		/*
		 *  NOTICE: No references to the master transport structure
		 *	    beyond this point!
		 */
		mutex_exit(&xprt->xp_thread_lock);
	}
}

/*
 * Interrupt `request delivery' routine called from rpcmod
 * - put a request at the tail of the transport request queue
 * - insert a hint for svc_poll() into the xprt-ready queue
 * - increment the `pending-requests' count for the pool
 * - handle flow control
 * - wake up a thread sleeping in svc_poll() if necessary
 * - if all the threads are running ask the creator for a new one.
 */
bool_t
svc_queuereq(queue_t *q, mblk_t *mp, bool_t flowcontrol)
{
	SVCMASTERXPRT *xprt = ((void **) q->q_ptr)[0];
	SVCPOOL *pool = xprt->xp_pool;
	size_t size;

	TRACE_0(TR_FAC_KRPC, TR_SVC_QUEUEREQ_START, "svc_queuereq_start");

	ASSERT(!is_system_labeled() || msg_getcred(mp, NULL) != NULL ||
	    mp->b_datap->db_type != M_DATA);

	/*
	 * Step 1.
	 * Grab the transport's request lock and the
	 * pool's request lock so that when we put
	 * the request at the tail of the transport's
	 * request queue, possibly put the request on
	 * the xprt ready queue and increment the
	 * pending request count it looks atomic.
	 */
	mutex_enter(&xprt->xp_req_lock);
	if (flowcontrol && xprt->xp_full) {
		mutex_exit(&xprt->xp_req_lock);

		return (FALSE);
	}
	ASSERT(xprt->xp_full == FALSE);
	mutex_enter(&pool->p_req_lock);
	if (xprt->xp_req_head == NULL)
		xprt->xp_req_head = mp;
	else
		xprt->xp_req_tail->b_next = mp;
	xprt->xp_req_tail = mp;

	/*
	 * Step 2.
	 * Insert a hint into the xprt-ready queue, increment
	 * counters, handle flow control, and wake up
	 * a thread sleeping in svc_poll() if necessary.
	 */

	/* Insert pointer to this transport into the xprt-ready queue */
	svc_xprt_qput(pool, xprt);

	/* Increment counters */
	pool->p_reqs++;
	xprt->xp_reqs++;

	size = svc_msgsize(mp);
	xprt->xp_size += size;
	pool->p_size += size;

	/* Handle flow control */
	if (flowcontrol)
		svc_flowcontrol(xprt);

	TRACE_2(TR_FAC_KRPC, TR_NFSFP_QUE_REQ_ENQ,
	    "rpc_que_req_enq:pool %p mp %p", pool, mp);

	/*
	 * If there are more requests and req_cv hasn't
	 * been signaled yet then wake up one more thread now.
	 *
	 * We avoid signaling req_cv until the most recently
	 * signaled thread wakes up and gets CPU to clear
	 * the `drowsy' flag.
	 */
	if (pool->p_drowsy || pool->p_reqs <= pool->p_walkers ||
	    pool->p_asleep == 0) {
		mutex_exit(&pool->p_req_lock);
	} else {
		pool->p_drowsy = TRUE;
		pool->p_asleep--;

		/*
		 * Signal wakeup and drop the request lock.
		 */
		cv_signal(&pool->p_req_cv);
		mutex_exit(&pool->p_req_lock);
	}
	mutex_exit(&xprt->xp_req_lock);

	/*
	 * Step 3.
	 * If there are no asleep/signaled threads, we are
	 * still below pool->p_maxthreads limit, and no thread is
	 * currently being created then signal the creator
	 * for one more service thread.
	 *
	 * The asleep and drowsy checks are not not protected
	 * by a lock since it hurts performance and a wrong
	 * decision is not essential.
	 */
	if (pool->p_asleep == 0 && !pool->p_drowsy &&
	    pool->p_threads + pool->p_detached_threads < pool->p_maxthreads)
		svc_creator_signal(pool);

	TRACE_1(TR_FAC_KRPC, TR_SVC_QUEUEREQ_END,
	    "svc_queuereq_end:(%S)", "end");

	return (TRUE);
}

/*
 * Reserve a service thread so that it can be detached later.
 * This reservation is required to make sure that when it tries to
 * detach itself the total number of detached threads does not exceed
 * pool->p_maxthreads - pool->p_redline (i.e. that we can have
 * up to pool->p_redline non-detached threads).
 *
 * If the thread does not detach itself later, it should cancel the
 * reservation before returning to svc_run().
 *
 * - check if there is room for more reserved/detached threads
 * - if so, then increment the `reserved threads' count for the pool
 * - mark the thread as reserved (setting the flag in the clone transport
 *   handle for this thread
 * - returns 1 if the reservation succeeded, 0 if it failed.
 */
int
svc_reserve_thread(SVCXPRT *clone_xprt)
{
	SVCPOOL *pool = clone_xprt->xp_master->xp_pool;

	/* Recursive reservations are not allowed */
	ASSERT(!clone_xprt->xp_reserved);
	ASSERT(!clone_xprt->xp_detached);

	/* Check pool counts if there is room for reservation */
	mutex_enter(&pool->p_thread_lock);
	if (pool->p_reserved_threads + pool->p_detached_threads >=
	    pool->p_maxthreads - pool->p_redline) {
		mutex_exit(&pool->p_thread_lock);
		return (0);
	}
	pool->p_reserved_threads++;
	mutex_exit(&pool->p_thread_lock);

	/* Mark the thread (clone handle) as reserved */
	clone_xprt->xp_reserved = TRUE;

	return (1);
}

/*
 * Cancel a reservation for a thread.
 * - decrement the `reserved threads' count for the pool
 * - clear the flag in the clone transport handle for this thread.
 */
void
svc_unreserve_thread(SVCXPRT *clone_xprt)
{
	SVCPOOL *pool = clone_xprt->xp_master->xp_pool;

	/* Thread must have a reservation */
	ASSERT(clone_xprt->xp_reserved);
	ASSERT(!clone_xprt->xp_detached);

	/* Decrement global count */
	mutex_enter(&pool->p_thread_lock);
	pool->p_reserved_threads--;
	mutex_exit(&pool->p_thread_lock);

	/* Clear reservation flag */
	clone_xprt->xp_reserved = FALSE;
}

/*
 * Detach a thread from its transport, so that it can block for an
 * extended time.  Because the transport can be closed after the thread is
 * detached, the thread should have already sent off a reply if it was
 * going to send one.
 *
 * - decrement `non-detached threads' count and increment `detached threads'
 *   counts for the transport
 * - decrement the  `non-detached threads' and `reserved threads'
 *   counts and increment the `detached threads' count for the pool
 * - release the rpcmod slot
 * - mark the clone (thread) as detached.
 *
 * No need to return a pointer to the thread's CPR information, since
 * the thread has a userland identity.
 *
 * NOTICE: a thread must not detach itself without making a prior reservation
 *	   through svc_thread_reserve().
 */
callb_cpr_t *
svc_detach_thread(SVCXPRT *clone_xprt)
{
	SVCMASTERXPRT *xprt = clone_xprt->xp_master;
	SVCPOOL *pool = xprt->xp_pool;
	bool_t enable;

	/* Thread must have a reservation */
	ASSERT(clone_xprt->xp_reserved);
	ASSERT(!clone_xprt->xp_detached);

	/* Bookkeeping for this transport */
	mutex_enter(&xprt->xp_thread_lock);
	xprt->xp_threads--;
	xprt->xp_detached_threads++;
	mutex_exit(&xprt->xp_thread_lock);

	/* Bookkeeping for the pool */
	mutex_enter(&pool->p_thread_lock);
	pool->p_threads--;
	pool->p_reserved_threads--;
	pool->p_detached_threads++;
	mutex_exit(&pool->p_thread_lock);

	/* Release an rpcmod slot for this request */
	mutex_enter(&xprt->xp_req_lock);
	enable = xprt->xp_enable;
	if (enable)
		xprt->xp_enable = FALSE;
	mutex_exit(&xprt->xp_req_lock);
	SVC_RELE(clone_xprt, NULL, enable);

	/* Mark the clone (thread) as detached */
	clone_xprt->xp_reserved = FALSE;
	clone_xprt->xp_detached = TRUE;

	return (NULL);
}

/*
 * This routine is responsible for extracting RDMA plugin master XPRT,
 * unregister from the SVCPOOL and initiate plugin specific cleanup.
 * It is passed a list/group of rdma transports as records which are
 * active in a given registered or unregistered kRPC thread pool. Its shuts
 * all active rdma transports in that pool. If the thread active on the trasport
 * happens to be last thread for that pool, it will signal the creater thread
 * to cleanup the pool and destroy the xprt in svc_queueclose()
 */
void
rdma_stop(rdma_xprt_group_t *rdma_xprts)
{
	SVCMASTERXPRT *xprt;
	rdma_xprt_record_t *curr_rec;
	queue_t *q;
	mblk_t *mp;
	int i, rtg_count;
	SVCPOOL *pool;

	if (rdma_xprts->rtg_count == 0)
		return;

	rtg_count = rdma_xprts->rtg_count;

	for (i = 0; i < rtg_count; i++) {
		curr_rec = rdma_xprts->rtg_listhead;
		rdma_xprts->rtg_listhead = curr_rec->rtr_next;
		rdma_xprts->rtg_count--;
		curr_rec->rtr_next = NULL;
		xprt = curr_rec->rtr_xprt_ptr;
		q = xprt->xp_wq;
		svc_rdma_kstop(xprt);

		mutex_enter(&xprt->xp_req_lock);
		pool = xprt->xp_pool;
		while ((mp = xprt->xp_req_head) != NULL) {
			rdma_recv_data_t *rdp = (rdma_recv_data_t *)mp->b_rptr;

			/* remove the request from the list */
			xprt->xp_req_head = mp->b_next;
			mp->b_next = (mblk_t *)0;

			RDMA_BUF_FREE(rdp->conn, &rdp->rpcmsg);
			RDMA_REL_CONN(rdp->conn);
			freemsg(mp);
		}
		mutex_enter(&pool->p_req_lock);
		pool->p_reqs -= xprt->xp_reqs;
		pool->p_size -= xprt->xp_size;
		mutex_exit(&pool->p_req_lock);
		xprt->xp_reqs = 0;
		xprt->xp_size = 0;
		xprt->xp_full = FALSE;
		xprt->xp_enable = FALSE;
		mutex_exit(&xprt->xp_req_lock);
		svc_queueclose(q);
#ifdef	DEBUG
		if (rdma_check)
			cmn_err(CE_NOTE, "rdma_stop: Exited svc_queueclose\n");
#endif
		/*
		 * Free the rdma transport record for the expunged rdma
		 * based master transport handle.
		 */
		kmem_free(curr_rec, sizeof (rdma_xprt_record_t));
		if (!rdma_xprts->rtg_listhead)
			break;
	}
}


/*
 * rpc_msg_dup/rpc_msg_free
 * Currently only used by svc_rpcsec_gss.c but put in this file as it
 * may be useful to others in the future.
 * But future consumers should be careful cuz so far
 *   - only tested/used for call msgs (not reply)
 *   - only tested/used with call verf oa_length==0
 */
struct rpc_msg *
rpc_msg_dup(struct rpc_msg *src)
{
	struct rpc_msg *dst;
	struct opaque_auth oa_src, oa_dst;

	dst = kmem_alloc(sizeof (*dst), KM_SLEEP);

	dst->rm_xid = src->rm_xid;
	dst->rm_direction = src->rm_direction;

	dst->rm_call.cb_rpcvers = src->rm_call.cb_rpcvers;
	dst->rm_call.cb_prog = src->rm_call.cb_prog;
	dst->rm_call.cb_vers = src->rm_call.cb_vers;
	dst->rm_call.cb_proc = src->rm_call.cb_proc;

	/* dup opaque auth call body cred */
	oa_src = src->rm_call.cb_cred;

	oa_dst.oa_flavor = oa_src.oa_flavor;
	oa_dst.oa_base = kmem_alloc(oa_src.oa_length, KM_SLEEP);

	bcopy(oa_src.oa_base, oa_dst.oa_base, oa_src.oa_length);
	oa_dst.oa_length = oa_src.oa_length;

	dst->rm_call.cb_cred = oa_dst;

	/* dup or just alloc opaque auth call body verifier */
	if (src->rm_call.cb_verf.oa_length > 0) {
		oa_src = src->rm_call.cb_verf;

		oa_dst.oa_flavor = oa_src.oa_flavor;
		oa_dst.oa_base = kmem_alloc(oa_src.oa_length, KM_SLEEP);

		bcopy(oa_src.oa_base, oa_dst.oa_base, oa_src.oa_length);
		oa_dst.oa_length = oa_src.oa_length;

		dst->rm_call.cb_verf = oa_dst;
	} else {
		oa_dst.oa_flavor = -1;  /* will be set later */
		oa_dst.oa_base = kmem_alloc(MAX_AUTH_BYTES, KM_SLEEP);

		oa_dst.oa_length = 0;   /* will be set later */

		dst->rm_call.cb_verf = oa_dst;
	}
	return (dst);
}

void
rpc_msg_free(struct rpc_msg **msg, int cb_verf_oa_length)
{
	struct rpc_msg *m = *msg;

	kmem_free(m->rm_call.cb_cred.oa_base, m->rm_call.cb_cred.oa_length);
	m->rm_call.cb_cred.oa_base = NULL;
	m->rm_call.cb_cred.oa_length = 0;

	kmem_free(m->rm_call.cb_verf.oa_base, cb_verf_oa_length);
	m->rm_call.cb_verf.oa_base = NULL;
	m->rm_call.cb_verf.oa_length = 0;

	kmem_free(m, sizeof (*m));
	m = NULL;
}

/*
 * Generally 'cr_ref' should be 1, otherwise reference is kept
 * in underlying calls, so reset it.
 */
cred_t *
svc_xprt_cred(SVCXPRT *xprt)
{
	cred_t *cr = xprt->xp_cred;

	ASSERT(cr != NULL);

	if (crgetref(cr) != 1) {
		crfree(cr);
		cr = crget();
		xprt->xp_cred = cr;
	}
	return (cr);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright 2012 Marcel Telka <marcel@telka.sk>
 * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
 * Copyright 2018 OmniOS Community Edition (OmniOSce) Association.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

/*
 * svc.h, Server-side remote procedure call interface.
 */

#ifndef	_RPC_SVC_H
#define	_RPC_SVC_H

#include <rpc/rpc_com.h>
#include <rpc/rpc_msg.h>
#include <sys/tihdr.h>
#include <sys/poll.h>
#include <sys/tsol/label.h>

#ifdef	_KERNEL
#include <rpc/svc_auth.h>
#include <rpc/rpc_tags.h>
#include <sys/callb.h>
#endif	/* _KERNEL */

/*
 * This interface must manage two items concerning remote procedure calling:
 *
 * 1) An arbitrary number of transport connections upon which rpc requests
 * are received. They are created and registered by routines in svc_generic.c,
 * svc_vc.c and svc_dg.c; they in turn call xprt_register and
 * xprt_unregister.
 *
 * 2) An arbitrary number of locally registered services.  Services are
 * described by the following four data: program number, version number,
 * "service dispatch" function, a transport handle, and a boolean that
 * indicates whether or not the exported program should be registered with a
 * local binder service;  if true the program's number and version and the
 * address from the transport handle are registered with the binder.
 * These data are registered with rpcbind via svc_reg().
 *
 * A service's dispatch function is called whenever an rpc request comes in
 * on a transport.  The request's program and version numbers must match
 * those of the registered service.  The dispatch function is passed two
 * parameters, struct svc_req * and SVCXPRT *, defined below.
 */

#ifdef __cplusplus
extern "C" {
#endif

/*
 * Server-side transport handles.
 * The actual type definitions are below.
 */
#ifdef	_KERNEL
typedef struct __svcmasterxprt	SVCMASTERXPRT;	/* Master transport handle */
typedef struct __svcxprt	SVCXPRT;	/* Per-thread clone handle */
typedef	struct __svcpool	SVCPOOL;	/* Kernel thread pool	   */
#else	/* _KERNEL */
typedef struct __svcxprt	SVCXPRT;	/* Server transport handle */
#endif	/* _KERNEL */

/*
 *  Prototype of error handler callback
 */
#ifndef _KERNEL
typedef void (*svc_errorhandler_t)(const SVCXPRT* svc, const bool_t isAConn);
#endif

/*
 * Service request.
 *
 * PSARC 2003/523 Contract Private Interface
 * svc_req
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
struct svc_req {
	rpcprog_t	rq_prog;	/* service program number */
	rpcvers_t	rq_vers;	/* service protocol version */
	rpcproc_t	rq_proc;	/* the desired procedure */
	struct opaque_auth rq_cred;	/* raw creds from the wire */
	caddr_t		rq_clntcred;	/* read only cooked cred */
	SVCXPRT		*rq_xprt;	/* associated transport */
	bslabel_t	*rq_label;	/* TSOL label of the request */
};

#ifdef _KERNEL
struct dupreq {
	uint32_t	dr_xid;
	rpcproc_t	dr_proc;
	rpcvers_t	dr_vers;
	rpcprog_t	dr_prog;
	struct netbuf	dr_addr;
	struct netbuf	dr_resp;
	void		(*dr_resfree)();
	int		dr_status;
	struct dupreq	*dr_next;
	struct dupreq	*dr_chain;
};

/*
 * States of requests for duplicate request caching.
 */
#define	DUP_NEW			0x00	/* new entry */
#define	DUP_INPROGRESS		0x01	/* request already going */
#define	DUP_DONE		0x02	/* request done */
#define	DUP_DROP		0x03	/* request dropped */
#define	DUP_ERROR		0x04	/* error in dup req cache */

/*
 * Prototype for a service dispatch routine.
 */
typedef void (SVC_DISPATCH)(struct svc_req *, SVCXPRT *);

/*
 * The service provider callout.
 * Each entry identifies a dispatch routine to be called
 * for a given RPC program number and a version fitting
 * into the registered range.
 */
typedef struct {
	rpcprog_t	sc_prog;	/* RPC Program number */
	rpcvers_t	sc_versmin;	/* Min version number */
	rpcvers_t	sc_versmax;	/* Max version number */
	SVC_DISPATCH	*sc_dispatch;	/* Dispatch routine   */
} SVC_CALLOUT;

/*
 * Table of service provider `callouts' for an RPC
 * transport handle. If sct_free is TRUE then transport
 * destructor is supposed to deallocate this table.
 */
typedef struct {
	size_t		sct_size;	/* Number of entries  */
	bool_t		sct_free;	/* Deallocate if true */
	SVC_CALLOUT	*sct_sc;	/* Callout entries    */
} SVC_CALLOUT_TABLE;

struct svc_ops {
	bool_t	(*xp_recv)(SVCXPRT *, mblk_t *, struct rpc_msg *);
		/* receive incoming requests */
	bool_t	(*xp_getargs)(SVCXPRT *, xdrproc_t, caddr_t);
		/* get arguments */
	bool_t	(*xp_reply)(SVCXPRT *, struct rpc_msg *);
		/* send reply */
	bool_t	(*xp_freeargs)(SVCXPRT *, xdrproc_t, caddr_t);
		/* free mem allocated for args */
	void	(*xp_destroy)(SVCMASTERXPRT *);
		/* destroy this struct */
	int	(*xp_dup)(struct svc_req *, caddr_t, int,
				struct dupreq **, bool_t *);
		/* check for dup */
	void	(*xp_dupdone)(struct dupreq *, caddr_t, void (*)(), int, int);
		/* mark dup entry as completed */
	int32_t *(*xp_getres)(SVCXPRT *, int);
		/* get pointer to response buffer */
	void	(*xp_freeres)(SVCXPRT *);
		/* destroy pre-serialized response */
	void	(*xp_clone_destroy)(SVCXPRT *);
		/* destroy a clone xprt */
	void	(*xp_start)(SVCMASTERXPRT *);
		/* `ready-to-receive' */
	void	(*xp_clone_xprt)(SVCXPRT *, SVCXPRT *);
		/* transport specific clone function */
	void	(*xp_tattrs)(SVCXPRT *, int, void **);
		/* kernel level control */
	int	(*xp_ctl)(SVCXPRT *, int, void *);
		/* transport specific hold function */
	void	(*xp_hold)(queue_t *);
		/* transport specific release function */
	void	(*xp_release)(queue_t *, mblk_t *, bool_t);
};

/*
 * Kernel SVC Control Requests.
 */
#define	SVCCTL_SET_ASD		1
#define	SVCCTL_GET_ASD		2
#define	SVCCTL_SET_CBCONN	3
#define	SVCCTL_SET_TAG		4
#define	SVCCTL_SET_TAG_CLEAR	5
#define	SVCCTL_CMP_TAG		6

#define	SVC_TATTR_ADDRMASK	1

#else	/* _KERNEL */
/*
 *	Service control requests
 */
#define	SVCGET_VERSQUIET	1
#define	SVCSET_VERSQUIET	2
#define	SVCGET_XID		4
#define	SVCSET_KEEPALIVE	5
#define	SVCSET_CONNMAXREC	6
#define	SVCGET_CONNMAXREC	7
#define	SVCGET_RECVERRHANDLER	8
#define	SVCSET_RECVERRHANDLER	9

enum xprt_stat {
	XPRT_DIED,
	XPRT_MOREREQS,
	XPRT_IDLE
};

struct xp_ops {
#ifdef	__STDC__
	bool_t	(*xp_recv)(SVCXPRT *, struct rpc_msg *);
		/* receive incoming requests */
	enum xprt_stat (*xp_stat)(SVCXPRT *);
		/* get transport status */
	bool_t	(*xp_getargs)(SVCXPRT *, xdrproc_t, caddr_t);
		/* get arguments */
	bool_t	(*xp_reply)(SVCXPRT *,	struct rpc_msg *);
		/* send reply */
	bool_t	(*xp_freeargs)(SVCXPRT *, xdrproc_t, caddr_t);
		/* free mem allocated for args */
	void	(*xp_destroy)(SVCXPRT *);
		/* destroy this struct */
	bool_t	(*xp_control)(SVCXPRT *, const uint_t,	void *);
		/* catch-all control function */
#else	/* __STDC__ */
	bool_t	(*xp_recv)(); /* receive incoming requests */
	enum xprt_stat (*xp_stat)(); /* get transport status */
	bool_t	(*xp_getargs)(); /* get arguments */
	bool_t	(*xp_reply)(); /* send reply */
	bool_t	(*xp_freeargs)(); /* free mem allocated for args */
	void	(*xp_destroy)(); /* destroy this struct */
	bool_t	(*xp_control)(); /* catch-all control function */
#endif	/* __STDC__ */
};
#endif	/* _KERNEL */

#ifdef	_KERNEL
/*
 * SVCPOOL
 * Kernel RPC server-side thread pool structure.
 */
typedef struct __svcxprt_qnode __SVCXPRT_QNODE;	/* Defined in svc.c */

struct __svcpool {
	/*
	 * Thread pool variables.
	 *
	 * The pool's thread lock p_thread_lock protects:
	 * - p_threads, p_detached_threads, p_reserved_threads and p_closing
	 * The pool's request lock protects:
	 * - p_asleep, p_drowsy, p_reqs, p_size, p_walkers, p_req_cv.
	 * The following fields are `initialized constants':
	 * - p_id, p_stksize, p_timeout.
	 * Access to p_next and p_prev is protected by the pool
	 * list lock.
	 */
	SVCPOOL		*p_next;		/* Next pool in the list  */
	SVCPOOL		*p_prev;		/* Prev pool in the list  */
	int		p_id;			/* Pool id		  */
	int		p_threads;		/* Non-detached threads	  */
	int		p_detached_threads;	/* Detached threads	  */
	int		p_maxthreads;		/* Max threads in the pool */
	int		p_redline;		/* `Redline' for the pool */
	int		p_reserved_threads;	/* Reserved threads	  */
	kmutex_t	p_thread_lock;		/* Thread lock		  */
	int		p_asleep;		/* Asleep threads	  */
	int		p_drowsy;		/* Drowsy flag		  */
	kcondvar_t	p_req_cv;		/* svc_poll() sleep var.  */
	clock_t		p_timeout;		/* svc_poll() timeout	  */
	kmutex_t	p_req_lock;		/* Request lock		  */
	int		p_reqs;			/* Pending requests	  */
	int		p_walkers;		/* Walking threads	  */
	int		p_max_same_xprt;	/* Max reqs from the xprt */
	int		p_stksize;		/* Stack size for svc_run */
	bool_t		p_closing : 1;		/* Pool is closing	  */

	/*
	 * Thread creator variables.
	 * The `creator signaled' flag is turned on when a signal is send
	 * to the creator thread (to create a new service thread). The
	 * creator clears when the thread is created. The protocol is not
	 * to signal the creator thread when the flag is on. However,
	 * a new thread should signal the creator if there are more
	 * requests in the queue.
	 *
	 * When the pool is closing (ie it has been already unregistered from
	 * the pool list) the last thread on the last transport should turn
	 * the p_creator_exit flag on. This tells the creator thread to
	 * free the pool structure and exit.
	 */
	bool_t		p_creator_signaled : 1;	/* Create requested flag  */
	bool_t		p_creator_exit : 1;	/* If true creator exits  */
	kcondvar_t	p_creator_cv;		/* Creator cond. variable */
	kmutex_t	p_creator_lock;		/* Creator lock		  */

	/*
	 * Doubly linked list containing `registered' master transport handles.
	 * There is no special structure for a list node. Instead the
	 * SVCMASTERXPRT structure has the xp_next and xp_prev fields.
	 *
	 * The p_lrwlock protects access to xprt->xp_next and xprt->xp_prev.
	 * A service thread should also acquire a reader lock before accessing
	 * any transports it is no longer linked to (to prevent them from
	 * being destroyed).
	 *
	 * The list lock governs also the `pool is closing' flag.
	 */
	size_t		p_lcount;		/* Current count	  */
	SVCMASTERXPRT	*p_lhead;		/* List head		  */
	krwlock_t	p_lrwlock;		/* R/W lock		  */

	/*
	 * Circular linked list for the `xprt-ready' queue (FIFO).
	 * Must be initialized with svc_xprt_qinit() before it is used.
	 *
	 * The writer's end is protected by the pool's request lock
	 * (pool->p_req_lock). The reader's end is protected by q_end_lock.
	 *
	 * When the queue is full the p_qoverflow flag is raised. It stays
	 * on until all the pending request are drained.
	 */
	size_t		p_qsize;		/* Number of queue nodes  */
	int		p_qoverflow : 1;	/* Overflow flag	  */
	__SVCXPRT_QNODE *p_qbody;		/* Queue body (array)	  */
	__SVCXPRT_QNODE *p_qtop;		/* Writer's end of FIFO   */
	__SVCXPRT_QNODE *p_qend;		/* Reader's end of FIFO	  */
	kmutex_t	p_qend_lock;		/* Reader's end lock	  */

	/*
	 * Userspace thread creator variables.
	 * Thread creation is actually done in userland, via a thread
	 * that is parked in the kernel. When that thread is signaled,
	 * it returns back down to the daemon from whence it came and
	 * does the lwp create.
	 *
	 * A parallel "creator" thread runs in the kernel. That is the
	 * thread that will signal for the user thread to return to
	 * userland and do its work.
	 *
	 * Since the thread doesn't always exist (there could be a race
	 * if two threads are created in rapid succession), we set
	 * p_signal_create_thread to FALSE when we're ready to accept work.
	 *
	 * p_user_exit is set to true when the service pool is about
	 * to close. This is done so that the user creation thread
	 * can be informed and cleanup any userland state.
	 */

	bool_t		p_signal_create_thread : 1; /* Create requested flag  */
	bool_t		p_user_exit : 1;	/* If true creator exits  */
	bool_t		p_user_waiting : 1;	/* Thread waiting for work */
	kcondvar_t	p_user_cv;		/* Creator cond. variable */
	kmutex_t	p_user_lock;		/* Creator lock		  */
	void		(*p_offline)();		/* callout for unregister */
	void		(*p_shutdown)();	/* callout for shutdown */

	size_t		p_size;			/* Total size of queued msgs */
};

/*
 * Server side transport handle (SVCMASTERXPRT).
 * xprt->xp_req_lock governs the following fields in xprt:
 *		xp_req_head, xp_req_tail.
 * xprt->xp_thread_lock governs the following fields in xprt:
 *		xp_threads, xp_detached_threads.
 *
 * xp_req_tail is only valid if xp_req_head is non-NULL
 *
 * The xp_threads count is the number of attached threads.  These threads
 * are able to handle new requests, and it is expected that they will not
 * block for a very long time handling a given request. The
 * xp_detached_threads count is the number of threads that have detached
 * themselves from the transport. These threads can block indefinitely
 * while handling a request.  Once they complete the request, they exit.
 *
 * A kernel service provider may register a callback function "closeproc"
 * for a transport.  When the transport is closing the last exiting attached
 * thread - xp_threads goes to zero - it calls the callback function, passing
 * it a reference to the transport.  This call is made with xp_thread_lock
 * held, so any cleanup bookkeeping it does should be done quickly.
 *
 * When the transport is closing the last exiting thread is supposed
 * to destroy/free the data structure.
 */
typedef struct __svcxprt_common {
	struct file	*xpc_fp;
	struct svc_ops	*xpc_ops;
	queue_t		*xpc_wq;	/* queue to write onto		*/
	cred_t		*xpc_cred;	/* cached cred for server to use */
	int32_t		xpc_type;	/* transport type		*/
	int		xpc_msg_size;	/* TSDU or TIDU size		*/
	struct netbuf	xpc_rtaddr;	/* remote transport address	*/
	struct netbuf	xpc_lcladdr;	/* local transport address	*/
	char		*xpc_netid;	/* network token		*/
	void		*xpc_tags;	/* network token		*/
	SVC_CALLOUT_TABLE *xpc_sct;
} __SVCXPRT_COMMON;

#define	xp_fp		xp_xpc.xpc_fp
#define	xp_ops		xp_xpc.xpc_ops
#define	xp_wq		xp_xpc.xpc_wq
#define	xp_cred		xp_xpc.xpc_cred
#define	xp_type		xp_xpc.xpc_type
#define	xp_msg_size	xp_xpc.xpc_msg_size
#define	xp_rtaddr	xp_xpc.xpc_rtaddr
#define	xp_lcladdr	xp_xpc.xpc_lcladdr
#define	xp_sct		xp_xpc.xpc_sct
#define	xp_netid	xp_xpc.xpc_netid
#define	xp_tags		xp_xpc.xpc_tags

struct __svcmasterxprt {
	SVCMASTERXPRT	*xp_next;	/* Next transport in the list	*/
	SVCMASTERXPRT	*xp_prev;	/* Prev transport in the list	*/
	__SVCXPRT_COMMON xp_xpc;	/* Fields common with the clone	*/
	SVCPOOL		*xp_pool;	/* Pointer to the pool		*/
	mblk_t		*xp_req_head;	/* Request queue head		*/
	mblk_t		*xp_req_tail;	/* Request queue tail		*/
	kmutex_t	xp_req_lock;	/* Request lock			*/
	int		xp_threads;	/* Current num. of attached threads */
	int		xp_detached_threads; /* num. of detached threads */
	kmutex_t	xp_thread_lock;	/* Thread count lock		*/
	void		(*xp_closeproc)(const SVCMASTERXPRT *);
					/* optional; see comments above	*/
	struct netbuf	xp_addrmask;	/* address mask			*/

	caddr_t		xp_p2;		/* private: for use by svc ops  */

	int		xp_full : 1;	/* xprt is full			*/
	int		xp_enable : 1;	/* xprt needs to be enabled	*/
	int		xp_reqs;	/* number of requests queued	*/
	size_t		xp_size;	/* total size of queued msgs	*/
};

typedef struct __svccb_args {
	SVCMASTERXPRT *xprt;
	rpcprog_t prog;
	rpcvers_t vers;
	int family;
	void *tag;
} SVCCB_ARGS;

/*
 * Service thread `clone' transport handle (SVCXPRT)
 *
 * PSARC 2003/523 Contract Private Interface
 * SVCXPRT
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 *
 * The xp_p2buf buffer is used as the storage for a transport type
 * specific structure. It is private for the svc ops for a given
 * transport type.
 */

#define	SVC_P2LEN   128

struct __svcxprt {
	__SVCXPRT_COMMON xp_xpc;
	SVCMASTERXPRT	*xp_master;	/* back ptr to master		*/

	/* The following fileds are on a per-thread basis */
	callb_cpr_t	*xp_cprp;	/* unused padding for Contract	*/
	bool_t		xp_reserved : 1; /* is thread reserved?		*/
	bool_t		xp_detached : 1; /* is thread detached?		*/
	int		xp_same_xprt;	/* Reqs from the same xprt	*/

	/* The following fields are used on a per-request basis */
	struct opaque_auth xp_verf;	/* raw response verifier	*/
	SVCAUTH		xp_auth;	/* auth flavor of current req	*/
	void		*xp_cookie;	/* a cookie			*/
	uint32_t	xp_xid;		/* id				*/
	XDR		xp_xdrin;	/* input xdr stream		*/
	XDR		xp_xdrout;	/* output xdr stream		*/

	/* Private for svc ops */
	char		xp_p2buf[SVC_P2LEN]; /* udp_data or cots_data_t */
						/* or clone_rdma_data_t */
	void		*xp_asd;
};
#else	/* _KERNEL */
struct __svcxprt {
	int		xp_fd;
#define	xp_sock		xp_fd
	ushort_t	xp_port;
	/*
	 * associated port number.
	 * Obsolete, but still used to
	 * specify whether rendezvouser
	 * or normal connection
	 */
	struct	xp_ops	*xp_ops;
	int		xp_addrlen;	/* length of remote addr. Obsoleted */
	char		*xp_tp;		/* transport provider device name */
	char		*xp_netid;	/* network token */
	struct netbuf	xp_ltaddr;	/* local transport address */
	struct netbuf	xp_rtaddr;	/* remote transport address */
	char		xp_raddr[16];	/* remote address. Now obsoleted */
	struct opaque_auth xp_verf;	/* raw response verifier */
	caddr_t		xp_p1;		/* private: for use by svc ops */
	caddr_t		xp_p2;		/* private: for use by svc ops */
	caddr_t		xp_p3;		/* private: for use by svc lib */
	int		xp_type;	/* transport type */
	/*
	 * callback on client death
	 * First parameter is the current structure,
	 * Second parameter :
	 *	- FALSE for the service listener
	 *	- TRUE for a real connected socket
	 */
	svc_errorhandler_t xp_closeclnt;
};
#endif	/* _KERNEL */

/*
 *  Approved way of getting address of caller,
 *  address mask, and netid of transport.
 */
#define	svc_getrpccaller(x) (&(x)->xp_rtaddr)
#define	svc_getrpchost(x) (&(x)->xp_lcladdr)
#ifdef _KERNEL
#define	svc_getcaller(x) (&(x)->xp_rtaddr.buf)
#define	svc_getaddrmask(x) (&(x)->xp_master->xp_addrmask)
#define	svc_getnetid(x) ((x)->xp_netid)
#endif	/* _KERNEL */

/*
 * Operations defined on an SVCXPRT handle
 */

#ifdef	_KERNEL

#define	SVC_GETADDRMASK(clone_xprt, attrflag, tattr) \
(*(clone_xprt)->xp_ops->xp_tattrs)((clone_xprt), (attrflag), (tattr))

#define	SVC_CLONE_XPRT(src_xprt, dst_xprt) \
	if ((src_xprt)->xp_ops->xp_clone_xprt) \
		(*(src_xprt)->xp_ops->xp_clone_xprt) \
		    (src_xprt, dst_xprt)

#define	SVC_HOLD(xprt) \
	if ((xprt)->xp_ops->xp_hold) \
		(*(xprt)->xp_ops->xp_hold)((xprt)->xp_wq)

#define	SVC_RELE(xprt, mp, enable) \
	if ((xprt)->xp_ops->xp_release) \
		(*(xprt)->xp_ops->xp_release)((xprt)->xp_wq, (mp), (enable))

#define	SVC_RECV(clone_xprt, mp, msg) \
	(*(clone_xprt)->xp_ops->xp_recv)((clone_xprt), (mp), (msg))

/*
 * PSARC 2003/523 Contract Private Interface
 * SVC_GETARGS
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
#define	SVC_GETARGS(clone_xprt, xargs, argsp) \
	(*(clone_xprt)->xp_ops->xp_getargs)((clone_xprt), (xargs), (argsp))

#define	SVC_REPLY(clone_xprt, msg) \
	(*(clone_xprt)->xp_ops->xp_reply) ((clone_xprt), (msg))

#define	SVC_FREEARGS(clone_xprt, xargs, argsp) \
	(*(clone_xprt)->xp_ops->xp_freeargs)((clone_xprt), (xargs), (argsp))

#define	SVC_GETRES(clone_xprt, size) \
	(*(clone_xprt)->xp_ops->xp_getres)((clone_xprt), (size))

#define	SVC_FREERES(clone_xprt)	\
	(*(clone_xprt)->xp_ops->xp_freeres)(clone_xprt)

#define	SVC_DESTROY(xprt) \
	(*(xprt)->xp_ops->xp_destroy)(xprt)

/*
 * PSARC 2003/523 Contract Private Interfaces
 * SVC_DUP, SVC_DUPDONE, SVC_DUP_EXT, SVC_DUPDONE_EXT
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 *
 * SVC_DUP and SVC_DUPDONE are defined here for backward compatibility.
 */
#define	SVC_DUP_EXT(clone_xprt, req, res, size, drpp, dupcachedp) \
	(*(clone_xprt)->xp_ops->xp_dup)(req, res, size, drpp, dupcachedp)

#define	SVC_DUPDONE_EXT(clone_xprt, dr, res, resfree, size, status) \
	(*(clone_xprt)->xp_ops->xp_dupdone)(dr, res, resfree, size, status)

#define	SVC_DUP(clone_xprt, req, res, size, drpp) \
	(*(clone_xprt)->xp_ops->xp_dup)(req, res, size, drpp, NULL)

#define	SVC_DUPDONE(clone_xprt, dr, res, size, status) \
	(*(clone_xprt)->xp_ops->xp_dupdone)(dr, res, NULL, size, status)

#define	SVC_CLONE_DESTROY(clone_xprt) \
	(*(clone_xprt)->xp_ops->xp_clone_destroy)(clone_xprt)


#define	SVC_START(xprt) \
	(*(xprt)->xp_ops->xp_start)(xprt)

#define	SVC_CTL(clone_xprt, rq, arg) \
	(*(clone_xprt)->xp_ops->xp_ctl)((clone_xprt), (rq), (arg))

#else	/* _KERNEL */

#define	SVC_RECV(xprt, msg) \
	(*(xprt)->xp_ops->xp_recv)((xprt), (msg))
#define	svc_recv(xprt, msg) \
	(*(xprt)->xp_ops->xp_recv)((xprt), (msg))

#define	SVC_STAT(xprt) \
	(*(xprt)->xp_ops->xp_stat)(xprt)
#define	svc_stat(xprt) \
	(*(xprt)->xp_ops->xp_stat)(xprt)

#define	SVC_GETARGS(xprt, xargs, argsp) \
	(*(xprt)->xp_ops->xp_getargs)((xprt), (xargs), (argsp))
#define	svc_getargs(xprt, xargs, argsp)	\
	(*(xprt)->xp_ops->xp_getargs)((xprt), (xargs), (argsp))

#define	SVC_REPLY(xprt, msg) \
	(*(xprt)->xp_ops->xp_reply) ((xprt), (msg))
#define	svc_reply(xprt, msg) \
	(*(xprt)->xp_ops->xp_reply) ((xprt), (msg))

#define	SVC_FREEARGS(xprt, xargs, argsp) \
	(*(xprt)->xp_ops->xp_freeargs)((xprt), (xargs), (argsp))
#define	svc_freeargs(xprt, xargs, argsp) \
	(*(xprt)->xp_ops->xp_freeargs)((xprt), (xargs), (argsp))

#define	SVC_GETRES(xprt, size) \
	(*(xprt)->xp_ops->xp_getres)((xprt), (size))
#define	svc_getres(xprt, size) \
	(*(xprt)->xp_ops->xp_getres)((xprt), (size))

#define	SVC_FREERES(xprt) \
	(*(xprt)->xp_ops->xp_freeres)(xprt)
#define	svc_freeres(xprt) \
	(*(xprt)->xp_ops->xp_freeres)(xprt)

#define	SVC_DESTROY(xprt) \
	(*(xprt)->xp_ops->xp_destroy)(xprt)
#define	svc_destroy(xprt) \
	(*(xprt)->xp_ops->xp_destroy)(xprt)

/*
 * PSARC 2003/523 Contract Private Interface
 * SVC_CONTROL
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
#define	SVC_CONTROL(xprt, rq, in) \
	(*(xprt)->xp_ops->xp_control)((xprt), (rq), (in))
#endif	/* _KERNEL */

/*
 * Pool id's reserved for NFS, NLM, and the NFSv4 callback program.
 */
#define	NFS_SVCPOOL_ID		0x01
#define	NLM_SVCPOOL_ID		0x02
#define	NFS_CB_SVCPOOL_ID	0x03
#define	RDC_SVCPOOL_ID		0x05	/* SNDR, PSARC 2001/699 */

struct svcpool_args {
	uint32_t	id;		/* Pool id */
	uint32_t	maxthreads;	/* Max threads in the pool */
	uint32_t	redline;	/* `Redline' for the pool */
	uint32_t	qsize;		/* `xprt-ready' queue size */
	uint32_t	timeout;	/* svc_poll() timeout */
	uint32_t	stksize;	/* svc_run() stack size */
	uint32_t	max_same_xprt;	/* Max reqs from the same xprt */
};


#ifdef	_KERNEL
/*
 * Transport registration and thread pool creation.
 */
extern int	svc_xprt_register(SVCMASTERXPRT *, int);
extern void	svc_xprt_unregister(SVCMASTERXPRT *);
extern int	svc_pool_create(struct svcpool_args *);
extern int	svc_wait(int);
extern int	svc_do_run(int);
#define	SVCPSET_SHUTDOWN_PROC	1
#define	SVCPSET_UNREGISTER_PROC	2
extern int	svc_pool_control(int, int, void *);
#else	/* _KERNEL */
#ifdef	__STDC__
extern bool_t	rpc_reg(const rpcprog_t, const rpcvers_t, const rpcproc_t,
			char *(*)(char *), const xdrproc_t, const xdrproc_t,
			const char *);

/*
 * Service registration
 *
 * svc_reg(xprt, prog, vers, dispatch, nconf)
 *	const SVCXPRT *xprt;
 *	const rpcprog_t prog;
 *	const rpcvers_t vers;
 *	const void (*dispatch)();
 *	const struct netconfig *nconf;
 */
extern bool_t	svc_reg(const SVCXPRT *, const rpcprog_t, const rpcvers_t,
			void (*)(struct svc_req *, SVCXPRT *),
			const struct netconfig *);

/*
 * Service authentication registration
 *
 * svc_auth_reg(cred_flavor, handler)
 *    int cred_flavor;
 *    enum auth_stat (*handler)();
 */
extern int	svc_auth_reg(int, enum auth_stat (*)());

/*
 * Service un-registration
 *
 * svc_unreg(prog, vers)
 *	const rpcprog_t prog;
 *	const rpcvers_t vers;
 */
extern void	svc_unreg(const rpcprog_t, const rpcvers_t);

/*
 * Transport registration/unregistration.
 *
 * xprt_register(xprt)
 *	const SVCXPRT *xprt;
 *
 * xprt_unregister(xprt)
 *	const SVCXPRT *xprt;
 */
extern void	xprt_register(const SVCXPRT *);
extern void	xprt_unregister(const SVCXPRT *);
#else	/* __STDC__ */
extern bool_t	rpc_reg();
extern bool_t	svc_reg();
extern bool_t	svc_auth_reg();
extern void	svc_unreg();
extern void	xprt_register();
extern void	xprt_unregister();
#endif /* __STDC__ */
#endif	/* _KERNEL */

#ifdef _KERNEL
/*
 * Transport hold and release.
 */
extern void rpcmod_hold(queue_t *);
extern void rpcmod_release(queue_t *, mblk_t *, bool_t);
extern void mir_svc_hold(queue_t *);
extern void mir_svc_release(queue_t *, mblk_t *, bool_t);
#endif /* _KERNEL */

/*
 * When the service routine is called, it must first check to see if it
 * knows about the procedure;  if not, it should call svcerr_noproc
 * and return.  If so, it should deserialize its arguments via
 * SVC_GETARGS (defined above).  If the deserialization does not work,
 * svcerr_decode should be called followed by a return.  Successful
 * decoding of the arguments should be followed the execution of the
 * procedure's code and a call to svc_sendreply.
 *
 * Also, if the service refuses to execute the procedure due to too-
 * weak authentication parameters, svcerr_weakauth should be called.
 * Note: do not confuse access-control failure with weak authentication!
 *
 * NB: In pure implementations of rpc, the caller always waits for a reply
 * msg.  This message is sent when svc_sendreply is called.
 * Therefore pure service implementations should always call
 * svc_sendreply even if the function logically returns void;  use
 * xdr.h - xdr_void for the xdr routine.  HOWEVER, connectionful rpc allows
 * for the abuse of pure rpc via batched calling or pipelining.  In the
 * case of a batched call, svc_sendreply should NOT be called since
 * this would send a return message, which is what batching tries to avoid.
 * It is the service/protocol writer's responsibility to know which calls are
 * batched and which are not.  Warning: responding to batch calls may
 * deadlock the caller and server processes!
 */
#ifdef	__STDC__
extern bool_t	svc_sendreply(const SVCXPRT *, const xdrproc_t,	const caddr_t);
extern void	svcerr_decode(const SVCXPRT *);
extern void	svcerr_weakauth(const SVCXPRT *);
extern void	svcerr_noproc(const SVCXPRT *);
extern void	svcerr_progvers(const SVCXPRT *, const rpcvers_t,
    const rpcvers_t);
extern void	svcerr_auth(const SVCXPRT *, const enum auth_stat);
extern void	svcerr_noprog(const SVCXPRT *);
extern void	svcerr_systemerr(const SVCXPRT *);
extern void	svcerr_badcred(const SVCXPRT *);
#else	/* __STDC__ */
extern bool_t	svc_sendreply();
extern void	svcerr_decode();
extern void	svcerr_weakauth();
extern void	svcerr_noproc();
extern void	svcerr_progvers();
extern void	svcerr_auth();
extern void	svcerr_noprog();
extern void	svcerr_systemerr();
extern void	svcerr_badcred();
#endif	/* __STDC__ */

#ifdef	_KERNEL
/*
 * Kernel RPC functions.
 */
extern void	svc_init(void);
extern void	svc_cots_init(void);
extern void	svc_clts_init(void);
extern void	mt_kstat_init(void);
extern void	mt_kstat_fini(void);
extern int	svc_tli_kcreate(struct file *, uint_t, char *,
				struct netbuf *, SVCMASTERXPRT **,
				SVC_CALLOUT_TABLE *,
				void (*closeproc)(const SVCMASTERXPRT *),
				int, bool_t);
extern int	svc_clts_kcreate(struct file *, uint_t, struct T_info_ack *,
				SVCMASTERXPRT **);
extern int	svc_cots_kcreate(struct file *, uint_t, struct T_info_ack *,
				SVCMASTERXPRT **);
extern bool_t	svc_queuereq(queue_t *, mblk_t *, bool_t);
extern void	svc_queueclean(queue_t *);
extern void	svc_queueclose(queue_t *);
extern int	svc_reserve_thread(SVCXPRT *);
extern void	svc_unreserve_thread(SVCXPRT *);
extern callb_cpr_t *svc_detach_thread(SVCXPRT *);

/*
 * For RDMA based kRPC.
 * "rdma_xprt_record" is a reference to master transport handles
 * in kRPC thread pools. This is an easy way of tracking and shuting
 * down rdma based kRPC transports on demand.
 * "rdma_xprt_group" is a list of RDMA based mster transport handles
 * or records in a kRPC thread pool.
 */
typedef struct rdma_xprt_record		rdma_xprt_record_t;
struct rdma_xprt_record {
	int			rtr_type;	/* Type of rdma; IB/VI/RDDP */
	SVCMASTERXPRT		*rtr_xprt_ptr;	/* Ptr to master xprt handle */
	rdma_xprt_record_t	*rtr_next;	/* Ptr to next record */
};

typedef struct {
	int			rtg_count;	/* Number transport records */
	int			rtg_poolid;	/* Pool Id for this group */
	rdma_xprt_record_t	*rtg_listhead;	/* Head of the records list */
} rdma_xprt_group_t;

extern int	svc_rdma_kcreate(char *, SVC_CALLOUT_TABLE *, int,
			rdma_xprt_group_t *);
extern void	svc_rdma_kstop(SVCMASTERXPRT *);
extern void	svc_rdma_kdestroy(SVCMASTERXPRT *);
extern void	rdma_stop(rdma_xprt_group_t *);

/*
 * GSS cleanup method.
 */
extern void	rpc_gss_cleanup(SVCXPRT *);
#else	/* _KERNEL */
/*
 * Lowest level dispatching -OR- who owns this process anyway.
 * Somebody has to wait for incoming requests and then call the correct
 * service routine.  The routine svc_run does infinite waiting; i.e.,
 * svc_run never returns.
 * Since another (co-existant) package may wish to selectively wait for
 * incoming calls or other events outside of the rpc architecture, the
 * routine svc_getreq_poll is provided.  It must be passed pollfds, the
 * "in-place" results of a poll call (see poll, section 2).
 */

/*
 * Global keeper of rpc service descriptors in use
 * dynamic; must be inspected before each call to select or poll
 */
extern pollfd_t	*svc_pollfd;
extern int	svc_max_pollfd;
extern fd_set	svc_fdset;
#define	svc_fds svc_fdset.fds_bits[0]	/* compatibility */

/*
 * A small program implemented by the svc_rpc implementation itself.
 * Also see clnt.h for protocol numbers.
 */
#ifdef __STDC__
extern void	svc_getreq(int);
extern void	svc_getreq_common(const int);
extern void	svc_getreqset(fd_set *); /* takes fdset instead of int */
extern void	svc_getreq_poll(struct pollfd *, const int);
extern void	svc_run(void);
extern void	svc_exit(void);
#else	/* __STDC__ */
extern void	rpctest_service();
extern void	svc_getreqset();
extern void	svc_getreq();
extern void	svc_getreq_common();
extern void	svc_getreqset();	 /* takes fdset instead of int */
extern void	svc_getreq_poll();
extern void	svc_run();
extern void	svc_exit();
#endif	/* __STDC__ */

/*
 *  Functions used to manage user file descriptors
 */
typedef int svc_input_id_t;
typedef void (*svc_callback_t)(svc_input_id_t id, int fd,
				unsigned int events, void* cookie);

#ifdef __STDC__
extern svc_input_id_t svc_add_input(int fd, unsigned int events,
				svc_callback_t user_callback,
				void* cookie);
extern int svc_remove_input(svc_input_id_t id);
#else	/* __STDC__ */
extern svc_input_id_t svc_add_input();
extern int	svc_remove_input();
#endif

/*
 * These are the existing service side transport implementations.
 *
 * Transport independent svc_create routine.
 */
#ifdef __STDC__
extern int	svc_create(void (*)(struct svc_req *, SVCXPRT *),
				const rpcprog_t, const rpcvers_t,
				const char *);
	/*
	 *	void (*dispatch)();		-- dispatch routine
	 *	const rpcprog_t prognum;	-- program number
	 *	const rpcvers_t versnum;	-- version number
	 *	const char *nettype;		-- network type
	 */

/*
 * Generic server creation routine. It takes a netconfig structure
 * instead of a nettype.
 */
extern SVCXPRT	*svc_tp_create(void (*)(struct svc_req *, SVCXPRT *),
				const rpcprog_t, const rpcvers_t,
				const struct netconfig *);
	/*
	 * void (*dispatch)();			-- dispatch routine
	 * const rpcprog_t prognum;		-- program number
	 * const rpcvers_t versnum;		-- version number
	 * const struct netconfig *nconf;	-- netconfig structure
	 */

/*
 * Variant of svc_tp_create that accepts a binding address.
 * If addr == NULL, this is the same as svc_tp_create().
 */
extern SVCXPRT	*svc_tp_create_addr(void (*)(struct svc_req *, SVCXPRT *),
				const rpcprog_t, const rpcvers_t,
				const struct netconfig *,
				const struct netbuf *);
	/*
	 * void (*dispatch)();			-- dispatch routine
	 * const rpcprog_t prognum;		-- program number
	 * const rpcvers_t versnum;		-- version number
	 * const struct netconfig *nconf;	-- netconfig structure
	 * const struct netbuf *addr;		-- address to bind
	 */

/*
 * Generic TLI create routine
 */
extern  SVCXPRT	*svc_tli_create(const int, const struct netconfig *,
				const struct t_bind *, const uint_t,
				const uint_t);
	/*
	 *	const int fd;			-- connection end point
	 *	const struct netconfig *nconf;	-- netconfig structure
	 *	const struct t_bind *bindaddr;	-- local bind address
	 *	const uint_t sendsz;		-- max sendsize
	 *	const uint_t recvsz;		-- max recvsize
	 */

/*
 * Connectionless and connectionful create routines.
 */
extern SVCXPRT	*svc_vc_create(const int, const uint_t, const uint_t);
	/*
	 *	const int fd;			-- open connection end point
	 *	const uint_t sendsize;		-- max send size
	 *	const uint_t recvsize;		-- max recv size
	 */

extern SVCXPRT	*svc_dg_create(const int, const uint_t, const uint_t);
	/*
	 * const int fd;			-- open connection
	 * const uint_t sendsize;		-- max send size
	 * const uint_t recvsize;		-- max recv size
	 */

/*
 * the routine takes any *open* TLI file
 * descriptor as its first input and is used for open connections.
 */
extern  SVCXPRT	*svc_fd_create(const int, const uint_t, const uint_t);
	/*
	 *	const int fd;			-- open connection end point
	 *	const uint_t sendsize;		-- max send size
	 *	const uint_t recvsize;		-- max recv size
	 */

/*
 * Memory based rpc (for speed check and testing)
 */
extern SVCXPRT	*svc_raw_create(void);

/*
 * Creation of service over doors transport.
 */
extern SVCXPRT	*svc_door_create(void (*)(struct svc_req *, SVCXPRT *),
				const rpcprog_t, const rpcvers_t,
				const uint_t);
	/*
	 *	void (*dispatch)();		-- dispatch routine
	 *	const rpcprog_t prognum;	-- program number
	 *	const rpcvers_t versnum;	-- version number
	 *	const uint_t sendsize;		-- send buffer size
	 */

/*
 * Service control interface
 */
extern	bool_t	svc_control(SVCXPRT *, const uint_t, void *);
	/*
	 *	SVCXPRT *svc;			-- service to manipulate
	 *	const uint_t req;		-- request
	 *	void *info;			-- argument to request
	 */

/*
 * svc_dg_enable_cache() enables the cache on dg transports.
 */
extern int svc_dg_enablecache(SVCXPRT *, const uint_t);
#else	/* __STDC__ */
extern int	svc_create();
extern SVCXPRT	*svc_tp_create();
extern SVCXPRT	*svc_tli_create();
extern SVCXPRT	*svc_vc_create();
extern SVCXPRT	*svc_dg_create();
extern SVCXPRT	*svc_fd_create();
extern SVCXPRT	*svc_raw_create();
extern SVCXPRT	*svc_door_create();
extern int svc_dg_enablecache();
#endif	/* __STDC__ */

extern boolean_t is_multilevel(rpcprog_t);

#ifdef	PORTMAP
/* For backward compatibility */
#include <rpc/svc_soc.h>
#endif	/* PORTMAP */

/*
 * For user level MT hot server functions
 */

/*
 * Different MT modes
 */
#define	RPC_SVC_MT_NONE		0	/* default, single-threaded */
#define	RPC_SVC_MT_AUTO		1	/* automatic MT mode */
#define	RPC_SVC_MT_USER		2	/* user MT mode */

#ifdef	__STDC__
extern void	svc_done(SVCXPRT *);
#else
extern void	svc_done();
#endif	/* __STDC__ */

/*
 * Obtaining local credentials.
 */
typedef struct __svc_local_cred_t {
	uid_t	euid;	/* effective uid */
	gid_t	egid;	/* effective gid */
	uid_t	ruid;	/* real uid */
	gid_t	rgid;	/* real gid */
	pid_t	pid;	/* caller's pid, or -1 if not available */
} svc_local_cred_t;

#ifdef __STDC__
struct ucred_s;
extern void	svc_fd_negotiate_ucred(int);
extern int	svc_getcallerucred(const SVCXPRT *, struct ucred_s **);
extern bool_t	svc_get_local_cred(SVCXPRT *, svc_local_cred_t *);
#else
extern void	svc_fd_negotiate_ucred();
extern int	svc_getcallerucred();
extern bool_t	svc_get_local_cred();
#endif	/* __STDC__ */

/*
 * Private interfaces and structures for user level duplicate request caching.
 * The interfaces and data structures are not committed and subject to
 * change in future releases. Currently only intended for use by automountd.
 */
struct dupreq {
	uint32_t	dr_xid;
	rpcproc_t	dr_proc;
	rpcvers_t	dr_vers;
	rpcprog_t	dr_prog;
	struct netbuf	dr_addr;
	struct netbuf	dr_resp;
	int		dr_status;
	time_t		dr_time;
	uint_t		dr_hash;
	struct dupreq	*dr_next;
	struct dupreq	*dr_prev;
	struct dupreq	*dr_chain;
	struct dupreq	*dr_prevchain;
};

/*
 * The fixedtime state is defined if we want to expand the routines to
 * handle and encompass fixed size caches.
 */
#define	DUPCACHE_FIXEDTIME	0

/*
 * States of requests for duplicate request caching.
 * These are the same as defined for the kernel.
 */
#define	DUP_NEW			0x00	/* new entry */
#define	DUP_INPROGRESS		0x01	/* request already going */
#define	DUP_DONE		0x02	/* request done */
#define	DUP_DROP		0x03	/* request dropped */
#define	DUP_ERROR		0x04	/* error in dup req cache */

#ifdef __STDC__
extern bool_t	__svc_dupcache_init(void *, int, char **);
extern int	__svc_dup(struct svc_req *, caddr_t *, uint_t *, char *);
extern int	__svc_dupdone(struct svc_req *, caddr_t, uint_t, int, char *);
extern bool_t	__svc_vc_dupcache_init(SVCXPRT *, void *, int);
extern int	__svc_vc_dup(struct svc_req *, caddr_t *, uint_t *);
extern int	__svc_vc_dupdone(struct svc_req *, caddr_t, uint_t, int);
#else
extern bool_t	__svc_dupcache_init();
extern int	__svc_dup();
extern int	__svc_dupdone();
extern bool_t	__svc_vc_dupcache_init();
extern int	__svc_vc_dup();
extern int	__svc_vc_dupdone();
#endif	/* __STDC__ */
#endif	/* _KERNEL */

#ifdef	_KERNEL
/*
 * Private interfaces and structures for SVCXPRT cloning.
 * The interfaces and data structures are not committed and subject to
 * change in future releases.
 */
extern SVCXPRT *svc_clone_init(void);
extern void svc_init_clone_xprt(SVCXPRT *, queue_t *);
extern void svc_clone_free(SVCXPRT *);
extern void svc_clone_link(SVCMASTERXPRT *, SVCXPRT *, SVCXPRT *);
extern void svc_clone_unlink(SVCXPRT *);

/* Get cached preallocated cred */
extern cred_t *svc_xprt_cred(SVCXPRT *);
#endif	/* _KERNEL */

#ifdef	__cplusplus
}
#endif

#endif	/* !_RPC_SVC_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

#ifndef _RPC_SVC_AUTH_H
#define	_RPC_SVC_AUTH_H

/*
 * svc_auth.h, Service side of rpc authentication.
 */
#include <rpc/rpcsec_gss.h>
#include <rpc/rpc_msg.h>

#ifdef __cplusplus
extern "C" {
#endif

/*
 * Server side authenticator
 */
#ifdef _KERNEL
/*
 * Copy of GSS parameters, needed for MT operation
 */
typedef struct {
	bool_t			established;
	rpc_gss_service_t	service;
	uint_t			qop_rcvd;
	void			*context;
	uint_t			seq_num;
} svc_rpc_gss_parms_t;

/*
 * sec_svc_control() commands
 */
#define	RPC_SVC_SET_GSS_CALLBACK	1  /* set rpcsec_gss callback routine */
extern bool_t sec_svc_control(uint_t, void *);

/*
 * Interface to server-side authentication flavors, may change on
 * each request.
 */
typedef struct {
	struct svc_auth_ops {
		int		(*svc_ah_wrap)();
		int		(*svc_ah_unwrap)();
	} svc_ah_ops;
	caddr_t			svc_ah_private;
	svc_rpc_gss_parms_t	svc_gss_parms;
	rpc_gss_rawcred_t	raw_cred;
} SVCAUTH;

#define	SVCAUTH_GSSPARMS(auth)  ((svc_rpc_gss_parms_t *)&(auth)->svc_gss_parms)

/*
 * Auth flavors can now apply a transformation in addition to simple XDR
 * on the body of a call/response in ways that depend on the flavor being
 * used.  These interfaces provide a generic interface between the
 * internal RPC frame and the auth flavor specific code to allow the
 * auth flavor to encode (WRAP) or decode (UNWRAP) the body.
 */
#define	SVCAUTH_WRAP(auth, xdrs, xfunc, xwhere) \
	((*((auth)->svc_ah_ops.svc_ah_wrap))(auth, xdrs, xfunc, xwhere))
#define	SVCAUTH_UNWRAP(auth, xdrs, xfunc, xwhere) \
	((*((auth)->svc_ah_ops.svc_ah_unwrap))(auth, xdrs, xfunc, xwhere))

/*
 * Server side authenticator
 */
extern enum auth_stat sec_svc_msg(struct svc_req *, struct rpc_msg *,
				bool_t *);

extern int sec_svc_getcred(struct svc_req *, cred_t *,  caddr_t *, int *);

#else

extern enum auth_stat __gss_authenticate(struct svc_req *, struct rpc_msg *,
				bool_t *);
extern enum auth_stat __authenticate(struct svc_req *, struct rpc_msg *);

#endif /* _KERNEL */

#ifdef __cplusplus
}
#endif

#endif	/* _RPC_SVC_AUTH_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
 * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright (c) 2012 by Delphix. All rights reserved.
 * Copyright 2012 Marcel Telka <marcel@telka.sk>
 * Copyright 2018 OmniOS Community Edition (OmniOSce) Association.
 */

/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
/*	All Rights Reserved	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

/*
 * svc_clts.c
 * Server side for RPC in the kernel.
 *
 */

#include <sys/param.h>
#include <sys/types.h>
#include <sys/sysmacros.h>
#include <sys/file.h>
#include <sys/stream.h>
#include <sys/strsun.h>
#include <sys/strsubr.h>
#include <sys/tihdr.h>
#include <sys/tiuser.h>
#include <sys/t_kuser.h>
#include <sys/fcntl.h>
#include <sys/errno.h>
#include <sys/kmem.h>
#include <sys/systm.h>
#include <sys/cmn_err.h>
#include <sys/kstat.h>
#include <sys/vtrace.h>
#include <sys/debug.h>

#include <rpc/types.h>
#include <rpc/xdr.h>
#include <rpc/auth.h>
#include <rpc/clnt.h>
#include <rpc/rpc_msg.h>
#include <rpc/svc.h>
#include <inet/ip.h>

/*
 * Routines exported through ops vector.
 */
static bool_t		svc_clts_krecv(SVCXPRT *, mblk_t *, struct rpc_msg *);
static bool_t		svc_clts_ksend(SVCXPRT *, struct rpc_msg *);
static bool_t		svc_clts_kgetargs(SVCXPRT *, xdrproc_t, caddr_t);
static bool_t		svc_clts_kfreeargs(SVCXPRT *, xdrproc_t, caddr_t);
static void		svc_clts_kdestroy(SVCMASTERXPRT *);
static int		svc_clts_kdup(struct svc_req *, caddr_t, int,
				struct dupreq **, bool_t *);
static void		svc_clts_kdupdone(struct dupreq *, caddr_t,
				void (*)(), int, int);
static int32_t		*svc_clts_kgetres(SVCXPRT *, int);
static void		svc_clts_kclone_destroy(SVCXPRT *);
static void		svc_clts_kfreeres(SVCXPRT *);
static void		svc_clts_kstart(SVCMASTERXPRT *);
static void		svc_clts_kclone_xprt(SVCXPRT *, SVCXPRT *);
static void		svc_clts_ktattrs(SVCXPRT *, int, void **);

/*
 * Server transport operations vector.
 */
struct svc_ops svc_clts_op = {
	.xp_recv = svc_clts_krecv,
	.xp_getargs = svc_clts_kgetargs,
	.xp_reply = svc_clts_ksend,
	.xp_freeargs = svc_clts_kfreeargs,
	.xp_destroy = svc_clts_kdestroy,
	.xp_dup = svc_clts_kdup,
	.xp_dupdone = svc_clts_kdupdone,
	.xp_getres = svc_clts_kgetres,
	.xp_freeres = svc_clts_kfreeres,
	.xp_clone_destroy = svc_clts_kclone_destroy,
	.xp_start = svc_clts_kstart,
	.xp_clone_xprt = svc_clts_kclone_xprt,
	.xp_tattrs = svc_clts_ktattrs,
	.xp_ctl = NULL,
	.xp_hold = rpcmod_hold,
	.xp_release = rpcmod_release
};

/*
 * Transport private data.
 * Kept in xprt->xp_p2buf.
 */
struct udp_data {
	mblk_t	*ud_resp;			/* buffer for response */
	mblk_t	*ud_inmp;			/* mblk chain of request */
};

#define	UD_MAXSIZE	8800
#define	UD_INITSIZE	2048

/*
 * Connectionless server statistics
 */
static const struct rpc_clts_server {
	kstat_named_t	rscalls;
	kstat_named_t	rsbadcalls;
	kstat_named_t	rsnullrecv;
	kstat_named_t	rsbadlen;
	kstat_named_t	rsxdrcall;
	kstat_named_t	rsdupchecks;
	kstat_named_t	rsdupreqs;
} clts_rsstat_tmpl = {
	{ "calls",	KSTAT_DATA_UINT64 },
	{ "badcalls",	KSTAT_DATA_UINT64 },
	{ "nullrecv",	KSTAT_DATA_UINT64 },
	{ "badlen",	KSTAT_DATA_UINT64 },
	{ "xdrcall",	KSTAT_DATA_UINT64 },
	{ "dupchecks",	KSTAT_DATA_UINT64 },
	{ "dupreqs",	KSTAT_DATA_UINT64 }
};

static uint_t clts_rsstat_ndata =
	sizeof (clts_rsstat_tmpl) / sizeof (kstat_named_t);

#define	CLONE2STATS(clone_xprt)	\
	(struct rpc_clts_server *)(clone_xprt)->xp_master->xp_p2

#define	RSSTAT_INCR(stats, x)	\
	atomic_inc_64(&(stats)->x.value.ui64)

/*
 * Create a transport record.
 * The transport record, output buffer, and private data structure
 * are allocated.  The output buffer is serialized into using xdrmem.
 * There is one transport record per user process which implements a
 * set of services.
 */
/* ARGSUSED */
int
svc_clts_kcreate(file_t *fp, uint_t sendsz, struct T_info_ack *tinfo,
    SVCMASTERXPRT **nxprt)
{
	SVCMASTERXPRT *xprt;
	struct rpcstat *rpcstat;

	if (nxprt == NULL)
		return (EINVAL);

	rpcstat = zone_getspecific(rpcstat_zone_key, curproc->p_zone);
	ASSERT(rpcstat != NULL);

	xprt = kmem_zalloc(sizeof (*xprt), KM_SLEEP);
	xprt->xp_lcladdr.buf = kmem_zalloc(sizeof (sin6_t), KM_SLEEP);
	xprt->xp_p2 = (caddr_t)rpcstat->rpc_clts_server;
	xprt->xp_ops = &svc_clts_op;
	xprt->xp_msg_size = tinfo->TSDU_size;

	xprt->xp_rtaddr.buf = NULL;
	xprt->xp_rtaddr.maxlen = tinfo->ADDR_size;
	xprt->xp_rtaddr.len = 0;

	*nxprt = xprt;

	return (0);
}

/*
 * Destroy a transport record.
 * Frees the space allocated for a transport record.
 */
static void
svc_clts_kdestroy(SVCMASTERXPRT *xprt)
{
	if (xprt->xp_netid)
		kmem_free(xprt->xp_netid, strlen(xprt->xp_netid) + 1);
	if (xprt->xp_addrmask.maxlen)
		kmem_free(xprt->xp_addrmask.buf, xprt->xp_addrmask.maxlen);

	mutex_destroy(&xprt->xp_req_lock);
	mutex_destroy(&xprt->xp_thread_lock);

	kmem_free(xprt->xp_lcladdr.buf, sizeof (sin6_t));
	kmem_free(xprt, sizeof (SVCMASTERXPRT));
}

/*
 * Transport-type specific part of svc_xprt_cleanup().
 * Frees the message buffer space allocated for a clone of a transport record
 */
static void
svc_clts_kclone_destroy(SVCXPRT *clone_xprt)
{
	/* LINTED pointer alignment */
	struct udp_data *ud = (struct udp_data *)clone_xprt->xp_p2buf;

	if (ud->ud_resp) {
		/*
		 * There should not be any left over results buffer.
		 */
		ASSERT(ud->ud_resp->b_cont == NULL);

		/*
		 * Free the T_UNITDATA_{REQ/IND} that svc_clts_krecv
		 * saved.
		 */
		freeb(ud->ud_resp);
	}
	if (ud->ud_inmp)
		freemsg(ud->ud_inmp);
}

/*
 * svc_tli_kcreate() calls this function at the end to tell
 * rpcmod that the transport is ready to receive requests.
 */
/* ARGSUSED */
static void
svc_clts_kstart(SVCMASTERXPRT *xprt)
{
}

static void
svc_clts_kclone_xprt(SVCXPRT *src_xprt, SVCXPRT *dst_xprt)
{
	struct udp_data *ud_src =
	    (struct udp_data *)src_xprt->xp_p2buf;
	struct udp_data *ud_dst =
	    (struct udp_data *)dst_xprt->xp_p2buf;

	if (ud_src->ud_resp)
		ud_dst->ud_resp = dupb(ud_src->ud_resp);

}

static void
svc_clts_ktattrs(SVCXPRT *clone_xprt, int attrflag, void **tattr)
{
	*tattr = NULL;

	switch (attrflag) {
	case SVC_TATTR_ADDRMASK:
		*tattr = (void *)&clone_xprt->xp_master->xp_addrmask;
	}
}

/*
 * Receive rpc requests.
 * Pulls a request in off the socket, checks if the packet is intact,
 * and deserializes the call packet.
 */
static bool_t
svc_clts_krecv(SVCXPRT *clone_xprt, mblk_t *mp, struct rpc_msg *msg)
{
	/* LINTED pointer alignment */
	struct udp_data *ud = (struct udp_data *)clone_xprt->xp_p2buf;
	XDR *xdrs = &clone_xprt->xp_xdrin;
	struct rpc_clts_server *stats = CLONE2STATS(clone_xprt);
	union T_primitives *pptr;
	int hdrsz;
	cred_t *cr;

	TRACE_0(TR_FAC_KRPC, TR_SVC_CLTS_KRECV_START,
	    "svc_clts_krecv_start:");

	RSSTAT_INCR(stats, rscalls);

	/*
	 * The incoming request should start with an M_PROTO message.
	 */
	if (mp->b_datap->db_type != M_PROTO) {
		goto bad;
	}

	/*
	 * The incoming request should be an T_UNITDTA_IND.  There
	 * might be other messages coming up the stream, but we can
	 * ignore them.
	 */
	pptr = (union T_primitives *)mp->b_rptr;
	if (pptr->type != T_UNITDATA_IND) {
		goto bad;
	}
	/*
	 * Do some checking to make sure that the header at least looks okay.
	 */
	hdrsz = (int)(mp->b_wptr - mp->b_rptr);
	if (hdrsz < TUNITDATAINDSZ ||
	    hdrsz < (pptr->unitdata_ind.OPT_offset +
	    pptr->unitdata_ind.OPT_length) ||
	    hdrsz < (pptr->unitdata_ind.SRC_offset +
	    pptr->unitdata_ind.SRC_length)) {
		goto bad;
	}

	/*
	 * Make sure that the transport provided a usable address.
	 */
	if (pptr->unitdata_ind.SRC_length <= 0) {
		goto bad;
	}
	/*
	 * Point the remote transport address in the service_transport
	 * handle at the address in the request.
	 */
	clone_xprt->xp_rtaddr.buf = (char *)mp->b_rptr +
	    pptr->unitdata_ind.SRC_offset;
	clone_xprt->xp_rtaddr.len = pptr->unitdata_ind.SRC_length;

	/*
	 * Copy the local transport address in the service_transport
	 * handle at the address in the request. We will have only
	 * the local IP address in options.
	 */
	((sin_t *)(clone_xprt->xp_lcladdr.buf))->sin_family = AF_UNSPEC;
	if (pptr->unitdata_ind.OPT_length && pptr->unitdata_ind.OPT_offset) {
		char *dstopt = (char *)mp->b_rptr +
		    pptr->unitdata_ind.OPT_offset;
		struct T_opthdr *toh = (struct T_opthdr *)dstopt;

		if (toh->level == IPPROTO_IPV6 && toh->status == 0 &&
		    toh->name == IPV6_PKTINFO) {
			struct in6_pktinfo *pkti;

			dstopt += sizeof (struct T_opthdr);
			pkti = (struct in6_pktinfo *)dstopt;
			((sin6_t *)(clone_xprt->xp_lcladdr.buf))->sin6_addr
			    = pkti->ipi6_addr;
			((sin6_t *)(clone_xprt->xp_lcladdr.buf))->sin6_family
			    = AF_INET6;
			clone_xprt->xp_lcladdr.len = sizeof (sin6_t);
			clone_xprt->xp_lcladdr.maxlen =
			    clone_xprt->xp_lcladdr.len;
		} else if (toh->level == IPPROTO_IP && toh->status == 0 &&
		    toh->name == IP_RECVDSTADDR) {
			dstopt += sizeof (struct T_opthdr);
			((sin_t *)(clone_xprt->xp_lcladdr.buf))->sin_addr
			    = *(struct in_addr *)dstopt;
			((sin_t *)(clone_xprt->xp_lcladdr.buf))->sin_family
			    = AF_INET;
			clone_xprt->xp_lcladdr.len = sizeof (sin_t);
			clone_xprt->xp_lcladdr.maxlen =
			    clone_xprt->xp_lcladdr.len;
		}
	}

	/*
	 * Save the first mblk which contains the T_unidata_ind in
	 * ud_resp.  It will be used to generate the T_unitdata_req
	 * during the reply.
	 * We reuse any options in the T_unitdata_ind for the T_unitdata_req
	 * since we must pass any SCM_UCRED across in order for TX to
	 * work. We also make sure any cred_t is carried across.
	 */
	if (ud->ud_resp) {
		if (ud->ud_resp->b_cont != NULL) {
			cmn_err(CE_WARN, "svc_clts_krecv: ud_resp %p, "
			    "b_cont %p", (void *)ud->ud_resp,
			    (void *)ud->ud_resp->b_cont);
		}
		freeb(ud->ud_resp);
	}
	/* Move any cred_t to the first mblk in the message */
	cr = msg_getcred(mp, NULL);
	if (cr != NULL)
		mblk_setcred(mp, cr, NOPID);

	ud->ud_resp = mp;
	mp = mp->b_cont;
	ud->ud_resp->b_cont = NULL;

	xdrmblk_init(xdrs, mp, XDR_DECODE, 0);

	TRACE_0(TR_FAC_KRPC, TR_XDR_CALLMSG_START,
	    "xdr_callmsg_start:");
	if (! xdr_callmsg(xdrs, msg)) {
		XDR_DESTROY(xdrs);
		TRACE_1(TR_FAC_KRPC, TR_XDR_CALLMSG_END,
		    "xdr_callmsg_end:(%S)", "bad");
		RSSTAT_INCR(stats, rsxdrcall);
		goto bad;
	}
	TRACE_1(TR_FAC_KRPC, TR_XDR_CALLMSG_END,
	    "xdr_callmsg_end:(%S)", "good");

	clone_xprt->xp_xid = msg->rm_xid;
	ud->ud_inmp = mp;

	TRACE_1(TR_FAC_KRPC, TR_SVC_CLTS_KRECV_END,
	    "svc_clts_krecv_end:(%S)", "good");
	return (TRUE);

bad:
	freemsg(mp);
	if (ud->ud_resp) {
		/*
		 * There should not be any left over results buffer.
		 */
		ASSERT(ud->ud_resp->b_cont == NULL);
		freeb(ud->ud_resp);
		ud->ud_resp = NULL;
	}

	RSSTAT_INCR(stats, rsbadcalls);
	TRACE_1(TR_FAC_KRPC, TR_SVC_CLTS_KRECV_END,
	    "svc_clts_krecv_end:(%S)", "bad");
	return (FALSE);
}

/*
 * Send rpc reply.
 * Serialize the reply packet into the output buffer then
 * call t_ksndudata to send it.
 */
static bool_t
svc_clts_ksend(SVCXPRT *clone_xprt, struct rpc_msg *msg)
{
	/* LINTED pointer alignment */
	struct udp_data *ud = (struct udp_data *)clone_xprt->xp_p2buf;
	XDR *xdrs = &clone_xprt->xp_xdrout;
	int stat = FALSE;
	mblk_t *mp;
	int msgsz;
	struct T_unitdata_req *udreq;
	xdrproc_t xdr_results;
	caddr_t xdr_location;
	bool_t has_args;

	TRACE_0(TR_FAC_KRPC, TR_SVC_CLTS_KSEND_START,
	    "svc_clts_ksend_start:");

	ASSERT(ud->ud_resp != NULL);

	/*
	 * If there is a result procedure specified in the reply message,
	 * it will be processed in the xdr_replymsg and SVCAUTH_WRAP.
	 * We need to make sure it won't be processed twice, so we null
	 * it for xdr_replymsg here.
	 */
	has_args = FALSE;
	if (msg->rm_reply.rp_stat == MSG_ACCEPTED &&
	    msg->rm_reply.rp_acpt.ar_stat == SUCCESS) {
		if ((xdr_results = msg->acpted_rply.ar_results.proc) != NULL) {
			has_args = TRUE;
			xdr_location = msg->acpted_rply.ar_results.where;
			msg->acpted_rply.ar_results.proc = xdr_void;
			msg->acpted_rply.ar_results.where = NULL;
		}
	}

	if (ud->ud_resp->b_cont == NULL) {
		/*
		 * Allocate an initial mblk for the response data.
		 */
		while ((mp = allocb(UD_INITSIZE, BPRI_LO)) == NULL) {
			if (strwaitbuf(UD_INITSIZE, BPRI_LO)) {
				TRACE_1(TR_FAC_KRPC, TR_SVC_CLTS_KSEND_END,
				    "svc_clts_ksend_end:(%S)", "strwaitbuf");
				return (FALSE);
			}
		}

		/*
		 * Initialize the XDR encode stream.  Additional mblks
		 * will be allocated if necessary.  They will be UD_MAXSIZE
		 * sized.
		 */
		xdrmblk_init(xdrs, mp, XDR_ENCODE, UD_MAXSIZE);

		/*
		 * Leave some space for protocol headers.
		 */
		(void) XDR_SETPOS(xdrs, 512);
		mp->b_rptr += 512;

		msg->rm_xid = clone_xprt->xp_xid;

		ud->ud_resp->b_cont = mp;

		TRACE_0(TR_FAC_KRPC, TR_XDR_REPLYMSG_START,
		    "xdr_replymsg_start:");
		if (!(xdr_replymsg(xdrs, msg) &&
		    (!has_args || SVCAUTH_WRAP(&clone_xprt->xp_auth, xdrs,
		    xdr_results, xdr_location)))) {
			XDR_DESTROY(xdrs);
			TRACE_1(TR_FAC_KRPC, TR_XDR_REPLYMSG_END,
			    "xdr_replymsg_end:(%S)", "bad");
			RPCLOG0(1, "xdr_replymsg/SVCAUTH_WRAP failed\n");
			goto out;
		}
		TRACE_1(TR_FAC_KRPC, TR_XDR_REPLYMSG_END,
		    "xdr_replymsg_end:(%S)", "good");

	} else if (!(xdr_replymsg_body(xdrs, msg) &&
	    (!has_args || SVCAUTH_WRAP(&clone_xprt->xp_auth, xdrs,
	    xdr_results, xdr_location)))) {
		XDR_DESTROY(xdrs);
		RPCLOG0(1, "xdr_replymsg_body/SVCAUTH_WRAP failed\n");
		goto out;
	}

	XDR_DESTROY(xdrs);

	msgsz = (int)xmsgsize(ud->ud_resp->b_cont);

	if (msgsz <= 0 || (clone_xprt->xp_msg_size != -1 &&
	    msgsz > clone_xprt->xp_msg_size)) {
#ifdef	DEBUG
		cmn_err(CE_NOTE,
"KRPC: server response message of %d bytes; transport limits are [0, %d]",
		    msgsz, clone_xprt->xp_msg_size);
#endif
		goto out;
	}

	/*
	 * Construct the T_unitdata_req.  We take advantage of the fact that
	 * T_unitdata_ind looks just like T_unitdata_req, except for the
	 * primitive type.  Reusing it means we preserve the SCM_UCRED, and
	 * we must preserve it for TX to work.
	 *
	 * This has the side effect that we can also pass certain receive-side
	 * options like IPV6_PKTINFO back down the send side.  This implies
	 * that we can not ASSERT on a non-NULL db_credp when we have send-side
	 * options in UDP.
	 */
	ASSERT(MBLKL(ud->ud_resp) >= TUNITDATAREQSZ);
	udreq = (struct T_unitdata_req *)ud->ud_resp->b_rptr;
	ASSERT(udreq->PRIM_type == T_UNITDATA_IND);
	udreq->PRIM_type = T_UNITDATA_REQ;

	/*
	 * If the local IPv4 transport address is known use it as a source
	 * address for the outgoing UDP packet.
	 */
	if (((sin_t *)(clone_xprt->xp_lcladdr.buf))->sin_family == AF_INET) {
		struct T_opthdr *opthdr;
		in_pktinfo_t *pktinfo;
		size_t size;

		if (udreq->DEST_length == 0)
			udreq->OPT_offset = _TPI_ALIGN_TOPT(TUNITDATAREQSZ);
		else
			udreq->OPT_offset = _TPI_ALIGN_TOPT(udreq->DEST_offset +
			    udreq->DEST_length);

		udreq->OPT_length = sizeof (struct T_opthdr) +
		    sizeof (in_pktinfo_t);

		size = udreq->OPT_length + udreq->OPT_offset;

		/* make sure we have enough space for the option data */
		mp = reallocb(ud->ud_resp, size, 1);
		if (mp == NULL)
			goto out;
		ud->ud_resp = mp;
		udreq = (struct T_unitdata_req *)mp->b_rptr;

		/* set desired option header */
		opthdr = (struct T_opthdr *)(mp->b_rptr + udreq->OPT_offset);
		opthdr->len = udreq->OPT_length;
		opthdr->level = IPPROTO_IP;
		opthdr->name = IP_PKTINFO;

		/*
		 * 1. set source IP of outbound packet
		 * 2. value '0' for index means IP layer uses this as source
		 *    address
		 */
		pktinfo = (in_pktinfo_t *)(opthdr + 1);
		(void) memset(pktinfo, 0, sizeof (in_pktinfo_t));
		pktinfo->ipi_spec_dst.s_addr =
		    ((sin_t *)(clone_xprt->xp_lcladdr.buf))->sin_addr.s_addr;
		pktinfo->ipi_ifindex = 0;

		/* adjust the end of active data */
		mp->b_wptr = mp->b_rptr + size;
	}

	put(clone_xprt->xp_wq, ud->ud_resp);
	stat = TRUE;
	ud->ud_resp = NULL;

out:
	if (stat == FALSE) {
		freemsg(ud->ud_resp);
		ud->ud_resp = NULL;
	}

	/*
	 * This is completely disgusting.  If public is set it is
	 * a pointer to a structure whose first field is the address
	 * of the function to free that structure and any related
	 * stuff.  (see rrokfree in nfs_xdr.c).
	 */
	if (xdrs->x_public) {
		/* LINTED pointer alignment */
		(**((int (**)())xdrs->x_public))(xdrs->x_public);
	}

	TRACE_1(TR_FAC_KRPC, TR_SVC_CLTS_KSEND_END,
	    "svc_clts_ksend_end:(%S)", "done");
	return (stat);
}

/*
 * Deserialize arguments.
 */
static bool_t
svc_clts_kgetargs(SVCXPRT *clone_xprt, xdrproc_t xdr_args,
    caddr_t args_ptr)
{

	/* LINTED pointer alignment */
	return (SVCAUTH_UNWRAP(&clone_xprt->xp_auth, &clone_xprt->xp_xdrin,
	    xdr_args, args_ptr));

}

static bool_t
svc_clts_kfreeargs(SVCXPRT *clone_xprt, xdrproc_t xdr_args,
    caddr_t args_ptr)
{
	/* LINTED pointer alignment */
	struct udp_data *ud = (struct udp_data *)clone_xprt->xp_p2buf;
	XDR *xdrs = &clone_xprt->xp_xdrin;
	bool_t retval;

	if (args_ptr) {
		xdrs->x_op = XDR_FREE;
		retval = (*xdr_args)(xdrs, args_ptr);
	} else
		retval = TRUE;

	XDR_DESTROY(xdrs);

	if (ud->ud_inmp) {
		freemsg(ud->ud_inmp);
		ud->ud_inmp = NULL;
	}

	return (retval);
}

static int32_t *
svc_clts_kgetres(SVCXPRT *clone_xprt, int size)
{
	/* LINTED pointer alignment */
	struct udp_data *ud = (struct udp_data *)clone_xprt->xp_p2buf;
	XDR *xdrs = &clone_xprt->xp_xdrout;
	mblk_t *mp;
	int32_t *buf;
	struct rpc_msg rply;

	/*
	 * Allocate an initial mblk for the response data.
	 */
	while ((mp = allocb(UD_INITSIZE, BPRI_LO)) == NULL) {
		if (strwaitbuf(UD_INITSIZE, BPRI_LO)) {
			return (NULL);
		}
	}

	mp->b_cont = NULL;

	/*
	 * Initialize the XDR encode stream.  Additional mblks
	 * will be allocated if necessary.  They will be UD_MAXSIZE
	 * sized.
	 */
	xdrmblk_init(xdrs, mp, XDR_ENCODE, UD_MAXSIZE);

	/*
	 * Leave some space for protocol headers.
	 */
	(void) XDR_SETPOS(xdrs, 512);
	mp->b_rptr += 512;

	/*
	 * Assume a successful RPC since most of them are.
	 */
	rply.rm_xid = clone_xprt->xp_xid;
	rply.rm_direction = REPLY;
	rply.rm_reply.rp_stat = MSG_ACCEPTED;
	rply.acpted_rply.ar_verf = clone_xprt->xp_verf;
	rply.acpted_rply.ar_stat = SUCCESS;

	if (!xdr_replymsg_hdr(xdrs, &rply)) {
		XDR_DESTROY(xdrs);
		freeb(mp);
		return (NULL);
	}

	buf = XDR_INLINE(xdrs, size);

	if (buf == NULL) {
		XDR_DESTROY(xdrs);
		freeb(mp);
	} else {
		ud->ud_resp->b_cont = mp;
	}

	return (buf);
}

static void
svc_clts_kfreeres(SVCXPRT *clone_xprt)
{
	/* LINTED pointer alignment */
	struct udp_data *ud = (struct udp_data *)clone_xprt->xp_p2buf;

	if (ud->ud_resp == NULL || ud->ud_resp->b_cont == NULL)
		return;

	XDR_DESTROY(&clone_xprt->xp_xdrout);

	/*
	 * SVC_FREERES() is called whenever the server decides not to
	 * send normal reply. Thus, we expect only one mblk to be allocated,
	 * because we have not attempted any XDR encoding.
	 * If we do any XDR encoding and we get an error, then SVC_REPLY()
	 * will freemsg(ud->ud_resp);
	 */
	ASSERT(ud->ud_resp->b_cont->b_cont == NULL);
	freeb(ud->ud_resp->b_cont);
	ud->ud_resp->b_cont = NULL;
}

/*
 * the dup cacheing routines below provide a cache of non-failure
 * transaction id's.  rpc service routines can use this to detect
 * retransmissions and re-send a non-failure response.
 */

/*
 * MAXDUPREQS is the number of cached items.  It should be adjusted
 * to the service load so that there is likely to be a response entry
 * when the first retransmission comes in.
 */
#define	MAXDUPREQS	8192

/*
 * This should be appropriately scaled to MAXDUPREQS.  To produce as less as
 * possible collisions it is suggested to set this to a prime.
 */
#define	DRHASHSZ	2053

#define	XIDHASH(xid)	((xid) % DRHASHSZ)
#define	DRHASH(dr)	XIDHASH((dr)->dr_xid)
#define	REQTOXID(req)	((req)->rq_xprt->xp_xid)

static int	ndupreqs = 0;
int	maxdupreqs = MAXDUPREQS;
static kmutex_t dupreq_lock;
static struct dupreq *drhashtbl[DRHASHSZ];
static int	drhashstat[DRHASHSZ];

static void unhash(struct dupreq *);

/*
 * drmru points to the head of a circular linked list in lru order.
 * drmru->dr_next == drlru
 */
struct dupreq *drmru;

/*
 * PSARC 2003/523 Contract Private Interface
 * svc_clts_kdup
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 *
 * svc_clts_kdup searches the request cache and returns 0 if the
 * request is not found in the cache.  If it is found, then it
 * returns the state of the request (in progress or done) and
 * the status or attributes that were part of the original reply.
 *
 * If DUP_DONE (there is a duplicate) svc_clts_kdup copies over the
 * value of the response. In that case, also return in *dupcachedp
 * whether the response free routine is cached in the dupreq - in which case
 * the caller should not be freeing it, because it will be done later
 * in the svc_clts_kdup code when the dupreq is reused.
 */
static int
svc_clts_kdup(struct svc_req *req, caddr_t res, int size, struct dupreq **drpp,
    bool_t *dupcachedp)
{
	struct rpc_clts_server *stats = CLONE2STATS(req->rq_xprt);
	struct dupreq *dr;
	uint32_t xid;
	uint32_t drhash;
	int status;

	xid = REQTOXID(req);
	mutex_enter(&dupreq_lock);
	RSSTAT_INCR(stats, rsdupchecks);
	/*
	 * Check to see whether an entry already exists in the cache.
	 */
	dr = drhashtbl[XIDHASH(xid)];
	while (dr != NULL) {
		if (dr->dr_xid == xid &&
		    dr->dr_proc == req->rq_proc &&
		    dr->dr_prog == req->rq_prog &&
		    dr->dr_vers == req->rq_vers &&
		    dr->dr_addr.len == req->rq_xprt->xp_rtaddr.len &&
		    bcmp(dr->dr_addr.buf, req->rq_xprt->xp_rtaddr.buf,
		    dr->dr_addr.len) == 0) {
			status = dr->dr_status;
			if (status == DUP_DONE) {
				bcopy(dr->dr_resp.buf, res, size);
				if (dupcachedp != NULL)
					*dupcachedp = (dr->dr_resfree != NULL);
			} else {
				dr->dr_status = DUP_INPROGRESS;
				*drpp = dr;
			}
			RSSTAT_INCR(stats, rsdupreqs);
			mutex_exit(&dupreq_lock);
			return (status);
		}
		dr = dr->dr_chain;
	}

	/*
	 * There wasn't an entry, either allocate a new one or recycle
	 * an old one.
	 */
	if (ndupreqs < maxdupreqs) {
		dr = kmem_alloc(sizeof (*dr), KM_NOSLEEP);
		if (dr == NULL) {
			mutex_exit(&dupreq_lock);
			return (DUP_ERROR);
		}
		dr->dr_resp.buf = NULL;
		dr->dr_resp.maxlen = 0;
		dr->dr_addr.buf = NULL;
		dr->dr_addr.maxlen = 0;
		if (drmru) {
			dr->dr_next = drmru->dr_next;
			drmru->dr_next = dr;
		} else {
			dr->dr_next = dr;
		}
		ndupreqs++;
	} else {
		dr = drmru->dr_next;
		while (dr->dr_status == DUP_INPROGRESS) {
			dr = dr->dr_next;
			if (dr == drmru->dr_next) {
				cmn_err(CE_WARN, "svc_clts_kdup no slots free");
				mutex_exit(&dupreq_lock);
				return (DUP_ERROR);
			}
		}
		unhash(dr);
		if (dr->dr_resfree) {
			(*dr->dr_resfree)(dr->dr_resp.buf);
		}
	}
	dr->dr_resfree = NULL;
	drmru = dr;

	dr->dr_xid = REQTOXID(req);
	dr->dr_prog = req->rq_prog;
	dr->dr_vers = req->rq_vers;
	dr->dr_proc = req->rq_proc;
	if (dr->dr_addr.maxlen < req->rq_xprt->xp_rtaddr.len) {
		if (dr->dr_addr.buf != NULL)
			kmem_free(dr->dr_addr.buf, dr->dr_addr.maxlen);
		dr->dr_addr.maxlen = req->rq_xprt->xp_rtaddr.len;
		dr->dr_addr.buf = kmem_alloc(dr->dr_addr.maxlen,
		    KM_NOSLEEP);
		if (dr->dr_addr.buf == NULL) {
			dr->dr_addr.maxlen = 0;
			dr->dr_status = DUP_DROP;
			mutex_exit(&dupreq_lock);
			return (DUP_ERROR);
		}
	}
	dr->dr_addr.len = req->rq_xprt->xp_rtaddr.len;
	bcopy(req->rq_xprt->xp_rtaddr.buf, dr->dr_addr.buf, dr->dr_addr.len);
	if (dr->dr_resp.maxlen < size) {
		if (dr->dr_resp.buf != NULL)
			kmem_free(dr->dr_resp.buf, dr->dr_resp.maxlen);
		dr->dr_resp.maxlen = (unsigned int)size;
		dr->dr_resp.buf = kmem_alloc(size, KM_NOSLEEP);
		if (dr->dr_resp.buf == NULL) {
			dr->dr_resp.maxlen = 0;
			dr->dr_status = DUP_DROP;
			mutex_exit(&dupreq_lock);
			return (DUP_ERROR);
		}
	}
	dr->dr_status = DUP_INPROGRESS;

	drhash = (uint32_t)DRHASH(dr);
	dr->dr_chain = drhashtbl[drhash];
	drhashtbl[drhash] = dr;
	drhashstat[drhash]++;
	mutex_exit(&dupreq_lock);
	*drpp = dr;
	return (DUP_NEW);
}

/*
 * PSARC 2003/523 Contract Private Interface
 * svc_clts_kdupdone
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 *
 * svc_clts_kdupdone marks the request done (DUP_DONE or DUP_DROP)
 * and stores the response.
 */
static void
svc_clts_kdupdone(struct dupreq *dr, caddr_t res, void (*dis_resfree)(),
    int size, int status)
{

	ASSERT(dr->dr_resfree == NULL);
	if (status == DUP_DONE) {
		bcopy(res, dr->dr_resp.buf, size);
		dr->dr_resfree = dis_resfree;
	}
	dr->dr_status = status;
}

/*
 * This routine expects that the mutex, dupreq_lock, is already held.
 */
static void
unhash(struct dupreq *dr)
{
	struct dupreq *drt;
	struct dupreq *drtprev = NULL;
	uint32_t drhash;

	ASSERT(MUTEX_HELD(&dupreq_lock));

	drhash = (uint32_t)DRHASH(dr);
	drt = drhashtbl[drhash];
	while (drt != NULL) {
		if (drt == dr) {
			drhashstat[drhash]--;
			if (drtprev == NULL) {
				drhashtbl[drhash] = drt->dr_chain;
			} else {
				drtprev->dr_chain = drt->dr_chain;
			}
			return;
		}
		drtprev = drt;
		drt = drt->dr_chain;
	}
}

void
svc_clts_stats_init(zoneid_t zoneid, struct rpc_clts_server **statsp)
{
	kstat_t *ksp;
	kstat_named_t *knp;

	knp = rpcstat_zone_init_common(zoneid, "unix", "rpc_clts_server",
	    (const kstat_named_t *)&clts_rsstat_tmpl,
	    sizeof (clts_rsstat_tmpl));
	/*
	 * Backwards compatibility for old kstat clients
	 */
	ksp = kstat_create_zone("unix", 0, "rpc_server", "rpc",
	    KSTAT_TYPE_NAMED, clts_rsstat_ndata,
	    KSTAT_FLAG_VIRTUAL | KSTAT_FLAG_WRITABLE, zoneid);
	if (ksp) {
		ksp->ks_data = knp;
		kstat_install(ksp);
	}
	*statsp = (struct rpc_clts_server *)knp;
}

void
svc_clts_stats_fini(zoneid_t zoneid, struct rpc_clts_server **statsp)
{
	rpcstat_zone_fini_common(zoneid, "unix", "rpc_clts_server");
	kstat_delete_byname_zone("unix", 0, "rpc_server", zoneid);
	kmem_free(*statsp, sizeof (clts_rsstat_tmpl));
}

void
svc_clts_init()
{
	/*
	 * Check to make sure that the clts private data will fit into
	 * the stack buffer allocated by svc_run.  The compiler should
	 * remove this check, but it's a safety net if the udp_data
	 * structure ever changes.
	 */
	/*CONSTANTCONDITION*/
	ASSERT(sizeof (struct udp_data) <= SVC_P2LEN);

	mutex_init(&dupreq_lock, NULL, MUTEX_DEFAULT, NULL);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
 * Copyright (c) 1993, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright (c) 2012 by Delphix. All rights reserved.
 * Copyright 2012 Marcel Telka <marcel@telka.sk>
 * Copyright 2018 OmniOS Community Edition (OmniOSce) Association.
 */

/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
/*	All Rights Reserved	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

/*
 * svc_cots.c
 * Server side for connection-oriented RPC in the kernel.
 *
 */

#include <sys/param.h>
#include <sys/types.h>
#include <sys/sysmacros.h>
#include <sys/file.h>
#include <sys/stream.h>
#include <sys/strsubr.h>
#include <sys/strsun.h>
#include <sys/stropts.h>
#include <sys/tiuser.h>
#include <sys/timod.h>
#include <sys/tihdr.h>
#include <sys/fcntl.h>
#include <sys/errno.h>
#include <sys/kmem.h>
#include <sys/systm.h>
#include <sys/debug.h>
#include <sys/cmn_err.h>
#include <sys/kstat.h>
#include <sys/vtrace.h>
#include <sys/sdt.h>

#include <rpc/types.h>
#include <rpc/xdr.h>
#include <rpc/auth.h>
#include <rpc/rpc_msg.h>
#include <rpc/rpc_tags.h>
#include <rpc/svc.h>
#include <rpc/clnt.h>
#include <inet/ip.h>

#define	COTS_MAX_ALLOCSIZE	2048
#define	MSG_OFFSET		128	/* offset of call into the mblk */
#define	RM_HDR_SIZE		4	/* record mark header size */

/*
 * Routines exported through ops vector.
 */
static bool_t		svc_cots_krecv(SVCXPRT *, mblk_t *, struct rpc_msg *);
static bool_t		svc_cots_ksend(SVCXPRT *, struct rpc_msg *);
static bool_t		svc_cots_kgetargs(SVCXPRT *, xdrproc_t, caddr_t);
static bool_t		svc_cots_kfreeargs(SVCXPRT *, xdrproc_t, caddr_t);
static void		svc_cots_kdestroy(SVCMASTERXPRT *);
static int		svc_cots_kdup(struct svc_req *, caddr_t, int,
				struct dupreq **, bool_t *);
static void		svc_cots_kdupdone(struct dupreq *, caddr_t,
				void (*)(), int, int);
static int32_t		*svc_cots_kgetres(SVCXPRT *, int);
static void		svc_cots_kfreeres(SVCXPRT *);
static void		svc_cots_kclone_destroy(SVCXPRT *);
static void		svc_cots_kstart(SVCMASTERXPRT *);
static void		svc_cots_ktattrs(SVCXPRT *, int, void **);
static int		svc_cots_kctl(SVCXPRT *, int, void *);
static int		svc_cots_tag(SVCXPRT *, int, void *);

/*
 * Server transport operations vector.
 */
struct svc_ops svc_cots_op = {
	.xp_recv = svc_cots_krecv,
	.xp_getargs = svc_cots_kgetargs,
	.xp_reply = svc_cots_ksend,
	.xp_freeargs = svc_cots_kfreeargs,
	.xp_destroy = svc_cots_kdestroy,
	.xp_dup = svc_cots_kdup,
	.xp_dupdone = svc_cots_kdupdone,
	.xp_getres = svc_cots_kgetres,
	.xp_freeres = svc_cots_kfreeres,
	.xp_clone_destroy = svc_cots_kclone_destroy,
	.xp_start = svc_cots_kstart,
	.xp_clone_xprt = NULL,
	.xp_tattrs = svc_cots_ktattrs,
	.xp_ctl = svc_cots_kctl,
	.xp_hold = mir_svc_hold,
	.xp_release = mir_svc_release
};

/*
 * Master transport private data.
 * Kept in xprt->xp_p2.
 * -----------------------------------------------------------
 *
 * cmd_xprt_started	flag for clone routine to call rpcmod's
 *			start routine
 * cmd_stats		stats for zone
 * cmd_addrs		Addresses for local and remote.
 *
 * !! WARNING !!
 *
 * The size of cots_master_data is larger than
 * "sizeof (struct cots_master_data)" since the local and remote
 * addresses are stored after the cmd_addrs structure, so keep
 * that as the last element or the T_ADDR_REQ will stomp on
 * your data.
 *
 * -----------------------------------------------------------
 */
struct cots_master_data {
	int	cmd_xprt_started;
	struct rpc_cots_server *cmd_stats;
	struct T_addr_ack cmd_addrs;
};

/*
 * Transport private data.
 * Kept in clone_xprt->xp_p2buf.
 */
typedef struct cots_data {
	mblk_t	*cd_mp;		/* pre-allocated reply message */
	mblk_t	*cd_req_mp;	/* request message */
} cots_data_t;

/*
 * Server statistics
 * NOTE: This structure type is duplicated in the NFS fast path.
 */
static const struct rpc_cots_server {
	kstat_named_t	rscalls;
	kstat_named_t	rsbadcalls;
	kstat_named_t	rsnullrecv;
	kstat_named_t	rsbadlen;
	kstat_named_t	rsxdrcall;
	kstat_named_t	rsdupchecks;
	kstat_named_t	rsdupreqs;
} cots_rsstat_tmpl = {
	{ "calls",	KSTAT_DATA_UINT64 },
	{ "badcalls",	KSTAT_DATA_UINT64 },
	{ "nullrecv",	KSTAT_DATA_UINT64 },
	{ "badlen",	KSTAT_DATA_UINT64 },
	{ "xdrcall",	KSTAT_DATA_UINT64 },
	{ "dupchecks",	KSTAT_DATA_UINT64 },
	{ "dupreqs",	KSTAT_DATA_UINT64 }
};

#define	CLONE2STATS(clone_xprt)	\
	((clone_xprt)->xp_master != NULL ? \
	((struct cots_master_data *) \
		(clone_xprt)->xp_master->xp_p2)->cmd_stats : NULL)

#define	RSSTAT_INCR(s, x)	\
	if ((s) != NULL)	\
		atomic_inc_64(&(s)->x.value.ui64)

static rpc_tag_hd_t svc_tag_hd;

/*
 * Pointer to a transport specific `ready to receive' function in rpcmod
 * (set from rpcmod).
 */
void    (*mir_start)(queue_t *);
uint_t	*svc_max_msg_sizep;

/*
 * the address size of the underlying transport can sometimes be
 * unknown (tinfo->ADDR_size == -1).  For this case, it is
 * necessary to figure out what the size is so the correct amount
 * of data is allocated.  This is an itterative process:
 *	1. take a good guess (use T_MINADDRSIZE)
 *	2. try it.
 *	3. if it works then everything is ok
 *	4. if the error is ENAMETOLONG, double the guess
 *	5. go back to step 2.
 */
#define	T_UNKNOWNADDRSIZE	(-1)
#define	T_MINADDRSIZE	32

/*
 * Create a transport record.
 * The transport record, output buffer, and private data structure
 * are allocated.  The output buffer is serialized into using xdrmem.
 * There is one transport record per user process which implements a
 * set of services.
 */
static kmutex_t cots_kcreate_lock;

int
svc_cots_kcreate(file_t *fp, uint_t max_msgsize, struct T_info_ack *tinfo,
    SVCMASTERXPRT **nxprt)
{
	struct cots_master_data *cmd;
	int err, retval;
	SVCMASTERXPRT *xprt;
	struct rpcstat *rpcstat;
	struct T_addr_ack *ack_p;
	struct strioctl getaddr;
	int cmd_sz, ack_p_sz;

	if (nxprt == NULL)
		return (EINVAL);

	rpcstat = zone_getspecific(rpcstat_zone_key, curproc->p_zone);
	ASSERT(rpcstat != NULL);

	xprt = kmem_zalloc(sizeof (SVCMASTERXPRT), KM_SLEEP);

	/*
	 * Size such that we can fit the maximum possible reply.
	 * cots_master_data includes a T_addr_ack struct.
	 */
	cmd_sz = sizeof (*cmd) + (2 * sizeof (sin6_t));
	cmd = kmem_zalloc(cmd_sz, KM_SLEEP);

	if ((tinfo->TIDU_size > COTS_MAX_ALLOCSIZE) ||
	    (tinfo->TIDU_size <= 0))
		xprt->xp_msg_size = COTS_MAX_ALLOCSIZE;
	else {
		xprt->xp_msg_size = tinfo->TIDU_size -
		    (tinfo->TIDU_size % BYTES_PER_XDR_UNIT);
	}

	xprt->xp_ops = &svc_cots_op;
	xprt->xp_p2 = (caddr_t)cmd;
	cmd->cmd_xprt_started = 0;
	cmd->cmd_stats = rpcstat->rpc_cots_server;
	ack_p = &cmd->cmd_addrs;
	ack_p_sz = sizeof (*ack_p) + (2 * sizeof (sin6_t));

	getaddr.ic_cmd = TI_GETINFO;
	getaddr.ic_timout = -1;
	getaddr.ic_len = ack_p_sz;
	getaddr.ic_dp = (char *)ack_p;
	ack_p->PRIM_type = T_ADDR_REQ;

	err = strioctl(fp->f_vnode, I_STR, (intptr_t)&getaddr,
	    0, K_TO_K, CRED(), &retval);
	if (err != 0 || retval != 0) {
		if (err == 0) {
			if ((retval & 0xff) == TSYSERR)
				err = (retval >> 8) & 0xff;
			else
				err = t_tlitosyserr(retval & 0xff);
		}
		/* In case TLI error conversion gave us zero. */
		if (err == 0)
			err = EPROTO;

		kmem_free(xprt, sizeof (SVCMASTERXPRT));
		kmem_free(cmd, cmd_sz);
		return (err);
	}

	xprt->xp_rtaddr.maxlen = ack_p->REMADDR_length;
	xprt->xp_rtaddr.len = ack_p->REMADDR_length;
	xprt->xp_rtaddr.buf = (char *)ack_p + ack_p->REMADDR_offset;

	xprt->xp_lcladdr.maxlen = ack_p->LOCADDR_length;
	xprt->xp_lcladdr.len = ack_p->LOCADDR_length;
	xprt->xp_lcladdr.buf = (char *)ack_p + ack_p->LOCADDR_offset;

	rpc_init_taglist(&xprt->xp_tags);

	/*
	 * If the current sanity check size in rpcmod is smaller
	 * than the size needed for this xprt, then increase
	 * the sanity check.
	 */
	if (max_msgsize != 0 && svc_max_msg_sizep &&
	    max_msgsize > *svc_max_msg_sizep) {

		/* This check needs a lock */
		mutex_enter(&cots_kcreate_lock);
		if (svc_max_msg_sizep && max_msgsize > *svc_max_msg_sizep)
			*svc_max_msg_sizep = max_msgsize;
		mutex_exit(&cots_kcreate_lock);
	}

	*nxprt = xprt;

	return (0);
}

/*
 * Create a connection manager entry for callback
 */
static int
svc_cots_cbconn(void *cb_args)
{
	SVCCB_ARGS *cb = (SVCCB_ARGS *)cb_args;
	int err;

	err = connmgr_cb_create((void *)cb->xprt, cb->prog, cb->vers,
	    cb->family, cb->tag);
	return (err);
}

/*
 * Destroy a master transport record.
 * Frees the space allocated for a transport record.
 */
static void
svc_cots_kdestroy(SVCMASTERXPRT *xprt)
{
	struct cots_master_data *cmd = (struct cots_master_data *)xprt->xp_p2;

	ASSERT(cmd);

	if (xprt->xp_netid)
		kmem_free(xprt->xp_netid, strlen(xprt->xp_netid) + 1);
	if (xprt->xp_addrmask.maxlen)
		kmem_free(xprt->xp_addrmask.buf, xprt->xp_addrmask.maxlen);

	if (!rpc_is_taglist_empty(xprt->xp_tags))
		rpc_remove_all_tag(&svc_tag_hd, (void *)xprt);

	rpc_destroy_taglist(&xprt->xp_tags);

	mutex_destroy(&xprt->xp_req_lock);
	mutex_destroy(&xprt->xp_thread_lock);

	kmem_free(cmd, sizeof (*cmd) + (2 * sizeof (sin6_t)));
	kmem_free(xprt, sizeof (SVCMASTERXPRT));
}

/*
 * svc_tli_kcreate() calls this function at the end to tell
 * rpcmod that the transport is ready to receive requests.
 */
static void
svc_cots_kstart(SVCMASTERXPRT *xprt)
{
	struct cots_master_data *cmd = (struct cots_master_data *)xprt->xp_p2;

	if (cmd->cmd_xprt_started == 0) {
		/*
		 * Acquire the xp_req_lock in order to use xp_wq
		 * safely (we don't want to qenable a queue that has
		 * already been closed).
		 */
		mutex_enter(&xprt->xp_req_lock);
		if (cmd->cmd_xprt_started == 0 &&
		    xprt->xp_wq != NULL) {
			(*mir_start)(xprt->xp_wq);
			cmd->cmd_xprt_started = 1;
		}
		mutex_exit(&xprt->xp_req_lock);
	}
}

/*
 * Transport-type specific part of svc_xprt_cleanup().
 */
static void
svc_cots_kclone_destroy(SVCXPRT *clone_xprt)
{
	cots_data_t *cd = (cots_data_t *)clone_xprt->xp_p2buf;

	if (cd->cd_req_mp) {
		freemsg(cd->cd_req_mp);
		cd->cd_req_mp = (mblk_t *)0;
	}
	ASSERT(cd->cd_mp == NULL);
}

/*
 * Transport Attributes.
 */
static void
svc_cots_ktattrs(SVCXPRT *clone_xprt, int attrflag, void **tattr)
{
	*tattr = NULL;

	switch (attrflag) {
	case SVC_TATTR_ADDRMASK:
		*tattr = (void *)&clone_xprt->xp_master->xp_addrmask;
	}
}

/*
 * Receive rpc requests.
 * Checks if the message is intact, and deserializes the call packet.
 */
static bool_t
svc_cots_krecv(SVCXPRT *clone_xprt, mblk_t *mp, struct rpc_msg *msg)
{
	cots_data_t *cd = (cots_data_t *)clone_xprt->xp_p2buf;
	XDR *xdrs = &clone_xprt->xp_xdrin;
	struct rpc_cots_server *stats = CLONE2STATS(clone_xprt);

	TRACE_0(TR_FAC_KRPC, TR_SVC_COTS_KRECV_START,
	    "svc_cots_krecv_start:");
	RPCLOG(4, "svc_cots_krecv_start clone_xprt = %p:\n",
	    (void *)clone_xprt);

	RSSTAT_INCR(stats, rscalls);

	if (mp->b_datap->db_type != M_DATA) {
		RPCLOG(16, "svc_cots_krecv bad db_type %d\n",
		    mp->b_datap->db_type);
		goto bad;
	}

	xdrmblk_init(xdrs, mp, XDR_DECODE, 0);

	TRACE_0(TR_FAC_KRPC, TR_XDR_CALLMSG_START,
	    "xdr_callmsg_start:");
	RPCLOG0(4, "xdr_callmsg_start:\n");
	if (!xdr_callmsg(xdrs, msg)) {
		XDR_DESTROY(xdrs);
		TRACE_1(TR_FAC_KRPC, TR_XDR_CALLMSG_END,
		    "xdr_callmsg_end:(%S)", "bad");
		RPCLOG0(1, "svc_cots_krecv xdr_callmsg failure\n");
		RSSTAT_INCR(stats, rsxdrcall);
		goto bad;
	}
	TRACE_1(TR_FAC_KRPC, TR_XDR_CALLMSG_END,
	    "xdr_callmsg_end:(%S)", "good");

	clone_xprt->xp_xid = msg->rm_xid;
	cd->cd_req_mp = mp;

	TRACE_1(TR_FAC_KRPC, TR_SVC_COTS_KRECV_END,
	    "svc_cots_krecv_end:(%S)", "good");
	RPCLOG0(4, "svc_cots_krecv_end:good\n");
	return (TRUE);

bad:
	if (mp)
		freemsg(mp);

	RSSTAT_INCR(stats, rsbadcalls);
	TRACE_1(TR_FAC_KRPC, TR_SVC_COTS_KRECV_END,
	    "svc_cots_krecv_end:(%S)", "bad");
	return (FALSE);
}

/*
 * Send rpc reply.
 */
static bool_t
svc_cots_ksend(SVCXPRT *clone_xprt, struct rpc_msg *msg)
{
	/* LINTED pointer alignment */
	cots_data_t *cd = (cots_data_t *)clone_xprt->xp_p2buf;
	XDR *xdrs = &(clone_xprt->xp_xdrout);
	int retval = FALSE;
	mblk_t *mp;
	xdrproc_t xdr_results;
	caddr_t xdr_location;
	bool_t has_args;

	/*
	 * If there is a result procedure specified in the reply message,
	 * it will be processed in the xdr_replymsg and SVCAUTH_WRAP.
	 * We need to make sure it won't be processed twice, so we null
	 * it for xdr_replymsg here.
	 */
	has_args = FALSE;
	if (msg->rm_reply.rp_stat == MSG_ACCEPTED &&
	    msg->rm_reply.rp_acpt.ar_stat == SUCCESS) {
		if ((xdr_results = msg->acpted_rply.ar_results.proc) != NULL) {
			has_args = TRUE;
			xdr_location = msg->acpted_rply.ar_results.where;
			msg->acpted_rply.ar_results.proc = xdr_void;
			msg->acpted_rply.ar_results.where = NULL;
		}
	}

	mp = cd->cd_mp;
	if (mp) {
		/*
		 * The program above pre-allocated an mblk and put
		 * the data in place.
		 */
		cd->cd_mp = (mblk_t *)NULL;
		if (!(xdr_replymsg_body(xdrs, msg) &&
		    (!has_args || SVCAUTH_WRAP(&clone_xprt->xp_auth, xdrs,
		    xdr_results, xdr_location)))) {
			XDR_DESTROY(xdrs);
			RPCLOG0(1, "svc_cots_ksend: "
			    "xdr_replymsg_body/SVCAUTH_WRAP failed\n");
			freemsg(mp);
			goto out;
		}
	} else {
		int	len;
		int	mpsize;

		/*
		 * Leave space for protocol headers.
		 */
		len = MSG_OFFSET + clone_xprt->xp_msg_size;

		/*
		 * Allocate an initial mblk for the response data.
		 */
		while (!(mp = allocb(len, BPRI_LO))) {
			RPCLOG0(16, "svc_cots_ksend: allocb failed failed\n");
			if (strwaitbuf(len, BPRI_LO)) {
				TRACE_1(TR_FAC_KRPC, TR_SVC_COTS_KSEND_END,
				    "svc_cots_ksend_end:(%S)", "strwaitbuf");
				RPCLOG0(1,
				    "svc_cots_ksend: strwaitbuf failed\n");
				goto out;
			}
		}

		/*
		 * Initialize the XDR encode stream.  Additional mblks
		 * will be allocated if necessary.  They will be TIDU
		 * sized.
		 */
		xdrmblk_init(xdrs, mp, XDR_ENCODE, clone_xprt->xp_msg_size);
		mpsize = MBLKSIZE(mp);
		ASSERT(mpsize >= len);
		ASSERT(mp->b_rptr == mp->b_datap->db_base);

		/*
		 * If the size of mblk is not appreciably larger than what we
		 * asked, then resize the mblk to exactly len bytes. Reason for
		 * this: suppose len is 1600 bytes, the tidu is 1460 bytes
		 * (from TCP over ethernet), and the arguments to RPC require
		 * 2800 bytes. Ideally we want the protocol to render two
		 * ~1400 byte segments over the wire. If allocb() gives us a 2k
		 * mblk, and we allocate a second mblk for the rest, the
		 * protocol module may generate 3 segments over the wire:
		 * 1460 bytes for the first, 448 (2048 - 1600) for the 2nd, and
		 * 892 for the 3rd. If we "waste" 448 bytes in the first mblk,
		 * the XDR encoding will generate two ~1400 byte mblks, and the
		 * protocol module is more likely to produce properly sized
		 * segments.
		 */
		if ((mpsize >> 1) <= len) {
			mp->b_rptr += (mpsize - len);
		}

		/*
		 * Adjust b_rptr to reserve space for the non-data protocol
		 * headers that any downstream modules might like to add, and
		 * for the record marking header.
		 */
		mp->b_rptr += (MSG_OFFSET + RM_HDR_SIZE);

		XDR_SETPOS(xdrs, (uint_t)(mp->b_rptr - mp->b_datap->db_base));
		ASSERT(mp->b_wptr == mp->b_rptr);

		msg->rm_xid = clone_xprt->xp_xid;

		TRACE_0(TR_FAC_KRPC, TR_XDR_REPLYMSG_START,
		    "xdr_replymsg_start:");
		if (!(xdr_replymsg(xdrs, msg) &&
		    (!has_args || SVCAUTH_WRAP(&clone_xprt->xp_auth, xdrs,
		    xdr_results, xdr_location)))) {
			XDR_DESTROY(xdrs);
			TRACE_1(TR_FAC_KRPC, TR_XDR_REPLYMSG_END,
			    "xdr_replymsg_end:(%S)", "bad");
			freemsg(mp);
			goto out;
		}
		TRACE_1(TR_FAC_KRPC, TR_XDR_REPLYMSG_END,
		    "xdr_replymsg_end:(%S)", "good");
	}

	XDR_DESTROY(xdrs);

	put(clone_xprt->xp_wq, mp);
	retval = TRUE;

out:
	/*
	 * This is completely disgusting.  If public is set it is
	 * a pointer to a structure whose first field is the address
	 * of the function to free that structure and any related
	 * stuff.  (see rrokfree in nfs_xdr.c).
	 */
	if (xdrs->x_public) {
		/* LINTED pointer alignment */
		(**((int (**)())xdrs->x_public))(xdrs->x_public);
	}

	TRACE_1(TR_FAC_KRPC, TR_SVC_COTS_KSEND_END,
	    "svc_cots_ksend_end:(%S)", "done");
	return (retval);
}

/*
 * Deserialize arguments.
 */
static bool_t
svc_cots_kgetargs(SVCXPRT *clone_xprt, xdrproc_t xdr_args,
    caddr_t args_ptr)
{
	return (SVCAUTH_UNWRAP(&clone_xprt->xp_auth, &clone_xprt->xp_xdrin,
	    xdr_args, args_ptr));
}

static bool_t
svc_cots_kfreeargs(SVCXPRT *clone_xprt, xdrproc_t xdr_args,
    caddr_t args_ptr)
{
	cots_data_t *cd = (cots_data_t *)clone_xprt->xp_p2buf;
	/* LINTED pointer alignment */
	XDR *xdrs = &clone_xprt->xp_xdrin;
	mblk_t *mp;
	bool_t retval;

	/*
	 * It is important to call the XDR routine before
	 * freeing the request mblk.  Structures in the
	 * XDR data may point into the mblk and require that
	 * the memory be intact during the free routine.
	 */
	if (args_ptr) {
		xdrs->x_op = XDR_FREE;
		retval = (*xdr_args)(xdrs, args_ptr);
	} else
		retval = TRUE;

	XDR_DESTROY(xdrs);

	if ((mp = cd->cd_req_mp) != NULL) {
		cd->cd_req_mp = (mblk_t *)0;
		freemsg(mp);
	}

	return (retval);
}

static int32_t *
svc_cots_kgetres(SVCXPRT *clone_xprt, int size)
{
	/* LINTED pointer alignment */
	cots_data_t *cd = (cots_data_t *)clone_xprt->xp_p2buf;
	XDR *xdrs = &clone_xprt->xp_xdrout;
	mblk_t *mp;
	int32_t *buf;
	struct rpc_msg rply;
	int len;
	int mpsize;

	/*
	 * Leave space for protocol headers.
	 */
	len = MSG_OFFSET + clone_xprt->xp_msg_size;

	/*
	 * Allocate an initial mblk for the response data.
	 */
	while ((mp = allocb(len, BPRI_LO)) == NULL) {
		if (strwaitbuf(len, BPRI_LO))
			return (NULL);
	}

	/*
	 * Initialize the XDR encode stream.  Additional mblks
	 * will be allocated if necessary.  They will be TIDU
	 * sized.
	 */
	xdrmblk_init(xdrs, mp, XDR_ENCODE, clone_xprt->xp_msg_size);
	mpsize = MBLKSIZE(mp);
	ASSERT(mpsize >= len);
	ASSERT(mp->b_rptr == mp->b_datap->db_base);

	/*
	 * If the size of mblk is not appreciably larger than what we
	 * asked, then resize the mblk to exactly len bytes. Reason for
	 * this: suppose len is 1600 bytes, the tidu is 1460 bytes
	 * (from TCP over ethernet), and the arguments to RPC require
	 * 2800 bytes. Ideally we want the protocol to render two
	 * ~1400 byte segments over the wire. If allocb() gives us a 2k
	 * mblk, and we allocate a second mblk for the rest, the
	 * protocol module may generate 3 segments over the wire:
	 * 1460 bytes for the first, 448 (2048 - 1600) for the 2nd, and
	 * 892 for the 3rd. If we "waste" 448 bytes in the first mblk,
	 * the XDR encoding will generate two ~1400 byte mblks, and the
	 * protocol module is more likely to produce properly sized
	 * segments.
	 */
	if ((mpsize >> 1) <= len) {
		mp->b_rptr += (mpsize - len);
	}

	/*
	 * Adjust b_rptr to reserve space for the non-data protocol
	 * headers that any downstream modules might like to add, and
	 * for the record marking header.
	 */
	mp->b_rptr += (MSG_OFFSET + RM_HDR_SIZE);

	XDR_SETPOS(xdrs, (uint_t)(mp->b_rptr - mp->b_datap->db_base));
	ASSERT(mp->b_wptr == mp->b_rptr);

	/*
	 * Assume a successful RPC since most of them are.
	 */
	rply.rm_xid = clone_xprt->xp_xid;
	rply.rm_direction = REPLY;
	rply.rm_reply.rp_stat = MSG_ACCEPTED;
	rply.acpted_rply.ar_verf = clone_xprt->xp_verf;
	rply.acpted_rply.ar_stat = SUCCESS;

	if (!xdr_replymsg_hdr(xdrs, &rply)) {
		XDR_DESTROY(xdrs);
		freeb(mp);
		return (NULL);
	}

	buf = XDR_INLINE(xdrs, size);
	if (buf == NULL) {
		XDR_DESTROY(xdrs);
		ASSERT(cd->cd_mp == NULL);
		freemsg(mp);
	} else {
		cd->cd_mp = mp;
	}
	return (buf);
}

static void
svc_cots_kfreeres(SVCXPRT *clone_xprt)
{
	cots_data_t *cd;
	mblk_t *mp;

	cd = (cots_data_t *)clone_xprt->xp_p2buf;
	if ((mp = cd->cd_mp) != NULL) {
		XDR_DESTROY(&clone_xprt->xp_xdrout);
		cd->cd_mp = (mblk_t *)NULL;
		freemsg(mp);
	}
}

static int
svc_cots_kctl(SVCXPRT *clone_xprt, int cmd, void *arg)
{
	int rc = 0;

	switch (cmd) {
	case SVCCTL_SET_ASD:
		clone_xprt->xp_asd = arg;
		break;

	case SVCCTL_GET_ASD:
		*(char **)arg = clone_xprt->xp_asd;
		break;

	case SVCCTL_SET_CBCONN:
		rc = svc_cots_cbconn(arg);
		break;

	case SVCCTL_SET_TAG:
	case SVCCTL_SET_TAG_CLEAR:
	case SVCCTL_CMP_TAG:
		rc = svc_cots_tag(clone_xprt, cmd, arg);
		break;
	}

	return (rc);
}

/*
 * the dup cacheing routines below provide a cache of non-failure
 * transaction id's.  rpc service routines can use this to detect
 * retransmissions and re-send a non-failure response.
 */

/*
 * MAXDUPREQS is the number of cached items.  It should be adjusted
 * to the service load so that there is likely to be a response entry
 * when the first retransmission comes in.
 */
#define	MAXDUPREQS	8192

/*
 * This should be appropriately scaled to MAXDUPREQS.  To produce as less as
 * possible collisions it is suggested to set this to a prime.
 */
#define	DRHASHSZ	2053

#define	XIDHASH(xid)	((xid) % DRHASHSZ)
#define	DRHASH(dr)	XIDHASH((dr)->dr_xid)
#define	REQTOXID(req)	((req)->rq_xprt->xp_xid)

static int	cotsndupreqs = 0;
int	cotsmaxdupreqs = MAXDUPREQS;
static kmutex_t cotsdupreq_lock;
static struct dupreq *cotsdrhashtbl[DRHASHSZ];
static int	cotsdrhashstat[DRHASHSZ];

static void unhash(struct dupreq *);

/*
 * cotsdrmru points to the head of a circular linked list in lru order.
 * cotsdrmru->dr_next == drlru
 */
struct dupreq *cotsdrmru;

/*
 * PSARC 2003/523 Contract Private Interface
 * svc_cots_kdup
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 *
 * svc_cots_kdup searches the request cache and returns 0 if the
 * request is not found in the cache.  If it is found, then it
 * returns the state of the request (in progress or done) and
 * the status or attributes that were part of the original reply.
 *
 * If DUP_DONE (there is a duplicate) svc_cots_kdup copies over the
 * value of the response. In that case, also return in *dupcachedp
 * whether the response free routine is cached in the dupreq - in which case
 * the caller should not be freeing it, because it will be done later
 * in the svc_cots_kdup code when the dupreq is reused.
 */
static int
svc_cots_kdup(struct svc_req *req, caddr_t res, int size, struct dupreq **drpp,
    bool_t *dupcachedp)
{
	struct rpc_cots_server *stats = CLONE2STATS(req->rq_xprt);
	struct dupreq *dr;
	uint32_t xid;
	uint32_t drhash;
	int status;

	xid = REQTOXID(req);
	mutex_enter(&cotsdupreq_lock);
	RSSTAT_INCR(stats, rsdupchecks);
	/*
	 * Check to see whether an entry already exists in the cache.
	 */
	dr = cotsdrhashtbl[XIDHASH(xid)];
	while (dr != NULL) {
		if (dr->dr_xid == xid &&
		    dr->dr_proc == req->rq_proc &&
		    dr->dr_prog == req->rq_prog &&
		    dr->dr_vers == req->rq_vers &&
		    dr->dr_addr.len == req->rq_xprt->xp_rtaddr.len &&
		    bcmp((caddr_t)dr->dr_addr.buf,
		    (caddr_t)req->rq_xprt->xp_rtaddr.buf,
		    dr->dr_addr.len) == 0) {
			status = dr->dr_status;
			if (status == DUP_DONE) {
				bcopy(dr->dr_resp.buf, res, size);
				if (dupcachedp != NULL)
					*dupcachedp = (dr->dr_resfree != NULL);
				TRACE_0(TR_FAC_KRPC, TR_SVC_COTS_KDUP_DONE,
				    "svc_cots_kdup: DUP_DONE");
			} else {
				dr->dr_status = DUP_INPROGRESS;
				*drpp = dr;
				TRACE_0(TR_FAC_KRPC,
				    TR_SVC_COTS_KDUP_INPROGRESS,
				    "svc_cots_kdup: DUP_INPROGRESS");
			}
			RSSTAT_INCR(stats, rsdupreqs);
			mutex_exit(&cotsdupreq_lock);
			return (status);
		}
		dr = dr->dr_chain;
	}

	/*
	 * There wasn't an entry, either allocate a new one or recycle
	 * an old one.
	 */
	if (cotsndupreqs < cotsmaxdupreqs) {
		dr = kmem_alloc(sizeof (*dr), KM_NOSLEEP);
		if (dr == NULL) {
			mutex_exit(&cotsdupreq_lock);
			return (DUP_ERROR);
		}
		dr->dr_resp.buf = NULL;
		dr->dr_resp.maxlen = 0;
		dr->dr_addr.buf = NULL;
		dr->dr_addr.maxlen = 0;
		if (cotsdrmru) {
			dr->dr_next = cotsdrmru->dr_next;
			cotsdrmru->dr_next = dr;
		} else {
			dr->dr_next = dr;
		}
		cotsndupreqs++;
	} else {
		dr = cotsdrmru->dr_next;
		while (dr->dr_status == DUP_INPROGRESS) {
			dr = dr->dr_next;
			if (dr == cotsdrmru->dr_next) {
				cmn_err(CE_WARN, "svc_cots_kdup no slots free");
				mutex_exit(&cotsdupreq_lock);
				return (DUP_ERROR);
			}
		}
		unhash(dr);
		if (dr->dr_resfree) {
			(*dr->dr_resfree)(dr->dr_resp.buf);
		}
	}
	dr->dr_resfree = NULL;
	cotsdrmru = dr;

	dr->dr_xid = REQTOXID(req);
	dr->dr_prog = req->rq_prog;
	dr->dr_vers = req->rq_vers;
	dr->dr_proc = req->rq_proc;
	if (dr->dr_addr.maxlen < req->rq_xprt->xp_rtaddr.len) {
		if (dr->dr_addr.buf != NULL)
			kmem_free(dr->dr_addr.buf, dr->dr_addr.maxlen);
		dr->dr_addr.maxlen = req->rq_xprt->xp_rtaddr.len;
		dr->dr_addr.buf = kmem_alloc(dr->dr_addr.maxlen, KM_NOSLEEP);
		if (dr->dr_addr.buf == NULL) {
			dr->dr_addr.maxlen = 0;
			dr->dr_status = DUP_DROP;
			mutex_exit(&cotsdupreq_lock);
			return (DUP_ERROR);
		}
	}
	dr->dr_addr.len = req->rq_xprt->xp_rtaddr.len;
	bcopy(req->rq_xprt->xp_rtaddr.buf, dr->dr_addr.buf, dr->dr_addr.len);
	if (dr->dr_resp.maxlen < size) {
		if (dr->dr_resp.buf != NULL)
			kmem_free(dr->dr_resp.buf, dr->dr_resp.maxlen);
		dr->dr_resp.maxlen = (unsigned int)size;
		dr->dr_resp.buf = kmem_alloc(size, KM_NOSLEEP);
		if (dr->dr_resp.buf == NULL) {
			dr->dr_resp.maxlen = 0;
			dr->dr_status = DUP_DROP;
			mutex_exit(&cotsdupreq_lock);
			return (DUP_ERROR);
		}
	}
	dr->dr_status = DUP_INPROGRESS;

	drhash = (uint32_t)DRHASH(dr);
	dr->dr_chain = cotsdrhashtbl[drhash];
	cotsdrhashtbl[drhash] = dr;
	cotsdrhashstat[drhash]++;
	mutex_exit(&cotsdupreq_lock);
	*drpp = dr;
	return (DUP_NEW);
}

/*
 * PSARC 2003/523 Contract Private Interface
 * svc_cots_kdupdone
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 *
 * svc_cots_kdupdone marks the request done (DUP_DONE or DUP_DROP)
 * and stores the response.
 */
static void
svc_cots_kdupdone(struct dupreq *dr, caddr_t res, void (*dis_resfree)(),
    int size, int status)
{
	ASSERT(dr->dr_resfree == NULL);
	if (status == DUP_DONE) {
		bcopy(res, dr->dr_resp.buf, size);
		dr->dr_resfree = dis_resfree;
	}
	dr->dr_status = status;
}

static int
svc_cots_tag(SVCXPRT *clone_xprt, int cmd, void *arg)
{
	SVCMASTERXPRT *xprt = clone_xprt->xp_master;
	rpc_tag_t *tag;

	switch (cmd) {

	case SVCCTL_SET_TAG:
		rpc_add_tag(&svc_tag_hd, (void *)xprt, arg);
		break;

	case SVCCTL_SET_TAG_CLEAR:
		if (rpc_is_taglist_empty(xprt->xp_tags)) {
			DTRACE_PROBE1(krpc__svc__tag, char *,
			    "tag clear called on xprt with no tags");
			return (1);
		}

		/* First, get the tag */
		tag = rpc_lookup_tag(&svc_tag_hd, arg, FALSE);

		if (tag == NULL) {
			DTRACE_PROBE1(krpc__svc__tag, char *,
			    "could not find a matching tag");
			return (1);
		}

		/* Remove the xprt from the tag */
		mutex_enter(&tag->rt_lock);
		rpc_remove_xprt(&svc_tag_hd, tag, (void *)xprt);
		mutex_exit(&tag->rt_lock);

		/* Remove the tag from the xprt */
		rpc_remove_tag(&svc_tag_hd, (void *)xprt, tag->rt_id);

		/*
		 * Release the refcnt acquired by rpc_lookup_tag()
		 */
		RPC_TAG_RELE(tag);

		break;

	case SVCCTL_CMP_TAG:
		/*
		 * CMP_TAG is called with a tag as the argument.
		 * If a matching tag is found on the xprt, returns 0, else 1.
		 */
		if (rpc_is_taglist_empty(xprt->xp_tags)) {
			DTRACE_PROBE1(krpc__svc__tag, char *,
			    "tag match called on xprt with no tags");
			return (1);
		}
		if (!rpc_cmp_tag(xprt->xp_tags, arg))
			return (1);
		break;
	}

	return (0);
}

/*
 * This routine expects that the mutex, cotsdupreq_lock, is already held.
 */
static void
unhash(struct dupreq *dr)
{
	struct dupreq *drt;
	struct dupreq *drtprev = NULL;
	uint32_t drhash;

	ASSERT(MUTEX_HELD(&cotsdupreq_lock));

	drhash = (uint32_t)DRHASH(dr);
	drt = cotsdrhashtbl[drhash];
	while (drt != NULL) {
		if (drt == dr) {
			cotsdrhashstat[drhash]--;
			if (drtprev == NULL) {
				cotsdrhashtbl[drhash] = drt->dr_chain;
			} else {
				drtprev->dr_chain = drt->dr_chain;
			}
			return;
		}
		drtprev = drt;
		drt = drt->dr_chain;
	}
}

void
svc_cots_stats_init(zoneid_t zoneid, struct rpc_cots_server **statsp)
{
	*statsp = (struct rpc_cots_server *)rpcstat_zone_init_common(zoneid,
	    "unix", "rpc_cots_server", (const kstat_named_t *)&cots_rsstat_tmpl,
	    sizeof (cots_rsstat_tmpl));
}

void
svc_cots_stats_fini(zoneid_t zoneid, struct rpc_cots_server **statsp)
{
	rpcstat_zone_fini_common(zoneid, "unix", "rpc_cots_server");
	kmem_free(*statsp, sizeof (cots_rsstat_tmpl));
}

void
svc_cots_init(void)
{
	/*
	 * Check to make sure that the cots private data will fit into
	 * the stack buffer allocated by svc_run.  The ASSERT is a safety
	 * net if the cots_data_t structure ever changes.
	 */
	ASSERT(sizeof (cots_data_t) <= SVC_P2LEN);

	mutex_init(&cots_kcreate_lock, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&cotsdupreq_lock, NULL, MUTEX_DEFAULT, NULL);
	rpc_taghd_init(&svc_tag_hd, offsetof(SVCMASTERXPRT, xp_tags));
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 *  Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
 *  Use is subject to license terms.
 */
/*
 * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
 */

/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

#include <sys/types.h>
#include <sys/sysmacros.h>
#include <sys/param.h>
#include <sys/cmn_err.h>
#include <sys/debug.h>
#include <rpc/types.h>
#include <netinet/in.h>
#include <rpc/auth.h>
#include <rpc/clnt.h>
#include <sys/tiuser.h>
#include <sys/t_kuser.h>
#include <rpc/svc.h>
#include <sys/file.h>
#include <sys/user.h>
#include <sys/stream.h>
#include <sys/strsubr.h>
#include <sys/stropts.h>
#include <sys/tihdr.h>
#include <sys/timod.h>
#include <sys/sunddi.h>
#include <sys/fcntl.h>
#include <sys/errno.h>

/*
 * Create server-side kernel RPC `master' transport handle
 *
 * This is public interface for creation of a server RPC transport handle
 * for a given file descriptor. This function is called from nfs_svc()
 * and lm_svc().
 *
 * PSARC 2003/523 Contract Private Interface
 * svc_tli_kcreate
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 *
 * Arguments:
 * - fp		 - connection end point
 * - max_msgsize - max receive size
 * - netid	 - netid
 * - addrmask	 - address mask
 * - nxprt       - filled with outgoing transport handle
 * - sct	 - callout table to be registered with this transport handle
 * - closeproc	 - optional pointer to a closeproc for this transport or NULL
 * - id	         - RPC pool id (currently only NFS_SVCPOOL_ID or LM_SVCPOOL_ID)
 * - hotstream	 - very MT-hot flag (TRUE for NFS, FALSE for Lock Manager)
 *
 * Description:
 * - make sure rpcmod is on the stream
 * - call T_INFO_REQ to get the transport service type info
 * - call transport-type specific `create' routine (svc_clts_kcreate(),
 *   svc_cots_kcreate()) to create and initialize transport for the stream
 * - call svc_xprt_register() to register the transport handle into the
 *   service thread pool
 * - initialize transport-type independent fields (synchronization objects,
 *   thread counts, callout table, closeproc)
 * - optionally, for CLTS transports tell streams framework that the
 *   stream can be MT-hot
 * - call transport-type specific `start' function to tell rpcmod that
 *   the transport is ready to receive.
 */
int
svc_tli_kcreate(
	struct file	*fp,		/* connection end point */
	uint_t		max_msgsize,	/* max receive size */
	char		*netid,
	struct netbuf	*addrmask,
	SVCMASTERXPRT	**nxprt,
	SVC_CALLOUT_TABLE *sct,
	void		(*closeproc)(const SVCMASTERXPRT *),
	int		id,		/* thread pool  */
	bool_t		hotstream)
{
	queue_t		*wq;
	SVCMASTERXPRT	*xprt = NULL;	/* service handle */
	int		retval;
	struct strioctl strioc;
	struct T_info_ack tinfo;
	int		error;
	void		**vp;
	major_t		udpmaj;

	RPCLOG(16, "svc_tli_kcreate: on file %p\n", (void *)fp);

	if (fp == NULL || nxprt == NULL)
		return (EINVAL);

	if (fp->f_vnode->v_stream == NULL)
		return (ENOSTR);

	/*
	 * Make sure that an RPC interface module is on the stream.
	 */
	wq = fp->f_vnode->v_stream->sd_wrq;
	while ((wq = wq->q_next) != NULL) {
		if (strcmp(wq->q_qinfo->qi_minfo->mi_idname, "rpcmod") == 0)
			break;
	}
	if (!wq) {
		RPCLOG0(1, "svc_tli_kcreate: no RPC module on stream\n");
		return (EINVAL);
	}

	/*
	 * Find out what type of transport this is.
	 */
	strioc.ic_cmd = TI_GETINFO;
	strioc.ic_timout = -1;
	strioc.ic_len = sizeof (tinfo);
	strioc.ic_dp = (char *)&tinfo;
	tinfo.PRIM_type = T_INFO_REQ;

	error = strioctl(fp->f_vnode, I_STR, (intptr_t)&strioc, 0, K_TO_K,
	    CRED(), &retval);
	if (error || retval) {
		RPCLOG(1, "svc_tli_kcreate: getinfo ioctl: %d\n", error);
		return (error);
	}

	/*
	 * Call transport-type specific `create' function.
	 * It will allocate transport structure.
	 */
	switch (tinfo.SERV_type) {
	case T_CLTS:
		error = svc_clts_kcreate(fp, max_msgsize, &tinfo, &xprt);
		break;
	case T_COTS:
	case T_COTS_ORD:
		error = svc_cots_kcreate(fp, max_msgsize, &tinfo, &xprt);
		break;
	default:
		RPCLOG(1, "svc_tli_kcreate: Bad service type %d\n",
		    tinfo.SERV_type);
		error = EINVAL;
	}
	if (error)
		return (error);

	/*
	 * Initialize transport-type independent fields.
	 */
	xprt->xp_req_head = (mblk_t *)0;
	xprt->xp_req_tail = (mblk_t *)0;
	xprt->xp_full = FALSE;
	xprt->xp_enable = FALSE;
	xprt->xp_reqs = 0;
	xprt->xp_size = 0;
	mutex_init(&xprt->xp_req_lock, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&xprt->xp_thread_lock, NULL, MUTEX_DEFAULT, NULL);
	xprt->xp_type = tinfo.SERV_type;
	xprt->xp_threads = 0;
	xprt->xp_detached_threads = 0;
	xprt->xp_fp = fp;
	xprt->xp_wq = wq;
	xprt->xp_closeproc = closeproc;
	xprt->xp_sct = sct;
	xprt->xp_netid = NULL;
	if (netid != NULL) {
		xprt->xp_netid = kmem_alloc(strlen(netid) + 1, KM_SLEEP);
		(void) strcpy(xprt->xp_netid, netid);
	}

	xprt->xp_addrmask.len = 0;
	xprt->xp_addrmask.maxlen = 0;
	xprt->xp_addrmask.buf = NULL;

	if (addrmask != NULL) {
		xprt->xp_addrmask = *addrmask;
	}

	/*
	 * Register this transport handle after all fields have been
	 * initialized. The registration can fail only if we try to register
	 * with a non-existent pool (ENOENT) or a closing pool (EBUSY).
	 */
	if (error = svc_xprt_register(xprt, id)) {
		/* if there was an addrmask, caller will delete it */
		xprt->xp_addrmask.maxlen = 0;
		SVC_DESTROY(xprt);
		cmn_err(CE_WARN, "svc_tli_kcreate: xprt_register failed");

		return (error);
	}

	/*
	 * Set the private RPC cell in the module's data.
	 */
	vp = (void **)wq->q_ptr;
	vp[0] = xprt;

	/*
	 * Inform the streams framework that the stream may be very MT hot.
	 */
	if (hotstream && tinfo.SERV_type == T_CLTS) {
		udpmaj = ddi_name_to_major("udp");
		if (udpmaj != (major_t)-1 &&
		    getmajor(fp->f_vnode->v_rdev) == udpmaj)
			create_putlocks(wq, 1);
	}

	*nxprt = xprt;

	/*
	 * Tell rpcmod that the transport is fully initialized and
	 * ready to process requests.
	 */
	SVC_START(xprt);

	return (0);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#ifndef _RPC_SVC_MT_H
#define	_RPC_SVC_MT_H

#include <synch.h>		/* needed for mutex_t declaration */

/*
 * Private service definitions
 */

#ifdef __cplusplus
extern "C" {
#endif

/*
 * SVC flags
 */
#define	SVC_VERSQUIET	0x0001	/* keep quiet about version mismatch */
#define	SVC_DEFUNCT	0x0002	/* xprt is defunct, release asap */
#define	SVC_DGRAM	0x0004	/* datagram type */
#define	SVC_RENDEZVOUS	0x0008	/* rendezvous */
#define	SVC_CONNECTION	0x000c	/* connection */
#define	SVC_DOOR	0x0010	/* door ipc */
#define	SVC_TYPE_MASK	0x001c	/* type mask */
#define	SVC_FAILED	0x0020	/* send/receive failed, used for VC */
#define	SVC_ARGS_CHECK	0x0040	/* flag to check for argument completion */

#define	svc_flags(xprt)		(SVCEXT(xprt)->flags)
#define	version_keepquiet(xprt)	(svc_flags(xprt) & SVC_VERSQUIET)
#define	svc_defunct(xprt)	((svc_flags(xprt) & SVC_DEFUNCT) ? TRUE : FALSE)
#define	svc_failed(xprt)	((svc_flags(xprt) & SVC_FAILED) ? TRUE : FALSE)
#define	svc_type(xprt)		(svc_flags(xprt) & SVC_TYPE_MASK)
#define	svc_send_mutex(xprt)	(SVCEXT(xprt)->send_mutex)


/*
 * Copy of GSS parameters, needed for MT operation
 */
typedef struct {
	bool_t			established;
	rpc_gss_service_t	service;
	uint_t			qop_rcvd;
	void			*context;
	uint_t			seq_num;
} svc_rpc_gss_parms_t;

/*
 * Interface to server-side authentication flavors, may vary with
 * each request.
 *
 * NOTE: This structure is part of an interface, and must not change.
 */
typedef struct {
	struct svc_auth_ops {
		int		(*svc_ah_wrap)();
		int		(*svc_ah_unwrap)();
	} svc_ah_ops;
	caddr_t			svc_ah_private;
	svc_rpc_gss_parms_t	svc_gss_parms;
	rpc_gss_rawcred_t	raw_cred;
} SVCAUTH;

/*
 * The xp_p3 field the the service handle points to the SVCXPRT_EXT
 * extension structure.
 */
typedef struct svcxprt_list_t {
	struct svcxprt_list_t	*next;
	SVCXPRT			*xprt;
} SVCXPRT_LIST;

typedef struct svcxprt_ext_t {
	int		flags;		/* VERSQUIET, DEFUNCT flag */
	SVCXPRT		*parent;	/* points to parent (NULL in parent) */

	struct rpc_msg	*msg;		/* message */
	struct svc_req	*req;		/* request */
	char		*cred_area;	/* auth work area */
	int		refcnt;		/* number of parent references */
	SVCXPRT_LIST	*my_xlist;	/* list header for this copy */
	mutex_t		send_mutex;	/* for sequencing sends */
	SVCAUTH		xp_auth;	/* flavor of current request */
} SVCXPRT_EXT;

#define	SVCEXT(xprt)		((SVCXPRT_EXT *)((xprt)->xp_p3))
#define	SVC_XP_AUTH(xprt)	(SVCEXT(xprt)->xp_auth)

#define	SVCAUTH_WRAP(auth, xdrs, xfunc, xwhere) \
	((*((auth)->svc_ah_ops.svc_ah_wrap))(auth, xdrs, xfunc, xwhere))
#define	SVCAUTH_UNWRAP(auth, xdrs, xfunc, xwhere) \
	((*((auth)->svc_ah_ops.svc_ah_unwrap))(auth, xdrs, xfunc, xwhere))

/*
 * Global/module private data and functions
 */
extern SVCXPRT **svc_xports;
extern XDR **svc_xdrs;
extern int svc_mt_mode;
extern mutex_t svc_thr_mutex;
extern cond_t svc_thr_fdwait;
extern int svc_nfds;
extern int svc_nfds_set;
extern int svc_max_fd;
extern mutex_t svc_mutex;
extern mutex_t svc_exit_mutex;
extern int svc_pipe[2];
extern bool_t svc_polling;

SVCXPRT *svc_xprt_alloc();
SVCXPRT *svc_dg_xprtcopy();
SVCXPRT *svc_vc_xprtcopy();
SVCXPRT *svc_fd_xprtcopy();
SVCXPRT *svc_copy();
void svc_xprt_free();
void svc_xprt_destroy();
void svc_dg_xprtfree();
void svc_vc_xprtfree();
void svc_fd_xprtfree();
void svc_door_xprtfree();
void svc_args_done();
void _svc_dg_destroy_private();
void _svc_vc_destroy_private();
void _svc_destroy_private();

#define	RPC_DOOR_DIR		"/var/run/rpc_door"
#define	RPC_DOOR_RENDEZVOUS	"/var/run/rpc_door/rpc_%d.%d"

#ifdef __cplusplus
}
#endif

#endif /* !_RPC_SVC_MT_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 1983, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright (c) 2012 by Delphix. All rights reserved.
 * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
 * Copyright 2012 Marcel Telka <marcel@telka.sk>
 * Copyright 2018 OmniOS Community Edition (OmniOSce) Association.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

/*
 * Server side of RPC over RDMA in the kernel.
 */

#include <sys/param.h>
#include <sys/types.h>
#include <sys/user.h>
#include <sys/sysmacros.h>
#include <sys/proc.h>
#include <sys/file.h>
#include <sys/errno.h>
#include <sys/kmem.h>
#include <sys/debug.h>
#include <sys/systm.h>
#include <sys/cmn_err.h>
#include <sys/kstat.h>
#include <sys/vtrace.h>
#include <sys/debug.h>

#include <rpc/types.h>
#include <rpc/xdr.h>
#include <rpc/auth.h>
#include <rpc/clnt.h>
#include <rpc/rpc_msg.h>
#include <rpc/svc.h>
#include <rpc/rpc_rdma.h>
#include <sys/ddi.h>
#include <sys/sunddi.h>

#include <inet/common.h>
#include <inet/ip.h>
#include <inet/ip6.h>

#include <nfs/nfs.h>
#include <sys/sdt.h>

#define	SVC_RDMA_SUCCESS 0
#define	SVC_RDMA_FAIL -1

#define	SVC_CREDIT_FACTOR (0.5)

#define	MSG_IS_RPCSEC_GSS(msg)		\
	((msg)->rm_reply.rp_acpt.ar_verf.oa_flavor == RPCSEC_GSS)


uint32_t rdma_bufs_granted = RDMA_BUFS_GRANT;

/*
 * RDMA transport specific data associated with SVCMASTERXPRT
 */
struct rdma_data {
	SVCMASTERXPRT	*rd_xprt;	/* back ptr to SVCMASTERXPRT */
	struct rdma_svc_data rd_data;	/* rdma data */
	rdma_mod_t	*r_mod;		/* RDMA module containing ops ptr */
};

/*
 * Plugin connection specific data stashed away in clone SVCXPRT
 */
struct clone_rdma_data {
	bool_t		cloned;		/* xprt cloned for thread processing */
	CONN		*conn;		/* RDMA connection */
	rdma_buf_t	rpcbuf;		/* RPC req/resp buffer */
	struct clist	*cl_reply;	/* reply chunk buffer info */
	struct clist	*cl_wlist;		/* write list clist */
};


#define	MAXADDRLEN	128	/* max length for address mask */

/*
 * Routines exported through ops vector.
 */
static bool_t		svc_rdma_krecv(SVCXPRT *, mblk_t *, struct rpc_msg *);
static bool_t		svc_rdma_ksend(SVCXPRT *, struct rpc_msg *);
static bool_t		svc_rdma_kgetargs(SVCXPRT *, xdrproc_t, caddr_t);
static bool_t		svc_rdma_kfreeargs(SVCXPRT *, xdrproc_t, caddr_t);
void			svc_rdma_kdestroy(SVCMASTERXPRT *);
static int		svc_rdma_kdup(struct svc_req *, caddr_t, int,
				struct dupreq **, bool_t *);
static void		svc_rdma_kdupdone(struct dupreq *, caddr_t,
				void (*)(), int, int);
static int32_t		*svc_rdma_kgetres(SVCXPRT *, int);
static void		svc_rdma_kfreeres(SVCXPRT *);
static void		svc_rdma_kclone_destroy(SVCXPRT *);
static void		svc_rdma_kstart(SVCMASTERXPRT *);
void			svc_rdma_kstop(SVCMASTERXPRT *);
static void		svc_rdma_kclone_xprt(SVCXPRT *, SVCXPRT *);
static void		svc_rdma_ktattrs(SVCXPRT *, int, void **);

static int	svc_process_long_reply(SVCXPRT *, xdrproc_t,
			caddr_t, struct rpc_msg *, bool_t, int *,
			int *, int *, unsigned int *);

static int	svc_compose_rpcmsg(SVCXPRT *, CONN *, xdrproc_t,
			caddr_t, rdma_buf_t *, XDR **, struct rpc_msg *,
			bool_t, uint_t *);
static bool_t rpcmsg_length(xdrproc_t,
		caddr_t,
		struct rpc_msg *, bool_t, int);

/*
 * Server transport operations vector.
 */
struct svc_ops rdma_svc_ops = {
	svc_rdma_krecv,		/* Get requests */
	svc_rdma_kgetargs,	/* Deserialize arguments */
	svc_rdma_ksend,		/* Send reply */
	svc_rdma_kfreeargs,	/* Free argument data space */
	svc_rdma_kdestroy,	/* Destroy transport handle */
	svc_rdma_kdup,		/* Check entry in dup req cache */
	svc_rdma_kdupdone,	/* Mark entry in dup req cache as done */
	svc_rdma_kgetres,	/* Get pointer to response buffer */
	svc_rdma_kfreeres,	/* Destroy pre-serialized response header */
	svc_rdma_kclone_destroy,	/* Destroy a clone xprt */
	svc_rdma_kstart,	/* Tell `ready-to-receive' to rpcmod */
	svc_rdma_kclone_xprt,	/* Transport specific clone xprt */
	svc_rdma_ktattrs,	/* Get Transport Attributes */
	NULL,			/* Increment transport reference count */
	NULL			/* Decrement transport reference count */
};

/*
 * Server statistics
 * NOTE: This structure type is duplicated in the NFS fast path.
 */
struct {
	kstat_named_t	rscalls;
	kstat_named_t	rsbadcalls;
	kstat_named_t	rsnullrecv;
	kstat_named_t	rsbadlen;
	kstat_named_t	rsxdrcall;
	kstat_named_t	rsdupchecks;
	kstat_named_t	rsdupreqs;
	kstat_named_t	rslongrpcs;
	kstat_named_t	rstotalreplies;
	kstat_named_t	rstotallongreplies;
	kstat_named_t	rstotalinlinereplies;
} rdmarsstat = {
	{ "calls",	KSTAT_DATA_UINT64 },
	{ "badcalls",	KSTAT_DATA_UINT64 },
	{ "nullrecv",	KSTAT_DATA_UINT64 },
	{ "badlen",	KSTAT_DATA_UINT64 },
	{ "xdrcall",	KSTAT_DATA_UINT64 },
	{ "dupchecks",	KSTAT_DATA_UINT64 },
	{ "dupreqs",	KSTAT_DATA_UINT64 },
	{ "longrpcs",	KSTAT_DATA_UINT64 },
	{ "totalreplies",	KSTAT_DATA_UINT64 },
	{ "totallongreplies",	KSTAT_DATA_UINT64 },
	{ "totalinlinereplies",	KSTAT_DATA_UINT64 },
};

kstat_named_t *rdmarsstat_ptr = (kstat_named_t *)&rdmarsstat;
uint_t rdmarsstat_ndata = sizeof (rdmarsstat) / sizeof (kstat_named_t);

#define	RSSTAT_INCR(x)	atomic_inc_64(&rdmarsstat.x.value.ui64)
/*
 * Create a transport record.
 * The transport record, output buffer, and private data structure
 * are allocated.  The output buffer is serialized into using xdrmem.
 * There is one transport record per user process which implements a
 * set of services.
 */
/* ARGSUSED */
int
svc_rdma_kcreate(char *netid, SVC_CALLOUT_TABLE *sct, int id,
    rdma_xprt_group_t *started_xprts)
{
	int error;
	SVCMASTERXPRT *xprt;
	struct rdma_data *rd;
	rdma_registry_t *rmod;
	rdma_xprt_record_t *xprt_rec;
	queue_t	*q;
	/*
	 * modload the RDMA plugins is not already done.
	 */
	if (!rdma_modloaded) {
		/*CONSTANTCONDITION*/
		ASSERT(sizeof (struct clone_rdma_data) <= SVC_P2LEN);

		mutex_enter(&rdma_modload_lock);
		if (!rdma_modloaded) {
			error = rdma_modload();
		}
		mutex_exit(&rdma_modload_lock);

		if (error)
			return (error);
	}

	/*
	 * master_xprt_count is the count of master transport handles
	 * that were successfully created and are ready to recieve for
	 * RDMA based access.
	 */
	error = 0;
	xprt_rec = NULL;
	rw_enter(&rdma_lock, RW_READER);
	if (rdma_mod_head == NULL) {
		started_xprts->rtg_count = 0;
		rw_exit(&rdma_lock);
		if (rdma_dev_available)
			return (EPROTONOSUPPORT);
		else
			return (ENODEV);
	}

	/*
	 * If we have reached here, then atleast one RDMA plugin has loaded.
	 * Create a master_xprt, make it start listenining on the device,
	 * if an error is generated, record it, we might need to shut
	 * the master_xprt.
	 * SVC_START() calls svc_rdma_kstart which calls plugin binding
	 * routines.
	 */
	for (rmod = rdma_mod_head; rmod != NULL; rmod = rmod->r_next) {

		/*
		 * One SVCMASTERXPRT per RDMA plugin.
		 */
		xprt = kmem_zalloc(sizeof (*xprt), KM_SLEEP);
		xprt->xp_ops = &rdma_svc_ops;
		xprt->xp_sct = sct;
		xprt->xp_type = T_RDMA;
		mutex_init(&xprt->xp_req_lock, NULL, MUTEX_DEFAULT, NULL);
		mutex_init(&xprt->xp_thread_lock, NULL, MUTEX_DEFAULT, NULL);
		xprt->xp_req_head = (mblk_t *)0;
		xprt->xp_req_tail = (mblk_t *)0;
		xprt->xp_full = FALSE;
		xprt->xp_enable = FALSE;
		xprt->xp_reqs = 0;
		xprt->xp_size = 0;
		xprt->xp_threads = 0;
		xprt->xp_detached_threads = 0;

		rd = kmem_zalloc(sizeof (*rd), KM_SLEEP);
		xprt->xp_p2 = (caddr_t)rd;
		rd->rd_xprt = xprt;
		rd->r_mod = rmod->r_mod;

		q = &rd->rd_data.q;
		xprt->xp_wq = q;
		q->q_ptr = &rd->rd_xprt;
		xprt->xp_netid = NULL;

		/*
		 * Each of the plugins will have their own Service ID
		 * to listener specific mapping, like port number for VI
		 * and service name for IB.
		 */
		rd->rd_data.svcid = id;
		error = svc_xprt_register(xprt, id);
		if (error) {
			DTRACE_PROBE(krpc__e__svcrdma__xprt__reg);
			goto cleanup;
		}

		SVC_START(xprt);
		if (!rd->rd_data.active) {
			svc_xprt_unregister(xprt);
			error = rd->rd_data.err_code;
			goto cleanup;
		}

		/*
		 * This is set only when there is atleast one or more
		 * transports successfully created. We insert the pointer
		 * to the created RDMA master xprt into a separately maintained
		 * list. This way we can easily reference it later to cleanup,
		 * when NFS kRPC service pool is going away/unregistered.
		 */
		started_xprts->rtg_count ++;
		xprt_rec = kmem_alloc(sizeof (*xprt_rec), KM_SLEEP);
		xprt_rec->rtr_xprt_ptr = xprt;
		xprt_rec->rtr_next = started_xprts->rtg_listhead;
		started_xprts->rtg_listhead = xprt_rec;
		continue;
cleanup:
		SVC_DESTROY(xprt);
		if (error == RDMA_FAILED)
			error = EPROTONOSUPPORT;
	}

	rw_exit(&rdma_lock);

	/*
	 * Don't return any error even if a single plugin was started
	 * successfully.
	 */
	if (started_xprts->rtg_count == 0)
		return (error);
	return (0);
}

/*
 * Cleanup routine for freeing up memory allocated by
 * svc_rdma_kcreate()
 */
void
svc_rdma_kdestroy(SVCMASTERXPRT *xprt)
{
	struct rdma_data *rd = (struct rdma_data *)xprt->xp_p2;


	mutex_destroy(&xprt->xp_req_lock);
	mutex_destroy(&xprt->xp_thread_lock);
	kmem_free(rd, sizeof (*rd));
	kmem_free(xprt, sizeof (*xprt));
}


static void
svc_rdma_kstart(SVCMASTERXPRT *xprt)
{
	struct rdma_svc_data *svcdata;
	rdma_mod_t *rmod;

	svcdata = &((struct rdma_data *)xprt->xp_p2)->rd_data;
	rmod = ((struct rdma_data *)xprt->xp_p2)->r_mod;

	/*
	 * Create a listener for  module at this port
	 */

	if (rmod->rdma_count != 0)
		(*rmod->rdma_ops->rdma_svc_listen)(svcdata);
	else
		svcdata->err_code = RDMA_FAILED;
}

void
svc_rdma_kstop(SVCMASTERXPRT *xprt)
{
	struct rdma_svc_data *svcdata;
	rdma_mod_t *rmod;

	svcdata	= &((struct rdma_data *)xprt->xp_p2)->rd_data;
	rmod = ((struct rdma_data *)xprt->xp_p2)->r_mod;

	/*
	 * Call the stop listener routine for each plugin. If rdma_count is
	 * already zero set active to zero.
	 */
	if (rmod->rdma_count != 0)
		(*rmod->rdma_ops->rdma_svc_stop)(svcdata);
	else
		svcdata->active = 0;
	if (svcdata->active)
		DTRACE_PROBE(krpc__e__svcrdma__kstop);
}

/* ARGSUSED */
static void
svc_rdma_kclone_destroy(SVCXPRT *clone_xprt)
{

	struct clone_rdma_data *cdrp;
	cdrp = (struct clone_rdma_data *)clone_xprt->xp_p2buf;

	/*
	 * Only free buffers and release connection when cloned is set.
	 */
	if (cdrp->cloned != TRUE)
		return;

	rdma_buf_free(cdrp->conn, &cdrp->rpcbuf);
	if (cdrp->cl_reply) {
		clist_free(cdrp->cl_reply);
		cdrp->cl_reply = NULL;
	}
	RDMA_REL_CONN(cdrp->conn);

	cdrp->cloned = 0;
}

/*
 * Clone the xprt specific information.  It will be freed by
 * SVC_CLONE_DESTROY.
 */
static void
svc_rdma_kclone_xprt(SVCXPRT *src_xprt, SVCXPRT *dst_xprt)
{
	struct clone_rdma_data *srcp2;
	struct clone_rdma_data *dstp2;

	srcp2 = (struct clone_rdma_data *)src_xprt->xp_p2buf;
	dstp2 = (struct clone_rdma_data *)dst_xprt->xp_p2buf;

	if (srcp2->conn != NULL) {
		srcp2->cloned = TRUE;
		*dstp2 = *srcp2;
	}
}

static void
svc_rdma_ktattrs(SVCXPRT *clone_xprt, int attrflag, void **tattr)
{
	CONN	*conn;
	*tattr = NULL;

	switch (attrflag) {
	case SVC_TATTR_ADDRMASK:
		conn = ((struct clone_rdma_data *)clone_xprt->xp_p2buf)->conn;
		ASSERT(conn != NULL);
		if (conn)
			*tattr = (void *)&conn->c_addrmask;
	}
}

static bool_t
svc_rdma_krecv(SVCXPRT *clone_xprt, mblk_t *mp, struct rpc_msg *msg)
{
	XDR	*xdrs;
	CONN	*conn;
	rdma_recv_data_t	*rdp = (rdma_recv_data_t *)mp->b_rptr;
	struct clone_rdma_data *crdp;
	struct clist	*cl = NULL;
	struct clist	*wcl = NULL;
	struct clist	*cllong = NULL;

	rdma_stat	status;
	uint32_t vers, op, pos, xid;
	uint32_t rdma_credit;
	uint32_t wcl_total_length = 0;
	bool_t	wwl = FALSE;

	crdp = (struct clone_rdma_data *)clone_xprt->xp_p2buf;
	RSSTAT_INCR(rscalls);
	conn = rdp->conn;

	status = rdma_svc_postrecv(conn);
	if (status != RDMA_SUCCESS) {
		DTRACE_PROBE(krpc__e__svcrdma__krecv__postrecv);
		goto badrpc_call;
	}

	xdrs = &clone_xprt->xp_xdrin;
	xdrmem_create(xdrs, rdp->rpcmsg.addr, rdp->rpcmsg.len, XDR_DECODE);
	xid = *(uint32_t *)rdp->rpcmsg.addr;
	XDR_SETPOS(xdrs, sizeof (uint32_t));

	if (! xdr_u_int(xdrs, &vers) ||
	    ! xdr_u_int(xdrs, &rdma_credit) ||
	    ! xdr_u_int(xdrs, &op)) {
		DTRACE_PROBE(krpc__e__svcrdma__krecv__uint);
		goto xdr_err;
	}

	/* Checking if the status of the recv operation was normal */
	if (rdp->status != 0) {
		DTRACE_PROBE1(krpc__e__svcrdma__krecv__invalid__status,
		    int, rdp->status);
		goto badrpc_call;
	}

	if (! xdr_do_clist(xdrs, &cl)) {
		DTRACE_PROBE(krpc__e__svcrdma__krecv__do__clist);
		goto xdr_err;
	}

	if (!xdr_decode_wlist_svc(xdrs, &wcl, &wwl, &wcl_total_length, conn)) {
		DTRACE_PROBE(krpc__e__svcrdma__krecv__decode__wlist);
		if (cl)
			clist_free(cl);
		goto xdr_err;
	}
	crdp->cl_wlist = wcl;

	crdp->cl_reply = NULL;
	(void) xdr_decode_reply_wchunk(xdrs, &crdp->cl_reply);

	/*
	 * A chunk at 0 offset indicates that the RPC call message
	 * is in a chunk. Get the RPC call message chunk.
	 */
	if (cl != NULL && op == RDMA_NOMSG) {

		/* Remove RPC call message chunk from chunklist */
		cllong = cl;
		cl = cl->c_next;
		cllong->c_next = NULL;


		/* Allocate and register memory for the RPC call msg chunk */
		cllong->rb_longbuf.type = RDMA_LONG_BUFFER;
		cllong->rb_longbuf.len = cllong->c_len > LONG_REPLY_LEN ?
		    cllong->c_len : LONG_REPLY_LEN;

		if (rdma_buf_alloc(conn, &cllong->rb_longbuf)) {
			clist_free(cllong);
			goto cll_malloc_err;
		}

		cllong->u.c_daddr3 = cllong->rb_longbuf.addr;

		if (cllong->u.c_daddr == 0) {
			DTRACE_PROBE(krpc__e__svcrdma__krecv__nomem);
			rdma_buf_free(conn, &cllong->rb_longbuf);
			clist_free(cllong);
			goto cll_malloc_err;
		}

		status = clist_register(conn, cllong, CLIST_REG_DST);
		if (status) {
			DTRACE_PROBE(krpc__e__svcrdma__krecv__clist__reg);
			rdma_buf_free(conn, &cllong->rb_longbuf);
			clist_free(cllong);
			goto cll_malloc_err;
		}

		/*
		 * Now read the RPC call message in
		 */
		status = RDMA_READ(conn, cllong, WAIT);
		if (status) {
			DTRACE_PROBE(krpc__e__svcrdma__krecv__read);
			(void) clist_deregister(conn, cllong);
			rdma_buf_free(conn, &cllong->rb_longbuf);
			clist_free(cllong);
			goto cll_malloc_err;
		}

		status = clist_syncmem(conn, cllong, CLIST_REG_DST);
		(void) clist_deregister(conn, cllong);

		xdrrdma_create(xdrs, (caddr_t)(uintptr_t)cllong->u.c_daddr3,
		    cllong->c_len, 0, cl, XDR_DECODE, conn);

		crdp->rpcbuf = cllong->rb_longbuf;
		crdp->rpcbuf.len = cllong->c_len;
		clist_free(cllong);
		RDMA_BUF_FREE(conn, &rdp->rpcmsg);
	} else {
		pos = XDR_GETPOS(xdrs);
		xdrrdma_create(xdrs, rdp->rpcmsg.addr + pos,
		    rdp->rpcmsg.len - pos, 0, cl, XDR_DECODE, conn);
		crdp->rpcbuf = rdp->rpcmsg;

		/* Use xdrrdmablk_ops to indicate there is a read chunk list */
		if (cl != NULL) {
			int32_t flg = XDR_RDMA_RLIST_REG;

			XDR_CONTROL(xdrs, XDR_RDMA_SET_FLAGS, &flg);
			xdrs->x_ops = &xdrrdmablk_ops;
		}
	}

	if (crdp->cl_wlist) {
		int32_t flg = XDR_RDMA_WLIST_REG;

		XDR_CONTROL(xdrs, XDR_RDMA_SET_WLIST, crdp->cl_wlist);
		XDR_CONTROL(xdrs, XDR_RDMA_SET_FLAGS, &flg);
	}

	if (! xdr_callmsg(xdrs, msg)) {
		DTRACE_PROBE(krpc__e__svcrdma__krecv__callmsg);
		RSSTAT_INCR(rsxdrcall);
		goto callmsg_err;
	}

	/*
	 * Point the remote transport address in the service_transport
	 * handle at the address in the request.
	 */
	clone_xprt->xp_rtaddr.buf = conn->c_raddr.buf;
	clone_xprt->xp_rtaddr.len = conn->c_raddr.len;
	clone_xprt->xp_rtaddr.maxlen = conn->c_raddr.len;

	clone_xprt->xp_lcladdr.buf = conn->c_laddr.buf;
	clone_xprt->xp_lcladdr.len = conn->c_laddr.len;
	clone_xprt->xp_lcladdr.maxlen = conn->c_laddr.len;

	/*
	 * In case of RDMA, connection management is
	 * entirely done in rpcib module and netid in the
	 * SVCMASTERXPRT is NULL. Initialize the clone netid
	 * from the connection.
	 */

	clone_xprt->xp_netid = conn->c_netid;

	clone_xprt->xp_xid = xid;
	crdp->conn = conn;

	freeb(mp);

	return (TRUE);

callmsg_err:
	rdma_buf_free(conn, &crdp->rpcbuf);

cll_malloc_err:
	if (cl)
		clist_free(cl);
xdr_err:
	XDR_DESTROY(xdrs);

badrpc_call:
	RDMA_BUF_FREE(conn, &rdp->rpcmsg);
	RDMA_REL_CONN(conn);
	freeb(mp);
	RSSTAT_INCR(rsbadcalls);
	return (FALSE);
}

static int
svc_process_long_reply(SVCXPRT * clone_xprt,
    xdrproc_t xdr_results, caddr_t xdr_location,
    struct rpc_msg *msg, bool_t has_args, int *msglen,
    int *freelen, int *numchunks, unsigned int *final_len)
{
	int status;
	XDR xdrslong;
	struct clist *wcl = NULL;
	int count = 0;
	int alloc_len;
	char  *memp;
	rdma_buf_t long_rpc = {0};
	struct clone_rdma_data *crdp;

	crdp = (struct clone_rdma_data *)clone_xprt->xp_p2buf;

	bzero(&xdrslong, sizeof (xdrslong));

	/* Choose a size for the long rpc response */
	if (MSG_IS_RPCSEC_GSS(msg)) {
		alloc_len = RNDUP(MAX_AUTH_BYTES + *msglen);
	} else {
		alloc_len = RNDUP(*msglen);
	}

	if (alloc_len <= 64 * 1024) {
		if (alloc_len > 32 * 1024) {
			alloc_len = 64 * 1024;
		} else {
			if (alloc_len > 16 * 1024) {
				alloc_len = 32 * 1024;
			} else {
				alloc_len = 16 * 1024;
			}
		}
	}

	long_rpc.type = RDMA_LONG_BUFFER;
	long_rpc.len = alloc_len;
	if (rdma_buf_alloc(crdp->conn, &long_rpc)) {
		return (SVC_RDMA_FAIL);
	}

	memp = long_rpc.addr;
	xdrmem_create(&xdrslong, memp, alloc_len, XDR_ENCODE);

	msg->rm_xid = clone_xprt->xp_xid;

	if (!(xdr_replymsg(&xdrslong, msg) &&
	    (!has_args || SVCAUTH_WRAP(&clone_xprt->xp_auth, &xdrslong,
	    xdr_results, xdr_location)))) {
		rdma_buf_free(crdp->conn, &long_rpc);
		DTRACE_PROBE(krpc__e__svcrdma__longrep__authwrap);
		return (SVC_RDMA_FAIL);
	}

	*final_len = XDR_GETPOS(&xdrslong);

	DTRACE_PROBE1(krpc__i__replylen, uint_t, *final_len);
	*numchunks = 0;
	*freelen = 0;

	wcl = crdp->cl_reply;
	wcl->rb_longbuf = long_rpc;

	count = *final_len;
	while ((wcl != NULL) && (count > 0)) {

		if (wcl->c_dmemhandle.mrc_rmr == 0)
			break;

		DTRACE_PROBE2(krpc__i__write__chunks, uint32_t, count,
		    uint32_t, wcl->c_len);

		if (wcl->c_len > count) {
			wcl->c_len = count;
		}
		wcl->w.c_saddr3 = (caddr_t)memp;

		count -= wcl->c_len;
		*numchunks +=  1;
		memp += wcl->c_len;
		wcl = wcl->c_next;
	}

	/*
	 * Make rest of the chunks 0-len
	 */
	while (wcl != NULL) {
		if (wcl->c_dmemhandle.mrc_rmr == 0)
			break;
		wcl->c_len = 0;
		wcl = wcl->c_next;
	}

	wcl = crdp->cl_reply;

	/*
	 * MUST fail if there are still more data
	 */
	if (count > 0) {
		rdma_buf_free(crdp->conn, &long_rpc);
		DTRACE_PROBE(krpc__e__svcrdma__longrep__dlen__clist);
		return (SVC_RDMA_FAIL);
	}

	if (clist_register(crdp->conn, wcl, CLIST_REG_SOURCE) != RDMA_SUCCESS) {
		rdma_buf_free(crdp->conn, &long_rpc);
		DTRACE_PROBE(krpc__e__svcrdma__longrep__clistreg);
		return (SVC_RDMA_FAIL);
	}

	status = clist_syncmem(crdp->conn, wcl, CLIST_REG_SOURCE);

	if (status) {
		(void) clist_deregister(crdp->conn, wcl);
		rdma_buf_free(crdp->conn, &long_rpc);
		DTRACE_PROBE(krpc__e__svcrdma__longrep__syncmem);
		return (SVC_RDMA_FAIL);
	}

	status = RDMA_WRITE(crdp->conn, wcl, WAIT);

	(void) clist_deregister(crdp->conn, wcl);
	rdma_buf_free(crdp->conn, &wcl->rb_longbuf);

	if (status != RDMA_SUCCESS) {
		DTRACE_PROBE(krpc__e__svcrdma__longrep__write);
		return (SVC_RDMA_FAIL);
	}

	return (SVC_RDMA_SUCCESS);
}


static int
svc_compose_rpcmsg(SVCXPRT * clone_xprt, CONN * conn, xdrproc_t xdr_results,
    caddr_t xdr_location, rdma_buf_t *rpcreply, XDR ** xdrs,
    struct rpc_msg *msg, bool_t has_args, uint_t *len)
{
	/*
	 * Get a pre-allocated buffer for rpc reply
	 */
	rpcreply->type = SEND_BUFFER;
	if (rdma_buf_alloc(conn, rpcreply)) {
		DTRACE_PROBE(krpc__e__svcrdma__rpcmsg__reply__nofreebufs);
		return (SVC_RDMA_FAIL);
	}

	xdrrdma_create(*xdrs, rpcreply->addr, rpcreply->len,
	    0, NULL, XDR_ENCODE, conn);

	msg->rm_xid = clone_xprt->xp_xid;

	if (has_args) {
		if (!(xdr_replymsg(*xdrs, msg) &&
		    (!has_args ||
		    SVCAUTH_WRAP(&clone_xprt->xp_auth, *xdrs,
		    xdr_results, xdr_location)))) {
			rdma_buf_free(conn, rpcreply);
			DTRACE_PROBE(
			    krpc__e__svcrdma__rpcmsg__reply__authwrap1);
			return (SVC_RDMA_FAIL);
		}
	} else {
		if (!xdr_replymsg(*xdrs, msg)) {
			rdma_buf_free(conn, rpcreply);
			DTRACE_PROBE(
			    krpc__e__svcrdma__rpcmsg__reply__authwrap2);
			return (SVC_RDMA_FAIL);
		}
	}

	*len = XDR_GETPOS(*xdrs);

	return (SVC_RDMA_SUCCESS);
}

/*
 * Send rpc reply.
 */
static bool_t
svc_rdma_ksend(SVCXPRT * clone_xprt, struct rpc_msg *msg)
{
	XDR *xdrs_rpc = &(clone_xprt->xp_xdrout);
	XDR xdrs_rhdr;
	CONN *conn = NULL;
	rdma_buf_t rbuf_resp = {0}, rbuf_rpc_resp = {0};

	struct clone_rdma_data *crdp;
	struct clist *cl_read = NULL;
	struct clist *cl_send = NULL;
	struct clist *cl_write = NULL;
	xdrproc_t xdr_results;		/* results XDR encoding function */
	caddr_t xdr_location;		/* response results pointer */

	int retval = FALSE;
	int status, msglen, num_wreply_segments = 0;
	uint32_t rdma_credit = 0;
	int freelen = 0;
	bool_t has_args;
	uint_t  final_resp_len, rdma_response_op, vers;

	bzero(&xdrs_rhdr, sizeof (XDR));
	crdp = (struct clone_rdma_data *)clone_xprt->xp_p2buf;
	conn = crdp->conn;

	/*
	 * If there is a result procedure specified in the reply message,
	 * it will be processed in the xdr_replymsg and SVCAUTH_WRAP.
	 * We need to make sure it won't be processed twice, so we null
	 * it for xdr_replymsg here.
	 */
	has_args = FALSE;
	if (msg->rm_reply.rp_stat == MSG_ACCEPTED &&
	    msg->rm_reply.rp_acpt.ar_stat == SUCCESS) {
		if ((xdr_results = msg->acpted_rply.ar_results.proc) != NULL) {
			has_args = TRUE;
			xdr_location = msg->acpted_rply.ar_results.where;
			msg->acpted_rply.ar_results.proc = xdr_void;
			msg->acpted_rply.ar_results.where = NULL;
		}
	}

	/*
	 * Given the limit on the inline response size (RPC_MSG_SZ),
	 * there is a need to make a guess as to the overall size of
	 * the response.  If the resultant size is beyond the inline
	 * size, then the server needs to use the "reply chunk list"
	 * provided by the client (if the client provided one).  An
	 * example of this type of response would be a READDIR
	 * response (e.g. a small directory read would fit in RPC_MSG_SZ
	 * and that is the preference but it may not fit)
	 *
	 * Combine the encoded size and the size of the true results
	 * and then make the decision about where to encode and send results.
	 *
	 * One important note, this calculation is ignoring the size
	 * of the encoding of the authentication overhead.  The reason
	 * for this is rooted in the complexities of access to the
	 * encoded size of RPCSEC_GSS related authentiation,
	 * integrity, and privacy.
	 *
	 * If it turns out that the encoded authentication bumps the
	 * response over the RPC_MSG_SZ limit, then it may need to
	 * attempt to encode for the reply chunk list.
	 */

	/*
	 * Calculating the "sizeof" the RPC response header and the
	 * encoded results.
	 */
	msglen = xdr_sizeof(xdr_replymsg, msg);

	if (msglen > 0) {
		RSSTAT_INCR(rstotalreplies);
	}
	if (has_args)
		msglen += xdrrdma_sizeof(xdr_results, xdr_location,
		    rdma_minchunk, NULL, NULL);

	DTRACE_PROBE1(krpc__i__svcrdma__ksend__msglen, int, msglen);

	status = SVC_RDMA_SUCCESS;

	if (msglen < RPC_MSG_SZ) {
		/*
		 * Looks like the response will fit in the inline
		 * response; let's try
		 */
		RSSTAT_INCR(rstotalinlinereplies);

		rdma_response_op = RDMA_MSG;

		status = svc_compose_rpcmsg(clone_xprt, conn, xdr_results,
		    xdr_location, &rbuf_rpc_resp, &xdrs_rpc, msg,
		    has_args, &final_resp_len);

		DTRACE_PROBE1(krpc__i__srdma__ksend__compose_status,
		    int, status);
		DTRACE_PROBE1(krpc__i__srdma__ksend__compose_len,
		    int, final_resp_len);

		if (status == SVC_RDMA_SUCCESS && crdp->cl_reply) {
			clist_free(crdp->cl_reply);
			crdp->cl_reply = NULL;
		}
	}

	/*
	 * If the encode failed (size?) or the message really is
	 * larger than what is allowed, try the response chunk list.
	 */
	if (status != SVC_RDMA_SUCCESS || msglen >= RPC_MSG_SZ) {
		/*
		 * attempting to use a reply chunk list when there
		 * isn't one won't get very far...
		 */
		if (crdp->cl_reply == NULL) {
			DTRACE_PROBE(krpc__e__svcrdma__ksend__noreplycl);
			goto out;
		}

		RSSTAT_INCR(rstotallongreplies);

		msglen = xdr_sizeof(xdr_replymsg, msg);
		msglen += xdrrdma_sizeof(xdr_results, xdr_location, 0,
		    NULL, NULL);

		status = svc_process_long_reply(clone_xprt, xdr_results,
		    xdr_location, msg, has_args, &msglen, &freelen,
		    &num_wreply_segments, &final_resp_len);

		DTRACE_PROBE1(krpc__i__svcrdma__ksend__longreplen,
		    int, final_resp_len);

		if (status != SVC_RDMA_SUCCESS) {
			DTRACE_PROBE(krpc__e__svcrdma__ksend__compose__failed);
			goto out;
		}

		rdma_response_op = RDMA_NOMSG;
	}

	DTRACE_PROBE1(krpc__i__svcrdma__ksend__rdmamsg__len,
	    int, final_resp_len);

	rbuf_resp.type = SEND_BUFFER;
	if (rdma_buf_alloc(conn, &rbuf_resp)) {
		rdma_buf_free(conn, &rbuf_rpc_resp);
		DTRACE_PROBE(krpc__e__svcrdma__ksend__nofreebufs);
		goto out;
	}

	rdma_credit = rdma_bufs_granted;

	vers = RPCRDMA_VERS;
	xdrmem_create(&xdrs_rhdr, rbuf_resp.addr, rbuf_resp.len, XDR_ENCODE);
	(*(uint32_t *)rbuf_resp.addr) = msg->rm_xid;
	/* Skip xid and set the xdr position accordingly. */
	XDR_SETPOS(&xdrs_rhdr, sizeof (uint32_t));
	if (!xdr_u_int(&xdrs_rhdr, &vers) ||
	    !xdr_u_int(&xdrs_rhdr, &rdma_credit) ||
	    !xdr_u_int(&xdrs_rhdr, &rdma_response_op)) {
		rdma_buf_free(conn, &rbuf_rpc_resp);
		rdma_buf_free(conn, &rbuf_resp);
		DTRACE_PROBE(krpc__e__svcrdma__ksend__uint);
		goto out;
	}

	/*
	 * Now XDR the read chunk list, actually always NULL
	 */
	(void) xdr_encode_rlist_svc(&xdrs_rhdr, cl_read);

	/*
	 * encode write list -- we already drove RDMA_WRITEs
	 */
	cl_write = crdp->cl_wlist;
	if (!xdr_encode_wlist(&xdrs_rhdr, cl_write)) {
		DTRACE_PROBE(krpc__e__svcrdma__ksend__enc__wlist);
		rdma_buf_free(conn, &rbuf_rpc_resp);
		rdma_buf_free(conn, &rbuf_resp);
		goto out;
	}

	/*
	 * XDR encode the RDMA_REPLY write chunk
	 */
	if (!xdr_encode_reply_wchunk(&xdrs_rhdr, crdp->cl_reply,
	    num_wreply_segments)) {
		rdma_buf_free(conn, &rbuf_rpc_resp);
		rdma_buf_free(conn, &rbuf_resp);
		goto out;
	}

	clist_add(&cl_send, 0, XDR_GETPOS(&xdrs_rhdr), &rbuf_resp.handle,
	    rbuf_resp.addr, NULL, NULL);

	if (rdma_response_op == RDMA_MSG) {
		clist_add(&cl_send, 0, final_resp_len, &rbuf_rpc_resp.handle,
		    rbuf_rpc_resp.addr, NULL, NULL);
	}

	status = RDMA_SEND(conn, cl_send, msg->rm_xid);

	if (status == RDMA_SUCCESS) {
		retval = TRUE;
	}

out:
	/*
	 * Free up sendlist chunks
	 */
	if (cl_send != NULL)
		clist_free(cl_send);

	/*
	 * Destroy private data for xdr rdma
	 */
	if (clone_xprt->xp_xdrout.x_ops != NULL) {
		XDR_DESTROY(&(clone_xprt->xp_xdrout));
	}

	if (crdp->cl_reply) {
		clist_free(crdp->cl_reply);
		crdp->cl_reply = NULL;
	}

	/*
	 * This is completely disgusting.  If public is set it is
	 * a pointer to a structure whose first field is the address
	 * of the function to free that structure and any related
	 * stuff.  (see rrokfree in nfs_xdr.c).
	 */
	if (xdrs_rpc->x_public) {
		/* LINTED pointer alignment */
		(**((int (**)()) xdrs_rpc->x_public)) (xdrs_rpc->x_public);
	}

	if (xdrs_rhdr.x_ops != NULL) {
		XDR_DESTROY(&xdrs_rhdr);
	}

	return (retval);
}

/*
 * Deserialize arguments.
 */
static bool_t
svc_rdma_kgetargs(SVCXPRT *clone_xprt, xdrproc_t xdr_args, caddr_t args_ptr)
{
	if ((SVCAUTH_UNWRAP(&clone_xprt->xp_auth, &clone_xprt->xp_xdrin,
	    xdr_args, args_ptr)) != TRUE)
		return (FALSE);
	return (TRUE);
}

static bool_t
svc_rdma_kfreeargs(SVCXPRT *clone_xprt, xdrproc_t xdr_args,
    caddr_t args_ptr)
{
	struct clone_rdma_data *crdp;
	bool_t retval;

	/*
	 * If the cloned bit is true, then this transport specific
	 * rmda data has been duplicated into another cloned xprt. Do
	 * not free, or release the connection, it is still in use.  The
	 * buffers will be freed and the connection released later by
	 * SVC_CLONE_DESTROY().
	 */
	crdp = (struct clone_rdma_data *)clone_xprt->xp_p2buf;
	if (crdp->cloned == TRUE) {
		crdp->cloned = 0;
		return (TRUE);
	}

	/*
	 * Free the args if needed then XDR_DESTROY
	 */
	if (args_ptr) {
		XDR	*xdrs = &clone_xprt->xp_xdrin;

		xdrs->x_op = XDR_FREE;
		retval = (*xdr_args)(xdrs, args_ptr);
	}

	XDR_DESTROY(&(clone_xprt->xp_xdrin));
	rdma_buf_free(crdp->conn, &crdp->rpcbuf);
	if (crdp->cl_reply) {
		clist_free(crdp->cl_reply);
		crdp->cl_reply = NULL;
	}
	RDMA_REL_CONN(crdp->conn);

	return (retval);
}

/* ARGSUSED */
static int32_t *
svc_rdma_kgetres(SVCXPRT *clone_xprt, int size)
{
	return (NULL);
}

/* ARGSUSED */
static void
svc_rdma_kfreeres(SVCXPRT *clone_xprt)
{
}

/*
 * the dup cacheing routines below provide a cache of non-failure
 * transaction id's.  rpc service routines can use this to detect
 * retransmissions and re-send a non-failure response.
 */

/*
 * MAXDUPREQS is the number of cached items.  It should be adjusted
 * to the service load so that there is likely to be a response entry
 * when the first retransmission comes in.
 */
#define	MAXDUPREQS	8192

/*
 * This should be appropriately scaled to MAXDUPREQS.  To produce as less as
 * possible collisions it is suggested to set this to a prime.
 */
#define	DRHASHSZ	2053

#define	XIDHASH(xid)	((xid) % DRHASHSZ)
#define	DRHASH(dr)	XIDHASH((dr)->dr_xid)
#define	REQTOXID(req)	((req)->rq_xprt->xp_xid)

static int	rdmandupreqs = 0;
int	rdmamaxdupreqs = MAXDUPREQS;
static kmutex_t rdmadupreq_lock;
static struct dupreq *rdmadrhashtbl[DRHASHSZ];
static int	rdmadrhashstat[DRHASHSZ];

static void unhash(struct dupreq *);

/*
 * rdmadrmru points to the head of a circular linked list in lru order.
 * rdmadrmru->dr_next == drlru
 */
struct dupreq *rdmadrmru;

/*
 * svc_rdma_kdup searches the request cache and returns 0 if the
 * request is not found in the cache.  If it is found, then it
 * returns the state of the request (in progress or done) and
 * the status or attributes that were part of the original reply.
 */
static int
svc_rdma_kdup(struct svc_req *req, caddr_t res, int size, struct dupreq **drpp,
    bool_t *dupcachedp)
{
	struct dupreq *dr;
	uint32_t xid;
	uint32_t drhash;
	int status;

	xid = REQTOXID(req);
	mutex_enter(&rdmadupreq_lock);
	RSSTAT_INCR(rsdupchecks);
	/*
	 * Check to see whether an entry already exists in the cache.
	 */
	dr = rdmadrhashtbl[XIDHASH(xid)];
	while (dr != NULL) {
		if (dr->dr_xid == xid &&
		    dr->dr_proc == req->rq_proc &&
		    dr->dr_prog == req->rq_prog &&
		    dr->dr_vers == req->rq_vers &&
		    dr->dr_addr.len == req->rq_xprt->xp_rtaddr.len &&
		    bcmp((caddr_t)dr->dr_addr.buf,
		    (caddr_t)req->rq_xprt->xp_rtaddr.buf,
		    dr->dr_addr.len) == 0) {
			status = dr->dr_status;
			if (status == DUP_DONE) {
				bcopy(dr->dr_resp.buf, res, size);
				if (dupcachedp != NULL)
					*dupcachedp = (dr->dr_resfree != NULL);
			} else {
				dr->dr_status = DUP_INPROGRESS;
				*drpp = dr;
			}
			RSSTAT_INCR(rsdupreqs);
			mutex_exit(&rdmadupreq_lock);
			return (status);
		}
		dr = dr->dr_chain;
	}

	/*
	 * There wasn't an entry, either allocate a new one or recycle
	 * an old one.
	 */
	if (rdmandupreqs < rdmamaxdupreqs) {
		dr = kmem_alloc(sizeof (*dr), KM_NOSLEEP);
		if (dr == NULL) {
			mutex_exit(&rdmadupreq_lock);
			return (DUP_ERROR);
		}
		dr->dr_resp.buf = NULL;
		dr->dr_resp.maxlen = 0;
		dr->dr_addr.buf = NULL;
		dr->dr_addr.maxlen = 0;
		if (rdmadrmru) {
			dr->dr_next = rdmadrmru->dr_next;
			rdmadrmru->dr_next = dr;
		} else {
			dr->dr_next = dr;
		}
		rdmandupreqs++;
	} else {
		dr = rdmadrmru->dr_next;
		while (dr->dr_status == DUP_INPROGRESS) {
			dr = dr->dr_next;
			if (dr == rdmadrmru->dr_next) {
				mutex_exit(&rdmadupreq_lock);
				return (DUP_ERROR);
			}
		}
		unhash(dr);
		if (dr->dr_resfree) {
			(*dr->dr_resfree)(dr->dr_resp.buf);
		}
	}
	dr->dr_resfree = NULL;
	rdmadrmru = dr;

	dr->dr_xid = REQTOXID(req);
	dr->dr_prog = req->rq_prog;
	dr->dr_vers = req->rq_vers;
	dr->dr_proc = req->rq_proc;
	if (dr->dr_addr.maxlen < req->rq_xprt->xp_rtaddr.len) {
		if (dr->dr_addr.buf != NULL)
			kmem_free(dr->dr_addr.buf, dr->dr_addr.maxlen);
		dr->dr_addr.maxlen = req->rq_xprt->xp_rtaddr.len;
		dr->dr_addr.buf = kmem_alloc(dr->dr_addr.maxlen, KM_NOSLEEP);
		if (dr->dr_addr.buf == NULL) {
			dr->dr_addr.maxlen = 0;
			dr->dr_status = DUP_DROP;
			mutex_exit(&rdmadupreq_lock);
			return (DUP_ERROR);
		}
	}
	dr->dr_addr.len = req->rq_xprt->xp_rtaddr.len;
	bcopy(req->rq_xprt->xp_rtaddr.buf, dr->dr_addr.buf, dr->dr_addr.len);
	if (dr->dr_resp.maxlen < size) {
		if (dr->dr_resp.buf != NULL)
			kmem_free(dr->dr_resp.buf, dr->dr_resp.maxlen);
		dr->dr_resp.maxlen = (unsigned int)size;
		dr->dr_resp.buf = kmem_alloc(size, KM_NOSLEEP);
		if (dr->dr_resp.buf == NULL) {
			dr->dr_resp.maxlen = 0;
			dr->dr_status = DUP_DROP;
			mutex_exit(&rdmadupreq_lock);
			return (DUP_ERROR);
		}
	}
	dr->dr_status = DUP_INPROGRESS;

	drhash = (uint32_t)DRHASH(dr);
	dr->dr_chain = rdmadrhashtbl[drhash];
	rdmadrhashtbl[drhash] = dr;
	rdmadrhashstat[drhash]++;
	mutex_exit(&rdmadupreq_lock);
	*drpp = dr;
	return (DUP_NEW);
}

/*
 * svc_rdma_kdupdone marks the request done (DUP_DONE or DUP_DROP)
 * and stores the response.
 */
static void
svc_rdma_kdupdone(struct dupreq *dr, caddr_t res, void (*dis_resfree)(),
    int size, int status)
{
	ASSERT(dr->dr_resfree == NULL);
	if (status == DUP_DONE) {
		bcopy(res, dr->dr_resp.buf, size);
		dr->dr_resfree = dis_resfree;
	}
	dr->dr_status = status;
}

/*
 * This routine expects that the mutex, rdmadupreq_lock, is already held.
 */
static void
unhash(struct dupreq *dr)
{
	struct dupreq *drt;
	struct dupreq *drtprev = NULL;
	uint32_t drhash;

	ASSERT(MUTEX_HELD(&rdmadupreq_lock));

	drhash = (uint32_t)DRHASH(dr);
	drt = rdmadrhashtbl[drhash];
	while (drt != NULL) {
		if (drt == dr) {
			rdmadrhashstat[drhash]--;
			if (drtprev == NULL) {
				rdmadrhashtbl[drhash] = drt->dr_chain;
			} else {
				drtprev->dr_chain = drt->dr_chain;
			}
			return;
		}
		drtprev = drt;
		drt = drt->dr_chain;
	}
}

bool_t
rdma_get_wchunk(struct svc_req *req, iovec_t *iov, struct clist *wlist)
{
	struct clist	*clist;
	uint32_t	tlen;

	if (req->rq_xprt->xp_type != T_RDMA) {
		return (FALSE);
	}

	tlen = 0;
	clist = wlist;
	while (clist) {
		tlen += clist->c_len;
		clist = clist->c_next;
	}

	/*
	 * set iov to addr+len of first segment of first wchunk of
	 * wlist sent by client.  krecv() already malloc'd a buffer
	 * large enough, but registration is deferred until we write
	 * the buffer back to (NFS) client using RDMA_WRITE.
	 */
	iov->iov_base = (caddr_t)(uintptr_t)wlist->w.c_saddr;
	iov->iov_len = tlen;

	return (TRUE);
}

/*
 * routine to setup the read chunk lists
 */

int
rdma_setup_read_chunks(struct clist *wcl, uint32_t count, int *wcl_len)
{
	int		data_len, avail_len;
	uint_t		round_len;

	data_len = avail_len = 0;

	while (wcl != NULL && count > 0) {
		if (wcl->c_dmemhandle.mrc_rmr == 0)
			break;

		if (wcl->c_len < count) {
			data_len += wcl->c_len;
			avail_len = 0;
		} else {
			data_len += count;
			avail_len = wcl->c_len - count;
			wcl->c_len = count;
		}
		count -= wcl->c_len;

		if (count == 0)
			break;

		wcl = wcl->c_next;
	}

	/*
	 * MUST fail if there are still more data
	 */
	if (count > 0) {
		DTRACE_PROBE2(krpc__e__rdma_setup_read_chunks_clist_len,
		    int, data_len, int, count);
		return (FALSE);
	}

	/*
	 * Round up the last chunk to 4-byte boundary
	 */
	*wcl_len = roundup(data_len, BYTES_PER_XDR_UNIT);
	round_len = *wcl_len - data_len;

	if (round_len) {

		/*
		 * If there is space in the current chunk,
		 * add the roundup to the chunk.
		 */
		if (avail_len >= round_len) {
			wcl->c_len += round_len;
		} else  {
			/*
			 * try the next one.
			 */
			wcl = wcl->c_next;
			if ((wcl == NULL) || (wcl->c_len < round_len)) {
				DTRACE_PROBE1(
				    krpc__e__rdma_setup_read_chunks_rndup,
				    int, round_len);
				return (FALSE);
			}
			wcl->c_len = round_len;
		}
	}

	wcl = wcl->c_next;

	/*
	 * Make rest of the chunks 0-len
	 */

	clist_zero_len(wcl);

	return (TRUE);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

/*
 * svc_soc.h, Server-side remote procedure call interface.
 *
 * All the following declarations are only for backward compatibility
 * with SUNOS 4.0.
 */

#ifndef _RPC_SVC_SOC_H
#define	_RPC_SVC_SOC_H

#ifndef _KERNEL

#include <sys/socket.h>
#include <netinet/in.h>
#include <rpc/svc.h>

#ifdef __cplusplus
extern "C" {
#endif

/*
 *  Approved way of getting address of caller
 */
#define	svc_getcaller(x)	((struct sockaddr_in *)(x)->xp_rtaddr.buf)

/*
 * Service registration and unregistration.
 *
 * svc_register(xprt, prog, vers, dispatch, protocol)
 * svc_unregister(prog, vers);
 */
#ifdef __STDC__
extern bool_t svc_register(SVCXPRT *, rpcprog_t, rpcvers_t,
    void (*)(struct svc_req *, SVCXPRT *), int);
extern void svc_unregister(rpcprog_t, rpcvers_t);

/*
 * Memory based rpc for testing and timing.
 */
extern SVCXPRT *svcraw_create(void);

/*
 * Udp based rpc. For compatibility reasons
 */
extern SVCXPRT *svcudp_create(int);
extern SVCXPRT *svcudp_bufcreate(int, uint_t, uint_t);

/*
 * Tcp based rpc.
 */
extern SVCXPRT *svctcp_create(int, uint_t, uint_t);
extern SVCXPRT *svcfd_create(int, uint_t, uint_t);

/*
 * For connectionless kind of transport. Obsoleted by rpc_reg()
 *
 * registerrpc(prognum, versnum, procnum, progname, inproc, outproc)
 *      rpcprog_t prognum;
 *      rpcvers_t versnum;
 *      rpcproc_t procnum;
 *      char *(*progname)();
 *      xdrproc_t inproc, outproc;
 */
extern int registerrpc(rpcprog_t, rpcvers_t, rpcproc_t, char *(*)(),
				xdrproc_t, xdrproc_t);
#else	/* __STDC__ */
extern bool_t svc_register();
extern void svc_unregister();
extern SVCXPRT *svcraw_create();
extern SVCXPRT *svcudp_create();
extern SVCXPRT *svcudp_bufcreate();
extern SVCXPRT *svctcp_create();
extern SVCXPRT *svcfd_create();
extern int registerrpc();
#endif	/* __STDC__ */

#ifdef __cplusplus
}
#endif
#endif	/* _KERNEL */

#endif /* !_RPC_SVC_SOC_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

#ifndef _RPC_TYPES_H
#define	_RPC_TYPES_H

/*
 * Rpc additions to <sys/types.h>
 */
#include <sys/types.h>
#include <sys/null.h>

#ifdef __cplusplus
extern "C" {
#endif

typedef int bool_t;
typedef int enum_t;

/*
 * The ulonglong_t type was introduced to workaround an rpcgen bug
 * that has been fixed, this next typedef will be removed in a future release.
 * Do *NOT* use!
 */
typedef u_longlong_t ulonglong_t;

#if defined(_LP64)
typedef	uint32_t rpcprog_t;
typedef	uint32_t rpcvers_t;
typedef	uint32_t rpcproc_t;
typedef uint32_t rpcprot_t;
typedef uint32_t rpcport_t;
typedef int32_t rpc_inline_t;
#else
typedef	unsigned long rpcprog_t;
typedef	unsigned long rpcvers_t;
typedef	unsigned long rpcproc_t;
typedef unsigned long rpcprot_t;
typedef unsigned long rpcport_t;
typedef long rpc_inline_t;
#endif


#define	__dontcare__	-1

#ifndef	FALSE
#define	FALSE	(0)
#endif

#ifndef	TRUE
#define	TRUE	(1)
#endif

#ifndef	_KERNEL
#define	mem_alloc(bsize)	malloc(bsize)
#define	mem_free(ptr, bsize)	free(ptr)
#else
#include <sys/kmem.h>		/* XXX */

#define	mem_alloc(bsize)	kmem_alloc(bsize, KM_SLEEP)
#define	mem_free(ptr, bsize)	kmem_free(ptr, bsize)

extern const char *rpc_tpiprim2name(uint_t prim);
extern const char *rpc_tpierr2name(uint_t err);

#if defined(DEBUG) && !defined(RPCDEBUG)
#define	RPCDEBUG
#endif

#ifdef RPCDEBUG
extern uint_t	rpclog;

#define	RPCLOG(A, B, C)	\
	((void)((rpclog) && (rpclog & (A)) && (printf((B), (C)), TRUE)))
#define	RPCLOG0(A, B)	\
	((void)((rpclog) && (rpclog & (A)) && (printf(B), TRUE)))
#else
#define		RPCLOG(A, B, C)
#define		RPCLOG0(A, B)
#endif

#endif

/* messaging stuff. */
#ifndef _KERNEL
#ifdef __STDC__
extern const char __nsl_dom[];
#else
extern char __nsl_dom[];
#endif
#endif

#ifdef __cplusplus
}
#endif

#include <sys/time.h>

#endif	/* _RPC_TYPES_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved  	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

/*
 * xdr.c, generic XDR routines implementation.
 * These are the "generic" xdr routines used to serialize and de-serialize
 * most common data items.  See xdr.h for more info on the interface to
 * xdr.
 */

#include <sys/param.h>
#include <sys/cmn_err.h>
#include <sys/types.h>
#include <sys/systm.h>

#include <rpc/types.h>
#include <rpc/xdr.h>
#include <sys/isa_defs.h>

#pragma weak xdr_int32_t = xdr_int
#pragma weak xdr_uint32_t = xdr_u_int
#pragma weak xdr_int64_t = xdr_longlong_t
#pragma weak xdr_uint64_t = xdr_u_longlong_t

#if !defined(_BIG_ENDIAN) && !defined(_LITTLE_ENDIAN)
#error "Exactly one of _BIG_ENDIAN or _LITTLE_ENDIAN must be defined"
#elif defined(_BIG_ENDIAN) && defined(_LITTLE_ENDIAN)
#error "Only one of _BIG_ENDIAN or _LITTLE_ENDIAN may be defined"
#endif

/*
 * constants specific to the xdr "protocol"
 */
#define	XDR_FALSE	((int32_t)0)
#define	XDR_TRUE	((int32_t)1)
#define	LASTUNSIGNED	((uint_t)0-1)

/*
 * for unit alignment
 */
static char xdr_zero[BYTES_PER_XDR_UNIT] = { 0, 0, 0, 0 };

/*
 * Free a data structure using XDR
 * Not a filter, but a convenient utility nonetheless
 */
void
xdr_free(xdrproc_t proc, char *objp)
{
	XDR x;

	x.x_op = XDR_FREE;
	(void) (*proc)(&x, objp);
}

/*
 * XDR nothing
 */
bool_t
xdr_void(void)
{
	return (TRUE);
}

/*
 * XDR integers
 *
 * PSARC 2003/523 Contract Private Interface
 * xdr_int
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
bool_t
xdr_int(XDR *xdrs, int *ip)
{
	if (xdrs->x_op == XDR_ENCODE)
		return (XDR_PUTINT32(xdrs, ip));

	if (xdrs->x_op == XDR_DECODE)
		return (XDR_GETINT32(xdrs, ip));

	if (xdrs->x_op == XDR_FREE)
		return (TRUE);

	return (FALSE);
}

/*
 * XDR unsigned integers
 *
 * PSARC 2003/523 Contract Private Interface
 * xdr_u_int
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
bool_t
xdr_u_int(XDR *xdrs, uint_t *up)
{
	if (xdrs->x_op == XDR_ENCODE)
		return (XDR_PUTINT32(xdrs, (int32_t *)up));

	if (xdrs->x_op == XDR_DECODE)
		return (XDR_GETINT32(xdrs, (int32_t *)up));

	if (xdrs->x_op == XDR_FREE)
		return (TRUE);

	return (FALSE);
}


#if defined(_ILP32)
/*
 * xdr_long and xdr_u_long for binary compatability on ILP32 kernels.
 *
 * No prototypes since new code should not be using these interfaces.
 */
bool_t
xdr_long(XDR *xdrs, long *ip)
{
	return (xdr_int(xdrs, (int *)ip));
}

bool_t
xdr_u_long(XDR *xdrs, unsigned long *up)
{
	return (xdr_u_int(xdrs, (uint_t *)up));
}
#endif /* _ILP32 */


/*
 * XDR long long integers
 */
bool_t
xdr_longlong_t(XDR *xdrs, longlong_t *hp)
{
	if (xdrs->x_op == XDR_ENCODE) {
#if defined(_LITTLE_ENDIAN)
		if (XDR_PUTINT32(xdrs, (int32_t *)((char *)hp +
		    BYTES_PER_XDR_UNIT)) == TRUE) {
			return (XDR_PUTINT32(xdrs, (int32_t *)hp));
		}
#elif defined(_BIG_ENDIAN)
		if (XDR_PUTINT32(xdrs, (int32_t *)hp) == TRUE) {
			return (XDR_PUTINT32(xdrs, (int32_t *)((char *)hp +
			    BYTES_PER_XDR_UNIT)));
		}
#endif
		return (FALSE);

	}
	if (xdrs->x_op == XDR_DECODE) {
#if defined(_LITTLE_ENDIAN)
		if (XDR_GETINT32(xdrs, (int32_t *)((char *)hp +
		    BYTES_PER_XDR_UNIT)) == TRUE) {
			return (XDR_GETINT32(xdrs, (int32_t *)hp));
		}
#elif defined(_BIG_ENDIAN)
		if (XDR_GETINT32(xdrs, (int32_t *)hp) == TRUE) {
			return (XDR_GETINT32(xdrs, (int32_t *)((char *)hp +
			    BYTES_PER_XDR_UNIT)));
		}
#endif
		return (FALSE);
	}
	return (TRUE);
}

/*
 * XDR unsigned long long integers
 */
bool_t
xdr_u_longlong_t(XDR *xdrs, u_longlong_t *hp)
{

	if (xdrs->x_op == XDR_ENCODE) {
#if defined(_LITTLE_ENDIAN)
		if (XDR_PUTINT32(xdrs, (int32_t *)((char *)hp +
		    BYTES_PER_XDR_UNIT)) == TRUE) {
			return (XDR_PUTINT32(xdrs, (int32_t *)hp));
		}
#elif defined(_BIG_ENDIAN)
		if (XDR_PUTINT32(xdrs, (int32_t *)hp) == TRUE) {
			return (XDR_PUTINT32(xdrs, (int32_t *)((char *)hp +
			    BYTES_PER_XDR_UNIT)));
		}
#endif
		return (FALSE);

	}
	if (xdrs->x_op == XDR_DECODE) {
#if defined(_LITTLE_ENDIAN)
		if (XDR_GETINT32(xdrs, (int32_t *)((char *)hp +
		    BYTES_PER_XDR_UNIT)) == TRUE) {
			return (XDR_GETINT32(xdrs, (int32_t *)hp));
		}
#elif defined(_BIG_ENDIAN)
		if (XDR_GETINT32(xdrs, (int32_t *)hp) == TRUE) {
			return (XDR_GETINT32(xdrs, (int32_t *)((char *)hp +
			    BYTES_PER_XDR_UNIT)));
		}
#endif
		return (FALSE);
	}
	return (TRUE);
}

/*
 * XDR short integers
 */
bool_t
xdr_short(XDR *xdrs, short *sp)
{
	int32_t l;

	switch (xdrs->x_op) {

	case XDR_ENCODE:
		l = (int32_t)*sp;
		return (XDR_PUTINT32(xdrs, &l));

	case XDR_DECODE:
		if (!XDR_GETINT32(xdrs, &l))
			return (FALSE);
		*sp = (short)l;
		return (TRUE);

	case XDR_FREE:
		return (TRUE);
	}
	return (FALSE);
}

/*
 * XDR unsigned short integers
 */
bool_t
xdr_u_short(XDR *xdrs, ushort_t *usp)
{
	uint32_t l;

	switch (xdrs->x_op) {

	case XDR_ENCODE:
		l = (uint32_t)*usp;
		return (XDR_PUTINT32(xdrs, (int32_t *)&l));

	case XDR_DECODE:
		if (!XDR_GETINT32(xdrs, (int32_t *)&l)) {
			return (FALSE);
		}
		*usp = (ushort_t)l;
		return (TRUE);

	case XDR_FREE:
		return (TRUE);
	}
	return (FALSE);
}


/*
 * XDR a char
 */
bool_t
xdr_char(XDR *xdrs, char *cp)
{
	int i;

	i = (*cp);
	if (!xdr_int(xdrs, &i)) {
		return (FALSE);
	}
	*cp = (char)i;
	return (TRUE);
}

/*
 * XDR an unsigned char
 */
bool_t
xdr_u_char(XDR *xdrs, uchar_t *cp)
{
	int i;

	switch (xdrs->x_op) {
	case XDR_ENCODE:
		i = (*cp);
		return (XDR_PUTINT32(xdrs, &i));
	case XDR_DECODE:
		if (!XDR_GETINT32(xdrs, &i))
			return (FALSE);
		*cp = (uchar_t)i;
		return (TRUE);
	case XDR_FREE:
		return (TRUE);
	}
	return (FALSE);
}

/*
 * XDR booleans
 *
 * PSARC 2003/523 Contract Private Interface
 * xdr_bool
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
bool_t
xdr_bool(XDR *xdrs, bool_t *bp)
{
	int32_t i32b;

	switch (xdrs->x_op) {

	case XDR_ENCODE:
		i32b = *bp ? XDR_TRUE : XDR_FALSE;
		return (XDR_PUTINT32(xdrs, &i32b));

	case XDR_DECODE:
		if (!XDR_GETINT32(xdrs, &i32b)) {
			return (FALSE);
		}
		*bp = (i32b == XDR_FALSE) ? FALSE : TRUE;
		return (TRUE);

	case XDR_FREE:
		return (TRUE);
	}
	return (FALSE);
}

/*
 * XDR enumerations
 *
 * PSARC 2003/523 Contract Private Interface
 * xdr_enum
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
#ifndef lint
enum sizecheck { SIZEVAL } sizecheckvar;	/* used to find the size of */
						/* an enum */
#endif
bool_t
xdr_enum(XDR *xdrs, enum_t *ep)
{
#ifndef lint
	/*
	 * enums are treated as ints
	 */
	if (sizeof (sizecheckvar) == sizeof (int32_t)) {
		return (xdr_int(xdrs, (int32_t *)ep));
	} else if (sizeof (sizecheckvar) == sizeof (short)) {
		return (xdr_short(xdrs, (short *)ep));
	} else {
		return (FALSE);
	}
#else
	(void) (xdr_short(xdrs, (short *)ep));
	return (xdr_int(xdrs, (int32_t *)ep));
#endif
}

/*
 * XDR opaque data
 * Allows the specification of a fixed size sequence of opaque bytes.
 * cp points to the opaque object and cnt gives the byte length.
 *
 * PSARC 2003/523 Contract Private Interface
 * xdr_opaque
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
bool_t
xdr_opaque(XDR *xdrs, caddr_t cp, const uint_t cnt)
{
	uint_t rndup;
	static char crud[BYTES_PER_XDR_UNIT];

	/*
	 * if no data we are done
	 */
	if (cnt == 0)
		return (TRUE);

	/*
	 * round byte count to full xdr units
	 */
	rndup = cnt % BYTES_PER_XDR_UNIT;
	if (rndup != 0)
		rndup = BYTES_PER_XDR_UNIT - rndup;

	if (xdrs->x_op == XDR_DECODE) {
		if (!XDR_GETBYTES(xdrs, cp, cnt)) {
			return (FALSE);
		}
		if (rndup == 0)
			return (TRUE);
		return (XDR_GETBYTES(xdrs, (caddr_t)crud, rndup));
	}

	if (xdrs->x_op == XDR_ENCODE) {
		if (!XDR_PUTBYTES(xdrs, cp, cnt)) {
			return (FALSE);
		}
		if (rndup == 0)
			return (TRUE);
		return (XDR_PUTBYTES(xdrs, xdr_zero, rndup));
	}

	if (xdrs->x_op == XDR_FREE)
		return (TRUE);

	return (FALSE);
}

/*
 * XDR counted bytes
 * *cpp is a pointer to the bytes, *sizep is the count.
 * If *cpp is NULL maxsize bytes are allocated
 *
 * PSARC 2003/523 Contract Private Interface
 * xdr_bytes
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
bool_t
xdr_bytes(XDR *xdrs, char **cpp, uint_t *sizep, const uint_t maxsize)
{
	char *sp = *cpp;  /* sp is the actual string pointer */
	uint_t nodesize;

	/*
	 * first deal with the length since xdr bytes are counted
	 */
	if (!xdr_u_int(xdrs, sizep)) {
		return (FALSE);
	}
	nodesize = *sizep;
	if ((nodesize > maxsize) && (xdrs->x_op != XDR_FREE)) {
		return (FALSE);
	}

	/*
	 * now deal with the actual bytes
	 */
	switch (xdrs->x_op) {
	case XDR_DECODE:
		if (nodesize == 0)
			return (TRUE);
		if (sp == NULL)
			*cpp = sp = (char *)mem_alloc(nodesize);
		/* FALLTHROUGH */

	case XDR_ENCODE:
		return (xdr_opaque(xdrs, sp, nodesize));

	case XDR_FREE:
		if (sp != NULL) {
			mem_free(sp, nodesize);
			*cpp = NULL;
		}
		return (TRUE);
	}
	return (FALSE);
}

/*
 * Implemented here due to commonality of the object.
 */
bool_t
xdr_netobj(XDR *xdrs, struct netobj *np)
{
	return (xdr_bytes(xdrs, &np->n_bytes, &np->n_len, MAX_NETOBJ_SZ));
}

/*
 * XDR a descriminated union
 * Support routine for discriminated unions.
 * You create an array of xdrdiscrim structures, terminated with
 * an entry with a null procedure pointer.  The routine gets
 * the discriminant value and then searches the array of xdrdiscrims
 * looking for that value.  It calls the procedure given in the xdrdiscrim
 * to handle the discriminant.  If there is no specific routine a default
 * routine may be called.
 * If there is no specific or default routine an error is returned.
 */
bool_t
xdr_union(XDR *xdrs, enum_t *dscmp, char *unp,
	const struct xdr_discrim *choices, const xdrproc_t dfault)
{
	enum_t dscm;

	/*
	 * we deal with the discriminator;  it's an enum
	 */
	if (!xdr_enum(xdrs, dscmp)) {
		return (FALSE);
	}
	dscm = *dscmp;

	/*
	 * search choices for a value that matches the discriminator.
	 * if we find one, execute the xdr routine for that value.
	 */
	for (; choices->proc != NULL_xdrproc_t; choices++) {
		if (choices->value == dscm)
			return ((*(choices->proc))(xdrs, unp, LASTUNSIGNED));
	}

	/*
	 * no match - execute the default xdr routine if there is one
	 */
	return ((dfault == NULL_xdrproc_t) ? FALSE :
	    (*dfault)(xdrs, unp, LASTUNSIGNED));
}


/*
 * Non-portable xdr primitives.
 * Care should be taken when moving these routines to new architectures.
 */


/*
 * XDR null terminated ASCII strings
 * xdr_string deals with "C strings" - arrays of bytes that are
 * terminated by a NULL character.  The parameter cpp references a
 * pointer to storage; If the pointer is null, then the necessary
 * storage is allocated.  The last parameter is the max allowed length
 * of the string as specified by a protocol.
 */
bool_t
xdr_string(XDR *xdrs, char **cpp, const uint_t maxsize)
{
	char *sp = *cpp;  /* sp is the actual string pointer */
	uint_t size;
	uint_t nodesize;

	/*
	 * first deal with the length since xdr strings are counted-strings
	 */
	switch (xdrs->x_op) {
	case XDR_FREE:
		if (sp == NULL)
			return (TRUE);	/* already free */
		/* FALLTHROUGH */
	case XDR_ENCODE:
		size = (sp != NULL) ? (uint_t)strlen(sp) : 0;
		break;
	case XDR_DECODE:
		break;
	}
	if (!xdr_u_int(xdrs, &size)) {
		return (FALSE);
	}
	if (size > maxsize) {
		return (FALSE);
	}
	nodesize = size + 1;

	/*
	 * now deal with the actual bytes
	 */
	switch (xdrs->x_op) {
	case XDR_DECODE:
		if (nodesize == 0)
			return (TRUE);
		if (sp == NULL)
			sp = (char *)mem_alloc(nodesize);
		sp[size] = 0;
		if (!xdr_opaque(xdrs, sp, size)) {
			/*
			 * free up memory if allocated here
			 */
			if (*cpp == NULL) {
				mem_free(sp, nodesize);
			}
			return (FALSE);
		}
		if (strlen(sp) != size) {
			if (*cpp == NULL) {
				mem_free(sp, nodesize);
			}
			return (FALSE);
		}
		*cpp = sp;
		return (TRUE);

	case XDR_ENCODE:
		return (xdr_opaque(xdrs, sp, size));

	case XDR_FREE:
		mem_free(sp, nodesize);
		*cpp = NULL;
		return (TRUE);
	}
	return (FALSE);
}

/*
 * xdr_vector():
 *
 * XDR a fixed length array. Unlike variable-length arrays, the storage
 * of fixed length arrays is static and unfreeable.
 * > basep: base of the array
 * > size: size of the array
 * > elemsize: size of each element
 * > xdr_elem: routine to XDR each element
 */
bool_t
xdr_vector(XDR *xdrs, char *basep, const uint_t nelem,
	const uint_t elemsize, const xdrproc_t xdr_elem)
{
	uint_t i;
	char *elptr;

	elptr = basep;
	for (i = 0; i < nelem; i++) {
		if (!(*xdr_elem)(xdrs, elptr, LASTUNSIGNED))
			return (FALSE);
		elptr += elemsize;
	}
	return (TRUE);
}

/*
 * Wrapper for xdr_string that can be called directly from
 * routines like clnt_call
 */
bool_t
xdr_wrapstring(XDR *xdrs, char **cpp)
{
	if (xdr_string(xdrs, cpp, LASTUNSIGNED))
		return (TRUE);
	return (FALSE);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2016 Nexenta Systems, Inc.  All rights reserved.
 */

/*
 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

/*
 * xdr.h, External Data Representation Serialization Routines.
 *
 */

#ifndef _RPC_XDR_H
#define	_RPC_XDR_H

#include <sys/byteorder.h>	/* For all ntoh* and hton*() kind of macros */
#include <rpc/types.h>	/* For all ntoh* and hton*() kind of macros */
#if !defined(_KERNEL) && !defined(_FAKE_KERNEL)
#include <stdio.h> /* defines FILE *, used in ANSI C function prototypes */
#else	/* _KERNEL */
#include <sys/stream.h>
#endif	/* _KERNEL */

#ifdef __cplusplus
extern "C" {
#endif

/*
 * XDR provides a conventional way for converting between C data
 * types and an external bit-string representation.  Library supplied
 * routines provide for the conversion on built-in C data types.  These
 * routines and utility routines defined here are used to help implement
 * a type encode/decode routine for each user-defined type.
 *
 * Each data type provides a single procedure which takes two arguments:
 *
 *	bool_t
 *	xdrproc(xdrs, argresp)
 *		XDR *xdrs;
 *		<type> *argresp;
 *
 * xdrs is an instance of a XDR handle, to which or from which the data
 * type is to be converted.  argresp is a pointer to the structure to be
 * converted.  The XDR handle contains an operation field which indicates
 * which of the operations (ENCODE, DECODE * or FREE) is to be performed.
 *
 * XDR_DECODE may allocate space if the pointer argresp is null.  This
 * data can be freed with the XDR_FREE operation.
 *
 * We write only one procedure per data type to make it easy
 * to keep the encode and decode procedures for a data type consistent.
 * In many cases the same code performs all operations on a user defined type,
 * because all the hard work is done in the component type routines.
 * decode as a series of calls on the nested data types.
 */

/*
 * Xdr operations.  XDR_ENCODE causes the type to be encoded into the
 * stream.  XDR_DECODE causes the type to be extracted from the stream.
 * XDR_FREE can be used to release the space allocated by an XDR_DECODE
 * request.
 */
enum xdr_op {
	XDR_ENCODE = 0,
	XDR_DECODE = 1,
	XDR_FREE = 2
};

/*
 * This is the number of bytes per unit of external data.
 */
#define	BYTES_PER_XDR_UNIT	(4)
#define	RNDUP(x)  ((((x) + BYTES_PER_XDR_UNIT - 1) / BYTES_PER_XDR_UNIT) \
		    * BYTES_PER_XDR_UNIT)

/*
 * The XDR handle.
 * Contains operation which is being applied to the stream,
 * an operations vector for the paticular implementation (e.g. see xdr_mem.c),
 * and two private fields for the use of the particular impelementation.
 *
 * PSARC 2003/523 Contract Private Interface
 * XDR
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
typedef struct XDR {
	enum xdr_op	x_op;	/* operation; fast additional param */
	struct xdr_ops *x_ops;
	caddr_t		x_public; /* users' data */
	caddr_t		x_private; /* pointer to private data */
	caddr_t		x_base;	/* private used for position info */
	int		x_handy; /* extra private word */
} XDR;

/*
 * PSARC 2003/523 Contract Private Interface
 * xdr_ops
 * Changes must be reviewed by Solaris File Sharing
 * Changes must be communicated to contract-2003-523@sun.com
 */
struct xdr_ops {
#ifdef __STDC__
#if !defined(_KERNEL)
		bool_t	(*x_getlong)(struct XDR *, long *);
		/* get a long from underlying stream */
		bool_t	(*x_putlong)(struct XDR *, long *);
		/* put a long to " */
#endif /* KERNEL */
		bool_t	(*x_getbytes)(struct XDR *, caddr_t, int);
		/* get some bytes from " */
		bool_t	(*x_putbytes)(struct XDR *, caddr_t, int);
		/* put some bytes to " */
		uint_t	(*x_getpostn)(struct XDR *);
		/* returns bytes off from beginning */
		bool_t  (*x_setpostn)(struct XDR *, uint_t);
		/* lets you reposition the stream */
		rpc_inline_t *(*x_inline)(struct XDR *, int);
		/* buf quick ptr to buffered data */
		void	(*x_destroy)(struct XDR *);
		/* free privates of this xdr_stream */
		bool_t	(*x_control)(struct XDR *, int, void *);
#if defined(_LP64) || defined(_KERNEL)
		bool_t	(*x_getint32)(struct XDR *, int32_t *);
		/* get a int from underlying stream */
		bool_t	(*x_putint32)(struct XDR *, int32_t *);
		/* put an int to " */
#endif /* _LP64 || _KERNEL */
#else
#if !defined(_KERNEL)
		bool_t	(*x_getlong)();	/* get a long from underlying stream */
		bool_t	(*x_putlong)();	/* put a long to " */
#endif /* KERNEL */
		bool_t	(*x_getbytes)(); /* get some bytes from " */
		bool_t	(*x_putbytes)(); /* put some bytes to " */
		uint_t	(*x_getpostn)(); /* returns bytes off from beginning */
		bool_t  (*x_setpostn)(); /* lets you reposition the stream */
		rpc_inline_t *(*x_inline)();
				/* buf quick ptr to buffered data */
		void	(*x_destroy)();	/* free privates of this xdr_stream */
		bool_t	(*x_control)();
#if defined(_LP64) || defined(_KERNEL)
		bool_t	(*x_getint32)();
		bool_t	(*x_putint32)();
#endif /* _LP64 || defined(_KERNEL) */
#endif
};

/*
 * Operations defined on a XDR handle
 *
 * XDR		*xdrs;
 * long		*longp;
 * caddr_t	 addr;
 * uint_t	 len;
 * uint_t	 pos;
 */
#if !defined(_KERNEL)
#define	XDR_GETLONG(xdrs, longp)			\
	(*(xdrs)->x_ops->x_getlong)(xdrs, longp)
#define	xdr_getlong(xdrs, longp)			\
	(*(xdrs)->x_ops->x_getlong)(xdrs, longp)

#define	XDR_PUTLONG(xdrs, longp)			\
	(*(xdrs)->x_ops->x_putlong)(xdrs, longp)
#define	xdr_putlong(xdrs, longp)			\
	(*(xdrs)->x_ops->x_putlong)(xdrs, longp)
#endif /* KERNEL */


#if !defined(_LP64) && !defined(_KERNEL)

/*
 * For binary compatability on ILP32 we do not change the shape
 * of the XDR structure and the GET/PUTINT32 functions just use
 * the get/putlong vectors which operate on identically-sized
 * units of data.
 */

#define	XDR_GETINT32(xdrs, int32p)			\
	(*(xdrs)->x_ops->x_getlong)(xdrs, (long *)int32p)
#define	xdr_getint32(xdrs, int32p)			\
	(*(xdrs)->x_ops->x_getlong)(xdrs, (long *)int32p)

#define	XDR_PUTINT32(xdrs, int32p)			\
	(*(xdrs)->x_ops->x_putlong)(xdrs, (long *)int32p)
#define	xdr_putint32(xdrs, int32p)			\
	(*(xdrs)->x_ops->x_putlong)(xdrs, (long *)int32p)

#else /* !_LP64 && !_KERNEL */

#define	XDR_GETINT32(xdrs, int32p)			\
	(*(xdrs)->x_ops->x_getint32)(xdrs, int32p)
#define	xdr_getint32(xdrs, int32p)			\
	(*(xdrs)->x_ops->x_getint32)(xdrs, int32p)

#define	XDR_PUTINT32(xdrs, int32p)			\
	(*(xdrs)->x_ops->x_putint32)(xdrs, int32p)
#define	xdr_putint32(xdrs, int32p)			\
	(*(xdrs)->x_ops->x_putint32)(xdrs, int32p)

#endif /* !_LP64 && !_KERNEL */

#define	XDR_GETBYTES(xdrs, addr, len)			\
	(*(xdrs)->x_ops->x_getbytes)(xdrs, addr, len)
#define	xdr_getbytes(xdrs, addr, len)			\
	(*(xdrs)->x_ops->x_getbytes)(xdrs, addr, len)

#define	XDR_PUTBYTES(xdrs, addr, len)			\
	(*(xdrs)->x_ops->x_putbytes)(xdrs, addr, len)
#define	xdr_putbytes(xdrs, addr, len)			\
	(*(xdrs)->x_ops->x_putbytes)(xdrs, addr, len)

#define	XDR_GETPOS(xdrs)				\
	(*(xdrs)->x_ops->x_getpostn)(xdrs)
#define	xdr_getpos(xdrs)				\
	(*(xdrs)->x_ops->x_getpostn)(xdrs)

#define	XDR_SETPOS(xdrs, pos)				\
	(*(xdrs)->x_ops->x_setpostn)(xdrs, pos)
#define	xdr_setpos(xdrs, pos)				\
	(*(xdrs)->x_ops->x_setpostn)(xdrs, pos)

#define	XDR_INLINE(xdrs, len)				\
	(*(xdrs)->x_ops->x_inline)(xdrs, len)
#define	xdr_inline(xdrs, len)				\
	(*(xdrs)->x_ops->x_inline)(xdrs, len)

#define	XDR_DESTROY(xdrs)				\
	(*(xdrs)->x_ops->x_destroy)(xdrs)
#define	xdr_destroy(xdrs)				\
	(*(xdrs)->x_ops->x_destroy)(xdrs)

#define	XDR_CONTROL(xdrs, req, op)			\
	(*(xdrs)->x_ops->x_control)(xdrs, req, op)
#define	xdr_control(xdrs, req, op)			\
	(*(xdrs)->x_ops->x_control)(xdrs, req, op)

/*
 * Support struct for discriminated unions.
 * You create an array of xdrdiscrim structures, terminated with
 * a entry with a null procedure pointer.  The xdr_union routine gets
 * the discriminant value and then searches the array of structures
 * for a matching value.  If a match is found the associated xdr routine
 * is called to handle that part of the union.  If there is
 * no match, then a default routine may be called.
 * If there is no match and no default routine it is an error.
 */


/*
 * A xdrproc_t exists for each data type which is to be encoded or decoded.
 *
 * The second argument to the xdrproc_t is a pointer to an opaque pointer.
 * The opaque pointer generally points to a structure of the data type
 * to be decoded.  If this pointer is 0, then the type routines should
 * allocate dynamic storage of the appropriate size and return it.
 * bool_t	(*xdrproc_t)(XDR *, void *);
 */
#ifdef __cplusplus
typedef bool_t (*xdrproc_t)(XDR *, void *);
#else
#ifdef __STDC__
typedef bool_t (*xdrproc_t)(); /* For Backward compatibility */
#else
typedef	bool_t (*xdrproc_t)();
#endif
#endif

#define	NULL_xdrproc_t ((xdrproc_t)0)

#if defined(_LP64)
#define	xdr_rpcvers(xdrs, versp)	xdr_u_int(xdrs, versp)
#define	xdr_rpcprog(xdrs, progp)	xdr_u_int(xdrs, progp)
#define	xdr_rpcproc(xdrs, procp)	xdr_u_int(xdrs, procp)
#define	xdr_rpcprot(xdrs, protp)	xdr_u_int(xdrs, protp)
#define	xdr_rpcport(xdrs, portp)	xdr_u_int(xdrs, portp)
#else
#define	xdr_rpcvers(xdrs, versp)	xdr_u_long(xdrs, versp)
#define	xdr_rpcprog(xdrs, progp)	xdr_u_long(xdrs, progp)
#define	xdr_rpcproc(xdrs, procp)	xdr_u_long(xdrs, procp)
#define	xdr_rpcprot(xdrs, protp)	xdr_u_long(xdrs, protp)
#define	xdr_rpcport(xdrs, portp)	xdr_u_long(xdrs, portp)
#endif

struct xdr_discrim {
	int	value;
	xdrproc_t proc;
};

/*
 * In-line routines for fast encode/decode of primitve data types.
 * Caveat emptor: these use single memory cycles to get the
 * data from the underlying buffer, and will fail to operate
 * properly if the data is not aligned.  The standard way to use these
 * is to say:
 *	if ((buf = XDR_INLINE(xdrs, count)) == NULL)
 *		return (FALSE);
 *	<<< macro calls >>>
 * where ``count'' is the number of bytes of data occupied
 * by the primitive data types.
 *
 * N.B. and frozen for all time: each data type here uses 4 bytes
 * of external representation.
 */

#define	IXDR_GET_INT32(buf)		((int32_t)ntohl((uint32_t)*(buf)++))
#define	IXDR_PUT_INT32(buf, v)		(*(buf)++ = (int32_t)htonl((uint32_t)v))
#define	IXDR_GET_U_INT32(buf)		((uint32_t)IXDR_GET_INT32(buf))
#define	IXDR_PUT_U_INT32(buf, v)	IXDR_PUT_INT32((buf), ((int32_t)(v)))

#if !defined(_KERNEL) && !defined(_LP64)

#define	IXDR_GET_LONG(buf)		((long)ntohl((ulong_t)*(buf)++))
#define	IXDR_PUT_LONG(buf, v)		(*(buf)++ = (long)htonl((ulong_t)v))
#define	IXDR_GET_U_LONG(buf)		((ulong_t)IXDR_GET_LONG(buf))
#define	IXDR_PUT_U_LONG(buf, v)		IXDR_PUT_LONG((buf), ((long)(v)))

#define	IXDR_GET_BOOL(buf)		((bool_t)IXDR_GET_LONG(buf))
#define	IXDR_GET_ENUM(buf, t)		((t)IXDR_GET_LONG(buf))
#define	IXDR_GET_SHORT(buf)		((short)IXDR_GET_LONG(buf))
#define	IXDR_GET_U_SHORT(buf)		((ushort_t)IXDR_GET_LONG(buf))

#define	IXDR_PUT_BOOL(buf, v)		IXDR_PUT_LONG((buf), ((long)(v)))
#define	IXDR_PUT_ENUM(buf, v)		IXDR_PUT_LONG((buf), ((long)(v)))
#define	IXDR_PUT_SHORT(buf, v)		IXDR_PUT_LONG((buf), ((long)(v)))
#define	IXDR_PUT_U_SHORT(buf, v)	IXDR_PUT_LONG((buf), ((long)(v)))

#else

#define	IXDR_GET_BOOL(buf)		((bool_t)IXDR_GET_INT32(buf))
#define	IXDR_GET_ENUM(buf, t)		((t)IXDR_GET_INT32(buf))
#define	IXDR_GET_SHORT(buf)		((short)IXDR_GET_INT32(buf))
#define	IXDR_GET_U_SHORT(buf)		((ushort_t)IXDR_GET_INT32(buf))

#define	IXDR_PUT_BOOL(buf, v)		IXDR_PUT_INT32((buf), ((int)(v)))
#define	IXDR_PUT_ENUM(buf, v)		IXDR_PUT_INT32((buf), ((int)(v)))
#define	IXDR_PUT_SHORT(buf, v)		IXDR_PUT_INT32((buf), ((int)(v)))
#define	IXDR_PUT_U_SHORT(buf, v)	IXDR_PUT_INT32((buf), ((int)(v)))

#endif

#ifndef _LITTLE_ENDIAN
#define	IXDR_GET_HYPER(buf, v)	{ \
			*((int32_t *)(&v)) = ntohl(*(uint32_t *)buf++); \
			*((int32_t *)(((char *)&v) + BYTES_PER_XDR_UNIT)) \
			= ntohl(*(uint32_t *)buf++); \
			}
#define	IXDR_PUT_HYPER(buf, v)	{ \
			*(buf)++ = (int32_t)htonl(*(uint32_t *) \
				((char *)&v)); \
			*(buf)++ = \
				(int32_t)htonl(*(uint32_t *)(((char *)&v) \
				+ BYTES_PER_XDR_UNIT)); \
			}
#else

#define	IXDR_GET_HYPER(buf, v)	{ \
			*((int32_t *)(((char *)&v) + \
				BYTES_PER_XDR_UNIT)) \
				= ntohl(*(uint32_t *)buf++); \
			*((int32_t *)(&v)) = \
				ntohl(*(uint32_t *)buf++); \
			}

#define	IXDR_PUT_HYPER(buf, v)	{ \
			*(buf)++ = \
				(int32_t)htonl(*(uint32_t *)(((char *)&v) + \
				BYTES_PER_XDR_UNIT)); \
			*(buf)++ = \
				(int32_t)htonl(*(uint32_t *)((char *)&v)); \
			}
#endif
#define	IXDR_GET_U_HYPER(buf, v)	IXDR_GET_HYPER(buf, v)
#define	IXDR_PUT_U_HYPER(buf, v)	IXDR_PUT_HYPER(buf, v)


/*
 * These are the "generic" xdr routines.
 */
#ifdef __STDC__
extern bool_t	xdr_void(void);
extern bool_t	xdr_int(XDR *, int *);
extern bool_t	xdr_u_int(XDR *, uint_t *);
extern bool_t	xdr_long(XDR *, long *);
extern bool_t	xdr_u_long(XDR *, ulong_t *);
extern bool_t	xdr_short(XDR *, short *);
extern bool_t	xdr_u_short(XDR *, ushort_t *);
extern bool_t	xdr_bool(XDR *, bool_t *);
extern bool_t	xdr_enum(XDR *, enum_t *);
extern bool_t	xdr_array(XDR *, caddr_t *, uint_t *, const uint_t,
		    const uint_t, const xdrproc_t);
extern bool_t	xdr_bytes(XDR *, char **, uint_t *, const uint_t);
extern bool_t	xdr_opaque(XDR *, caddr_t, const uint_t);
extern bool_t	xdr_string(XDR *, char **, const uint_t);
extern bool_t	xdr_union(XDR *, enum_t *, char *,
		    const struct xdr_discrim *, const xdrproc_t);
extern bool_t	xdr_vector(XDR *, char *, const uint_t, const uint_t,
    const xdrproc_t);
extern unsigned int  xdr_sizeof(xdrproc_t, void *);

extern bool_t   xdr_hyper(XDR *, longlong_t *);
extern bool_t   xdr_longlong_t(XDR *, longlong_t *);
extern bool_t   xdr_u_hyper(XDR *, u_longlong_t *);
extern bool_t   xdr_u_longlong_t(XDR *, u_longlong_t *);

extern bool_t	xdr_char(XDR *, char *);
extern bool_t	xdr_u_char(XDR *, uchar_t *);
extern bool_t	xdr_wrapstring(XDR *, char **);
extern bool_t	xdr_reference(XDR *, caddr_t *, uint_t, const xdrproc_t);
extern bool_t	xdr_pointer(XDR *, char **, uint_t, const xdrproc_t);
extern void	xdr_free(xdrproc_t, char *);
extern bool_t	xdr_time_t(XDR *, time_t *);

extern bool_t	xdr_int8_t(XDR *, int8_t *);
extern bool_t	xdr_uint8_t(XDR *, uint8_t *);
extern bool_t	xdr_int16_t(XDR *, int16_t *);
extern bool_t	xdr_uint16_t(XDR *, uint16_t *);
extern bool_t	xdr_int32_t(XDR *, int32_t *);
extern bool_t	xdr_uint32_t(XDR *, uint32_t *);
#if defined(_INT64_TYPE)
extern bool_t	xdr_int64_t(XDR *, int64_t *);
extern bool_t	xdr_uint64_t(XDR *, uint64_t *);
#endif

#ifndef _KERNEL
extern bool_t	xdr_float(XDR *, float *);
extern bool_t	xdr_double(XDR *, double *);
extern bool_t	xdr_quadruple(XDR *, long double *);
#endif /* !_KERNEL */
#else
extern bool_t	xdr_void();
extern bool_t	xdr_int();
extern bool_t	xdr_u_int();
extern bool_t	xdr_long();
extern bool_t	xdr_u_long();
extern bool_t	xdr_short();
extern bool_t	xdr_u_short();
extern bool_t	xdr_bool();
extern bool_t	xdr_enum();
extern bool_t	xdr_array();
extern bool_t	xdr_bytes();
extern bool_t	xdr_opaque();
extern bool_t	xdr_string();
extern bool_t	xdr_union();
extern bool_t	xdr_vector();

extern bool_t   xdr_hyper();
extern bool_t   xdr_longlong_t();
extern bool_t   xdr_u_hyper();
extern bool_t   xdr_u_longlong_t();
extern bool_t	xdr_char();
extern bool_t	xdr_u_char();
extern bool_t	xdr_reference();
extern bool_t	xdr_pointer();
extern void	xdr_free();
extern bool_t	xdr_wrapstring();
extern bool_t	xdr_time_t();

extern bool_t	xdr_int8_t();
extern bool_t	xdr_uint8_t();
extern bool_t	xdr_int16_t();
extern bool_t	xdr_uint16_t();
extern bool_t	xdr_int32_t();
extern bool_t	xdr_uint32_t();
#if defined(_INT64_TYPE)
extern bool_t	xdr_int64_t();
extern bool_t	xdr_uint64_t();
#endif

#ifndef _KERNEL
extern bool_t	xdr_float();
extern bool_t	xdr_double();
extern bool_t   xdr_quadruple();
#endif /* !_KERNEL */
#endif

/*
 * Common opaque bytes objects used by many rpc protocols;
 * declared here due to commonality.
 */
#define	MAX_NETOBJ_SZ 1024
struct netobj {
	uint_t	n_len;
	char	*n_bytes;
};
typedef struct netobj netobj;

#ifdef __STDC__
extern bool_t   xdr_netobj(XDR *, netobj *);
#else
extern bool_t   xdr_netobj();
#endif

/*
 * These are XDR control operators
 */

#define	XDR_GET_BYTES_AVAIL 1

struct xdr_bytesrec {
	bool_t xc_is_last_record;
	size_t xc_num_avail;
};

typedef struct xdr_bytesrec xdr_bytesrec;

/*
 * These are the request arguments to XDR_CONTROL.
 *
 * XDR_PEEK - returns the contents of the next XDR unit on the XDR stream.
 * XDR_SKIPBYTES - skips the next N bytes in the XDR stream.
 * XDR_RDMAGET - for xdr implementation over RDMA, gets private flags from
 *		 the XDR stream being moved over RDMA
 * XDR_RDMANOCHUNK - for xdr implementaion over RDMA, sets private flags in
 *                   the XDR stream moving over RDMA.
 */
#ifdef _KERNEL
#define	XDR_PEEK		2
#define	XDR_SKIPBYTES		3
#define	XDR_RDMA_GET_FLAGS	4
#define	XDR_RDMA_SET_FLAGS	5
#define	XDR_RDMA_ADD_CHUNK	6
#define	XDR_RDMA_GET_CHUNK_LEN	7
#define	XDR_RDMA_SET_WLIST	8
#define	XDR_RDMA_GET_WLIST	9
#define	XDR_RDMA_GET_WCINFO	10
#define	XDR_RDMA_GET_RLIST	11
#endif

/*
 * These are the public routines for the various implementations of
 * xdr streams.
 */
#if !defined(_KERNEL) && !defined(_FAKE_KERNEL)
#ifdef __STDC__
extern void   xdrmem_create(XDR *, const caddr_t, const uint_t, const enum
xdr_op);
	/* XDR using memory buffers */
extern void   xdrstdio_create(XDR *, FILE *, const enum xdr_op);
/* XDR using stdio library */
extern void   xdrrec_create(XDR *, const uint_t, const uint_t, const caddr_t,
int (*) (void *, caddr_t, int), int (*) (void *, caddr_t, int));
/* XDR pseudo records for tcp */
extern bool_t xdrrec_endofrecord(XDR *, bool_t);
/* make end of xdr record */
extern bool_t xdrrec_skiprecord(XDR *);
/* move to beginning of next record */
extern bool_t xdrrec_eof(XDR *);
extern uint_t xdrrec_readbytes(XDR *, caddr_t, uint_t);
/* true if no more input */
#else
extern void   xdrmem_create();
extern void   xdrstdio_create();
extern void   xdrrec_create();
extern bool_t xdrrec_endofrecord();
extern bool_t xdrrec_skiprecord();
extern bool_t xdrrec_eof();
extern uint_t xdrrec_readbytes();
#endif
#else

#define	DLEN(mp) (mp->b_cont ? msgdsize(mp) : (mp->b_wptr - mp->b_rptr))

extern void	xdrmem_create(XDR *, caddr_t, uint_t, enum xdr_op);
extern void	xdrmblk_init(XDR *, mblk_t *, enum xdr_op, int);
extern bool_t	xdrmblk_getmblk(XDR *, mblk_t **, uint_t *);
extern bool_t	xdrmblk_putmblk(XDR *, mblk_t *, uint_t);
extern bool_t	xdrmblk_putmblk_raw(XDR *, mblk_t *);
extern struct xdr_ops xdrmblk_ops;
extern struct xdr_ops xdrrdmablk_ops;
extern struct xdr_ops xdrrdma_ops;

struct rpc_msg;
extern bool_t	xdr_callmsg(XDR *, struct rpc_msg *);
extern bool_t	xdr_replymsg_body(XDR *, struct rpc_msg *);
extern bool_t	xdr_replymsg_hdr(XDR *, struct rpc_msg *);

#endif /* !_KERNEL */

#ifdef __cplusplus
}
#endif

#endif	/* !_RPC_XDR_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved  	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

/*
 * xdr_array.c, Generic XDR routines impelmentation.
 * These are the "non-trivial" xdr primitives used to serialize and de-serialize
 * arrays.  See xdr.h for more info on the interface to xdr.
 */

#include <sys/param.h>
#include <sys/cmn_err.h>
#include <sys/types.h>
#include <sys/systm.h>

#include <rpc/types.h>
#include <rpc/xdr.h>

#define	LASTUNSIGNED	((uint_t)0-1)

/*
 * XDR an array of arbitrary elements
 * *addrp is a pointer to the array, *sizep is the number of elements.
 * If addrp is NULL (*sizep * elsize) bytes are allocated.
 * elsize is the size (in bytes) of each element, and elproc is the
 * xdr procedure to call to handle each element of the array.
 */
bool_t
xdr_array(XDR *xdrs, caddr_t *addrp, uint_t *sizep, const uint_t maxsize,
	const uint_t elsize, const xdrproc_t elproc)
{
	uint_t i;
	caddr_t target = *addrp;
	uint_t c;  /* the actual element count */
	bool_t stat = TRUE;
	uint_t nodesize;

	/* like strings, arrays are really counted arrays */
	if (!xdr_u_int(xdrs, sizep)) {
		return (FALSE);
	}
	c = *sizep;
	if ((c > maxsize || LASTUNSIGNED / elsize < c) &&
	    xdrs->x_op != XDR_FREE) {
		return (FALSE);
	}
	nodesize = c * elsize;

	/*
	 * if we are deserializing, we may need to allocate an array.
	 * We also save time by checking for a null array if we are freeing.
	 */
	if (target == NULL)
		switch (xdrs->x_op) {
		case XDR_DECODE:
			if (c == 0)
				return (TRUE);
			*addrp = target = (char *)mem_alloc(nodesize);
			bzero(target, nodesize);
			break;

		case XDR_FREE:
			return (TRUE);

		case XDR_ENCODE:
			break;
		}

	/*
	 * now we xdr each element of array
	 */
	for (i = 0; (i < c) && stat; i++) {
		stat = (*elproc)(xdrs, target, LASTUNSIGNED);
		target += elsize;
	}

	/*
	 * the array may need freeing
	 */
	if (xdrs->x_op == XDR_FREE) {
		mem_free(*addrp, nodesize);
		*addrp = NULL;
	}
	return (stat);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2016 Nexenta Systems, Inc.  All rights reserved.
 */

/*
 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved  	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

/*
 * xdr_mblk.c, XDR implementation on kernel streams mblks.
 */

#include <sys/param.h>
#include <sys/types.h>
#include <sys/systm.h>
#include <sys/stream.h>
#include <sys/cmn_err.h>
#include <sys/strsubr.h>
#include <sys/strsun.h>
#include <sys/debug.h>
#include <sys/sysmacros.h>

#include <rpc/types.h>
#include <rpc/xdr.h>

static bool_t	xdrmblk_getint32(XDR *, int32_t *);
static bool_t	xdrmblk_putint32(XDR *, int32_t *);
static bool_t	xdrmblk_getbytes(XDR *, caddr_t, int);
static bool_t	xdrmblk_putbytes(XDR *, caddr_t, int);
static uint_t	xdrmblk_getpos(XDR *);
static bool_t	xdrmblk_setpos(XDR *, uint_t);
static rpc_inline_t *xdrmblk_inline(XDR *, int);
static void	xdrmblk_destroy(XDR *);
static bool_t	xdrmblk_control(XDR *, int, void *);

static mblk_t *xdrmblk_alloc(int);
static void xdrmblk_skip_fully_read_mblks(XDR *);

/*
 * Xdr on mblks operations vector.
 */
struct	xdr_ops xdrmblk_ops = {
	xdrmblk_getbytes,
	xdrmblk_putbytes,
	xdrmblk_getpos,
	xdrmblk_setpos,
	xdrmblk_inline,
	xdrmblk_destroy,
	xdrmblk_control,
	xdrmblk_getint32,
	xdrmblk_putint32
};

/*
 * The xdrmblk_params structure holds the internal data for the XDR stream.
 * The x_private member of the XDR points to this structure.  The
 * xdrmblk_params structure is dynamically allocated in xdrmblk_init() and
 * freed in xdrmblk_destroy().
 *
 * The apos and rpos members of the xdrmblk_params structure are used to
 * implement xdrmblk_getpos() and xdrmblk_setpos().
 *
 * In addition to the xdrmblk_params structure we store some additional
 * internal data directly in the XDR stream structure:
 *
 * x_base	A pointer to the current mblk (that one we are currently
 * 		working with).
 * x_handy	The number of available bytes (either for read or for write) in
 * 		the current mblk.
 */
struct xdrmblk_params {
	int sz;
	uint_t apos;	/* Absolute position of the current mblk */
	uint_t rpos;	/* Relative position in the current mblk */
};

/*
 * Initialize xdr stream.
 */
void
xdrmblk_init(XDR *xdrs, mblk_t *m, enum xdr_op op, int sz)
{
	struct xdrmblk_params *p;

	xdrs->x_op = op;
	xdrs->x_ops = &xdrmblk_ops;
	xdrs->x_base = (caddr_t)m;
	xdrs->x_public = NULL;
	p = kmem_alloc(sizeof (struct xdrmblk_params), KM_SLEEP);
	xdrs->x_private = (caddr_t)p;

	p->sz = sz;
	p->apos = 0;
	p->rpos = 0;

	if (op == XDR_DECODE) {
		xdrs->x_handy = (int)MBLKL(m);
	} else {
		xdrs->x_handy = (int)MBLKTAIL(m);
		if (p->sz < sizeof (int32_t))
			p->sz = sizeof (int32_t);
	}
}

static void
xdrmblk_destroy(XDR *xdrs)
{
	kmem_free(xdrs->x_private, sizeof (struct xdrmblk_params));
}

static bool_t
xdrmblk_getint32(XDR *xdrs, int32_t *int32p)
{
	mblk_t *m;
	struct xdrmblk_params *p;

	xdrmblk_skip_fully_read_mblks(xdrs);

	/* LINTED pointer alignment */
	m = (mblk_t *)xdrs->x_base;
	if (m == NULL)
		return (FALSE);

	p = (struct xdrmblk_params *)xdrs->x_private;

	/*
	 * If the pointer is not aligned or there is not
	 * enough bytes, pullupmsg to get enough bytes and
	 * align the mblk.
	 */
	if (!IS_P2ALIGNED(m->b_rptr, sizeof (int32_t)) ||
	    xdrs->x_handy < sizeof (int32_t)) {
		while (!pullupmsg(m, sizeof (int32_t))) {
			/*
			 * Could have failed due to not
			 * enough data or an allocb failure.
			 */
			if (xmsgsize(m) < sizeof (int32_t))
				return (FALSE);
			delay(hz);
		}
		p->apos += p->rpos;
		p->rpos = 0;
		xdrs->x_handy = (int)MBLKL(m);
	}

	/* LINTED pointer alignment */
	*int32p = ntohl(*((int32_t *)(m->b_rptr)));
	m->b_rptr += sizeof (int32_t);
	xdrs->x_handy -= sizeof (int32_t);
	p->rpos += sizeof (int32_t);

	return (TRUE);
}

static bool_t
xdrmblk_putint32(XDR *xdrs, int32_t *int32p)
{
	mblk_t *m;
	struct xdrmblk_params *p;

	/* LINTED pointer alignment */
	m = (mblk_t *)xdrs->x_base;
	if (m == NULL)
		return (FALSE);

	p = (struct xdrmblk_params *)xdrs->x_private;

	while (!IS_P2ALIGNED(m->b_wptr, sizeof (int32_t)) ||
	    xdrs->x_handy < sizeof (int32_t)) {
		if (m->b_cont == NULL) {
			ASSERT(p->sz >= sizeof (int32_t));
			m->b_cont = xdrmblk_alloc(p->sz);
		}
		m = m->b_cont;
		xdrs->x_base = (caddr_t)m;
		p->apos += p->rpos;
		p->rpos = 0;
		if (m == NULL) {
			xdrs->x_handy = 0;
			return (FALSE);
		}
		xdrs->x_handy = (int)MBLKTAIL(m);
		ASSERT(m->b_rptr == m->b_wptr);
		ASSERT(m->b_rptr >= m->b_datap->db_base);
		ASSERT(m->b_rptr < m->b_datap->db_lim);
	}
	/* LINTED pointer alignment */
	*(int32_t *)m->b_wptr = htonl(*int32p);
	m->b_wptr += sizeof (int32_t);
	xdrs->x_handy -= sizeof (int32_t);
	p->rpos += sizeof (int32_t);
	ASSERT(m->b_wptr <= m->b_datap->db_lim);
	return (TRUE);
}

/*
 * We pick 16 as a compromise threshold for most architectures.
 */
#define	XDRMBLK_BCOPY_LIMIT	16

static bool_t
xdrmblk_getbytes(XDR *xdrs, caddr_t addr, int len)
{
	mblk_t *m;
	struct xdrmblk_params *p;
	int i;

	/* LINTED pointer alignment */
	m = (mblk_t *)xdrs->x_base;
	if (m == NULL)
		return (FALSE);

	p = (struct xdrmblk_params *)xdrs->x_private;

	/*
	 * Performance tweak: converted explicit bcopy()
	 * call to simple in-line. This function is called
	 * to process things like readdir reply filenames
	 * which are small strings--typically 12 bytes or less.
	 * Overhead of calling bcopy() is obnoxious for such
	 * small copies.
	 */
	while (xdrs->x_handy < len) {
		if (xdrs->x_handy > 0) {
			if (xdrs->x_handy < XDRMBLK_BCOPY_LIMIT) {
				for (i = 0; i < xdrs->x_handy; i++)
					*addr++ = *m->b_rptr++;
			} else {
				bcopy(m->b_rptr, addr, xdrs->x_handy);
				m->b_rptr += xdrs->x_handy;
				addr += xdrs->x_handy;
			}
			len -= xdrs->x_handy;
			p->rpos += xdrs->x_handy;
		}
		m = m->b_cont;
		xdrs->x_base = (caddr_t)m;
		p->apos += p->rpos;
		p->rpos = 0;
		if (m == NULL) {
			xdrs->x_handy = 0;
			return (FALSE);
		}
		xdrs->x_handy = (int)MBLKL(m);
	}

	xdrs->x_handy -= len;
	p->rpos += len;

	if (len < XDRMBLK_BCOPY_LIMIT) {
		for (i = 0; i < len; i++)
			*addr++ = *m->b_rptr++;
	} else {
		bcopy(m->b_rptr, addr, len);
		m->b_rptr += len;
	}

	return (TRUE);
}

/*
 * Sort of like getbytes except that instead of getting bytes we return the
 * mblk chain which contains the data.  If the data ends in the middle of
 * an mblk, the mblk is dup'd and split, so that the data will end on an
 * mblk.  Note that it is up to the caller to keep track of the data length
 * and not walk too far down the mblk chain.
 */

bool_t
xdrmblk_getmblk(XDR *xdrs, mblk_t **mm, uint_t *lenp)
{
	mblk_t *m, *nextm;
	struct xdrmblk_params *p;
	int len;
	uint32_t llen;

	if (!xdrmblk_getint32(xdrs, (int32_t *)&llen))
		return (FALSE);

	*lenp = llen;
	/* LINTED pointer alignment */
	m = (mblk_t *)xdrs->x_base;
	*mm = m;

	/*
	 * Walk the mblk chain until we get to the end or we've gathered
	 * enough data.
	 */
	len = 0;
	llen = roundup(llen, BYTES_PER_XDR_UNIT);
	while (m != NULL && len + (int)MBLKL(m) <= llen) {
		len += (int)MBLKL(m);
		m = m->b_cont;
	}
	if (len < llen) {
		if (m == NULL) {
			return (FALSE);
		} else {
			int tail_bytes = llen - len;

			/*
			 * Split the mblk with the last chunk of data and
			 * insert it into the chain.  The new mblk goes
			 * after the existing one so that it will get freed
			 * properly.
			 */
			nextm = dupb(m);
			if (nextm == NULL)
				return (FALSE);
			nextm->b_cont = m->b_cont;
			m->b_cont = nextm;
			m->b_wptr = m->b_rptr + tail_bytes;
			nextm->b_rptr += tail_bytes;
			ASSERT(nextm->b_rptr != nextm->b_wptr);

			m = nextm;	/* for x_base */
		}
	}
	xdrs->x_base = (caddr_t)m;
	xdrs->x_handy = m != NULL ? MBLKL(m) : 0;

	p = (struct xdrmblk_params *)xdrs->x_private;
	p->apos += p->rpos + llen;
	p->rpos = 0;

	return (TRUE);
}

static bool_t
xdrmblk_putbytes(XDR *xdrs, caddr_t addr, int len)
{
	mblk_t *m;
	struct xdrmblk_params *p;
	int i;

	/* LINTED pointer alignment */
	m = (mblk_t *)xdrs->x_base;
	if (m == NULL)
		return (FALSE);

	p = (struct xdrmblk_params *)xdrs->x_private;

	/*
	 * Performance tweak: converted explicit bcopy()
	 * call to simple in-line. This function is called
	 * to process things like readdir reply filenames
	 * which are small strings--typically 12 bytes or less.
	 * Overhead of calling bcopy() is obnoxious for such
	 * small copies.
	 */
	while (xdrs->x_handy < len) {
		if (xdrs->x_handy > 0) {
			if (xdrs->x_handy < XDRMBLK_BCOPY_LIMIT) {
				for (i = 0; i < xdrs->x_handy; i++)
					*m->b_wptr++ = *addr++;
			} else {
				bcopy(addr, m->b_wptr, xdrs->x_handy);
				m->b_wptr += xdrs->x_handy;
				addr += xdrs->x_handy;
			}
			len -= xdrs->x_handy;
			p->rpos += xdrs->x_handy;
		}

		/*
		 * We don't have enough space, so allocate the
		 * amount we need, or sz, whichever is larger.
		 * It is better to let the underlying transport divide
		 * large chunks than to try and guess what is best.
		 */
		if (m->b_cont == NULL)
			m->b_cont = xdrmblk_alloc(MAX(len, p->sz));

		m = m->b_cont;
		xdrs->x_base = (caddr_t)m;
		p->apos += p->rpos;
		p->rpos = 0;
		if (m == NULL) {
			xdrs->x_handy = 0;
			return (FALSE);
		}
		xdrs->x_handy = (int)MBLKTAIL(m);
		ASSERT(m->b_rptr == m->b_wptr);
		ASSERT(m->b_rptr >= m->b_datap->db_base);
		ASSERT(m->b_rptr < m->b_datap->db_lim);
	}

	xdrs->x_handy -= len;
	p->rpos += len;

	if (len < XDRMBLK_BCOPY_LIMIT) {
		for (i = 0; i < len; i++)
			*m->b_wptr++ = *addr++;
	} else {
		bcopy(addr, m->b_wptr, len);
		m->b_wptr += len;
	}
	ASSERT(m->b_wptr <= m->b_datap->db_lim);
	return (TRUE);
}

/*
 * We avoid a copy by merely adding this mblk to the list.  The caller is
 * responsible for allocating and filling in the mblk. If len is
 * not a multiple of BYTES_PER_XDR_UNIT, the caller has the option
 * of making the data a BYTES_PER_XDR_UNIT multiple (b_wptr - b_rptr is
 * a BYTES_PER_XDR_UNIT multiple), but in this case the caller has to ensure
 * that the filler bytes are initialized to zero.
 */
bool_t
xdrmblk_putmblk(XDR *xdrs, mblk_t *m, uint_t len)
{
	int32_t llen = (int32_t)len;

	if (!xdrmblk_putint32(xdrs, &llen))
		return (FALSE);

	return (xdrmblk_putmblk_raw(xdrs, m));
}

/*
 * The raw version of putmblk does not prepend the added data with the length.
 */
bool_t
xdrmblk_putmblk_raw(XDR *xdrs, mblk_t *m)
{
	struct xdrmblk_params *p;

	if ((DLEN(m) % BYTES_PER_XDR_UNIT) != 0)
		return (FALSE);

	p = (struct xdrmblk_params *)xdrs->x_private;

	/* LINTED pointer alignment */
	((mblk_t *)xdrs->x_base)->b_cont = m;
	p->apos += p->rpos;

	/* base points to the last mblk */
	while (m->b_cont) {
		p->apos += MBLKL(m);
		m = m->b_cont;
	}
	xdrs->x_base = (caddr_t)m;
	xdrs->x_handy = 0;
	p->rpos = MBLKL(m);
	return (TRUE);
}

static uint_t
xdrmblk_getpos(XDR *xdrs)
{
	struct xdrmblk_params *p = (struct xdrmblk_params *)xdrs->x_private;

	return (p->apos + p->rpos);
}

static bool_t
xdrmblk_setpos(XDR *xdrs, uint_t pos)
{
	mblk_t *m;
	struct xdrmblk_params *p;

	p = (struct xdrmblk_params *)xdrs->x_private;

	if (pos < p->apos)
		return (FALSE);

	if (pos > p->apos + p->rpos + xdrs->x_handy)
		return (FALSE);

	if (pos == p->apos + p->rpos)
		return (TRUE);

	/* LINTED pointer alignment */
	m = (mblk_t *)xdrs->x_base;
	ASSERT(m != NULL);

	if (xdrs->x_op == XDR_DECODE)
		m->b_rptr = m->b_rptr - p->rpos + (pos - p->apos);
	else
		m->b_wptr = m->b_wptr - p->rpos + (pos - p->apos);

	xdrs->x_handy = p->rpos + xdrs->x_handy - (pos - p->apos);
	p->rpos = pos - p->apos;

	return (TRUE);
}

#ifdef DEBUG
static int xdrmblk_inline_hits = 0;
static int xdrmblk_inline_misses = 0;
static int do_xdrmblk_inline = 1;
#endif

static rpc_inline_t *
xdrmblk_inline(XDR *xdrs, int len)
{
	rpc_inline_t *buf;
	mblk_t *m;
	unsigned char **mptr;
	struct xdrmblk_params *p;

	/*
	 * Can't inline XDR_FREE calls, doesn't make sense.
	 */
	if (xdrs->x_op == XDR_FREE)
		return (NULL);

#ifdef DEBUG
	if (!do_xdrmblk_inline) {
		xdrmblk_inline_misses++;
		return (NULL);
	}
#endif

	if (xdrs->x_op == XDR_DECODE)
		xdrmblk_skip_fully_read_mblks(xdrs);

	/*
	 * Can't inline if there isn't enough room.
	 */
	if (len <= 0 || xdrs->x_handy < len) {
#ifdef DEBUG
		xdrmblk_inline_misses++;
#endif
		return (NULL);
	}

	/* LINTED pointer alignment */
	m = (mblk_t *)xdrs->x_base;
	ASSERT(m != NULL);

	if (xdrs->x_op == XDR_DECODE) {
		/* LINTED pointer alignment */
		mptr = &m->b_rptr;
	} else {
		/* LINTED pointer alignment */
		mptr = &m->b_wptr;
	}

	/*
	 * Can't inline if the buffer is not 4 byte aligned, or if there is
	 * more than one reference to the data block associated with this mblk.
	 * This last check is used because the caller may want to modify the
	 * data in the inlined portion and someone else is holding a reference
	 * to the data who may not want it to be modified.
	 */
	if (!IS_P2ALIGNED(*mptr, sizeof (int32_t)) ||
	    m->b_datap->db_ref != 1) {
#ifdef DEBUG
		xdrmblk_inline_misses++;
#endif
		return (NULL);
	}

	buf = (rpc_inline_t *)*mptr;

	p = (struct xdrmblk_params *)xdrs->x_private;

	*mptr += len;
	xdrs->x_handy -= len;
	p->rpos += len;

#ifdef DEBUG
	xdrmblk_inline_hits++;
#endif

	return (buf);
}

static bool_t
xdrmblk_control(XDR *xdrs, int request, void *info)
{
	mblk_t *m;
	struct xdrmblk_params *p;
	int32_t *int32p;
	int len;

	switch (request) {
	case XDR_PEEK:
		xdrmblk_skip_fully_read_mblks(xdrs);

		/*
		 * Return the next 4 byte unit in the XDR stream.
		 */
		if (xdrs->x_handy < sizeof (int32_t))
			return (FALSE);

		/* LINTED pointer alignment */
		m = (mblk_t *)xdrs->x_base;
		ASSERT(m != NULL);

		/*
		 * If the pointer is not aligned, fail the peek
		 */
		if (!IS_P2ALIGNED(m->b_rptr, sizeof (int32_t)))
			return (FALSE);

		int32p = (int32_t *)info;
		/* LINTED pointer alignment */
		*int32p = ntohl(*((int32_t *)(m->b_rptr)));
		return (TRUE);

	case XDR_SKIPBYTES:
		int32p = (int32_t *)info;
		len = RNDUP((int)(*int32p));
		if (len < 0)
			return (FALSE);
		if (len == 0)
			return (TRUE);

		/* LINTED pointer alignment */
		m = (mblk_t *)xdrs->x_base;
		if (m == NULL)
			return (FALSE);

		p = (struct xdrmblk_params *)xdrs->x_private;

		while (xdrs->x_handy < len) {
			if (xdrs->x_handy > 0) {
				m->b_rptr += xdrs->x_handy;
				len -= xdrs->x_handy;
				p->rpos += xdrs->x_handy;
			}
			m = m->b_cont;
			xdrs->x_base = (caddr_t)m;
			p->apos += p->rpos;
			p->rpos = 0;
			if (m == NULL) {
				xdrs->x_handy = 0;
				return (FALSE);
			}
			xdrs->x_handy = (int)MBLKL(m);
		}

		xdrs->x_handy -= len;
		p->rpos += len;
		m->b_rptr += len;
		return (TRUE);

	default:
		return (FALSE);
	}
}

#define	HDR_SPACE	128

static mblk_t *
xdrmblk_alloc(int sz)
{
	mblk_t *mp;

	if (sz == 0)
		return (NULL);

	/*
	 * Pad the front of the message to allow the lower networking
	 * layers space to add headers as needed.
	 */
	sz += HDR_SPACE;

	while ((mp = allocb(sz, BPRI_LO)) == NULL) {
		if (strwaitbuf(sz, BPRI_LO))
			return (NULL);
	}

	mp->b_wptr += HDR_SPACE;
	mp->b_rptr = mp->b_wptr;

	return (mp);
}

/*
 * Skip fully read or empty mblks
 */
static void
xdrmblk_skip_fully_read_mblks(XDR *xdrs)
{
	mblk_t *m;
	struct xdrmblk_params *p;

	if (xdrs->x_handy != 0)
		return;

	/* LINTED pointer alignment */
	m = (mblk_t *)xdrs->x_base;
	if (m == NULL)
		return;

	p = (struct xdrmblk_params *)xdrs->x_private;
	p->apos += p->rpos;
	p->rpos = 0;

	do {
		m = m->b_cont;
		if (m == NULL)
			break;

		xdrs->x_handy = (int)MBLKL(m);
	} while (xdrs->x_handy == 0);

	xdrs->x_base = (caddr_t)m;
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved  	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

/*
 * xdr_mem.c, XDR implementation using memory buffers.
 *
 * If you have some data to be interpreted as external data representation
 * or to be converted to external data representation in a memory buffer,
 * then this is the package for you.
 */

#include <sys/param.h>
#include <sys/types.h>
#include <sys/systm.h>

#include <rpc/types.h>
#include <rpc/xdr.h>

static struct xdr_ops *xdrmem_ops(void);

/*
 * The procedure xdrmem_create initializes a stream descriptor for a
 * memory buffer.
 */
void
xdrmem_create(XDR *xdrs, caddr_t addr, uint_t size, enum xdr_op op)
{
	xdrs->x_op = op;
	xdrs->x_ops = xdrmem_ops();
	xdrs->x_private = xdrs->x_base = addr;
	xdrs->x_handy = size;
	xdrs->x_public = NULL;
}

/* ARGSUSED */
static void
xdrmem_destroy(XDR *xdrs)
{
}

static bool_t
xdrmem_getint32(XDR *xdrs, int32_t *int32p)
{
	if ((xdrs->x_handy -= (int)sizeof (int32_t)) < 0)
		return (FALSE);
	/* LINTED pointer alignment */
	*int32p = (int32_t)ntohl((uint32_t)(*((int32_t *)(xdrs->x_private))));
	xdrs->x_private += sizeof (int32_t);
	return (TRUE);
}

static bool_t
xdrmem_putint32(XDR *xdrs, int32_t *int32p)
{
	if ((xdrs->x_handy -= (int)sizeof (int32_t)) < 0)
		return (FALSE);
	/* LINTED pointer alignment */
	*(int32_t *)xdrs->x_private = (int32_t)htonl((uint32_t)(*int32p));
	xdrs->x_private += sizeof (int32_t);
	return (TRUE);
}

static bool_t
xdrmem_getbytes(XDR *xdrs, caddr_t addr, int len)
{
	if ((xdrs->x_handy -= len) < 0)
		return (FALSE);
	bcopy(xdrs->x_private, addr, len);
	xdrs->x_private += len;
	return (TRUE);
}

static bool_t
xdrmem_putbytes(XDR *xdrs, caddr_t addr, int len)
{
	if ((xdrs->x_handy -= len) < 0)
		return (FALSE);
	bcopy(addr, xdrs->x_private, len);
	xdrs->x_private += len;
	return (TRUE);
}

static uint_t
xdrmem_getpos(XDR *xdrs)
{
	return ((uint_t)((uintptr_t)xdrs->x_private - (uintptr_t)xdrs->x_base));
}

static bool_t
xdrmem_setpos(XDR *xdrs, uint_t pos)
{
	caddr_t newaddr = xdrs->x_base + pos;
	caddr_t lastaddr = xdrs->x_private + xdrs->x_handy;
	ptrdiff_t diff;

	if (newaddr > lastaddr)
		return (FALSE);
	xdrs->x_private = newaddr;
	diff = lastaddr - newaddr;
	xdrs->x_handy = (int)diff;
	return (TRUE);
}

static rpc_inline_t *
xdrmem_inline(XDR *xdrs, int len)
{
	rpc_inline_t *buf = NULL;

	if (xdrs->x_handy >= len) {
		xdrs->x_handy -= len;
		/* LINTED pointer alignment */
		buf = (rpc_inline_t *)xdrs->x_private;
		xdrs->x_private += len;
	}
	return (buf);
}

static bool_t
xdrmem_control(XDR *xdrs, int request, void *info)
{
	xdr_bytesrec *xptr;
	int32_t *int32p;
	int len;

	switch (request) {

	case XDR_GET_BYTES_AVAIL:
		xptr = (xdr_bytesrec *)info;
		xptr->xc_is_last_record = TRUE;
		xptr->xc_num_avail = xdrs->x_handy;
		return (TRUE);

	case XDR_PEEK:
		/*
		 * Return the next 4 byte unit in the XDR stream.
		 */
		if (xdrs->x_handy < sizeof (int32_t))
			return (FALSE);
		int32p = (int32_t *)info;
		*int32p = (int32_t)ntohl((uint32_t)
		    (*((int32_t *)(xdrs->x_private))));
		return (TRUE);

	case XDR_SKIPBYTES:
		/*
		 * Skip the next N bytes in the XDR stream.
		 */
		int32p = (int32_t *)info;
		len = RNDUP((int)(*int32p));
		if ((xdrs->x_handy -= len) < 0)
			return (FALSE);
		xdrs->x_private += len;
		return (TRUE);

	}
	return (FALSE);
}

static struct xdr_ops *
xdrmem_ops(void)
{
	static struct xdr_ops ops;

	if (ops.x_getint32 == NULL) {
		ops.x_getbytes = xdrmem_getbytes;
		ops.x_putbytes = xdrmem_putbytes;
		ops.x_getpostn = xdrmem_getpos;
		ops.x_setpostn = xdrmem_setpos;
		ops.x_inline = xdrmem_inline;
		ops.x_destroy = xdrmem_destroy;
		ops.x_control = xdrmem_control;
		ops.x_getint32 = xdrmem_getint32;
		ops.x_putint32 = xdrmem_putint32;
	}
	return (&ops);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
 */

/*
 * Copyright (c) 2007, The Ohio State University. All rights reserved.
 *
 * Portions of this source code is developed by the team members of
 * The Ohio State University's Network-Based Computing Laboratory (NBCL),
 * headed by Professor Dhabaleswar K. (DK) Panda.
 *
 * Acknowledgements to contributions from developors:
 *   Ranjit Noronha: noronha@cse.ohio-state.edu
 *   Lei Chai      : chail@cse.ohio-state.edu
 *   Weikuan Yu    : yuw@cse.ohio-state.edu
 *
 */

/*
 * xdr_rdma.c, XDR implementation using RDMA to move large chunks
 */

#include <sys/param.h>
#include <sys/types.h>
#include <sys/systm.h>
#include <sys/kmem.h>
#include <sys/sdt.h>
#include <sys/debug.h>

#include <rpc/types.h>
#include <rpc/xdr.h>
#include <sys/cmn_err.h>
#include <rpc/rpc_sztypes.h>
#include <rpc/rpc_rdma.h>
#include <sys/sysmacros.h>

/*
 * RCP header and xdr encoding overhead.  The number was determined by
 * tracing the msglen in svc_rdma_ksend for sec=sys,krb5,krb5i and krb5p.
 * If the XDR_RDMA_BUF_OVERHEAD is not large enough the result is the trigger
 * of the dtrace probe on the server "krpc-e-svcrdma-ksend-noreplycl" from
 * svc_rdma_ksend.
 */
#define	XDR_RDMA_BUF_OVERHEAD	300

static bool_t   xdrrdma_getint32(XDR *, int32_t *);
static bool_t   xdrrdma_putint32(XDR *, int32_t *);
static bool_t   xdrrdma_getbytes(XDR *, caddr_t, int);
static bool_t   xdrrdma_putbytes(XDR *, caddr_t, int);
uint_t		xdrrdma_getpos(XDR *);
bool_t		xdrrdma_setpos(XDR *, uint_t);
static rpc_inline_t *xdrrdma_inline(XDR *, int);
void		xdrrdma_destroy(XDR *);
static bool_t   xdrrdma_control(XDR *, int, void *);
static bool_t  xdrrdma_read_a_chunk(XDR *, CONN **);
static void xdrrdma_free_xdr_chunks(CONN *, struct clist *);

struct xdr_ops  xdrrdmablk_ops = {
	xdrrdma_getbytes,
	xdrrdma_putbytes,
	xdrrdma_getpos,
	xdrrdma_setpos,
	xdrrdma_inline,
	xdrrdma_destroy,
	xdrrdma_control,
	xdrrdma_getint32,
	xdrrdma_putint32
};

struct xdr_ops  xdrrdma_ops = {
	xdrrdma_getbytes,
	xdrrdma_putbytes,
	xdrrdma_getpos,
	xdrrdma_setpos,
	xdrrdma_inline,
	xdrrdma_destroy,
	xdrrdma_control,
	xdrrdma_getint32,
	xdrrdma_putint32
};

/*
 * A chunk list entry identifies a chunk of opaque data to be moved
 * separately from the rest of the RPC message. xp_min_chunk = 0, is a
 * special case for ENCODING, which means do not chunk the incoming stream of
 * data.
 *
 * A read chunk can contain part of the RPC message in addition to the
 * inline message. In such a case, (xp_offp - x_base) will not provide
 * the correct xdr offset of the entire message. xp_off is used in such
 * a case to denote the offset or current position in the overall message
 * covering both the inline and the chunk. This is used only in the case
 * of decoding and useful to compare read chunk 'c_xdroff' offsets.
 *
 * An example for a read chunk containing an XDR message:
 * An NFSv4 compound as following:
 *
 * PUTFH
 * WRITE [4109 bytes]
 * GETATTR
 *
 * Solaris Encoding is:
 * -------------------
 *
 * <Inline message>: [PUTFH WRITE4args GETATTR]
 *                                   |
 *                                   v
 * [RDMA_READ chunks]:               [write data]
 *
 *
 * Linux encoding is:
 * -----------------
 *
 * <Inline message>: [PUTFH WRITE4args]
 *                                    |
 *                                    v
 * [RDMA_READ chunks]:                [Write data] [Write data2] [Getattr chunk]
 *                                     chunk1       chunk2         chunk3
 *
 * where the READ chunks are as:
 *
 *             - chunk1 - 4k
 * write data |
 *             - chunk2 - 13 bytes(4109 - 4k)
 * getattr op  - chunk3 - 19 bytes
 * (getattr op starts at byte 4 after 3 bytes of roundup)
 *
 */

typedef struct {
	caddr_t		xp_offp;
	int		xp_min_chunk;
	uint_t		xp_flags;	/* Controls setting for rdma xdr */
	int		xp_buf_size;	/* size of xdr buffer */
	int		xp_off;		/* overall offset */
	struct clist	*xp_rcl;	/* head of chunk list */
	struct clist	**xp_rcl_next;	/* location to place/find next chunk */
	struct clist	*xp_rcl_xdr;	/* copy of rcl containing RPC message */
	struct clist	*xp_wcl;	/* head of write chunk list */
	CONN		*xp_conn;	/* connection for chunk data xfer */
	uint_t		xp_reply_chunk_len;
	/* used to track length for security modes: integrity/privacy */
	uint_t		xp_reply_chunk_len_alt;
} xrdma_private_t;

extern kmem_cache_t *clist_cache;

bool_t
xdrrdma_getrdmablk(XDR *xdrs, struct clist **rlist, uint_t *sizep,
    CONN **conn, const uint_t maxsize)
{
	xrdma_private_t	*xdrp = (xrdma_private_t *)(xdrs->x_private);
	struct clist	*cle = *(xdrp->xp_rcl_next);
	struct clist	*rdclist = NULL, *prev = NULL;
	bool_t		retval = TRUE;
	uint32_t	cur_offset = 0;
	uint32_t	total_segments = 0;
	uint32_t	actual_segments = 0;
	uint32_t	alen;
	uint_t		total_len;

	ASSERT(xdrs->x_op != XDR_FREE);

	/*
	 * first deal with the length since xdr bytes are counted
	 */
	if (!xdr_u_int(xdrs, sizep)) {
		DTRACE_PROBE(xdr__e__getrdmablk_sizep_fail);
		return (FALSE);
	}
	total_len = *sizep;
	if (total_len > maxsize) {
		DTRACE_PROBE2(xdr__e__getrdmablk_bad_size,
		    int, total_len, int, maxsize);
		return (FALSE);
	}
	(*conn) = xdrp->xp_conn;

	/*
	 * if no data we are done
	 */
	if (total_len == 0)
		return (TRUE);

	while (cle) {
		total_segments++;
		cle = cle->c_next;
	}

	cle = *(xdrp->xp_rcl_next);

	/*
	 * If there was a chunk at the current offset, then setup a read
	 * chunk list which records the destination address and length
	 * and will RDMA READ the data in later.
	 */
	if (cle == NULL)
		return (FALSE);

	if (cle->c_xdroff != (xdrp->xp_offp - xdrs->x_base))
		return (FALSE);

	/*
	 * Setup the chunk list with appropriate
	 * address (offset) and length
	 */
	for (actual_segments = 0;
	    actual_segments < total_segments; actual_segments++) {

		DTRACE_PROBE3(krpc__i__xdrrdma_getrdmablk, uint32_t, cle->c_len,
		    uint32_t, total_len, uint32_t, cle->c_xdroff);

		if (total_len <= 0)
			break;

		/*
		 * not the first time in the loop
		 */
		if (actual_segments > 0)
			cle = cle->c_next;

		cle->u.c_daddr = (uint64) cur_offset;
		alen = 0;
		if (cle->c_len > total_len) {
			alen = cle->c_len;
			cle->c_len = total_len;
		}
		if (!alen)
			xdrp->xp_rcl_next = &cle->c_next;

		cur_offset += cle->c_len;
		total_len -= cle->c_len;

		if ((total_segments - actual_segments - 1) == 0 &&
		    total_len > 0) {
			DTRACE_PROBE(krpc__e__xdrrdma_getblk_chunktooshort);
			retval = FALSE;
		}

		if ((total_segments - actual_segments - 1) > 0 &&
		    total_len == 0) {
			DTRACE_PROBE2(krpc__e__xdrrdma_getblk_toobig,
			    int, total_segments, int, actual_segments);
		}

		rdclist = clist_alloc();
		(*rdclist) = (*cle);
		if ((*rlist) == NULL)
			(*rlist) = rdclist;
		if (prev == NULL)
			prev = rdclist;
		else {
			prev->c_next = rdclist;
			prev = rdclist;
		}

	}

	if (prev != NULL)
		prev->c_next = NULL;

	/*
	 * Adjust the chunk length, if we read only a part of
	 * a chunk.
	 */

	if (alen) {
		cle->w.c_saddr =
		    (uint64)(uintptr_t)cle->w.c_saddr + cle->c_len;
		cle->c_len = alen - cle->c_len;
	}

	return (retval);
}

/*
 * The procedure xdrrdma_create initializes a stream descriptor for a memory
 * buffer.
 */
void
xdrrdma_create(XDR *xdrs, caddr_t addr, uint_t size,
    int min_chunk, struct clist *cl, enum xdr_op op, CONN *conn)
{
	xrdma_private_t *xdrp;
	struct clist   *cle;

	xdrs->x_op = op;
	xdrs->x_ops = &xdrrdma_ops;
	xdrs->x_base = addr;
	xdrs->x_handy = size;
	xdrs->x_public = NULL;

	xdrp = (xrdma_private_t *)kmem_zalloc(sizeof (xrdma_private_t),
	    KM_SLEEP);
	xdrs->x_private = (caddr_t)xdrp;
	xdrp->xp_offp = addr;
	xdrp->xp_min_chunk = min_chunk;
	xdrp->xp_flags = 0;
	xdrp->xp_buf_size = size;
	xdrp->xp_rcl = cl;
	xdrp->xp_reply_chunk_len = 0;
	xdrp->xp_reply_chunk_len_alt = 0;

	if (op == XDR_ENCODE && cl != NULL) {
		/* Find last element in chunk list and set xp_rcl_next */
		for (cle = cl; cle->c_next != NULL; cle = cle->c_next)
			continue;

		xdrp->xp_rcl_next = &(cle->c_next);
	} else {
		xdrp->xp_rcl_next = &(xdrp->xp_rcl);
	}

	xdrp->xp_wcl = NULL;

	xdrp->xp_conn = conn;
	if (xdrp->xp_min_chunk != 0)
		xdrp->xp_flags |= XDR_RDMA_CHUNK;
}

/* ARGSUSED */
void
xdrrdma_destroy(XDR * xdrs)
{
	xrdma_private_t	*xdrp = (xrdma_private_t *)(xdrs->x_private);

	if (xdrp == NULL)
		return;

	if (xdrp->xp_wcl) {
		if (xdrp->xp_flags & XDR_RDMA_WLIST_REG) {
			(void) clist_deregister(xdrp->xp_conn, xdrp->xp_wcl);
			rdma_buf_free(xdrp->xp_conn,
			    &xdrp->xp_wcl->rb_longbuf);
		}
		clist_free(xdrp->xp_wcl);
	}

	if (xdrp->xp_rcl) {
		if (xdrp->xp_flags & XDR_RDMA_RLIST_REG) {
			(void) clist_deregister(xdrp->xp_conn, xdrp->xp_rcl);
			rdma_buf_free(xdrp->xp_conn,
			    &xdrp->xp_rcl->rb_longbuf);
		}
		clist_free(xdrp->xp_rcl);
	}

	if (xdrp->xp_rcl_xdr)
		xdrrdma_free_xdr_chunks(xdrp->xp_conn, xdrp->xp_rcl_xdr);

	(void) kmem_free(xdrs->x_private, sizeof (xrdma_private_t));
	xdrs->x_private = NULL;
}

static	bool_t
xdrrdma_getint32(XDR *xdrs, int32_t *int32p)
{
	xrdma_private_t	*xdrp = (xrdma_private_t *)(xdrs->x_private);
	int chunked = 0;

	if ((xdrs->x_handy -= (int)sizeof (int32_t)) < 0) {
		/*
		 * check if rest of the rpc message is in a chunk
		 */
		if (!xdrrdma_read_a_chunk(xdrs, &xdrp->xp_conn)) {
			return (FALSE);
		}
		chunked = 1;
	}

	/* LINTED pointer alignment */
	*int32p = (int32_t)ntohl((uint32_t)(*((int32_t *)(xdrp->xp_offp))));

	DTRACE_PROBE1(krpc__i__xdrrdma_getint32, int32_t, *int32p);

	xdrp->xp_offp += sizeof (int32_t);

	if (chunked)
		xdrs->x_handy -= (int)sizeof (int32_t);

	if (xdrp->xp_off != 0) {
		xdrp->xp_off += sizeof (int32_t);
	}

	return (TRUE);
}

static	bool_t
xdrrdma_putint32(XDR *xdrs, int32_t *int32p)
{
	xrdma_private_t	*xdrp = (xrdma_private_t *)(xdrs->x_private);

	if ((xdrs->x_handy -= (int)sizeof (int32_t)) < 0)
		return (FALSE);

	/* LINTED pointer alignment */
	*(int32_t *)xdrp->xp_offp = (int32_t)htonl((uint32_t)(*int32p));
	xdrp->xp_offp += sizeof (int32_t);

	return (TRUE);
}

/*
 * DECODE bytes from XDR stream for rdma.
 * If the XDR stream contains a read chunk list,
 * it will go through xdrrdma_getrdmablk instead.
 */
static	bool_t
xdrrdma_getbytes(XDR *xdrs, caddr_t addr, int len)
{
	xrdma_private_t	*xdrp = (xrdma_private_t *)(xdrs->x_private);
	struct clist	*cle = *(xdrp->xp_rcl_next);
	struct clist	*cls = *(xdrp->xp_rcl_next);
	struct clist	cl;
	bool_t		retval = TRUE;
	uint32_t	total_len = len;
	uint32_t	cur_offset = 0;
	uint32_t	total_segments = 0;
	uint32_t	actual_segments = 0;
	uint32_t	status = RDMA_SUCCESS;
	uint32_t	alen = 0;
	uint32_t	xpoff;

	while (cle) {
		total_segments++;
		cle = cle->c_next;
	}

	cle = *(xdrp->xp_rcl_next);

	if (xdrp->xp_off) {
		xpoff = xdrp->xp_off;
	} else {
		xpoff = (xdrp->xp_offp - xdrs->x_base);
	}

	/*
	 * If there was a chunk at the current offset, then setup a read
	 * chunk list which records the destination address and length
	 * and will RDMA READ the data in later.
	 */

	if (cle != NULL && cle->c_xdroff == xpoff) {
		for (actual_segments = 0;
		    actual_segments < total_segments; actual_segments++) {

			if (total_len <= 0)
				break;

			if (status != RDMA_SUCCESS)
				goto out;

			cle->u.c_daddr = (uint64)(uintptr_t)addr + cur_offset;
			alen = 0;
			if (cle->c_len > total_len) {
				alen = cle->c_len;
				cle->c_len = total_len;
			}
			if (!alen)
				xdrp->xp_rcl_next = &cle->c_next;

			cur_offset += cle->c_len;
			total_len -= cle->c_len;

			if ((total_segments - actual_segments - 1) == 0 &&
			    total_len > 0) {
				DTRACE_PROBE(
				    krpc__e__xdrrdma_getbytes_chunktooshort);
				retval = FALSE;
			}

			if ((total_segments - actual_segments - 1) > 0 &&
			    total_len == 0) {
				DTRACE_PROBE2(krpc__e__xdrrdma_getbytes_toobig,
				    int, total_segments, int, actual_segments);
			}

			/*
			 * RDMA READ the chunk data from the remote end.
			 * First prep the destination buffer by registering
			 * it, then RDMA READ the chunk data. Since we are
			 * doing streaming memory, sync the destination
			 * buffer to CPU and deregister the buffer.
			 */
			if (xdrp->xp_conn == NULL) {
				return (FALSE);
			}
			cl = *cle;
			cl.c_next = NULL;
			status = clist_register(xdrp->xp_conn, &cl,
			    CLIST_REG_DST);
			if (status != RDMA_SUCCESS) {
				retval = FALSE;
				/*
				 * Deregister the previous chunks
				 * before return
				 */
				goto out;
			}

			cle->c_dmemhandle = cl.c_dmemhandle;
			cle->c_dsynchandle = cl.c_dsynchandle;

			/*
			 * Now read the chunk in
			 */
			if ((total_segments - actual_segments - 1) == 0 ||
			    total_len == 0) {
				status = RDMA_READ(xdrp->xp_conn, &cl, WAIT);
			} else {
				status = RDMA_READ(xdrp->xp_conn, &cl, NOWAIT);
			}
			if (status != RDMA_SUCCESS) {
				DTRACE_PROBE1(
				    krpc__i__xdrrdma_getblk_readfailed,
				    int, status);
				retval = FALSE;
			}

			cle = cle->c_next;

		}

		/*
		 * sync the memory for cpu
		 */
		cl = *cls;
		cl.c_next = NULL;
		cl.c_len = cur_offset;
		if (clist_syncmem(
		    xdrp->xp_conn, &cl, CLIST_REG_DST) != RDMA_SUCCESS) {
			retval = FALSE;
		}
out:

		/*
		 * Deregister the chunks
		 */
		cle = cls;
		while (actual_segments != 0) {
			cl = *cle;
			cl.c_next = NULL;

			cl.c_regtype = CLIST_REG_DST;
			(void) clist_deregister(xdrp->xp_conn, &cl);

			cle = cle->c_next;
			actual_segments--;
		}

		if (alen) {
			cle = *(xdrp->xp_rcl_next);
			cle->w.c_saddr =
			    (uint64)(uintptr_t)cle->w.c_saddr + cle->c_len;
			cle->c_len = alen - cle->c_len;
		}

		return (retval);
	}

	if ((xdrs->x_handy -= len) < 0)
		return (FALSE);

	bcopy(xdrp->xp_offp, addr, len);

	xdrp->xp_offp += len;

	if (xdrp->xp_off != 0)
		xdrp->xp_off += len;

	return (TRUE);
}

/*
 * ENCODE some bytes into an XDR stream xp_min_chunk = 0, means the stream of
 * bytes contain no chunks to seperate out, and if the bytes do not fit in
 * the supplied buffer, grow the buffer and free the old buffer.
 */
static	bool_t
xdrrdma_putbytes(XDR *xdrs, caddr_t addr, int len)
{
	xrdma_private_t	*xdrp = (xrdma_private_t *)(xdrs->x_private);
	/*
	 * Is this stream accepting chunks?
	 * If so, does the either of the two following conditions exist?
	 * - length of bytes to encode is greater than the min chunk size?
	 * - remaining space in this stream is shorter than length of
	 *   bytes to encode?
	 *
	 * If the above exists, then create a chunk for this encoding
	 * and save the addresses, etc.
	 */
	if (xdrp->xp_flags & XDR_RDMA_CHUNK &&
	    ((xdrp->xp_min_chunk != 0 &&
	    len >= xdrp->xp_min_chunk) ||
	    (xdrs->x_handy - len  < 0))) {
		struct clist	*cle;
		int		offset = xdrp->xp_offp - xdrs->x_base;

		cle = clist_alloc();
		cle->c_xdroff = offset;
		cle->c_len = len;
		cle->w.c_saddr = (uint64)(uintptr_t)addr;
		cle->c_next = NULL;

		*(xdrp->xp_rcl_next) = cle;
		xdrp->xp_rcl_next = &(cle->c_next);

		return (TRUE);
	}
	/* Is there enough space to encode what is left? */
	if ((xdrs->x_handy -= len) < 0) {
		return (FALSE);
	}
	bcopy(addr, xdrp->xp_offp, len);
	xdrp->xp_offp += len;

	return (TRUE);
}

uint_t
xdrrdma_getpos(XDR *xdrs)
{
	xrdma_private_t *xdrp = (xrdma_private_t *)(xdrs->x_private);

	return ((uint_t)((uintptr_t)xdrp->xp_offp - (uintptr_t)xdrs->x_base));
}

bool_t
xdrrdma_setpos(XDR *xdrs, uint_t pos)
{
	xrdma_private_t	*xdrp = (xrdma_private_t *)(xdrs->x_private);

	caddr_t		newaddr = xdrs->x_base + pos;
	caddr_t		lastaddr = xdrp->xp_offp + xdrs->x_handy;
	ptrdiff_t	diff;

	if (newaddr > lastaddr)
		return (FALSE);

	xdrp->xp_offp = newaddr;
	diff = lastaddr - newaddr;
	xdrs->x_handy = (int)diff;

	return (TRUE);
}

/* ARGSUSED */
static rpc_inline_t *
xdrrdma_inline(XDR *xdrs, int len)
{
	rpc_inline_t	*buf = NULL;
	xrdma_private_t	*xdrp = (xrdma_private_t *)(xdrs->x_private);
	struct clist	*cle = *(xdrp->xp_rcl_next);

	if (xdrs->x_op == XDR_DECODE) {
		/*
		 * Since chunks aren't in-line, check to see whether there is
		 * a chunk in the inline range.
		 */
		if (cle != NULL &&
		    cle->c_xdroff <= (xdrp->xp_offp - xdrs->x_base + len))
			return (NULL);
	}

	/* LINTED pointer alignment */
	buf = (rpc_inline_t *)xdrp->xp_offp;
	if (!IS_P2ALIGNED(buf, sizeof (int32_t)))
		return (NULL);

	if ((xdrs->x_handy < len) || (xdrp->xp_min_chunk != 0 &&
	    len >= xdrp->xp_min_chunk)) {
		return (NULL);
	} else {
		xdrs->x_handy -= len;
		xdrp->xp_offp += len;
		return (buf);
	}
}

static	bool_t
xdrrdma_control(XDR *xdrs, int request, void *info)
{
	int32_t		*int32p;
	int		len, i;
	uint_t		in_flags;
	xrdma_private_t	*xdrp = (xrdma_private_t *)(xdrs->x_private);
	rdma_chunkinfo_t *rcip = NULL;
	rdma_wlist_conn_info_t *rwcip = NULL;
	rdma_chunkinfo_lengths_t *rcilp = NULL;
	struct uio *uiop;
	struct clist	*rwl = NULL, *first = NULL;
	struct clist	*prev = NULL;

	switch (request) {
	case XDR_PEEK:
		/*
		 * Return the next 4 byte unit in the XDR stream.
		 */
		if (xdrs->x_handy < sizeof (int32_t))
			return (FALSE);

		int32p = (int32_t *)info;
		*int32p = (int32_t)ntohl((uint32_t)
		    (*((int32_t *)(xdrp->xp_offp))));

		return (TRUE);

	case XDR_SKIPBYTES:
		/*
		 * Skip the next N bytes in the XDR stream.
		 */
		int32p = (int32_t *)info;
		len = RNDUP((int)(*int32p));
		if ((xdrs->x_handy -= len) < 0)
			return (FALSE);
		xdrp->xp_offp += len;

		return (TRUE);

	case XDR_RDMA_SET_FLAGS:
		/*
		 * Set the flags provided in the *info in xp_flags for rdma
		 * xdr stream control.
		 */
		int32p = (int32_t *)info;
		in_flags = (uint_t)(*int32p);

		xdrp->xp_flags |= in_flags;
		return (TRUE);

	case XDR_RDMA_GET_FLAGS:
		/*
		 * Get the flags provided in xp_flags return through *info
		 */
		int32p = (int32_t *)info;

		*int32p = (int32_t)xdrp->xp_flags;
		return (TRUE);

	case XDR_RDMA_GET_CHUNK_LEN:
		rcilp = (rdma_chunkinfo_lengths_t *)info;
		rcilp->rcil_len = xdrp->xp_reply_chunk_len;
		rcilp->rcil_len_alt = xdrp->xp_reply_chunk_len_alt;

		return (TRUE);

	case XDR_RDMA_ADD_CHUNK:
		/*
		 * Store wlist information
		 */

		rcip = (rdma_chunkinfo_t *)info;

		DTRACE_PROBE2(krpc__i__xdrrdma__control__add__chunk,
		    rci_type_t, rcip->rci_type, uint32, rcip->rci_len);
		switch (rcip->rci_type) {
		case RCI_WRITE_UIO_CHUNK:
			xdrp->xp_reply_chunk_len_alt += rcip->rci_len;

			if ((rcip->rci_len + XDR_RDMA_BUF_OVERHEAD) <
			    xdrp->xp_min_chunk) {
				xdrp->xp_wcl = NULL;
				*(rcip->rci_clpp) = NULL;
				return (TRUE);
			}
			uiop = rcip->rci_a.rci_uiop;

			for (i = 0; i < uiop->uio_iovcnt; i++) {
				rwl = clist_alloc();
				if (first == NULL)
					first = rwl;
				rwl->c_len = uiop->uio_iov[i].iov_len;
				rwl->u.c_daddr =
				    (uint64)(uintptr_t)
				    (uiop->uio_iov[i].iov_base);
				/*
				 * if userspace address, put adspace ptr in
				 * clist. If not, then do nothing since it's
				 * already set to NULL (from kmem_zalloc)
				 */
				if (uiop->uio_segflg == UIO_USERSPACE) {
					rwl->c_adspc = ttoproc(curthread)->p_as;
				}

				if (prev == NULL)
					prev = rwl;
				else {
					prev->c_next = rwl;
					prev = rwl;
				}
			}

			rwl->c_next = NULL;
			xdrp->xp_wcl = first;
			*(rcip->rci_clpp) = first;

			break;

		case RCI_WRITE_ADDR_CHUNK:
			rwl = clist_alloc();

			rwl->c_len = rcip->rci_len;
			rwl->u.c_daddr3 = rcip->rci_a.rci_addr;
			rwl->c_next = NULL;
			xdrp->xp_reply_chunk_len_alt += rcip->rci_len;

			xdrp->xp_wcl = rwl;
			*(rcip->rci_clpp) = rwl;

			break;

		case RCI_REPLY_CHUNK:
			xdrp->xp_reply_chunk_len += rcip->rci_len;
			break;
		}
		return (TRUE);

	case XDR_RDMA_GET_WLIST:
		*((struct clist **)info) = xdrp->xp_wcl;
		return (TRUE);

	case XDR_RDMA_SET_WLIST:
		xdrp->xp_wcl = (struct clist *)info;
		return (TRUE);

	case XDR_RDMA_GET_RLIST:
		*((struct clist **)info) = xdrp->xp_rcl;
		return (TRUE);

	case XDR_RDMA_GET_WCINFO:
		rwcip = (rdma_wlist_conn_info_t *)info;

		rwcip->rwci_wlist = xdrp->xp_wcl;
		rwcip->rwci_conn = xdrp->xp_conn;

		return (TRUE);

	default:
		return (FALSE);
	}
}

bool_t xdr_do_clist(XDR *, clist **);

/*
 * Not all fields in struct clist are interesting to the RPC over RDMA
 * protocol. Only XDR the interesting fields.
 */
bool_t
xdr_clist(XDR *xdrs, clist *objp)
{
	if (!xdr_uint32(xdrs, &objp->c_xdroff))
		return (FALSE);
	if (!xdr_uint32(xdrs, &objp->c_smemhandle.mrc_rmr))
		return (FALSE);
	if (!xdr_uint32(xdrs, &objp->c_len))
		return (FALSE);
	if (!xdr_uint64(xdrs, &objp->w.c_saddr))
		return (FALSE);
	if (!xdr_do_clist(xdrs, &objp->c_next))
		return (FALSE);
	return (TRUE);
}

/*
 * The following two functions are forms of xdr_pointer()
 * and xdr_reference(). Since the generic versions just
 * kmem_alloc() a new clist, we actually want to use the
 * rdma_clist kmem_cache.
 */

/*
 * Generate or free a clist structure from the
 * kmem_cache "rdma_clist"
 */
bool_t
xdr_ref_clist(XDR *xdrs, caddr_t *pp)
{
	caddr_t loc = *pp;
	bool_t stat;

	if (loc == NULL) {
		switch (xdrs->x_op) {
		case XDR_FREE:
			return (TRUE);

		case XDR_DECODE:
			*pp = loc = (caddr_t)clist_alloc();
			break;

		case XDR_ENCODE:
			ASSERT(loc);
			break;
		}
	}

	stat = xdr_clist(xdrs, (struct clist *)loc);

	if (xdrs->x_op == XDR_FREE) {
		kmem_cache_free(clist_cache, loc);
		*pp = NULL;
	}
	return (stat);
}

/*
 * XDR a pointer to a possibly recursive clist. This differs
 * with xdr_reference in that it can serialize/deserialiaze
 * trees correctly.
 *
 *  What is sent is actually a union:
 *
 *  union object_pointer switch (boolean b) {
 *  case TRUE: object_data data;
 *  case FALSE: void nothing;
 *  }
 *
 * > objpp: Pointer to the pointer to the object.
 *
 */

bool_t
xdr_do_clist(XDR *xdrs, clist **objpp)
{
	bool_t more_data;

	more_data = (*objpp != NULL);
	if (!xdr_bool(xdrs, &more_data))
		return (FALSE);
	if (!more_data) {
		*objpp = NULL;
		return (TRUE);
	}
	return (xdr_ref_clist(xdrs, (caddr_t *)objpp));
}

uint_t
xdr_getbufsize(XDR *xdrs)
{
	xrdma_private_t *xdrp = (xrdma_private_t *)(xdrs->x_private);

	return ((uint_t)xdrp->xp_buf_size);
}

/* ARGSUSED */
bool_t
xdr_encode_rlist_svc(XDR *xdrs, clist *rlist)
{
	bool_t	vfalse = FALSE;

	ASSERT(rlist == NULL);
	return (xdr_bool(xdrs, &vfalse));
}

bool_t
xdr_encode_wlist(XDR *xdrs, clist *w)
{
	bool_t		vfalse = FALSE, vtrue = TRUE;
	int		i;
	uint_t		num_segment = 0;
	struct clist	*cl;

	/* does a wlist exist? */
	if (w == NULL) {
		return (xdr_bool(xdrs, &vfalse));
	}
	/* Encode N consecutive segments, 1, N, HLOO, ..., HLOO, 0 */
	if (!xdr_bool(xdrs, &vtrue))
		return (FALSE);

	for (cl = w; cl != NULL; cl = cl->c_next) {
		num_segment++;
	}

	if (!xdr_uint32(xdrs, &num_segment))
		return (FALSE);
	for (i = 0; i < num_segment; i++) {

		DTRACE_PROBE1(krpc__i__xdr_encode_wlist_len, uint_t, w->c_len);

		if (!xdr_uint32(xdrs, &w->c_dmemhandle.mrc_rmr))
			return (FALSE);

		if (!xdr_uint32(xdrs, &w->c_len))
			return (FALSE);

		if (!xdr_uint64(xdrs, &w->u.c_daddr))
			return (FALSE);

		w = w->c_next;
	}

	if (!xdr_bool(xdrs, &vfalse))
		return (FALSE);

	return (TRUE);
}


/*
 * Conditionally decode a RDMA WRITE chunk list from XDR stream.
 *
 * If the next boolean in the XDR stream is false there is no
 * RDMA WRITE chunk list present. Otherwise iterate over the
 * array and for each entry: allocate a struct clist and decode.
 * Pass back an indication via wlist_exists if we have seen a
 * RDMA WRITE chunk list.
 */
bool_t
xdr_decode_wlist(XDR *xdrs, struct clist **w, bool_t *wlist_exists)
{
	struct clist	*tmp;
	bool_t		more = FALSE;
	uint32_t	seg_array_len;
	uint32_t	i;

	if (!xdr_bool(xdrs, &more))
		return (FALSE);

	/* is there a wlist? */
	if (more == FALSE) {
		*wlist_exists = FALSE;
		return (TRUE);
	}
	*wlist_exists = TRUE;

	if (!xdr_uint32(xdrs, &seg_array_len))
		return (FALSE);

	tmp = *w = clist_alloc();
	for (i = 0; i < seg_array_len; i++) {

		if (!xdr_uint32(xdrs, &tmp->c_dmemhandle.mrc_rmr))
			return (FALSE);
		if (!xdr_uint32(xdrs, &tmp->c_len))
			return (FALSE);

		DTRACE_PROBE1(krpc__i__xdr_decode_wlist_len,
		    uint_t, tmp->c_len);

		if (!xdr_uint64(xdrs, &tmp->u.c_daddr))
			return (FALSE);
		if (i < seg_array_len - 1) {
			tmp->c_next = clist_alloc();
			tmp = tmp->c_next;
		} else {
			tmp->c_next = NULL;
		}
	}

	more = FALSE;
	if (!xdr_bool(xdrs, &more))
		return (FALSE);

	return (TRUE);
}

/*
 * Server side RDMA WRITE list decode.
 * XDR context is memory ops
 */
bool_t
xdr_decode_wlist_svc(XDR *xdrs, struct clist **wclp, bool_t *wwl,
    uint32_t *total_length, CONN *conn)
{
	struct clist	*first, *ncl;
	char		*memp;
	uint32_t	num_wclist;
	uint32_t	wcl_length = 0;
	uint32_t	i;
	bool_t		more = FALSE;

	*wclp = NULL;
	*wwl = FALSE;
	*total_length = 0;

	if (!xdr_bool(xdrs, &more)) {
		return (FALSE);
	}

	if (more == FALSE) {
		return (TRUE);
	}

	*wwl = TRUE;

	if (!xdr_uint32(xdrs, &num_wclist)) {
		DTRACE_PROBE(krpc__e__xdrrdma__wlistsvc__listlength);
		return (FALSE);
	}

	first = ncl = clist_alloc();

	for (i = 0; i < num_wclist; i++) {

		if (!xdr_uint32(xdrs, &ncl->c_dmemhandle.mrc_rmr))
			goto err_out;
		if (!xdr_uint32(xdrs, &ncl->c_len))
			goto err_out;
		if (!xdr_uint64(xdrs, &ncl->u.c_daddr))
			goto err_out;

		if (ncl->c_len > MAX_SVC_XFER_SIZE) {
			DTRACE_PROBE(
			    krpc__e__xdrrdma__wlistsvc__chunklist_toobig);
			ncl->c_len = MAX_SVC_XFER_SIZE;
		}

		DTRACE_PROBE1(krpc__i__xdr_decode_wlist_svc_len,
		    uint_t, ncl->c_len);

		wcl_length += ncl->c_len;

		if (i < num_wclist - 1) {
			ncl->c_next = clist_alloc();
			ncl = ncl->c_next;
		}
	}

	if (!xdr_bool(xdrs, &more))
		goto err_out;

	first->rb_longbuf.type = RDMA_LONG_BUFFER;
	first->rb_longbuf.len =
	    wcl_length > WCL_BUF_LEN ? wcl_length : WCL_BUF_LEN;

	if (rdma_buf_alloc(conn, &first->rb_longbuf)) {
		clist_free(first);
		return (FALSE);
	}

	memp = first->rb_longbuf.addr;

	ncl = first;
	for (i = 0; i < num_wclist; i++) {
		ncl->w.c_saddr3 = (caddr_t)memp;
		memp += ncl->c_len;
		ncl = ncl->c_next;
	}

	*wclp = first;
	*total_length = wcl_length;
	return (TRUE);

err_out:
	clist_free(first);
	return (FALSE);
}

/*
 * XDR decode the long reply write chunk.
 */
bool_t
xdr_decode_reply_wchunk(XDR *xdrs, struct clist **clist)
{
	bool_t		have_rchunk = FALSE;
	struct clist	*first = NULL, *ncl = NULL;
	uint32_t	num_wclist;
	uint32_t	i;

	if (!xdr_bool(xdrs, &have_rchunk))
		return (FALSE);

	if (have_rchunk == FALSE)
		return (TRUE);

	if (!xdr_uint32(xdrs, &num_wclist)) {
		DTRACE_PROBE(krpc__e__xdrrdma__replywchunk__listlength);
		return (FALSE);
	}

	if (num_wclist == 0) {
		return (FALSE);
	}

	first = ncl = clist_alloc();

	for (i = 0; i < num_wclist; i++) {

		if (i > 0) {
			ncl->c_next = clist_alloc();
			ncl = ncl->c_next;
		}

		if (!xdr_uint32(xdrs, &ncl->c_dmemhandle.mrc_rmr))
			goto err_out;
		if (!xdr_uint32(xdrs, &ncl->c_len))
			goto err_out;
		if (!xdr_uint64(xdrs, &ncl->u.c_daddr))
			goto err_out;

		if (ncl->c_len > MAX_SVC_XFER_SIZE) {
			DTRACE_PROBE(
			    krpc__e__xdrrdma__replywchunk__chunklist_toobig);
			ncl->c_len = MAX_SVC_XFER_SIZE;
		}
		if (!(ncl->c_dmemhandle.mrc_rmr &&
		    (ncl->c_len > 0) && ncl->u.c_daddr))
			DTRACE_PROBE(
			    krpc__e__xdrrdma__replywchunk__invalid_segaddr);

		DTRACE_PROBE1(krpc__i__xdr_decode_reply_wchunk_c_len,
		    uint32_t, ncl->c_len);

	}
	*clist = first;
	return (TRUE);

err_out:
	clist_free(first);
	return (FALSE);
}


bool_t
xdr_encode_reply_wchunk(XDR *xdrs,
    struct clist *cl_longreply, uint32_t seg_array_len)
{
	int		i;
	bool_t		long_reply_exists = TRUE;
	uint32_t	length;
	uint64		offset;

	if (seg_array_len > 0) {
		if (!xdr_bool(xdrs, &long_reply_exists))
			return (FALSE);
		if (!xdr_uint32(xdrs, &seg_array_len))
			return (FALSE);

		for (i = 0; i < seg_array_len; i++) {
			if (!cl_longreply)
				return (FALSE);
			length = cl_longreply->c_len;
			offset = (uint64) cl_longreply->u.c_daddr;

			DTRACE_PROBE1(
			    krpc__i__xdr_encode_reply_wchunk_c_len,
			    uint32_t, length);

			if (!xdr_uint32(xdrs,
			    &cl_longreply->c_dmemhandle.mrc_rmr))
				return (FALSE);
			if (!xdr_uint32(xdrs, &length))
				return (FALSE);
			if (!xdr_uint64(xdrs, &offset))
				return (FALSE);
			cl_longreply = cl_longreply->c_next;
		}
	} else {
		long_reply_exists = FALSE;
		if (!xdr_bool(xdrs, &long_reply_exists))
			return (FALSE);
	}
	return (TRUE);
}
bool_t
xdrrdma_read_from_client(struct clist *rlist, CONN **conn, uint_t count)
{
	struct clist	*rdclist;
	struct clist	cl;
	uint_t		total_len = 0;
	uint32_t	status;
	bool_t		retval = TRUE;

	rlist->rb_longbuf.type = RDMA_LONG_BUFFER;
	rlist->rb_longbuf.len =
	    count > RCL_BUF_LEN ? count : RCL_BUF_LEN;

	if (rdma_buf_alloc(*conn, &rlist->rb_longbuf)) {
		return (FALSE);
	}

	/*
	 * The entire buffer is registered with the first chunk.
	 * Later chunks will use the same registered memory handle.
	 */

	cl = *rlist;
	cl.c_next = NULL;
	if (clist_register(*conn, &cl, CLIST_REG_DST) != RDMA_SUCCESS) {
		rdma_buf_free(*conn, &rlist->rb_longbuf);
		DTRACE_PROBE(
		    krpc__e__xdrrdma__readfromclient__clist__reg);
		return (FALSE);
	}

	rlist->c_regtype = CLIST_REG_DST;
	rlist->c_dmemhandle = cl.c_dmemhandle;
	rlist->c_dsynchandle = cl.c_dsynchandle;

	for (rdclist = rlist;
	    rdclist != NULL; rdclist = rdclist->c_next) {
		total_len += rdclist->c_len;
#if (defined(OBJ32)||defined(DEBUG32))
		rdclist->u.c_daddr3 =
		    (caddr_t)((char *)rlist->rb_longbuf.addr +
		    (uint32) rdclist->u.c_daddr3);
#else
		rdclist->u.c_daddr3 =
		    (caddr_t)((char *)rlist->rb_longbuf.addr +
		    (uint64) rdclist->u.c_daddr);

#endif
		cl = (*rdclist);
		cl.c_next = NULL;

		/*
		 * Use the same memory handle for all the chunks
		 */
		cl.c_dmemhandle = rlist->c_dmemhandle;
		cl.c_dsynchandle = rlist->c_dsynchandle;


		DTRACE_PROBE1(krpc__i__xdrrdma__readfromclient__buflen,
		    int, rdclist->c_len);

		/*
		 * Now read the chunk in
		 */
		if (rdclist->c_next == NULL) {
			status = RDMA_READ(*conn, &cl, WAIT);
		} else {
			status = RDMA_READ(*conn, &cl, NOWAIT);
		}
		if (status != RDMA_SUCCESS) {
			DTRACE_PROBE(
			    krpc__e__xdrrdma__readfromclient__readfailed);
			rdma_buf_free(*conn, &rlist->rb_longbuf);
			return (FALSE);
		}
	}

	cl = (*rlist);
	cl.c_next = NULL;
	cl.c_len = total_len;
	if (clist_syncmem(*conn, &cl, CLIST_REG_DST) != RDMA_SUCCESS) {
		retval = FALSE;
	}
	return (retval);
}

bool_t
xdrrdma_free_clist(CONN *conn, struct clist *clp)
{
	rdma_buf_free(conn, &clp->rb_longbuf);
	clist_free(clp);
	return (TRUE);
}

bool_t
xdrrdma_send_read_data(XDR *xdrs, uint_t data_len, struct clist *wcl)
{
	int status;
	xrdma_private_t	*xdrp = (xrdma_private_t *)(xdrs->x_private);
	struct xdr_ops *xops = xdrrdma_xops();
	struct clist *tcl, *wrcl, *cl;
	struct clist fcl;
	int rndup_present, rnduplen;

	rndup_present = 0;
	wrcl = NULL;

	/* caller is doing a sizeof */
	if (xdrs->x_ops != &xdrrdma_ops || xdrs->x_ops == xops)
		return (TRUE);

	/* copy of the first chunk */
	fcl = *wcl;
	fcl.c_next = NULL;

	/*
	 * The entire buffer is registered with the first chunk.
	 * Later chunks will use the same registered memory handle.
	 */

	status = clist_register(xdrp->xp_conn, &fcl, CLIST_REG_SOURCE);
	if (status != RDMA_SUCCESS) {
		return (FALSE);
	}

	wcl->c_regtype = CLIST_REG_SOURCE;
	wcl->c_smemhandle = fcl.c_smemhandle;
	wcl->c_ssynchandle = fcl.c_ssynchandle;

	/*
	 * Only transfer the read data ignoring any trailing
	 * roundup chunks. A bit of work, but it saves an
	 * unnecessary extra RDMA_WRITE containing only
	 * roundup bytes.
	 */

	rnduplen = clist_len(wcl) - data_len;

	if (rnduplen) {

		tcl = wcl->c_next;

		/*
		 * Check if there is a trailing roundup chunk
		 */
		while (tcl) {
			if ((tcl->c_next == NULL) && (tcl->c_len == rnduplen)) {
				rndup_present = 1;
				break;
			}
			tcl = tcl->c_next;
		}

		/*
		 * Make a copy chunk list skipping the last chunk
		 */
		if (rndup_present) {
			cl = wcl;
			tcl = NULL;
			while (cl) {
				if (tcl == NULL) {
					tcl = clist_alloc();
					wrcl = tcl;
				} else {
					tcl->c_next = clist_alloc();
					tcl = tcl->c_next;
				}

				*tcl = *cl;
				cl = cl->c_next;
				/* last chunk */
				if (cl->c_next == NULL)
					break;
			}
			tcl->c_next = NULL;
		}
	}

	if (wrcl == NULL) {
		/* No roundup chunks */
		wrcl = wcl;
	}

	/*
	 * Set the registered memory handles for the
	 * rest of the chunks same as the first chunk.
	 */
	tcl = wrcl->c_next;
	while (tcl) {
		tcl->c_smemhandle = fcl.c_smemhandle;
		tcl->c_ssynchandle = fcl.c_ssynchandle;
		tcl = tcl->c_next;
	}

	/*
	 * Sync the total len beginning from the first chunk.
	 */
	fcl.c_len = clist_len(wrcl);
	status = clist_syncmem(xdrp->xp_conn, &fcl, CLIST_REG_SOURCE);
	if (status != RDMA_SUCCESS) {
		return (FALSE);
	}

	status = RDMA_WRITE(xdrp->xp_conn, wrcl, WAIT);

	if (rndup_present)
		clist_free(wrcl);

	if (status != RDMA_SUCCESS) {
		return (FALSE);
	}

	return (TRUE);
}


/*
 * Reads one chunk at a time
 */

static bool_t
xdrrdma_read_a_chunk(XDR *xdrs, CONN **conn)
{
	int status;
	int32_t len = 0;
	xrdma_private_t	*xdrp = (xrdma_private_t *)(xdrs->x_private);
	struct clist *cle = *(xdrp->xp_rcl_next);
	struct clist *rclp = xdrp->xp_rcl;
	struct clist *clp;

	/*
	 * len is used later to decide xdr offset in
	 * the chunk factoring any 4-byte XDR alignment
	 * (See read chunk example top of this file)
	 */
	while (rclp != cle) {
		len += rclp->c_len;
		rclp = rclp->c_next;
	}

	len = RNDUP(len) - len;

	ASSERT(xdrs->x_handy <= 0);

	/*
	 * If this is the first chunk to contain the RPC
	 * message set xp_off to the xdr offset of the
	 * inline message.
	 */
	if (xdrp->xp_off == 0)
		xdrp->xp_off = (xdrp->xp_offp - xdrs->x_base);

	if (cle == NULL || (cle->c_xdroff != xdrp->xp_off))
		return (FALSE);

	/*
	 * Make a copy of the chunk to read from client.
	 * Chunks are read on demand, so read only one
	 * for now.
	 */

	rclp = clist_alloc();
	*rclp = *cle;
	rclp->c_next = NULL;

	xdrp->xp_rcl_next = &cle->c_next;

	/*
	 * If there is a roundup present, then skip those
	 * bytes when reading.
	 */
	if (len) {
		rclp->w.c_saddr =
		    (uint64)(uintptr_t)rclp->w.c_saddr + len;
			rclp->c_len = rclp->c_len - len;
	}

	status = xdrrdma_read_from_client(rclp, conn, rclp->c_len);

	if (status == FALSE) {
		clist_free(rclp);
		return (status);
	}

	xdrp->xp_offp = rclp->rb_longbuf.addr;
	xdrs->x_base = xdrp->xp_offp;
	xdrs->x_handy = rclp->c_len;

	/*
	 * This copy of read chunks containing the XDR
	 * message is freed later in xdrrdma_destroy()
	 */

	if (xdrp->xp_rcl_xdr) {
		/* Add the chunk to end of the list */
		clp = xdrp->xp_rcl_xdr;
		while (clp->c_next != NULL)
			clp = clp->c_next;
		clp->c_next = rclp;
	} else {
		xdrp->xp_rcl_xdr = rclp;
	}
	return (TRUE);
}

static void
xdrrdma_free_xdr_chunks(CONN *conn, struct clist *xdr_rcl)
{
	struct clist *cl;

	(void) clist_deregister(conn, xdr_rcl);

	/*
	 * Read chunks containing parts XDR message are
	 * special: in case of multiple chunks each has
	 * its own buffer.
	 */

	cl = xdr_rcl;
	while (cl) {
		rdma_buf_free(conn, &cl->rb_longbuf);
		cl = cl->c_next;
	}

	clist_free(xdr_rcl);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved  	*/

/*
 * Portions of this source code were derived from Berkeley 4.3 BSD
 * under license from the Regents of the University of California.
 */

/*
 * #if !defined(lint) && defined(SCCSIDS)
 * static char sccsid[] = "@(#)xdr_refer.c 1.21 89/02/28 SMI";
 * #endif
 */

/*
 * xdr_refer.c, Generic XDR routines impelmentation.
 *
 * These are the "non-trivial" xdr primitives used to serialize and de-serialize
 * "pointers".  See xdr.h for more info on the interface to xdr.
 */

#include <sys/param.h>
#include <sys/systm.h>

#include <rpc/types.h>
#include <rpc/xdr.h>

#define	LASTUNSIGNED	((uint_t)0-1)

/*
 * XDR an indirect pointer
 * xdr_reference is for recursively translating a structure that is
 * referenced by a pointer inside the structure that is currently being
 * translated.  pp references a pointer to storage. If *pp is null
 * the  necessary storage is allocated.
 * size is the sizeof the referneced structure.
 * proc is the routine to handle the referenced structure.
 */
bool_t
xdr_reference(XDR *xdrs, caddr_t *pp, uint_t size, const xdrproc_t proc)
{
	caddr_t loc = *pp;
	bool_t stat;

	if (loc == NULL) {
		switch (xdrs->x_op) {
		case XDR_FREE:
			return (TRUE);

		case XDR_DECODE:
			*pp = loc = (caddr_t)mem_alloc(size);
			bzero(loc, size);
			break;

		case XDR_ENCODE:
			break;
		}
	}

	stat = (*proc)(xdrs, loc, LASTUNSIGNED);

	if (xdrs->x_op == XDR_FREE) {
		mem_free(loc, size);
		*pp = NULL;
	}
	return (stat);
}

/*
 * xdr_pointer():
 *
 * XDR a pointer to a possibly recursive data structure. This
 * differs with xdr_reference in that it can serialize/deserialiaze
 * trees correctly.
 *
 *  What's sent is actually a union:
 *
 *  union object_pointer switch (boolean b) {
 *  case TRUE: object_data data;
 *  case FALSE: void nothing;
 *  }
 *
 * > objpp: Pointer to the pointer to the object.
 * > obj_size: size of the object.
 * > xdr_obj: routine to XDR an object.
 *
 */
bool_t
xdr_pointer(XDR *xdrs, char **objpp, uint_t obj_size, const xdrproc_t xdr_obj)
{
	bool_t more_data;

	more_data = (*objpp != NULL);
	if (!xdr_bool(xdrs, &more_data))
		return (FALSE);
	if (!more_data) {
		*objpp = NULL;
		return (TRUE);
	}
	return (xdr_reference(xdrs, objpp, obj_size, xdr_obj));
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/*
 * Copyright 2012 Nexenta Systems, Inc. All rights reserved.
 * Copyright 2017 RackTop Systems.
 */

#include <rpc/types.h>
#include <rpc/xdr.h>
#include <sys/types.h>

/* ARGSUSED */
static bool_t
x_putint32_t(XDR *xdrs, int32_t *ip)
{
	xdrs->x_handy += BYTES_PER_XDR_UNIT;
	return (TRUE);
}

/* ARGSUSED */
static bool_t
x_putbytes(XDR *xdrs, char *bp, int len)
{
	xdrs->x_handy += len;
	return (TRUE);
}

static uint_t
x_getpostn(XDR *xdrs)
{
	return (xdrs->x_handy);
}

/* ARGSUSED */
static bool_t
x_setpostn(XDR *xdrs, uint_t pos)
{
	/* This is not allowed */
	return (FALSE);
}

static rpc_inline_t *
x_inline(XDR *xdrs, int len)
{
	if (len == 0) {
		return (NULL);
	}
	if (xdrs->x_op != XDR_ENCODE) {
		return (NULL);
	}
	if (len < (uintptr_t)xdrs->x_base) {
		/* x_private was already allocated */
		xdrs->x_handy += len;
		return ((rpc_inline_t *)xdrs->x_private);
	} else {
		/* Free the earlier space and allocate new area */
		if (xdrs->x_private)
			mem_free(xdrs->x_private, (uintptr_t)xdrs->x_base);
		if ((xdrs->x_private = (caddr_t)mem_alloc(len)) == NULL) {
			xdrs->x_base = 0;
			return (NULL);
		}
		xdrs->x_base = (caddr_t)(uintptr_t)len;
		xdrs->x_handy += len;
		return ((rpc_inline_t *)xdrs->x_private);
	}
}

static int
harmless()
{
	/* Always return FALSE/NULL, as the case may be */
	return (0);
}

static void
x_destroy(XDR *xdrs)
{
	xdrs->x_handy = 0;
	if (xdrs->x_private) {
		mem_free(xdrs->x_private, (uintptr_t)xdrs->x_base);
		xdrs->x_private = NULL;
	}
	xdrs->x_base = 0;
}

unsigned int
xdr_sizeof(xdrproc_t func, void *data)
{
	XDR x;
	struct xdr_ops ops;
	bool_t stat;
	/* to stop ANSI-C compiler from complaining */
	typedef  bool_t (* dummyfunc1)(XDR *, caddr_t, int);
	typedef	 bool_t (* dummyfunc2)(XDR *, int, void *);
#if defined(_LP64) || defined(_KERNEL)
	typedef  bool_t (* dummyfunc3)(XDR *, int32_t *);
#endif

	ops.x_putbytes = x_putbytes;
	ops.x_inline = x_inline;
	ops.x_getpostn = x_getpostn;
	ops.x_setpostn = x_setpostn;
	ops.x_destroy = x_destroy;

#if defined(_LP64) || defined(_KERNEL)
	ops.x_getint32 = (dummyfunc3)harmless;
	ops.x_putint32 = x_putint32_t;
#endif

	/* the other harmless ones */
	ops.x_getbytes = (dummyfunc1)harmless;
	ops.x_control = (dummyfunc2)harmless;

	x.x_op = XDR_ENCODE;
	x.x_ops = &ops;
	x.x_handy = 0;
	x.x_private = (caddr_t)NULL;
	x.x_base = NULL;

	stat = func(&x, data);
	if (x.x_private)
		mem_free(x.x_private, (uintptr_t)x.x_base);
	return (stat == TRUE ? (unsigned int)x.x_handy: 0);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 *
 * Copyright 2017 RackTop Systems.
 */

#include <rpc/types.h>
#include <rpc/xdr.h>
#include <sys/types.h>
#include <sys/sdt.h>
#include <rpc/auth.h>
#include <rpc/rpc_rdma.h>

struct private {
	int	min_chunk;
	uint_t	flags;			/* controls setting for rdma xdr */
	int	num_chunk;
	caddr_t	inline_buf;		/* temporary buffer for xdr inlining */
	int	inline_len;		/* inline buffer length */
	uint_t	xp_reply_chunk_len;
	uint_t	xp_reply_chunk_len_alt;
};

/* ARGSUSED */
static bool_t
x_putint32_t(XDR *xdrs, int32_t *ip)
{
	xdrs->x_handy += BYTES_PER_XDR_UNIT;
	return (TRUE);
}

/* ARGSUSED */
static bool_t
x_putbytes(XDR *xdrs, char *bp, int len)
{
	struct private *xdrp = (struct private *)xdrs->x_private;

	/*
	 * min_chunk = 0, means that the stream of bytes, to estimate size of,
	 * contains no chunks to seperate out. See xdrrdma_putbytes()
	 */
	if (len < xdrp->min_chunk || !(xdrp->flags & XDR_RDMA_CHUNK)) {
		xdrs->x_handy += len;
		return (TRUE);
	}
	/*
	 * Chunk item. No impact on xdr size.
	 */
	xdrp->num_chunk++;

	return (TRUE);
}

static uint_t
x_getpostn(XDR *xdrs)
{
	return (xdrs->x_handy);
}

/* ARGSUSED */
static bool_t
x_setpostn(XDR *xdrs, uint_t pos)
{
	/* This is not allowed */
	return (FALSE);
}

/* ARGSUSED */
static bool_t
x_control(XDR *xdrs, int request, void *info)
{
	int32_t *int32p;
	uint_t in_flags;
	rdma_chunkinfo_t *rcip = NULL;
	rdma_chunkinfo_lengths_t *rcilp = NULL;
	struct private *xdrp = (struct private *)xdrs->x_private;

	switch (request) {
	case XDR_RDMA_SET_FLAGS:
		/*
		 * Set the flags provided in the *info in xp_flags for rdma xdr
		 * stream control.
		 */
		int32p = (int32_t *)info;
		in_flags = (uint_t)(*int32p);

		xdrp->flags = in_flags;
		return (TRUE);

	case XDR_RDMA_GET_FLAGS:
		/*
		 * Get the flags provided in xp_flags return through *info
		 */
		int32p = (int32_t *)info;

		*int32p = (int32_t)xdrp->flags;
		return (TRUE);

	case XDR_RDMA_GET_CHUNK_LEN:
		rcilp = (rdma_chunkinfo_lengths_t *)info;
		rcilp->rcil_len = xdrp->xp_reply_chunk_len;
		rcilp->rcil_len_alt = xdrp->xp_reply_chunk_len_alt;

		return (TRUE);

	case XDR_RDMA_ADD_CHUNK:
		rcip = (rdma_chunkinfo_t *)info;

		switch (rcip->rci_type) {
		case RCI_WRITE_UIO_CHUNK:
			xdrp->xp_reply_chunk_len_alt += rcip->rci_len;
			break;

		case RCI_WRITE_ADDR_CHUNK:
			xdrp->xp_reply_chunk_len_alt += rcip->rci_len;
			break;

		case RCI_REPLY_CHUNK:
			xdrp->xp_reply_chunk_len += rcip->rci_len;
			break;
		}
		return (TRUE);

	default:
		return (FALSE);
	}
}

/* ARGSUSED */
static rpc_inline_t *
x_inline(XDR *xdrs, int len)
{
	struct private *xdrp = (struct private *)xdrs->x_private;

	if (len == 0) {
		return (NULL);
	}
	if (xdrs->x_op != XDR_ENCODE) {
		return (NULL);
	}
	if (len >= xdrp->min_chunk) {
		return (NULL);
	}
	if (len <= xdrp->inline_len) {
		/* inline_buf was already allocated, just reuse it */
		xdrs->x_handy += len;
		return ((rpc_inline_t *)xdrp->inline_buf);
	} else {
		/* Free the earlier space and allocate new area */
		if (xdrp->inline_buf)
			mem_free(xdrp->inline_buf, xdrp->inline_len);
		if ((xdrp->inline_buf = (caddr_t)mem_alloc(len)) == NULL) {
			xdrp->inline_len = 0;
			return (NULL);
		}
		xdrp->inline_len = len;
		xdrs->x_handy += len;
		return ((rpc_inline_t *)xdrp->inline_buf);
	}
}

static int
harmless()
{
	/* Always return FALSE/NULL, as the case may be */
	return (0);
}

static void
x_destroy(XDR *xdrs)
{
	struct private *xdrp = (struct private *)xdrs->x_private;

	xdrs->x_handy = 0;
	if (xdrp) {
		if (xdrp->inline_buf)
			mem_free(xdrp->inline_buf, xdrp->inline_len);
		mem_free(xdrp, sizeof (struct private));
		xdrs->x_private = NULL;
	}
	xdrs->x_base = 0;
}

static bool_t
xdrrdma_common(XDR *xdrs, int min_chunk)
{
	struct private *xdrp;

	xdrs->x_ops = xdrrdma_xops();
	xdrs->x_op = XDR_ENCODE;
	xdrs->x_handy = 0;
	xdrs->x_base = NULL;
	xdrs->x_private = kmem_zalloc(sizeof (struct private), KM_SLEEP);
	xdrp = (struct private *)xdrs->x_private;
	xdrp->min_chunk = min_chunk;
	xdrp->flags = 0;
	if (xdrp->min_chunk != 0)
		xdrp->flags |= XDR_RDMA_CHUNK;

	xdrp->xp_reply_chunk_len = 0;
	xdrp->xp_reply_chunk_len_alt = 0;

	return (TRUE);
}

unsigned int
xdrrdma_sizeof(xdrproc_t func, void *data, int min_chunk,
    uint_t *reply_size, uint_t *reply_size_alt)
{
	XDR x;
	struct xdr_ops ops;
	bool_t stat;
	struct private *xdrp;

	x.x_ops = &ops;
	(void) xdrrdma_common(&x, min_chunk);

	stat = func(&x, data);
	xdrp = (struct private *)x.x_private;
	if (xdrp) {
		if (reply_size != NULL)
			*reply_size = xdrp->xp_reply_chunk_len;
		if (reply_size_alt != NULL)
			*reply_size_alt = xdrp->xp_reply_chunk_len_alt;
		if (xdrp->inline_buf)
			mem_free(xdrp->inline_buf, xdrp->inline_len);
		mem_free(xdrp, sizeof (struct private));
	}
	return (stat == TRUE ? (unsigned int)x.x_handy: 0);
}

unsigned int
xdrrdma_authsize(AUTH *auth, struct cred *cred, int min_chunk)
{
	XDR x;
	struct xdr_ops ops;
	bool_t stat;
	struct private *xdrp;

	x.x_ops = &ops;
	(void) xdrrdma_common(&x, min_chunk);

	stat = AUTH_MARSHALL(auth, &x, cred);
	xdrp = (struct private *)x.x_private;
	if (xdrp) {
		if (xdrp->inline_buf)
			mem_free(xdrp->inline_buf, xdrp->inline_len);
		mem_free(xdrp, sizeof (struct private));
	}
	return (stat == TRUE ? (unsigned int)x.x_handy: 0);
}

struct xdr_ops *
xdrrdma_xops(void)
{
	static struct xdr_ops ops;

	/* to stop ANSI-C compiler from complaining */
	typedef  bool_t (* dummyfunc1)(XDR *, caddr_t, int);
#if defined(_LP64) || defined(_KERNEL)
	typedef  bool_t (* dummyfunc2)(XDR *, int32_t *);
#endif

	ops.x_putbytes = x_putbytes;
	ops.x_inline = x_inline;
	ops.x_getpostn = x_getpostn;
	ops.x_setpostn = x_setpostn;
	ops.x_destroy = x_destroy;
	ops.x_control = x_control;

#if defined(_LP64) || defined(_KERNEL)
	ops.x_getint32 = (dummyfunc2)harmless;
	ops.x_putint32 = x_putint32_t;
#endif

	/* the other harmless ones */
	ops.x_getbytes = (dummyfunc1)harmless;

	return (&ops);
}