libnsl/rpc/svc.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
 * Copyright (c) 2016 by Delphix. All rights reserved.
 * Copyright 2017 Joyent Inc
 */
/*
 * Copyright 1993 OpenVision Technologies, Inc., All Rights Reserved.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * Portions of this source code were derived from Berkeley
 * 4.3 BSD under license from the Regents of the University of
 * California.
 */

/*
 * svc.c, Server-side remote procedure call interface.
 *
 * There are two sets of procedures here.  The xprt routines are
 * for handling transport handles.  The svc routines handle the
 * list of service routines.
 *
 */

#include "mt.h"
#include "rpc_mt.h"
#include <assert.h>
#include <errno.h>
#include <sys/types.h>
#include <stropts.h>
#include <sys/conf.h>
#include <rpc/rpc.h>
#include <rpc/auth.h>
#ifdef PORTMAP
#include <rpc/pmap_clnt.h>
#endif
#include <sys/poll.h>
#include <netconfig.h>
#include <syslog.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <limits.h>

extern bool_t __svc_get_door_cred();
extern bool_t __rpc_get_local_cred();

SVCXPRT **svc_xports;
static int nsvc_xports; 	/* total number of svc_xports allocated */

XDR **svc_xdrs;		/* common XDR receive area */
int nsvc_xdrs;		/* total number of svc_xdrs allocated */

int __rpc_use_pollfd_done;	/* to unlimit the number of connections */

#define	NULL_SVC ((struct svc_callout *)0)

/*
 * The services list
 * Each entry represents a set of procedures (an rpc program).
 * The dispatch routine takes request structs and runs the
 * appropriate procedure.
 */
static struct svc_callout {
	struct svc_callout *sc_next;
	rpcprog_t	    sc_prog;
	rpcvers_t	    sc_vers;
	char		   *sc_netid;
	void		    (*sc_dispatch)();
} *svc_head;
extern rwlock_t	svc_lock;

static struct svc_callout *svc_find();
int _svc_prog_dispatch();
void svc_getreq_common();
char *strdup();

extern mutex_t	svc_door_mutex;
extern cond_t	svc_door_waitcv;
extern int	svc_ndoorfds;
extern SVCXPRT_LIST *_svc_xprtlist;
extern mutex_t xprtlist_lock;
extern void __svc_rm_from_xlist();

#if !defined(_LP64)
extern fd_set _new_svc_fdset;
#endif

/*
 * If the allocated array of reactor is too small, this value is used as a
 * margin. This reduces the number of allocations.
 */
#define	USER_FD_INCREMENT 5

static void add_pollfd(int fd, short events);
static void remove_pollfd(int fd);
static void __svc_remove_input_of_fd(int fd);

/*
 * Data used to handle reactor:
 * 	- one file descriptor we listen to,
 *	- one callback we call if the fd pops,
 *	- and a cookie passed as a parameter to the callback.
 *
 * The structure is an array indexed on the file descriptor. Each entry is
 * pointing to the first element of a double-linked list of callback.
 * only one callback may be associated to a couple (fd, event).
 */

struct _svc_user_fd_head;

typedef struct {
	struct _svc_user_fd_node *next;
	struct _svc_user_fd_node *previous;
} _svc_user_link;

typedef struct _svc_user_fd_node {
	_svc_user_link lnk;
	svc_input_id_t id;
	int	    fd;
	unsigned int   events;
	svc_callback_t callback;
	void*	  cookie;
} _svc_user_fd_node;

typedef struct _svc_user_fd_head {
	struct _svc_user_fd_node *list;
	unsigned int mask;    /* logical OR of all sub-masks */
} _svc_user_fd_head;


/* Array of defined reactor - indexed on file descriptor */
static _svc_user_fd_head *svc_userfds = NULL;

/* current size of file descriptor */
static int svc_nuserfds = 0;

/* Mutex to ensure MT safe operations for user fds callbacks. */
static mutex_t svc_userfds_lock = DEFAULTMUTEX;


/*
 * This structure is used to have constant time alogrithms. There is an array
 * of this structure as large as svc_nuserfds. When the user is registering a
 * new callback, the address of the created structure is stored in a cell of
 * this array. The address of this cell is the returned unique identifier.
 *
 * On removing, the id is given by the user, then we know if this cell is
 * filled or not (with free). If it is free, we return an error. Otherwise,
 * we can free the structure pointed by fd_node.
 *
 * On insertion, we use the linked list created by (first_free,
 * next_free). In this way with a constant time computation, we can give a
 * correct index to the user.
 */

typedef struct _svc_management_user_fd {
	bool_t free;
	union {
		svc_input_id_t next_free;
		_svc_user_fd_node *fd_node;
	} data;
} _svc_management_user_fd;

/* index to the first free elem */
static svc_input_id_t first_free = (svc_input_id_t)-1;
/* the size of this array is the same as svc_nuserfds */
static _svc_management_user_fd* user_fd_mgt_array = NULL;

/* current size of user_fd_mgt_array */
static int svc_nmgtuserfds = 0;


/* Define some macros to access data associated to registration ids. */
#define	node_from_id(id) (user_fd_mgt_array[(int)id].data.fd_node)
#define	is_free_id(id) (user_fd_mgt_array[(int)id].free)

#ifndef POLLSTANDARD
#define	POLLSTANDARD \
	(POLLIN|POLLPRI|POLLOUT|POLLRDNORM|POLLRDBAND| \
	POLLWRBAND|POLLERR|POLLHUP|POLLNVAL)
#endif

/*
 * To free an Id, we set the cell as free and insert its address in the list
 * of free cell.
 */

static void
_svc_free_id(const svc_input_id_t id)
{
	assert(((int)id >= 0) && ((int)id < svc_nmgtuserfds));
	user_fd_mgt_array[(int)id].free = TRUE;
	user_fd_mgt_array[(int)id].data.next_free = first_free;
	first_free = id;
}

/*
 * To get a free cell, we just have to take it from the free linked list and
 * set the flag to "not free". This function also allocates new memory if
 * necessary
 */
static svc_input_id_t
_svc_attribute_new_id(_svc_user_fd_node *node)
{
	int selected_index = (int)first_free;
	assert(node != NULL);

	if (selected_index == -1) {
		/* Allocate new entries */
		int L_inOldSize = svc_nmgtuserfds;
		int i;
		_svc_management_user_fd *tmp;

		svc_nmgtuserfds += USER_FD_INCREMENT;

		tmp = realloc(user_fd_mgt_array,
		    svc_nmgtuserfds * sizeof (_svc_management_user_fd));

		if (tmp == NULL) {
			syslog(LOG_ERR, "_svc_attribute_new_id: out of memory");
			svc_nmgtuserfds = L_inOldSize;
			errno = ENOMEM;
			return ((svc_input_id_t)-1);
		}

		user_fd_mgt_array = tmp;

		for (i = svc_nmgtuserfds - 1; i >= L_inOldSize; i--)
			_svc_free_id((svc_input_id_t)i);
		selected_index = (int)first_free;
	}

	node->id = (svc_input_id_t)selected_index;
	first_free = user_fd_mgt_array[selected_index].data.next_free;

	user_fd_mgt_array[selected_index].data.fd_node = node;
	user_fd_mgt_array[selected_index].free = FALSE;

	return ((svc_input_id_t)selected_index);
}

/*
 * Access to a pollfd treatment. Scan all the associated callbacks that have
 * at least one bit in their mask that masks a received event.
 *
 * If event POLLNVAL is received, we check that one callback processes it, if
 * not, then remove the file descriptor from the poll. If there is one, let
 * the user do the work.
 */
void
__svc_getreq_user(struct pollfd *pfd)
{
	int fd = pfd->fd;
	short revents = pfd->revents;
	bool_t invalHandled = FALSE;
	_svc_user_fd_node *node;

	(void) mutex_lock(&svc_userfds_lock);

	if ((fd < 0) || (fd >= svc_nuserfds)) {
		(void) mutex_unlock(&svc_userfds_lock);
		return;
	}

	node = svc_userfds[fd].list;

	/* check if at least one mask fits */
	if (0 == (revents & svc_userfds[fd].mask)) {
		(void) mutex_unlock(&svc_userfds_lock);
		return;
	}

	while ((svc_userfds[fd].mask != 0) && (node != NULL)) {
		/*
		 * If one of the received events maps the ones the node listens
		 * to
		 */
		_svc_user_fd_node *next = node->lnk.next;

		if (node->callback != NULL) {
			if (node->events & revents) {
				if (revents & POLLNVAL) {
					invalHandled = TRUE;
				}

				/*
				 * The lock must be released before calling the
				 * user function, as this function can call
				 * svc_remove_input() for example.
				 */
				(void) mutex_unlock(&svc_userfds_lock);
				node->callback(node->id, node->fd,
				    node->events & revents, node->cookie);
				/*
				 * Do not use the node structure anymore, as it
				 * could have been deallocated by the previous
				 * callback.
				 */
				(void) mutex_lock(&svc_userfds_lock);
			}
		}
		node = next;
	}

	if ((revents & POLLNVAL) && !invalHandled)
		__svc_remove_input_of_fd(fd);
	(void) mutex_unlock(&svc_userfds_lock);
}


/*
 * Check if a file descriptor is associated with a user reactor.
 * To do this, just check that the array indexed on fd has a non-void linked
 * list (ie. first element is not NULL)
 */
bool_t
__is_a_userfd(int fd)
{
	/* Checks argument */
	if ((fd < 0) || (fd >= svc_nuserfds))
		return (FALSE);
	return ((svc_userfds[fd].mask == 0x0000)? FALSE:TRUE);
}

/* free everything concerning user fd */
/* used in svc_run.c => no static */

void
__destroy_userfd(void)
{
	int one_fd;
	/* Clean user fd */
	if (svc_userfds != NULL) {
		for (one_fd = 0; one_fd < svc_nuserfds; one_fd++) {
			_svc_user_fd_node *node;

			node = svc_userfds[one_fd].list;
			while (node != NULL) {
				_svc_user_fd_node *tmp = node;
				_svc_free_id(node->id);
				node = node->lnk.next;
				free(tmp);
			}
		}

		free(user_fd_mgt_array);
		user_fd_mgt_array = NULL;
		first_free = (svc_input_id_t)-1;

		free(svc_userfds);
		svc_userfds = NULL;
		svc_nuserfds = 0;
	}
}

/*
 * Remove all the callback associated with a fd => useful when the fd is
 * closed for instance
 */
static void
__svc_remove_input_of_fd(int fd)
{
	_svc_user_fd_node **pnode;
	_svc_user_fd_node *tmp;

	if ((fd < 0) || (fd >= svc_nuserfds))
		return;

	pnode = &svc_userfds[fd].list;
	while ((tmp = *pnode) != NULL) {
		*pnode = tmp->lnk.next;

		_svc_free_id(tmp->id);
		free(tmp);
	}

	svc_userfds[fd].mask = 0;
}

/*
 * Allow user to add an fd in the poll list. If it does not succeed, return
 * -1. Otherwise, return a svc_id
 */

svc_input_id_t
svc_add_input(int user_fd, unsigned int events,
    svc_callback_t user_callback, void *cookie)
{
	_svc_user_fd_node *new_node;

	if (user_fd < 0) {
		errno = EINVAL;
		return ((svc_input_id_t)-1);
	}

	if ((events == 0x0000) ||
	    (events & ~(POLLIN|POLLPRI|POLLOUT|POLLRDNORM|POLLRDBAND|\
	    POLLWRBAND|POLLERR|POLLHUP|POLLNVAL))) {
		errno = EINVAL;
		return ((svc_input_id_t)-1);
	}

	(void) mutex_lock(&svc_userfds_lock);

	if ((user_fd < svc_nuserfds) &&
	    (svc_userfds[user_fd].mask & events) != 0) {
		/* Already registrated call-back */
		errno = EEXIST;
		(void) mutex_unlock(&svc_userfds_lock);
		return ((svc_input_id_t)-1);
	}

	/* Handle memory allocation. */
	if (user_fd >= svc_nuserfds) {
		int oldSize = svc_nuserfds;
		int i;
		_svc_user_fd_head *tmp;

		svc_nuserfds = (user_fd + 1) + USER_FD_INCREMENT;

		tmp = realloc(svc_userfds,
		    svc_nuserfds * sizeof (_svc_user_fd_head));

		if (tmp == NULL) {
			syslog(LOG_ERR, "svc_add_input: out of memory");
			svc_nuserfds = oldSize;
			errno = ENOMEM;
			(void) mutex_unlock(&svc_userfds_lock);
			return ((svc_input_id_t)-1);
		}

		svc_userfds = tmp;

		for (i = oldSize; i < svc_nuserfds; i++) {
			svc_userfds[i].list = NULL;
			svc_userfds[i].mask = 0;
		}
	}

	new_node = malloc(sizeof (_svc_user_fd_node));
	if (new_node == NULL) {
		syslog(LOG_ERR, "svc_add_input: out of memory");
		errno = ENOMEM;
		(void) mutex_unlock(&svc_userfds_lock);
		return ((svc_input_id_t)-1);
	}

	/* create a new node */
	new_node->fd		= user_fd;
	new_node->events	= events;
	new_node->callback	= user_callback;
	new_node->cookie	= cookie;

	if (_svc_attribute_new_id(new_node) == -1) {
		(void) mutex_unlock(&svc_userfds_lock);
		free(new_node);
		return ((svc_input_id_t)-1);
	}

	/* Add the new element at the beginning of the list. */
	if (svc_userfds[user_fd].list != NULL)
		svc_userfds[user_fd].list->lnk.previous = new_node;
	new_node->lnk.next = svc_userfds[user_fd].list;
	new_node->lnk.previous = NULL;

	svc_userfds[user_fd].list = new_node;

	/* refresh global mask for this file desciptor */
	svc_userfds[user_fd].mask |= events;

	/* refresh mask for the poll */
	add_pollfd(user_fd, (svc_userfds[user_fd].mask));

	(void) mutex_unlock(&svc_userfds_lock);
	return (new_node->id);
}

int
svc_remove_input(svc_input_id_t id)
{
	_svc_user_fd_node* node;
	_svc_user_fd_node* next;
	_svc_user_fd_node* previous;
	int fd;		/* caching optim */

	(void) mutex_lock(&svc_userfds_lock);

	/* Immediately update data for id management */
	if (user_fd_mgt_array == NULL || id >= svc_nmgtuserfds ||
	    is_free_id(id)) {
		errno = EINVAL;
		(void) mutex_unlock(&svc_userfds_lock);
		return (-1);
	}

	node = node_from_id(id);
	assert(node != NULL);

	_svc_free_id(id);
	next		= node->lnk.next;
	previous	= node->lnk.previous;
	fd		= node->fd; /* caching optim */

	/* Remove this node from the list. */
	if (previous != NULL) {
		previous->lnk.next = next;
	} else {
		assert(svc_userfds[fd].list == node);
		svc_userfds[fd].list = next;
	}
	if (next != NULL)
		next->lnk.previous = previous;

	/* Remove the node flags from the global mask */
	svc_userfds[fd].mask ^= node->events;

	free(node);
	if (svc_userfds[fd].mask == 0) {
		assert(svc_userfds[fd].list == NULL);
		remove_pollfd(fd);
	} else {
		assert(svc_userfds[fd].list != NULL);
	}
	/* <=> CLEAN NEEDED TO SHRINK MEMORY USAGE */

	(void) mutex_unlock(&svc_userfds_lock);
	return (0);
}

/*
 * Provides default service-side functions for authentication flavors
 * that do not use all the fields in struct svc_auth_ops.
 */

/*ARGSUSED*/
static int
authany_wrap(AUTH *auth, XDR *xdrs, xdrproc_t xfunc, caddr_t xwhere)
{
	return (*xfunc)(xdrs, xwhere);
}

struct svc_auth_ops svc_auth_any_ops = {
	authany_wrap,
	authany_wrap,
};

/*
 * Return pointer to server authentication structure.
 */
SVCAUTH *
__svc_get_svcauth(SVCXPRT *xprt)
{
/* LINTED pointer alignment */
	return (&SVC_XP_AUTH(xprt));
}

/*
 * A callback routine to cleanup after a procedure is executed.
 */
void (*__proc_cleanup_cb)() = NULL;

void *
__svc_set_proc_cleanup_cb(void *cb)
{
	void	*tmp = (void *)__proc_cleanup_cb;

	__proc_cleanup_cb = (void (*)())cb;
	return (tmp);
}

/* ***************  SVCXPRT related stuff **************** */


static int pollfd_shrinking = 1;


/*
 * Add fd to svc_pollfd
 */
static void
add_pollfd(int fd, short events)
{
	if (fd < FD_SETSIZE) {
		FD_SET(fd, &svc_fdset);
#if !defined(_LP64)
		FD_SET(fd, &_new_svc_fdset);
#endif
		svc_nfds++;
		svc_nfds_set++;
		if (fd >= svc_max_fd)
			svc_max_fd = fd + 1;
	}
	if (fd >= svc_max_pollfd)
		svc_max_pollfd = fd + 1;
	if (svc_max_pollfd > svc_pollfd_allocd) {
		int i = svc_pollfd_allocd;
		pollfd_t *tmp;
		do {
			svc_pollfd_allocd += POLLFD_EXTEND;
		} while (svc_max_pollfd > svc_pollfd_allocd);
		tmp = realloc(svc_pollfd,
		    sizeof (pollfd_t) * svc_pollfd_allocd);
		if (tmp != NULL) {
			svc_pollfd = tmp;
			for (; i < svc_pollfd_allocd; i++)
				POLLFD_CLR(i, tmp);
		} else {
			/*
			 * give an error message; undo fdset setting
			 * above;  reset the pollfd_shrinking flag.
			 * because of this poll will not be done
			 * on these fds.
			 */
			if (fd < FD_SETSIZE) {
				FD_CLR(fd, &svc_fdset);
#if !defined(_LP64)
				FD_CLR(fd, &_new_svc_fdset);
#endif
				svc_nfds--;
				svc_nfds_set--;
				if (fd == (svc_max_fd - 1))
					svc_max_fd--;
			}
			if (fd == (svc_max_pollfd - 1))
				svc_max_pollfd--;
			pollfd_shrinking = 0;
			syslog(LOG_ERR, "add_pollfd: out of memory");
			_exit(1);
		}
	}
	svc_pollfd[fd].fd	= fd;
	svc_pollfd[fd].events	= events;
	svc_npollfds++;
	svc_npollfds_set++;
}

/*
 * the fd is still active but only the bit in fdset is cleared.
 * do not subtract svc_nfds or svc_npollfds
 */
void
clear_pollfd(int fd)
{
	if (fd < FD_SETSIZE && FD_ISSET(fd, &svc_fdset)) {
		FD_CLR(fd, &svc_fdset);
#if !defined(_LP64)
		FD_CLR(fd, &_new_svc_fdset);
#endif
		svc_nfds_set--;
	}
	if (fd < svc_pollfd_allocd && POLLFD_ISSET(fd, svc_pollfd)) {
		POLLFD_CLR(fd, svc_pollfd);
		svc_npollfds_set--;
	}
}

/*
 * sets the bit in fdset for an active fd so that poll() is done for that
 */
void
set_pollfd(int fd, short events)
{
	if (fd < FD_SETSIZE) {
		FD_SET(fd, &svc_fdset);
#if !defined(_LP64)
		FD_SET(fd, &_new_svc_fdset);
#endif
		svc_nfds_set++;
	}
	if (fd < svc_pollfd_allocd) {
		svc_pollfd[fd].fd	= fd;
		svc_pollfd[fd].events	= events;
		svc_npollfds_set++;
	}
}

/*
 * remove a svc_pollfd entry; it does not shrink the memory
 */
static void
remove_pollfd(int fd)
{
	clear_pollfd(fd);
	if (fd == (svc_max_fd - 1))
		svc_max_fd--;
	svc_nfds--;
	if (fd == (svc_max_pollfd - 1))
		svc_max_pollfd--;
	svc_npollfds--;
}

/*
 * delete a svc_pollfd entry; it shrinks the memory
 * use remove_pollfd if you do not want to shrink
 */
static void
delete_pollfd(int fd)
{
	remove_pollfd(fd);
	if (pollfd_shrinking && svc_max_pollfd <
	    (svc_pollfd_allocd - POLLFD_SHRINK)) {
		do {
			svc_pollfd_allocd -= POLLFD_SHRINK;
		} while (svc_max_pollfd < (svc_pollfd_allocd - POLLFD_SHRINK));
		svc_pollfd = realloc(svc_pollfd,
		    sizeof (pollfd_t) * svc_pollfd_allocd);
		if (svc_pollfd == NULL) {
			syslog(LOG_ERR, "delete_pollfd: out of memory");
			_exit(1);
		}
	}
}


/*
 * Activate a transport handle.
 */
void
xprt_register(const SVCXPRT *xprt)
{
	int fd = xprt->xp_fd;
#ifdef CALLBACK
	extern void (*_svc_getreqset_proc)();
#endif
/* VARIABLES PROTECTED BY svc_fd_lock: svc_xports, svc_fdset */

	(void) rw_wrlock(&svc_fd_lock);
	if (svc_xports == NULL) {
		/* allocate some small amount first */
		svc_xports = calloc(FD_INCREMENT,  sizeof (SVCXPRT *));
		if (svc_xports == NULL) {
			syslog(LOG_ERR, "xprt_register: out of memory");
			_exit(1);
		}
		nsvc_xports = FD_INCREMENT;

#ifdef CALLBACK
		/*
		 * XXX: This code does not keep track of the server state.
		 *
		 * This provides for callback support.	When a client
		 * recv's a call from another client on the server fd's,
		 * it calls _svc_getreqset_proc() which would return
		 * after serving all the server requests.  Also look under
		 * clnt_dg.c and clnt_vc.c  (clnt_call part of it)
		 */
		_svc_getreqset_proc = svc_getreq_poll;
#endif
	}

	while (fd >= nsvc_xports) {
		SVCXPRT **tmp_xprts = svc_xports;

		/* time to expand svc_xprts */
		tmp_xprts = realloc(svc_xports,
		    sizeof (SVCXPRT *) * (nsvc_xports + FD_INCREMENT));
		if (tmp_xprts == NULL) {
			syslog(LOG_ERR, "xprt_register : out of memory.");
			_exit(1);
		}

		svc_xports = tmp_xprts;
		(void) memset(&svc_xports[nsvc_xports], 0,
		    sizeof (SVCXPRT *) * FD_INCREMENT);
		nsvc_xports += FD_INCREMENT;
	}

	svc_xports[fd] = (SVCXPRT *)xprt;

	add_pollfd(fd, MASKVAL);

	if (svc_polling) {
		char dummy;

		/*
		 * This happens only in one of the MT modes.
		 * Wake up poller.
		 */
		(void) write(svc_pipe[1], &dummy, sizeof (dummy));
	}
	/*
	 * If already dispatching door based services, start
	 * dispatching TLI based services now.
	 */
	(void) mutex_lock(&svc_door_mutex);
	if (svc_ndoorfds > 0)
		(void) cond_signal(&svc_door_waitcv);
	(void) mutex_unlock(&svc_door_mutex);

	if (svc_xdrs == NULL) {
		/* allocate initial chunk */
		svc_xdrs = calloc(FD_INCREMENT, sizeof (XDR *));
		if (svc_xdrs != NULL)
			nsvc_xdrs = FD_INCREMENT;
		else {
			syslog(LOG_ERR, "xprt_register : out of memory.");
			_exit(1);
		}
	}
	(void) rw_unlock(&svc_fd_lock);
}

/*
 * De-activate a transport handle.
 */
void
__xprt_unregister_private(const SVCXPRT *xprt, bool_t lock_not_held)
{
	int fd = xprt->xp_fd;

	if (lock_not_held)
		(void) rw_wrlock(&svc_fd_lock);
	if ((fd < nsvc_xports) && (svc_xports[fd] == xprt)) {
		svc_xports[fd] = NULL;
		delete_pollfd(fd);
	}
	if (lock_not_held)
		(void) rw_unlock(&svc_fd_lock);
	__svc_rm_from_xlist(&_svc_xprtlist, xprt, &xprtlist_lock);
}

void
xprt_unregister(const SVCXPRT *xprt)
{
	__xprt_unregister_private(xprt, TRUE);
}

/* ********************** CALLOUT list related stuff ************* */

/*
 * Add a service program to the callout list.
 * The dispatch routine will be called when a rpc request for this
 * program number comes in.
 */
bool_t
svc_reg(const SVCXPRT *xprt, const rpcprog_t prog, const rpcvers_t vers,
    void (*dispatch)(), const struct netconfig *nconf)
{
	struct svc_callout *prev;
	struct svc_callout *s, **s2;
	struct netconfig *tnconf;
	char *netid = NULL;
	int flag = 0;

/* VARIABLES PROTECTED BY svc_lock: s, prev, svc_head */

	if (xprt->xp_netid) {
		netid = strdup(xprt->xp_netid);
		flag = 1;
	} else if (nconf && nconf->nc_netid) {
		netid = strdup(nconf->nc_netid);
		flag = 1;
	} else if ((tnconf = __rpcfd_to_nconf(xprt->xp_fd, xprt->xp_type))
	    != NULL) {
		netid = strdup(tnconf->nc_netid);
		flag = 1;
		freenetconfigent(tnconf);
	} /* must have been created with svc_raw_create */
	if ((netid == NULL) && (flag == 1))
		return (FALSE);

	(void) rw_wrlock(&svc_lock);
	if ((s = svc_find(prog, vers, &prev, netid)) != NULL_SVC) {
		if (netid)
			free(netid);
		if (s->sc_dispatch == dispatch)
			goto rpcb_it; /* it is registering another xptr */
		(void) rw_unlock(&svc_lock);
		return (FALSE);
	}
	s = malloc(sizeof (struct svc_callout));
	if (s == NULL) {
		if (netid)
			free(netid);
		(void) rw_unlock(&svc_lock);
		return (FALSE);
	}

	s->sc_prog = prog;
	s->sc_vers = vers;
	s->sc_dispatch = dispatch;
	s->sc_netid = netid;
	s->sc_next = NULL;

	/*
	 * The ordering of transports is such that the most frequently used
	 * one appears first.  So add the new entry to the end of the list.
	 */
	for (s2 = &svc_head; *s2 != NULL; s2 = &(*s2)->sc_next)
		;
	*s2 = s;

	if ((xprt->xp_netid == NULL) && (flag == 1) && netid)
		if ((((SVCXPRT *)xprt)->xp_netid = strdup(netid)) == NULL) {
			syslog(LOG_ERR, "svc_reg : strdup failed.");
			free(netid);
			free(s);
			*s2 = NULL;
			(void) rw_unlock(&svc_lock);
			return (FALSE);
		}

rpcb_it:
	(void) rw_unlock(&svc_lock);

	/* now register the information with the local binder service */
	if (nconf)
		return (rpcb_set(prog, vers, nconf, &xprt->xp_ltaddr));
	return (TRUE);
	/*NOTREACHED*/
}

/*
 * Remove a service program from the callout list.
 */
void
svc_unreg(const rpcprog_t prog, const rpcvers_t vers)
{
	struct svc_callout *prev;
	struct svc_callout *s;

	/* unregister the information anyway */
	(void) rpcb_unset(prog, vers, NULL);

	(void) rw_wrlock(&svc_lock);
	while ((s = svc_find(prog, vers, &prev, NULL)) != NULL_SVC) {
		if (prev == NULL_SVC) {
			svc_head = s->sc_next;
		} else {
			prev->sc_next = s->sc_next;
		}
		s->sc_next = NULL_SVC;
		if (s->sc_netid)
			free(s->sc_netid);
		free(s);
	}
	(void) rw_unlock(&svc_lock);
}

#ifdef PORTMAP
/*
 * Add a service program to the callout list.
 * The dispatch routine will be called when a rpc request for this
 * program number comes in.
 * For version 2 portmappers.
 */
bool_t
svc_register(SVCXPRT *xprt, rpcprog_t prog, rpcvers_t vers,
    void (*dispatch)(), int protocol)
{
	struct svc_callout *prev;
	struct svc_callout *s;
	struct netconfig *nconf;
	char *netid = NULL;
	int flag = 0;

	if (xprt->xp_netid) {
		netid = strdup(xprt->xp_netid);
		flag = 1;
	} else if ((ioctl(xprt->xp_fd, I_FIND, "timod") > 0) && ((nconf =
	    __rpcfd_to_nconf(xprt->xp_fd, xprt->xp_type)) != NULL)) {
		/* fill in missing netid field in SVCXPRT */
		netid = strdup(nconf->nc_netid);
		flag = 1;
		freenetconfigent(nconf);
	} /* must be svc_raw_create */

	if ((netid == NULL) && (flag == 1))
		return (FALSE);

	(void) rw_wrlock(&svc_lock);
	if ((s = svc_find(prog, vers, &prev, netid)) != NULL_SVC) {
		if (netid)
			free(netid);
		if (s->sc_dispatch == dispatch)
			goto pmap_it;  /* it is registering another xptr */
		(void) rw_unlock(&svc_lock);
		return (FALSE);
	}
	s = malloc(sizeof (struct svc_callout));
	if (s == (struct svc_callout *)0) {
		if (netid)
			free(netid);
		(void) rw_unlock(&svc_lock);
		return (FALSE);
	}
	s->sc_prog = prog;
	s->sc_vers = vers;
	s->sc_dispatch = dispatch;
	s->sc_netid = netid;
	s->sc_next = svc_head;
	svc_head = s;

	if ((xprt->xp_netid == NULL) && (flag == 1) && netid)
		if ((xprt->xp_netid = strdup(netid)) == NULL) {
			syslog(LOG_ERR, "svc_register : strdup failed.");
			free(netid);
			svc_head = s->sc_next;
			free(s);
			(void) rw_unlock(&svc_lock);
			return (FALSE);
		}

pmap_it:
	(void) rw_unlock(&svc_lock);
	/* now register the information with the local binder service */
	if (protocol)
		return (pmap_set(prog, vers, protocol, xprt->xp_port));
	return (TRUE);
}

/*
 * Remove a service program from the callout list.
 * For version 2 portmappers.
 */
void
svc_unregister(rpcprog_t prog, rpcvers_t vers)
{
	struct svc_callout *prev;
	struct svc_callout *s;

	(void) rw_wrlock(&svc_lock);
	while ((s = svc_find(prog, vers, &prev, NULL)) != NULL_SVC) {
		if (prev == NULL_SVC) {
			svc_head = s->sc_next;
		} else {
			prev->sc_next = s->sc_next;
		}
		s->sc_next = NULL_SVC;
		if (s->sc_netid)
			free(s->sc_netid);
		free(s);
		/* unregister the information with the local binder service */
		(void) pmap_unset(prog, vers);
	}
	(void) rw_unlock(&svc_lock);
}
#endif /* PORTMAP */

/*
 * Search the callout list for a program number, return the callout
 * struct.
 * Also check for transport as well.  Many routines such as svc_unreg
 * dont give any corresponding transport, so dont check for transport if
 * netid == NULL
 */
static struct svc_callout *
svc_find(rpcprog_t prog, rpcvers_t vers, struct svc_callout **prev, char *netid)
{
	struct svc_callout *s, *p;

/* WRITE LOCK HELD ON ENTRY: svc_lock */

/*	assert(RW_WRITE_HELD(&svc_lock)); */
	p = NULL_SVC;
	for (s = svc_head; s != NULL_SVC; s = s->sc_next) {
		if (((s->sc_prog == prog) && (s->sc_vers == vers)) &&
		    ((netid == NULL) || (s->sc_netid == NULL) ||
		    (strcmp(netid, s->sc_netid) == 0)))
			break;
		p = s;
	}
	*prev = p;
	return (s);
}


/* ******************* REPLY GENERATION ROUTINES  ************ */

/*
 * Send a reply to an rpc request
 */
bool_t
svc_sendreply(const SVCXPRT *xprt, const xdrproc_t xdr_results,
    const caddr_t xdr_location)
{
	struct rpc_msg rply;

	rply.rm_direction = REPLY;
	rply.rm_reply.rp_stat = MSG_ACCEPTED;
	rply.acpted_rply.ar_verf = xprt->xp_verf;
	rply.acpted_rply.ar_stat = SUCCESS;
	rply.acpted_rply.ar_results.where = xdr_location;
	rply.acpted_rply.ar_results.proc = xdr_results;
	return (SVC_REPLY((SVCXPRT *)xprt, &rply));
}

/*
 * No procedure error reply
 */
void
svcerr_noproc(const SVCXPRT *xprt)
{
	struct rpc_msg rply;

	rply.rm_direction = REPLY;
	rply.rm_reply.rp_stat = MSG_ACCEPTED;
	rply.acpted_rply.ar_verf = xprt->xp_verf;
	rply.acpted_rply.ar_stat = PROC_UNAVAIL;
	SVC_REPLY((SVCXPRT *)xprt, &rply);
}

/*
 * Can't decode args error reply
 */
void
svcerr_decode(const SVCXPRT *xprt)
{
	struct rpc_msg rply;

	rply.rm_direction = REPLY;
	rply.rm_reply.rp_stat = MSG_ACCEPTED;
	rply.acpted_rply.ar_verf = xprt->xp_verf;
	rply.acpted_rply.ar_stat = GARBAGE_ARGS;
	SVC_REPLY((SVCXPRT *)xprt, &rply);
}

/*
 * Some system error
 */
void
svcerr_systemerr(const SVCXPRT *xprt)
{
	struct rpc_msg rply;

	rply.rm_direction = REPLY;
	rply.rm_reply.rp_stat = MSG_ACCEPTED;
	rply.acpted_rply.ar_verf = xprt->xp_verf;
	rply.acpted_rply.ar_stat = SYSTEM_ERR;
	SVC_REPLY((SVCXPRT *)xprt, &rply);
}

/*
 * Tell RPC package to not complain about version errors to the client.	 This
 * is useful when revving broadcast protocols that sit on a fixed address.
 * There is really one (or should be only one) example of this kind of
 * protocol: the portmapper (or rpc binder).
 */
void
__svc_versquiet_on(const SVCXPRT *xprt)
{
/* LINTED pointer alignment */
	svc_flags(xprt) |= SVC_VERSQUIET;
}

void
__svc_versquiet_off(const SVCXPRT *xprt)
{
/* LINTED pointer alignment */
	svc_flags(xprt) &= ~SVC_VERSQUIET;
}

void
svc_versquiet(const SVCXPRT *xprt)
{
	__svc_versquiet_on(xprt);
}

int
__svc_versquiet_get(const SVCXPRT *xprt)
{
/* LINTED pointer alignment */
	return (svc_flags(xprt) & SVC_VERSQUIET);
}

/*
 * Authentication error reply
 */
void
svcerr_auth(const SVCXPRT *xprt, const enum auth_stat why)
{
	struct rpc_msg rply;

	rply.rm_direction = REPLY;
	rply.rm_reply.rp_stat = MSG_DENIED;
	rply.rjcted_rply.rj_stat = AUTH_ERROR;
	rply.rjcted_rply.rj_why = why;
	SVC_REPLY((SVCXPRT *)xprt, &rply);
}

/*
 * Auth too weak error reply
 */
void
svcerr_weakauth(const SVCXPRT *xprt)
{
	svcerr_auth(xprt, AUTH_TOOWEAK);
}

/*
 * Program unavailable error reply
 */
void
svcerr_noprog(const SVCXPRT *xprt)
{
	struct rpc_msg rply;

	rply.rm_direction = REPLY;
	rply.rm_reply.rp_stat = MSG_ACCEPTED;
	rply.acpted_rply.ar_verf = xprt->xp_verf;
	rply.acpted_rply.ar_stat = PROG_UNAVAIL;
	SVC_REPLY((SVCXPRT *)xprt, &rply);
}

/*
 * Program version mismatch error reply
 */
void
svcerr_progvers(const SVCXPRT *xprt, const rpcvers_t low_vers,
    const rpcvers_t high_vers)
{
	struct rpc_msg rply;

	rply.rm_direction = REPLY;
	rply.rm_reply.rp_stat = MSG_ACCEPTED;
	rply.acpted_rply.ar_verf = xprt->xp_verf;
	rply.acpted_rply.ar_stat = PROG_MISMATCH;
	rply.acpted_rply.ar_vers.low = low_vers;
	rply.acpted_rply.ar_vers.high = high_vers;
	SVC_REPLY((SVCXPRT *)xprt, &rply);
}

/* ******************* SERVER INPUT STUFF ******************* */

/*
 * Get server side input from some transport.
 *
 * Statement of authentication parameters management:
 * This function owns and manages all authentication parameters, specifically
 * the "raw" parameters (msg.rm_call.cb_cred and msg.rm_call.cb_verf) and
 * the "cooked" credentials (rqst->rq_clntcred).
 * However, this function does not know the structure of the cooked
 * credentials, so it make the following assumptions:
 *   a) the structure is contiguous (no pointers), and
 *   b) the cred structure size does not exceed RQCRED_SIZE bytes.
 * In all events, all three parameters are freed upon exit from this routine.
 * The storage is trivially management on the call stack in user land, but
 * is mallocated in kernel land.
 */

void
svc_getreq(int rdfds)
{
	fd_set readfds;

	FD_ZERO(&readfds);
	readfds.fds_bits[0] = rdfds;
	svc_getreqset(&readfds);
}

void
svc_getreqset(fd_set *readfds)
{
	int i;

	for (i = 0; i < svc_max_fd; i++) {
		/* fd has input waiting */
		if (FD_ISSET(i, readfds))
			svc_getreq_common(i);
	}
}

void
svc_getreq_poll(struct pollfd *pfdp, const int pollretval)
{
	int i;
	int fds_found;

	for (i = fds_found = 0; fds_found < pollretval; i++) {
		struct pollfd *p = &pfdp[i];

		if (p->revents) {
			/* fd has input waiting */
			fds_found++;
			/*
			 *	We assume that this function is only called
			 *	via someone select()ing from svc_fdset or
			 *	poll()ing from svc_pollset[].  Thus it's safe
			 *	to handle the POLLNVAL event by simply turning
			 *	the corresponding bit off in svc_fdset.  The
			 *	svc_pollset[] array is derived from svc_fdset
			 *	and so will also be updated eventually.
			 *
			 *	XXX Should we do an xprt_unregister() instead?
			 */
			/* Handle user callback */
			if (__is_a_userfd(p->fd) == TRUE) {
				(void) rw_rdlock(&svc_fd_lock);
				__svc_getreq_user(p);
				(void) rw_unlock(&svc_fd_lock);
			} else {
				if (p->revents & POLLNVAL) {
					(void) rw_wrlock(&svc_fd_lock);
					remove_pollfd(p->fd);	/* XXX */
					(void) rw_unlock(&svc_fd_lock);
				} else {
					svc_getreq_common(p->fd);
				}
			}
		}
	}
}

void
svc_getreq_common(const int fd)
{
	SVCXPRT *xprt;
	enum xprt_stat stat;
	struct rpc_msg *msg;
	struct svc_req *r;
	char *cred_area;

	(void) rw_rdlock(&svc_fd_lock);

	/* HANDLE USER CALLBACK */
	if (__is_a_userfd(fd) == TRUE) {
		struct pollfd virtual_fd;

		virtual_fd.events = virtual_fd.revents = (short)0xFFFF;
		virtual_fd.fd = fd;
		__svc_getreq_user(&virtual_fd);
		(void) rw_unlock(&svc_fd_lock);
		return;
	}

	/*
	 * The transport associated with this fd could have been
	 * removed from svc_timeout_nonblock_xprt_and_LRU, for instance.
	 * This can happen if two or more fds get read events and are
	 * passed to svc_getreq_poll/set, the first fd is seviced by
	 * the dispatch routine and cleans up any dead transports.  If
	 * one of the dead transports removed is the other fd that
	 * had a read event then svc_getreq_common() will be called with no
	 * xprt associated with the fd that had the original read event.
	 */
	if ((fd >= nsvc_xports) || (xprt = svc_xports[fd]) == NULL) {
		(void) rw_unlock(&svc_fd_lock);
		return;
	}
	(void) rw_unlock(&svc_fd_lock);
/* LINTED pointer alignment */
	msg = SVCEXT(xprt)->msg;
/* LINTED pointer alignment */
	r = SVCEXT(xprt)->req;
/* LINTED pointer alignment */
	cred_area = SVCEXT(xprt)->cred_area;
	msg->rm_call.cb_cred.oa_base = cred_area;
	msg->rm_call.cb_verf.oa_base = &(cred_area[MAX_AUTH_BYTES]);
	r->rq_clntcred = &(cred_area[2 * MAX_AUTH_BYTES]);

	/* receive msgs from xprtprt (support batch calls) */
	do {
		bool_t dispatch;

		if (dispatch = SVC_RECV(xprt, msg))
			(void) _svc_prog_dispatch(xprt, msg, r);
		/*
		 * Check if the xprt has been disconnected in a recursive call
		 * in the service dispatch routine. If so, then break
		 */
		(void) rw_rdlock(&svc_fd_lock);
		if (xprt != svc_xports[fd]) {
			(void) rw_unlock(&svc_fd_lock);
			break;
		}
		(void) rw_unlock(&svc_fd_lock);

		/*
		 * Call cleanup procedure if set.
		 */
		if (__proc_cleanup_cb != NULL && dispatch)
			(*__proc_cleanup_cb)(xprt);

		if ((stat = SVC_STAT(xprt)) == XPRT_DIED) {
			SVC_DESTROY(xprt);
			break;
		}
	} while (stat == XPRT_MOREREQS);
}

int
_svc_prog_dispatch(SVCXPRT *xprt, struct rpc_msg *msg, struct svc_req *r)
{
	struct svc_callout *s;
	enum auth_stat why;
	int prog_found;
	rpcvers_t low_vers;
	rpcvers_t high_vers;
	void (*disp_fn)();

	r->rq_xprt = xprt;
	r->rq_prog = msg->rm_call.cb_prog;
	r->rq_vers = msg->rm_call.cb_vers;
	r->rq_proc = msg->rm_call.cb_proc;
	r->rq_cred = msg->rm_call.cb_cred;
/* LINTED pointer alignment */
	SVC_XP_AUTH(r->rq_xprt).svc_ah_ops = svc_auth_any_ops;
/* LINTED pointer alignment */
	SVC_XP_AUTH(r->rq_xprt).svc_ah_private = NULL;

	/* first authenticate the message */
	/* Check for null flavor and bypass these calls if possible */

	if (msg->rm_call.cb_cred.oa_flavor == AUTH_NULL) {
		r->rq_xprt->xp_verf.oa_flavor = _null_auth.oa_flavor;
		r->rq_xprt->xp_verf.oa_length = 0;
	} else {
		bool_t no_dispatch;

		if ((why = __gss_authenticate(r, msg,
		    &no_dispatch)) != AUTH_OK) {
			svcerr_auth(xprt, why);
			return (0);
		}
		if (no_dispatch)
			return (0);
	}
	/* match message with a registered service */
	prog_found = FALSE;
	low_vers = (rpcvers_t)(0 - 1);
	high_vers = 0;
	(void) rw_rdlock(&svc_lock);
	for (s = svc_head; s != NULL_SVC; s = s->sc_next) {
		if (s->sc_prog == r->rq_prog) {
			prog_found = TRUE;
			if (s->sc_vers == r->rq_vers) {
				if ((xprt->xp_netid == NULL) ||
				    (s->sc_netid == NULL) ||
				    (strcmp(xprt->xp_netid,
				    s->sc_netid) == 0)) {
					disp_fn = (*s->sc_dispatch);
					(void) rw_unlock(&svc_lock);
					disp_fn(r, xprt);
					return (1);
				}
				prog_found = FALSE;
			}
			if (s->sc_vers < low_vers)
				low_vers = s->sc_vers;
			if (s->sc_vers > high_vers)
				high_vers = s->sc_vers;
		}		/* found correct program */
	}
	(void) rw_unlock(&svc_lock);

	/*
	 * if we got here, the program or version
	 * is not served ...
	 */
	if (prog_found) {
/* LINTED pointer alignment */
		if (!version_keepquiet(xprt))
			svcerr_progvers(xprt, low_vers, high_vers);
	} else {
		svcerr_noprog(xprt);
	}
	return (0);
}

/* ******************* SVCXPRT allocation and deallocation ***************** */

/*
 * svc_xprt_alloc() - allocate a service transport handle
 */
SVCXPRT *
svc_xprt_alloc(void)
{
	SVCXPRT		*xprt = NULL;
	SVCXPRT_EXT	*xt = NULL;
	SVCXPRT_LIST	*xlist = NULL;
	struct rpc_msg	*msg = NULL;
	struct svc_req	*req = NULL;
	char		*cred_area = NULL;

	if ((xprt = calloc(1, sizeof (SVCXPRT))) == NULL)
		goto err_exit;

	if ((xt = calloc(1, sizeof (SVCXPRT_EXT))) == NULL)
		goto err_exit;
	xprt->xp_p3 = (caddr_t)xt; /* SVCEXT(xprt) = xt */

	if ((xlist = calloc(1, sizeof (SVCXPRT_LIST))) == NULL)
		goto err_exit;
	xt->my_xlist = xlist;
	xlist->xprt = xprt;

	if ((msg = malloc(sizeof (struct rpc_msg))) == NULL)
		goto err_exit;
	xt->msg = msg;

	if ((req = malloc(sizeof (struct svc_req))) == NULL)
		goto err_exit;
	xt->req = req;

	if ((cred_area = malloc(2*MAX_AUTH_BYTES + RQCRED_SIZE)) == NULL)
		goto err_exit;
	xt->cred_area = cred_area;

/* LINTED pointer alignment */
	(void) mutex_init(&svc_send_mutex(xprt), USYNC_THREAD, (void *)0);
	return (xprt);

err_exit:
	svc_xprt_free(xprt);
	return (NULL);
}


/*
 * svc_xprt_free() - free a service handle
 */
void
svc_xprt_free(SVCXPRT *xprt)
{
/* LINTED pointer alignment */
	SVCXPRT_EXT	*xt = xprt ? SVCEXT(xprt) : NULL;
	SVCXPRT_LIST	*my_xlist = xt ? xt->my_xlist: NULL;
	struct rpc_msg	*msg = xt ? xt->msg : NULL;
	struct svc_req	*req = xt ? xt->req : NULL;
	char		*cred_area = xt ? xt->cred_area : NULL;

	if (xprt)
		free(xprt);
	if (xt)
		free(xt);
	if (my_xlist)
		free(my_xlist);
	if (msg)
		free(msg);
	if (req)
		free(req);
	if (cred_area)
		free(cred_area);
}


/*
 * svc_xprt_destroy() - free parent and child xprt list
 */
void
svc_xprt_destroy(SVCXPRT *xprt)
{
	SVCXPRT_LIST	*xlist, *xnext = NULL;
	int		type;

/* LINTED pointer alignment */
	if (SVCEXT(xprt)->parent)
/* LINTED pointer alignment */
		xprt = SVCEXT(xprt)->parent;
/* LINTED pointer alignment */
	type = svc_type(xprt);
/* LINTED pointer alignment */
	for (xlist = SVCEXT(xprt)->my_xlist; xlist != NULL; xlist = xnext) {
		xnext = xlist->next;
		xprt = xlist->xprt;
		switch (type) {
		case SVC_DGRAM:
			svc_dg_xprtfree(xprt);
			break;
		case SVC_RENDEZVOUS:
			svc_vc_xprtfree(xprt);
			break;
		case SVC_CONNECTION:
			svc_fd_xprtfree(xprt);
			break;
		case SVC_DOOR:
			svc_door_xprtfree(xprt);
			break;
		}
	}
}


/*
 * svc_copy() - make a copy of parent
 */
SVCXPRT *
svc_copy(SVCXPRT *xprt)
{
/* LINTED pointer alignment */
	switch (svc_type(xprt)) {
	case SVC_DGRAM:
		return (svc_dg_xprtcopy(xprt));
	case SVC_RENDEZVOUS:
		return (svc_vc_xprtcopy(xprt));
	case SVC_CONNECTION:
		return (svc_fd_xprtcopy(xprt));
	}
	return (NULL);
}


/*
 * _svc_destroy_private() - private SVC_DESTROY interface
 */
void
_svc_destroy_private(SVCXPRT *xprt)
{
/* LINTED pointer alignment */
	switch (svc_type(xprt)) {
	case SVC_DGRAM:
		_svc_dg_destroy_private(xprt);
		break;
	case SVC_RENDEZVOUS:
	case SVC_CONNECTION:
		_svc_vc_destroy_private(xprt, TRUE);
		break;
	}
}

/*
 * svc_get_local_cred() - fetch local user credentials.  This always
 * works over doors based transports.  For local transports, this
 * does not yield correct results unless the __rpc_negotiate_uid()
 * call has been invoked to enable this feature.
 */
bool_t
svc_get_local_cred(SVCXPRT *xprt, svc_local_cred_t *lcred)
{
	/* LINTED pointer alignment */
	if (svc_type(xprt) == SVC_DOOR)
		return (__svc_get_door_cred(xprt, lcred));
	return (__rpc_get_local_cred(xprt, lcred));
}


/* ******************* DUPLICATE ENTRY HANDLING ROUTINES ************** */

/*
 * the dup cacheing routines below provide a cache of received
 * transactions. rpc service routines can use this to detect
 * retransmissions and re-send a non-failure response. Uses a
 * lru scheme to find entries to get rid of entries in the cache,
 * though only DUP_DONE entries are placed on the lru list.
 * the routines were written towards development of a generic
 * SVC_DUP() interface, which can be expanded to encompass the
 * svc_dg_enablecache() routines as well. the cache is currently
 * private to the automounter.
 */


/* dupcache header contains xprt specific information */
struct dupcache {
	rwlock_t	dc_lock;
	time_t		dc_time;
	int		dc_buckets;
	int		dc_maxsz;
	int		dc_basis;
	struct dupreq 	*dc_mru;
	struct dupreq	**dc_hashtbl;
};

/*
 * private duplicate cache request routines
 */
static int __svc_dupcache_check(struct svc_req *, caddr_t *, uint_t *,
		struct dupcache *, uint32_t, uint32_t);
static struct dupreq *__svc_dupcache_victim(struct dupcache *, time_t);
static int __svc_dupcache_enter(struct svc_req *, struct dupreq *,
		struct dupcache *, uint32_t, uint32_t, time_t);
static int __svc_dupcache_update(struct svc_req *, caddr_t, uint_t, int,
		struct dupcache *, uint32_t, uint32_t);
#ifdef DUP_DEBUG
static void __svc_dupcache_debug(struct dupcache *);
#endif /* DUP_DEBUG */

/* default parameters for the dupcache */
#define	DUPCACHE_BUCKETS	257
#define	DUPCACHE_TIME		900
#define	DUPCACHE_MAXSZ		INT_MAX

/*
 * __svc_dupcache_init(void *condition, int basis, char *xprt_cache)
 * initialize the duprequest cache and assign it to the xprt_cache
 * Use default values depending on the cache condition and basis.
 * return TRUE on success and FALSE on failure
 */
bool_t
__svc_dupcache_init(void *condition, int basis, char **xprt_cache)
{
	static mutex_t initdc_lock = DEFAULTMUTEX;
	int i;
	struct dupcache *dc;

	(void) mutex_lock(&initdc_lock);
	if (*xprt_cache != NULL) { /* do only once per xprt */
		(void) mutex_unlock(&initdc_lock);
		syslog(LOG_ERR,
		    "__svc_dupcache_init: multiply defined dup cache");
		return (FALSE);
	}

	switch (basis) {
	case DUPCACHE_FIXEDTIME:
		dc = malloc(sizeof (struct dupcache));
		if (dc == NULL) {
			(void) mutex_unlock(&initdc_lock);
			syslog(LOG_ERR,
			    "__svc_dupcache_init: memory alloc failed");
			return (FALSE);
		}
		(void) rwlock_init(&(dc->dc_lock), USYNC_THREAD, NULL);
		if (condition != NULL)
			dc->dc_time = *((time_t *)condition);
		else
			dc->dc_time = DUPCACHE_TIME;
		dc->dc_buckets = DUPCACHE_BUCKETS;
		dc->dc_maxsz = DUPCACHE_MAXSZ;
		dc->dc_basis = basis;
		dc->dc_mru = NULL;
		dc->dc_hashtbl = malloc(dc->dc_buckets *
		    sizeof (struct dupreq *));
		if (dc->dc_hashtbl == NULL) {
			free(dc);
			(void) mutex_unlock(&initdc_lock);
			syslog(LOG_ERR,
			    "__svc_dupcache_init: memory alloc failed");
			return (FALSE);
		}
		for (i = 0; i < DUPCACHE_BUCKETS; i++)
			dc->dc_hashtbl[i] = NULL;
		*xprt_cache = (char *)dc;
		break;
	default:
		(void) mutex_unlock(&initdc_lock);
		syslog(LOG_ERR,
		    "__svc_dupcache_init: undefined dup cache basis");
		return (FALSE);
	}

	(void) mutex_unlock(&initdc_lock);

	return (TRUE);
}

/*
 * __svc_dup(struct svc_req *req, caddr_t *resp_buf, uint_t *resp_bufsz,
 *	char *xprt_cache)
 * searches the request cache. Creates an entry and returns DUP_NEW if
 * the request is not found in the cache.  If it is found, then it
 * returns the state of the request (in progress, drop, or done) and
 * also allocates, and passes back results to the user (if any) in
 * resp_buf, and its length in resp_bufsz. DUP_ERROR is returned on error.
 */
int
__svc_dup(struct svc_req *req, caddr_t *resp_buf, uint_t *resp_bufsz,
    char *xprt_cache)
{
	uint32_t drxid, drhash;
	int rc;
	struct dupreq *dr = NULL;
	time_t timenow = time(NULL);

	/* LINTED pointer alignment */
	struct dupcache *dc = (struct dupcache *)xprt_cache;

	if (dc == NULL) {
		syslog(LOG_ERR, "__svc_dup: undefined cache");
		return (DUP_ERROR);
	}

	/* get the xid of the request */
	if (SVC_CONTROL(req->rq_xprt, SVCGET_XID, (void*)&drxid) == FALSE) {
		syslog(LOG_ERR, "__svc_dup: xid error");
		return (DUP_ERROR);
	}
	drhash = drxid % dc->dc_buckets;

	if ((rc = __svc_dupcache_check(req, resp_buf, resp_bufsz, dc, drxid,
	    drhash)) != DUP_NEW)
		return (rc);

	if ((dr = __svc_dupcache_victim(dc, timenow)) == NULL)
		return (DUP_ERROR);

	if ((rc = __svc_dupcache_enter(req, dr, dc, drxid, drhash, timenow))
	    == DUP_ERROR)
		return (rc);

	return (DUP_NEW);
}


/*
 * __svc_dupcache_check(struct svc_req *req, caddr_t *resp_buf,
 *		uint_t *resp_bufsz,truct dupcache *dc, uint32_t drxid,
 * 		uint32_t drhash)
 * Checks to see whether an entry already exists in the cache. If it does
 * copy back into the resp_buf, if appropriate. Return the status of
 * the request, or DUP_NEW if the entry is not in the cache
 */
static int
__svc_dupcache_check(struct svc_req *req, caddr_t *resp_buf, uint_t *resp_bufsz,
    struct dupcache *dc, uint32_t drxid, uint32_t drhash)
{
	struct dupreq *dr = NULL;

	(void) rw_rdlock(&(dc->dc_lock));
	dr = dc->dc_hashtbl[drhash];
	while (dr != NULL) {
		if (dr->dr_xid == drxid &&
		    dr->dr_proc == req->rq_proc &&
		    dr->dr_prog == req->rq_prog &&
		    dr->dr_vers == req->rq_vers &&
		    dr->dr_addr.len == req->rq_xprt->xp_rtaddr.len &&
		    memcmp(dr->dr_addr.buf, req->rq_xprt->xp_rtaddr.buf,
		    dr->dr_addr.len) == 0) { /* entry found */
			if (dr->dr_hash != drhash) {
				/* sanity check */
				(void) rw_unlock((&dc->dc_lock));
				syslog(LOG_ERR,
				    "\n__svc_dupdone: hashing error");
				return (DUP_ERROR);
			}

			/*
			 * return results for requests on lru list, if
			 * appropriate requests must be DUP_DROP or DUP_DONE
			 * to have a result. A NULL buffer in the cache
			 * implies no results were sent during dupdone.
			 * A NULL buffer in the call implies not interested
			 * in results.
			 */
			if (((dr->dr_status == DUP_DONE) ||
			    (dr->dr_status == DUP_DROP)) &&
			    resp_buf != NULL &&
			    dr->dr_resp.buf != NULL) {
				*resp_buf = malloc(dr->dr_resp.len);
				if (*resp_buf == NULL) {
					syslog(LOG_ERR,
					"__svc_dupcache_check: malloc failed");
					(void) rw_unlock(&(dc->dc_lock));
					return (DUP_ERROR);
				}
				(void) memset(*resp_buf, 0, dr->dr_resp.len);
				(void) memcpy(*resp_buf, dr->dr_resp.buf,
				    dr->dr_resp.len);
				*resp_bufsz = dr->dr_resp.len;
			} else {
				/* no result */
				if (resp_buf)
					*resp_buf = NULL;
				if (resp_bufsz)
					*resp_bufsz = 0;
			}
			(void) rw_unlock(&(dc->dc_lock));
			return (dr->dr_status);
		}
		dr = dr->dr_chain;
	}
	(void) rw_unlock(&(dc->dc_lock));
	return (DUP_NEW);
}

/*
 * __svc_dupcache_victim(struct dupcache *dc, time_t timenow)
 * Return a victim dupreq entry to the caller, depending on cache policy.
 */
static struct dupreq *
__svc_dupcache_victim(struct dupcache *dc, time_t timenow)
{
	struct dupreq *dr = NULL;

	switch (dc->dc_basis) {
	case DUPCACHE_FIXEDTIME:
		/*
		 * The hash policy is to free up a bit of the hash
		 * table before allocating a new entry as the victim.
		 * Freeing up the hash table each time should split
		 * the cost of keeping the hash table clean among threads.
		 * Note that only DONE or DROPPED entries are on the lru
		 * list but we do a sanity check anyway.
		 */
		(void) rw_wrlock(&(dc->dc_lock));
		while ((dc->dc_mru) && (dr = dc->dc_mru->dr_next) &&
		    ((timenow - dr->dr_time) > dc->dc_time)) {
			/* clean and then free the entry */
			if (dr->dr_status != DUP_DONE &&
			    dr->dr_status != DUP_DROP) {
				/*
				 * The LRU list can't contain an
				 * entry where the status is other than
				 * DUP_DONE or DUP_DROP.
				 */
				syslog(LOG_ERR,
				    "__svc_dupcache_victim: bad victim");
#ifdef DUP_DEBUG
				/*
				 * Need to hold the reader/writers lock to
				 * print the cache info, since we already
				 * hold the writers lock, we shall continue
				 * calling __svc_dupcache_debug()
				 */
				__svc_dupcache_debug(dc);
#endif /* DUP_DEBUG */
				(void) rw_unlock(&(dc->dc_lock));
				return (NULL);
			}
			/* free buffers */
			if (dr->dr_resp.buf) {
				free(dr->dr_resp.buf);
				dr->dr_resp.buf = NULL;
			}
			if (dr->dr_addr.buf) {
				free(dr->dr_addr.buf);
				dr->dr_addr.buf = NULL;
			}

			/* unhash the entry */
			if (dr->dr_chain)
				dr->dr_chain->dr_prevchain = dr->dr_prevchain;
			if (dr->dr_prevchain)
				dr->dr_prevchain->dr_chain = dr->dr_chain;
			if (dc->dc_hashtbl[dr->dr_hash] == dr)
				dc->dc_hashtbl[dr->dr_hash] = dr->dr_chain;

			/* modify the lru pointers */
			if (dc->dc_mru == dr) {
				dc->dc_mru = NULL;
			} else {
				dc->dc_mru->dr_next = dr->dr_next;
				dr->dr_next->dr_prev = dc->dc_mru;
			}
			free(dr);
			dr = NULL;
		}
		(void) rw_unlock(&(dc->dc_lock));

		/*
		 * Allocate and return new clean entry as victim
		 */
		if ((dr = malloc(sizeof (*dr))) == NULL) {
			syslog(LOG_ERR,
			    "__svc_dupcache_victim: malloc failed");
			return (NULL);
		}
		(void) memset(dr, 0, sizeof (*dr));
		return (dr);
	default:
		syslog(LOG_ERR,
		    "__svc_dupcache_victim: undefined dup cache_basis");
		return (NULL);
	}
}

/*
 * __svc_dupcache_enter(struct svc_req *req, struct dupreq *dr,
 *	struct dupcache *dc, uint32_t drxid, uint32_t drhash, time_t timenow)
 * build new duprequest entry and then insert into the cache
 */
static int
__svc_dupcache_enter(struct svc_req *req, struct dupreq *dr,
    struct dupcache *dc, uint32_t drxid, uint32_t drhash, time_t timenow)
{
	dr->dr_xid = drxid;
	dr->dr_prog = req->rq_prog;
	dr->dr_vers = req->rq_vers;
	dr->dr_proc = req->rq_proc;
	dr->dr_addr.maxlen = req->rq_xprt->xp_rtaddr.len;
	dr->dr_addr.len = dr->dr_addr.maxlen;
	if ((dr->dr_addr.buf = malloc(dr->dr_addr.maxlen)) == NULL) {
		syslog(LOG_ERR, "__svc_dupcache_enter: malloc failed");
		free(dr);
		return (DUP_ERROR);
	}
	(void) memset(dr->dr_addr.buf, 0, dr->dr_addr.len);
	(void) memcpy(dr->dr_addr.buf, req->rq_xprt->xp_rtaddr.buf,
	    dr->dr_addr.len);
	dr->dr_resp.buf = NULL;
	dr->dr_resp.maxlen = 0;
	dr->dr_resp.len = 0;
	dr->dr_status = DUP_INPROGRESS;
	dr->dr_time = timenow;
	dr->dr_hash = drhash;	/* needed for efficient victim cleanup */

	/* place entry at head of hash table */
	(void) rw_wrlock(&(dc->dc_lock));
	dr->dr_chain = dc->dc_hashtbl[drhash];
	dr->dr_prevchain = NULL;
	if (dc->dc_hashtbl[drhash] != NULL)
		dc->dc_hashtbl[drhash]->dr_prevchain = dr;
	dc->dc_hashtbl[drhash] = dr;
	(void) rw_unlock(&(dc->dc_lock));
	return (DUP_NEW);
}

/*
 * __svc_dupdone(struct svc_req *req, caddr_t resp_buf, uint_t resp_bufsz,
 *		int status, char *xprt_cache)
 * Marks the request done (DUP_DONE or DUP_DROP) and stores the response.
 * Only DONE and DROP requests can be marked as done. Sets the lru pointers
 * to make the entry the most recently used. Returns DUP_ERROR or status.
 */
int
__svc_dupdone(struct svc_req *req, caddr_t resp_buf, uint_t resp_bufsz,
    int status, char *xprt_cache)
{
	uint32_t drxid, drhash;
	int rc;

	/* LINTED pointer alignment */
	struct dupcache *dc = (struct dupcache *)xprt_cache;

	if (dc == NULL) {
		syslog(LOG_ERR, "__svc_dupdone: undefined cache");
		return (DUP_ERROR);
	}

	if (status != DUP_DONE && status != DUP_DROP) {
		syslog(LOG_ERR, "__svc_dupdone: invalid dupdone status");
		syslog(LOG_ERR, "	 must be DUP_DONE or DUP_DROP");
		return (DUP_ERROR);
	}

	/* find the xid of the entry in the cache */
	if (SVC_CONTROL(req->rq_xprt, SVCGET_XID, (void*)&drxid) == FALSE) {
		syslog(LOG_ERR, "__svc_dup: xid error");
		return (DUP_ERROR);
	}
	drhash = drxid % dc->dc_buckets;

	/* update the status of the entry and result buffers, if required */
	if ((rc = __svc_dupcache_update(req, resp_buf, resp_bufsz, status,
	    dc, drxid, drhash)) == DUP_ERROR) {
		syslog(LOG_ERR, "__svc_dupdone: cache entry error");
		return (DUP_ERROR);
	}

	return (rc);
}

/*
 * __svc_dupcache_update(struct svc_req *req, caddr_t resp_buf,
 * 	uint_t resp_bufsz, int status, struct dupcache *dc, uint32_t drxid,
 * 	uint32_t drhash)
 * Check if entry exists in the dupcacache. If it does, update its status
 * and time and also its buffer, if appropriate. Its possible, but unlikely
 * for DONE requests to not exist in the cache. Return DUP_ERROR or status.
 */
static int
__svc_dupcache_update(struct svc_req *req, caddr_t resp_buf, uint_t resp_bufsz,
    int status, struct dupcache *dc, uint32_t drxid, uint32_t drhash)
{
	struct dupreq *dr = NULL;
	time_t timenow = time(NULL);

	(void) rw_wrlock(&(dc->dc_lock));
	dr = dc->dc_hashtbl[drhash];
	while (dr != NULL) {
		if (dr->dr_xid == drxid &&
		    dr->dr_proc == req->rq_proc &&
		    dr->dr_prog == req->rq_prog &&
		    dr->dr_vers == req->rq_vers &&
		    dr->dr_addr.len == req->rq_xprt->xp_rtaddr.len &&
		    memcmp(dr->dr_addr.buf, req->rq_xprt->xp_rtaddr.buf,
		    dr->dr_addr.len) == 0) { /* entry found */
			if (dr->dr_hash != drhash) {
				/* sanity check */
				(void) rw_unlock(&(dc->dc_lock));
				syslog(LOG_ERR,
				"\n__svc_dupdone: hashing error");
				return (DUP_ERROR);
			}

			/* store the results if bufer is not NULL */
			if (resp_buf != NULL) {
				if ((dr->dr_resp.buf =
				    malloc(resp_bufsz)) == NULL) {
					(void) rw_unlock(&(dc->dc_lock));
					syslog(LOG_ERR,
					    "__svc_dupdone: malloc failed");
					return (DUP_ERROR);
				}
				(void) memset(dr->dr_resp.buf, 0, resp_bufsz);
				(void) memcpy(dr->dr_resp.buf, resp_buf,
				    (uint_t)resp_bufsz);
				dr->dr_resp.len = resp_bufsz;
			}

			/* update status and done time */
			dr->dr_status = status;
			dr->dr_time = timenow;

			/* move the entry to the mru position */
			if (dc->dc_mru == NULL) {
				dr->dr_next = dr;
				dr->dr_prev = dr;
			} else {
				dr->dr_next = dc->dc_mru->dr_next;
				dc->dc_mru->dr_next->dr_prev = dr;
				dr->dr_prev = dc->dc_mru;
				dc->dc_mru->dr_next = dr;
			}
			dc->dc_mru = dr;

			(void) rw_unlock(&(dc->dc_lock));
			return (status);
		}
		dr = dr->dr_chain;
	}
	(void) rw_unlock(&(dc->dc_lock));
	syslog(LOG_ERR, "__svc_dupdone: entry not in dup cache");
	return (DUP_ERROR);
}

#ifdef DUP_DEBUG
/*
 * __svc_dupcache_debug(struct dupcache *dc)
 * print out the hash table stuff
 *
 * This function requires the caller to hold the reader
 * or writer version of the duplicate request cache lock (dc_lock).
 */
static void
__svc_dupcache_debug(struct dupcache *dc)
{
	struct dupreq *dr = NULL;
	int i;
	bool_t bval;

	fprintf(stderr, "   HASHTABLE\n");
	for (i = 0; i < dc->dc_buckets; i++) {
		bval = FALSE;
		dr = dc->dc_hashtbl[i];
		while (dr != NULL) {
			if (!bval) {	/* ensures bucket printed only once */
				fprintf(stderr, "    bucket : %d\n", i);
				bval = TRUE;
			}
			fprintf(stderr, "\txid: %u status: %d time: %ld",
			    dr->dr_xid, dr->dr_status, dr->dr_time);
			fprintf(stderr, " dr: %x chain: %x prevchain: %x\n",
			    dr, dr->dr_chain, dr->dr_prevchain);
			dr = dr->dr_chain;
		}
	}

	fprintf(stderr, "   LRU\n");
	if (dc->dc_mru) {
		dr = dc->dc_mru->dr_next;	/* lru */
		while (dr != dc->dc_mru) {
			fprintf(stderr, "\txid: %u status : %d time : %ld",
			    dr->dr_xid, dr->dr_status, dr->dr_time);
			fprintf(stderr, " dr: %x next: %x prev: %x\n",
			    dr, dr->dr_next, dr->dr_prev);
			dr = dr->dr_next;
		}
		fprintf(stderr, "\txid: %u status: %d time: %ld",
		    dr->dr_xid, dr->dr_status, dr->dr_time);
		fprintf(stderr, " dr: %x next: %x prev: %x\n",
		    dr, dr->dr_next, dr->dr_prev);
	}
}
#endif /* DUP_DEBUG */