xref: /titanic_52/usr/src/uts/common/rpc/clnt_cots.c (revision 9e1a718fa89856ea8192b1cc4fbd6c0a6df7fea4)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*
28  * Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T
29  *		All Rights Reserved
30  */
31 
32 /*
33  * Portions of this source code were derived from Berkeley 4.3 BSD
34  * under license from the Regents of the University of California.
35  */
36 
37 #pragma ident	"%Z%%M%	%I%	%E% SMI"
38 
39 /*
40  * Implements a kernel based, client side RPC over Connection Oriented
41  * Transports (COTS).
42  */
43 
44 /*
45  * Much of this file has been re-written to let NFS work better over slow
46  * transports. A description follows.
47  *
48  * One of the annoying things about kRPC/COTS is that it will temporarily
49  * create more than one connection between a client and server. This
50  * happens because when a connection is made, the end-points entry in the
51  * linked list of connections (headed by cm_hd), is removed so that other
52  * threads don't mess with it. Went ahead and bit the bullet by keeping
53  * the endpoint on the connection list and introducing state bits,
54  * condition variables etc. to the connection entry data structure (struct
55  * cm_xprt).
56  *
57  * Here is a summary of the changes to cm-xprt:
58  *
59  *	x_ctime is the timestamp of when the endpoint was last
60  *	connected or disconnected. If an end-point is ever disconnected
61  *	or re-connected, then any outstanding RPC request is presumed
62  *	lost, telling clnt_cots_kcallit that it needs to re-send the
63  *	request, not just wait for the original request's reply to
64  *	arrive.
65  *
66  *	x_thread flag which tells us if a thread is doing a connection attempt.
67  *
68  *	x_waitdis flag which tells us we are waiting a disconnect ACK.
69  *
70  *	x_needdis flag which tells us we need to send a T_DISCONN_REQ
71  *	to kill the connection.
72  *
73  *	x_needrel flag which tells us we need to send a T_ORDREL_REQ to
74  *	gracefully close the connection.
75  *
76  *	#defined bitmasks for the all the b_* bits so that more
77  *	efficient (and at times less clumsy) masks can be used to
78  *	manipulated state in cases where multiple bits have to
79  *	set/cleared/checked in the same critical section.
80  *
81  *	x_conn_cv and x_dis-_cv are new condition variables to let
82  *	threads knows when the connection attempt is done, and to let
83  *	the connecting thread know when the disconnect handshake is
84  *	done.
85  *
86  * Added the CONN_HOLD() macro so that all reference holds have the same
87  * look and feel.
88  *
89  * In the private (cku_private) portion of the client handle,
90  *
91  *	cku_flags replaces the cku_sent a boolean. cku_flags keeps
92  *	track of whether a request as been sent, and whether the
93  *	client's handles call record is on the dispatch list (so that
94  *	the reply can be matched by XID to the right client handle).
95  *	The idea of CKU_ONQUEUE is that we can exit clnt_cots_kcallit()
96  *	and still have the response find the right client handle so
97  *	that the retry of CLNT_CALL() gets the result. Testing, found
98  *	situations where if the timeout was increased, performance
99  *	degraded. This was due to us hitting a window where the thread
100  *	was back in rfscall() (probably printing server not responding)
101  *	while the response came back but no place to put it.
102  *
103  *	cku_ctime is just a cache of x_ctime. If they match,
104  *	clnt_cots_kcallit() won't to send a retry (unless the maximum
105  *	receive count limit as been reached). If the don't match, then
106  *	we assume the request has been lost, and a retry of the request
107  *	is needed.
108  *
109  *	cku_recv_attempts counts the number of receive count attempts
110  *	after one try is sent on the wire.
111  *
112  * Added the clnt_delay() routine so that interruptible and
113  * noninterruptible delays are possible.
114  *
115  * CLNT_MIN_TIMEOUT has been bumped to 10 seconds from 3. This is used to
116  * control how long the client delays before returned after getting
117  * ECONNREFUSED. At 3 seconds, 8 client threads per mount really does bash
118  * a server that may be booting and not yet started nfsd.
119  *
120  * CLNT_MAXRECV_WITHOUT_RETRY is a new macro (value of 3) (with a tunable)
121  * Why don't we just wait forever (receive an infinite # of times)?
122  * Because the server may have rebooted. More insidious is that some
123  * servers (ours) will drop NFS/TCP requests in some cases. This is bad,
124  * but it is a reality.
125  *
126  * The case of a server doing orderly release really messes up the
127  * client's recovery, especially if the server's TCP implementation is
128  * buggy.  It was found was that the kRPC/COTS client was breaking some
129  * TPI rules, such as not waiting for the acknowledgement of a
130  * T_DISCON_REQ (hence the added case statements T_ERROR_ACK, T_OK_ACK and
131  * T_DISCON_REQ in clnt_dispatch_notifyall()).
132  *
133  * One of things that we've seen is that a kRPC TCP endpoint goes into
134  * TIMEWAIT and a thus a reconnect takes a long time to satisfy because
135  * that the TIMEWAIT state takes a while to finish.  If a server sends a
136  * T_ORDREL_IND, there is little point in an RPC client doing a
137  * T_ORDREL_REQ, because the RPC request isn't going to make it (the
138  * server is saying that it won't accept any more data). So kRPC was
139  * changed to send a T_DISCON_REQ when we get a T_ORDREL_IND. So now the
140  * connection skips the TIMEWAIT state and goes straight to a bound state
141  * that kRPC can quickly switch to connected.
142  *
143  * Code that issues TPI request must use waitforack() to wait for the
144  * corresponding ack (assuming there is one) in any future modifications.
145  * This works around problems that may be introduced by breaking TPI rules
146  * (by submitting new calls before earlier requests have been acked) in the
147  * case of a signal or other early return.  waitforack() depends on
148  * clnt_dispatch_notifyconn() to issue the wakeup when the ack
149  * arrives, so adding new TPI calls may require corresponding changes
150  * to clnt_dispatch_notifyconn(). Presently, the timeout period is based on
151  * CLNT_MIN_TIMEOUT which is 10 seconds. If you modify this value, be sure
152  * not to set it too low or TPI ACKS will be lost.
153  */
154 
155 #include <sys/param.h>
156 #include <sys/types.h>
157 #include <sys/user.h>
158 #include <sys/systm.h>
159 #include <sys/sysmacros.h>
160 #include <sys/proc.h>
161 #include <sys/socket.h>
162 #include <sys/file.h>
163 #include <sys/stream.h>
164 #include <sys/strsubr.h>
165 #include <sys/stropts.h>
166 #include <sys/strsun.h>
167 #include <sys/timod.h>
168 #include <sys/tiuser.h>
169 #include <sys/tihdr.h>
170 #include <sys/t_kuser.h>
171 #include <sys/fcntl.h>
172 #include <sys/errno.h>
173 #include <sys/kmem.h>
174 #include <sys/debug.h>
175 #include <sys/systm.h>
176 #include <sys/kstat.h>
177 #include <sys/t_lock.h>
178 #include <sys/ddi.h>
179 #include <sys/cmn_err.h>
180 #include <sys/time.h>
181 #include <sys/isa_defs.h>
182 #include <sys/callb.h>
183 #include <sys/sunddi.h>
184 #include <sys/atomic.h>
185 
186 #include <netinet/in.h>
187 #include <netinet/tcp.h>
188 
189 #include <rpc/types.h>
190 #include <rpc/xdr.h>
191 #include <rpc/auth.h>
192 #include <rpc/clnt.h>
193 #include <rpc/rpc_msg.h>
194 
195 #define	COTS_DEFAULT_ALLOCSIZE	2048
196 
197 #define	WIRE_HDR_SIZE	20	/* serialized call header, sans proc number */
198 #define	MSG_OFFSET	128	/* offset of call into the mblk */
199 
200 const char *kinet_ntop6(uchar_t *, char *, size_t);
201 
202 static int	clnt_cots_ksettimers(CLIENT *, struct rpc_timers *,
203     struct rpc_timers *, int, void(*)(int, int, caddr_t), caddr_t, uint32_t);
204 static enum clnt_stat	clnt_cots_kcallit(CLIENT *, rpcproc_t, xdrproc_t,
205     caddr_t, xdrproc_t, caddr_t, struct timeval);
206 static void	clnt_cots_kabort(CLIENT *);
207 static void	clnt_cots_kerror(CLIENT *, struct rpc_err *);
208 static bool_t	clnt_cots_kfreeres(CLIENT *, xdrproc_t, caddr_t);
209 static void	clnt_cots_kdestroy(CLIENT *);
210 static bool_t	clnt_cots_kcontrol(CLIENT *, int, char *);
211 
212 
213 /* List of transports managed by the connection manager. */
214 struct cm_xprt {
215 	TIUSER		*x_tiptr;	/* transport handle */
216 	queue_t		*x_wq;		/* send queue */
217 	clock_t		x_time;		/* last time we handed this xprt out */
218 	clock_t		x_ctime;	/* time we went to CONNECTED */
219 	int		x_tidu_size;    /* TIDU size of this transport */
220 	union {
221 	    struct {
222 		unsigned int
223 #ifdef	_BIT_FIELDS_HTOL
224 		b_closing:	1,	/* we've sent a ord rel on this conn */
225 		b_dead:		1,	/* transport is closed or disconn */
226 		b_doomed:	1,	/* too many conns, let this go idle */
227 		b_connected:	1,	/* this connection is connected */
228 
229 		b_ordrel:	1,	/* do an orderly release? */
230 		b_thread:	1,	/* thread doing connect */
231 		b_waitdis:	1,	/* waiting for disconnect ACK */
232 		b_needdis:	1,	/* need T_DISCON_REQ */
233 
234 		b_needrel:	1,	/* need T_ORDREL_REQ */
235 		b_early_disc:	1,	/* got a T_ORDREL_IND or T_DISCON_IND */
236 					/* disconnect during connect */
237 
238 		b_pad:		22;
239 
240 #endif
241 
242 #ifdef	_BIT_FIELDS_LTOH
243 		b_pad:		22,
244 
245 		b_early_disc:	1,	/* got a T_ORDREL_IND or T_DISCON_IND */
246 					/* disconnect during connect */
247 		b_needrel:	1,	/* need T_ORDREL_REQ */
248 
249 		b_needdis:	1,	/* need T_DISCON_REQ */
250 		b_waitdis:	1,	/* waiting for disconnect ACK */
251 		b_thread:	1,	/* thread doing connect */
252 		b_ordrel:	1,	/* do an orderly release? */
253 
254 		b_connected:	1,	/* this connection is connected */
255 		b_doomed:	1,	/* too many conns, let this go idle */
256 		b_dead:		1,	/* transport is closed or disconn */
257 		b_closing:	1;	/* we've sent a ord rel on this conn */
258 #endif
259 	    } bit;	    unsigned int word;
260 
261 #define	x_closing	x_state.bit.b_closing
262 #define	x_dead		x_state.bit.b_dead
263 #define	x_doomed	x_state.bit.b_doomed
264 #define	x_connected	x_state.bit.b_connected
265 
266 #define	x_ordrel	x_state.bit.b_ordrel
267 #define	x_thread	x_state.bit.b_thread
268 #define	x_waitdis	x_state.bit.b_waitdis
269 #define	x_needdis	x_state.bit.b_needdis
270 
271 #define	x_needrel	x_state.bit.b_needrel
272 #define	x_early_disc    x_state.bit.b_early_disc
273 
274 #define	x_state_flags	x_state.word
275 
276 #define	X_CLOSING	0x80000000
277 #define	X_DEAD		0x40000000
278 #define	X_DOOMED	0x20000000
279 #define	X_CONNECTED	0x10000000
280 
281 #define	X_ORDREL	0x08000000
282 #define	X_THREAD	0x04000000
283 #define	X_WAITDIS	0x02000000
284 #define	X_NEEDDIS	0x01000000
285 
286 #define	X_NEEDREL	0x00800000
287 #define	X_EARLYDISC	0x00400000
288 
289 #define	X_BADSTATES	(X_CLOSING | X_DEAD | X_DOOMED)
290 
291 	}		x_state;
292 	int		x_ref;		/* number of users of this xprt */
293 	int		x_family;	/* address family of transport */
294 	dev_t		x_rdev;		/* device number of transport */
295 	struct cm_xprt	*x_next;
296 
297 	struct netbuf	x_server;	/* destination address */
298 	struct netbuf	x_src;		/* src address (for retries) */
299 	kmutex_t	x_lock;		/* lock on this entry */
300 	kcondvar_t	x_cv;		/* to signal when can be closed */
301 	kcondvar_t	x_conn_cv;	/* to signal when connection attempt */
302 					/* is complete */
303 	kstat_t		*x_ksp;
304 
305 	kcondvar_t	x_dis_cv;	/* to signal when disconnect attempt */
306 					/* is complete */
307 	zoneid_t	x_zoneid;	/* zone this xprt belongs to */
308 };
309 
310 typedef struct cm_kstat_xprt {
311 	kstat_named_t	x_wq;
312 	kstat_named_t	x_server;
313 	kstat_named_t	x_family;
314 	kstat_named_t	x_rdev;
315 	kstat_named_t	x_time;
316 	kstat_named_t	x_state;
317 	kstat_named_t	x_ref;
318 	kstat_named_t	x_port;
319 } cm_kstat_xprt_t;
320 
321 static cm_kstat_xprt_t cm_kstat_template = {
322 	{ "write_queue", KSTAT_DATA_UINT32 },
323 	{ "server",	KSTAT_DATA_STRING },
324 	{ "addr_family", KSTAT_DATA_UINT32 },
325 	{ "device",	KSTAT_DATA_UINT32 },
326 	{ "time_stamp",	KSTAT_DATA_UINT32 },
327 	{ "status",	KSTAT_DATA_UINT32 },
328 	{ "ref_count",	KSTAT_DATA_INT32 },
329 	{ "port",	KSTAT_DATA_UINT32 },
330 };
331 
332 /*
333  * The inverse of this is connmgr_release().
334  */
335 #define	CONN_HOLD(Cm_entry)	{\
336 	mutex_enter(&(Cm_entry)->x_lock);	\
337 	(Cm_entry)->x_ref++;	\
338 	mutex_exit(&(Cm_entry)->x_lock);	\
339 }
340 
341 
342 /*
343  * Private data per rpc handle.  This structure is allocated by
344  * clnt_cots_kcreate, and freed by clnt_cots_kdestroy.
345  */
346 typedef struct cku_private_s {
347 	CLIENT			cku_client;	/* client handle */
348 	calllist_t		cku_call;	/* for dispatching calls */
349 	struct rpc_err		cku_err;	/* error status */
350 
351 	struct netbuf		cku_srcaddr;	/* source address for retries */
352 	int			cku_addrfmly;  /* for binding port */
353 	struct netbuf		cku_addr;	/* remote address */
354 	dev_t			cku_device;	/* device to use */
355 	uint_t			cku_flags;
356 #define	CKU_ONQUEUE		0x1
357 #define	CKU_SENT		0x2
358 
359 	bool_t			cku_progress;	/* for CLSET_PROGRESS */
360 	uint32_t		cku_xid;	/* current XID */
361 	clock_t			cku_ctime;	/* time stamp of when */
362 						/* connection was created */
363 	uint_t			cku_recv_attempts;
364 	XDR			cku_outxdr;	/* xdr routine for output */
365 	XDR			cku_inxdr;	/* xdr routine for input */
366 	char			cku_rpchdr[WIRE_HDR_SIZE + 4];
367 						/* pre-serialized rpc header */
368 
369 	uint_t			cku_outbuflen;	/* default output mblk length */
370 	struct cred		*cku_cred;	/* credentials */
371 	bool_t			cku_nodelayonerr;
372 						/* for CLSET_NODELAYONERR */
373 	int			cku_useresvport; /* Use reserved port */
374 	struct rpc_cots_client	*cku_stats;	/* stats for zone */
375 } cku_private_t;
376 
377 static struct cm_xprt *connmgr_wrapconnect(struct cm_xprt *,
378 	const struct timeval *, struct netbuf *, int, struct netbuf *,
379 	struct rpc_err *, bool_t, bool_t);
380 
381 static bool_t	connmgr_connect(struct cm_xprt *, queue_t *, struct netbuf *,
382 				int, calllist_t *, int *, bool_t reconnect,
383 				const struct timeval *, bool_t);
384 
385 static bool_t	connmgr_setopt(queue_t *, int, int, calllist_t *);
386 static void	connmgr_sndrel(struct cm_xprt *);
387 static void	connmgr_snddis(struct cm_xprt *);
388 static void	connmgr_close(struct cm_xprt *);
389 static void	connmgr_release(struct cm_xprt *);
390 static struct cm_xprt *connmgr_wrapget(struct netbuf *, const struct timeval *,
391 	cku_private_t *);
392 
393 static struct cm_xprt *connmgr_get(struct netbuf *, const struct timeval *,
394 	struct netbuf *, int, struct netbuf *, struct rpc_err *, dev_t,
395 	bool_t, int);
396 
397 static void connmgr_cancelconn(struct cm_xprt *);
398 static enum clnt_stat connmgr_cwait(struct cm_xprt *, const struct timeval *,
399 	bool_t);
400 static void connmgr_dis_and_wait(struct cm_xprt *);
401 
402 static void	clnt_dispatch_send(queue_t *, mblk_t *, calllist_t *, uint_t,
403 					uint_t);
404 
405 static int clnt_delay(clock_t, bool_t);
406 
407 static int waitforack(calllist_t *, t_scalar_t, const struct timeval *, bool_t);
408 
409 /*
410  * Operations vector for TCP/IP based RPC
411  */
412 static struct clnt_ops tcp_ops = {
413 	clnt_cots_kcallit,	/* do rpc call */
414 	clnt_cots_kabort,	/* abort call */
415 	clnt_cots_kerror,	/* return error status */
416 	clnt_cots_kfreeres,	/* free results */
417 	clnt_cots_kdestroy,	/* destroy rpc handle */
418 	clnt_cots_kcontrol,	/* the ioctl() of rpc */
419 	clnt_cots_ksettimers,	/* set retry timers */
420 };
421 
422 static int rpc_kstat_instance = 0;  /* keeps the current instance */
423 				/* number for the next kstat_create */
424 
425 static struct cm_xprt *cm_hd = NULL;
426 static kmutex_t connmgr_lock;	/* for connection mngr's list of transports */
427 
428 extern kmutex_t clnt_max_msg_lock;
429 
430 static calllist_t *clnt_pending = NULL;
431 extern kmutex_t clnt_pending_lock;
432 
433 static int clnt_cots_hash_size = DEFAULT_HASH_SIZE;
434 
435 static call_table_t *cots_call_ht;
436 
437 static const struct rpc_cots_client {
438 	kstat_named_t	rccalls;
439 	kstat_named_t	rcbadcalls;
440 	kstat_named_t	rcbadxids;
441 	kstat_named_t	rctimeouts;
442 	kstat_named_t	rcnewcreds;
443 	kstat_named_t	rcbadverfs;
444 	kstat_named_t	rctimers;
445 	kstat_named_t	rccantconn;
446 	kstat_named_t	rcnomem;
447 	kstat_named_t	rcintrs;
448 } cots_rcstat_tmpl = {
449 	{ "calls",	KSTAT_DATA_UINT64 },
450 	{ "badcalls",	KSTAT_DATA_UINT64 },
451 	{ "badxids",	KSTAT_DATA_UINT64 },
452 	{ "timeouts",	KSTAT_DATA_UINT64 },
453 	{ "newcreds",	KSTAT_DATA_UINT64 },
454 	{ "badverfs",	KSTAT_DATA_UINT64 },
455 	{ "timers",	KSTAT_DATA_UINT64 },
456 	{ "cantconn",	KSTAT_DATA_UINT64 },
457 	{ "nomem",	KSTAT_DATA_UINT64 },
458 	{ "interrupts", KSTAT_DATA_UINT64 }
459 };
460 
461 #define	COTSRCSTAT_INCR(p, x)	\
462 	atomic_add_64(&(p)->x.value.ui64, 1)
463 
464 #define	CLNT_MAX_CONNS	1	/* concurrent connections between clnt/srvr */
465 static int clnt_max_conns = CLNT_MAX_CONNS;
466 
467 #define	CLNT_MIN_TIMEOUT	10	/* seconds to wait after we get a */
468 					/* connection reset */
469 #define	CLNT_MIN_CONNTIMEOUT	5	/* seconds to wait for a connection */
470 
471 
472 static int clnt_cots_min_tout = CLNT_MIN_TIMEOUT;
473 static int clnt_cots_min_conntout = CLNT_MIN_CONNTIMEOUT;
474 
475 /*
476  * Limit the number of times we will attempt to receive a reply without
477  * re-sending a response.
478  */
479 #define	CLNT_MAXRECV_WITHOUT_RETRY	3
480 static uint_t clnt_cots_maxrecv	= CLNT_MAXRECV_WITHOUT_RETRY;
481 
482 uint_t *clnt_max_msg_sizep;
483 void (*clnt_stop_idle)(queue_t *wq);
484 
485 #define	ptoh(p)		(&((p)->cku_client))
486 #define	htop(h)		((cku_private_t *)((h)->cl_private))
487 
488 /*
489  * Times to retry
490  */
491 #define	REFRESHES	2	/* authentication refreshes */
492 
493 static int clnt_cots_do_bindresvport = 0; /* bind to a non-reserved port */
494 
495 static zone_key_t zone_cots_key;
496 
497 /*
498  * We need to do this after all kernel threads in the zone have exited.
499  */
500 /* ARGSUSED */
501 static void
502 clnt_zone_destroy(zoneid_t zoneid, void *unused)
503 {
504 	struct cm_xprt **cmp;
505 	struct cm_xprt *cm_entry;
506 	struct cm_xprt *freelist = NULL;
507 
508 	mutex_enter(&connmgr_lock);
509 	cmp = &cm_hd;
510 	while ((cm_entry = *cmp) != NULL) {
511 		if (cm_entry->x_zoneid == zoneid) {
512 			*cmp = cm_entry->x_next;
513 			cm_entry->x_next = freelist;
514 			freelist = cm_entry;
515 		} else {
516 			cmp = &cm_entry->x_next;
517 		}
518 	}
519 	mutex_exit(&connmgr_lock);
520 	while ((cm_entry = freelist) != NULL) {
521 		freelist = cm_entry->x_next;
522 		connmgr_close(cm_entry);
523 	}
524 }
525 
526 int
527 clnt_cots_kcreate(dev_t dev, struct netbuf *addr, int family, rpcprog_t prog,
528 	rpcvers_t vers, uint_t max_msgsize, cred_t *cred, CLIENT **ncl)
529 {
530 	CLIENT *h;
531 	cku_private_t *p;
532 	struct rpc_msg call_msg;
533 	struct rpcstat *rpcstat;
534 
535 	RPCLOG(8, "clnt_cots_kcreate: prog %u\n", prog);
536 
537 	rpcstat = zone_getspecific(rpcstat_zone_key, curproc->p_zone);
538 	ASSERT(rpcstat != NULL);
539 
540 	/* Allocate and intialize the client handle. */
541 	p = kmem_zalloc(sizeof (*p), KM_SLEEP);
542 
543 	h = ptoh(p);
544 
545 	h->cl_private = (caddr_t)p;
546 	h->cl_auth = authkern_create();
547 	h->cl_ops = &tcp_ops;
548 
549 	cv_init(&p->cku_call.call_cv, NULL, CV_DEFAULT, NULL);
550 	mutex_init(&p->cku_call.call_lock, NULL, MUTEX_DEFAULT, NULL);
551 
552 	/*
553 	 * If the current sanity check size in rpcmod is smaller
554 	 * than the size needed, then increase the sanity check.
555 	 */
556 	if (max_msgsize != 0 && clnt_max_msg_sizep != NULL &&
557 	    max_msgsize > *clnt_max_msg_sizep) {
558 		mutex_enter(&clnt_max_msg_lock);
559 		if (max_msgsize > *clnt_max_msg_sizep)
560 			*clnt_max_msg_sizep = max_msgsize;
561 		mutex_exit(&clnt_max_msg_lock);
562 	}
563 
564 	p->cku_outbuflen = COTS_DEFAULT_ALLOCSIZE;
565 
566 	/* Preserialize the call message header */
567 
568 	call_msg.rm_xid = 0;
569 	call_msg.rm_direction = CALL;
570 	call_msg.rm_call.cb_rpcvers = RPC_MSG_VERSION;
571 	call_msg.rm_call.cb_prog = prog;
572 	call_msg.rm_call.cb_vers = vers;
573 
574 	xdrmem_create(&p->cku_outxdr, p->cku_rpchdr, WIRE_HDR_SIZE, XDR_ENCODE);
575 
576 	if (!xdr_callhdr(&p->cku_outxdr, &call_msg)) {
577 		RPCLOG0(1, "clnt_cots_kcreate - Fatal header serialization "
578 		    "error\n");
579 		auth_destroy(h->cl_auth);
580 		kmem_free(p, sizeof (cku_private_t));
581 		RPCLOG0(1, "clnt_cots_kcreate: create failed error EINVAL\n");
582 		return (EINVAL);		/* XXX */
583 	}
584 
585 	/*
586 	 * The zalloc initialized the fields below.
587 	 * p->cku_xid = 0;
588 	 * p->cku_flags = 0;
589 	 * p->cku_srcaddr.len = 0;
590 	 * p->cku_srcaddr.maxlen = 0;
591 	 */
592 
593 	p->cku_cred = cred;
594 	p->cku_device = dev;
595 	p->cku_addrfmly = family;
596 	p->cku_addr.buf = kmem_zalloc(addr->maxlen, KM_SLEEP);
597 	p->cku_addr.maxlen = addr->maxlen;
598 	p->cku_addr.len = addr->len;
599 	bcopy(addr->buf, p->cku_addr.buf, addr->len);
600 	p->cku_stats = rpcstat->rpc_cots_client;
601 	p->cku_useresvport = -1; /* value is has not been set */
602 
603 	*ncl = h;
604 	return (0);
605 }
606 
607 /*ARGSUSED*/
608 static void
609 clnt_cots_kabort(CLIENT *h)
610 {
611 }
612 
613 /*
614  * Return error info on this handle.
615  */
616 static void
617 clnt_cots_kerror(CLIENT *h, struct rpc_err *err)
618 {
619 	/* LINTED pointer alignment */
620 	cku_private_t *p = htop(h);
621 
622 	*err = p->cku_err;
623 }
624 
625 static bool_t
626 clnt_cots_kfreeres(CLIENT *h, xdrproc_t xdr_res, caddr_t res_ptr)
627 {
628 	/* LINTED pointer alignment */
629 	cku_private_t *p = htop(h);
630 	XDR *xdrs;
631 
632 	xdrs = &(p->cku_outxdr);
633 	xdrs->x_op = XDR_FREE;
634 	return ((*xdr_res)(xdrs, res_ptr));
635 }
636 
637 static bool_t
638 clnt_cots_kcontrol(CLIENT *h, int cmd, char *arg)
639 {
640 	cku_private_t *p = htop(h);
641 
642 	switch (cmd) {
643 	case CLSET_PROGRESS:
644 		p->cku_progress = TRUE;
645 		return (TRUE);
646 
647 	case CLSET_XID:
648 		if (arg == NULL)
649 			return (FALSE);
650 
651 		p->cku_xid = *((uint32_t *)arg);
652 		return (TRUE);
653 
654 	case CLGET_XID:
655 		if (arg == NULL)
656 			return (FALSE);
657 
658 		*((uint32_t *)arg) = p->cku_xid;
659 		return (TRUE);
660 
661 	case CLSET_NODELAYONERR:
662 		if (arg == NULL)
663 			return (FALSE);
664 
665 		if (*((bool_t *)arg) == TRUE) {
666 			p->cku_nodelayonerr = TRUE;
667 			return (TRUE);
668 		}
669 		if (*((bool_t *)arg) == FALSE) {
670 			p->cku_nodelayonerr = FALSE;
671 			return (TRUE);
672 		}
673 		return (FALSE);
674 
675 	case CLGET_NODELAYONERR:
676 		if (arg == NULL)
677 			return (FALSE);
678 
679 		*((bool_t *)arg) = p->cku_nodelayonerr;
680 		return (TRUE);
681 
682 	case CLSET_BINDRESVPORT:
683 		if (arg == NULL)
684 			return (FALSE);
685 
686 		if (*(int *)arg != 1 && *(int *)arg != 0)
687 			return (FALSE);
688 
689 		p->cku_useresvport = *(int *)arg;
690 
691 		return (TRUE);
692 
693 	case CLGET_BINDRESVPORT:
694 		if (arg == NULL)
695 			return (FALSE);
696 
697 		*(int *)arg = p->cku_useresvport;
698 
699 		return (TRUE);
700 
701 	default:
702 		return (FALSE);
703 	}
704 }
705 
706 /*
707  * Destroy rpc handle.  Frees the space used for output buffer,
708  * private data, and handle structure.
709  */
710 static void
711 clnt_cots_kdestroy(CLIENT *h)
712 {
713 	/* LINTED pointer alignment */
714 	cku_private_t *p = htop(h);
715 	calllist_t *call = &p->cku_call;
716 
717 	RPCLOG(8, "clnt_cots_kdestroy h: %p\n", (void *)h);
718 	RPCLOG(8, "clnt_cots_kdestroy h: xid=0x%x\n", p->cku_xid);
719 
720 	if (p->cku_flags & CKU_ONQUEUE) {
721 		RPCLOG(64, "clnt_cots_kdestroy h: removing call for xid 0x%x "
722 		    "from dispatch list\n", p->cku_xid);
723 		call_table_remove(call);
724 	}
725 
726 	if (call->call_reply)
727 		freemsg(call->call_reply);
728 	cv_destroy(&call->call_cv);
729 	mutex_destroy(&call->call_lock);
730 
731 	kmem_free(p->cku_srcaddr.buf, p->cku_srcaddr.maxlen);
732 	kmem_free(p->cku_addr.buf, p->cku_addr.maxlen);
733 	kmem_free(p, sizeof (*p));
734 }
735 
736 static int clnt_cots_pulls;
737 #define	RM_HDR_SIZE	4	/* record mark header size */
738 
739 /*
740  * Call remote procedure.
741  */
742 static enum clnt_stat
743 clnt_cots_kcallit(CLIENT *h, rpcproc_t procnum, xdrproc_t xdr_args,
744     caddr_t argsp, xdrproc_t xdr_results, caddr_t resultsp, struct timeval wait)
745 {
746 	/* LINTED pointer alignment */
747 	cku_private_t *p = htop(h);
748 	calllist_t *call = &p->cku_call;
749 	XDR *xdrs;
750 	struct rpc_msg reply_msg;
751 	mblk_t *mp;
752 #ifdef	RPCDEBUG
753 	clock_t time_sent;
754 #endif
755 	struct netbuf *retryaddr;
756 	struct cm_xprt *cm_entry = NULL;
757 	queue_t *wq;
758 	int len;
759 	int mpsize;
760 	int refreshes = REFRESHES;
761 	int interrupted;
762 	int tidu_size;
763 	enum clnt_stat status;
764 	struct timeval cwait;
765 	bool_t delay_first = FALSE;
766 	clock_t ticks;
767 
768 	RPCLOG(2, "clnt_cots_kcallit, procnum %u\n", procnum);
769 	COTSRCSTAT_INCR(p->cku_stats, rccalls);
770 
771 	RPCLOG(2, "clnt_cots_kcallit: wait.tv_sec: %ld\n", wait.tv_sec);
772 	RPCLOG(2, "clnt_cots_kcallit: wait.tv_usec: %ld\n", wait.tv_usec);
773 
774 	/*
775 	 * Bug ID 1240234:
776 	 * Look out for zero length timeouts. We don't want to
777 	 * wait zero seconds for a connection to be established.
778 	 */
779 	if (wait.tv_sec < clnt_cots_min_conntout) {
780 		cwait.tv_sec = clnt_cots_min_conntout;
781 		cwait.tv_usec = 0;
782 		RPCLOG(8, "clnt_cots_kcallit: wait.tv_sec (%ld) too low,",
783 		    wait.tv_sec);
784 		RPCLOG(8, " setting to: %d\n", clnt_cots_min_conntout);
785 	} else {
786 		cwait = wait;
787 	}
788 
789 call_again:
790 	if (cm_entry) {
791 		connmgr_release(cm_entry);
792 		cm_entry = NULL;
793 	}
794 
795 	mp = NULL;
796 
797 	/*
798 	 * If the call is not a retry, allocate a new xid and cache it
799 	 * for future retries.
800 	 * Bug ID 1246045:
801 	 * Treat call as a retry for purposes of binding the source
802 	 * port only if we actually attempted to send anything on
803 	 * the previous call.
804 	 */
805 	if (p->cku_xid == 0) {
806 		p->cku_xid = alloc_xid();
807 		/*
808 		 * We need to ASSERT here that our xid != 0 because this
809 		 * determines whether or not our call record gets placed on
810 		 * the hash table or the linked list.  By design, we mandate
811 		 * that RPC calls over cots must have xid's != 0, so we can
812 		 * ensure proper management of the hash table.
813 		 */
814 		ASSERT(p->cku_xid != 0);
815 
816 		retryaddr = NULL;
817 		p->cku_flags &= ~CKU_SENT;
818 
819 		if (p->cku_flags & CKU_ONQUEUE) {
820 			RPCLOG(8, "clnt_cots_kcallit: new call, dequeuing old"
821 			    " one (%p)\n", (void *)call);
822 			call_table_remove(call);
823 			p->cku_flags &= ~CKU_ONQUEUE;
824 			RPCLOG(64, "clnt_cots_kcallit: removing call from "
825 			    "dispatch list because xid was zero (now 0x%x)\n",
826 			    p->cku_xid);
827 		}
828 
829 		if (call->call_reply != NULL) {
830 			freemsg(call->call_reply);
831 			call->call_reply = NULL;
832 		}
833 	} else if (p->cku_srcaddr.buf == NULL || p->cku_srcaddr.len == 0) {
834 		retryaddr = NULL;
835 
836 	} else if (p->cku_flags & CKU_SENT) {
837 		retryaddr = &p->cku_srcaddr;
838 
839 	} else {
840 		/*
841 		 * Bug ID 1246045: Nothing was sent, so set retryaddr to
842 		 * NULL and let connmgr_get() bind to any source port it
843 		 * can get.
844 		 */
845 		retryaddr = NULL;
846 	}
847 
848 	RPCLOG(64, "clnt_cots_kcallit: xid = 0x%x", p->cku_xid);
849 	RPCLOG(64, " flags = 0x%x\n", p->cku_flags);
850 
851 	p->cku_err.re_status = RPC_TIMEDOUT;
852 	p->cku_err.re_errno = p->cku_err.re_terrno = 0;
853 
854 	cm_entry = connmgr_wrapget(retryaddr, &cwait, p);
855 
856 	if (cm_entry == NULL) {
857 		RPCLOG(1, "clnt_cots_kcallit: can't connect status %s\n",
858 		    clnt_sperrno(p->cku_err.re_status));
859 
860 		/*
861 		 * The reasons why we fail to create a connection are
862 		 * varied. In most cases we don't want the caller to
863 		 * immediately retry. This could have one or more
864 		 * bad effects. This includes flooding the net with
865 		 * connect requests to ports with no listener; a hard
866 		 * kernel loop due to all the "reserved" TCP ports being
867 		 * in use.
868 		 */
869 		delay_first = TRUE;
870 
871 		/*
872 		 * Even if we end up returning EINTR, we still count a
873 		 * a "can't connect", because the connection manager
874 		 * might have been committed to waiting for or timing out on
875 		 * a connection.
876 		 */
877 		COTSRCSTAT_INCR(p->cku_stats, rccantconn);
878 		switch (p->cku_err.re_status) {
879 		case RPC_INTR:
880 			p->cku_err.re_errno = EINTR;
881 
882 			/*
883 			 * No need to delay because a UNIX signal(2)
884 			 * interrupted us. The caller likely won't
885 			 * retry the CLNT_CALL() and even if it does,
886 			 * we assume the caller knows what it is doing.
887 			 */
888 			delay_first = FALSE;
889 			break;
890 
891 		case RPC_TIMEDOUT:
892 			p->cku_err.re_errno = ETIMEDOUT;
893 
894 			/*
895 			 * No need to delay because timed out already
896 			 * on the connection request and assume that the
897 			 * transport time out is longer than our minimum
898 			 * timeout, or least not too much smaller.
899 			 */
900 			delay_first = FALSE;
901 			break;
902 
903 		case RPC_SYSTEMERROR:
904 		case RPC_TLIERROR:
905 			/*
906 			 * We want to delay here because a transient
907 			 * system error has a better chance of going away
908 			 * if we delay a bit. If it's not transient, then
909 			 * we don't want end up in a hard kernel loop
910 			 * due to retries.
911 			 */
912 			ASSERT(p->cku_err.re_errno != 0);
913 			break;
914 
915 
916 		case RPC_CANTCONNECT:
917 			/*
918 			 * RPC_CANTCONNECT is set on T_ERROR_ACK which
919 			 * implies some error down in the TCP layer or
920 			 * below. If cku_nodelayonerror is set then we
921 			 * assume the caller knows not to try too hard.
922 			 */
923 			RPCLOG0(8, "clnt_cots_kcallit: connection failed,");
924 			RPCLOG0(8, " re_status=RPC_CANTCONNECT,");
925 			RPCLOG(8, " re_errno=%d,", p->cku_err.re_errno);
926 			RPCLOG(8, " cku_nodelayonerr=%d", p->cku_nodelayonerr);
927 			if (p->cku_nodelayonerr == TRUE)
928 				delay_first = FALSE;
929 
930 			p->cku_err.re_errno = EIO;
931 
932 			break;
933 
934 		case RPC_XPRTFAILED:
935 			/*
936 			 * We want to delay here because we likely
937 			 * got a refused connection.
938 			 */
939 			if (p->cku_err.re_errno != 0)
940 				break;
941 
942 			/* fall thru */
943 
944 		default:
945 			/*
946 			 * We delay here because it is better to err
947 			 * on the side of caution. If we got here then
948 			 * status could have been RPC_SUCCESS, but we
949 			 * know that we did not get a connection, so
950 			 * force the rpc status to RPC_CANTCONNECT.
951 			 */
952 			p->cku_err.re_status = RPC_CANTCONNECT;
953 			p->cku_err.re_errno = EIO;
954 			break;
955 		}
956 		if (delay_first == TRUE)
957 			ticks = clnt_cots_min_tout * drv_usectohz(1000000);
958 		goto cots_done;
959 	}
960 
961 	/*
962 	 * If we've never sent any request on this connection (send count
963 	 * is zero, or the connection has been reset), cache the
964 	 * the connection's create time and send a request (possibly a retry)
965 	 */
966 	if ((p->cku_flags & CKU_SENT) == 0 ||
967 	    p->cku_ctime != cm_entry->x_ctime) {
968 		p->cku_ctime = cm_entry->x_ctime;
969 
970 	} else if ((p->cku_flags & CKU_SENT) && (p->cku_flags & CKU_ONQUEUE) &&
971 	    (call->call_reply != NULL ||
972 	    p->cku_recv_attempts < clnt_cots_maxrecv)) {
973 
974 		/*
975 		 * If we've sent a request and our call is on the dispatch
976 		 * queue and we haven't made too many receive attempts, then
977 		 * don't re-send, just receive.
978 		 */
979 		p->cku_recv_attempts++;
980 		goto read_again;
981 	}
982 
983 	/*
984 	 * Now we create the RPC request in a STREAMS message.  We have to do
985 	 * this after the call to connmgr_get so that we have the correct
986 	 * TIDU size for the transport.
987 	 */
988 	tidu_size = cm_entry->x_tidu_size;
989 	len = MSG_OFFSET + MAX(tidu_size, RM_HDR_SIZE + WIRE_HDR_SIZE);
990 
991 	while ((mp = allocb(len, BPRI_MED)) == NULL) {
992 		if (strwaitbuf(len, BPRI_MED)) {
993 			p->cku_err.re_status = RPC_SYSTEMERROR;
994 			p->cku_err.re_errno = ENOSR;
995 			COTSRCSTAT_INCR(p->cku_stats, rcnomem);
996 			goto cots_done;
997 		}
998 	}
999 	xdrs = &p->cku_outxdr;
1000 	xdrmblk_init(xdrs, mp, XDR_ENCODE, tidu_size);
1001 	mpsize = MBLKSIZE(mp);
1002 	ASSERT(mpsize >= len);
1003 	ASSERT(mp->b_rptr == mp->b_datap->db_base);
1004 
1005 	/*
1006 	 * If the size of mblk is not appreciably larger than what we
1007 	 * asked, then resize the mblk to exactly len bytes. The reason for
1008 	 * this: suppose len is 1600 bytes, the tidu is 1460 bytes
1009 	 * (from TCP over ethernet), and the arguments to the RPC require
1010 	 * 2800 bytes. Ideally we want the protocol to render two
1011 	 * ~1400 byte segments over the wire. However if allocb() gives us a 2k
1012 	 * mblk, and we allocate a second mblk for the remainder, the protocol
1013 	 * module may generate 3 segments over the wire:
1014 	 * 1460 bytes for the first, 448 (2048 - 1600) for the second, and
1015 	 * 892 for the third. If we "waste" 448 bytes in the first mblk,
1016 	 * the XDR encoding will generate two ~1400 byte mblks, and the
1017 	 * protocol module is more likely to produce properly sized segments.
1018 	 */
1019 	if ((mpsize >> 1) <= len)
1020 		mp->b_rptr += (mpsize - len);
1021 
1022 	/*
1023 	 * Adjust b_rptr to reserve space for the non-data protocol headers
1024 	 * any downstream modules might like to add, and for the
1025 	 * record marking header.
1026 	 */
1027 	mp->b_rptr += (MSG_OFFSET + RM_HDR_SIZE);
1028 
1029 	if (h->cl_auth->ah_cred.oa_flavor != RPCSEC_GSS) {
1030 		/* Copy in the preserialized RPC header information. */
1031 		bcopy(p->cku_rpchdr, mp->b_rptr, WIRE_HDR_SIZE);
1032 
1033 		/* Use XDR_SETPOS() to set the b_wptr to past the RPC header. */
1034 		XDR_SETPOS(xdrs, (uint_t)(mp->b_rptr - mp->b_datap->db_base +
1035 		    WIRE_HDR_SIZE));
1036 
1037 		ASSERT((mp->b_wptr - mp->b_rptr) == WIRE_HDR_SIZE);
1038 
1039 		/* Serialize the procedure number and the arguments. */
1040 		if ((!XDR_PUTINT32(xdrs, (int32_t *)&procnum)) ||
1041 		    (!AUTH_MARSHALL(h->cl_auth, xdrs, p->cku_cred)) ||
1042 		    (!(*xdr_args)(xdrs, argsp))) {
1043 			p->cku_err.re_status = RPC_CANTENCODEARGS;
1044 			p->cku_err.re_errno = EIO;
1045 			goto cots_done;
1046 		}
1047 
1048 		(*(uint32_t *)(mp->b_rptr)) = p->cku_xid;
1049 	} else {
1050 		uint32_t *uproc = (uint32_t *)&p->cku_rpchdr[WIRE_HDR_SIZE];
1051 		IXDR_PUT_U_INT32(uproc, procnum);
1052 
1053 		(*(uint32_t *)(&p->cku_rpchdr[0])) = p->cku_xid;
1054 
1055 		/* Use XDR_SETPOS() to set the b_wptr. */
1056 		XDR_SETPOS(xdrs, (uint_t)(mp->b_rptr - mp->b_datap->db_base));
1057 
1058 		/* Serialize the procedure number and the arguments. */
1059 		if (!AUTH_WRAP(h->cl_auth, p->cku_rpchdr, WIRE_HDR_SIZE+4,
1060 		    xdrs, xdr_args, argsp)) {
1061 			p->cku_err.re_status = RPC_CANTENCODEARGS;
1062 			p->cku_err.re_errno = EIO;
1063 			goto cots_done;
1064 		}
1065 	}
1066 
1067 	RPCLOG(2, "clnt_cots_kcallit: connected, sending call, tidu_size %d\n",
1068 	    tidu_size);
1069 
1070 	wq = cm_entry->x_wq;
1071 	clnt_dispatch_send(wq, mp, call, p->cku_xid,
1072 				(p->cku_flags & CKU_ONQUEUE));
1073 
1074 	RPCLOG(64, "clnt_cots_kcallit: sent call for xid 0x%x\n",
1075 		(uint_t)p->cku_xid);
1076 	p->cku_flags = (CKU_ONQUEUE|CKU_SENT);
1077 	p->cku_recv_attempts = 1;
1078 
1079 #ifdef	RPCDEBUG
1080 	time_sent = lbolt;
1081 #endif
1082 
1083 	/*
1084 	 * Wait for a reply or a timeout.  If there is no error or timeout,
1085 	 * (both indicated by call_status), call->call_reply will contain
1086 	 * the RPC reply message.
1087 	 */
1088 read_again:
1089 	mutex_enter(&call->call_lock);
1090 	interrupted = 0;
1091 	if (call->call_status == RPC_TIMEDOUT) {
1092 		/*
1093 		 * Indicate that the lwp is not to be stopped while waiting
1094 		 * for this network traffic.  This is to avoid deadlock while
1095 		 * debugging a process via /proc and also to avoid recursive
1096 		 * mutex_enter()s due to NFS page faults while stopping
1097 		 * (NFS holds locks when it calls here).
1098 		 */
1099 		clock_t cv_wait_ret;
1100 		clock_t timout;
1101 		clock_t oldlbolt;
1102 
1103 		klwp_t *lwp = ttolwp(curthread);
1104 
1105 		if (lwp != NULL)
1106 			lwp->lwp_nostop++;
1107 
1108 		oldlbolt = lbolt;
1109 		timout = wait.tv_sec * drv_usectohz(1000000) +
1110 		    drv_usectohz(wait.tv_usec) + oldlbolt;
1111 		/*
1112 		 * Iterate until the call_status is changed to something
1113 		 * other that RPC_TIMEDOUT, or if cv_timedwait_sig() returns
1114 		 * something <=0 zero. The latter means that we timed
1115 		 * out.
1116 		 */
1117 		if (h->cl_nosignal)
1118 			while ((cv_wait_ret = cv_timedwait(&call->call_cv,
1119 			    &call->call_lock, timout)) > 0 &&
1120 			    call->call_status == RPC_TIMEDOUT);
1121 		else
1122 			while ((cv_wait_ret = cv_timedwait_sig(
1123 			    &call->call_cv,
1124 			    &call->call_lock, timout)) > 0 &&
1125 			    call->call_status == RPC_TIMEDOUT);
1126 
1127 		switch (cv_wait_ret) {
1128 		case 0:
1129 			/*
1130 			 * If we got out of the above loop with
1131 			 * cv_timedwait_sig() returning 0, then we were
1132 			 * interrupted regardless what call_status is.
1133 			 */
1134 			interrupted = 1;
1135 			break;
1136 		case -1:
1137 			/* cv_timedwait_sig() timed out */
1138 			break;
1139 		default:
1140 
1141 			/*
1142 			 * We were cv_signaled(). If we didn't
1143 			 * get a successful call_status and returned
1144 			 * before time expired, delay up to clnt_cots_min_tout
1145 			 * seconds so that the caller doesn't immediately
1146 			 * try to call us again and thus force the
1147 			 * same condition that got us here (such
1148 			 * as a RPC_XPRTFAILED due to the server not
1149 			 * listening on the end-point.
1150 			 */
1151 			if (call->call_status != RPC_SUCCESS) {
1152 				clock_t curlbolt;
1153 				clock_t diff;
1154 
1155 				curlbolt = ddi_get_lbolt();
1156 				ticks = clnt_cots_min_tout *
1157 				    drv_usectohz(1000000);
1158 				diff = curlbolt - oldlbolt;
1159 				if (diff < ticks) {
1160 					delay_first = TRUE;
1161 					if (diff > 0)
1162 						ticks -= diff;
1163 				}
1164 			}
1165 			break;
1166 		}
1167 
1168 		if (lwp != NULL)
1169 			lwp->lwp_nostop--;
1170 	}
1171 	/*
1172 	 * Get the reply message, if any.  This will be freed at the end
1173 	 * whether or not an error occurred.
1174 	 */
1175 	mp = call->call_reply;
1176 	call->call_reply = NULL;
1177 
1178 	/*
1179 	 * call_err is the error info when the call is on dispatch queue.
1180 	 * cku_err is the error info returned to the caller.
1181 	 * Sync cku_err with call_err for local message processing.
1182 	 */
1183 
1184 	status = call->call_status;
1185 	p->cku_err = call->call_err;
1186 	mutex_exit(&call->call_lock);
1187 
1188 	if (status != RPC_SUCCESS) {
1189 		switch (status) {
1190 		case RPC_TIMEDOUT:
1191 			if (interrupted) {
1192 				COTSRCSTAT_INCR(p->cku_stats, rcintrs);
1193 				p->cku_err.re_status = RPC_INTR;
1194 				p->cku_err.re_errno = EINTR;
1195 				RPCLOG(1, "clnt_cots_kcallit: xid 0x%x",
1196 				    p->cku_xid);
1197 				RPCLOG(1, "signal interrupted at %ld", lbolt);
1198 				RPCLOG(1, ", was sent at %ld\n", time_sent);
1199 			} else {
1200 				COTSRCSTAT_INCR(p->cku_stats, rctimeouts);
1201 				p->cku_err.re_errno = ETIMEDOUT;
1202 				RPCLOG(1, "clnt_cots_kcallit: timed out at %ld",
1203 				    lbolt);
1204 				RPCLOG(1, ", was sent at %ld\n", time_sent);
1205 			}
1206 			break;
1207 
1208 		case RPC_XPRTFAILED:
1209 			if (p->cku_err.re_errno == 0)
1210 				p->cku_err.re_errno = EIO;
1211 
1212 			RPCLOG(1, "clnt_cots_kcallit: transport failed: %d\n",
1213 			    p->cku_err.re_errno);
1214 			break;
1215 
1216 		case RPC_SYSTEMERROR:
1217 			ASSERT(p->cku_err.re_errno);
1218 			RPCLOG(1, "clnt_cots_kcallit: system error: %d\n",
1219 			    p->cku_err.re_errno);
1220 			break;
1221 
1222 		default:
1223 			p->cku_err.re_status = RPC_SYSTEMERROR;
1224 			p->cku_err.re_errno = EIO;
1225 			RPCLOG(1, "clnt_cots_kcallit: error: %s\n",
1226 			    clnt_sperrno(status));
1227 			break;
1228 		}
1229 		if (p->cku_err.re_status != RPC_TIMEDOUT) {
1230 
1231 			if (p->cku_flags & CKU_ONQUEUE) {
1232 				call_table_remove(call);
1233 				p->cku_flags &= ~CKU_ONQUEUE;
1234 			}
1235 
1236 			RPCLOG(64, "clnt_cots_kcallit: non TIMEOUT so xid 0x%x "
1237 			    "taken off dispatch list\n", p->cku_xid);
1238 			if (call->call_reply) {
1239 				freemsg(call->call_reply);
1240 				call->call_reply = NULL;
1241 			}
1242 		} else if (wait.tv_sec != 0) {
1243 			/*
1244 			 * We've sent the request over TCP and so we have
1245 			 * every reason to believe it will get
1246 			 * delivered. In which case returning a timeout is not
1247 			 * appropriate.
1248 			 */
1249 			if (p->cku_progress == TRUE &&
1250 			    p->cku_recv_attempts < clnt_cots_maxrecv) {
1251 				p->cku_err.re_status = RPC_INPROGRESS;
1252 			}
1253 		}
1254 		goto cots_done;
1255 	}
1256 
1257 	xdrs = &p->cku_inxdr;
1258 	xdrmblk_init(xdrs, mp, XDR_DECODE, 0);
1259 
1260 	reply_msg.rm_direction = REPLY;
1261 	reply_msg.rm_reply.rp_stat = MSG_ACCEPTED;
1262 	reply_msg.acpted_rply.ar_stat = SUCCESS;
1263 
1264 	reply_msg.acpted_rply.ar_verf = _null_auth;
1265 	/*
1266 	 *  xdr_results will be done in AUTH_UNWRAP.
1267 	 */
1268 	reply_msg.acpted_rply.ar_results.where = NULL;
1269 	reply_msg.acpted_rply.ar_results.proc = xdr_void;
1270 
1271 	if (xdr_replymsg(xdrs, &reply_msg)) {
1272 		enum clnt_stat re_status;
1273 
1274 		_seterr_reply(&reply_msg, &p->cku_err);
1275 
1276 		re_status = p->cku_err.re_status;
1277 		if (re_status == RPC_SUCCESS) {
1278 			/*
1279 			 * Reply is good, check auth.
1280 			 */
1281 			if (!AUTH_VALIDATE(h->cl_auth,
1282 			    &reply_msg.acpted_rply.ar_verf)) {
1283 				COTSRCSTAT_INCR(p->cku_stats, rcbadverfs);
1284 				RPCLOG0(1, "clnt_cots_kcallit: validation "
1285 				    "failure\n");
1286 				freemsg(mp);
1287 				(void) xdr_rpc_free_verifier(xdrs, &reply_msg);
1288 				mutex_enter(&call->call_lock);
1289 				if (call->call_reply == NULL)
1290 					call->call_status = RPC_TIMEDOUT;
1291 				mutex_exit(&call->call_lock);
1292 				goto read_again;
1293 			} else if (!AUTH_UNWRAP(h->cl_auth, xdrs,
1294 			    xdr_results, resultsp)) {
1295 				RPCLOG0(1, "clnt_cots_kcallit: validation "
1296 				    "failure (unwrap)\n");
1297 				p->cku_err.re_status = RPC_CANTDECODERES;
1298 				p->cku_err.re_errno = EIO;
1299 			}
1300 		} else {
1301 			/* set errno in case we can't recover */
1302 			if (re_status != RPC_VERSMISMATCH &&
1303 			    re_status != RPC_AUTHERROR &&
1304 			    re_status != RPC_PROGVERSMISMATCH)
1305 				p->cku_err.re_errno = EIO;
1306 
1307 			if (re_status == RPC_AUTHERROR) {
1308 				/*
1309 				 * Maybe our credential need to be
1310 				 * refreshed
1311 				 */
1312 			    if ((refreshes > 0) &&
1313 				AUTH_REFRESH(h->cl_auth, &reply_msg,
1314 						p->cku_cred)) {
1315 				refreshes--;
1316 				(void) xdr_rpc_free_verifier(xdrs, &reply_msg);
1317 				freemsg(mp);
1318 				mp = NULL;
1319 
1320 				if (p->cku_flags & CKU_ONQUEUE) {
1321 					call_table_remove(call);
1322 					p->cku_flags &= ~CKU_ONQUEUE;
1323 				}
1324 
1325 				RPCLOG(64, "clnt_cots_kcallit: AUTH_ERROR, so "
1326 				    "xid 0x%x taken off dispatch list\n",
1327 				    p->cku_xid);
1328 				if (call->call_reply) {
1329 					freemsg(call->call_reply);
1330 					call->call_reply = NULL;
1331 				}
1332 				COTSRCSTAT_INCR(p->cku_stats, rcbadcalls);
1333 				COTSRCSTAT_INCR(p->cku_stats, rcnewcreds);
1334 				goto call_again;
1335 			    } else {
1336 				/*
1337 				 * We have used the client handle to
1338 				 * do an AUTH_REFRESH and the RPC status may
1339 				 * be set to RPC_SUCCESS; Let's make sure to
1340 				 * set it to RPC_AUTHERROR.
1341 				 */
1342 				p->cku_err.re_status = RPC_AUTHERROR;
1343 				/*
1344 				 * Map recoverable and unrecoverable
1345 				 * authentication errors to appropriate errno
1346 				 */
1347 				switch (p->cku_err.re_why) {
1348 				case AUTH_TOOWEAK:
1349 					/*
1350 					 * Could be an nfsportmon failure, set
1351 					 * useresvport and try again
1352 					 */
1353 					if (p->cku_useresvport != 1) {
1354 						p->cku_useresvport = 1;
1355 						p->cku_xid = 0;
1356 						(void) xdr_rpc_free_verifier
1357 							    (xdrs, &reply_msg);
1358 						freemsg(mp);
1359 						connmgr_cancelconn(cm_entry);
1360 						cm_entry = NULL;
1361 						goto call_again;
1362 					}
1363 					/* FALLTHRU */
1364 				case AUTH_BADCRED:
1365 				case AUTH_BADVERF:
1366 				case AUTH_INVALIDRESP:
1367 				case AUTH_FAILED:
1368 				case RPCSEC_GSS_NOCRED:
1369 				case RPCSEC_GSS_FAILED:
1370 						p->cku_err.re_errno = EACCES;
1371 						break;
1372 				case AUTH_REJECTEDCRED:
1373 				case AUTH_REJECTEDVERF:
1374 				default:	p->cku_err.re_errno = EIO;
1375 						break;
1376 				}
1377 				RPCLOG(1, "clnt_cots_kcallit : authentication"
1378 				    " failed with RPC_AUTHERROR of type %d\n",
1379 				    (int)p->cku_err.re_why);
1380 			    }
1381 			}
1382 		}
1383 	} else {
1384 		/* reply didn't decode properly. */
1385 		p->cku_err.re_status = RPC_CANTDECODERES;
1386 		p->cku_err.re_errno = EIO;
1387 		RPCLOG0(1, "clnt_cots_kcallit: decode failure\n");
1388 	}
1389 
1390 	(void) xdr_rpc_free_verifier(xdrs, &reply_msg);
1391 
1392 	if (p->cku_flags & CKU_ONQUEUE) {
1393 		call_table_remove(call);
1394 		p->cku_flags &= ~CKU_ONQUEUE;
1395 	}
1396 
1397 	RPCLOG(64, "clnt_cots_kcallit: xid 0x%x taken off dispatch list",
1398 	    p->cku_xid);
1399 	RPCLOG(64, " status is %s\n", clnt_sperrno(p->cku_err.re_status));
1400 cots_done:
1401 	if (cm_entry)
1402 		connmgr_release(cm_entry);
1403 
1404 	if (mp != NULL)
1405 		freemsg(mp);
1406 	if ((p->cku_flags & CKU_ONQUEUE) == 0 && call->call_reply) {
1407 		freemsg(call->call_reply);
1408 		call->call_reply = NULL;
1409 	}
1410 	if (p->cku_err.re_status != RPC_SUCCESS) {
1411 		RPCLOG0(1, "clnt_cots_kcallit: tail-end failure\n");
1412 		COTSRCSTAT_INCR(p->cku_stats, rcbadcalls);
1413 	}
1414 
1415 	/*
1416 	 * No point in delaying if the zone is going away.
1417 	 */
1418 	if (delay_first == TRUE &&
1419 	    !(zone_status_get(curproc->p_zone) >= ZONE_IS_SHUTTING_DOWN)) {
1420 		if (clnt_delay(ticks, h->cl_nosignal) == EINTR) {
1421 			p->cku_err.re_errno = EINTR;
1422 			p->cku_err.re_status = RPC_INTR;
1423 		}
1424 	}
1425 	return (p->cku_err.re_status);
1426 }
1427 
1428 /*
1429  * Kinit routine for cots.  This sets up the correct operations in
1430  * the client handle, as the handle may have previously been a clts
1431  * handle, and clears the xid field so there is no way a new call
1432  * could be mistaken for a retry.  It also sets in the handle the
1433  * information that is passed at create/kinit time but needed at
1434  * call time, as cots creates the transport at call time - device,
1435  * address of the server, protocol family.
1436  */
1437 void
1438 clnt_cots_kinit(CLIENT *h, dev_t dev, int family, struct netbuf *addr,
1439 	int max_msgsize, cred_t *cred)
1440 {
1441 	/* LINTED pointer alignment */
1442 	cku_private_t *p = htop(h);
1443 	calllist_t *call = &p->cku_call;
1444 
1445 	h->cl_ops = &tcp_ops;
1446 	if (p->cku_flags & CKU_ONQUEUE) {
1447 		call_table_remove(call);
1448 		p->cku_flags &= ~CKU_ONQUEUE;
1449 		RPCLOG(64, "clnt_cots_kinit: removing call for xid 0x%x from"
1450 		    " dispatch list\n", p->cku_xid);
1451 	}
1452 
1453 	if (call->call_reply != NULL) {
1454 		freemsg(call->call_reply);
1455 		call->call_reply = NULL;
1456 	}
1457 
1458 	call->call_bucket = NULL;
1459 	call->call_hash = 0;
1460 
1461 	/*
1462 	 * We don't clear cku_flags here, because clnt_cots_kcallit()
1463 	 * takes care of handling the cku_flags reset.
1464 	 */
1465 	p->cku_xid = 0;
1466 	p->cku_device = dev;
1467 	p->cku_addrfmly = family;
1468 	p->cku_cred = cred;
1469 
1470 	if (p->cku_addr.maxlen < addr->len) {
1471 		if (p->cku_addr.maxlen != 0 && p->cku_addr.buf != NULL)
1472 			kmem_free(p->cku_addr.buf, p->cku_addr.maxlen);
1473 		p->cku_addr.buf = kmem_zalloc(addr->maxlen, KM_SLEEP);
1474 		p->cku_addr.maxlen = addr->maxlen;
1475 	}
1476 
1477 	p->cku_addr.len = addr->len;
1478 	bcopy(addr->buf, p->cku_addr.buf, addr->len);
1479 
1480 	/*
1481 	 * If the current sanity check size in rpcmod is smaller
1482 	 * than the size needed, then increase the sanity check.
1483 	 */
1484 	if (max_msgsize != 0 && clnt_max_msg_sizep != NULL &&
1485 	    max_msgsize > *clnt_max_msg_sizep) {
1486 		mutex_enter(&clnt_max_msg_lock);
1487 		if (max_msgsize > *clnt_max_msg_sizep)
1488 			*clnt_max_msg_sizep = max_msgsize;
1489 		mutex_exit(&clnt_max_msg_lock);
1490 	}
1491 }
1492 
1493 /*
1494  * ksettimers is a no-op for cots, with the exception of setting the xid.
1495  */
1496 /* ARGSUSED */
1497 static int
1498 clnt_cots_ksettimers(CLIENT *h, struct rpc_timers *t, struct rpc_timers *all,
1499 	int minimum, void (*feedback)(int, int, caddr_t), caddr_t arg,
1500 	uint32_t xid)
1501 {
1502 	/* LINTED pointer alignment */
1503 	cku_private_t *p = htop(h);
1504 
1505 	if (xid)
1506 		p->cku_xid = xid;
1507 	COTSRCSTAT_INCR(p->cku_stats, rctimers);
1508 	return (0);
1509 }
1510 
1511 extern void rpc_poptimod(struct vnode *);
1512 extern int kstr_push(struct vnode *, char *);
1513 
1514 int
1515 conn_kstat_update(kstat_t *ksp, int rw)
1516 {
1517 	struct cm_xprt *cm_entry;
1518 	struct cm_kstat_xprt *cm_ksp_data;
1519 	uchar_t *b;
1520 	char *fbuf;
1521 
1522 	if (rw == KSTAT_WRITE)
1523 		return (EACCES);
1524 	if (ksp == NULL || ksp->ks_private == NULL)
1525 		return (EIO);
1526 	cm_entry  = (struct cm_xprt *)ksp->ks_private;
1527 	cm_ksp_data = (struct cm_kstat_xprt *)ksp->ks_data;
1528 
1529 	cm_ksp_data->x_wq.value.ui32 = (uint32_t)(uintptr_t)cm_entry->x_wq;
1530 	cm_ksp_data->x_family.value.ui32 = cm_entry->x_family;
1531 	cm_ksp_data->x_rdev.value.ui32 = (uint32_t)cm_entry->x_rdev;
1532 	cm_ksp_data->x_time.value.ui32 = cm_entry->x_time;
1533 	cm_ksp_data->x_ref.value.ui32 = cm_entry->x_ref;
1534 	cm_ksp_data->x_state.value.ui32 = cm_entry->x_state_flags;
1535 
1536 	if (cm_entry->x_server.buf) {
1537 		fbuf = cm_ksp_data->x_server.value.str.addr.ptr;
1538 		if (cm_entry->x_family == AF_INET &&
1539 		    cm_entry->x_server.len ==
1540 		    sizeof (struct sockaddr_in)) {
1541 			struct sockaddr_in  *sa;
1542 			sa = (struct sockaddr_in *)
1543 				cm_entry->x_server.buf;
1544 			b = (uchar_t *)&sa->sin_addr;
1545 			(void) sprintf(fbuf,
1546 			    "%03d.%03d.%03d.%03d", b[0] & 0xFF, b[1] & 0xFF,
1547 			    b[2] & 0xFF, b[3] & 0xFF);
1548 			cm_ksp_data->x_port.value.ui32 =
1549 				(uint32_t)sa->sin_port;
1550 		} else if (cm_entry->x_family == AF_INET6 &&
1551 				cm_entry->x_server.len >=
1552 				sizeof (struct sockaddr_in6)) {
1553 			/* extract server IP address & port */
1554 			struct sockaddr_in6 *sin6;
1555 			sin6 = (struct sockaddr_in6 *)cm_entry->x_server.buf;
1556 			(void) kinet_ntop6((uchar_t *)&sin6->sin6_addr, fbuf,
1557 				INET6_ADDRSTRLEN);
1558 			cm_ksp_data->x_port.value.ui32 = sin6->sin6_port;
1559 		} else {
1560 			struct sockaddr_in  *sa;
1561 
1562 			sa = (struct sockaddr_in *)cm_entry->x_server.buf;
1563 			b = (uchar_t *)&sa->sin_addr;
1564 			(void) sprintf(fbuf,
1565 			    "%03d.%03d.%03d.%03d", b[0] & 0xFF, b[1] & 0xFF,
1566 			    b[2] & 0xFF, b[3] & 0xFF);
1567 		}
1568 		KSTAT_NAMED_STR_BUFLEN(&cm_ksp_data->x_server) =
1569 			strlen(fbuf) + 1;
1570 	}
1571 
1572 	return (0);
1573 }
1574 
1575 
1576 /*
1577  * We want a version of delay which is interruptible by a UNIX signal
1578  * Return EINTR if an interrupt occured.
1579  */
1580 static int
1581 clnt_delay(clock_t ticks, bool_t nosignal)
1582 {
1583 	if (nosignal == TRUE) {
1584 		delay(ticks);
1585 		return (0);
1586 	}
1587 	return (delay_sig(ticks));
1588 }
1589 
1590 /*
1591  * Wait for a connection until a timeout, or until we are
1592  * signalled that there has been a connection state change.
1593  */
1594 static enum clnt_stat
1595 connmgr_cwait(struct cm_xprt *cm_entry, const struct timeval *waitp,
1596 	bool_t nosignal)
1597 {
1598 	bool_t interrupted;
1599 	clock_t timout, cv_stat;
1600 	enum clnt_stat clstat;
1601 	unsigned int old_state;
1602 
1603 	ASSERT(MUTEX_HELD(&connmgr_lock));
1604 	/*
1605 	 * We wait for the transport connection to be made, or an
1606 	 * indication that it could not be made.
1607 	 */
1608 	clstat = RPC_TIMEDOUT;
1609 	interrupted = FALSE;
1610 
1611 	old_state = cm_entry->x_state_flags;
1612 	/*
1613 	 * Now loop until cv_timedwait{_sig} returns because of
1614 	 * a signal(0) or timeout(-1) or cv_signal(>0). But it may be
1615 	 * cv_signalled for various other reasons too. So loop
1616 	 * until there is a state change on the connection.
1617 	 */
1618 
1619 	timout = waitp->tv_sec * drv_usectohz(1000000) +
1620 	    drv_usectohz(waitp->tv_usec) + lbolt;
1621 
1622 	if (nosignal) {
1623 		while ((cv_stat = cv_timedwait(&cm_entry->x_conn_cv,
1624 		    &connmgr_lock, timout)) > 0 &&
1625 		    cm_entry->x_state_flags == old_state)
1626 			;
1627 	} else {
1628 		while ((cv_stat = cv_timedwait_sig(&cm_entry->x_conn_cv,
1629 		    &connmgr_lock, timout)) > 0 &&
1630 		    cm_entry->x_state_flags == old_state)
1631 			;
1632 
1633 		if (cv_stat == 0) /* got intr signal? */
1634 			interrupted = TRUE;
1635 	}
1636 
1637 	if ((cm_entry->x_state_flags & (X_BADSTATES|X_CONNECTED)) ==
1638 	    X_CONNECTED) {
1639 		clstat = RPC_SUCCESS;
1640 	} else {
1641 		if (interrupted == TRUE)
1642 			clstat = RPC_INTR;
1643 		RPCLOG(1, "connmgr_cwait: can't connect, error: %s\n",
1644 		    clnt_sperrno(clstat));
1645 	}
1646 
1647 	return (clstat);
1648 }
1649 
1650 /*
1651  * Primary interface for how RPC grabs a connection.
1652  */
1653 static struct cm_xprt *
1654 connmgr_wrapget(
1655 	struct netbuf *retryaddr,
1656 	const struct timeval *waitp,
1657 	cku_private_t *p)
1658 {
1659 	struct cm_xprt *cm_entry;
1660 
1661 	cm_entry = connmgr_get(retryaddr, waitp, &p->cku_addr, p->cku_addrfmly,
1662 	    &p->cku_srcaddr, &p->cku_err, p->cku_device,
1663 	    p->cku_client.cl_nosignal, p->cku_useresvport);
1664 
1665 	if (cm_entry == NULL) {
1666 		/*
1667 		 * Re-map the call status to RPC_INTR if the err code is
1668 		 * EINTR. This can happen if calls status is RPC_TLIERROR.
1669 		 * However, don't re-map if signalling has been turned off.
1670 		 * XXX Really need to create a separate thread whenever
1671 		 * there isn't an existing connection.
1672 		 */
1673 		if (p->cku_err.re_errno == EINTR) {
1674 			if (p->cku_client.cl_nosignal == TRUE)
1675 				p->cku_err.re_errno = EIO;
1676 			else
1677 				p->cku_err.re_status = RPC_INTR;
1678 		}
1679 	}
1680 
1681 	return (cm_entry);
1682 }
1683 
1684 /*
1685  * Obtains a transport to the server specified in addr.  If a suitable transport
1686  * does not already exist in the list of cached transports, a new connection
1687  * is created, connected, and added to the list. The connection is for sending
1688  * only - the reply message may come back on another transport connection.
1689  */
1690 static struct cm_xprt *
1691 connmgr_get(
1692 	struct netbuf	*retryaddr,
1693 	const struct timeval	*waitp,	/* changed to a ptr to converse stack */
1694 	struct netbuf	*destaddr,
1695 	int		addrfmly,
1696 	struct netbuf	*srcaddr,
1697 	struct rpc_err	*rpcerr,
1698 	dev_t		device,
1699 	bool_t		nosignal,
1700 	int		useresvport)
1701 {
1702 	struct cm_xprt *cm_entry;
1703 	struct cm_xprt *lru_entry;
1704 	struct cm_xprt **cmp;
1705 	queue_t *wq;
1706 	TIUSER *tiptr;
1707 	int i;
1708 	int retval;
1709 	clock_t prev_time;
1710 	int tidu_size;
1711 	bool_t	connected;
1712 	zoneid_t zoneid = getzoneid();
1713 
1714 	/*
1715 	 * If the call is not a retry, look for a transport entry that
1716 	 * goes to the server of interest.
1717 	 */
1718 	mutex_enter(&connmgr_lock);
1719 
1720 	if (retryaddr == NULL) {
1721 use_new_conn:
1722 		i = 0;
1723 		cm_entry = lru_entry = NULL;
1724 		prev_time = lbolt;
1725 
1726 		cmp = &cm_hd;
1727 		while ((cm_entry = *cmp) != NULL) {
1728 			ASSERT(cm_entry != cm_entry->x_next);
1729 			/*
1730 			 * Garbage collect conections that are marked
1731 			 * for needs disconnect.
1732 			 */
1733 			if (cm_entry->x_needdis) {
1734 				CONN_HOLD(cm_entry);
1735 				connmgr_dis_and_wait(cm_entry);
1736 				connmgr_release(cm_entry);
1737 				/*
1738 				 * connmgr_lock could have been
1739 				 * dropped for the disconnect
1740 				 * processing so start over.
1741 				 */
1742 				goto use_new_conn;
1743 			}
1744 
1745 			/*
1746 			 * Garbage collect the dead connections that have
1747 			 * no threads working on them.
1748 			 */
1749 			if ((cm_entry->x_state_flags & (X_DEAD|X_THREAD)) ==
1750 			    X_DEAD) {
1751 				*cmp = cm_entry->x_next;
1752 				mutex_exit(&connmgr_lock);
1753 				connmgr_close(cm_entry);
1754 				mutex_enter(&connmgr_lock);
1755 				goto use_new_conn;
1756 			}
1757 
1758 
1759 			if ((cm_entry->x_state_flags & X_BADSTATES) == 0 &&
1760 			    cm_entry->x_zoneid == zoneid &&
1761 			    cm_entry->x_rdev == device &&
1762 			    destaddr->len == cm_entry->x_server.len &&
1763 			    bcmp(destaddr->buf, cm_entry->x_server.buf,
1764 			    destaddr->len) == 0) {
1765 				/*
1766 				 * If the matching entry isn't connected,
1767 				 * attempt to reconnect it.
1768 				 */
1769 				if (cm_entry->x_connected == FALSE) {
1770 					/*
1771 					 * We don't go through trying
1772 					 * to find the least recently
1773 					 * used connected because
1774 					 * connmgr_reconnect() briefly
1775 					 * dropped the connmgr_lock,
1776 					 * allowing a window for our
1777 					 * accounting to be messed up.
1778 					 * In any case, a re-connected
1779 					 * connection is as good as
1780 					 * a LRU connection.
1781 					 */
1782 					return (connmgr_wrapconnect(cm_entry,
1783 					    waitp, destaddr, addrfmly, srcaddr,
1784 					    rpcerr, TRUE, nosignal));
1785 				}
1786 				i++;
1787 				if (cm_entry->x_time - prev_time <= 0 ||
1788 				    lru_entry == NULL) {
1789 					prev_time = cm_entry->x_time;
1790 					lru_entry = cm_entry;
1791 				}
1792 			}
1793 			cmp = &cm_entry->x_next;
1794 		}
1795 
1796 		if (i > clnt_max_conns) {
1797 			RPCLOG(8, "connmgr_get: too many conns, dooming entry"
1798 			    " %p\n", (void *)lru_entry->x_tiptr);
1799 			lru_entry->x_doomed = TRUE;
1800 			goto use_new_conn;
1801 		}
1802 
1803 		/*
1804 		 * If we are at the maximum number of connections to
1805 		 * the server, hand back the least recently used one.
1806 		 */
1807 		if (i == clnt_max_conns) {
1808 			/*
1809 			 * Copy into the handle the source address of
1810 			 * the connection, which we will use in case of
1811 			 * a later retry.
1812 			 */
1813 			if (srcaddr->len != lru_entry->x_src.len) {
1814 				if (srcaddr->len > 0)
1815 					kmem_free(srcaddr->buf,
1816 					    srcaddr->maxlen);
1817 				srcaddr->buf = kmem_zalloc(
1818 				    lru_entry->x_src.len, KM_SLEEP);
1819 				srcaddr->maxlen = srcaddr->len =
1820 				    lru_entry->x_src.len;
1821 			}
1822 			bcopy(lru_entry->x_src.buf, srcaddr->buf, srcaddr->len);
1823 			RPCLOG(2, "connmgr_get: call going out on %p\n",
1824 			    (void *)lru_entry);
1825 			lru_entry->x_time = lbolt;
1826 			CONN_HOLD(lru_entry);
1827 			mutex_exit(&connmgr_lock);
1828 			return (lru_entry);
1829 		}
1830 
1831 	} else {
1832 		/*
1833 		 * This is the retry case (retryaddr != NULL).  Retries must
1834 		 * be sent on the same source port as the original call.
1835 		 */
1836 
1837 		/*
1838 		 * Walk the list looking for a connection with a source address
1839 		 * that matches the retry address.
1840 		 */
1841 		cmp = &cm_hd;
1842 		while ((cm_entry = *cmp) != NULL) {
1843 			ASSERT(cm_entry != cm_entry->x_next);
1844 			if (zoneid != cm_entry->x_zoneid ||
1845 			    device != cm_entry->x_rdev ||
1846 			    retryaddr->len != cm_entry->x_src.len ||
1847 			    bcmp(retryaddr->buf, cm_entry->x_src.buf,
1848 				    retryaddr->len) != 0) {
1849 				cmp = &cm_entry->x_next;
1850 				continue;
1851 			}
1852 
1853 			/*
1854 			 * Sanity check: if the connection with our source
1855 			 * port is going to some other server, something went
1856 			 * wrong, as we never delete connections (i.e. release
1857 			 * ports) unless they have been idle.  In this case,
1858 			 * it is probably better to send the call out using
1859 			 * a new source address than to fail it altogether,
1860 			 * since that port may never be released.
1861 			 */
1862 			if (destaddr->len != cm_entry->x_server.len ||
1863 				bcmp(destaddr->buf, cm_entry->x_server.buf,
1864 					destaddr->len) != 0) {
1865 				RPCLOG(1, "connmgr_get: tiptr %p"
1866 				    " is going to a different server"
1867 				    " with the port that belongs"
1868 				    " to us!\n", (void *)cm_entry->x_tiptr);
1869 				retryaddr = NULL;
1870 				goto use_new_conn;
1871 			}
1872 
1873 			/*
1874 			 * If the connection of interest is not connected and we
1875 			 * can't reconnect it, then the server is probably
1876 			 * still down.  Return NULL to the caller and let it
1877 			 * retry later if it wants to.  We have a delay so the
1878 			 * machine doesn't go into a tight retry loop.  If the
1879 			 * entry was already connected, or the reconnected was
1880 			 * successful, return this entry.
1881 			 */
1882 			if (cm_entry->x_connected == FALSE) {
1883 				return (connmgr_wrapconnect(cm_entry,
1884 				    waitp, destaddr, addrfmly, NULL,
1885 				    rpcerr, TRUE, nosignal));
1886 			} else {
1887 				CONN_HOLD(cm_entry);
1888 
1889 				cm_entry->x_time = lbolt;
1890 				mutex_exit(&connmgr_lock);
1891 				RPCLOG(2, "connmgr_get: found old "
1892 				    "transport %p for retry\n",
1893 				    (void *)cm_entry);
1894 				return (cm_entry);
1895 			}
1896 		}
1897 
1898 		/*
1899 		 * We cannot find an entry in the list for this retry.
1900 		 * Either the entry has been removed temporarily to be
1901 		 * reconnected by another thread, or the original call
1902 		 * got a port but never got connected,
1903 		 * and hence the transport never got put in the
1904 		 * list.  Fall through to the "create new connection" code -
1905 		 * the former case will fail there trying to rebind the port,
1906 		 * and the later case (and any other pathological cases) will
1907 		 * rebind and reconnect and not hang the client machine.
1908 		 */
1909 		RPCLOG0(8, "connmgr_get: no entry in list for retry\n");
1910 	}
1911 	/*
1912 	 * Set up a transport entry in the connection manager's list.
1913 	 */
1914 	cm_entry = (struct cm_xprt *)
1915 	    kmem_zalloc(sizeof (struct cm_xprt), KM_SLEEP);
1916 
1917 	cm_entry->x_server.buf = kmem_zalloc(destaddr->len, KM_SLEEP);
1918 	bcopy(destaddr->buf, cm_entry->x_server.buf, destaddr->len);
1919 	cm_entry->x_server.len = cm_entry->x_server.maxlen = destaddr->len;
1920 
1921 	cm_entry->x_state_flags = X_THREAD;
1922 	cm_entry->x_ref = 1;
1923 	cm_entry->x_family = addrfmly;
1924 	cm_entry->x_rdev = device;
1925 	cm_entry->x_zoneid = zoneid;
1926 	mutex_init(&cm_entry->x_lock, NULL, MUTEX_DEFAULT, NULL);
1927 	cv_init(&cm_entry->x_cv, NULL, CV_DEFAULT, NULL);
1928 	cv_init(&cm_entry->x_conn_cv, NULL, CV_DEFAULT, NULL);
1929 	cv_init(&cm_entry->x_dis_cv, NULL, CV_DEFAULT, NULL);
1930 
1931 	/*
1932 	 * Note that we add this partially initialized entry to the
1933 	 * connection list. This is so that we don't have connections to
1934 	 * the same server.
1935 	 *
1936 	 * Note that x_src is not initialized at this point. This is because
1937 	 * retryaddr might be NULL in which case x_src is whatever
1938 	 * t_kbind/bindresvport gives us. If another thread wants a
1939 	 * connection to the same server, seemingly we have an issue, but we
1940 	 * don't. If the other thread comes in with retryaddr == NULL, then it
1941 	 * will never look at x_src, and it will end up waiting in
1942 	 * connmgr_cwait() for the first thread to finish the connection
1943 	 * attempt. If the other thread comes in with retryaddr != NULL, then
1944 	 * that means there was a request sent on a connection, in which case
1945 	 * the the connection should already exist. Thus the first thread
1946 	 * never gets here ... it finds the connection it its server in the
1947 	 * connection list.
1948 	 *
1949 	 * But even if theory is wrong, in the retryaddr != NULL case, the 2nd
1950 	 * thread will skip us because x_src.len == 0.
1951 	 */
1952 	cm_entry->x_next = cm_hd;
1953 	cm_hd = cm_entry;
1954 	mutex_exit(&connmgr_lock);
1955 
1956 	/*
1957 	 * Either we didn't find an entry to the server of interest, or we
1958 	 * don't have the maximum number of connections to that server -
1959 	 * create a new connection.
1960 	 */
1961 	RPCLOG0(8, "connmgr_get: creating new connection\n");
1962 	rpcerr->re_status = RPC_TLIERROR;
1963 
1964 	i = t_kopen(NULL, device, FREAD|FWRITE|FNDELAY, &tiptr, kcred);
1965 	if (i) {
1966 		RPCLOG(1, "connmgr_get: can't open cots device, error %d\n", i);
1967 		rpcerr->re_errno = i;
1968 		connmgr_cancelconn(cm_entry);
1969 		return (NULL);
1970 	}
1971 	rpc_poptimod(tiptr->fp->f_vnode);
1972 
1973 	if (i = strioctl(tiptr->fp->f_vnode, I_PUSH, (intptr_t)"rpcmod", 0,
1974 			K_TO_K, kcred, &retval)) {
1975 		RPCLOG(1, "connmgr_get: can't push cots module, %d\n", i);
1976 		(void) t_kclose(tiptr, 1);
1977 		rpcerr->re_errno = i;
1978 		connmgr_cancelconn(cm_entry);
1979 		return (NULL);
1980 	}
1981 
1982 	if (i = strioctl(tiptr->fp->f_vnode, RPC_CLIENT, 0, 0, K_TO_K,
1983 		kcred, &retval)) {
1984 		RPCLOG(1, "connmgr_get: can't set client status with cots "
1985 		    "module, %d\n", i);
1986 		(void) t_kclose(tiptr, 1);
1987 		rpcerr->re_errno = i;
1988 		connmgr_cancelconn(cm_entry);
1989 		return (NULL);
1990 	}
1991 
1992 	mutex_enter(&connmgr_lock);
1993 
1994 	wq = tiptr->fp->f_vnode->v_stream->sd_wrq->q_next;
1995 	cm_entry->x_wq = wq;
1996 
1997 	mutex_exit(&connmgr_lock);
1998 
1999 	if (i = strioctl(tiptr->fp->f_vnode, I_PUSH, (intptr_t)"timod", 0,
2000 			K_TO_K, kcred, &retval)) {
2001 		RPCLOG(1, "connmgr_get: can't push timod, %d\n", i);
2002 		(void) t_kclose(tiptr, 1);
2003 		rpcerr->re_errno = i;
2004 		connmgr_cancelconn(cm_entry);
2005 		return (NULL);
2006 	}
2007 
2008 	/*
2009 	 * If the caller has not specified reserved port usage then
2010 	 * take the system default.
2011 	 */
2012 	if (useresvport == -1)
2013 		useresvport = clnt_cots_do_bindresvport;
2014 
2015 	if ((useresvport || retryaddr != NULL) &&
2016 	    (addrfmly == AF_INET || addrfmly == AF_INET6)) {
2017 		bool_t alloc_src = FALSE;
2018 
2019 		if (srcaddr->len != destaddr->len) {
2020 			kmem_free(srcaddr->buf, srcaddr->maxlen);
2021 			srcaddr->buf = kmem_zalloc(destaddr->len, KM_SLEEP);
2022 			srcaddr->maxlen = destaddr->len;
2023 			srcaddr->len = destaddr->len;
2024 			alloc_src = TRUE;
2025 		}
2026 
2027 		if ((i = bindresvport(tiptr, retryaddr, srcaddr, TRUE)) != 0) {
2028 			(void) t_kclose(tiptr, 1);
2029 			RPCLOG(1, "connmgr_get: couldn't bind, retryaddr: "
2030 				"%p\n", (void *)retryaddr);
2031 
2032 			/*
2033 			 * 1225408: If we allocated a source address, then it
2034 			 * is either garbage or all zeroes. In that case
2035 			 * we need to clear srcaddr.
2036 			 */
2037 			if (alloc_src == TRUE) {
2038 				kmem_free(srcaddr->buf, srcaddr->maxlen);
2039 				srcaddr->maxlen = srcaddr->len = 0;
2040 				srcaddr->buf = NULL;
2041 			}
2042 			rpcerr->re_errno = i;
2043 			connmgr_cancelconn(cm_entry);
2044 			return (NULL);
2045 		}
2046 	} else {
2047 		if ((i = t_kbind(tiptr, NULL, NULL)) != 0) {
2048 			RPCLOG(1, "clnt_cots_kcreate: t_kbind: %d\n", i);
2049 			(void) t_kclose(tiptr, 1);
2050 			rpcerr->re_errno = i;
2051 			connmgr_cancelconn(cm_entry);
2052 			return (NULL);
2053 		}
2054 	}
2055 
2056 	{
2057 		/*
2058 		 * Keep the kernel stack lean. Don't move this call
2059 		 * declaration to the top of this function because a
2060 		 * call is declared in connmgr_wrapconnect()
2061 		 */
2062 		calllist_t call;
2063 
2064 		bzero(&call, sizeof (call));
2065 		cv_init(&call.call_cv, NULL, CV_DEFAULT, NULL);
2066 
2067 		/*
2068 		 * This is a bound end-point so don't close it's stream.
2069 		 */
2070 		connected = connmgr_connect(cm_entry, wq, destaddr, addrfmly,
2071 						&call, &tidu_size, FALSE, waitp,
2072 						nosignal);
2073 		*rpcerr = call.call_err;
2074 		cv_destroy(&call.call_cv);
2075 
2076 	}
2077 
2078 	mutex_enter(&connmgr_lock);
2079 
2080 	/*
2081 	 * Set up a transport entry in the connection manager's list.
2082 	 */
2083 	cm_entry->x_src.buf = kmem_zalloc(srcaddr->len, KM_SLEEP);
2084 	bcopy(srcaddr->buf, cm_entry->x_src.buf, srcaddr->len);
2085 	cm_entry->x_src.len = cm_entry->x_src.maxlen = srcaddr->len;
2086 
2087 	cm_entry->x_tiptr = tiptr;
2088 	cm_entry->x_time = lbolt;
2089 
2090 	if (tiptr->tp_info.servtype == T_COTS_ORD)
2091 		cm_entry->x_ordrel = TRUE;
2092 	else
2093 		cm_entry->x_ordrel = FALSE;
2094 
2095 	cm_entry->x_tidu_size = tidu_size;
2096 
2097 	if (cm_entry->x_early_disc)
2098 		cm_entry->x_connected = FALSE;
2099 	else
2100 		cm_entry->x_connected = connected;
2101 
2102 	/*
2103 	 * There could be a discrepancy here such that
2104 	 * x_early_disc is TRUE yet connected is TRUE as well
2105 	 * and the connection is actually connected. In that case
2106 	 * lets be conservative and declare the connection as not
2107 	 * connected.
2108 	 */
2109 	cm_entry->x_early_disc = FALSE;
2110 	cm_entry->x_needdis = (cm_entry->x_connected == FALSE);
2111 	cm_entry->x_ctime = lbolt;
2112 
2113 	/*
2114 	 * Notify any threads waiting that the connection attempt is done.
2115 	 */
2116 	cm_entry->x_thread = FALSE;
2117 	cv_broadcast(&cm_entry->x_conn_cv);
2118 
2119 	mutex_exit(&connmgr_lock);
2120 
2121 	if (cm_entry->x_connected == FALSE) {
2122 		connmgr_release(cm_entry);
2123 		return (NULL);
2124 	}
2125 	return (cm_entry);
2126 }
2127 
2128 /*
2129  * Keep the cm_xprt entry on the connecton list when making a connection. This
2130  * is to prevent multiple connections to a slow server from appearing.
2131  * We use the bit field x_thread to tell if a thread is doing a connection
2132  * which keeps other interested threads from messing with connection.
2133  * Those other threads just wait if x_thread is set.
2134  *
2135  * If x_thread is not set, then we do the actual work of connecting via
2136  * connmgr_connect().
2137  *
2138  * mutex convention: called with connmgr_lock held, returns with it released.
2139  */
2140 static struct cm_xprt *
2141 connmgr_wrapconnect(
2142 	struct cm_xprt	*cm_entry,
2143 	const struct timeval	*waitp,
2144 	struct netbuf	*destaddr,
2145 	int		addrfmly,
2146 	struct netbuf	*srcaddr,
2147 	struct rpc_err	*rpcerr,
2148 	bool_t		reconnect,
2149 	bool_t		nosignal)
2150 {
2151 	ASSERT(MUTEX_HELD(&connmgr_lock));
2152 	/*
2153 	 * Hold this entry as we are about to drop connmgr_lock.
2154 	 */
2155 	CONN_HOLD(cm_entry);
2156 
2157 	/*
2158 	 * If there is a thread already making a connection for us, then
2159 	 * wait for it to complete the connection.
2160 	 */
2161 	if (cm_entry->x_thread == TRUE) {
2162 		rpcerr->re_status = connmgr_cwait(cm_entry, waitp, nosignal);
2163 
2164 		if (rpcerr->re_status != RPC_SUCCESS) {
2165 			mutex_exit(&connmgr_lock);
2166 			connmgr_release(cm_entry);
2167 			return (NULL);
2168 		}
2169 	} else {
2170 		bool_t connected;
2171 		calllist_t call;
2172 
2173 		cm_entry->x_thread = TRUE;
2174 
2175 		while (cm_entry->x_needrel == TRUE) {
2176 			cm_entry->x_needrel = FALSE;
2177 
2178 			connmgr_sndrel(cm_entry);
2179 			delay(drv_usectohz(1000000));
2180 
2181 			mutex_enter(&connmgr_lock);
2182 		}
2183 
2184 		/*
2185 		 * If we need to send a T_DISCON_REQ, send one.
2186 		 */
2187 		connmgr_dis_and_wait(cm_entry);
2188 
2189 		mutex_exit(&connmgr_lock);
2190 
2191 		bzero(&call, sizeof (call));
2192 		cv_init(&call.call_cv, NULL, CV_DEFAULT, NULL);
2193 
2194 		connected = connmgr_connect(cm_entry, cm_entry->x_wq,
2195 					    destaddr, addrfmly, &call,
2196 					    &cm_entry->x_tidu_size,
2197 					    reconnect, waitp, nosignal);
2198 
2199 		*rpcerr = call.call_err;
2200 		cv_destroy(&call.call_cv);
2201 
2202 		mutex_enter(&connmgr_lock);
2203 
2204 
2205 		if (cm_entry->x_early_disc)
2206 			cm_entry->x_connected = FALSE;
2207 		else
2208 			cm_entry->x_connected = connected;
2209 
2210 		/*
2211 		 * There could be a discrepancy here such that
2212 		 * x_early_disc is TRUE yet connected is TRUE as well
2213 		 * and the connection is actually connected. In that case
2214 		 * lets be conservative and declare the connection as not
2215 		 * connected.
2216 		 */
2217 
2218 		cm_entry->x_early_disc = FALSE;
2219 		cm_entry->x_needdis = (cm_entry->x_connected == FALSE);
2220 
2221 
2222 		/*
2223 		 * connmgr_connect() may have given up before the connection
2224 		 * actually timed out. So ensure that before the next
2225 		 * connection attempt we do a disconnect.
2226 		 */
2227 		cm_entry->x_ctime = lbolt;
2228 		cm_entry->x_thread = FALSE;
2229 
2230 		cv_broadcast(&cm_entry->x_conn_cv);
2231 
2232 		if (cm_entry->x_connected == FALSE) {
2233 			mutex_exit(&connmgr_lock);
2234 			connmgr_release(cm_entry);
2235 			return (NULL);
2236 		}
2237 	}
2238 
2239 	if (srcaddr != NULL) {
2240 		/*
2241 		 * Copy into the handle the
2242 		 * source address of the
2243 		 * connection, which we will use
2244 		 * in case of a later retry.
2245 		 */
2246 		if (srcaddr->len != cm_entry->x_src.len) {
2247 			if (srcaddr->maxlen > 0)
2248 				kmem_free(srcaddr->buf, srcaddr->maxlen);
2249 			srcaddr->buf = kmem_zalloc(cm_entry->x_src.len,
2250 			    KM_SLEEP);
2251 			srcaddr->maxlen = srcaddr->len =
2252 			    cm_entry->x_src.len;
2253 		}
2254 		bcopy(cm_entry->x_src.buf, srcaddr->buf, srcaddr->len);
2255 	}
2256 	cm_entry->x_time = lbolt;
2257 	mutex_exit(&connmgr_lock);
2258 	return (cm_entry);
2259 }
2260 
2261 /*
2262  * If we need to send a T_DISCON_REQ, send one.
2263  */
2264 static void
2265 connmgr_dis_and_wait(struct cm_xprt *cm_entry)
2266 {
2267 	ASSERT(MUTEX_HELD(&connmgr_lock));
2268 	for (;;) {
2269 		while (cm_entry->x_needdis == TRUE) {
2270 			RPCLOG(8, "connmgr_dis_and_wait: need "
2271 				"T_DISCON_REQ for connection 0x%p\n",
2272 				(void *)cm_entry);
2273 			cm_entry->x_needdis = FALSE;
2274 			cm_entry->x_waitdis = TRUE;
2275 
2276 			connmgr_snddis(cm_entry);
2277 
2278 			mutex_enter(&connmgr_lock);
2279 		}
2280 
2281 		if (cm_entry->x_waitdis == TRUE) {
2282 			clock_t curlbolt;
2283 			clock_t timout;
2284 
2285 			RPCLOG(8, "connmgr_dis_and_wait waiting for "
2286 				"T_DISCON_REQ's ACK for connection %p\n",
2287 				(void *)cm_entry);
2288 			curlbolt = ddi_get_lbolt();
2289 
2290 			timout = clnt_cots_min_conntout *
2291 				drv_usectohz(1000000) + curlbolt;
2292 
2293 			/*
2294 			 * The TPI spec says that the T_DISCON_REQ
2295 			 * will get acknowledged, but in practice
2296 			 * the ACK may never get sent. So don't
2297 			 * block forever.
2298 			 */
2299 			(void) cv_timedwait(&cm_entry->x_dis_cv,
2300 					    &connmgr_lock, timout);
2301 		}
2302 		/*
2303 		 * If we got the ACK, break. If we didn't,
2304 		 * then send another T_DISCON_REQ.
2305 		 */
2306 		if (cm_entry->x_waitdis == FALSE) {
2307 			break;
2308 		} else {
2309 			RPCLOG(8, "connmgr_dis_and_wait: did"
2310 				"not get T_DISCON_REQ's ACK for "
2311 				"connection  %p\n", (void *)cm_entry);
2312 			cm_entry->x_needdis = TRUE;
2313 		}
2314 	}
2315 }
2316 
2317 static void
2318 connmgr_cancelconn(struct cm_xprt *cm_entry)
2319 {
2320 	/*
2321 	 * Mark the connection table entry as dead; the next thread that
2322 	 * goes through connmgr_release() will notice this and deal with it.
2323 	 */
2324 	mutex_enter(&connmgr_lock);
2325 	cm_entry->x_dead = TRUE;
2326 
2327 	/*
2328 	 * Notify any threads waiting for the connection that it isn't
2329 	 * going to happen.
2330 	 */
2331 	cm_entry->x_thread = FALSE;
2332 	cv_broadcast(&cm_entry->x_conn_cv);
2333 	mutex_exit(&connmgr_lock);
2334 
2335 	connmgr_release(cm_entry);
2336 }
2337 
2338 static void
2339 connmgr_close(struct cm_xprt *cm_entry)
2340 {
2341 	mutex_enter(&cm_entry->x_lock);
2342 	while (cm_entry->x_ref != 0) {
2343 		/*
2344 		 * Must be a noninterruptible wait.
2345 		 */
2346 		cv_wait(&cm_entry->x_cv, &cm_entry->x_lock);
2347 	}
2348 
2349 	if (cm_entry->x_tiptr != NULL)
2350 		(void) t_kclose(cm_entry->x_tiptr, 1);
2351 
2352 	mutex_exit(&cm_entry->x_lock);
2353 	if (cm_entry->x_ksp != NULL) {
2354 		mutex_enter(&connmgr_lock);
2355 		cm_entry->x_ksp->ks_private = NULL;
2356 		mutex_exit(&connmgr_lock);
2357 
2358 		/*
2359 		 * Must free the buffer we allocated for the
2360 		 * server address in the update function
2361 		 */
2362 		if (((struct cm_kstat_xprt *)(cm_entry->x_ksp->ks_data))->
2363 		    x_server.value.str.addr.ptr != NULL)
2364 			kmem_free(((struct cm_kstat_xprt *)(cm_entry->x_ksp->
2365 			    ks_data))->x_server.value.str.addr.ptr,
2366 				    INET6_ADDRSTRLEN);
2367 		kmem_free(cm_entry->x_ksp->ks_data,
2368 			    cm_entry->x_ksp->ks_data_size);
2369 		kstat_delete(cm_entry->x_ksp);
2370 	}
2371 
2372 	mutex_destroy(&cm_entry->x_lock);
2373 	cv_destroy(&cm_entry->x_cv);
2374 	cv_destroy(&cm_entry->x_conn_cv);
2375 	cv_destroy(&cm_entry->x_dis_cv);
2376 
2377 	if (cm_entry->x_server.buf != NULL)
2378 		kmem_free(cm_entry->x_server.buf, cm_entry->x_server.maxlen);
2379 	if (cm_entry->x_src.buf != NULL)
2380 		kmem_free(cm_entry->x_src.buf, cm_entry->x_src.maxlen);
2381 	kmem_free(cm_entry, sizeof (struct cm_xprt));
2382 }
2383 
2384 /*
2385  * Called by KRPC after sending the call message to release the connection
2386  * it was using.
2387  */
2388 static void
2389 connmgr_release(struct cm_xprt *cm_entry)
2390 {
2391 	mutex_enter(&cm_entry->x_lock);
2392 	cm_entry->x_ref--;
2393 	if (cm_entry->x_ref == 0)
2394 		cv_signal(&cm_entry->x_cv);
2395 	mutex_exit(&cm_entry->x_lock);
2396 }
2397 
2398 /*
2399  * Given an open stream, connect to the remote.  Returns true if connected,
2400  * false otherwise.
2401  */
2402 static bool_t
2403 connmgr_connect(
2404 	struct cm_xprt		*cm_entry,
2405 	queue_t			*wq,
2406 	struct netbuf		*addr,
2407 	int			addrfmly,
2408 	calllist_t 		*e,
2409 	int 			*tidu_ptr,
2410 	bool_t 			reconnect,
2411 	const struct timeval 	*waitp,
2412 	bool_t 			nosignal)
2413 {
2414 	mblk_t *mp;
2415 	struct T_conn_req *tcr;
2416 	struct T_info_ack *tinfo;
2417 	int interrupted, error;
2418 	int tidu_size, kstat_instance;
2419 
2420 	/* if it's a reconnect, flush any lingering data messages */
2421 	if (reconnect)
2422 		(void) putctl1(wq, M_FLUSH, FLUSHRW);
2423 
2424 	mp = allocb(sizeof (*tcr) + addr->len, BPRI_LO);
2425 	if (mp == NULL) {
2426 		/*
2427 		 * This is unfortunate, but we need to look up the stats for
2428 		 * this zone to increment the "memory allocation failed"
2429 		 * counter.  curproc->p_zone is safe since we're initiating a
2430 		 * connection and not in some strange streams context.
2431 		 */
2432 		struct rpcstat *rpcstat;
2433 
2434 		rpcstat = zone_getspecific(rpcstat_zone_key, curproc->p_zone);
2435 		ASSERT(rpcstat != NULL);
2436 
2437 		RPCLOG0(1, "connmgr_connect: cannot alloc mp for "
2438 		    "sending conn request\n");
2439 		COTSRCSTAT_INCR(rpcstat->rpc_cots_client, rcnomem);
2440 		e->call_status = RPC_SYSTEMERROR;
2441 		e->call_reason = ENOSR;
2442 		return (FALSE);
2443 	}
2444 
2445 	mp->b_datap->db_type = M_PROTO;
2446 	tcr = (struct T_conn_req *)mp->b_rptr;
2447 	bzero(tcr, sizeof (*tcr));
2448 	tcr->PRIM_type = T_CONN_REQ;
2449 	tcr->DEST_length = addr->len;
2450 	tcr->DEST_offset = sizeof (struct T_conn_req);
2451 	mp->b_wptr = mp->b_rptr + sizeof (*tcr);
2452 
2453 	bcopy(addr->buf, mp->b_wptr, tcr->DEST_length);
2454 	mp->b_wptr += tcr->DEST_length;
2455 
2456 	RPCLOG(8, "connmgr_connect: sending conn request on queue "
2457 	    "%p", (void *)wq);
2458 	RPCLOG(8, " call %p\n", (void *)wq);
2459 	/*
2460 	 * We use the entry in the handle that is normally used for
2461 	 * waiting for RPC replies to wait for the connection accept.
2462 	 */
2463 	clnt_dispatch_send(wq, mp, e, 0, 0);
2464 
2465 	mutex_enter(&clnt_pending_lock);
2466 
2467 	/*
2468 	 * We wait for the transport connection to be made, or an
2469 	 * indication that it could not be made.
2470 	 */
2471 	interrupted = 0;
2472 
2473 	/*
2474 	 * waitforack should have been called with T_OK_ACK, but the
2475 	 * present implementation needs to be passed T_INFO_ACK to
2476 	 * work correctly.
2477 	 */
2478 	error = waitforack(e, T_INFO_ACK, waitp, nosignal);
2479 	if (error == EINTR)
2480 		interrupted = 1;
2481 	if (zone_status_get(curproc->p_zone) >= ZONE_IS_EMPTY) {
2482 		/*
2483 		 * No time to lose; we essentially have been signaled to
2484 		 * quit.
2485 		 */
2486 		interrupted = 1;
2487 	}
2488 #ifdef RPCDEBUG
2489 	if (error == ETIME)
2490 		RPCLOG0(8, "connmgr_connect: giving up "
2491 		    "on connection attempt; "
2492 		    "clnt_dispatch notifyconn "
2493 		    "diagnostic 'no one waiting for "
2494 		    "connection' should not be "
2495 		    "unexpected\n");
2496 #endif
2497 	if (e->call_prev)
2498 		e->call_prev->call_next = e->call_next;
2499 	else
2500 		clnt_pending = e->call_next;
2501 	if (e->call_next)
2502 		e->call_next->call_prev = e->call_prev;
2503 	mutex_exit(&clnt_pending_lock);
2504 
2505 	if (e->call_status != RPC_SUCCESS || error != 0) {
2506 		if (interrupted)
2507 			e->call_status = RPC_INTR;
2508 		else if (error == ETIME)
2509 			e->call_status = RPC_TIMEDOUT;
2510 		else if (error == EPROTO)
2511 			e->call_status = RPC_SYSTEMERROR;
2512 
2513 		RPCLOG(8, "connmgr_connect: can't connect, status: "
2514 		    "%s\n", clnt_sperrno(e->call_status));
2515 
2516 		if (e->call_reply) {
2517 			freemsg(e->call_reply);
2518 			e->call_reply = NULL;
2519 		}
2520 
2521 		return (FALSE);
2522 	}
2523 	/*
2524 	 * The result of the "connection accept" is a T_info_ack
2525 	 * in the call_reply field.
2526 	 */
2527 	ASSERT(e->call_reply != NULL);
2528 	mp = e->call_reply;
2529 	e->call_reply = NULL;
2530 	tinfo = (struct T_info_ack *)mp->b_rptr;
2531 
2532 	tidu_size = tinfo->TIDU_size;
2533 	tidu_size -= (tidu_size % BYTES_PER_XDR_UNIT);
2534 	if (tidu_size > COTS_DEFAULT_ALLOCSIZE || (tidu_size <= 0))
2535 		tidu_size = COTS_DEFAULT_ALLOCSIZE;
2536 	*tidu_ptr = tidu_size;
2537 
2538 	freemsg(mp);
2539 
2540 	/*
2541 	 * Set up the pertinent options.  NODELAY is so the transport doesn't
2542 	 * buffer up RPC messages on either end.  This may not be valid for
2543 	 * all transports.  Failure to set this option is not cause to
2544 	 * bail out so we return success anyway.  Note that lack of NODELAY
2545 	 * or some other way to flush the message on both ends will cause
2546 	 * lots of retries and terrible performance.
2547 	 */
2548 	if (addrfmly == AF_INET || addrfmly == AF_INET6) {
2549 		(void) connmgr_setopt(wq, IPPROTO_TCP, TCP_NODELAY, e);
2550 		if (e->call_status == RPC_XPRTFAILED)
2551 			return (FALSE);
2552 	}
2553 
2554 	/*
2555 	 * Since we have a connection, we now need to figure out if
2556 	 * we need to create a kstat. If x_ksp is not NULL then we
2557 	 * are reusing a connection and so we do not need to create
2558 	 * another kstat -- lets just return.
2559 	 */
2560 	if (cm_entry->x_ksp != NULL)
2561 		return (TRUE);
2562 
2563 	/*
2564 	 * We need to increment rpc_kstat_instance atomically to prevent
2565 	 * two kstats being created with the same instance.
2566 	 */
2567 	kstat_instance = atomic_add_32_nv((uint32_t *)&rpc_kstat_instance, 1);
2568 
2569 	if ((cm_entry->x_ksp = kstat_create_zone("unix", kstat_instance,
2570 	    "rpc_cots_connections", "rpc", KSTAT_TYPE_NAMED,
2571 	    (uint_t)(sizeof (cm_kstat_xprt_t) / sizeof (kstat_named_t)),
2572 	    KSTAT_FLAG_VIRTUAL, cm_entry->x_zoneid)) == NULL) {
2573 		return (TRUE);
2574 	    }
2575 
2576 	cm_entry->x_ksp->ks_lock = &connmgr_lock;
2577 	cm_entry->x_ksp->ks_private = cm_entry;
2578 	cm_entry->x_ksp->ks_data_size = ((INET6_ADDRSTRLEN * sizeof (char))
2579 					    + sizeof (cm_kstat_template));
2580 	cm_entry->x_ksp->ks_data = kmem_alloc(cm_entry->x_ksp->ks_data_size,
2581 					    KM_SLEEP);
2582 	bcopy(&cm_kstat_template, cm_entry->x_ksp->ks_data,
2583 	    cm_entry->x_ksp->ks_data_size);
2584 	((struct cm_kstat_xprt *)(cm_entry->x_ksp->ks_data))->
2585 		    x_server.value.str.addr.ptr =
2586 		    kmem_alloc(INET6_ADDRSTRLEN, KM_SLEEP);
2587 
2588 	cm_entry->x_ksp->ks_update = conn_kstat_update;
2589 	kstat_install(cm_entry->x_ksp);
2590 	return (TRUE);
2591 }
2592 
2593 /*
2594  * Called by connmgr_connect to set an option on the new stream.
2595  */
2596 static bool_t
2597 connmgr_setopt(queue_t *wq, int level, int name, calllist_t *e)
2598 {
2599 	mblk_t *mp;
2600 	struct opthdr *opt;
2601 	struct T_optmgmt_req *tor;
2602 	struct timeval waitp;
2603 	int error;
2604 
2605 	mp = allocb(sizeof (struct T_optmgmt_req) + sizeof (struct opthdr) +
2606 	    sizeof (int), BPRI_LO);
2607 	if (mp == NULL) {
2608 		RPCLOG0(1, "connmgr_setopt: cannot alloc mp for option "
2609 		    "request\n");
2610 		return (FALSE);
2611 	}
2612 
2613 	mp->b_datap->db_type = M_PROTO;
2614 	tor = (struct T_optmgmt_req *)(mp->b_rptr);
2615 	tor->PRIM_type = T_SVR4_OPTMGMT_REQ;
2616 	tor->MGMT_flags = T_NEGOTIATE;
2617 	tor->OPT_length = sizeof (struct opthdr) + sizeof (int);
2618 	tor->OPT_offset = sizeof (struct T_optmgmt_req);
2619 
2620 	opt = (struct opthdr *)(mp->b_rptr + sizeof (struct T_optmgmt_req));
2621 	opt->level = level;
2622 	opt->name = name;
2623 	opt->len = sizeof (int);
2624 	*(int *)((char *)opt + sizeof (*opt)) = 1;
2625 	mp->b_wptr += sizeof (struct T_optmgmt_req) + sizeof (struct opthdr) +
2626 	    sizeof (int);
2627 
2628 	/*
2629 	 * We will use this connection regardless
2630 	 * of whether or not the option is settable.
2631 	 */
2632 	clnt_dispatch_send(wq, mp, e, 0, 0);
2633 	mutex_enter(&clnt_pending_lock);
2634 
2635 	waitp.tv_sec = clnt_cots_min_conntout;
2636 	waitp.tv_usec = 0;
2637 	error = waitforack(e, T_OPTMGMT_ACK, &waitp, 1);
2638 
2639 	if (e->call_prev)
2640 		e->call_prev->call_next = e->call_next;
2641 	else
2642 		clnt_pending = e->call_next;
2643 	if (e->call_next)
2644 		e->call_next->call_prev = e->call_prev;
2645 	mutex_exit(&clnt_pending_lock);
2646 
2647 	if (e->call_reply != NULL) {
2648 		freemsg(e->call_reply);
2649 		e->call_reply = NULL;
2650 	}
2651 
2652 	if (e->call_status != RPC_SUCCESS || error != 0) {
2653 		RPCLOG(1, "connmgr_setopt: can't set option: %d\n", name);
2654 		return (FALSE);
2655 	}
2656 	RPCLOG(8, "connmgr_setopt: successfully set option: %d\n", name);
2657 	return (TRUE);
2658 }
2659 
2660 #ifdef	DEBUG
2661 
2662 /*
2663  * This is a knob to let us force code coverage in allocation failure
2664  * case.
2665  */
2666 static int	connmgr_failsnd;
2667 #define	CONN_SND_ALLOC(Size, Pri)	\
2668 	((connmgr_failsnd-- > 0) ? NULL : allocb(Size, Pri))
2669 
2670 #else
2671 
2672 #define	CONN_SND_ALLOC(Size, Pri)	allocb(Size, Pri)
2673 
2674 #endif
2675 
2676 /*
2677  * Sends an orderly release on the specified queue.
2678  * Entered with connmgr_lock. Exited without connmgr_lock
2679  */
2680 static void
2681 connmgr_sndrel(struct cm_xprt *cm_entry)
2682 {
2683 	struct T_ordrel_req *torr;
2684 	mblk_t *mp;
2685 	queue_t *q = cm_entry->x_wq;
2686 	ASSERT(MUTEX_HELD(&connmgr_lock));
2687 	mp = CONN_SND_ALLOC(sizeof (struct T_ordrel_req), BPRI_LO);
2688 	if (mp == NULL) {
2689 		cm_entry->x_needrel = TRUE;
2690 		mutex_exit(&connmgr_lock);
2691 		RPCLOG(1, "connmgr_sndrel: cannot alloc mp for sending ordrel "
2692 			"to queue %p\n", (void *)q);
2693 		return;
2694 	}
2695 	mutex_exit(&connmgr_lock);
2696 
2697 	mp->b_datap->db_type = M_PROTO;
2698 	torr = (struct T_ordrel_req *)(mp->b_rptr);
2699 	torr->PRIM_type = T_ORDREL_REQ;
2700 	mp->b_wptr = mp->b_rptr + sizeof (struct T_ordrel_req);
2701 
2702 	RPCLOG(8, "connmgr_sndrel: sending ordrel to queue %p\n", (void *)q);
2703 	put(q, mp);
2704 }
2705 
2706 /*
2707  * Sends an disconnect on the specified queue.
2708  * Entered with connmgr_lock. Exited without connmgr_lock
2709  */
2710 static void
2711 connmgr_snddis(struct cm_xprt *cm_entry)
2712 {
2713 	struct T_discon_req *tdis;
2714 	mblk_t *mp;
2715 	queue_t *q = cm_entry->x_wq;
2716 
2717 	ASSERT(MUTEX_HELD(&connmgr_lock));
2718 	mp = CONN_SND_ALLOC(sizeof (*tdis), BPRI_LO);
2719 	if (mp == NULL) {
2720 		cm_entry->x_needdis = TRUE;
2721 		mutex_exit(&connmgr_lock);
2722 		RPCLOG(1, "connmgr_snddis: cannot alloc mp for sending discon "
2723 		    "to queue %p\n", (void *)q);
2724 		return;
2725 	}
2726 	mutex_exit(&connmgr_lock);
2727 
2728 	mp->b_datap->db_type = M_PROTO;
2729 	tdis = (struct T_discon_req *)mp->b_rptr;
2730 	tdis->PRIM_type = T_DISCON_REQ;
2731 	mp->b_wptr = mp->b_rptr + sizeof (*tdis);
2732 
2733 	RPCLOG(8, "connmgr_snddis: sending discon to queue %p\n", (void *)q);
2734 	put(q, mp);
2735 }
2736 
2737 /*
2738  * Sets up the entry for receiving replies, and calls rpcmod's write put proc
2739  * (through put) to send the call.
2740  */
2741 static void
2742 clnt_dispatch_send(queue_t *q, mblk_t *mp, calllist_t *e, uint_t xid,
2743 			uint_t queue_flag)
2744 {
2745 	ASSERT(e != NULL);
2746 
2747 	e->call_status = RPC_TIMEDOUT;	/* optimistic, eh? */
2748 	e->call_reason = 0;
2749 	e->call_wq = q;
2750 	e->call_xid = xid;
2751 	e->call_notified = FALSE;
2752 
2753 	/*
2754 	 * If queue_flag is set then the calllist_t is already on the hash
2755 	 * queue.  In this case just send the message and return.
2756 	 */
2757 	if (queue_flag) {
2758 		put(q, mp);
2759 		return;
2760 	}
2761 
2762 	/*
2763 	 * Set up calls for RPC requests (with XID != 0) on the hash
2764 	 * queue for fast lookups and place other calls (i.e.
2765 	 * connection management) on the linked list.
2766 	 */
2767 	if (xid != 0) {
2768 		RPCLOG(64, "clnt_dispatch_send: putting xid 0x%x on "
2769 			"dispatch list\n", xid);
2770 		e->call_hash = call_hash(xid, clnt_cots_hash_size);
2771 		e->call_bucket = &cots_call_ht[e->call_hash];
2772 		call_table_enter(e);
2773 	} else {
2774 		mutex_enter(&clnt_pending_lock);
2775 		if (clnt_pending)
2776 			clnt_pending->call_prev = e;
2777 		e->call_next = clnt_pending;
2778 		e->call_prev = NULL;
2779 		clnt_pending = e;
2780 		mutex_exit(&clnt_pending_lock);
2781 	}
2782 
2783 	put(q, mp);
2784 }
2785 
2786 /*
2787  * Called by rpcmod to notify a client with a clnt_pending call that its reply
2788  * has arrived.  If we can't find a client waiting for this reply, we log
2789  * the error and return.
2790  */
2791 bool_t
2792 clnt_dispatch_notify(mblk_t *mp, zoneid_t zoneid)
2793 {
2794 	calllist_t *e = NULL;
2795 	call_table_t *chtp;
2796 	uint32_t xid;
2797 	uint_t hash;
2798 
2799 	if ((IS_P2ALIGNED(mp->b_rptr, sizeof (uint32_t))) &&
2800 	    (mp->b_wptr - mp->b_rptr) >= sizeof (xid))
2801 		xid = *((uint32_t *)mp->b_rptr);
2802 	else {
2803 		int i = 0;
2804 		unsigned char *p = (unsigned char *)&xid;
2805 		unsigned char *rptr;
2806 		mblk_t *tmp = mp;
2807 
2808 		/*
2809 		 * Copy the xid, byte-by-byte into xid.
2810 		 */
2811 		while (tmp) {
2812 			rptr = tmp->b_rptr;
2813 			while (rptr < tmp->b_wptr) {
2814 				*p++ = *rptr++;
2815 				if (++i >= sizeof (xid))
2816 					goto done_xid_copy;
2817 			}
2818 			tmp = tmp->b_cont;
2819 		}
2820 
2821 		/*
2822 		 * If we got here, we ran out of mblk space before the
2823 		 * xid could be copied.
2824 		 */
2825 		ASSERT(tmp == NULL && i < sizeof (xid));
2826 
2827 		RPCLOG0(1,
2828 		    "clnt_dispatch_notify: message less than size of xid\n");
2829 		return (FALSE);
2830 
2831 	}
2832 done_xid_copy:
2833 
2834 	hash = call_hash(xid, clnt_cots_hash_size);
2835 	chtp = &cots_call_ht[hash];
2836 	/* call_table_find returns with the hash bucket locked */
2837 	call_table_find(chtp, xid, e);
2838 
2839 	if (e != NULL) {
2840 		/*
2841 		 * Found thread waiting for this reply
2842 		 */
2843 		mutex_enter(&e->call_lock);
2844 		if (e->call_reply)
2845 			/*
2846 			 * This can happen under the following scenario:
2847 			 * clnt_cots_kcallit() times out on the response,
2848 			 * rfscall() repeats the CLNT_CALL() with
2849 			 * the same xid, clnt_cots_kcallit() sends the retry,
2850 			 * thereby putting the clnt handle on the pending list,
2851 			 * the first response arrives, signalling the thread
2852 			 * in clnt_cots_kcallit(). Before that thread is
2853 			 * dispatched, the second response arrives as well,
2854 			 * and clnt_dispatch_notify still finds the handle on
2855 			 * the pending list, with call_reply set. So free the
2856 			 * old reply now.
2857 			 *
2858 			 * It is also possible for a response intended for
2859 			 * an RPC call with a different xid to reside here.
2860 			 * This can happen if the thread that owned this
2861 			 * client handle prior to the current owner bailed
2862 			 * out and left its call record on the dispatch
2863 			 * queue.  A window exists where the response can
2864 			 * arrive before the current owner dispatches its
2865 			 * RPC call.
2866 			 *
2867 			 * In any case, this is the very last point where we
2868 			 * can safely check the call_reply field before
2869 			 * placing the new response there.
2870 			 */
2871 			freemsg(e->call_reply);
2872 		e->call_reply = mp;
2873 		e->call_status = RPC_SUCCESS;
2874 		e->call_notified = TRUE;
2875 		cv_signal(&e->call_cv);
2876 		mutex_exit(&e->call_lock);
2877 		mutex_exit(&chtp->ct_lock);
2878 		return (TRUE);
2879 	} else {
2880 		zone_t *zone;
2881 		struct rpcstat *rpcstat;
2882 
2883 		mutex_exit(&chtp->ct_lock);
2884 		RPCLOG(65, "clnt_dispatch_notify: no caller for reply 0x%x\n",
2885 		    xid);
2886 		/*
2887 		 * This is unfortunate, but we need to lookup the zone so we
2888 		 * can increment its "rcbadxids" counter.
2889 		 */
2890 		zone = zone_find_by_id(zoneid);
2891 		if (zone == NULL) {
2892 			/*
2893 			 * The zone went away...
2894 			 */
2895 			return (FALSE);
2896 		}
2897 		rpcstat = zone_getspecific(rpcstat_zone_key, zone);
2898 		if (zone_status_get(zone) >= ZONE_IS_SHUTTING_DOWN) {
2899 			/*
2900 			 * Not interested
2901 			 */
2902 			zone_rele(zone);
2903 			return (FALSE);
2904 		}
2905 		COTSRCSTAT_INCR(rpcstat->rpc_cots_client, rcbadxids);
2906 		zone_rele(zone);
2907 	}
2908 	return (FALSE);
2909 }
2910 
2911 /*
2912  * Called by rpcmod when a non-data indication arrives.  The ones in which we
2913  * are interested are connection indications and options acks.  We dispatch
2914  * based on the queue the indication came in on.  If we are not interested in
2915  * what came in, we return false to rpcmod, who will then pass it upstream.
2916  */
2917 bool_t
2918 clnt_dispatch_notifyconn(queue_t *q, mblk_t *mp)
2919 {
2920 	calllist_t *e;
2921 	int type;
2922 
2923 	ASSERT((q->q_flag & QREADR) == 0);
2924 
2925 	type = ((union T_primitives *)mp->b_rptr)->type;
2926 	RPCLOG(8, "clnt_dispatch_notifyconn: prim type: [%s]\n",
2927 	    rpc_tpiprim2name(type));
2928 	mutex_enter(&clnt_pending_lock);
2929 	for (e = clnt_pending; /* NO CONDITION */; e = e->call_next) {
2930 		if (e == NULL) {
2931 			mutex_exit(&clnt_pending_lock);
2932 			RPCLOG(1, "clnt_dispatch_notifyconn: no one waiting "
2933 			    "for connection on queue 0x%p\n", (void *)q);
2934 			return (FALSE);
2935 		}
2936 		if (e->call_wq == q)
2937 			break;
2938 	}
2939 
2940 	switch (type) {
2941 	case T_CONN_CON:
2942 		/*
2943 		 * The transport is now connected, send a T_INFO_REQ to get
2944 		 * the tidu size.
2945 		 */
2946 		mutex_exit(&clnt_pending_lock);
2947 		ASSERT(mp->b_datap->db_lim - mp->b_datap->db_base >=
2948 			sizeof (struct T_info_req));
2949 		mp->b_rptr = mp->b_datap->db_base;
2950 		((union T_primitives *)mp->b_rptr)->type = T_INFO_REQ;
2951 		mp->b_wptr = mp->b_rptr + sizeof (struct T_info_req);
2952 		mp->b_datap->db_type = M_PCPROTO;
2953 		put(q, mp);
2954 		return (TRUE);
2955 	case T_INFO_ACK:
2956 	case T_OPTMGMT_ACK:
2957 		e->call_status = RPC_SUCCESS;
2958 		e->call_reply = mp;
2959 		e->call_notified = TRUE;
2960 		cv_signal(&e->call_cv);
2961 		break;
2962 	case T_ERROR_ACK:
2963 		e->call_status = RPC_CANTCONNECT;
2964 		e->call_reply = mp;
2965 		e->call_notified = TRUE;
2966 		cv_signal(&e->call_cv);
2967 		break;
2968 	case T_OK_ACK:
2969 		/*
2970 		 * Great, but we are really waiting for a T_CONN_CON
2971 		 */
2972 		freemsg(mp);
2973 		break;
2974 	default:
2975 		mutex_exit(&clnt_pending_lock);
2976 		RPCLOG(1, "clnt_dispatch_notifyconn: bad type %d\n", type);
2977 		return (FALSE);
2978 	}
2979 
2980 	mutex_exit(&clnt_pending_lock);
2981 	return (TRUE);
2982 }
2983 
2984 /*
2985  * Called by rpcmod when the transport is (or should be) going away.  Informs
2986  * all callers waiting for replies and marks the entry in the connection
2987  * manager's list as unconnected, and either closing (close handshake in
2988  * progress) or dead.
2989  */
2990 void
2991 clnt_dispatch_notifyall(queue_t *q, int32_t msg_type, int32_t reason)
2992 {
2993 	calllist_t *e;
2994 	call_table_t *ctp;
2995 	struct cm_xprt *cm_entry;
2996 	int have_connmgr_lock;
2997 	int i;
2998 
2999 	ASSERT((q->q_flag & QREADR) == 0);
3000 
3001 	RPCLOG(1, "clnt_dispatch_notifyall on queue %p", (void *)q);
3002 	RPCLOG(1, " received a notifcation prim type [%s]",
3003 	    rpc_tpiprim2name(msg_type));
3004 	RPCLOG(1, " and reason %d\n", reason);
3005 
3006 	/*
3007 	 * Find the transport entry in the connection manager's list, close
3008 	 * the transport and delete the entry.  In the case where rpcmod's
3009 	 * idle timer goes off, it sends us a T_ORDREL_REQ, indicating we
3010 	 * should gracefully close the connection.
3011 	 */
3012 	have_connmgr_lock = 1;
3013 	mutex_enter(&connmgr_lock);
3014 	for (cm_entry = cm_hd; cm_entry; cm_entry = cm_entry->x_next) {
3015 		ASSERT(cm_entry != cm_entry->x_next);
3016 		if (cm_entry->x_wq == q) {
3017 			ASSERT(MUTEX_HELD(&connmgr_lock));
3018 			ASSERT(have_connmgr_lock == 1);
3019 			switch (msg_type) {
3020 			case T_ORDREL_REQ:
3021 
3022 				if (cm_entry->x_dead) {
3023 					RPCLOG(1, "idle timeout on dead "
3024 					    "connection: %p\n",
3025 					    (void *)cm_entry);
3026 					if (clnt_stop_idle != NULL)
3027 						(*clnt_stop_idle)(q);
3028 					break;
3029 				}
3030 
3031 				/*
3032 				 * Only mark the connection as dead if it is
3033 				 * connected and idle.
3034 				 * An unconnected connection has probably
3035 				 * gone idle because the server is down,
3036 				 * and when it comes back up there will be
3037 				 * retries that need to use that connection.
3038 				 */
3039 				if (cm_entry->x_connected ||
3040 				    cm_entry->x_doomed) {
3041 				    if (cm_entry->x_ordrel) {
3042 					if (cm_entry->x_closing == TRUE) {
3043 					/*
3044 					 * The connection is obviously
3045 					 * wedged due to a bug or problem
3046 					 * with the transport. Mark it
3047 					 * as dead. Otherwise we can leak
3048 					 * connections.
3049 					 */
3050 					    cm_entry->x_dead = TRUE;
3051 					    mutex_exit(&connmgr_lock);
3052 					    have_connmgr_lock = 0;
3053 					    if (clnt_stop_idle != NULL)
3054 						(*clnt_stop_idle)(q);
3055 					    break;
3056 					}
3057 					cm_entry->x_closing = TRUE;
3058 					connmgr_sndrel(cm_entry);
3059 					have_connmgr_lock = 0;
3060 				    } else {
3061 					cm_entry->x_dead = TRUE;
3062 					mutex_exit(&connmgr_lock);
3063 					have_connmgr_lock = 0;
3064 					if (clnt_stop_idle != NULL)
3065 						(*clnt_stop_idle)(q);
3066 				    }
3067 				} else {
3068 					/*
3069 					 * We don't mark the connection
3070 					 * as dead, but we turn off the
3071 					 * idle timer.
3072 					 */
3073 					mutex_exit(&connmgr_lock);
3074 					have_connmgr_lock = 0;
3075 					if (clnt_stop_idle != NULL)
3076 						(*clnt_stop_idle)(q);
3077 					RPCLOG(1, "clnt_dispatch_notifyall:"
3078 					    " ignoring timeout from rpcmod"
3079 					    " (q %p) because we are not "
3080 					    " connected\n", (void *)q);
3081 				}
3082 				break;
3083 			case T_ORDREL_IND:
3084 				/*
3085 				 * If this entry is marked closing, then we are
3086 				 * completing a close handshake, and the
3087 				 * connection is dead.  Otherwise, the server is
3088 				 * trying to close. Since the server will not
3089 				 * be sending any more RPC replies, we abort
3090 				 * the connection, including flushing
3091 				 * any RPC requests that are in-transit.
3092 				 */
3093 				if (cm_entry->x_closing) {
3094 					cm_entry->x_dead = TRUE;
3095 					mutex_exit(&connmgr_lock);
3096 					have_connmgr_lock = 0;
3097 					if (clnt_stop_idle != NULL)
3098 						(*clnt_stop_idle)(q);
3099 				} else {
3100 					/*
3101 					 * if we're getting a disconnect
3102 					 * before we've finished our
3103 					 * connect attempt, mark it for
3104 					 * later processing
3105 					 */
3106 					if (cm_entry->x_thread)
3107 						cm_entry->x_early_disc = TRUE;
3108 					else
3109 						cm_entry->x_connected = FALSE;
3110 					cm_entry->x_waitdis = TRUE;
3111 					connmgr_snddis(cm_entry);
3112 					have_connmgr_lock = 0;
3113 				}
3114 				break;
3115 
3116 			case T_ERROR_ACK:
3117 			case T_OK_ACK:
3118 				cm_entry->x_waitdis = FALSE;
3119 				cv_signal(&cm_entry->x_dis_cv);
3120 				mutex_exit(&connmgr_lock);
3121 				return;
3122 
3123 			case T_DISCON_REQ:
3124 				if (cm_entry->x_thread)
3125 					cm_entry->x_early_disc = TRUE;
3126 				else
3127 					cm_entry->x_connected = FALSE;
3128 				cm_entry->x_waitdis = TRUE;
3129 
3130 				connmgr_snddis(cm_entry);
3131 				have_connmgr_lock = 0;
3132 				break;
3133 
3134 			case T_DISCON_IND:
3135 			default:
3136 				/*
3137 				 * if we're getting a disconnect before
3138 				 * we've finished our connect attempt,
3139 				 * mark it for later processing
3140 				 */
3141 				if (cm_entry->x_closing) {
3142 					cm_entry->x_dead = TRUE;
3143 					mutex_exit(&connmgr_lock);
3144 					have_connmgr_lock = 0;
3145 					if (clnt_stop_idle != NULL)
3146 						(*clnt_stop_idle)(q);
3147 				} else {
3148 					if (cm_entry->x_thread) {
3149 						cm_entry->x_early_disc = TRUE;
3150 					} else {
3151 						cm_entry->x_dead = TRUE;
3152 						cm_entry->x_connected = FALSE;
3153 					}
3154 				}
3155 				break;
3156 			}
3157 			break;
3158 		}
3159 	}
3160 
3161 	if (have_connmgr_lock)
3162 		mutex_exit(&connmgr_lock);
3163 
3164 	if (msg_type == T_ERROR_ACK || msg_type == T_OK_ACK) {
3165 		RPCLOG(1, "clnt_dispatch_notifyall: (wq %p) could not find "
3166 		    "connmgr entry for discon ack\n", (void *)q);
3167 		return;
3168 	}
3169 
3170 	/*
3171 	 * Then kick all the clnt_pending calls out of their wait.  There
3172 	 * should be no clnt_pending calls in the case of rpcmod's idle
3173 	 * timer firing.
3174 	 */
3175 	for (i = 0; i < clnt_cots_hash_size; i++) {
3176 		ctp = &cots_call_ht[i];
3177 		mutex_enter(&ctp->ct_lock);
3178 		for (e = ctp->ct_call_next;
3179 			e != (calllist_t *)ctp;
3180 			e = e->call_next) {
3181 			if (e->call_wq == q && e->call_notified == FALSE) {
3182 				RPCLOG(1,
3183 				"clnt_dispatch_notifyall for queue %p ",
3184 					(void *)q);
3185 				RPCLOG(1, "aborting clnt_pending call %p\n",
3186 					(void *)e);
3187 
3188 				if (msg_type == T_DISCON_IND)
3189 					e->call_reason = reason;
3190 				e->call_notified = TRUE;
3191 				e->call_status = RPC_XPRTFAILED;
3192 				cv_signal(&e->call_cv);
3193 			}
3194 		}
3195 		mutex_exit(&ctp->ct_lock);
3196 	}
3197 
3198 	mutex_enter(&clnt_pending_lock);
3199 	for (e = clnt_pending; e; e = e->call_next) {
3200 		/*
3201 		 * Only signal those RPC handles that haven't been
3202 		 * signalled yet. Otherwise we can get a bogus call_reason.
3203 		 * This can happen if thread A is making a call over a
3204 		 * connection. If the server is killed, it will cause
3205 		 * reset, and reason will default to EIO as a result of
3206 		 * a T_ORDREL_IND. Thread B then attempts to recreate
3207 		 * the connection but gets a T_DISCON_IND. If we set the
3208 		 * call_reason code for all threads, then if thread A
3209 		 * hasn't been dispatched yet, it will get the wrong
3210 		 * reason. The bogus call_reason can make it harder to
3211 		 * discriminate between calls that fail because the
3212 		 * connection attempt failed versus those where the call
3213 		 * may have been executed on the server.
3214 		 */
3215 		if (e->call_wq == q && e->call_notified == FALSE) {
3216 			RPCLOG(1, "clnt_dispatch_notifyall for queue %p ",
3217 			    (void *)q);
3218 			RPCLOG(1, " aborting clnt_pending call %p\n",
3219 			    (void *)e);
3220 
3221 			if (msg_type == T_DISCON_IND)
3222 				e->call_reason = reason;
3223 			e->call_notified = TRUE;
3224 			/*
3225 			 * Let the caller timeout, else he will retry
3226 			 * immediately.
3227 			 */
3228 			e->call_status = RPC_XPRTFAILED;
3229 
3230 			/*
3231 			 * We used to just signal those threads
3232 			 * waiting for a connection, (call_xid = 0).
3233 			 * That meant that threads waiting for a response
3234 			 * waited till their timeout expired. This
3235 			 * could be a long time if they've specified a
3236 			 * maximum timeout. (2^31 - 1). So we
3237 			 * Signal all threads now.
3238 			 */
3239 			cv_signal(&e->call_cv);
3240 		}
3241 	}
3242 	mutex_exit(&clnt_pending_lock);
3243 }
3244 
3245 
3246 /*ARGSUSED*/
3247 /*
3248  * after resuming a system that's been suspended for longer than the
3249  * NFS server's idle timeout (svc_idle_timeout for Solaris 2), rfscall()
3250  * generates "NFS server X not responding" and "NFS server X ok" messages;
3251  * here we reset inet connections to cause a re-connect and avoid those
3252  * NFS messages.  see 4045054
3253  */
3254 boolean_t
3255 connmgr_cpr_reset(void *arg, int code)
3256 {
3257 	struct cm_xprt *cxp;
3258 
3259 	if (code == CB_CODE_CPR_CHKPT)
3260 		return (B_TRUE);
3261 
3262 	if (mutex_tryenter(&connmgr_lock) == 0)
3263 		return (B_FALSE);
3264 	for (cxp = cm_hd; cxp; cxp = cxp->x_next) {
3265 		if ((cxp->x_family == AF_INET || cxp->x_family == AF_INET6) &&
3266 			cxp->x_connected == TRUE) {
3267 			if (cxp->x_thread)
3268 				cxp->x_early_disc = TRUE;
3269 			else
3270 				cxp->x_connected = FALSE;
3271 			cxp->x_needdis = TRUE;
3272 		}
3273 	}
3274 	mutex_exit(&connmgr_lock);
3275 	return (B_TRUE);
3276 }
3277 
3278 void
3279 clnt_cots_stats_init(zoneid_t zoneid, struct rpc_cots_client **statsp)
3280 {
3281 
3282 	*statsp = (struct rpc_cots_client *)rpcstat_zone_init_common(zoneid,
3283 	    "unix", "rpc_cots_client", (const kstat_named_t *)&cots_rcstat_tmpl,
3284 	    sizeof (cots_rcstat_tmpl));
3285 }
3286 
3287 void
3288 clnt_cots_stats_fini(zoneid_t zoneid, struct rpc_cots_client **statsp)
3289 {
3290 	rpcstat_zone_fini_common(zoneid, "unix", "rpc_cots_client");
3291 	kmem_free(*statsp, sizeof (cots_rcstat_tmpl));
3292 }
3293 
3294 void
3295 clnt_cots_init(void)
3296 {
3297 	mutex_init(&connmgr_lock, NULL, MUTEX_DEFAULT, NULL);
3298 	mutex_init(&clnt_pending_lock, NULL, MUTEX_DEFAULT, NULL);
3299 
3300 	if (clnt_cots_hash_size < DEFAULT_MIN_HASH_SIZE)
3301 		clnt_cots_hash_size = DEFAULT_MIN_HASH_SIZE;
3302 
3303 	cots_call_ht = call_table_init(clnt_cots_hash_size);
3304 	zone_key_create(&zone_cots_key, NULL, NULL, clnt_zone_destroy);
3305 }
3306 
3307 void
3308 clnt_cots_fini(void)
3309 {
3310 	(void) zone_key_delete(zone_cots_key);
3311 }
3312 
3313 /*
3314  * Wait for TPI ack, returns success only if expected ack is received
3315  * within timeout period.
3316  */
3317 
3318 static int
3319 waitforack(calllist_t *e, t_scalar_t ack_prim, const struct timeval *waitp,
3320     bool_t nosignal)
3321 {
3322 	union T_primitives *tpr;
3323 	clock_t timout;
3324 	int cv_stat = 1;
3325 
3326 	ASSERT(MUTEX_HELD(&clnt_pending_lock));
3327 	while (e->call_reply == NULL) {
3328 		if (waitp != NULL) {
3329 			timout = waitp->tv_sec * drv_usectohz(MICROSEC) +
3330 			    drv_usectohz(waitp->tv_usec) + lbolt;
3331 			if (nosignal)
3332 				cv_stat = cv_timedwait(&e->call_cv,
3333 				    &clnt_pending_lock, timout);
3334 			else
3335 				cv_stat = cv_timedwait_sig(&e->call_cv,
3336 				    &clnt_pending_lock, timout);
3337 		} else {
3338 			if (nosignal)
3339 				cv_wait(&e->call_cv, &clnt_pending_lock);
3340 			else
3341 				cv_stat = cv_wait_sig(&e->call_cv,
3342 				    &clnt_pending_lock);
3343 		}
3344 		if (cv_stat == -1)
3345 			return (ETIME);
3346 		if (cv_stat == 0)
3347 			return (EINTR);
3348 	}
3349 	tpr = (union T_primitives *)e->call_reply->b_rptr;
3350 	if (tpr->type == ack_prim)
3351 		return (0); /* Success */
3352 
3353 	if (tpr->type == T_ERROR_ACK) {
3354 		if (tpr->error_ack.TLI_error == TSYSERR)
3355 			return (tpr->error_ack.UNIX_error);
3356 		else
3357 			return (t_tlitosyserr(tpr->error_ack.TLI_error));
3358 	}
3359 
3360 	return (EPROTO); /* unknown or unexpected primitive */
3361 }
3362