1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  *  Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
  23  */
  24 
  25 /*      Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
  26 /*        All Rights Reserved   */
  27 
  28 /*
  29  * Copyright 2012 Nexenta Systems, Inc.  All rights reserved.
  30  */
  31 
  32 /*
  33  * Portions of this source code were derived from Berkeley 4.3 BSD
  34  * under license from the Regents of the University of California.
  35  */
  36 
  37 /*
  38  * svc_clts.c
  39  * Server side for RPC in the kernel.
  40  *
  41  */
  42 
  43 #include <sys/param.h>
  44 #include <sys/types.h>
  45 #include <sys/sysmacros.h>
  46 #include <sys/file.h>
  47 #include <sys/stream.h>
  48 #include <sys/strsun.h>
  49 #include <sys/strsubr.h>
  50 #include <sys/tihdr.h>
  51 #include <sys/tiuser.h>
  52 #include <sys/t_kuser.h>
  53 #include <sys/fcntl.h>
  54 #include <sys/errno.h>
  55 #include <sys/kmem.h>
  56 #include <sys/systm.h>
  57 #include <sys/cmn_err.h>
  58 #include <sys/kstat.h>
  59 #include <sys/vtrace.h>
  60 #include <sys/debug.h>
  61 
  62 #include <rpc/types.h>
  63 #include <rpc/xdr.h>
  64 #include <rpc/auth.h>
  65 #include <rpc/clnt.h>
  66 #include <rpc/rpc_msg.h>
  67 #include <rpc/svc.h>
  68 #include <inet/ip.h>
  69 
  70 /*
  71  * Routines exported through ops vector.
  72  */
  73 static bool_t           svc_clts_krecv(SVCXPRT *, mblk_t *, struct rpc_msg *);
  74 static bool_t           svc_clts_ksend(SVCXPRT *, struct rpc_msg *);
  75 static bool_t           svc_clts_kgetargs(SVCXPRT *, xdrproc_t, caddr_t);
  76 static bool_t           svc_clts_kfreeargs(SVCXPRT *, xdrproc_t, caddr_t);
  77 static void             svc_clts_kdestroy(SVCMASTERXPRT *);
  78 static int              svc_clts_kdup(struct svc_req *, caddr_t, int,
  79                                 struct dupreq **, bool_t *);
  80 static void             svc_clts_kdupdone(struct dupreq *, caddr_t,
  81                                 void (*)(), int, int);
  82 static int32_t          *svc_clts_kgetres(SVCXPRT *, int);
  83 static void             svc_clts_kclone_destroy(SVCXPRT *);
  84 static void             svc_clts_kfreeres(SVCXPRT *);
  85 static void             svc_clts_kstart(SVCMASTERXPRT *);
  86 static void             svc_clts_kclone_xprt(SVCXPRT *, SVCXPRT *);
  87 static void             svc_clts_ktattrs(SVCXPRT *, int, void **);
  88 
  89 /*
  90  * Server transport operations vector.
  91  */
  92 struct svc_ops svc_clts_op = {
  93         svc_clts_krecv,         /* Get requests */
  94         svc_clts_kgetargs,      /* Deserialize arguments */
  95         svc_clts_ksend,         /* Send reply */
  96         svc_clts_kfreeargs,     /* Free argument data space */
  97         svc_clts_kdestroy,      /* Destroy transport handle */
  98         svc_clts_kdup,          /* Check entry in dup req cache */
  99         svc_clts_kdupdone,      /* Mark entry in dup req cache as done */
 100         svc_clts_kgetres,       /* Get pointer to response buffer */
 101         svc_clts_kfreeres,      /* Destroy pre-serialized response header */
 102         svc_clts_kclone_destroy, /* Destroy a clone xprt */
 103         svc_clts_kstart,        /* Tell `ready-to-receive' to rpcmod */
 104         svc_clts_kclone_xprt,   /* transport specific clone xprt function */
 105         svc_clts_ktattrs        /* Transport specific attributes. */
 106 };
 107 
 108 /*
 109  * Transport private data.
 110  * Kept in xprt->xp_p2buf.
 111  */
 112 struct udp_data {
 113         mblk_t  *ud_resp;                       /* buffer for response */
 114         mblk_t  *ud_inmp;                       /* mblk chain of request */
 115         sin6_t  ud_local;                       /* local address */
 116 };
 117 
 118 #define UD_MAXSIZE      8800
 119 #define UD_INITSIZE     2048
 120 
 121 /*
 122  * Connectionless server statistics
 123  */
 124 static const struct rpc_clts_server {
 125         kstat_named_t   rscalls;
 126         kstat_named_t   rsbadcalls;
 127         kstat_named_t   rsnullrecv;
 128         kstat_named_t   rsbadlen;
 129         kstat_named_t   rsxdrcall;
 130         kstat_named_t   rsdupchecks;
 131         kstat_named_t   rsdupreqs;
 132 } clts_rsstat_tmpl = {
 133         { "calls",      KSTAT_DATA_UINT64 },
 134         { "badcalls",   KSTAT_DATA_UINT64 },
 135         { "nullrecv",   KSTAT_DATA_UINT64 },
 136         { "badlen",     KSTAT_DATA_UINT64 },
 137         { "xdrcall",    KSTAT_DATA_UINT64 },
 138         { "dupchecks",  KSTAT_DATA_UINT64 },
 139         { "dupreqs",    KSTAT_DATA_UINT64 }
 140 };
 141 
 142 static uint_t clts_rsstat_ndata =
 143         sizeof (clts_rsstat_tmpl) / sizeof (kstat_named_t);
 144 
 145 #define CLONE2STATS(clone_xprt) \
 146         (struct rpc_clts_server *)(clone_xprt)->xp_master->xp_p2
 147 
 148 #define RSSTAT_INCR(stats, x)   \
 149         atomic_add_64(&(stats)->x.value.ui64, 1)
 150 
 151 /*
 152  * Create a transport record.
 153  * The transport record, output buffer, and private data structure
 154  * are allocated.  The output buffer is serialized into using xdrmem.
 155  * There is one transport record per user process which implements a
 156  * set of services.
 157  */
 158 /* ARGSUSED */
 159 int
 160 svc_clts_kcreate(file_t *fp, uint_t sendsz, struct T_info_ack *tinfo,
 161     SVCMASTERXPRT **nxprt)
 162 {
 163         SVCMASTERXPRT *xprt;
 164         struct rpcstat *rpcstat;
 165 
 166         if (nxprt == NULL)
 167                 return (EINVAL);
 168 
 169         rpcstat = zone_getspecific(rpcstat_zone_key, curproc->p_zone);
 170         ASSERT(rpcstat != NULL);
 171 
 172         xprt = kmem_zalloc(sizeof (*xprt), KM_SLEEP);
 173         xprt->xp_lcladdr.buf = kmem_zalloc(sizeof (sin6_t), KM_SLEEP);
 174         xprt->xp_p2 = (caddr_t)rpcstat->rpc_clts_server;
 175         xprt->xp_ops = &svc_clts_op;
 176         xprt->xp_msg_size = tinfo->TSDU_size;
 177 
 178         xprt->xp_rtaddr.buf = NULL;
 179         xprt->xp_rtaddr.maxlen = tinfo->ADDR_size;
 180         xprt->xp_rtaddr.len = 0;
 181 
 182         *nxprt = xprt;
 183 
 184         return (0);
 185 }
 186 
 187 /*
 188  * Destroy a transport record.
 189  * Frees the space allocated for a transport record.
 190  */
 191 static void
 192 svc_clts_kdestroy(SVCMASTERXPRT *xprt)
 193 {
 194         if (xprt->xp_netid)
 195                 kmem_free(xprt->xp_netid, strlen(xprt->xp_netid) + 1);
 196         if (xprt->xp_addrmask.maxlen)
 197                 kmem_free(xprt->xp_addrmask.buf, xprt->xp_addrmask.maxlen);
 198 
 199         mutex_destroy(&xprt->xp_req_lock);
 200         mutex_destroy(&xprt->xp_thread_lock);
 201 
 202         kmem_free(xprt->xp_lcladdr.buf, sizeof (sin6_t));
 203         kmem_free(xprt, sizeof (SVCMASTERXPRT));
 204 }
 205 
 206 /*
 207  * Transport-type specific part of svc_xprt_cleanup().
 208  * Frees the message buffer space allocated for a clone of a transport record
 209  */
 210 static void
 211 svc_clts_kclone_destroy(SVCXPRT *clone_xprt)
 212 {
 213         /* LINTED pointer alignment */
 214         struct udp_data *ud = (struct udp_data *)clone_xprt->xp_p2buf;
 215 
 216         if (ud->ud_resp) {
 217                 /*
 218                  * There should not be any left over results buffer.
 219                  */
 220                 ASSERT(ud->ud_resp->b_cont == NULL);
 221 
 222                 /*
 223                  * Free the T_UNITDATA_{REQ/IND} that svc_clts_krecv
 224                  * saved.
 225                  */
 226                 freeb(ud->ud_resp);
 227         }
 228         if (ud->ud_inmp)
 229                 freemsg(ud->ud_inmp);
 230 }
 231 
 232 /*
 233  * svc_tli_kcreate() calls this function at the end to tell
 234  * rpcmod that the transport is ready to receive requests.
 235  */
 236 /* ARGSUSED */
 237 static void
 238 svc_clts_kstart(SVCMASTERXPRT *xprt)
 239 {
 240 }
 241 
 242 static void
 243 svc_clts_kclone_xprt(SVCXPRT *src_xprt, SVCXPRT *dst_xprt)
 244 {
 245         struct udp_data *ud_src =
 246             (struct udp_data *)src_xprt->xp_p2buf;
 247         struct udp_data *ud_dst =
 248             (struct udp_data *)dst_xprt->xp_p2buf;
 249 
 250         if (ud_src->ud_resp)
 251                 ud_dst->ud_resp = dupb(ud_src->ud_resp);
 252 
 253 }
 254 
 255 static void
 256 svc_clts_ktattrs(SVCXPRT *clone_xprt, int attrflag, void **tattr)
 257 {
 258         *tattr = NULL;
 259 
 260         switch (attrflag) {
 261         case SVC_TATTR_ADDRMASK:
 262                 *tattr = (void *)&clone_xprt->xp_master->xp_addrmask;
 263         }
 264 }
 265 
 266 /*
 267  * Receive rpc requests.
 268  * Pulls a request in off the socket, checks if the packet is intact,
 269  * and deserializes the call packet.
 270  */
 271 static bool_t
 272 svc_clts_krecv(SVCXPRT *clone_xprt, mblk_t *mp, struct rpc_msg *msg)
 273 {
 274         /* LINTED pointer alignment */
 275         struct udp_data *ud = (struct udp_data *)clone_xprt->xp_p2buf;
 276         XDR *xdrs = &clone_xprt->xp_xdrin;
 277         struct rpc_clts_server *stats = CLONE2STATS(clone_xprt);
 278         union T_primitives *pptr;
 279         int hdrsz;
 280         cred_t *cr;
 281 
 282         TRACE_0(TR_FAC_KRPC, TR_SVC_CLTS_KRECV_START,
 283             "svc_clts_krecv_start:");
 284 
 285         RSSTAT_INCR(stats, rscalls);
 286 
 287         /*
 288          * The incoming request should start with an M_PROTO message.
 289          */
 290         if (mp->b_datap->db_type != M_PROTO) {
 291                 goto bad;
 292         }
 293 
 294         /*
 295          * The incoming request should be an T_UNITDTA_IND.  There
 296          * might be other messages coming up the stream, but we can
 297          * ignore them.
 298          */
 299         pptr = (union T_primitives *)mp->b_rptr;
 300         if (pptr->type != T_UNITDATA_IND) {
 301                 goto bad;
 302         }
 303         /*
 304          * Do some checking to make sure that the header at least looks okay.
 305          */
 306         hdrsz = (int)(mp->b_wptr - mp->b_rptr);
 307         if (hdrsz < TUNITDATAINDSZ ||
 308             hdrsz < (pptr->unitdata_ind.OPT_offset +
 309             pptr->unitdata_ind.OPT_length) ||
 310             hdrsz < (pptr->unitdata_ind.SRC_offset +
 311             pptr->unitdata_ind.SRC_length)) {
 312                 goto bad;
 313         }
 314 
 315         /*
 316          * Make sure that the transport provided a usable address.
 317          */
 318         if (pptr->unitdata_ind.SRC_length <= 0) {
 319                 goto bad;
 320         }
 321         /*
 322          * Point the remote transport address in the service_transport
 323          * handle at the address in the request.
 324          */
 325         clone_xprt->xp_rtaddr.buf = (char *)mp->b_rptr +
 326             pptr->unitdata_ind.SRC_offset;
 327         clone_xprt->xp_rtaddr.len = pptr->unitdata_ind.SRC_length;
 328 
 329         clone_xprt->xp_lcladdr.buf = (char *)&ud->ud_local;
 330 
 331         /*
 332          * Copy the local transport address in the service_transport
 333          * handle at the address in the request. We will have only
 334          * the local IP address in options.
 335          */
 336         ((sin_t *)(clone_xprt->xp_lcladdr.buf))->sin_family = AF_UNSPEC;
 337         if (pptr->unitdata_ind.OPT_length && pptr->unitdata_ind.OPT_offset) {
 338                 char *dstopt = (char *)mp->b_rptr +
 339                     pptr->unitdata_ind.OPT_offset;
 340                 struct T_opthdr *toh = (struct T_opthdr *)dstopt;
 341 
 342                 if (toh->level == IPPROTO_IPV6 && toh->status == 0 &&
 343                     toh->name == IPV6_PKTINFO) {
 344                         struct in6_pktinfo *pkti;
 345 
 346                         dstopt += sizeof (struct T_opthdr);
 347                         pkti = (struct in6_pktinfo *)dstopt;
 348                         ((sin6_t *)(clone_xprt->xp_lcladdr.buf))->sin6_addr
 349                             = pkti->ipi6_addr;
 350                         ((sin6_t *)(clone_xprt->xp_lcladdr.buf))->sin6_family
 351                             = AF_INET6;
 352                 } else if (toh->level == IPPROTO_IP && toh->status == 0 &&
 353                     toh->name == IP_RECVDSTADDR) {
 354                         dstopt += sizeof (struct T_opthdr);
 355                         ((sin_t *)(clone_xprt->xp_lcladdr.buf))->sin_addr
 356                             = *(struct in_addr *)dstopt;
 357                         ((sin_t *)(clone_xprt->xp_lcladdr.buf))->sin_family
 358                             = AF_INET;
 359                 }
 360         }
 361 
 362         /*
 363          * Save the first mblk which contains the T_unidata_ind in
 364          * ud_resp.  It will be used to generate the T_unitdata_req
 365          * during the reply.
 366          * We reuse any options in the T_unitdata_ind for the T_unitdata_req
 367          * since we must pass any SCM_UCRED across in order for TX to
 368          * work. We also make sure any cred_t is carried across.
 369          */
 370         if (ud->ud_resp) {
 371                 if (ud->ud_resp->b_cont != NULL) {
 372                         cmn_err(CE_WARN, "svc_clts_krecv: ud_resp %p, "
 373                             "b_cont %p", (void *)ud->ud_resp,
 374                             (void *)ud->ud_resp->b_cont);
 375                 }
 376                 freeb(ud->ud_resp);
 377         }
 378         /* Move any cred_t to the first mblk in the message */
 379         cr = msg_getcred(mp, NULL);
 380         if (cr != NULL)
 381                 mblk_setcred(mp, cr, NOPID);
 382 
 383         ud->ud_resp = mp;
 384         mp = mp->b_cont;
 385         ud->ud_resp->b_cont = NULL;
 386 
 387         xdrmblk_init(xdrs, mp, XDR_DECODE, 0);
 388 
 389         TRACE_0(TR_FAC_KRPC, TR_XDR_CALLMSG_START,
 390             "xdr_callmsg_start:");
 391         if (! xdr_callmsg(xdrs, msg)) {
 392                 TRACE_1(TR_FAC_KRPC, TR_XDR_CALLMSG_END,
 393                     "xdr_callmsg_end:(%S)", "bad");
 394                 RSSTAT_INCR(stats, rsxdrcall);
 395                 goto bad;
 396         }
 397         TRACE_1(TR_FAC_KRPC, TR_XDR_CALLMSG_END,
 398             "xdr_callmsg_end:(%S)", "good");
 399 
 400         clone_xprt->xp_xid = msg->rm_xid;
 401         ud->ud_inmp = mp;
 402 
 403         TRACE_1(TR_FAC_KRPC, TR_SVC_CLTS_KRECV_END,
 404             "svc_clts_krecv_end:(%S)", "good");
 405         return (TRUE);
 406 
 407 bad:
 408         freemsg(mp);
 409         if (ud->ud_resp) {
 410                 /*
 411                  * There should not be any left over results buffer.
 412                  */
 413                 ASSERT(ud->ud_resp->b_cont == NULL);
 414                 freeb(ud->ud_resp);
 415                 ud->ud_resp = NULL;
 416         }
 417 
 418         RSSTAT_INCR(stats, rsbadcalls);
 419         TRACE_1(TR_FAC_KRPC, TR_SVC_CLTS_KRECV_END,
 420             "svc_clts_krecv_end:(%S)", "bad");
 421         return (FALSE);
 422 }
 423 
 424 /*
 425  * Send rpc reply.
 426  * Serialize the reply packet into the output buffer then
 427  * call t_ksndudata to send it.
 428  */
 429 static bool_t
 430 svc_clts_ksend(SVCXPRT *clone_xprt, struct rpc_msg *msg)
 431 {
 432         /* LINTED pointer alignment */
 433         struct udp_data *ud = (struct udp_data *)clone_xprt->xp_p2buf;
 434         XDR *xdrs = &clone_xprt->xp_xdrout;
 435         int stat = FALSE;
 436         mblk_t *mp;
 437         int msgsz;
 438         struct T_unitdata_req *udreq;
 439         xdrproc_t xdr_results;
 440         caddr_t xdr_location;
 441         bool_t has_args;
 442 
 443         TRACE_0(TR_FAC_KRPC, TR_SVC_CLTS_KSEND_START,
 444             "svc_clts_ksend_start:");
 445 
 446         ASSERT(ud->ud_resp != NULL);
 447 
 448         /*
 449          * If there is a result procedure specified in the reply message,
 450          * it will be processed in the xdr_replymsg and SVCAUTH_WRAP.
 451          * We need to make sure it won't be processed twice, so we null
 452          * it for xdr_replymsg here.
 453          */
 454         has_args = FALSE;
 455         if (msg->rm_reply.rp_stat == MSG_ACCEPTED &&
 456             msg->rm_reply.rp_acpt.ar_stat == SUCCESS) {
 457                 if ((xdr_results = msg->acpted_rply.ar_results.proc) != NULL) {
 458                         has_args = TRUE;
 459                         xdr_location = msg->acpted_rply.ar_results.where;
 460                         msg->acpted_rply.ar_results.proc = xdr_void;
 461                         msg->acpted_rply.ar_results.where = NULL;
 462                 }
 463         }
 464 
 465         if (ud->ud_resp->b_cont == NULL) {
 466                 /*
 467                  * Allocate an initial mblk for the response data.
 468                  */
 469                 while ((mp = allocb(UD_INITSIZE, BPRI_LO)) == NULL) {
 470                         if (strwaitbuf(UD_INITSIZE, BPRI_LO)) {
 471                                 TRACE_1(TR_FAC_KRPC, TR_SVC_CLTS_KSEND_END,
 472                                     "svc_clts_ksend_end:(%S)", "strwaitbuf");
 473                                 return (FALSE);
 474                         }
 475                 }
 476 
 477                 /*
 478                  * Initialize the XDR decode stream.  Additional mblks
 479                  * will be allocated if necessary.  They will be UD_MAXSIZE
 480                  * sized.
 481                  */
 482                 xdrmblk_init(xdrs, mp, XDR_ENCODE, UD_MAXSIZE);
 483 
 484                 /*
 485                  * Leave some space for protocol headers.
 486                  */
 487                 (void) XDR_SETPOS(xdrs, 512);
 488                 mp->b_rptr += 512;
 489 
 490                 msg->rm_xid = clone_xprt->xp_xid;
 491 
 492                 ud->ud_resp->b_cont = mp;
 493 
 494                 TRACE_0(TR_FAC_KRPC, TR_XDR_REPLYMSG_START,
 495                     "xdr_replymsg_start:");
 496                 if (!(xdr_replymsg(xdrs, msg) &&
 497                     (!has_args || SVCAUTH_WRAP(&clone_xprt->xp_auth, xdrs,
 498                     xdr_results, xdr_location)))) {
 499                         TRACE_1(TR_FAC_KRPC, TR_XDR_REPLYMSG_END,
 500                             "xdr_replymsg_end:(%S)", "bad");
 501                         RPCLOG0(1, "xdr_replymsg/SVCAUTH_WRAP failed\n");
 502                         goto out;
 503                 }
 504                 TRACE_1(TR_FAC_KRPC, TR_XDR_REPLYMSG_END,
 505                     "xdr_replymsg_end:(%S)", "good");
 506 
 507         } else if (!(xdr_replymsg_body(xdrs, msg) &&
 508             (!has_args || SVCAUTH_WRAP(&clone_xprt->xp_auth, xdrs,
 509             xdr_results, xdr_location)))) {
 510                 RPCLOG0(1, "xdr_replymsg_body/SVCAUTH_WRAP failed\n");
 511                 goto out;
 512         }
 513 
 514         msgsz = (int)xmsgsize(ud->ud_resp->b_cont);
 515 
 516         if (msgsz <= 0 || (clone_xprt->xp_msg_size != -1 &&
 517             msgsz > clone_xprt->xp_msg_size)) {
 518 #ifdef  DEBUG
 519                 cmn_err(CE_NOTE,
 520 "KRPC: server response message of %d bytes; transport limits are [0, %d]",
 521                     msgsz, clone_xprt->xp_msg_size);
 522 #endif
 523                 goto out;
 524         }
 525 
 526         /*
 527          * Construct the T_unitdata_req.  We take advantage of the fact that
 528          * T_unitdata_ind looks just like T_unitdata_req, except for the
 529          * primitive type.  Reusing it means we preserve the SCM_UCRED, and
 530          * we must preserve it for TX to work.
 531          *
 532          * This has the side effect that we can also pass certain receive-side
 533          * options like IPV6_PKTINFO back down the send side.  This implies
 534          * that we can not ASSERT on a non-NULL db_credp when we have send-side
 535          * options in UDP.
 536          */
 537         ASSERT(MBLKL(ud->ud_resp) >= TUNITDATAREQSZ);
 538         udreq = (struct T_unitdata_req *)ud->ud_resp->b_rptr;
 539         ASSERT(udreq->PRIM_type == T_UNITDATA_IND);
 540         udreq->PRIM_type = T_UNITDATA_REQ;
 541 
 542         /*
 543          * If the local IPv4 transport address is known use it as a source
 544          * address for the outgoing UDP packet.
 545          */
 546         if (((sin_t *)(clone_xprt->xp_lcladdr.buf))->sin_family == AF_INET) {
 547                 struct T_opthdr *opthdr;
 548                 in_pktinfo_t *pktinfo;
 549                 size_t size;
 550 
 551                 if (udreq->DEST_length == 0)
 552                         udreq->OPT_offset = _TPI_ALIGN_TOPT(TUNITDATAREQSZ);
 553                 else
 554                         udreq->OPT_offset = _TPI_ALIGN_TOPT(udreq->DEST_offset +
 555                             udreq->DEST_length);
 556 
 557                 udreq->OPT_length = sizeof (struct T_opthdr) +
 558                     sizeof (in_pktinfo_t);
 559 
 560                 size = udreq->OPT_length + udreq->OPT_offset;
 561 
 562                 /* make sure we have enough space for the option data */
 563                 mp = reallocb(ud->ud_resp, size, 1);
 564                 if (mp == NULL)
 565                         goto out;
 566                 ud->ud_resp = mp;
 567                 udreq = (struct T_unitdata_req *)mp->b_rptr;
 568 
 569                 /* set desired option header */
 570                 opthdr = (struct T_opthdr *)(mp->b_rptr + udreq->OPT_offset);
 571                 opthdr->len = udreq->OPT_length;
 572                 opthdr->level = IPPROTO_IP;
 573                 opthdr->name = IP_PKTINFO;
 574 
 575                 /*
 576                  * 1. set source IP of outbound packet
 577                  * 2. value '0' for index means IP layer uses this as source
 578                  *    address
 579                  */
 580                 pktinfo = (in_pktinfo_t *)(opthdr + 1);
 581                 (void) memset(pktinfo, 0, sizeof (in_pktinfo_t));
 582                 pktinfo->ipi_spec_dst.s_addr =
 583                     ((sin_t *)(clone_xprt->xp_lcladdr.buf))->sin_addr.s_addr;
 584                 pktinfo->ipi_ifindex = 0;
 585 
 586                 /* adjust the end of active data */
 587                 mp->b_wptr = mp->b_rptr + size;
 588         }
 589 
 590         put(clone_xprt->xp_wq, ud->ud_resp);
 591         stat = TRUE;
 592         ud->ud_resp = NULL;
 593 
 594 out:
 595         if (stat == FALSE) {
 596                 freemsg(ud->ud_resp);
 597                 ud->ud_resp = NULL;
 598         }
 599 
 600         /*
 601          * This is completely disgusting.  If public is set it is
 602          * a pointer to a structure whose first field is the address
 603          * of the function to free that structure and any related
 604          * stuff.  (see rrokfree in nfs_xdr.c).
 605          */
 606         if (xdrs->x_public) {
 607                 /* LINTED pointer alignment */
 608                 (**((int (**)())xdrs->x_public))(xdrs->x_public);
 609         }
 610 
 611         TRACE_1(TR_FAC_KRPC, TR_SVC_CLTS_KSEND_END,
 612             "svc_clts_ksend_end:(%S)", "done");
 613         return (stat);
 614 }
 615 
 616 /*
 617  * Deserialize arguments.
 618  */
 619 static bool_t
 620 svc_clts_kgetargs(SVCXPRT *clone_xprt, xdrproc_t xdr_args,
 621     caddr_t args_ptr)
 622 {
 623 
 624         /* LINTED pointer alignment */
 625         return (SVCAUTH_UNWRAP(&clone_xprt->xp_auth, &clone_xprt->xp_xdrin,
 626             xdr_args, args_ptr));
 627 
 628 }
 629 
 630 static bool_t
 631 svc_clts_kfreeargs(SVCXPRT *clone_xprt, xdrproc_t xdr_args,
 632     caddr_t args_ptr)
 633 {
 634         /* LINTED pointer alignment */
 635         struct udp_data *ud = (struct udp_data *)clone_xprt->xp_p2buf;
 636         XDR *xdrs = &clone_xprt->xp_xdrin;
 637         bool_t retval;
 638 
 639         if (args_ptr) {
 640                 xdrs->x_op = XDR_FREE;
 641                 retval = (*xdr_args)(xdrs, args_ptr);
 642         } else
 643                 retval = TRUE;
 644 
 645         if (ud->ud_inmp) {
 646                 freemsg(ud->ud_inmp);
 647                 ud->ud_inmp = NULL;
 648         }
 649 
 650         return (retval);
 651 }
 652 
 653 static int32_t *
 654 svc_clts_kgetres(SVCXPRT *clone_xprt, int size)
 655 {
 656         /* LINTED pointer alignment */
 657         struct udp_data *ud = (struct udp_data *)clone_xprt->xp_p2buf;
 658         XDR *xdrs = &clone_xprt->xp_xdrout;
 659         mblk_t *mp;
 660         int32_t *buf;
 661         struct rpc_msg rply;
 662 
 663         /*
 664          * Allocate an initial mblk for the response data.
 665          */
 666         while ((mp = allocb(UD_INITSIZE, BPRI_LO)) == NULL) {
 667                 if (strwaitbuf(UD_INITSIZE, BPRI_LO)) {
 668                         return (FALSE);
 669                 }
 670         }
 671 
 672         mp->b_cont = NULL;
 673 
 674         /*
 675          * Initialize the XDR decode stream.  Additional mblks
 676          * will be allocated if necessary.  They will be UD_MAXSIZE
 677          * sized.
 678          */
 679         xdrmblk_init(xdrs, mp, XDR_ENCODE, UD_MAXSIZE);
 680 
 681         /*
 682          * Leave some space for protocol headers.
 683          */
 684         (void) XDR_SETPOS(xdrs, 512);
 685         mp->b_rptr += 512;
 686 
 687         /*
 688          * Assume a successful RPC since most of them are.
 689          */
 690         rply.rm_xid = clone_xprt->xp_xid;
 691         rply.rm_direction = REPLY;
 692         rply.rm_reply.rp_stat = MSG_ACCEPTED;
 693         rply.acpted_rply.ar_verf = clone_xprt->xp_verf;
 694         rply.acpted_rply.ar_stat = SUCCESS;
 695 
 696         if (!xdr_replymsg_hdr(xdrs, &rply)) {
 697                 freeb(mp);
 698                 return (NULL);
 699         }
 700 
 701         buf = XDR_INLINE(xdrs, size);
 702 
 703         if (buf == NULL)
 704                 freeb(mp);
 705         else
 706                 ud->ud_resp->b_cont = mp;
 707 
 708         return (buf);
 709 }
 710 
 711 static void
 712 svc_clts_kfreeres(SVCXPRT *clone_xprt)
 713 {
 714         /* LINTED pointer alignment */
 715         struct udp_data *ud = (struct udp_data *)clone_xprt->xp_p2buf;
 716 
 717         if (ud->ud_resp == NULL || ud->ud_resp->b_cont == NULL)
 718                 return;
 719 
 720         /*
 721          * SVC_FREERES() is called whenever the server decides not to
 722          * send normal reply. Thus, we expect only one mblk to be allocated,
 723          * because we have not attempted any XDR encoding.
 724          * If we do any XDR encoding and we get an error, then SVC_REPLY()
 725          * will freemsg(ud->ud_resp);
 726          */
 727         ASSERT(ud->ud_resp->b_cont->b_cont == NULL);
 728         freeb(ud->ud_resp->b_cont);
 729         ud->ud_resp->b_cont = NULL;
 730 }
 731 
 732 /*
 733  * the dup cacheing routines below provide a cache of non-failure
 734  * transaction id's.  rpc service routines can use this to detect
 735  * retransmissions and re-send a non-failure response.
 736  */
 737 
 738 /*
 739  * MAXDUPREQS is the number of cached items.  It should be adjusted
 740  * to the service load so that there is likely to be a response entry
 741  * when the first retransmission comes in.
 742  */
 743 #define MAXDUPREQS      1024
 744 
 745 /*
 746  * This should be appropriately scaled to MAXDUPREQS.
 747  */
 748 #define DRHASHSZ        257
 749 
 750 #if ((DRHASHSZ & (DRHASHSZ - 1)) == 0)
 751 #define XIDHASH(xid)    ((xid) & (DRHASHSZ - 1))
 752 #else
 753 #define XIDHASH(xid)    ((xid) % DRHASHSZ)
 754 #endif
 755 #define DRHASH(dr)      XIDHASH((dr)->dr_xid)
 756 #define REQTOXID(req)   ((req)->rq_xprt->xp_xid)
 757 
 758 static int      ndupreqs = 0;
 759 int     maxdupreqs = MAXDUPREQS;
 760 static kmutex_t dupreq_lock;
 761 static struct dupreq *drhashtbl[DRHASHSZ];
 762 static int      drhashstat[DRHASHSZ];
 763 
 764 static void unhash(struct dupreq *);
 765 
 766 /*
 767  * drmru points to the head of a circular linked list in lru order.
 768  * drmru->dr_next == drlru
 769  */
 770 struct dupreq *drmru;
 771 
 772 /*
 773  * PSARC 2003/523 Contract Private Interface
 774  * svc_clts_kdup
 775  * Changes must be reviewed by Solaris File Sharing
 776  * Changes must be communicated to contract-2003-523@sun.com
 777  *
 778  * svc_clts_kdup searches the request cache and returns 0 if the
 779  * request is not found in the cache.  If it is found, then it
 780  * returns the state of the request (in progress or done) and
 781  * the status or attributes that were part of the original reply.
 782  *
 783  * If DUP_DONE (there is a duplicate) svc_clts_kdup copies over the
 784  * value of the response. In that case, also return in *dupcachedp
 785  * whether the response free routine is cached in the dupreq - in which case
 786  * the caller should not be freeing it, because it will be done later
 787  * in the svc_clts_kdup code when the dupreq is reused.
 788  */
 789 static int
 790 svc_clts_kdup(struct svc_req *req, caddr_t res, int size, struct dupreq **drpp,
 791         bool_t *dupcachedp)
 792 {
 793         struct rpc_clts_server *stats = CLONE2STATS(req->rq_xprt);
 794         struct dupreq *dr;
 795         uint32_t xid;
 796         uint32_t drhash;
 797         int status;
 798 
 799         xid = REQTOXID(req);
 800         mutex_enter(&dupreq_lock);
 801         RSSTAT_INCR(stats, rsdupchecks);
 802         /*
 803          * Check to see whether an entry already exists in the cache.
 804          */
 805         dr = drhashtbl[XIDHASH(xid)];
 806         while (dr != NULL) {
 807                 if (dr->dr_xid == xid &&
 808                     dr->dr_proc == req->rq_proc &&
 809                     dr->dr_prog == req->rq_prog &&
 810                     dr->dr_vers == req->rq_vers &&
 811                     dr->dr_addr.len == req->rq_xprt->xp_rtaddr.len &&
 812                     bcmp(dr->dr_addr.buf, req->rq_xprt->xp_rtaddr.buf,
 813                     dr->dr_addr.len) == 0) {
 814                         status = dr->dr_status;
 815                         if (status == DUP_DONE) {
 816                                 bcopy(dr->dr_resp.buf, res, size);
 817                                 if (dupcachedp != NULL)
 818                                         *dupcachedp = (dr->dr_resfree != NULL);
 819                         } else {
 820                                 dr->dr_status = DUP_INPROGRESS;
 821                                 *drpp = dr;
 822                         }
 823                         RSSTAT_INCR(stats, rsdupreqs);
 824                         mutex_exit(&dupreq_lock);
 825                         return (status);
 826                 }
 827                 dr = dr->dr_chain;
 828         }
 829 
 830         /*
 831          * There wasn't an entry, either allocate a new one or recycle
 832          * an old one.
 833          */
 834         if (ndupreqs < maxdupreqs) {
 835                 dr = kmem_alloc(sizeof (*dr), KM_NOSLEEP);
 836                 if (dr == NULL) {
 837                         mutex_exit(&dupreq_lock);
 838                         return (DUP_ERROR);
 839                 }
 840                 dr->dr_resp.buf = NULL;
 841                 dr->dr_resp.maxlen = 0;
 842                 dr->dr_addr.buf = NULL;
 843                 dr->dr_addr.maxlen = 0;
 844                 if (drmru) {
 845                         dr->dr_next = drmru->dr_next;
 846                         drmru->dr_next = dr;
 847                 } else {
 848                         dr->dr_next = dr;
 849                 }
 850                 ndupreqs++;
 851         } else {
 852                 dr = drmru->dr_next;
 853                 while (dr->dr_status == DUP_INPROGRESS) {
 854                         dr = dr->dr_next;
 855                         if (dr == drmru->dr_next) {
 856                                 cmn_err(CE_WARN, "svc_clts_kdup no slots free");
 857                                 mutex_exit(&dupreq_lock);
 858                                 return (DUP_ERROR);
 859                         }
 860                 }
 861                 unhash(dr);
 862                 if (dr->dr_resfree) {
 863                         (*dr->dr_resfree)(dr->dr_resp.buf);
 864                 }
 865         }
 866         dr->dr_resfree = NULL;
 867         drmru = dr;
 868 
 869         dr->dr_xid = REQTOXID(req);
 870         dr->dr_prog = req->rq_prog;
 871         dr->dr_vers = req->rq_vers;
 872         dr->dr_proc = req->rq_proc;
 873         if (dr->dr_addr.maxlen < req->rq_xprt->xp_rtaddr.len) {
 874                 if (dr->dr_addr.buf != NULL)
 875                         kmem_free(dr->dr_addr.buf, dr->dr_addr.maxlen);
 876                 dr->dr_addr.maxlen = req->rq_xprt->xp_rtaddr.len;
 877                 dr->dr_addr.buf = kmem_alloc(dr->dr_addr.maxlen,
 878                     KM_NOSLEEP);
 879                 if (dr->dr_addr.buf == NULL) {
 880                         dr->dr_addr.maxlen = 0;
 881                         dr->dr_status = DUP_DROP;
 882                         mutex_exit(&dupreq_lock);
 883                         return (DUP_ERROR);
 884                 }
 885         }
 886         dr->dr_addr.len = req->rq_xprt->xp_rtaddr.len;
 887         bcopy(req->rq_xprt->xp_rtaddr.buf, dr->dr_addr.buf, dr->dr_addr.len);
 888         if (dr->dr_resp.maxlen < size) {
 889                 if (dr->dr_resp.buf != NULL)
 890                         kmem_free(dr->dr_resp.buf, dr->dr_resp.maxlen);
 891                 dr->dr_resp.maxlen = (unsigned int)size;
 892                 dr->dr_resp.buf = kmem_alloc(size, KM_NOSLEEP);
 893                 if (dr->dr_resp.buf == NULL) {
 894                         dr->dr_resp.maxlen = 0;
 895                         dr->dr_status = DUP_DROP;
 896                         mutex_exit(&dupreq_lock);
 897                         return (DUP_ERROR);
 898                 }
 899         }
 900         dr->dr_status = DUP_INPROGRESS;
 901 
 902         drhash = (uint32_t)DRHASH(dr);
 903         dr->dr_chain = drhashtbl[drhash];
 904         drhashtbl[drhash] = dr;
 905         drhashstat[drhash]++;
 906         mutex_exit(&dupreq_lock);
 907         *drpp = dr;
 908         return (DUP_NEW);
 909 }
 910 
 911 /*
 912  * PSARC 2003/523 Contract Private Interface
 913  * svc_clts_kdupdone
 914  * Changes must be reviewed by Solaris File Sharing
 915  * Changes must be communicated to contract-2003-523@sun.com
 916  *
 917  * svc_clts_kdupdone marks the request done (DUP_DONE or DUP_DROP)
 918  * and stores the response.
 919  */
 920 static void
 921 svc_clts_kdupdone(struct dupreq *dr, caddr_t res, void (*dis_resfree)(),
 922         int size, int status)
 923 {
 924 
 925         ASSERT(dr->dr_resfree == NULL);
 926         if (status == DUP_DONE) {
 927                 bcopy(res, dr->dr_resp.buf, size);
 928                 dr->dr_resfree = dis_resfree;
 929         }
 930         dr->dr_status = status;
 931 }
 932 
 933 /*
 934  * This routine expects that the mutex, dupreq_lock, is already held.
 935  */
 936 static void
 937 unhash(struct dupreq *dr)
 938 {
 939         struct dupreq *drt;
 940         struct dupreq *drtprev = NULL;
 941         uint32_t drhash;
 942 
 943         ASSERT(MUTEX_HELD(&dupreq_lock));
 944 
 945         drhash = (uint32_t)DRHASH(dr);
 946         drt = drhashtbl[drhash];
 947         while (drt != NULL) {
 948                 if (drt == dr) {
 949                         drhashstat[drhash]--;
 950                         if (drtprev == NULL) {
 951                                 drhashtbl[drhash] = drt->dr_chain;
 952                         } else {
 953                                 drtprev->dr_chain = drt->dr_chain;
 954                         }
 955                         return;
 956                 }
 957                 drtprev = drt;
 958                 drt = drt->dr_chain;
 959         }
 960 }
 961 
 962 void
 963 svc_clts_stats_init(zoneid_t zoneid, struct rpc_clts_server **statsp)
 964 {
 965         kstat_t *ksp;
 966         kstat_named_t *knp;
 967 
 968         knp = rpcstat_zone_init_common(zoneid, "unix", "rpc_clts_server",
 969             (const kstat_named_t *)&clts_rsstat_tmpl,
 970             sizeof (clts_rsstat_tmpl));
 971         /*
 972          * Backwards compatibility for old kstat clients
 973          */
 974         ksp = kstat_create_zone("unix", 0, "rpc_server", "rpc",
 975             KSTAT_TYPE_NAMED, clts_rsstat_ndata,
 976             KSTAT_FLAG_VIRTUAL | KSTAT_FLAG_WRITABLE, zoneid);
 977         if (ksp) {
 978                 ksp->ks_data = knp;
 979                 kstat_install(ksp);
 980         }
 981         *statsp = (struct rpc_clts_server *)knp;
 982 }
 983 
 984 void
 985 svc_clts_stats_fini(zoneid_t zoneid, struct rpc_clts_server **statsp)
 986 {
 987         rpcstat_zone_fini_common(zoneid, "unix", "rpc_clts_server");
 988         kstat_delete_byname_zone("unix", 0, "rpc_server", zoneid);
 989         kmem_free(*statsp, sizeof (clts_rsstat_tmpl));
 990 }
 991 
 992 void
 993 svc_clts_init()
 994 {
 995         /*
 996          * Check to make sure that the clts private data will fit into
 997          * the stack buffer allocated by svc_run.  The compiler should
 998          * remove this check, but it's a safety net if the udp_data
 999          * structure ever changes.
1000          */
1001         /*CONSTANTCONDITION*/
1002         ASSERT(sizeof (struct udp_data) <= SVC_P2LEN);
1003 
1004         mutex_init(&dupreq_lock, NULL, MUTEX_DEFAULT, NULL);
1005 }