 @@ -1,809 +1,812 @@
-/*	$NetBSD: svc.c,v 1.35 2015/11/06 19:34:13 christos Exp $	*/
+/*	$NetBSD: svc.c,v 1.36 2015/11/07 17:34:33 christos Exp $	*/
 /*
  * Copyright (c) 2010, Oracle America, Inc.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
+ *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials
  *       provided with the distribution.
  *     * Neither the name of the "Oracle America, Inc." nor the names of its
  *       contributors may be used to endorse or promote products derived
  *       from this software without specific prior written permission.
+ *
  *   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  *   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  *   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  *   FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  *   COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
  *   INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  *   DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
  *   GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  *   INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
  *   WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  *   NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  *   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
 #if defined(LIBC_SCCS) && !defined(lint)
 #if 0
 static char *sccsid = "@(#)svc.c 1.44 88/02/08 Copyr 1984 Sun Micro";
 static char *sccsid = "@(#)svc.c	2.4 88/08/11 4.0 RPCSRC";
 #else
-__RCSID("$NetBSD: svc.c,v 1.35 2015/11/06 19:34:13 christos Exp $");
+__RCSID("$NetBSD: svc.c,v 1.36 2015/11/07 17:34:33 christos Exp $");
 #endif
 #endif
 /*
  * svc.c, Server-side remote procedure call interface.
+ *
  * There are two sets of procedures here.  The xprt routines are
  * for handling transport handles.  The svc routines handle the
  * list of service routines.
+ *
  * Copyright (C) 1984, Sun Microsystems, Inc.
  */
 #include "namespace.h"
 #include "reentrant.h"
 #include <sys/types.h>
 #include <sys/poll.h>
 #include <assert.h>
 #include <errno.h>
 #include <stdlib.h>
 #include <string.h>
 #include <err.h>
 #include <rpc/rpc.h>
 #ifdef PORTMAP
 #include <rpc/pmap_clnt.h>
 #endif
 #include "svc_fdset.h"
 #include "rpc_internal.h"
 #ifdef __weak_alias
 __weak_alias(svc_getreq,_svc_getreq)
 __weak_alias(svc_getreqset,_svc_getreqset)
 __weak_alias(svc_getreq_common,_svc_getreq_common)
 __weak_alias(svc_register,_svc_register)
 __weak_alias(svc_reg,_svc_reg)
 __weak_alias(svc_unreg,_svc_unreg)
 __weak_alias(svc_sendreply,_svc_sendreply)
 __weak_alias(svc_unregister,_svc_unregister)
 __weak_alias(svcerr_auth,_svcerr_auth)
 __weak_alias(svcerr_decode,_svcerr_decode)
 __weak_alias(svcerr_noproc,_svcerr_noproc)
 __weak_alias(svcerr_noprog,_svcerr_noprog)
 __weak_alias(svcerr_progvers,_svcerr_progvers)
 __weak_alias(svcerr_systemerr,_svcerr_systemerr)
 __weak_alias(svcerr_weakauth,_svcerr_weakauth)
 __weak_alias(xprt_register,_xprt_register)
 __weak_alias(xprt_unregister,_xprt_unregister)
 __weak_alias(rpc_control,_rpc_control)
 #endif
 /* __svc_xports[-1] is reserved for raw */
 SVCXPRT **__svc_xports;
 int __svc_maxxports;
 int __svc_maxrec;
 #define	RQCRED_SIZE	400		/* this size is excessive */
 #define SVC_VERSQUIET 0x0001		/* keep quiet about vers mismatch */
 #define version_keepquiet(xp) ((u_long)(xp)->xp_p3 & SVC_VERSQUIET)
 #define max(a, b) (a > b ? a : b)
 /*
  * The services list
  * Each entry represents a set of procedures (an rpc program).
  * The dispatch routine takes request structs and runs the
  * apropriate procedure.
  */
 static struct svc_callout {
 	struct svc_callout *sc_next;
 	rpcprog_t	    sc_prog;
 	rpcvers_t	    sc_vers;
 	char		   *sc_netid;
 	void		    (*sc_dispatch)(struct svc_req *, SVCXPRT *);
 } *svc_head;
 #ifdef _REENTRANT
 extern rwlock_t svc_lock;
 extern rwlock_t svc_fd_lock;
 #endif
 static struct svc_callout *svc_find(rpcprog_t, rpcvers_t,
 					 struct svc_callout **, char *);
 static void __xprt_do_unregister(SVCXPRT *xprt, bool_t dolock);
 /* ***************  SVCXPRT related stuff **************** */
 static bool_t
 xprt_alloc(int sock)
+{
 	int maxset;
 	char *newxports;
 	if (++sock < 0)
 		return FALSE;
 	maxset = svc_fdset_getsize(sock);
 	if (maxset == -1)
 		return FALSE;
 	if (__svc_xports != NULL && maxset <= __svc_maxxports)
 		return TRUE;
 	if (__svc_xports != NULL)
 		--__svc_xports;
 	newxports = realloc(__svc_xports, maxset * sizeof(SVCXPRT *));
 	if (newxports == NULL) {
 		warn("%s: out of memory", __func__);
 		return FALSE;
+	}
 	memset(newxports + __svc_maxxports * sizeof(SVCXPRT *), 0,
 	    (maxset - __svc_maxxports) * sizeof(SVCXPRT *));
 	__svc_xports = (void *)newxports;
 	__svc_xports++;
 	__svc_maxxports = maxset;
 	return TRUE;
+}
 /*
  * Activate a transport handle.
  */
 bool_t
 xprt_register(SVCXPRT *xprt)
+{
 	int sock;
 	_DIAGASSERT(xprt != NULL);
 	rwlock_wrlock(&svc_fd_lock);
 	sock = xprt->xp_fd;
 	if (!xprt_alloc(sock))
 		goto out;
 	__svc_xports[sock] = xprt;
 	if (sock != -1) {
-		svc_fdset_set(sock);
+		if (svc_fdset_set(sock) == -1)
 			return FALSE;
+	}
 	rwlock_unlock(&svc_fd_lock);
 	return (TRUE);
 out:
 	rwlock_unlock(&svc_fd_lock);
 	return (FALSE);
+}
 void
 xprt_unregister(SVCXPRT *xprt)
+{
 	__xprt_do_unregister(xprt, TRUE);
+}
 void
 __xprt_unregister_unlocked(SVCXPRT *xprt)
+{
 	__xprt_do_unregister(xprt, FALSE);
+}
 /*
  * De-activate a transport handle.
  */
 static void
 __xprt_do_unregister(SVCXPRT *xprt, bool_t dolock)
+{
 	int sock, *fdmax;
 	_DIAGASSERT(xprt != NULL);
 	if (dolock)
 		rwlock_wrlock(&svc_fd_lock);
 	sock = xprt->xp_fd;
 	if (sock >= __svc_maxxports || __svc_xports[sock] != xprt)
 		goto out;
 	__svc_xports[sock] = NULL;
 	if (sock == -1)
 		goto out;
 	fdmax = svc_fdset_getmax();
-	if (sock < *fdmax)
+	if (fdmax == NULL || sock < *fdmax)
 		goto clr;
 	for ((*fdmax)--; *fdmax >= 0; (*fdmax)--)
 		if (__svc_xports[*fdmax])
 			break;
 clr:
 	svc_fdset_clr(sock);
 out:
 	if (dolock)
 		rwlock_unlock(&svc_fd_lock);
+}
 /*
  * Add a service program to the callout list.
  * The dispatch routine will be called when a rpc request for this
  * program number comes in.
  */
 bool_t
 svc_reg(SVCXPRT *xprt, const rpcprog_t prog, const rpcvers_t vers,
 	void (*dispatch)(struct svc_req *, SVCXPRT *),
 	const struct netconfig *nconf)
+{
 	bool_t dummy;
 	struct svc_callout *prev;
 	struct svc_callout *s;
 	struct netconfig *tnconf;
 	char *netid = NULL;
 	int flag = 0;
 	_DIAGASSERT(xprt != NULL);
 	/* XXX: dispatch may be NULL ??? */
 /* VARIABLES PROTECTED BY svc_lock: s, prev, svc_head */
 	if (xprt->xp_netid) {
 		netid = strdup(xprt->xp_netid);
 		flag = 1;
 	} else if (nconf && nconf->nc_netid) {
 		netid = strdup(nconf->nc_netid);
 		flag = 1;
 	} else if ((tnconf = __rpcgettp(xprt->xp_fd)) != NULL) {
 		netid = strdup(tnconf->nc_netid);
 		flag = 1;
 		freenetconfigent(tnconf);
 	} /* must have been created with svc_raw_create */
 	if ((netid == NULL) && (flag == 1)) {
 		return (FALSE);
+	}
 	rwlock_wrlock(&svc_lock);
 	if ((s = svc_find(prog, vers, &prev, netid)) != NULL) {
 		if (netid)
 			free(netid);
 		if (s->sc_dispatch == dispatch)
 			goto rpcb_it; /* he is registering another xptr */
 		rwlock_unlock(&svc_lock);
 		return (FALSE);
+	}
 	s = mem_alloc(sizeof (struct svc_callout));
 	if (s == NULL) {
 		if (netid)
 			free(netid);
 		rwlock_unlock(&svc_lock);
 		return (FALSE);
+	}
 	if ((xprt->xp_netid == NULL) && (flag == 1) && netid)
 		if ((((SVCXPRT *) xprt)->xp_netid = strdup(netid)) == NULL) {
 			warn("svc_reg");
 			mem_free(s, sizeof(struct svc_callout));
 			rwlock_unlock(&svc_lock);
 			return FALSE;
+		}
 	s->sc_prog = prog;
 	s->sc_vers = vers;
 	s->sc_dispatch = dispatch;
 	s->sc_netid = netid;
 	s->sc_next = svc_head;
 	svc_head = s;
 rpcb_it:
 	rwlock_unlock(&svc_lock);
 	/* now register the information with the local binder service */
 	if (nconf) {
 		dummy = rpcb_set(prog, vers, __UNCONST(nconf),
 		&((SVCXPRT *) xprt)->xp_ltaddr);
 		return (dummy);
+	}
 	return (TRUE);
+}
 /*
  * Remove a service program from the callout list.
  */
 void
 svc_unreg(const rpcprog_t prog, const rpcvers_t vers)
+{
 	struct svc_callout *prev;
 	struct svc_callout *s;
 	/* unregister the information anyway */
 	(void) rpcb_unset(prog, vers, NULL);
 	rwlock_wrlock(&svc_lock);
 	while ((s = svc_find(prog, vers, &prev, NULL)) != NULL) {
 		if (prev == NULL) {
 			svc_head = s->sc_next;
 		} else {
 			prev->sc_next = s->sc_next;
+		}
 		s->sc_next = NULL;
 		if (s->sc_netid)
 			mem_free(s->sc_netid, sizeof (s->sc_netid) + 1);
 		mem_free(s, sizeof (struct svc_callout));
+	}
 	rwlock_unlock(&svc_lock);
+}
 /* ********************** CALLOUT list related stuff ************* */
 #ifdef PORTMAP
 /*
  * Add a service program to the callout list.
  * The dispatch routine will be called when a rpc request for this
  * program number comes in.
  */
 bool_t
 svc_register(SVCXPRT *xprt, u_long prog, u_long vers,
 	void (*dispatch)(struct svc_req *, SVCXPRT *), int protocol)
+{
 	struct svc_callout *prev;
 	struct svc_callout *s;
 	_DIAGASSERT(xprt != NULL);
 	_DIAGASSERT(dispatch != NULL);
 	if ((s = svc_find((rpcprog_t)prog, (rpcvers_t)vers, &prev, NULL)) !=
 	    NULL) {
 		if (s->sc_dispatch == dispatch)
 			goto pmap_it;  /* he is registering another xptr */
 		return (FALSE);
+	}
 	s = mem_alloc(sizeof(struct svc_callout));
 	if (s == NULL) {
 		return (FALSE);
+	}
 	s->sc_prog = (rpcprog_t)prog;
 	s->sc_vers = (rpcvers_t)vers;
 	s->sc_dispatch = dispatch;
 	s->sc_next = svc_head;
 	svc_head = s;
 pmap_it:
 	/* now register the information with the local binder service */
 	if (protocol) {
 		return (pmap_set(prog, vers, protocol, xprt->xp_port));
+	}
 	return (TRUE);
+}
 /*
  * Remove a service program from the callout list.
  */
 void
 svc_unregister(u_long prog, u_long vers)
+{
 	struct svc_callout *prev;
 	struct svc_callout *s;
 	if ((s = svc_find((rpcprog_t)prog, (rpcvers_t)vers, &prev, NULL)) ==
 	    NULL)
 		return;
 	if (prev == NULL) {
 		svc_head = s->sc_next;
 	} else {
 		prev->sc_next = s->sc_next;
+	}
 	s->sc_next = NULL;
 	mem_free(s, sizeof(struct svc_callout));
 	/* now unregister the information with the local binder service */
 	(void)pmap_unset(prog, vers);
+}
 #endif /* PORTMAP */
 /*
  * Search the callout list for a program number, return the callout
  * struct.
  */
 static struct svc_callout *
 svc_find(rpcprog_t prog, rpcvers_t vers, struct svc_callout **prev, char *netid)
+{
 	struct svc_callout *s, *p;
 	_DIAGASSERT(prev != NULL);
 	/* netid is handled below */
 	p = NULL;
 	for (s = svc_head; s != NULL; s = s->sc_next) {
 		if (((s->sc_prog == prog) && (s->sc_vers == vers)) &&
 		    ((netid == NULL) || (s->sc_netid == NULL) ||
 		    (strcmp(netid, s->sc_netid) == 0)))
 			break;
 		p = s;
+	}
 	*prev = p;
 	return (s);
+}
 /* ******************* REPLY GENERATION ROUTINES  ************ */
 /*
  * Send a reply to an rpc request
  */
 bool_t
 svc_sendreply(SVCXPRT *xprt, xdrproc_t xdr_results, const char *xdr_location)
+{
 	struct rpc_msg rply;
 	_DIAGASSERT(xprt != NULL);
 	rply.rm_direction = REPLY;
 	rply.rm_reply.rp_stat = MSG_ACCEPTED;
 	rply.acpted_rply.ar_verf = xprt->xp_verf;
 	rply.acpted_rply.ar_stat = SUCCESS;
 	rply.acpted_rply.ar_results.where = xdr_location;
 	rply.acpted_rply.ar_results.proc = xdr_results;
 	return (SVC_REPLY(xprt, &rply));
+}
 /*
  * No procedure error reply
  */
 void
 svcerr_noproc(SVCXPRT *xprt)
+{
 	struct rpc_msg rply;
 	_DIAGASSERT(xprt != NULL);
 	rply.rm_direction = REPLY;
 	rply.rm_reply.rp_stat = MSG_ACCEPTED;
 	rply.acpted_rply.ar_verf = xprt->xp_verf;
 	rply.acpted_rply.ar_stat = PROC_UNAVAIL;
 	SVC_REPLY(xprt, &rply);
+}
 /*
  * Can't decode args error reply
  */
 void
 svcerr_decode(SVCXPRT *xprt)
+{
 	struct rpc_msg rply;
 	_DIAGASSERT(xprt != NULL);
 	rply.rm_direction = REPLY;
 	rply.rm_reply.rp_stat = MSG_ACCEPTED;
 	rply.acpted_rply.ar_verf = xprt->xp_verf;
 	rply.acpted_rply.ar_stat = GARBAGE_ARGS;
 	SVC_REPLY(xprt, &rply);
+}
 /*
  * Some system error
  */
 void
 svcerr_systemerr(SVCXPRT *xprt)
+{
 	struct rpc_msg rply;
 	_DIAGASSERT(xprt != NULL);
 	rply.rm_direction = REPLY;
 	rply.rm_reply.rp_stat = MSG_ACCEPTED;
 	rply.acpted_rply.ar_verf = xprt->xp_verf;
 	rply.acpted_rply.ar_stat = SYSTEM_ERR;
 	SVC_REPLY(xprt, &rply);
+}
 #if 0
 /*
  * Tell RPC package to not complain about version errors to the client.	 This
  * is useful when revving broadcast protocols that sit on a fixed address.
  * There is really one (or should be only one) example of this kind of
  * protocol: the portmapper (or rpc binder).
  */
 void
 __svc_versquiet_on(SVCXPRT *xprt)
+{
 	u_long	tmp;
 	_DIAGASSERT(xprt != NULL);
 	tmp = ((u_long) xprt->xp_p3) | SVC_VERSQUIET;
 	xprt->xp_p3 = (caddr_t) tmp;
+}
 void
 __svc_versquiet_off(SVCXPRT *xprt)
+{
 	u_long	tmp;
 	_DIAGASSERT(xprt != NULL);
 	tmp = ((u_long) xprt->xp_p3) & ~SVC_VERSQUIET;
 	xprt->xp_p3 = (caddr_t) tmp;
+}
 void
 svc_versquiet(SVCXPRT *xprt)
+{
 	__svc_versquiet_on(xprt);
+}
 int
 __svc_versquiet_get(SVCXPRT *xprt)
+{
 	_DIAGASSERT(xprt != NULL);
 	return ((int) xprt->xp_p3) & SVC_VERSQUIET;
+}
 #endif
 /*
  * Authentication error reply
  */
 void
 svcerr_auth(SVCXPRT *xprt, enum auth_stat why)
+{
 	struct rpc_msg rply;
 	_DIAGASSERT(xprt != NULL);
 	rply.rm_direction = REPLY;
 	rply.rm_reply.rp_stat = MSG_DENIED;
 	rply.rjcted_rply.rj_stat = AUTH_ERROR;
 	rply.rjcted_rply.rj_why = why;
 	SVC_REPLY(xprt, &rply);
+}
 /*
  * Auth too weak error reply
  */
 void
 svcerr_weakauth(SVCXPRT *xprt)
+{
 	_DIAGASSERT(xprt != NULL);
 	svcerr_auth(xprt, AUTH_TOOWEAK);
+}
 /*
  * Program unavailable error reply
  */
 void
 svcerr_noprog(SVCXPRT *xprt)
+{
 	struct rpc_msg rply;
 	_DIAGASSERT(xprt != NULL);
 	rply.rm_direction = REPLY;
 	rply.rm_reply.rp_stat = MSG_ACCEPTED;
 	rply.acpted_rply.ar_verf = xprt->xp_verf;
 	rply.acpted_rply.ar_stat = PROG_UNAVAIL;
 	SVC_REPLY(xprt, &rply);
+}
 /*
  * Program version mismatch error reply
  */
 void
 svcerr_progvers(SVCXPRT *xprt, rpcvers_t low_vers, rpcvers_t high_vers)
+{
 	struct rpc_msg rply;
 	_DIAGASSERT(xprt != NULL);
 	rply.rm_direction = REPLY;
 	rply.rm_reply.rp_stat = MSG_ACCEPTED;
 	rply.acpted_rply.ar_verf = xprt->xp_verf;
 	rply.acpted_rply.ar_stat = PROG_MISMATCH;
 	rply.acpted_rply.ar_vers.low = (u_int32_t)low_vers;
 	rply.acpted_rply.ar_vers.high = (u_int32_t)high_vers;
 	SVC_REPLY(xprt, &rply);
+}
 /* ******************* SERVER INPUT STUFF ******************* */
 /*
  * Get server side input from some transport.
+ *
  * Statement of authentication parameters management:
  * This function owns and manages all authentication parameters, specifically
  * the "raw" parameters (msg.rm_call.cb_cred and msg.rm_call.cb_verf) and
  * the "cooked" credentials (rqst->rq_clntcred).
  * However, this function does not know the structure of the cooked
  * credentials, so it make the following assumptions:
  *   a) the structure is contiguous (no pointers), and
  *   b) the cred structure size does not exceed RQCRED_SIZE bytes.
  * In all events, all three parameters are freed upon exit from this routine.
  * The storage is trivially management on the call stack in user land, but
  * is mallocated in kernel land.
  */
 void
 svc_getreq(int rdfds)
+{
 	fd_set *readfds = svc_fdset_copy(NULL);
 	if (readfds == NULL)
 		return;
 	readfds->fds_bits[0] = (unsigned int)rdfds;
 	svc_getreqset(readfds);
 	free(readfds);
+}
 void
 svc_getreqset2(fd_set *readfds, int maxsize)
+{
 	uint32_t mask, *maskp;
 	int sock, bit, fd;
 	_DIAGASSERT(readfds != NULL);
 	maskp = readfds->fds_bits;
 	for (sock = 0; sock < maxsize; sock += NFDBITS) {
 	    for (mask = *maskp++; (bit = ffs((int)mask)) != 0;
 		mask ^= (1 << (bit - 1))) {
 		/* sock has input waiting */
 		fd = sock + bit - 1;
 		svc_getreq_common(fd);
+	    }
+	}
+}
 void
 svc_getreqset(fd_set *readfds)
+{
 	svc_getreqset2(readfds, FD_SETSIZE);
+}
 void
 svc_getreq_common(int fd)
+{
 	SVCXPRT *xprt;
 	struct svc_req r;
 	struct rpc_msg msg;
 	int prog_found;
 	rpcvers_t low_vers;
 	rpcvers_t high_vers;
 	enum xprt_stat stat;
 	char cred_area[2*MAX_AUTH_BYTES + RQCRED_SIZE];
 	msg.rm_call.cb_cred.oa_base = cred_area;
 	msg.rm_call.cb_verf.oa_base = &(cred_area[MAX_AUTH_BYTES]);
 	r.rq_clntcred = &(cred_area[2*MAX_AUTH_BYTES]);
 	rwlock_rdlock(&svc_fd_lock);
 	xprt = __svc_xports[fd];
 	rwlock_unlock(&svc_fd_lock);
 	if (xprt == NULL)
 		/* But do we control sock? */
 		return;
 	/* now receive msgs from xprtprt (support batch calls) */
 	do {
 		if (SVC_RECV(xprt, &msg)) {
 			/* now find the exported program and call it */
 			struct svc_callout *s;
 			enum auth_stat why;
 			r.rq_xprt = xprt;
 			r.rq_prog = msg.rm_call.cb_prog;
 			r.rq_vers = msg.rm_call.cb_vers;
 			r.rq_proc = msg.rm_call.cb_proc;
 			r.rq_cred = msg.rm_call.cb_cred;
 			/* first authenticate the message */
 			if ((why = _authenticate(&r, &msg)) != AUTH_OK) {
 				svcerr_auth(xprt, why);
 				goto call_done;
+			}
 			/* now match message with a registered service*/
 			prog_found = FALSE;
 			low_vers = (rpcvers_t) -1L;
 			high_vers = (rpcvers_t) 0L;
 			for (s = svc_head; s != NULL; s = s->sc_next) {
 				if (s->sc_prog == r.rq_prog) {
 					if (s->sc_vers == r.rq_vers) {
 						(*s->sc_dispatch)(&r, xprt);
 						goto call_done;
 					}  /* found correct version */
 					prog_found = TRUE;
 					if (s->sc_vers < low_vers)
 						low_vers = s->sc_vers;
 					if (s->sc_vers > high_vers)
 						high_vers = s->sc_vers;
 				}   /* found correct program */
+			}
 			/*
 			 * if we got here, the program or version
 			 * is not served ...
 			 */
 			if (prog_found)
 				svcerr_progvers(xprt, low_vers, high_vers);
 			else
 				 svcerr_noprog(xprt);
 			/* Fall through to ... */
+		}
 		/*
 		 * Check if the xprt has been disconnected in a
 		 * recursive call in the service dispatch routine.
 		 * If so, then break.
 		 */
 		rwlock_rdlock(&svc_fd_lock);
 		if (xprt != __svc_xports[fd]) {
 			rwlock_unlock(&svc_fd_lock);
 			break;
+		}
 		rwlock_unlock(&svc_fd_lock);
 call_done:
 		if ((stat = SVC_STAT(xprt)) == XPRT_DIED){
 			SVC_DESTROY(xprt);
 			break;
+		}
 	} while (stat == XPRT_MOREREQS);
+}
 void
 svc_getreq_poll(struct pollfd *pfdp, int pollretval)
+{
 	int i;
 	int fds_found;
 	_DIAGASSERT(pfdp != NULL);
 	for (i = fds_found = 0; fds_found < pollretval; i++) {
 		struct pollfd *p = &pfdp[i];
 		if (p->revents) {
 			/* fd has input waiting */
 			fds_found++;
 			/*
 			 *	We assume that this function is only called
 			 *	via someone select()ing from svc_fdset or
 			 *	pollts()ing from svc_pollset[].  Thus it's safe
 			 *	to handle the POLLNVAL event by simply turning
-			 *	the corresponding bit off in svc_fdset.  The
+			 *	the corresponding bit off in the fdset.  The
 			 *	svc_pollset[] array is derived from svc_fdset
 			 *	and so will also be updated eventually.
+			 *
 			 *	XXX Should we do an xprt_unregister() instead?
 			 */
 			if (p->revents & POLLNVAL) {
 				rwlock_wrlock(&svc_fd_lock);
 				svc_fdset_clr(p->fd);
 				rwlock_unlock(&svc_fd_lock);
 			} else
 				svc_getreq_common(p->fd);
+		}
+	}
+}
 bool_t
 rpc_control(int what, void *arg)
+{
 	int val;
 	switch (what) {
 	case RPC_SVC_CONNMAXREC_SET:
 		val = *(int *)arg;
 		if (val <= 0)
 			return FALSE;
 		__svc_maxrec = val;
 		return TRUE;
 	case RPC_SVC_CONNMAXREC_GET:
 		*(int *)arg = __svc_maxrec;
 		return TRUE;
 	default:
 		break;
+	}
 	return FALSE;
+}

 @@ -1,809 +1,818 @@
-/*	$NetBSD: svc_vc.c,v 1.31 2015/11/06 19:34:13 christos Exp $	*/
+/*	$NetBSD: svc_vc.c,v 1.32 2015/11/07 17:34:33 christos Exp $	*/
 /*
  * Copyright (c) 2010, Oracle America, Inc.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
+ *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials
  *       provided with the distribution.
  *     * Neither the name of the "Oracle America, Inc." nor the names of its
  *       contributors may be used to endorse or promote products derived
  *       from this software without specific prior written permission.
+ *
  *   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  *   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  *   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  *   FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  *   COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
  *   INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  *   DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
  *   GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  *   INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
  *   WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  *   NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  *   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
 #if defined(LIBC_SCCS) && !defined(lint)
 #if 0
 static char *sccsid = "@(#)svc_tcp.c 1.21 87/08/11 Copyr 1984 Sun Micro";
 static char *sccsid = "@(#)svc_tcp.c	2.2 88/08/01 4.0 RPCSRC";
 #else
-__RCSID("$NetBSD: svc_vc.c,v 1.31 2015/11/06 19:34:13 christos Exp $");
+__RCSID("$NetBSD: svc_vc.c,v 1.32 2015/11/07 17:34:33 christos Exp $");
 #endif
 #endif
 /*
  * svc_vc.c, Server side for Connection Oriented based RPC.
+ *
  * Actually implements two flavors of transporter -
  * a tcp rendezvouser (a listner and connection establisher)
  * and a record/tcp stream.
  */
 #include "namespace.h"
 #include "reentrant.h"
 #include <sys/types.h>
 #include <sys/param.h>
 #include <sys/poll.h>
 #include <sys/socket.h>
 #include <sys/un.h>
 #include <sys/time.h>
 #include <netinet/in.h>
 #include <assert.h>
 #include <err.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
 #include <rpc/rpc.h>
 #include "svc_fdset.h"
 #include "rpc_internal.h"
 #ifdef __weak_alias
 __weak_alias(svc_fd_create,_svc_fd_create)
 __weak_alias(svc_vc_create,_svc_vc_create)
 #endif
 #ifdef _REENTRANT
 extern rwlock_t svc_fd_lock;
 #endif
 static SVCXPRT *makefd_xprt(int, u_int, u_int);
 static bool_t rendezvous_request(SVCXPRT *, struct rpc_msg *);
 static enum xprt_stat rendezvous_stat(SVCXPRT *);
 static void svc_vc_destroy(SVCXPRT *);
 static void __svc_vc_dodestroy(SVCXPRT *);
 static int read_vc(caddr_t, caddr_t, int);
 static int write_vc(caddr_t, caddr_t, int);
 static enum xprt_stat svc_vc_stat(SVCXPRT *);
 static bool_t svc_vc_recv(SVCXPRT *, struct rpc_msg *);
 static bool_t svc_vc_getargs(SVCXPRT *, xdrproc_t, caddr_t);
 static bool_t svc_vc_freeargs(SVCXPRT *, xdrproc_t, caddr_t);
 static bool_t svc_vc_reply(SVCXPRT *, struct rpc_msg *);
 static void svc_vc_rendezvous_ops(SVCXPRT *);
 static void svc_vc_ops(SVCXPRT *);
 static bool_t svc_vc_control(SVCXPRT *, const u_int, void *);
 static bool_t svc_vc_rendezvous_control(SVCXPRT *, const u_int, void *);
 struct cf_rendezvous { /* kept in xprt->xp_p1 for rendezvouser */
 	u_int sendsize;
 	u_int recvsize;
 	int maxrec;
 };
 struct cf_conn {  /* kept in xprt->xp_p1 for actual connection */
 	enum xprt_stat strm_stat;
 	u_int32_t x_id;
 	XDR xdrs;
 	char verf_body[MAX_AUTH_BYTES];
 	u_int sendsize;
 	u_int recvsize;
 	int maxrec;
 	bool_t nonblock;
 	struct timeval last_recv_time;
 };
 /*
  * Usage:
  *	xprt = svc_vc_create(sock, send_buf_size, recv_buf_size);
+ *
  * Creates, registers, and returns a (rpc) tcp based transporter.
  * Once *xprt is initialized, it is registered as a transporter
  * see (svc.h, xprt_register).  This routine returns
  * a NULL if a problem occurred.
+ *
  * The filedescriptor passed in is expected to refer to a bound, but
  * not yet connected socket.
+ *
  * Since streams do buffered io similar to stdio, the caller can specify
  * how big the send and receive buffers are via the second and third parms;
  * 0 => use the system default.
  */
 SVCXPRT *
 svc_vc_create(int fd, u_int sendsize, u_int recvsize)
+{
 	SVCXPRT *xprt;
 	struct cf_rendezvous *r = NULL;
 	struct __rpc_sockinfo si;
 	struct sockaddr_storage sslocal;
 	socklen_t slen;
 	int one = 1;
 	if (!__rpc_fd2sockinfo(fd, &si))
 		return NULL;
 	r = mem_alloc(sizeof(*r));
 	if (r == NULL) {
 		warn("%s: out of memory", __func__);
 		return NULL;
+	}
 	r->sendsize = __rpc_get_t_size(si.si_af, si.si_proto, (int)sendsize);
 	r->recvsize = __rpc_get_t_size(si.si_af, si.si_proto, (int)recvsize);
 	r->maxrec = __svc_maxrec;
 	xprt = mem_alloc(sizeof(SVCXPRT));
 	if (xprt == NULL) {
 		warn("%s: out of memory", __func__);
 		goto cleanup_svc_vc_create;
+	}
 	xprt->xp_tp = NULL;
 	xprt->xp_p1 = (caddr_t)(void *)r;
 	xprt->xp_p2 = NULL;
 	xprt->xp_p3 = NULL;
 	xprt->xp_verf = _null_auth;
 	svc_vc_rendezvous_ops(xprt);
 	xprt->xp_port = (u_short)-1;	/* It is the rendezvouser */
 	xprt->xp_fd = fd;
 	slen = sizeof (struct sockaddr_storage);
 	if (getsockname(fd, (struct sockaddr *)(void *)&sslocal, &slen) < 0) {
 		warn("%s: could not retrieve local addr", __func__);
 		goto cleanup_svc_vc_create;
+	}
 	/*
 	 * We want to be able to check credentials on local sockets.
 	 */
 	if (sslocal.ss_family == AF_LOCAL)
 		if (setsockopt(fd, 0, LOCAL_CREDS, &one, (socklen_t)sizeof one)
 		    == -1)
 			goto cleanup_svc_vc_create;
 	xprt->xp_ltaddr.maxlen = xprt->xp_ltaddr.len = sslocal.ss_len;
 	xprt->xp_ltaddr.buf = mem_alloc((size_t)sslocal.ss_len);
 	if (xprt->xp_ltaddr.buf == NULL) {
 		warn("%s: out of memory", __func__);
 		goto cleanup_svc_vc_create;
+	}
 	memcpy(xprt->xp_ltaddr.buf, &sslocal, (size_t)sslocal.ss_len);
 	xprt->xp_rtaddr.maxlen = sizeof (struct sockaddr_storage);
 	if (!xprt_register(xprt))
 		goto cleanup_svc_vc_create;
 	return xprt;
 cleanup_svc_vc_create:
 	if (xprt)
 		mem_free(xprt, sizeof(*xprt));
 	if (r != NULL)
 		mem_free(r, sizeof(*r));
 	return NULL;
+}
 /*
  * Like svtcp_create(), except the routine takes any *open* UNIX file
  * descriptor as its first input.
  */
 SVCXPRT *
 svc_fd_create(int fd, u_int sendsize, u_int recvsize)
+{
 	struct sockaddr_storage ss;
 	socklen_t slen;
 	SVCXPRT *ret;
 	_DIAGASSERT(fd != -1);
 	ret = makefd_xprt(fd, sendsize, recvsize);
 	if (ret == NULL)
 		return NULL;
 	slen = sizeof (struct sockaddr_storage);
 	if (getsockname(fd, (struct sockaddr *)(void *)&ss, &slen) < 0) {
 		warn("%s: could not retrieve local addr", __func__);
 		goto freedata;
+	}
 	ret->xp_ltaddr.maxlen = ret->xp_ltaddr.len = ss.ss_len;
 	ret->xp_ltaddr.buf = mem_alloc((size_t)ss.ss_len);
 	if (ret->xp_ltaddr.buf == NULL) {
 		warn("%s: out of memory", __func__);
 		goto freedata;
+	}
 	memcpy(ret->xp_ltaddr.buf, &ss, (size_t)ss.ss_len);
 	slen = sizeof (struct sockaddr_storage);
 	if (getpeername(fd, (struct sockaddr *)(void *)&ss, &slen) < 0) {
 		warn("%s: could not retrieve remote addr", __func__);
 		goto freedata;
+	}
 	ret->xp_rtaddr.maxlen = ret->xp_rtaddr.len = ss.ss_len;
 	ret->xp_rtaddr.buf = mem_alloc((size_t)ss.ss_len);
 	if (ret->xp_rtaddr.buf == NULL) {
 		warn("%s: out of memory", __func__);
 		goto freedata;
+	}
 	memcpy(ret->xp_rtaddr.buf, &ss, (size_t)ss.ss_len);
 #ifdef PORTMAP
 	if (ss.ss_family == AF_INET) {
 		ret->xp_raddr = *(struct sockaddr_in *)ret->xp_rtaddr.buf;
 		ret->xp_addrlen = sizeof (struct sockaddr_in);
+	}
 #endif
 	return ret;
 freedata:
 	if (ret->xp_ltaddr.buf != NULL)
 		mem_free(ret->xp_ltaddr.buf, rep->xp_ltaddr.maxlen);
 	return NULL;
+}
 static SVCXPRT *
 makefd_xprt(int fd, u_int sendsize, u_int recvsize)
+{
 	SVCXPRT *xprt;
 	struct cf_conn *cd;
 	const char *netid;
 	struct __rpc_sockinfo si;
 	_DIAGASSERT(fd != -1);
 	xprt = mem_alloc(sizeof(SVCXPRT));
 	if (xprt == NULL)
 		goto outofmem;
 	memset(xprt, 0, sizeof *xprt);
 	cd = mem_alloc(sizeof(struct cf_conn));
 	if (cd == NULL)
 		goto outofmem;
 	cd->strm_stat = XPRT_IDLE;
 	xdrrec_create(&(cd->xdrs), sendsize, recvsize,
 	    (caddr_t)(void *)xprt, read_vc, write_vc);
 	xprt->xp_p1 = (caddr_t)(void *)cd;
 	xprt->xp_verf.oa_base = cd->verf_body;
 	svc_vc_ops(xprt);  /* truely deals with calls */
 	xprt->xp_port = 0;  /* this is a connection, not a rendezvouser */
 	xprt->xp_fd = fd;
 	if (__rpc_fd2sockinfo(fd, &si) && __rpc_sockinfo2netid(&si, &netid))
 		if ((xprt->xp_netid = strdup(netid)) == NULL)
 			goto outofmem;
 	if (!xprt_register(xprt))
 		goto out;
 	return xprt;
 outofmem:
 	warn("svc_tcp: makefd_xprt");
 out:
 	if (xprt)
 		mem_free(xprt, sizeof(SVCXPRT));
 	return NULL;
+}
 /*ARGSUSED*/
 static bool_t
 rendezvous_request(SVCXPRT *xprt, struct rpc_msg *msg)
+{
 	int sock, flags;
 	struct cf_rendezvous *r;
 	struct cf_conn *cd;
 	struct sockaddr_storage addr;
 	socklen_t len;
 	struct __rpc_sockinfo si;
 	SVCXPRT *newxprt;
 	_DIAGASSERT(xprt != NULL);
 	_DIAGASSERT(msg != NULL);
 	r = (struct cf_rendezvous *)xprt->xp_p1;
 again:
 	len = sizeof addr;
 	if ((sock = accept(xprt->xp_fd, (struct sockaddr *)(void *)&addr,
 	    &len)) < 0) {
 		if (errno == EINTR)
 			goto again;
 		/*
 		 * Clean out the most idle file descriptor when we're
 		 * running out.
 		 */
 		if (errno == EMFILE || errno == ENFILE) {
 			fd_set *cleanfds = svc_fdset_copy(svc_fdset_get());
-			int rv = __svc_clean_idle(cleanfds, 0, FALSE);
+			int rv = 0;
 			if (cleanfds)
 				rv = __svc_clean_idle(cleanfds, 0, FALSE);
 			free(cleanfds);
 			if (rv)
 				goto again;
+		}
 		return FALSE;
+	}
 	/*
 	 * make a new transporter (re-uses xprt)
 	 */
 	newxprt = makefd_xprt(sock, r->sendsize, r->recvsize);
 	if (newxprt == NULL)
 		goto out;
 	newxprt->xp_rtaddr.buf = mem_alloc(len);
 	if (newxprt->xp_rtaddr.buf == NULL)
 		goto out;
 	memcpy(newxprt->xp_rtaddr.buf, &addr, len);
 	newxprt->xp_rtaddr.len = len;
 #ifdef PORTMAP
 	if (addr.ss_family == AF_INET) {
 		newxprt->xp_raddr = *(struct sockaddr_in *)newxprt->xp_rtaddr.buf;
 		newxprt->xp_addrlen = sizeof (struct sockaddr_in);
+	}
 #endif
 	if (__rpc_fd2sockinfo(sock, &si))
 		__rpc_setnodelay(sock, &si);
 	cd = (struct cf_conn *)newxprt->xp_p1;
 	cd->recvsize = r->recvsize;
 	cd->sendsize = r->sendsize;
 	cd->maxrec = r->maxrec;
 	if (cd->maxrec != 0) {
 		flags = fcntl(sock, F_GETFL, 0);
 		if (flags  == -1)
 			goto out;
 		if (fcntl(sock, F_SETFL, flags | O_NONBLOCK) == -1)
 			goto out;
 		if (cd->recvsize > (u_int)cd->maxrec)
 			cd->recvsize = cd->maxrec;
 		cd->nonblock = TRUE;
 		__xdrrec_setnonblock(&cd->xdrs, cd->maxrec);
 	} else
 		cd->nonblock = FALSE;
 	(void)gettimeofday(&cd->last_recv_time, NULL);
 	return FALSE; /* there is never an rpc msg to be processed */
 out:
 	(void)close(sock);
 	return FALSE; /* there was an error */
+}
 /*ARGSUSED*/
 static enum xprt_stat
 rendezvous_stat(SVCXPRT *xprt)
+{
 	return XPRT_IDLE;
+}
 static void
 svc_vc_destroy(SVCXPRT *xprt)
+{
 	_DIAGASSERT(xprt != NULL);
 	xprt_unregister(xprt);
 	__svc_vc_dodestroy(xprt);
+}
 static void
 __svc_vc_dodestroy(SVCXPRT *xprt)
+{
 	struct cf_conn *cd;
 	struct cf_rendezvous *r;
 	cd = (struct cf_conn *)xprt->xp_p1;
 	if (xprt->xp_fd != RPC_ANYFD)
 		(void)close(xprt->xp_fd);
 	if (xprt->xp_port != 0) {
 		/* a rendezvouser socket */
 		r = (struct cf_rendezvous *)xprt->xp_p1;
 		mem_free(r, sizeof (struct cf_rendezvous));
 		xprt->xp_port = 0;
 	} else {
 		/* an actual connection socket */
 		XDR_DESTROY(&(cd->xdrs));
 		mem_free(cd, sizeof(struct cf_conn));
+	}
 	if (xprt->xp_rtaddr.buf)
 		mem_free(xprt->xp_rtaddr.buf, xprt->xp_rtaddr.maxlen);
 	if (xprt->xp_ltaddr.buf)
 		mem_free(xprt->xp_ltaddr.buf, xprt->xp_ltaddr.maxlen);
 	if (xprt->xp_tp)
 		free(xprt->xp_tp);
 	if (xprt->xp_netid)
 		free(xprt->xp_netid);
 	mem_free(xprt, sizeof(SVCXPRT));
+}
 /*ARGSUSED*/
 static bool_t
 svc_vc_control(SVCXPRT *xprt, const u_int rq, void *in)
+{
 	return FALSE;
+}
 /*ARGSUSED*/
 static bool_t
 svc_vc_rendezvous_control(SVCXPRT *xprt, const u_int rq, void *in)
+{
 	struct cf_rendezvous *cfp;
 	cfp = (struct cf_rendezvous *)xprt->xp_p1;
 	if (cfp == NULL)
 		return FALSE;
 	switch (rq) {
 		case SVCGET_CONNMAXREC:
 			*(int *)in = cfp->maxrec;
 			break;
 		case SVCSET_CONNMAXREC:
 			cfp->maxrec = *(int *)in;
 			break;
 		default:
 			return FALSE;
+	}
 	return TRUE;
+}
 /*
  * reads data from the tcp connection.
  * any error is fatal and the connection is closed.
  * (And a read of zero bytes is a half closed stream => error.)
  * All read operations timeout after 35 seconds.  A timeout is
  * fatal for the connection.
  */
 static int
 read_vc(caddr_t xprtp, caddr_t buf, int len)
+{
 	SVCXPRT *xprt;
 	int sock;
 	struct pollfd pollfd;
 	struct sockaddr *sa;
 	struct msghdr msg;
 	struct cmsghdr *cmp;
 	void *crmsg = NULL;
 	struct sockcred *sc;
 	socklen_t crmsgsize;
 	struct cf_conn *cfp;
 	static const struct timespec ts = { 35, 0 };
 	xprt = (SVCXPRT *)(void *)xprtp;
 	_DIAGASSERT(xprt != NULL);
 	sock = xprt->xp_fd;
 	sa = (struct sockaddr *)xprt->xp_rtaddr.buf;
 	if (sa->sa_family == AF_LOCAL && xprt->xp_p2 == NULL) {
 		memset(&msg, 0, sizeof msg);
 		crmsgsize = CMSG_SPACE(SOCKCREDSIZE(NGROUPS));
 		crmsg = malloc(crmsgsize);
 		if (crmsg == NULL)
 			goto fatal_err;
 		memset(crmsg, 0, crmsgsize);
 		msg.msg_control = crmsg;
 		msg.msg_controllen = crmsgsize;
 		if (recvmsg(sock, &msg, 0) < 0)
 			goto fatal_err;
 		if (msg.msg_controllen == 0 ||
 		    (msg.msg_flags & MSG_CTRUNC) != 0)
 			goto fatal_err;
 		cmp = CMSG_FIRSTHDR(&msg);
 		if (cmp->cmsg_level != SOL_SOCKET ||
 		    cmp->cmsg_type != SCM_CREDS)
 			goto fatal_err;
 		sc = (struct sockcred *)(void *)CMSG_DATA(cmp);
 		xprt->xp_p2 = mem_alloc(SOCKCREDSIZE(sc->sc_ngroups));
 		if (xprt->xp_p2 == NULL)
 			goto fatal_err;
 		memcpy(xprt->xp_p2, sc, SOCKCREDSIZE(sc->sc_ngroups));
 		free(crmsg);
 		crmsg = NULL;
+	}
 	cfp = (struct cf_conn *)xprt->xp_p1;
 	if (cfp->nonblock) {
 		len = (int)read(sock, buf, (size_t)len);
 		if (len < 0) {
 			if (errno == EAGAIN)
 				len = 0;
 			else
 				goto fatal_err;
+		}
 		if (len != 0)
 			gettimeofday(&cfp->last_recv_time, NULL);
 		return len;
+	}
 	do {
 		pollfd.fd = sock;
 		pollfd.events = POLLIN;
 		switch (pollts(&pollfd, 1, &ts, NULL)) {
 		case -1:
 			if (errno == EINTR) {
 				continue;
+			}
 			/*FALLTHROUGH*/
 		case 0:
 			goto fatal_err;
 		default:
 			break;
+		}
 	} while ((pollfd.revents & POLLIN) == 0);
 	if ((len = (int)read(sock, buf, (size_t)len)) > 0) {
 		gettimeofday(&cfp->last_recv_time, NULL);
 		return len;
+	}
 fatal_err:
 	if (crmsg != NULL)
 		free(crmsg);
 	((struct cf_conn *)(xprt->xp_p1))->strm_stat = XPRT_DIED;
 	return -1;
+}
 /*
  * writes data to the tcp connection.
  * Any error is fatal and the connection is closed.
  */
 static int
 write_vc(caddr_t xprtp, caddr_t buf, int len)
+{
 	SVCXPRT *xprt;
 	int i, cnt;
 	struct cf_conn *cd;
 	struct timeval tv0, tv1;
 	xprt = (SVCXPRT *)(void *)xprtp;
 	_DIAGASSERT(xprt != NULL);
 	cd = (struct cf_conn *)xprt->xp_p1;
 	if (cd->nonblock)
 		gettimeofday(&tv0, NULL);
 	for (cnt = len; cnt > 0; cnt -= i, buf += i) {
 		if ((i = (int)write(xprt->xp_fd, buf, (size_t)cnt)) < 0) {
 			if (errno != EAGAIN || !cd->nonblock) {
 				cd->strm_stat = XPRT_DIED;
 				return -1;
+			}
 			if (cd->nonblock) {
 				/*
 				 * For non-blocking connections, do not
 				 * take more than 2 seconds writing the
 				 * data out.
+				 *
 				 * XXX 2 is an arbitrary amount.
 				 */
 				gettimeofday(&tv1, NULL);
 				if (tv1.tv_sec - tv0.tv_sec >= 2) {
 					cd->strm_stat = XPRT_DIED;
 					return -1;
+				}
+			}
 			i = 0;
+		}
+	}
 	return len;
+}
 static enum xprt_stat
 svc_vc_stat(SVCXPRT *xprt)
+{
 	struct cf_conn *cd;
 	_DIAGASSERT(xprt != NULL);
 	cd = (struct cf_conn *)(xprt->xp_p1);
 	if (cd->strm_stat == XPRT_DIED)
 		return XPRT_DIED;
 	if (! xdrrec_eof(&(cd->xdrs)))
 		return XPRT_MOREREQS;
 	return XPRT_IDLE;
+}
 static bool_t
 svc_vc_recv(SVCXPRT *xprt, struct rpc_msg *msg)
+{
 	struct cf_conn *cd;
 	XDR *xdrs;
 	_DIAGASSERT(xprt != NULL);
 	_DIAGASSERT(msg != NULL);
 	cd = (struct cf_conn *)(xprt->xp_p1);
 	xdrs = &(cd->xdrs);
 	if (cd->nonblock) {
 		if (!__xdrrec_getrec(xdrs, &cd->strm_stat, TRUE))
 			return FALSE;
+	}
 	xdrs->x_op = XDR_DECODE;
 	(void)xdrrec_skiprecord(xdrs);
 	if (xdr_callmsg(xdrs, msg)) {
 		cd->x_id = msg->rm_xid;
 		return TRUE;
+	}
 	cd->strm_stat = XPRT_DIED;
 	return FALSE;
+}
 static bool_t
 svc_vc_getargs(SVCXPRT *xprt, xdrproc_t xdr_args, caddr_t args_ptr)
+{
 	_DIAGASSERT(xprt != NULL);
 	/* args_ptr may be NULL */
 	return (*xdr_args)(&(((struct cf_conn *)(xprt->xp_p1))->xdrs),
 	    args_ptr);
+}
 static bool_t
 svc_vc_freeargs(SVCXPRT *xprt, xdrproc_t xdr_args, caddr_t args_ptr)
+{
 	XDR *xdrs;
 	_DIAGASSERT(xprt != NULL);
 	/* args_ptr may be NULL */
 	xdrs = &(((struct cf_conn *)(xprt->xp_p1))->xdrs);
 	xdrs->x_op = XDR_FREE;
 	return (*xdr_args)(xdrs, args_ptr);
+}
 static bool_t
 svc_vc_reply(SVCXPRT *xprt, struct rpc_msg *msg)
+{
 	struct cf_conn *cd;
 	XDR *xdrs;
 	bool_t rstat;
 	_DIAGASSERT(xprt != NULL);
 	_DIAGASSERT(msg != NULL);
 	cd = (struct cf_conn *)(xprt->xp_p1);
 	xdrs = &(cd->xdrs);
 	xdrs->x_op = XDR_ENCODE;
 	msg->rm_xid = cd->x_id;
 	rstat = xdr_replymsg(xdrs, msg);
 	(void)xdrrec_endofrecord(xdrs, TRUE);
 	return rstat;
+}
 static void
 svc_vc_ops(SVCXPRT *xprt)
+{
 	static struct xp_ops ops;
 	static struct xp_ops2 ops2;
 #ifdef _REENTRANT
 	extern mutex_t ops_lock;
 #endif
 /* VARIABLES PROTECTED BY ops_lock: ops, ops2 */
 	mutex_lock(&ops_lock);
 	if (ops.xp_recv == NULL) {
 		ops.xp_recv = svc_vc_recv;
 		ops.xp_stat = svc_vc_stat;
 		ops.xp_getargs = svc_vc_getargs;
 		ops.xp_reply = svc_vc_reply;
 		ops.xp_freeargs = svc_vc_freeargs;
 		ops.xp_destroy = svc_vc_destroy;
 		ops2.xp_control = svc_vc_control;
+	}
 	xprt->xp_ops = &ops;
 	xprt->xp_ops2 = &ops2;
 	mutex_unlock(&ops_lock);
+}
 static void
 svc_vc_rendezvous_ops(SVCXPRT *xprt)
+{
 	static struct xp_ops ops;
 	static struct xp_ops2 ops2;
 #ifdef _REENTRANT
 	extern mutex_t ops_lock;
 #endif
 	mutex_lock(&ops_lock);
 	if (ops.xp_recv == NULL) {
 		ops.xp_recv = rendezvous_request;
 		ops.xp_stat = rendezvous_stat;
 		ops.xp_getargs =
 		    (bool_t (*)(SVCXPRT *, xdrproc_t, caddr_t))abort;
 		ops.xp_reply =
 		    (bool_t (*)(SVCXPRT *, struct rpc_msg *))abort;
 		ops.xp_freeargs =
 		    (bool_t (*)(SVCXPRT *, xdrproc_t, caddr_t))abort;
 		ops.xp_destroy = svc_vc_destroy;
 		ops2.xp_control = svc_vc_rendezvous_control;
+	}
 	xprt->xp_ops = &ops;
 	xprt->xp_ops2 = &ops2;
 	mutex_unlock(&ops_lock);
+}
 /*
  * Destroy xprts that have not have had any activity in 'timeout' seconds.
  * If 'cleanblock' is true, blocking connections (the default) are also
  * cleaned. If timeout is 0, the least active connection is picked.
  */
 bool_t
 __svc_clean_idle(fd_set *fds, int timeout, bool_t cleanblock)
+{
-	int i, ncleaned, fdmax;
+	int i, ncleaned, *fdmax;
 	SVCXPRT *xprt, *least_active;
 	struct timeval tv, tdiff, tmax;
 	struct cf_conn *cd;
 	gettimeofday(&tv, NULL);
 	tmax.tv_sec = tmax.tv_usec = 0;
 	least_active = NULL;
 	rwlock_wrlock(&svc_fd_lock);
-	fdmax = *svc_fdset_getmax();
+	fdmax = svc_fdset_getmax();
-	for (i = ncleaned = 0; i <= fdmax; i++) {
+	if (fdmax == NULL)
-		if (!svc_fdset_isset(i))
+		return FALSE;
 	for (i = ncleaned = 0; i <= *fdmax; i++) {
 		switch (svc_fdset_isset(i)) {
 		case 0:
 		case -1:
 			continue;
 		default:
 			break;
+		}
 		xprt = __svc_xports[i];
 		if (xprt == NULL || xprt->xp_ops == NULL ||
 		    xprt->xp_ops->xp_recv != svc_vc_recv)
 			continue;
 		cd = (struct cf_conn *)xprt->xp_p1;
 		if (!cleanblock && !cd->nonblock)
 			continue;
 		if (timeout == 0) {
 			timersub(&tv, &cd->last_recv_time, &tdiff);
 			if (timercmp(&tdiff, &tmax, >)) {
 				tmax = tdiff;
 				least_active = xprt;
+			}
 			continue;
+		}
 		if (tv.tv_sec - cd->last_recv_time.tv_sec > timeout) {
 			__xprt_unregister_unlocked(xprt);
 			__svc_vc_dodestroy(xprt);
 			ncleaned++;
+		}
+	}
 	if (timeout == 0 && least_active != NULL) {
 		__xprt_unregister_unlocked(least_active);
 		__svc_vc_dodestroy(least_active);
 		ncleaned++;
+	}
 	rwlock_unlock(&svc_fd_lock);
 	return ncleaned > 0 ? TRUE : FALSE;
+}