BDB 4.1.24

8 files changed, 1971 insertions, 630 deletions

diff --git a/bdb/txn/txn.c b/bdb/txn/txn.c
index 0f6d894c19b..06fc8264afd 100644
--- a/bdb/txn/txn.c
+++ b/bdb/txn/txn.c
@@ -1,7 +1,7 @@
 /*-
  * See the file LICENSE for redistribution information.
  *
- * Copyright (c) 1996, 1997, 1998, 1999, 2000
+ * Copyright (c) 1996-2002
  *	Sleepycat Software.  All rights reserved.
  */
 /*
@@ -39,11 +39,12 @@
 #include "db_config.h"
 
 #ifndef lint
-static const char revid[] = "$Id: txn.c,v 11.61 2001/01/10 18:18:52 bostic Exp $";
+static const char revid[] = "$Id: txn.c,v 11.179 2002/08/29 17:41:17 margo Exp $";
 #endif /* not lint */
 
 #ifndef NO_SYSTEM_INCLUDES
 #include <sys/types.h>
+#include <stdlib.h>
 
 #if TIME_WITH_SYS_TIME
 #include <sys/time.h>
@@ -59,58 +60,129 @@ static const char revid[] = "$Id: txn.c,v 11.61 2001/01/10 18:18:52 bostic Exp $
 #include <string.h>
 #endif
 
-#ifdef  HAVE_RPC
-#include "db_server.h"
-#endif
-
 #include "db_int.h"
-#include "db_shash.h"
-#include "txn.h"
-#include "lock.h"
-#include "log.h"
-#include "db_dispatch.h"
-#include "db_page.h"
-#include "db_ext.h"
-
-#ifdef HAVE_RPC
-#include "gen_client_ext.h"
-#include "rpc_client_ext.h"
-#endif
+#include "dbinc/crypto.h"
+#include "dbinc/hmac.h"
+#include "dbinc/db_page.h"
+#include "dbinc/db_shash.h"
+#include "dbinc/hash.h"
+#include "dbinc/lock.h"
+#include "dbinc/log.h"
+#include "dbinc/txn.h"
+
+#define	SET_LOG_FLAGS(dbenv, txnp, lflags)				\
+	do {								\
+		lflags = DB_COMMIT | DB_PERMANENT;			\
+		if (F_ISSET(txnp, TXN_SYNC))				\
+			lflags |= DB_FLUSH;				\
+		else if (!F_ISSET(txnp, TXN_NOSYNC) &&			\
+		    !F_ISSET(dbenv, DB_ENV_TXN_NOSYNC)) {		\
+			if (F_ISSET(dbenv, DB_ENV_TXN_WRITE_NOSYNC))	\
+				lflags |= DB_WRNOSYNC;			\
+			else						\
+				lflags |= DB_FLUSH;			\
+		}							\
+	} while (0)
 
-static int  __txn_begin __P((DB_TXN *));
-static int  __txn_isvalid __P((const DB_TXN *, TXN_DETAIL **, u_int32_t));
+/*
+ * __txn_isvalid enumerated types.  We cannot simply use the transaction
+ * statuses, because different statuses need to be handled differently
+ * depending on the caller.
+ */
+typedef enum {
+	TXN_OP_ABORT,
+	TXN_OP_COMMIT,
+	TXN_OP_DISCARD,
+	TXN_OP_PREPARE
+} txnop_t;
+
+static int  __txn_begin_int __P((DB_TXN *, int));
+static int  __txn_end __P((DB_TXN *, int));
+static int  __txn_isvalid __P((const DB_TXN *, TXN_DETAIL **, txnop_t));
+static int  __txn_set_timeout __P(( DB_TXN *, db_timeout_t, u_int32_t));
 static int  __txn_undo __P((DB_TXN *));
 
+#ifndef db_create
 /*
+ * txn_abort --
  * txn_begin --
- *	This is a wrapper to the actual begin process.  Normal txn_begin()
- * allocates a DB_TXN structure for the caller, while txn_xa_begin() does
- * not.  Other than that, both call into the common __txn_begin code().
+ * txn_commit --
+ *
+ * When we switched to methods in 4.0, we guessed txn_{abort,begin,commit}
+ * were the interfaces applications would likely use and not be willing to
+ * change, due to the sheer volume of the calls.  Provide wrappers -- we
+ * could do txn_abort and txn_commit using macros, but not txn_begin, as
+ * the name of the field is txn_begin, we didn't want to modify it.
+ *
+ * The issue with txn_begin hits us in another way.  If configured with the
+ * --with-uniquename option, we use #defines to re-define DB's interfaces
+ * to unique names.  We can't do that for these functions because txn_begin
+ * is also a field name in the DB_ENV structure, and the #defines we use go
+ * at the end of the db.h file -- we get control too late to #define a field
+ * name.  So, modify the script that generates the unique names #defines to
+ * not generate them for these three functions, and don't include the three
+ * functions in libraries built with that configuration option.
+ *
+ * EXTERN: int txn_abort __P((DB_TXN *));
+ * EXTERN: int txn_begin __P((DB_ENV *, DB_TXN *, DB_TXN **, u_int32_t));
+ * EXTERN: int txn_commit __P((DB_TXN *, u_int32_t));
+ */
+int
+txn_abort(txnp)
+	DB_TXN *txnp;
+{
+	return (txnp->abort(txnp));
+}
+
+int
+txn_begin(dbenv, parent, txnpp, flags)
+	DB_ENV *dbenv;
+	DB_TXN *parent, **txnpp;
+	u_int32_t flags;
+{
+	return (dbenv->txn_begin(dbenv, parent, txnpp, flags));
+}
+
+int
+txn_commit(txnp, flags)
+	DB_TXN *txnp;
+	u_int32_t flags;
+{
+	return (txnp->commit(txnp, flags));
+}
+#endif /* !db_create */
+
+/*
+ * __txn_begin --
+ *	This is a wrapper to the actual begin process.  Normal transaction
+ * begin allocates a DB_TXN structure for the caller, while XA transaction
+ * begin does not.  Other than that, both call into common __txn_begin_int
+ * code.
  *
  * Internally, we use TXN_DETAIL structures, but the DB_TXN structure
  * provides access to the transaction ID and the offset in the transaction
  * region of the TXN_DETAIL structure.
+ *
+ * PUBLIC: int __txn_begin __P((DB_ENV *, DB_TXN *, DB_TXN **, u_int32_t));
  */
 int
-txn_begin(dbenv, parent, txnpp, flags)
+__txn_begin(dbenv, parent, txnpp, flags)
 	DB_ENV *dbenv;
 	DB_TXN *parent, **txnpp;
 	u_int32_t flags;
 {
+	DB_LOCKREGION *region;
 	DB_TXN *txn;
 	int ret;
 
-#ifdef HAVE_RPC
-	if (F_ISSET(dbenv, DB_ENV_RPCCLIENT))
-		return (__dbcl_txn_begin(dbenv, parent, txnpp, flags));
-#endif
-
+	*txnpp = NULL;
 	PANIC_CHECK(dbenv);
-	ENV_REQUIRES_CONFIG(dbenv, dbenv->tx_handle, DB_INIT_TXN);
+	ENV_REQUIRES_CONFIG(dbenv, dbenv->tx_handle, "txn_begin", DB_INIT_TXN);
 
 	if ((ret = __db_fchk(dbenv,
 	    "txn_begin", flags,
-	    DB_TXN_NOWAIT | DB_TXN_NOSYNC | DB_TXN_SYNC)) != 0)
+	    DB_DIRTY_READ | DB_TXN_NOWAIT |
+	    DB_TXN_NOSYNC | DB_TXN_SYNC)) != 0)
 		return (ret);
 	if ((ret = __db_fcchk(dbenv,
 	    "txn_begin", flags, DB_TXN_NOSYNC, DB_TXN_SYNC)) != 0)
@@ -122,7 +194,10 @@ txn_begin(dbenv, parent, txnpp, flags)
 	txn->mgrp = dbenv->tx_handle;
 	txn->parent = parent;
 	TAILQ_INIT(&txn->kids);
+	TAILQ_INIT(&txn->events);
 	txn->flags = TXN_MALLOC;
+	if (LF_ISSET(DB_DIRTY_READ))
+		F_SET(txn, TXN_DIRTY_READ);
 	if (LF_ISSET(DB_TXN_NOSYNC))
 		F_SET(txn, TXN_NOSYNC);
 	if (LF_ISSET(DB_TXN_SYNC))
@@ -130,15 +205,41 @@ txn_begin(dbenv, parent, txnpp, flags)
 	if (LF_ISSET(DB_TXN_NOWAIT))
 		F_SET(txn, TXN_NOWAIT);
 
-	if ((ret = __txn_begin(txn)) != 0) {
-		__os_free(txn, sizeof(DB_TXN));
-		txn = NULL;
-	}
+	if ((ret = __txn_begin_int(txn, 0)) != 0)
+		goto err;
 
-	if (txn != NULL && parent != NULL)
+	if (parent != NULL)
 		TAILQ_INSERT_HEAD(&parent->kids, txn, klinks);
 
+	if (LOCKING_ON(dbenv)) {
+		region = ((DB_LOCKTAB *)dbenv->lk_handle)->reginfo.primary;
+		if (parent != NULL) {
+			ret = __lock_inherit_timeout(dbenv,
+			    parent->txnid, txn->txnid);
+			/* No parent locker set yet. */
+			if (ret == EINVAL) {
+				parent = NULL;
+				ret = 0;
+			}
+			if (ret != 0)
+				goto err;
+		}
+
+		/*
+		 * Parent is NULL if we have no parent
+		 * or it has no timeouts set.
+		 */
+		if (parent == NULL && region->tx_timeout != 0)
+			if ((ret = __lock_set_timeout(dbenv, txn->txnid,
+			    region->tx_timeout, DB_SET_TXN_TIMEOUT)) != 0)
+				goto err;
+	}
+
 	*txnpp = txn;
+	return (0);
+
+err:
+	__os_free(dbenv, txn);
 	return (ret);
 }
 
@@ -158,26 +259,60 @@ __txn_xa_begin(dbenv, txn)
 	memset(txn, 0, sizeof(DB_TXN));
 
 	txn->mgrp = dbenv->tx_handle;
+	TAILQ_INIT(&txn->kids);
+	TAILQ_INIT(&txn->events);
 
-	return (__txn_begin(txn));
+	return (__txn_begin_int(txn, 0));
 }
 
 /*
- * __txn_begin --
+ * __txn_compensate_begin
+ *	Begin an compensation transaction.  This is a special interface
+ * that is used only for transactions that must be started to compensate
+ * for actions during an abort.  Currently only used for allocations.
+ *
+ * PUBLIC: int __txn_compensate_begin __P((DB_ENV *, DB_TXN **txnp));
+ */
+int
+__txn_compensate_begin(dbenv, txnpp)
+	DB_ENV *dbenv;
+	DB_TXN **txnpp;
+{
+	DB_TXN *txn;
+	int ret;
+
+	PANIC_CHECK(dbenv);
+
+	if ((ret = __os_calloc(dbenv, 1, sizeof(DB_TXN), &txn)) != 0)
+		return (ret);
+
+	txn->mgrp = dbenv->tx_handle;
+	TAILQ_INIT(&txn->kids);
+	TAILQ_INIT(&txn->events);
+	txn->flags = TXN_MALLOC;
+	F_SET(txn, TXN_COMPENSATE);
+
+	*txnpp = txn;
+	return (__txn_begin_int(txn, 1));
+}
+
+/*
+ * __txn_begin_int --
  *	Normal DB version of txn_begin.
  */
 static int
-__txn_begin(txn)
+__txn_begin_int(txn, internal)
 	DB_TXN *txn;
+	int internal;
 {
 	DB_ENV *dbenv;
-	DB_LSN begin_lsn;
+	DB_LSN begin_lsn, null_lsn;
 	DB_TXNMGR *mgr;
 	DB_TXNREGION *region;
 	TXN_DETAIL *td;
 	size_t off;
-	u_int32_t id;
-	int ret;
+	u_int32_t id, *ids;
+	int nids, ret;
 
 	mgr = txn->mgrp;
 	dbenv = mgr->dbenv;
@@ -188,36 +323,73 @@ __txn_begin(txn)
 	 * need never write records for read-only transactions).  However,
 	 * we do need to find the current LSN so that we can store it in the
 	 * transaction structure, so we can know where to take checkpoints.
+	 *
+	 * XXX
+	 * We should set this value when we write the first log record, not
+	 * here.
 	 */
-	if (LOGGING_ON(dbenv) &&
-	    (ret = log_put(dbenv, &begin_lsn, NULL, DB_CURLSN)) != 0)
-		goto err2;
+	if (DBENV_LOGGING(dbenv))
+		__log_txn_lsn(dbenv, &begin_lsn, NULL, NULL);
 
 	R_LOCK(dbenv, &mgr->reginfo);
+	if (!F_ISSET(txn, TXN_COMPENSATE) && F_ISSET(region, TXN_IN_RECOVERY)) {
+		__db_err(dbenv, "operation not permitted during recovery");
+		ret = EINVAL;
+		goto err;
+	}
 
-	/* Make sure that last_txnid is not going to wrap around. */
-	if (region->last_txnid == TXN_INVALID) {
+	/* Make sure that we aren't still recovering prepared transactions. */
+	if (!internal && region->stat.st_nrestores != 0) {
 		__db_err(dbenv,
-"txn_begin: transaction ID wrapped.  Exit the database environment\nand restart the application as if application failure had occurred");
+    "recovery of prepared but not yet committed transactions is incomplete");
 		ret = EINVAL;
-		goto err1;
+		goto err;
+	}
+
+	/*
+	 * Allocate a new transaction id. Our current valid range can span
+	 * the maximum valid value, so check for it and wrap manually.
+	 */
+	if (region->last_txnid == TXN_MAXIMUM &&
+	    region->cur_maxid != TXN_MAXIMUM)
+		region->last_txnid = TXN_MINIMUM - 1;
+
+	if (region->last_txnid == region->cur_maxid) {
+		if ((ret = __os_malloc(dbenv,
+		    sizeof(u_int32_t) * region->maxtxns, &ids)) != 0)
+			goto err;
+		nids = 0;
+		for (td = SH_TAILQ_FIRST(&region->active_txn, __txn_detail);
+		    td != NULL;
+		    td = SH_TAILQ_NEXT(td, links, __txn_detail))
+			ids[nids++] = td->txnid;
+		region->last_txnid = TXN_MINIMUM - 1;
+		region->cur_maxid = TXN_MAXIMUM;
+		if (nids != 0)
+			__db_idspace(ids, nids,
+			    &region->last_txnid, &region->cur_maxid);
+		__os_free(dbenv, ids);
+		if (DBENV_LOGGING(dbenv) &&
+		    (ret = __txn_recycle_log(dbenv, NULL,
+		    &null_lsn, 0, region->last_txnid, region->cur_maxid)) != 0)
+			goto err;
 	}
 
 	/* Allocate a new transaction detail structure. */
 	if ((ret =
 	    __db_shalloc(mgr->reginfo.addr, sizeof(TXN_DETAIL), 0, &td)) != 0) {
 		__db_err(dbenv,
-		     "Unable to allocate memory for transaction detail");
-		goto err1;
+		    "Unable to allocate memory for transaction detail");
+		goto err;
 	}
 
 	/* Place transaction on active transaction list. */
 	SH_TAILQ_INSERT_HEAD(&region->active_txn, td, links, __txn_detail);
 
 	id = ++region->last_txnid;
-	++region->nbegins;
-	if (++region->nactive > region->maxnactive)
-		region->maxnactive = region->nactive;
+	++region->stat.st_nbegins;
+	if (++region->stat.st_nactive > region->stat.st_maxnactive)
+		region->stat.st_maxnactive = region->stat.st_nactive;
 
 	td->txnid = id;
 	td->begin_lsn = begin_lsn;
@@ -228,12 +400,20 @@ __txn_begin(txn)
 	else
 		td->parent = INVALID_ROFF;
 
+	td->flags = 0;
 	off = R_OFFSET(&mgr->reginfo, td);
 	R_UNLOCK(dbenv, &mgr->reginfo);
 
 	ZERO_LSN(txn->last_lsn);
 	txn->txnid = id;
-	txn->off = off;
+	txn->off = (u_int32_t)off;
+
+	txn->abort = __txn_abort;
+	txn->commit = __txn_commit;
+	txn->discard = __txn_discard;
+	txn->id = __txn_id;
+	txn->prepare = __txn_prepare;
+	txn->set_timeout = __txn_set_timeout;
 
 	/*
 	 * If this is a transaction family, we must link the child to the
@@ -242,7 +422,7 @@ __txn_begin(txn)
 	if (txn->parent != NULL && LOCKING_ON(dbenv))
 		if ((ret = __lock_addfamilylocker(dbenv,
 		    txn->parent->txnid, txn->txnid)) != 0)
-			goto err2;
+			return (ret);
 
 	if (F_ISSET(txn, TXN_MALLOC)) {
 		MUTEX_THREAD_LOCK(dbenv, mgr->mutexp);
@@ -252,34 +432,33 @@ __txn_begin(txn)
 
 	return (0);
 
-err1:	R_UNLOCK(dbenv, &mgr->reginfo);
-
-err2:	return (ret);
+err:	R_UNLOCK(dbenv, &mgr->reginfo);
+	return (ret);
 }
 
 /*
- * txn_commit --
+ * __txn_commit --
  *	Commit a transaction.
+ *
+ * PUBLIC: int __txn_commit __P((DB_TXN *, u_int32_t));
  */
 int
-txn_commit(txnp, flags)
+__txn_commit(txnp, flags)
 	DB_TXN *txnp;
 	u_int32_t flags;
 {
 	DB_ENV *dbenv;
+	DB_LOCKREQ request;
 	DB_TXN *kid;
-	int is_commit, ret, t_ret;
+	TXN_DETAIL *td;
+	u_int32_t lflags;
+	int ret, t_ret;
 
 	dbenv = txnp->mgrp->dbenv;
 
-#ifdef HAVE_RPC
-	if (F_ISSET(dbenv, DB_ENV_RPCCLIENT))
-		return (__dbcl_txn_commit(txnp, flags));
-#endif
-
 	PANIC_CHECK(dbenv);
 
-	if ((ret = __txn_isvalid(txnp, NULL, TXN_COMMITTED)) != 0)
+	if ((ret = __txn_isvalid(txnp, &td, TXN_OP_COMMIT)) != 0)
 		return (ret);
 
 	/*
@@ -290,10 +469,10 @@ txn_commit(txnp, flags)
 	 * specifying the wrong flag for some reason.
 	 */
 	if (__db_fchk(dbenv,
-	    "txn_commit", flags, DB_TXN_NOSYNC | DB_TXN_SYNC) != 0)
+	    "DB_TXN->commit", flags, DB_TXN_NOSYNC | DB_TXN_SYNC) != 0)
 		flags = DB_TXN_SYNC;
 	if (__db_fcchk(dbenv,
-	    "txn_commit", flags, DB_TXN_NOSYNC, DB_TXN_SYNC) != 0)
+	    "DB_TXN->commit", flags, DB_TXN_NOSYNC, DB_TXN_SYNC) != 0)
 		flags = DB_TXN_SYNC;
 	if (LF_ISSET(DB_TXN_NOSYNC)) {
 		F_CLR(txnp, TXN_SYNC);
@@ -305,16 +484,33 @@ txn_commit(txnp, flags)
 	}
 
 	/*
-	 * Commit any unresolved children.  If there's an error, abort any
-	 * unresolved children and the parent.
+	 * Commit any unresolved children.  If anyone fails to commit,
+	 * then try to abort the rest of the kids and then abort the parent.
+	 * Abort should never fail; if it does, we bail out immediately.
 	 */
 	while ((kid = TAILQ_FIRST(&txnp->kids)) != NULL)
-		if ((ret = txn_commit(kid, flags)) != 0) {
+		if ((ret = kid->commit(kid, flags)) != 0)
 			while ((kid = TAILQ_FIRST(&txnp->kids)) != NULL)
-				(void)txn_abort(kid);
-			(void)txn_abort(txnp);
-			goto err;
-		}
+				if ((t_ret = kid->abort(kid)) != 0)
+					return (__db_panic(dbenv, t_ret));
+
+	/*
+	 * Process any aborted pages from our children.
+	 * We delay putting pages on the free list that are newly
+	 * allocated and then aborted so that we can undo other
+	 * allocations, if necessary, without worrying about
+	 * these pages which were not on the free list before.
+	 */
+	if (txnp->txn_list != NULL) {
+		t_ret = __db_do_the_limbo(dbenv, NULL, txnp, txnp->txn_list);
+		__db_txnlist_end(dbenv, txnp->txn_list);
+		txnp->txn_list = NULL;
+		if (t_ret != 0 && ret == 0)
+			ret = t_ret;
+	}
+
+	if (ret != 0)
+		goto err;
 
 	/*
 	 * If there are any log records, write a log record and sync the log,
@@ -322,27 +518,35 @@ txn_commit(txnp, flags)
 	 * we do not need to commit the child synchronously since it may still
 	 * abort (if its parent aborts), and otherwise its parent or ultimate
 	 * ancestor will write synchronously.
-	 *
-	 * I'd rather return a logging error than a flag-wrong error, so if
-	 * the log routines fail, set "ret" without regard to previous value.
 	 */
-	if (LOGGING_ON(dbenv) && !IS_ZERO_LSN(txnp->last_lsn)) {
+	if (DBENV_LOGGING(dbenv) && !IS_ZERO_LSN(txnp->last_lsn)) {
 		if (txnp->parent == NULL) {
-			if ((t_ret = __txn_regop_log(dbenv,
-			    txnp, &txnp->last_lsn,
-			    (F_ISSET(dbenv, DB_ENV_TXN_NOSYNC) &&
-			    !F_ISSET(txnp, TXN_SYNC)) ||
-			    F_ISSET(txnp, TXN_NOSYNC) ?  0 : DB_FLUSH,
-			    TXN_COMMIT, (int32_t)time(NULL))) != 0) {
-				ret = t_ret;
+			/*
+			 * We are about to free all the read locks
+			 * for this transaction below.  Some of those
+			 * locks might be handle locks which should
+			 * not be freed, because they will be freed
+			 * when the handle is closed.  Check the
+			 * events and preprocess any trades now so
+			 * that we don't release the locks below.
+			 */
+			if ((ret = __txn_doevents(dbenv, txnp, 0, 1)) != 0)
+				goto err;
+			request.op = DB_LOCK_PUT_READ;
+			if (LOCKING_ON(dbenv) && (ret = dbenv->lock_vec(
+			   dbenv, txnp->txnid, 0, &request, 1, NULL)) != 0)
+				goto err;
+
+			SET_LOG_FLAGS(dbenv, txnp, lflags);
+			if ((ret = __txn_regop_log(dbenv,
+			    txnp, &txnp->last_lsn, lflags,
+			    TXN_COMMIT, (int32_t)time(NULL))) != 0)
 				goto err;
-			}
 		} else {
 			/* Log the commit in the parent! */
-			if ((t_ret = __txn_child_log(dbenv,
+			if ((ret = __txn_child_log(dbenv,
 			    txnp->parent, &txnp->parent->last_lsn,
 			    0, txnp->txnid, &txnp->last_lsn)) != 0) {
-				ret = t_ret;
 				goto err;
 			}
 
@@ -350,108 +554,206 @@ txn_commit(txnp, flags)
 		}
 	}
 
-	is_commit = 1;
-	if (0) {
-err:		is_commit = 0;
-	}
-	if ((t_ret = __txn_end(txnp, is_commit)) != 0 && ret == 0)
+	/* This is OK because __txn_end can only fail with a panic. */
+	return (__txn_end(txnp, 1));
+
+err:	/*
+	 * If we are prepared, then we "must" be able to commit.  We
+	 * panic here because even though the coordinator might be
+	 * able to retry it is not clear it would know to do that.
+	 * Otherwise  we'll try to abort.  If that is successful,
+	 * then we return whatever was in ret (i.e., the reason we failed).
+	 * If the abort was unsuccessful, then abort probably returned
+	 * DB_RUNRECOVERY and we need to propagate that up.
+	 */
+	if (td->status == TXN_PREPARED)
+		return (__db_panic(dbenv, ret));
+		
+	if ((t_ret = txnp->abort(txnp)) != 0)
 		ret = t_ret;
 	return (ret);
 }
 
 /*
- * txn_abort --
+ * __txn_abort --
  *	Abort a transaction.
+ *
+ * PUBLIC: int __txn_abort __P((DB_TXN *));
  */
 int
-txn_abort(txnp)
+__txn_abort(txnp)
 	DB_TXN *txnp;
 {
 	DB_ENV *dbenv;
+	DB_LOCKREQ request;
 	DB_TXN *kid;
-	int ret, t_ret;
+	TXN_DETAIL *td;
+	u_int32_t lflags;
+	int ret;
 
 	dbenv = txnp->mgrp->dbenv;
 
-#ifdef HAVE_RPC
-	if (F_ISSET(dbenv, DB_ENV_RPCCLIENT))
-		return (__dbcl_txn_abort(txnp));
-#endif
+	PANIC_CHECK(dbenv);
+
+	/* Ensure that abort always fails fatally. */
+	if ((ret = __txn_isvalid(txnp, &td, TXN_OP_ABORT)) != 0)
+		return (__db_panic(dbenv, ret));
+
+	/*
+	 * Try to abort any unresolved children.
+	 *
+	 * Abort either succeeds or panics the region.  As soon as we
+	 * see any failure, we just get out of here and return the panic
+	 * up.
+	 */
+	while ((kid = TAILQ_FIRST(&txnp->kids)) != NULL)
+		if ((ret = kid->abort(kid)) != 0)
+			return (ret);
+
+	if (LOCKING_ON(dbenv)) {
+		/*
+		 * We are about to free all the read locks for this transaction
+		 * below.  Some of those locks might be handle locks which
+		 * should not be freed, because they will be freed when the
+		 * handle is closed.  Check the events and preprocess any
+		 * trades now so that we don't release the locks below.
+		 */
+		if ((ret = __txn_doevents(dbenv, txnp, 0, 1)) != 0)
+			return (__db_panic(dbenv, ret));
+
+		/* Turn off timeouts. */
+		if ((ret = __lock_set_timeout(dbenv,
+		    txnp->txnid, 0, DB_SET_TXN_TIMEOUT)) != 0)
+			return (__db_panic(dbenv, ret));
+
+		if ((ret = __lock_set_timeout(dbenv,
+		    txnp->txnid, 0, DB_SET_LOCK_TIMEOUT)) != 0)
+			return (__db_panic(dbenv, ret));
+
+		request.op = DB_LOCK_UPGRADE_WRITE;
+		if ((ret = dbenv->lock_vec(
+		    dbenv, txnp->txnid, 0, &request, 1, NULL)) != 0)
+			return (__db_panic(dbenv, ret));
+	}
+	if ((ret = __txn_undo(txnp)) != 0)
+		return (__db_panic(dbenv, ret));
+
+	/*
+	 * Normally, we do not need to log aborts.  However, if we
+	 * are a distributed transaction (i.e., we have a prepare),
+	 * then we log the abort so we know that this transaction
+	 * was actually completed.
+	 */
+	SET_LOG_FLAGS(dbenv, txnp, lflags);
+	if (DBENV_LOGGING(dbenv) && td->status == TXN_PREPARED &&
+	    (ret = __txn_regop_log(dbenv, txnp, &txnp->last_lsn,
+	    lflags, TXN_ABORT, (int32_t)time(NULL))) != 0)
+		return (__db_panic(dbenv, ret));
+
+	/* __txn_end always panics if it errors, so pass the return along. */
+	return (__txn_end(txnp, 0));
+}
+
+/*
+ * __txn_discard --
+ *	Free the per-process resources associated with this txn handle.
+ *
+ * PUBLIC: int __txn_discard __P((DB_TXN *, u_int32_t flags));
+ */
+int
+__txn_discard(txnp, flags)
+	DB_TXN *txnp;
+	u_int32_t flags;
+{
+	DB_ENV *dbenv;
+	DB_TXN *freep;
+	TXN_DETAIL *td;
+	int ret;
+
+	COMPQUIET(flags, 0);
+
+	dbenv = txnp->mgrp->dbenv;
+	freep = NULL;
 
 	PANIC_CHECK(dbenv);
 
-	if ((ret = __txn_isvalid(txnp, NULL, TXN_ABORTED)) != 0)
+	if ((ret = __txn_isvalid(txnp, &td, TXN_OP_DISCARD)) != 0)
 		return (ret);
 
-	/* Abort any unresolved children. */
-	while ((kid = TAILQ_FIRST(&txnp->kids)) != NULL)
-		if ((t_ret = txn_abort(kid)) != 0 && ret == 0)
-			ret = t_ret;
+	/* Should be no children. */
+	DB_ASSERT(TAILQ_FIRST(&txnp->kids) == NULL);
+	DB_ASSERT(F_ISSET(td, TXN_RESTORED));
 
-	if ((t_ret = __txn_undo(txnp)) != 0 && ret == 0)
-		ret = t_ret;
+	/* Free the space. */
+	MUTEX_THREAD_LOCK(dbenv, txnp->mgrp->mutexp);
+	txnp->mgrp->n_discards++;
+	if (F_ISSET(txnp, TXN_MALLOC)) {
+		TAILQ_REMOVE(&txnp->mgrp->txn_chain, txnp, links);
+		freep = txnp;
+	}
+	MUTEX_THREAD_UNLOCK(dbenv, txnp->mgrp->mutexp);
+	if (freep != NULL)
+		__os_free(dbenv, freep);
 
-	if ((t_ret = __txn_end(txnp, 0)) != 0 && ret == 0)
-		ret = t_ret;
-	return (ret);
+	return (0);
 }
 
 /*
- * txn_prepare --
+ * __txn_prepare --
  *	Flush the log so a future commit is guaranteed to succeed.
+ *
+ * PUBLIC: int __txn_prepare __P((DB_TXN *, u_int8_t *));
  */
 int
-txn_prepare(txnp)
+__txn_prepare(txnp, gid)
 	DB_TXN *txnp;
+	u_int8_t *gid;
 {
 	DBT xid;
 	DB_ENV *dbenv;
 	DB_TXN *kid;
 	TXN_DETAIL *td;
+	u_int32_t lflags;
 	int ret;
 
 	dbenv = txnp->mgrp->dbenv;
 
-#ifdef HAVE_RPC
-	if (F_ISSET(dbenv, DB_ENV_RPCCLIENT))
-		return (__dbcl_txn_prepare(txnp));
-#endif
-
 	PANIC_CHECK(dbenv);
 
-	if ((ret = __txn_isvalid(txnp, &td, TXN_PREPARED)) != 0)
+	if ((ret = __txn_isvalid(txnp, &td, TXN_OP_PREPARE)) != 0)
 		return (ret);
 
-	/* Prepare any unresolved children. */
+	/* Commit any unresolved children. */
 	while ((kid = TAILQ_FIRST(&txnp->kids)) != NULL)
-		if ((ret = txn_prepare(kid)) != 0)
+		if ((ret = kid->commit(kid, DB_TXN_NOSYNC)) != 0)
 			return (ret);
 
 	/*
-	 * We indicate that a transaction is an XA transaction by putting
-	 * a valid size in the xid.size fiels.  XA requires that the transaction
-	 * be either ENDED or SUSPENDED when prepare is called, so we know
-	 * that if the xa_status isn't in one of those states, but we are
-	 * calling prepare that we are not an XA transaction.
+	 * In XA, the global transaction ID in the txn_detail structure is
+	 * already set; in a non-XA environment, we must set it here.  XA
+	 * requires that the transaction be either ENDED or SUSPENDED when
+	 * prepare is called, so we know that if the xa_status isn't in one
+	 * of those states, then we are calling prepare directly and we need
+	 * to fill in the td->xid.
 	 */
-
-	if (LOGGING_ON(dbenv)) {
+	if (DBENV_LOGGING(dbenv)) {
 		memset(&xid, 0, sizeof(xid));
+		if (td->xa_status != TXN_XA_ENDED &&
+		    td->xa_status != TXN_XA_SUSPENDED)
+			/* Regular prepare; fill in the gid. */
+			memcpy(td->xid, gid, sizeof(td->xid));
+
+		xid.size = sizeof(td->xid);
 		xid.data = td->xid;
-		xid.size = td->xa_status != TXN_XA_ENDED &&
-		    td->xa_status != TXN_XA_SUSPENDED ?  0 : sizeof(td->xid);
+
+		SET_LOG_FLAGS(dbenv, txnp, lflags);
 		if ((ret = __txn_xa_regop_log(dbenv, txnp, &txnp->last_lsn,
-		    (F_ISSET(dbenv, DB_ENV_TXN_NOSYNC) &&
-		    !F_ISSET(txnp, TXN_SYNC)) ||
-		    F_ISSET(txnp, TXN_NOSYNC) ? 0 : DB_FLUSH, TXN_PREPARE,
-		    &xid, td->format, td->gtrid, td->bqual,
+		    lflags, TXN_PREPARE, &xid, td->format, td->gtrid, td->bqual,
 		    &td->begin_lsn)) != 0) {
-			__db_err(dbenv, "txn_prepare: log_write failed %s",
+			__db_err(dbenv, "DB_TXN->prepare: log_write failed %s",
 			    db_strerror(ret));
 			return (ret);
 		}
-		if (txnp->parent != NULL)
-			F_SET(txnp->parent, TXN_CHILDCOMMIT);
 	}
 
 	MUTEX_THREAD_LOCK(dbenv, txnp->mgrp->mutexp);
@@ -461,17 +763,36 @@ txn_prepare(txnp)
 }
 
 /*
- * txn_id --
+ * __txn_id --
  *	Return the transaction ID.
+ *
+ * PUBLIC: u_int32_t __txn_id __P((DB_TXN *));
  */
 u_int32_t
-txn_id(txnp)
+__txn_id(txnp)
 	DB_TXN *txnp;
 {
 	return (txnp->txnid);
 }
 
 /*
+ * __txn_set_timeout --
+ *	Set timeout values in the txn structure.
+ */
+static int
+__txn_set_timeout(txnp, timeout, op)
+	DB_TXN *txnp;
+	db_timeout_t timeout;
+	u_int32_t op;
+{
+	if (op != DB_SET_TXN_TIMEOUT &&  op != DB_SET_LOCK_TIMEOUT)
+		return (__db_ferr(txnp->mgrp->dbenv, "DB_TXN->set_timeout", 0));
+
+	return (__lock_set_timeout(
+	    txnp->mgrp->dbenv, txnp->txnid, timeout, op));
+}
+
+/*
  * __txn_isvalid --
  *	Return 0 if the txnp is reasonable, otherwise panic.
  */
@@ -479,12 +800,22 @@ static int
 __txn_isvalid(txnp, tdp, op)
 	const DB_TXN *txnp;
 	TXN_DETAIL **tdp;
-	u_int32_t op;
+	txnop_t op;
 {
 	DB_TXNMGR *mgrp;
+	DB_TXNREGION *region;
 	TXN_DETAIL *tp;
 
 	mgrp = txnp->mgrp;
+	region = mgrp->reginfo.primary;
+
+	/* Check for recovery. */
+	if (!F_ISSET(txnp, TXN_COMPENSATE) &&
+	    F_ISSET(region, TXN_IN_RECOVERY)) {
+		__db_err(mgrp->dbenv,
+		    "operation not permitted during recovery");
+		goto err;
+	}
 
 	/* Check for live cursors. */
 	if (txnp->cursors != 0) {
@@ -492,25 +823,70 @@ __txn_isvalid(txnp, tdp, op)
 		goto err;
 	}
 
-	/* Check transaction's status. */
+	/* Check transaction's state. */
 	tp = (TXN_DETAIL *)R_ADDR(&mgrp->reginfo, txnp->off);
 	if (tdp != NULL)
 		*tdp = tp;
 
+	/* Handle any operation specific checks. */
+	switch (op) {
+	case TXN_OP_DISCARD:
+		/*
+		 * Since we're just tossing the per-process space; there are
+		 * a lot of problems with the transaction that we can tolerate.
+		 */
+
+		/* Transaction is already been reused. */
+		if (txnp->txnid != tp->txnid)
+			return (0);
+
+		/* What we've got had better be a restored transaction. */
+		if (!F_ISSET(tp, TXN_RESTORED)) {
+			__db_err(mgrp->dbenv, "not a restored transaction");
+			return (__db_panic(mgrp->dbenv, EINVAL));
+		}
+
+		return (0);
+	case TXN_OP_PREPARE:
+		if (txnp->parent != NULL) {
+			/*
+			 * This is not fatal, because you could imagine an
+			 * application that simply prepares everybody because
+			 * it doesn't distinguish between children and parents.
+			 * I'm not arguing this is good, but I could imagine
+			 * someone doing it.
+			 */
+			__db_err(mgrp->dbenv,
+			    "Prepare disallowed on child transactions");
+			return (EINVAL);
+		}
+		break;
+	case TXN_OP_ABORT:
+	case TXN_OP_COMMIT:
+	default:
+		break;
+	}
+
 	switch (tp->status) {
+	case TXN_PREPARED:
+		if (op == TXN_OP_PREPARE) {
+			__db_err(mgrp->dbenv, "transaction already prepared");
+			/*
+			 * Txn_prepare doesn't blow away the user handle, so
+			 * in this case, give the user the opportunity to
+			 * abort or commit.
+			 */
+			return (EINVAL);
+		}
+		break;
+	case TXN_RUNNING:
+		break;
 	case TXN_ABORTED:
 	case TXN_COMMITTED:
 	default:
 		__db_err(mgrp->dbenv, "transaction already %s",
 		    tp->status == TXN_COMMITTED ? "committed" : "aborted");
 		goto err;
-	case TXN_PREPARED:
-		if (op == TXN_PREPARED) {
-			__db_err(mgrp->dbenv, "transaction already prepared");
-			goto err;
-		}
-	case TXN_RUNNING:
-		break;
 	}
 
 	return (0);
@@ -526,10 +902,8 @@ err:	/*
 /*
  * __txn_end --
  *	Internal transaction end routine.
- *
- * PUBLIC: int __txn_end __P((DB_TXN *, int));
  */
-int
+static int
 __txn_end(txnp, is_commit)
 	DB_TXN *txnp;
 	int is_commit;
@@ -539,46 +913,59 @@ __txn_end(txnp, is_commit)
 	DB_TXNMGR *mgr;
 	DB_TXNREGION *region;
 	TXN_DETAIL *tp;
-	int ret;
+	int do_closefiles, ret;
 
 	mgr = txnp->mgrp;
 	dbenv = mgr->dbenv;
 	region = mgr->reginfo.primary;
+	do_closefiles = 0;
+
+	/* Process commit events. */
+	if ((ret = __txn_doevents(dbenv, txnp, is_commit, 0)) != 0)
+		return (__db_panic(dbenv, ret));
 
 	/* Release the locks. */
 	request.op = txnp->parent == NULL ||
 	    is_commit == 0 ? DB_LOCK_PUT_ALL : DB_LOCK_INHERIT;
 
-	if (LOCKING_ON(dbenv)) {
-		ret = lock_vec(dbenv, txnp->txnid, 0, &request, 1, NULL);
-		if (ret != 0 && (ret != DB_LOCK_DEADLOCK || is_commit)) {
-			__db_err(dbenv, "%s: release locks failed %s",
-			    is_commit ? "txn_commit" : "txn_abort",
-			    db_strerror(ret));
-			__db_panic(dbenv, ret);
-		}
-	}
+	/*
+	 * __txn_end cannot return an simple error, we MUST return
+	 * success/failure from commit or abort, ignoring any internal
+	 * errors.  So, we panic if something goes wrong.  We can't
+	 * deadlock here because we're not acquiring any new locks,
+	 * so DB_LOCK_DEADLOCK is just as fatal as any other error.
+	 */
+	if (LOCKING_ON(dbenv) && (ret = dbenv->lock_vec(
+	    dbenv, txnp->txnid, DB_LOCK_FREE_LOCKER, &request, 1, NULL)) != 0)
+		return (__db_panic(dbenv, ret));
 
 	/* End the transaction. */
 	R_LOCK(dbenv, &mgr->reginfo);
 
 	tp = (TXN_DETAIL *)R_ADDR(&mgr->reginfo, txnp->off);
 	SH_TAILQ_REMOVE(&region->active_txn, tp, links, __txn_detail);
+	if (F_ISSET(tp, TXN_RESTORED)) {
+		region->stat.st_nrestores--;
+		do_closefiles = region->stat.st_nrestores == 0;
+	}
+
 	__db_shalloc_free(mgr->reginfo.addr, tp);
 
 	if (is_commit)
-		region->ncommits++;
+		region->stat.st_ncommits++;
 	else
-		region->naborts++;
-	--region->nactive;
+		region->stat.st_naborts++;
+	--region->stat.st_nactive;
 
 	R_UNLOCK(dbenv, &mgr->reginfo);
 
 	/*
-	 * The transaction cannot get more locks, remove its locker info.
+	 * The transaction cannot get more locks, remove its locker info,
+	 * if any.
 	 */
-	if (LOCKING_ON(dbenv))
-		__lock_freefamilylocker(dbenv->lk_handle, txnp->txnid);
+	if (LOCKING_ON(dbenv) && (ret =
+	    __lock_freefamilylocker(dbenv->lk_handle, txnp->txnid)) != 0)
+		return (__db_panic(dbenv, ret));
 	if (txnp->parent != NULL)
 		TAILQ_REMOVE(&txnp->parent->kids, txnp, klinks);
 
@@ -588,9 +975,16 @@ __txn_end(txnp, is_commit)
 		TAILQ_REMOVE(&mgr->txn_chain, txnp, links);
 		MUTEX_THREAD_UNLOCK(dbenv, mgr->mutexp);
 
-		__os_free(txnp, sizeof(*txnp));
+		__os_free(dbenv, txnp);
 	}
 
+	if (do_closefiles) {
+		F_SET((DB_LOG *)dbenv->lg_handle, DBLOG_RECOVER);
+		(void)__dbreg_close_files(dbenv);
+		F_CLR((DB_LOG *)dbenv->lg_handle, DBLOG_RECOVER);
+		mgr->n_discards = 0;
+		(void)dbenv->txn_checkpoint(dbenv, 0, 0, DB_FORCE);
+	}
 	return (0);
 }
 
@@ -605,16 +999,19 @@ __txn_undo(txnp)
 {
 	DBT rdbt;
 	DB_ENV *dbenv;
+	DB_LOGC *logc;
 	DB_LSN key_lsn;
+	DB_TXN *ptxn;
 	DB_TXNMGR *mgr;
+	int ret, t_ret;
 	void *txnlist;
-	int ret, threaded;
 
 	mgr = txnp->mgrp;
 	dbenv = mgr->dbenv;
+	logc = NULL;
 	txnlist = NULL;
 
-	if (!LOGGING_ON(dbenv))
+	if (!DBENV_LOGGING(dbenv))
 		return (0);
 
 	/*
@@ -623,53 +1020,66 @@ __txn_undo(txnp)
 	 * allocation here and use DB_DBT_USERMEM.
 	 */
 	memset(&rdbt, 0, sizeof(rdbt));
-	threaded = F_ISSET(dbenv, DB_ENV_THREAD) ? 1 : 0;
-	if (threaded)
-		F_SET(&rdbt, DB_DBT_MALLOC);
 
 	key_lsn = txnp->last_lsn;
 
-	/* Allocate a transaction list for children or aborted page creates. */
-	if ((ret = __db_txnlist_init(dbenv, &txnlist)) != 0)
+	/*
+	 * Allocate a txnlist for children and aborted page allocs.
+	 * We need to associate the list with the maximal parent
+	 * so that aborted pages are recovered when that transaction
+	 * is commited or aborted.
+	 */
+	for (ptxn = txnp->parent; ptxn != NULL && ptxn->parent != NULL;)
+		ptxn = ptxn->parent;
+
+	if (ptxn != NULL && ptxn->txn_list != NULL)
+		txnlist = ptxn->txn_list;
+	else if (txnp->txn_list != NULL)
+		txnlist = txnp->txn_list;
+	else if ((ret = __db_txnlist_init(dbenv, 0, 0, NULL, &txnlist)) != 0)
 		return (ret);
+	else if (ptxn != NULL)
+		ptxn->txn_list = txnlist;
 
 	if (F_ISSET(txnp, TXN_CHILDCOMMIT) &&
-	    (ret = __db_txnlist_lsninit(dbenv,
-	    txnlist, &txnp->last_lsn)) != 0)
+	    (ret = __db_txnlist_lsninit(dbenv, txnlist, &txnp->last_lsn)) != 0)
 		return (ret);
 
-	for (ret = 0; ret == 0 && !IS_ZERO_LSN(key_lsn);) {
+	if ((ret = dbenv->log_cursor(dbenv, &logc, 0)) != 0)
+		goto err;
+	while (ret == 0 && !IS_ZERO_LSN(key_lsn)) {
 		/*
 		 * The dispatch routine returns the lsn of the record
 		 * before the current one in the key_lsn argument.
 		 */
-		if ((ret = log_get(dbenv, &key_lsn, &rdbt, DB_SET)) == 0) {
-			ret = __db_dispatch(dbenv,
-			    &rdbt, &key_lsn, DB_TXN_ABORT, txnlist);
-			if (threaded && rdbt.data != NULL) {
-				__os_free(rdbt.data, rdbt.size);
-				rdbt.data = NULL;
-			}
+		if ((ret = logc->get(logc, &key_lsn, &rdbt, DB_SET)) == 0) {
+			ret = __db_dispatch(dbenv, dbenv->recover_dtab,
+			    dbenv->recover_dtab_size, &rdbt, &key_lsn,
+			    DB_TXN_ABORT, txnlist);
 			if (F_ISSET(txnp, TXN_CHILDCOMMIT))
 				(void)__db_txnlist_lsnadd(dbenv,
 				    txnlist, &key_lsn, 0);
 		}
-		if (ret != 0) {
+		if (ret == DB_SURPRISE_KID) {
+			if ((ret = __db_txnlist_lsninit(
+			    dbenv, txnlist, &key_lsn)) == 0)
+				F_SET(txnp, TXN_CHILDCOMMIT);
+		} else if (ret != 0) {
 			__db_err(txnp->mgrp->dbenv,
-			    "txn_abort: Log undo failed for LSN: %lu %lu: %s",
+		    "DB_TXN->abort: Log undo failed for LSN: %lu %lu: %s",
 			    (u_long)key_lsn.file, (u_long)key_lsn.offset,
 			    db_strerror(ret));
-			if (txnlist != NULL)
-				__db_txnlist_end(dbenv, txnlist);
-			return (ret);
+			goto err;
 		}
 	}
 
-	if (txnlist != NULL) {
-		__db_do_the_limbo(dbenv, txnlist);
-		__db_txnlist_end(dbenv, txnlist);
-	}
+	ret = __db_do_the_limbo(dbenv, ptxn, txnp, txnlist);
 
+err:	if (logc != NULL && (t_ret = logc->close(logc, 0)) != 0 && ret == 0)
+		ret = t_ret;
+
+	if (ptxn == NULL && txnlist != NULL)
+		__db_txnlist_end(dbenv, txnlist);
 	return (ret);
 }
 
@@ -682,150 +1092,115 @@ __txn_undo(txnp)
  * its first LSN.  This is the lowest LSN we can checkpoint, since any record
  * written after since that point may be involved in a transaction and may
  * therefore need to be undone in the case of an abort.
+ *
+ * PUBLIC: int __txn_checkpoint
+ * PUBLIC:     __P((DB_ENV *, u_int32_t, u_int32_t, u_int32_t));
  */
 int
-txn_checkpoint(dbenv, kbytes, minutes, flags)
+__txn_checkpoint(dbenv, kbytes, minutes, flags)
 	DB_ENV *dbenv;
 	u_int32_t kbytes, minutes, flags;
 {
-	DB_LOG *dblp;
-	DB_LSN ckp_lsn, sync_lsn, last_ckp;
+	DB_LSN ckp_lsn, last_ckp;
 	DB_TXNMGR *mgr;
 	DB_TXNREGION *region;
-	LOG *lp;
 	TXN_DETAIL *txnp;
 	time_t last_ckp_time, now;
 	u_int32_t bytes, mbytes;
-	int interval, ret;
+	int ret;
 
-#ifdef HAVE_RPC
-	if (F_ISSET(dbenv, DB_ENV_RPCCLIENT))
-		return (__dbcl_txn_checkpoint(dbenv, kbytes, minutes));
-#endif
 	PANIC_CHECK(dbenv);
-	ENV_REQUIRES_CONFIG(dbenv, dbenv->tx_handle, DB_INIT_TXN);
-
-	mgr = dbenv->tx_handle;
-	region = mgr->reginfo.primary;
-	dblp = dbenv->lg_handle;
-	lp = dblp->reginfo.primary;
+	ENV_REQUIRES_CONFIG(dbenv,
+	    dbenv->tx_handle, "txn_checkpoint", DB_INIT_TXN);
 
 	/*
-	 * Check if we need to checkpoint.
+	 * On a replication client, all transactions are read-only;  therefore,
+	 * a checkpoint is a null-op.
+	 *
+	 * We permit txn_checkpoint, instead of just rendering it illegal,
+	 * so that an application can just let a checkpoint thread continue
+	 * to operate as it gets promoted or demoted between being a
+	 * master and a client.
 	 */
-	ZERO_LSN(ckp_lsn);
+	if (F_ISSET(dbenv, DB_ENV_REP_CLIENT))
+		return (0);
 
-	if (LF_ISSET(DB_FORCE))
-		goto do_ckp;
+	mgr = dbenv->tx_handle;
+	region = mgr->reginfo.primary;
 
-	R_LOCK(dbenv, &dblp->reginfo);
-	mbytes = lp->stat.st_wc_mbytes;
 	/*
-	 * We add the current buffer offset so as to count bytes that
-	 * have not yet been written, but are sitting in the log buffer.
+	 * The checkpoint LSN is an LSN such that all transactions begun before
+	 * it are complete.  Our first guess (corrected below based on the list
+	 * of active transactions) is the last-written LSN.
 	 */
-	bytes = lp->stat.st_wc_bytes + lp->b_off;
-	ckp_lsn = lp->lsn;
-	R_UNLOCK(dbenv, &dblp->reginfo);
-
-	/* Don't checkpoint a quiescent database. */
-	if (bytes == 0 && mbytes == 0)
-		return (0);
+	__log_txn_lsn(dbenv, &ckp_lsn, &mbytes, &bytes);
 
-	if (kbytes != 0 && mbytes * 1024 + bytes / 1024 >= (u_int32_t)kbytes)
-		goto do_ckp;
+	if (!LF_ISSET(DB_FORCE)) {
+		/* Don't checkpoint a quiescent database. */
+		if (bytes == 0 && mbytes == 0)
+			return (0);
 
-	if (minutes != 0) {
-		(void)time(&now);
+		if (kbytes != 0 &&
+		    mbytes * 1024 + bytes / 1024 >= (u_int32_t)kbytes)
+			goto do_ckp;
 
-		R_LOCK(dbenv, &mgr->reginfo);
-		last_ckp_time = region->time_ckp;
-		R_UNLOCK(dbenv, &mgr->reginfo);
+		if (minutes != 0) {
+			(void)time(&now);
 
-		if (now - last_ckp_time >= (time_t)(minutes * 60))
-			goto do_ckp;
-	}
+			R_LOCK(dbenv, &mgr->reginfo);
+			last_ckp_time = region->time_ckp;
+			R_UNLOCK(dbenv, &mgr->reginfo);
 
-	/*
-	 * If we checked time and data and didn't go to checkpoint,
-	 * we're done.
-	 */
-	if (minutes != 0 || kbytes != 0)
-		return (0);
+			if (now - last_ckp_time >= (time_t)(minutes * 60))
+				goto do_ckp;
+		}
 
-do_ckp:
-	if (IS_ZERO_LSN(ckp_lsn)) {
-		R_LOCK(dbenv, &dblp->reginfo);
-		ckp_lsn = lp->lsn;
-		R_UNLOCK(dbenv, &dblp->reginfo);
+		/*
+		 * If we checked time and data and didn't go to checkpoint,
+		 * we're done.
+		 */
+		if (minutes != 0 || kbytes != 0)
+			return (0);
 	}
 
-	/*
-	 * We have to find an LSN such that all transactions begun
-	 * before that LSN are complete.
-	 */
+do_ckp:	/* Look through the active transactions for the lowest begin LSN. */
 	R_LOCK(dbenv, &mgr->reginfo);
-
-	if (IS_ZERO_LSN(region->pending_ckp)) {
-		for (txnp =
-		    SH_TAILQ_FIRST(&region->active_txn, __txn_detail);
-		    txnp != NULL;
-		    txnp = SH_TAILQ_NEXT(txnp, links, __txn_detail)) {
-
-			/*
-			 * Look through the active transactions for the
-			 * lowest begin lsn.
-			 */
-			if (!IS_ZERO_LSN(txnp->begin_lsn) &&
-			    log_compare(&txnp->begin_lsn, &ckp_lsn) < 0)
-				ckp_lsn = txnp->begin_lsn;
-		}
-		region->pending_ckp = ckp_lsn;
-	} else
-		ckp_lsn = region->pending_ckp;
-
+	for (txnp = SH_TAILQ_FIRST(&region->active_txn, __txn_detail);
+	    txnp != NULL;
+	    txnp = SH_TAILQ_NEXT(txnp, links, __txn_detail))
+		if (!IS_ZERO_LSN(txnp->begin_lsn) &&
+		    log_compare(&txnp->begin_lsn, &ckp_lsn) < 0)
+			ckp_lsn = txnp->begin_lsn;
 	R_UNLOCK(dbenv, &mgr->reginfo);
 
+	if (MPOOL_ON(dbenv) && (ret = dbenv->memp_sync(dbenv, NULL)) != 0) {
+		__db_err(dbenv,
+		    "txn_checkpoint: failed to flush the buffer cache %s",
+		    db_strerror(ret));
+		return (ret);
+	}
+
 	/*
-	 * Try three times to sync the mpool buffers up to the specified LSN,
-	 * sleeping 1, 2 and 4 seconds between attempts.
+	 * Because we can't be a replication client here, and because
+	 * recovery (somewhat unusually) calls txn_checkpoint and expects
+	 * it to write a log message, LOGGING_ON is the correct macro here.
 	 */
-	if (MPOOL_ON(dbenv))
-		for (interval = 1;;) {
-			/*
-			 * memp_sync may change the lsn you pass it, so don't
-			 * pass it the actual ckp_lsn, pass it a local instead.
-			 */
-			sync_lsn = ckp_lsn;
-			if ((ret = memp_sync(dbenv, &sync_lsn)) == 0)
-				break;
-
-			/*
-			 * ret == DB_INCOMPLETE means there are still buffers
-			 * to flush, the checkpoint is not complete.
-			 */
-			if (ret == DB_INCOMPLETE) {
-				if (interval > 4)
-					return (ret);
-
-				(void)__os_sleep(dbenv, interval, 0);
-				interval *= 2;
-			} else {
-				__db_err(dbenv,
-				    "txn_checkpoint: failure in memp_sync %s",
-				    db_strerror(ret));
-				return (ret);
-			}
-		}
-
 	if (LOGGING_ON(dbenv)) {
 		R_LOCK(dbenv, &mgr->reginfo);
 		last_ckp = region->last_ckp;
-		ZERO_LSN(region->pending_ckp);
 		R_UNLOCK(dbenv, &mgr->reginfo);
 
-		if ((ret = __txn_ckp_log(dbenv,
-		    NULL, &ckp_lsn, DB_CHECKPOINT, &ckp_lsn,
+		/*
+		 * Put out records for the open files before we log
+		 * the checkpoint.  The records are certain to be at
+		 * or after ckp_lsn, but before the checkpoint record
+		 * itself, so they're sure to be included if we start
+		 * recovery from the ckp_lsn contained in this
+		 * checkpoint.
+		 */
+		if ((ret = __dbreg_open_files(dbenv)) != 0 ||
+		    (ret = __txn_ckp_log(dbenv,
+		    NULL, &ckp_lsn, DB_PERMANENT | DB_FLUSH, &ckp_lsn,
 		    &last_ckp, (int32_t)time(NULL))) != 0) {
 			__db_err(dbenv,
 			    "txn_checkpoint: log failed at LSN [%ld %ld] %s",
@@ -834,15 +1209,52 @@ do_ckp:
 			return (ret);
 		}
 
+		/*
+		 * We want to make sure last_ckp only moves forward;  since
+		 * we drop locks above and in log_put, it's possible
+		 * for two calls to __txn_ckp_log to finish in a different
+		 * order from how they were called.
+		 */
 		R_LOCK(dbenv, &mgr->reginfo);
-		region->last_ckp = ckp_lsn;
-		(void)time(&region->time_ckp);
+		if (log_compare(&region->last_ckp, &ckp_lsn) < 0) {
+			region->last_ckp = ckp_lsn;
+			(void)time(&region->time_ckp);
+		}
 		R_UNLOCK(dbenv, &mgr->reginfo);
 	}
 	return (0);
 }
 
 /*
+ * __txn_getckp --
+ *	Get the LSN of the last transaction checkpoint.
+ *
+ * PUBLIC: int __txn_getckp __P((DB_ENV *, DB_LSN *));
+ */
+int
+__txn_getckp(dbenv, lsnp)
+	DB_ENV *dbenv;
+	DB_LSN *lsnp;
+{
+	DB_LSN lsn;
+	DB_TXNMGR *mgr;
+	DB_TXNREGION *region;
+
+	mgr = dbenv->tx_handle;
+	region = mgr->reginfo.primary;
+
+	R_LOCK(dbenv, &mgr->reginfo);
+	lsn = region->last_ckp;
+	R_UNLOCK(dbenv, &mgr->reginfo);
+
+	if (IS_ZERO_LSN(lsn))
+		return (DB_NOTFOUND);
+
+	*lsnp = lsn;
+	return (0);
+}
+
+/*
  * __txn_activekids --
  *	Return if this transaction has any active children.
  *
@@ -858,7 +1270,7 @@ __txn_activekids(dbenv, rectype, txnp)
 	 * On a child commit, we know that there are children (i.e., the
 	 * commiting child at the least.  In that case, skip this check.
 	 */
-	if (rectype == DB_txn_child)
+	if (F_ISSET(txnp, TXN_COMPENSATE) || rectype == DB___txn_child)
 		return (0);
 
 	if (TAILQ_FIRST(&txnp->kids) != NULL) {
@@ -867,3 +1279,128 @@ __txn_activekids(dbenv, rectype, txnp)
 	}
 	return (0);
 }
+
+/*
+ * __txn_force_abort --
+ *	Force an abort record into the log if the commit record
+ *	failed to get to disk.
+ *
+ * PUBLIC: int __txn_force_abort __P((DB_ENV *, u_int8_t *));
+ */
+int
+__txn_force_abort(dbenv, buffer)
+	DB_ENV *dbenv;
+	u_int8_t *buffer;
+{
+	DB_CIPHER *db_cipher;
+	HDR *hdr;
+	u_int32_t offset, opcode, rec_len, rec_type, sum_len;
+	u_int8_t *bp, *key, chksum[DB_MAC_KEY];
+	size_t hdrsize;
+	int ret;
+
+	db_cipher = dbenv->crypto_handle;
+
+	/*
+	 * This routine depends on the layout of HDR and the __txn_regop
+	 * record in txn.src.  We are passed the beginning of the commit
+	 * record in the log buffer and overwrite the commit with an abort
+	 * and recalculate the checksum.  We may be passed a txn_xa_regop
+	 * that is, an XA prepare), there's no need to overwrite that one.
+	 */
+	hdr = (HDR *)buffer;
+	memcpy(&rec_type, hdr, sizeof(rec_type));
+	if (rec_type == DB___txn_xa_regop)
+		return (0);
+
+	offset = sizeof(u_int32_t) + sizeof(u_int32_t) + sizeof(DB_LSN);
+	rec_len = offset + sizeof(u_int32_t) + sizeof(int32_t);
+	if (CRYPTO_ON(dbenv)) {
+		key = db_cipher->mac_key;
+		hdrsize = HDR_CRYPTO_SZ;
+		sum_len = DB_MAC_KEY;
+		if ((ret = db_cipher->decrypt(dbenv, db_cipher->data,
+		    &hdr->iv[0], buffer + hdrsize, rec_len)) != 0)
+			return (__db_panic(dbenv, ret));
+	} else {
+		key = NULL;
+		hdrsize = HDR_NORMAL_SZ;
+		sum_len = sizeof(u_int32_t);
+	}
+	bp = buffer + hdrsize + offset;
+	opcode = TXN_ABORT;
+	memcpy(bp, &opcode, sizeof(opcode));
+
+	if (CRYPTO_ON(dbenv) &&
+	    (ret = db_cipher->encrypt(dbenv,
+	    db_cipher->data, &hdr->iv[0], buffer + hdrsize, rec_len)) != 0)
+		return (__db_panic(dbenv, ret));
+
+	__db_chksum(buffer + hdrsize, rec_len, key, chksum);
+	memcpy(buffer + SSZ(HDR, chksum), &chksum, sum_len);
+
+	return (0);
+}
+
+/*
+ * __txn_preclose
+ *	Before we can close an environment, we need to check if we
+ * were in the midst of taking care of restored transactions.  If
+ * so, then we need to close the files that we opened.
+ *
+ * PUBLIC: int __txn_preclose __P((DB_ENV *));
+ */
+int
+__txn_preclose(dbenv)
+	DB_ENV *dbenv;
+{
+	DB_TXNMGR *mgr;
+	DB_TXNREGION *region;
+	int do_closefiles, ret;
+
+	mgr = (DB_TXNMGR *)dbenv->tx_handle;
+	region = mgr->reginfo.primary;
+	do_closefiles = 0;
+
+	R_LOCK(dbenv, &mgr->reginfo);
+	if (region != NULL &&
+	    region->stat.st_nrestores
+	    <= mgr->n_discards && mgr->n_discards != 0)
+		do_closefiles = 1;
+	R_UNLOCK(dbenv, &mgr->reginfo);
+
+	if (do_closefiles) {
+		/*
+		 * Set the DBLOG_RECOVER flag while closing these
+		 * files so they do not create additional log records
+		 * that will confuse future recoveries.
+		 */
+		F_SET((DB_LOG *)dbenv->lg_handle, DBLOG_RECOVER);
+		ret = __dbreg_close_files(dbenv);
+		F_CLR((DB_LOG *)dbenv->lg_handle, DBLOG_RECOVER);
+	} else
+		ret = 0;
+
+	return (ret);
+}
+
+/*
+ * __txn_reset --
+ *	Reset the last txnid to its minimum value, and log the reset.
+ *
+ * PUBLIC: int __txn_reset __P((DB_ENV *));
+ */
+int
+__txn_reset(dbenv)
+	DB_ENV *dbenv;
+{
+	DB_LSN scrap;
+	DB_TXNREGION *region;
+
+	region = ((DB_TXNMGR *)dbenv->tx_handle)->reginfo.primary;
+	region->last_txnid = TXN_MINIMUM;
+
+	DB_ASSERT(LOGGING_ON(dbenv));
+	return (__txn_recycle_log(dbenv,
+	    NULL, &scrap, 0, TXN_MINIMUM, TXN_MAXIMUM));
+}
diff --git a/bdb/txn/txn.src b/bdb/txn/txn.src
index b1e131c2bd7..3f69b29e3ff 100644
--- a/bdb/txn/txn.src
+++ b/bdb/txn/txn.src
@@ -1,13 +1,14 @@
 /*-
  * See the file LICENSE for redistribution information.
  *
- * Copyright (c) 1996, 1997, 1998, 1999, 2000
+ * Copyright (c) 1996-2002
  *	Sleepycat Software.  All rights reserved.
  *
- *	$Id: txn.src,v 11.10 2001/01/02 00:58:33 margo Exp $
+ * $Id: txn.src,v 11.19 2002/03/27 04:33:15 bostic Exp $
  */
 
-PREFIX	txn
+PREFIX	__txn
+DBPRIVATE
 
 INCLUDE	#include "db_config.h"
 INCLUDE
@@ -15,25 +16,20 @@ INCLUDE #ifndef NO_SYSTEM_INCLUDES
 INCLUDE #include <sys/types.h>
 INCLUDE
 INCLUDE #include <ctype.h>
-INCLUDE #include <errno.h>
 INCLUDE #include <string.h>
 INCLUDE #endif
 INCLUDE
 INCLUDE #include "db_int.h"
-INCLUDE #include "db_page.h"
-INCLUDE #include "db_dispatch.h"
-INCLUDE #include "db_am.h"
-INCLUDE #include "txn.h"
+INCLUDE #include "dbinc/crypto.h"
+INCLUDE #include "dbinc/db_page.h"
+INCLUDE #include "dbinc/db_dispatch.h"
+INCLUDE #include "dbinc/db_am.h"
+INCLUDE #include "dbinc/log.h"
+INCLUDE #include "dbinc/rep.h"
+INCLUDE #include "dbinc/txn.h"
 INCLUDE
 
 /*
- * DEPRECATED in 3.1 to add timestamps.
- */
-DEPRECATED old_regop		6
-ARG	opcode		u_int32_t	lu
-END
-
-/*
  * This is the standard log operation for commit.
  * Note that we are using an int32_t for the timestamp.  This means that
  * in 2039 we will need to deprecate this log record and create one that
@@ -44,11 +40,6 @@ ARG	opcode		u_int32_t	lu
 ARG	timestamp	int32_t		ld
 END
 
-DEPRECATED old_ckp		7
-POINTER	ckp_lsn		DB_LSN *	lu
-POINTER	last_ckp	DB_LSN *	lu
-END
-
 /*
  * This is the checkpoint record.  It contains the lsn that the checkpoint
  * guarantees and a pointer to the last checkpoint so we can walk backwards
@@ -70,20 +61,19 @@ ARG	timestamp	int32_t		ld
 END
 
 /*
- * This is the standard log operation for prepare (since right now
- * we only use prepare in an XA environment).
+ * This is the (new) log operation for a child commit.  It is
+ * logged as a record in the PARENT.  The child field contains
+ * the transaction ID of the child committing and the c_lsn is
+ * the last LSN of the child's log trail.
  */
-DEPRECATED xa_regop_old		8
-ARG	opcode		u_int32_t	lu
-DBT	xid		DBT		s
-ARG	formatID	int32_t		ld
-ARG	gtrid		u_int32_t	u
-ARG	bqual		u_int32_t	u
+BEGIN child		12
+ARG	child	u_int32_t	lx
+POINTER	c_lsn	DB_LSN *	lu
 END
 
+
 /*
- * This is the standard log operation for prepare (since right now
- * we only use prepare in an XA environment).
+ * This is the standard log operation for prepare.
  */
 BEGIN xa_regop		13
 ARG	opcode		u_int32_t	lu
@@ -95,20 +85,9 @@ POINTER	begin_lsn	DB_LSN *	lu
 END
 
 /*
- * This is the log operation for a child commit.
- */
-DEPRECATED child_old		9
-ARG	opcode		u_int32_t	lu
-ARG	parent		u_int32_t	lx
-END
-
-/*
- * This is the (new) log operation for a child commit.  It is
- * logged as a record in the PARENT.  The child field contains
- * the transaction ID of the child committing and the c_lsn is
- * the last LSN of the child's log trail.
+ * Log the fact that we are recycling txnids.
  */
-BEGIN child	12
-ARG	child	u_int32_t	lx
-POINTER	c_lsn	DB_LSN *	lu
+BEGIN recycle		14
+ARG	min		u_int32_t	u
+ARG	max		u_int32_t	u
 END
diff --git a/bdb/txn/txn_method.c b/bdb/txn/txn_method.c
new file mode 100644
index 00000000000..60fdf30583e
--- /dev/null
+++ b/bdb/txn/txn_method.c
@@ -0,0 +1,105 @@
+/*-
+ * See the file LICENSE for redistribution information.
+ *
+ * Copyright (c) 1996-2002
+ *	Sleepycat Software.  All rights reserved.
+ */
+
+#include "db_config.h"
+
+#ifndef lint
+static const char revid[] = "$Id: txn_method.c,v 11.62 2002/05/09 20:09:35 bostic Exp $";
+#endif /* not lint */
+
+#ifndef NO_SYSTEM_INCLUDES
+#include <sys/types.h>
+
+#ifdef HAVE_RPC
+#include <rpc/rpc.h>
+#endif
+
+#include <string.h>
+#endif
+
+#include "db_int.h"
+#include "dbinc/txn.h"
+
+#ifdef HAVE_RPC
+#include "dbinc_auto/db_server.h"
+#include "dbinc_auto/rpc_client_ext.h"
+#endif
+
+static int __txn_set_tx_max __P((DB_ENV *, u_int32_t));
+static int __txn_set_tx_timestamp __P((DB_ENV *, time_t *));
+
+/*
+ * __txn_dbenv_create --
+ *	Transaction specific initialization of the DB_ENV structure.
+ *
+ * PUBLIC: void __txn_dbenv_create __P((DB_ENV *));
+ */
+void
+__txn_dbenv_create(dbenv)
+	DB_ENV *dbenv;
+{
+	/*
+	 * !!!
+	 * Our caller has not yet had the opportunity to reset the panic
+	 * state or turn off mutex locking, and so we can neither check
+	 * the panic state or acquire a mutex in the DB_ENV create path.
+	 */
+
+	dbenv->tx_max = DEF_MAX_TXNS;
+
+#ifdef HAVE_RPC
+	if (F_ISSET(dbenv, DB_ENV_RPCCLIENT)) {
+		dbenv->set_tx_max = __dbcl_set_tx_max;
+		dbenv->set_tx_timestamp = __dbcl_set_tx_timestamp;
+		dbenv->txn_checkpoint = __dbcl_txn_checkpoint;
+		dbenv->txn_recover = __dbcl_txn_recover;
+		dbenv->txn_stat = __dbcl_txn_stat;
+		dbenv->txn_begin = __dbcl_txn_begin;
+	} else
+#endif
+	{
+		dbenv->set_tx_max = __txn_set_tx_max;
+		dbenv->set_tx_timestamp = __txn_set_tx_timestamp;
+		dbenv->txn_checkpoint = __txn_checkpoint;
+#ifdef CONFIG_TEST
+		dbenv->txn_id_set = __txn_id_set;
+#endif
+		dbenv->txn_recover = __txn_recover;
+		dbenv->txn_stat = __txn_stat;
+		dbenv->txn_begin = __txn_begin;
+	}
+}
+
+/*
+ * __txn_set_tx_max --
+ *	Set the size of the transaction table.
+ */
+static int
+__txn_set_tx_max(dbenv, tx_max)
+	DB_ENV *dbenv;
+	u_int32_t tx_max;
+{
+	ENV_ILLEGAL_AFTER_OPEN(dbenv, "set_tx_max");
+
+	dbenv->tx_max = tx_max;
+	return (0);
+}
+
+/*
+ * __txn_set_tx_timestamp --
+ *	Set the transaction recovery timestamp.
+ */
+static int
+__txn_set_tx_timestamp(dbenv, timestamp)
+	DB_ENV *dbenv;
+	time_t *timestamp;
+{
+	ENV_ILLEGAL_AFTER_OPEN(dbenv, "set_tx_timestamp");
+
+	dbenv->tx_timestamp = *timestamp;
+	return (0);
+}
diff --git a/bdb/txn/txn_rec.c b/bdb/txn/txn_rec.c
index bed20d98e1e..69af6a1f907 100644
--- a/bdb/txn/txn_rec.c
+++ b/bdb/txn/txn_rec.c
@@ -1,7 +1,7 @@
 /*-
  * See the file LICENSE for redistribution information.
  *
- * Copyright (c) 1996, 1997, 1998, 1999, 2000
+ * Copyright (c) 1996-2002
  *	Sleepycat Software.  All rights reserved.
  */
 /*
@@ -36,23 +36,20 @@
 #include "db_config.h"
 
 #ifndef lint
-static const char revid[] = "$Id: txn_rec.c,v 11.15 2001/01/11 18:19:55 bostic Exp $";
+static const char revid[] = "$Id: txn_rec.c,v 11.41 2002/08/06 04:42:37 bostic Exp $";
 #endif /* not lint */
 
 #ifndef NO_SYSTEM_INCLUDES
 #include <sys/types.h>
 
+#include <string.h>
 #endif
 
 #include "db_int.h"
-#include "db_page.h"
-#include "txn.h"
-#include "db_am.h"
-#include "db_dispatch.h"
-#include "log.h"
-#include "common_ext.h"
-
-static int __txn_restore_txn __P((DB_ENV *, DB_LSN *, __txn_xa_regop_args *));
+#include "dbinc/db_page.h"
+#include "dbinc/txn.h"
+#include "dbinc/db_am.h"
+#include "dbinc/db_dispatch.h"
 
 #define	IS_XA_TXN(R) (R->xid.size != 0)
 
@@ -72,6 +69,7 @@ __txn_regop_recover(dbenv, dbtp, lsnp, op, info)
 	db_recops op;
 	void *info;
 {
+	DB_TXNHEAD *headp;
 	__txn_regop_args *argp;
 	int ret;
 
@@ -82,31 +80,62 @@ __txn_regop_recover(dbenv, dbtp, lsnp, op, info)
 	if ((ret = __txn_regop_read(dbenv, dbtp->data, &argp)) != 0)
 		return (ret);
 
-	if (argp->opcode != TXN_COMMIT) {
-		ret = EINVAL;
-		goto err;
-	}
+	headp = info;
+	/*
+	 * We are only ever called during FORWARD_ROLL or BACKWARD_ROLL.
+	 * We check for the former explicitly and the last two clauses
+	 * apply to the BACKWARD_ROLL case.
+	 */
 
 	if (op == DB_TXN_FORWARD_ROLL)
-		ret = __db_txnlist_remove(info, argp->txnid->txnid);
-	else if (dbenv->tx_timestamp == 0 ||
-	    argp->timestamp <= (int32_t)dbenv->tx_timestamp)
 		/*
-		 * We know this is the backward roll case because we
-		 * are never called during ABORT or OPENFILES.
+		 * If this was a 2-phase-commit transaction, then it
+		 * might already have been removed from the list, and
+		 * that's OK.  Ignore the return code from remove.
 		 */
-		ret = __db_txnlist_add(dbenv, info, argp->txnid->txnid, 0);
-	else
+		(void)__db_txnlist_remove(dbenv, info, argp->txnid->txnid);
+	else if ((dbenv->tx_timestamp != 0 &&
+	    argp->timestamp > (int32_t)dbenv->tx_timestamp) ||
+	    (!IS_ZERO_LSN(headp->trunc_lsn) &&
+	    log_compare(&headp->trunc_lsn, lsnp) < 0)) {
 		/*
-		 * This is commit record, but we failed the timestamp check
-		 * so we should treat it as an abort and add it to the list
-		 * as an aborted record.
+		 * We failed either the timestamp check or the trunc_lsn check,
+		 * so we treat this as an abort even if it was a commit record.
 		 */
-		ret = __db_txnlist_add(dbenv, info, argp->txnid->txnid, 1);
+		ret = __db_txnlist_update(dbenv,
+		    info, argp->txnid->txnid, TXN_ABORT, NULL);
+
+		if (ret == TXN_NOTFOUND)
+			ret = __db_txnlist_add(dbenv,
+			    info, argp->txnid->txnid, TXN_IGNORE, NULL);
+		else if (ret != TXN_OK)
+			goto err;
+		/* else ret = 0; Not necessary because TXN_OK == 0 */
+	} else {
+		/* This is a normal commit; mark it appropriately. */
+		ret = __db_txnlist_update(dbenv,
+		    info, argp->txnid->txnid, argp->opcode, lsnp);
+
+		if (ret == TXN_NOTFOUND)
+			ret = __db_txnlist_add(dbenv,
+			    info, argp->txnid->txnid,
+			    argp->opcode == TXN_ABORT ?
+			    TXN_IGNORE : argp->opcode, lsnp);
+		else if (ret != TXN_OK)
+			goto err;
+		/* else ret = 0; Not necessary because TXN_OK == 0 */
+	}
 
 	if (ret == 0)
 		*lsnp = argp->prev_lsn;
-err:	__os_free(argp, 0);
+
+	if (0) {
+err:		__db_err(dbenv,
+		    "txnid %lx commit record found, already on commit list",
+		    argp->txnid->txnid);
+		ret = EINVAL;
+	}
+	__os_free(dbenv, argp);
 
 	return (ret);
 }
@@ -140,58 +169,50 @@ __txn_xa_regop_recover(dbenv, dbtp, lsnp, op, info)
 		goto err;
 	}
 
-	ret = __db_txnlist_find(info, argp->txnid->txnid);
+	ret = __db_txnlist_find(dbenv, info, argp->txnid->txnid);
 
 	/*
 	 * If we are rolling forward, then an aborted prepare
-	 * indicates that this is the last record we'll see for
-	 * this transaction ID and we should remove it from the
+	 * indicates that this may the last record we'll see for
+	 * this transaction ID, so we should remove it from the
 	 * list.
 	 */
 
-	if (op == DB_TXN_FORWARD_ROLL && ret == 1)
-		ret = __db_txnlist_remove(info, argp->txnid->txnid);
-	else if (op == DB_TXN_BACKWARD_ROLL && ret != 0) {
+	if (op == DB_TXN_FORWARD_ROLL) {
+		if ((ret = __db_txnlist_remove(dbenv,
+		    info, argp->txnid->txnid)) != TXN_OK)
+			goto txn_err;
+	} else if (op == DB_TXN_BACKWARD_ROLL && ret == TXN_PREPARE) {
 		/*
 		 * On the backward pass, we have three possibilities:
 		 * 1. The transaction is already committed, no-op.
-		 * 2. The transaction is not committed and we are XA, treat
-		 *	 like commited and roll forward so that can be committed
-		 *	 or aborted late.
-		 * 3. The transaction is not committed and we are not XA
-		 *	mark the transaction as aborted.
-		 *
-		 * Cases 2 and 3 are handled here.
+		 * 2. The transaction is already aborted, no-op.
+		 * 3. The transaction is neither committed nor aborted.
+		 *	 Treat this like a commit and roll forward so that
+		 *	 the transaction can be resurrected in the region.
+		 * We handle case 3 here; cases 1 and 2 are the final clause
+		 * below.
+		 * This is prepared, but not yet committed transaction.  We
+		 * need to add it to the transaction list, so that it gets
+		 * rolled forward. We also have to add it to the region's
+		 * internal state so it can be properly aborted or committed
+		 * after recovery (see txn_recover).
 		 */
-
-		/*
-		 * Should never have seen this transaction unless it was
-		 * commited.
-		 */
-		DB_ASSERT(ret == DB_NOTFOUND);
-
-		if (IS_XA_TXN(argp)) {
-			/*
-			 * This is an XA prepared, but not yet committed
-			 * transaction.  We need to add it to the
-			 * transaction list, so that it gets rolled
-			 * forward. We also have to add it to the region's
-			 * internal state so it can be properly aborted
-			 * or recovered.
-			 */
-			if ((ret = __db_txnlist_add(dbenv,
-			    info, argp->txnid->txnid, 0)) == 0)
-				ret = __txn_restore_txn(dbenv, lsnp, argp);
-		} else
-			ret = __db_txnlist_add(dbenv,
-			    info, argp->txnid->txnid, 1);
+		if ((ret = __db_txnlist_remove(dbenv,
+		   info, argp->txnid->txnid)) != TXN_OK) {
+txn_err:		__db_err(dbenv,
+			    "Transaction not in list %x", argp->txnid->txnid);
+			ret = DB_NOTFOUND;
+		} else if ((ret = __db_txnlist_add(dbenv,
+		   info, argp->txnid->txnid, TXN_COMMIT, lsnp)) == 0)
+			ret = __txn_restore_txn(dbenv, lsnp, argp);
 	} else
 		ret = 0;
 
 	if (ret == 0)
 		*lsnp = argp->prev_lsn;
 
-err:	__os_free(argp, 0);
+err:	__os_free(dbenv, argp);
 
 	return (ret);
 }
@@ -219,18 +240,11 @@ __txn_ckp_recover(dbenv, dbtp, lsnp, op, info)
 	if ((ret = __txn_ckp_read(dbenv, dbtp->data, &argp)) != 0)
 		return (ret);
 
-	/*
-	 * Check for 'restart' checkpoint record.  This occurs when the
-	 * checkpoint lsn is equal to the lsn of the checkpoint record
-	 * and means that we could set the transaction ID back to 1, so
-	 * that we don't exhaust the transaction ID name space.
-	 */
-	if (argp->ckp_lsn.file == lsnp->file &&
-	    argp->ckp_lsn.offset == lsnp->offset)
-		__db_txnlist_gen(info, DB_REDO(op) ? -1 : 1);
+	if (op == DB_TXN_BACKWARD_ROLL)
+		__db_txnlist_ckp(dbenv, info, lsnp);
 
 	*lsnp = argp->last_ckp;
-	__os_free(argp, 0);
+	__os_free(dbenv, argp);
 	return (DB_TXN_CKP);
 }
 
@@ -250,7 +264,7 @@ __txn_child_recover(dbenv, dbtp, lsnp, op, info)
 	void *info;
 {
 	__txn_child_args *argp;
-	int ret;
+	int c_stat, p_stat, ret;
 
 #ifdef DEBUG_RECOVER
 	(void)__txn_child_print(dbenv, dbtp, lsnp, op, info);
@@ -272,17 +286,54 @@ __txn_child_recover(dbenv, dbtp, lsnp, op, info)
 		ret = __db_txnlist_lsnadd(dbenv,
 		    info, &argp->c_lsn, TXNLIST_NEW);
 	} else if (op == DB_TXN_BACKWARD_ROLL) {
-		if (__db_txnlist_find(info, argp->txnid->txnid) == 0)
-			ret = __db_txnlist_add(dbenv, info, argp->child, 0);
-		else
-			ret = __db_txnlist_add(dbenv, info, argp->child, 1);
-	} else
-		ret = __db_txnlist_remove(info, argp->child);
+		/* Child might exist -- look for it. */
+		c_stat = __db_txnlist_find(dbenv, info, argp->child);
+		p_stat = __db_txnlist_find(dbenv, info, argp->txnid->txnid);
+
+		if (c_stat == TXN_EXPECTED) {
+			/*
+			 * The open after this create succeeded.  If the
+			 * parent succeeded, we don't want to redo; if the
+			 * parent aborted, we do want to undo.
+			 */
+			ret = __db_txnlist_update(dbenv,
+			    info, argp->child,
+			    p_stat == TXN_COMMIT ? TXN_IGNORE : TXN_ABORT,
+			    NULL);
+			if (ret > 0)
+				ret = 0;
+		} else if (c_stat == TXN_UNEXPECTED) {
+			/*
+			 * The open after this create failed.  If the parent
+			 * is rolling forward, we need to roll forward.  If
+			 * the parent failed, then we do not want to abort
+			 * (because the file may not be the one in which we
+			 * are interested).
+			 */
+			ret = __db_txnlist_update(dbenv, info, argp->child,
+			    p_stat == TXN_COMMIT ? TXN_COMMIT : TXN_IGNORE,
+			    NULL);
+			if (ret > 0)
+				ret = 0;
+		} else if (c_stat != TXN_IGNORE) {
+			ret = __db_txnlist_add(dbenv, info, argp->child,
+			    p_stat == TXN_COMMIT ? TXN_COMMIT : TXN_ABORT,
+			    NULL);
+		}
+	} else {
+		/* Forward Roll */
+		if ((ret =
+		    __db_txnlist_remove(dbenv, info, argp->child)) != TXN_OK) {
+			__db_err(dbenv,
+			    "Transaction not in list %x", argp->txnid->txnid);
+			ret = DB_NOTFOUND;
+		}
+	}
 
 	if (ret == 0)
 		*lsnp = argp->prev_lsn;
 
-	__os_free(argp, 0);
+	__os_free(dbenv, argp);
 
 	return (ret);
 }
@@ -291,13 +342,16 @@ __txn_child_recover(dbenv, dbtp, lsnp, op, info)
  * __txn_restore_txn --
  *	Using only during XA recovery.  If we find any transactions that are
  * prepared, but not yet committed, then we need to restore the transaction's
- * state into the shared region, because the TM is going to issue a txn_abort
- * or txn_commit and we need to respond correctly.
+ * state into the shared region, because the TM is going to issue an abort
+ * or commit and we need to respond correctly.
  *
  * lsnp is the LSN of the returned LSN
  * argp is the perpare record (in an appropriate structure)
+ *
+ * PUBLIC: int __txn_restore_txn __P((DB_ENV *,
+ * PUBLIC:     DB_LSN *, __txn_xa_regop_args *));
  */
-static int
+int
 __txn_restore_txn(dbenv, lsnp, argp)
 	DB_ENV *dbenv;
 	DB_LSN *lsnp;
@@ -317,8 +371,10 @@ __txn_restore_txn(dbenv, lsnp, argp)
 
 	/* Allocate a new transaction detail structure. */
 	if ((ret =
-	    __db_shalloc(mgr->reginfo.addr, sizeof(TXN_DETAIL), 0, &td)) != 0)
+	    __db_shalloc(mgr->reginfo.addr, sizeof(TXN_DETAIL), 0, &td)) != 0) {
+		R_UNLOCK(dbenv, &mgr->reginfo);
 		return (ret);
+	}
 
 	/* Place transaction on active transaction list. */
 	SH_TAILQ_INSERT_HEAD(&region->active_txn, td, links, __txn_detail);
@@ -333,7 +389,48 @@ __txn_restore_txn(dbenv, lsnp, argp)
 	td->bqual = argp->bqual;
 	td->gtrid = argp->gtrid;
 	td->format = argp->formatID;
+	td->flags = 0;
+	F_SET(td, TXN_RESTORED);
 
+	region->stat.st_nrestores++;
+	region->stat.st_nactive++;
+	if (region->stat.st_nactive > region->stat.st_maxnactive)
+		region->stat.st_maxnactive = region->stat.st_nactive;
 	R_UNLOCK(dbenv, &mgr->reginfo);
 	return (0);
 }
+
+/*
+ * __txn_recycle_recover --
+ *	Recovery function for recycle.
+ *
+ * PUBLIC: int __txn_recycle_recover
+ * PUBLIC:   __P((DB_ENV *, DBT *, DB_LSN *, db_recops, void *));
+ */
+int
+__txn_recycle_recover(dbenv, dbtp, lsnp, op, info)
+	DB_ENV *dbenv;
+	DBT *dbtp;
+	DB_LSN *lsnp;
+	db_recops op;
+	void *info;
+{
+	__txn_recycle_args *argp;
+	int ret;
+
+#ifdef DEBUG_RECOVER
+	(void)__txn_child_print(dbenv, dbtp, lsnp, op, info);
+#endif
+	if ((ret = __txn_recycle_read(dbenv, dbtp->data, &argp)) != 0)
+		return (ret);
+
+	COMPQUIET(lsnp, NULL);
+
+	if ((ret = __db_txnlist_gen(dbenv, info,
+	    DB_UNDO(op) ? -1 : 1, argp->min, argp->max)) != 0)
+		return (ret);
+
+	__os_free(dbenv, argp);
+
+	return (0);
+}
diff --git a/bdb/txn/txn_recover.c b/bdb/txn/txn_recover.c
new file mode 100644
index 00000000000..732a82e5030
--- /dev/null
+++ b/bdb/txn/txn_recover.c
@@ -0,0 +1,306 @@
+/*-
+ * See the file LICENSE for redistribution information.
+ *
+ * Copyright (c) 2001-2002
+ *	Sleepycat Software.  All rights reserved.
+ */
+
+#include "db_config.h"
+
+#ifndef lint
+static const char revid[] = "$Id: txn_recover.c,v 1.36 2002/08/19 16:59:15 bostic Exp $";
+#endif /* not lint */
+
+#ifndef NO_SYSTEM_INCLUDES
+#include <sys/types.h>
+
+#include <string.h>
+#endif
+
+#include "db_int.h"
+#include "dbinc/txn.h"
+#include "dbinc/db_page.h"
+#include "dbinc/log.h"
+#include "dbinc_auto/db_auto.h"
+#include "dbinc_auto/crdel_auto.h"
+#include "dbinc_auto/db_ext.h"
+
+/*
+ * __txn_continue
+ *	Fill in the fields of the local transaction structure given
+ *	the detail transaction structure.
+ *
+ * XXX
+ * I'm not sure that we work correctly with nested txns.
+ *
+ * PUBLIC: void __txn_continue __P((DB_ENV *, DB_TXN *, TXN_DETAIL *, size_t));
+ */
+void
+__txn_continue(env, txnp, td, off)
+	DB_ENV *env;
+	DB_TXN *txnp;
+	TXN_DETAIL *td;
+	size_t off;
+{
+	txnp->mgrp = env->tx_handle;
+	txnp->parent = NULL;
+	txnp->last_lsn = td->last_lsn;
+	txnp->txnid = td->txnid;
+	txnp->off = (roff_t)off;
+
+	txnp->abort = __txn_abort;
+	txnp->commit = __txn_commit;
+	txnp->discard = __txn_discard;
+	txnp->id = __txn_id;
+	txnp->prepare = __txn_prepare;
+
+	txnp->flags = 0;
+}
+
+/*
+ * __txn_map_gid
+ *	Return the txn that corresponds to this global ID.
+ *
+ * PUBLIC: int __txn_map_gid __P((DB_ENV *,
+ * PUBLIC:     u_int8_t *, TXN_DETAIL **, size_t *));
+ */
+int
+__txn_map_gid(dbenv, gid, tdp, offp)
+	DB_ENV *dbenv;
+	u_int8_t *gid;
+	TXN_DETAIL **tdp;
+	size_t *offp;
+{
+	DB_TXNMGR *mgr;
+	DB_TXNREGION *tmr;
+
+	mgr = dbenv->tx_handle;
+	tmr = mgr->reginfo.primary;
+
+	/*
+	 * Search the internal active transaction table to find the
+	 * matching xid.  If this is a performance hit, then we
+	 * can create a hash table, but I doubt it's worth it.
+	 */
+	R_LOCK(dbenv, &mgr->reginfo);
+	for (*tdp = SH_TAILQ_FIRST(&tmr->active_txn, __txn_detail);
+	    *tdp != NULL;
+	    *tdp = SH_TAILQ_NEXT(*tdp, links, __txn_detail))
+		if (memcmp(gid, (*tdp)->xid, sizeof((*tdp)->xid)) == 0)
+			break;
+	R_UNLOCK(dbenv, &mgr->reginfo);
+
+	if (*tdp == NULL)
+		return (EINVAL);
+
+	*offp = R_OFFSET(&mgr->reginfo, *tdp);
+	return (0);
+}
+
+/*
+ * __txn_recover --
+ *	Public interface to retrieve the list of prepared, but not yet
+ * commited transactions.  See __txn_get_prepared for details.  This
+ * function and __db_xa_recover both wrap that one.
+ *
+ * PUBLIC: int __txn_recover
+ * PUBLIC:     __P((DB_ENV *, DB_PREPLIST *, long, long *, u_int32_t));
+ */
+int
+__txn_recover(dbenv, preplist, count, retp, flags)
+	DB_ENV *dbenv;
+	DB_PREPLIST *preplist;
+	long count, *retp;
+	u_int32_t flags;
+{
+	PANIC_CHECK(dbenv);
+	ENV_REQUIRES_CONFIG(
+	    dbenv, dbenv->tx_handle, "txn_recover", DB_INIT_TXN);
+
+	if (F_ISSET((DB_TXNREGION *)
+	    ((DB_TXNMGR *)dbenv->tx_handle)->reginfo.primary,
+	    TXN_IN_RECOVERY)) {
+		__db_err(dbenv, "operation not permitted while in recovery");
+		return (EINVAL);
+	}
+	return (__txn_get_prepared(dbenv, NULL, preplist, count, retp, flags));
+}
+
+/*
+ * __txn_get_prepared --
+ *	Returns a list of prepared (and for XA, heuristically completed)
+ *	transactions (less than or equal to the count parameter).  One of
+ *	xids or txns must be set to point to an array of the appropriate type.
+ *	The count parameter indicates the number of entries in the xids and/or
+ *	txns array. The retp parameter will be set to indicate the number of
+ *	entries	returned in the xids/txns array.  Flags indicates the operation,
+ *	one of DB_FIRST or DB_NEXT.
+ *
+ * PUBLIC: int __txn_get_prepared __P((DB_ENV *,
+ * PUBLIC:     XID *, DB_PREPLIST *, long, long *, u_int32_t));
+ */
+int
+__txn_get_prepared(dbenv, xids, txns, count, retp, flags)
+	DB_ENV *dbenv;
+	XID *xids;
+	DB_PREPLIST *txns;
+	long count;		/* This is long for XA compatibility. */
+	long  *retp;
+	u_int32_t flags;
+{
+	DBT data;
+	DB_LOGC *logc;
+	DB_LSN min, open_lsn;
+	DB_PREPLIST *prepp;
+	DB_TXNMGR *mgr;
+	DB_TXNREGION *tmr;
+	TXN_DETAIL *td;
+	XID *xidp;
+	__txn_ckp_args *ckp_args;
+	long i;
+	int nrestores, open_files, ret, t_ret;
+	void *txninfo;
+
+	*retp = 0;
+
+	logc = NULL;
+	MAX_LSN(min);
+	prepp = txns;
+	xidp = xids;
+	nrestores = ret = 0;
+	open_files = 1;
+
+	/*
+	 * If we are starting a scan, then we traverse the active transaction
+	 * list once making sure that all transactions are marked as not having
+	 * been collected.  Then on each pass, we mark the ones we collected
+	 * so that if we cannot collect them all at once, we can finish up
+	 * next time with a continue.
+	 */
+
+	mgr = dbenv->tx_handle;
+	tmr = mgr->reginfo.primary;
+
+	/*
+	 * During this pass we need to figure out if we are going to need
+	 * to open files.  We need to open files if we've never collected
+	 * before (in which case, none of the COLLECTED bits will be set)
+	 * and the ones that we are collecting are restored (if they aren't
+	 * restored, then we never crashed; just the main server did).
+	 */
+	R_LOCK(dbenv, &mgr->reginfo);
+	if (flags == DB_FIRST) {
+		for (td = SH_TAILQ_FIRST(&tmr->active_txn, __txn_detail);
+		    td != NULL;
+		    td = SH_TAILQ_NEXT(td, links, __txn_detail)) {
+			if (F_ISSET(td, TXN_RESTORED))
+				nrestores++;
+			if (F_ISSET(td, TXN_COLLECTED))
+				open_files = 0;
+			F_CLR(td, TXN_COLLECTED);
+		}
+		mgr->n_discards = 0;
+	} else
+		open_files = 0;
+
+	/* Now begin collecting active transactions. */
+	for (td = SH_TAILQ_FIRST(&tmr->active_txn, __txn_detail);
+	    td != NULL && *retp < count;
+	    td = SH_TAILQ_NEXT(td, links, __txn_detail)) {
+		if (td->status != TXN_PREPARED || F_ISSET(td, TXN_COLLECTED))
+			continue;
+
+		if (xids != NULL) {
+			xidp->formatID = td->format;
+			xidp->gtrid_length = td->gtrid;
+			xidp->bqual_length = td->bqual;
+			memcpy(xidp->data, td->xid, sizeof(td->xid));
+			xidp++;
+		}
+
+		if (txns != NULL) {
+			if ((ret = __os_calloc(dbenv,
+			    1, sizeof(DB_TXN), &prepp->txn)) != 0)
+				goto err;
+			__txn_continue(dbenv,
+			    prepp->txn, td, R_OFFSET(&mgr->reginfo, td));
+			F_SET(prepp->txn, TXN_MALLOC);
+			memcpy(prepp->gid, td->xid, sizeof(td->xid));
+			prepp++;
+		}
+
+		if (log_compare(&td->begin_lsn, &min) < 0)
+			min = td->begin_lsn;
+
+		(*retp)++;
+		F_SET(td, TXN_COLLECTED);
+	}
+	R_UNLOCK(dbenv, &mgr->reginfo);
+
+	/*
+	 * Now link all the transactions into the transaction manager's list.
+	 */
+	if (txns != NULL) {
+		MUTEX_THREAD_LOCK(dbenv, mgr->mutexp);
+		for (i = 0; i < *retp; i++)
+			TAILQ_INSERT_TAIL(&mgr->txn_chain, txns[i].txn, links);
+		MUTEX_THREAD_UNLOCK(dbenv, mgr->mutexp);
+	}
+
+	if (open_files && nrestores && *retp != 0 && !IS_MAX_LSN(min)) {
+		/*
+		 * Figure out the last checkpoint before the smallest
+		 * start_lsn in the region.
+		 */
+		F_SET((DB_LOG *)dbenv->lg_handle, DBLOG_RECOVER);
+
+		if ((ret = dbenv->log_cursor(dbenv, &logc, 0)) != 0)
+			goto err;
+
+		memset(&data, 0, sizeof(data));
+		if ((ret = __txn_getckp(dbenv, &open_lsn)) == 0)
+			while (!IS_ZERO_LSN(open_lsn) && (ret =
+			    logc->get(logc, &open_lsn, &data, DB_SET)) == 0 &&
+			    log_compare(&min, &open_lsn) < 0) {
+				/* Format the log record. */
+				if ((ret = __txn_ckp_read(dbenv,
+				    data.data, &ckp_args)) != 0) {
+					__db_err(dbenv,
+				    "Invalid checkpoint record at [%lu][%lu]",
+					    (u_long)open_lsn.file,
+					    (u_long)open_lsn.offset);
+					goto err;
+				}
+				open_lsn = ckp_args->last_ckp;
+				__os_free(dbenv, ckp_args);
+			}
+
+		/*
+		 * There are three ways by which we may have gotten here.
+		 * - We got a DB_NOTFOUND -- we need to read the first
+		 *	log record.
+		 * - We found a checkpoint before min.  We're done.
+		 * - We found a checkpoint after min who's last_ckp is 0.  We
+		 *	need to start at the beginning of the log.
+		 */
+		if ((ret == DB_NOTFOUND || IS_ZERO_LSN(open_lsn)) &&
+		    (ret = logc->get(logc, &open_lsn, &data, DB_FIRST)) != 0) {
+			__db_err(dbenv, "No log records");
+			goto err;
+		}
+
+		if ((ret = __db_txnlist_init(dbenv, 0, 0, NULL, &txninfo)) != 0)
+			goto err;
+		ret = __env_openfiles(dbenv, logc,
+		    txninfo, &data, &open_lsn, NULL, 0, 0);
+		if (txninfo != NULL)
+			__db_txnlist_end(dbenv, txninfo);
+	}
+
+err:	F_CLR((DB_LOG *)dbenv->lg_handle, DBLOG_RECOVER);
+
+	if (logc != NULL && (t_ret = logc->close(logc, 0)) != 0 && ret == 0)
+		ret = t_ret;
+
+	return (ret);
+}
diff --git a/bdb/txn/txn_region.c b/bdb/txn/txn_region.c
index 77ce3d08f89..bf72d4f1d2c 100644
--- a/bdb/txn/txn_region.c
+++ b/bdb/txn/txn_region.c
@@ -1,14 +1,14 @@
 /*-
  * See the file LICENSE for redistribution information.
  *
- * Copyright (c) 1996, 1997, 1998, 1999, 2000
+ * Copyright (c) 1996-2002
  *	Sleepycat Software.  All rights reserved.
  */
 
 #include "db_config.h"
 
 #ifndef lint
-static const char revid[] = "$Id: txn_region.c,v 11.36 2001/01/11 18:19:55 bostic Exp $";
+static const char revid[] = "$Id: txn_region.c,v 11.73 2002/08/06 04:42:37 bostic Exp $";
 #endif /* not lint */
 
 #ifndef NO_SYSTEM_INCLUDES
@@ -28,98 +28,13 @@ static const char revid[] = "$Id: txn_region.c,v 11.36 2001/01/11 18:19:55 bosti
 #include <string.h>
 #endif
 
-#ifdef  HAVE_RPC
-#include "db_server.h"
-#endif
-
 #include "db_int.h"
-#include "db_page.h"
-#include "log.h"	/* for __log_lastckp */
-#include "txn.h"
-#include "db_am.h"
-
-#ifdef HAVE_RPC
-#include "gen_client_ext.h"
-#include "rpc_client_ext.h"
-#endif
+#include "dbinc/log.h"
+#include "dbinc/txn.h"
 
+static int __txn_findlastckp __P((DB_ENV *, DB_LSN *));
 static int __txn_init __P((DB_ENV *, DB_TXNMGR *));
-static int __txn_set_tx_max __P((DB_ENV *, u_int32_t));
-static int __txn_set_tx_recover __P((DB_ENV *,
-	       int (*)(DB_ENV *, DBT *, DB_LSN *, db_recops)));
-static int __txn_set_tx_timestamp __P((DB_ENV *, time_t *));
-
-/*
- * __txn_dbenv_create --
- *	Transaction specific initialization of the DB_ENV structure.
- *
- * PUBLIC: void __txn_dbenv_create __P((DB_ENV *));
- */
-void
-__txn_dbenv_create(dbenv)
-	DB_ENV *dbenv;
-{
-	dbenv->tx_max = DEF_MAX_TXNS;
-
-	dbenv->set_tx_max = __txn_set_tx_max;
-	dbenv->set_tx_recover = __txn_set_tx_recover;
-	dbenv->set_tx_timestamp = __txn_set_tx_timestamp;
-
-#ifdef HAVE_RPC
-	/*
-	 * If we have a client, overwrite what we just setup to point to
-	 * client functions.
-	 */
-	if (F_ISSET(dbenv, DB_ENV_RPCCLIENT)) {
-		dbenv->set_tx_max = __dbcl_set_tx_max;
-		dbenv->set_tx_recover = __dbcl_set_tx_recover;
-		dbenv->set_tx_timestamp = __dbcl_set_tx_timestamp;
-	}
-#endif
-}
-
-/*
- * __txn_set_tx_max --
- *	Set the size of the transaction table.
- */
-static int
-__txn_set_tx_max(dbenv, tx_max)
-	DB_ENV *dbenv;
-	u_int32_t tx_max;
-{
-	ENV_ILLEGAL_AFTER_OPEN(dbenv, "set_tx_max");
-
-	dbenv->tx_max = tx_max;
-	return (0);
-}
-
-/*
- * __txn_set_tx_recover --
- *	Set the transaction abort recover function.
- */
-static int
-__txn_set_tx_recover(dbenv, tx_recover)
-	DB_ENV *dbenv;
-	int (*tx_recover) __P((DB_ENV *, DBT *, DB_LSN *, db_recops));
-{
-	dbenv->tx_recover = tx_recover;
-	return (0);
-}
-
-/*
- * __txn_set_tx_timestamp --
- *	Set the transaction recovery timestamp.
- */
-static int
-__txn_set_tx_timestamp(dbenv, timestamp)
-	DB_ENV *dbenv;
-	time_t *timestamp;
-{
-	ENV_ILLEGAL_AFTER_OPEN(dbenv, "set_tx_timestamp");
-
-	dbenv->tx_timestamp = *timestamp;
-	return (0);
-}
+static size_t __txn_region_size __P((DB_ENV *));
 
 /*
  * __txn_open --
@@ -148,7 +63,7 @@ __txn_open(dbenv)
 	if (F_ISSET(dbenv, DB_ENV_CREATE))
 		F_SET(&tmgrp->reginfo, REGION_CREATE_OK);
 	if ((ret = __db_r_attach(dbenv,
-	    &tmgrp->reginfo, TXN_REGION_SIZE(dbenv->tx_max))) != 0)
+	    &tmgrp->reginfo, __txn_region_size(dbenv))) != 0)
 		goto err;
 
 	/* If we created the region, initialize it. */
@@ -161,14 +76,10 @@ __txn_open(dbenv)
 	    R_ADDR(&tmgrp->reginfo, tmgrp->reginfo.rp->primary);
 
 	/* Acquire a mutex to protect the active TXN list. */
-	if (F_ISSET(dbenv, DB_ENV_THREAD)) {
-		if ((ret = __db_mutex_alloc(
-		    dbenv, &tmgrp->reginfo, &tmgrp->mutexp)) != 0)
-			goto err;
-		if ((ret = __db_mutex_init(
-		    dbenv, tmgrp->mutexp, 0, MUTEX_THREAD)) != 0)
-			goto err;
-	}
+	if (F_ISSET(dbenv, DB_ENV_THREAD) &&
+	    (ret = __db_mutex_setup(dbenv, &tmgrp->reginfo, &tmgrp->mutexp,
+	    MUTEX_ALLOC | MUTEX_NO_RLOCK | MUTEX_THREAD)) != 0)
+		goto err;
 
 	R_UNLOCK(dbenv, &tmgrp->reginfo);
 
@@ -184,7 +95,7 @@ err:	if (tmgrp->reginfo.addr != NULL) {
 	}
 	if (tmgrp->mutexp != NULL)
 		__db_mutex_free(dbenv, &tmgrp->reginfo, tmgrp->mutexp);
-	__os_free(tmgrp, sizeof(*tmgrp));
+	__os_free(dbenv, tmgrp);
 	return (ret);
 }
 
@@ -200,15 +111,29 @@ __txn_init(dbenv, tmgrp)
 	DB_LSN last_ckp;
 	DB_TXNREGION *region;
 	int ret;
+#ifdef	HAVE_MUTEX_SYSTEM_RESOURCES
+	u_int8_t *addr;
+#endif
 
-	ZERO_LSN(last_ckp);
 	/*
-	 * If possible, fetch the last checkpoint LSN from the log system
-	 * so that the backwards chain of checkpoints is unbroken when
-	 * the environment is removed and recreated. [#2865]
+	 * Find the last checkpoint in the log.
 	 */
-	if (LOGGING_ON(dbenv) && (ret = __log_lastckp(dbenv, &last_ckp)) != 0)
-		return (ret);
+	ZERO_LSN(last_ckp);
+	if (LOGGING_ON(dbenv)) {
+		/*
+		 * The log system has already walked through the last
+		 * file.  Get the LSN of a checkpoint it may have found.
+		 */
+		__log_get_cached_ckp_lsn(dbenv, &last_ckp);
+
+		/*
+		 * If that didn't work, look backwards from the beginning of
+		 * the last log file until we find the last checkpoint.
+		 */
+		if (IS_ZERO_LSN(last_ckp) &&
+		    (ret = __txn_findlastckp(dbenv, &last_ckp)) != 0)
+			return (ret);
+	}
 
 	if ((ret = __db_shalloc(tmgrp->reginfo.addr,
 	    sizeof(DB_TXNREGION), 0, &tmgrp->reginfo.primary)) != 0) {
@@ -223,7 +148,7 @@ __txn_init(dbenv, tmgrp)
 
 	region->maxtxns = dbenv->tx_max;
 	region->last_txnid = TXN_MINIMUM;
-	ZERO_LSN(region->pending_ckp);
+	region->cur_maxid = TXN_MAXIMUM;
 	region->last_ckp = last_ckp;
 	region->time_ckp = time(NULL);
 
@@ -233,25 +158,86 @@ __txn_init(dbenv, tmgrp)
 	 */
 	region->logtype = 0;
 	region->locktype = 0;
-	region->naborts = 0;
-	region->ncommits = 0;
-	region->nbegins = 0;
-	region->nactive = 0;
-	region->maxnactive = 0;
 
-	SH_TAILQ_INIT(&region->active_txn);
+	memset(&region->stat, 0, sizeof(region->stat));
+	region->stat.st_maxtxns = region->maxtxns;
 
+	SH_TAILQ_INIT(&region->active_txn);
+#ifdef	HAVE_MUTEX_SYSTEM_RESOURCES
+	/* Allocate room for the txn maintenance info and initialize it. */
+	if ((ret = __db_shalloc(tmgrp->reginfo.addr,
+	    sizeof(REGMAINT) + TXN_MAINT_SIZE, 0, &addr)) != 0) {
+		__db_err(dbenv,
+		    "Unable to allocate memory for mutex maintenance");
+		return (ret);
+	}
+	__db_maintinit(&tmgrp->reginfo, addr, TXN_MAINT_SIZE);
+	region->maint_off = R_OFFSET(&tmgrp->reginfo, addr);
+#endif
 	return (0);
 }
 
 /*
- * __txn_close --
- *	Close a transaction region.
+ * __txn_findlastckp --
+ *	Find the last checkpoint in the log, walking backwards from the
+ *	beginning of the last log file.  (The log system looked through
+ *	the last log file when it started up.)
+ */
+static int
+__txn_findlastckp(dbenv, lsnp)
+	DB_ENV *dbenv;
+	DB_LSN *lsnp;
+{
+	DB_LOGC *logc;
+	DB_LSN lsn;
+	DBT dbt;
+	int ret, t_ret;
+	u_int32_t rectype;
+
+	if ((ret = dbenv->log_cursor(dbenv, &logc, 0)) != 0)
+		return (ret);
+
+	/* Get the last LSN. */
+	memset(&dbt, 0, sizeof(dbt));
+	if ((ret = logc->get(logc, &lsn, &dbt, DB_LAST)) != 0)
+		goto err;
+
+	/*
+	 * Twiddle the last LSN so it points to the beginning of the last
+	 * file;  we know there's no checkpoint after that, since the log
+	 * system already looked there.
+	 */
+	lsn.offset = 0;
+
+	/* Read backwards, looking for checkpoints. */
+	while ((ret = logc->get(logc, &lsn, &dbt, DB_PREV)) == 0) {
+		if (dbt.size < sizeof(u_int32_t))
+			continue;
+		memcpy(&rectype, dbt.data, sizeof(u_int32_t));
+		if (rectype == DB___txn_ckp) {
+			*lsnp = lsn;
+			break;
+		}
+	}
+
+err:	if ((t_ret = logc->close(logc, 0)) != 0 && ret == 0)
+		ret = t_ret;
+	/*
+	 * Not finding a checkpoint is not an error;  there may not exist
+	 * one in the log.
+	 */
+	return ((ret == 0 || ret == DB_NOTFOUND) ? 0 : ret);
+}
+
+/*
+ * __txn_dbenv_refresh --
+ *	Clean up after the transaction system on a close or failed open.
+ * Called only from __dbenv_refresh.  (Formerly called __txn_close.)
  *
- * PUBLIC: int __txn_close __P((DB_ENV *));
+ * PUBLIC: int __txn_dbenv_refresh __P((DB_ENV *));
  */
 int
-__txn_close(dbenv)
+__txn_dbenv_refresh(dbenv)
 	DB_ENV *dbenv;
 {
 	DB_TXN *txnp;
@@ -274,22 +260,23 @@ __txn_close(dbenv)
 	 */
 	if (TAILQ_FIRST(&tmgrp->txn_chain) != NULL) {
 		__db_err(dbenv,
-	"Error: closing the transaction region with active transactions\n");
+	"Error: closing the transaction region with active transactions");
 		ret = EINVAL;
 		while ((txnp = TAILQ_FIRST(&tmgrp->txn_chain)) != NULL) {
 			txnid = txnp->txnid;
-			if ((t_ret = txn_abort(txnp)) != 0) {
+			if ((t_ret = txnp->abort(txnp)) != 0) {
 				__db_err(dbenv,
-				    "Unable to abort transaction 0x%x: %s\n",
+				    "Unable to abort transaction 0x%x: %s",
 				    txnid, db_strerror(t_ret));
 				ret = __db_panic(dbenv, t_ret);
+				break;
 			}
 		}
 	}
 
 	/* Flush the log. */
 	if (LOGGING_ON(dbenv) &&
-	    (t_ret = log_flush(dbenv, NULL)) != 0 && ret == 0)
+	    (t_ret = dbenv->log_flush(dbenv, NULL)) != 0 && ret == 0)
 		ret = t_ret;
 
 	/* Discard the per-thread lock. */
@@ -300,94 +287,88 @@ __txn_close(dbenv)
 	if ((t_ret = __db_r_detach(dbenv, &tmgrp->reginfo, 0)) != 0 && ret == 0)
 		ret = t_ret;
 
-	__os_free(tmgrp, sizeof(*tmgrp));
+	__os_free(dbenv, tmgrp);
 
 	dbenv->tx_handle = NULL;
 	return (ret);
 }
 
+/*
+ * __txn_region_size --
+ *	 Return the amount of space needed for the txn region.  Make the
+ *	 region large enough to hold txn_max transaction detail structures
+ *	 plus some space to hold thread handles and the beginning of the
+ *	 shalloc region and anything we need for mutex system resource
+ *	 recording.
+ */
+static size_t
+__txn_region_size(dbenv)
+	DB_ENV *dbenv;
+{
+	size_t s;
+
+	s = sizeof(DB_TXNREGION) +
+	    dbenv->tx_max * sizeof(TXN_DETAIL) + 10 * 1024;
+#ifdef HAVE_MUTEX_SYSTEM_RESOURCES
+	if (F_ISSET(dbenv, DB_ENV_THREAD))
+		s += sizeof(REGMAINT) + TXN_MAINT_SIZE;
+#endif
+	return (s);
+}
+
+/*
+ * __txn_region_destroy
+ *	Destroy any region maintenance info.
+ *
+ * PUBLIC: void __txn_region_destroy __P((DB_ENV *, REGINFO *));
+ */
+void
+__txn_region_destroy(dbenv, infop)
+	DB_ENV *dbenv;
+	REGINFO *infop;
+{
+	__db_shlocks_destroy(infop, (REGMAINT *)R_ADDR(infop,
+	    ((DB_TXNREGION *)R_ADDR(infop, infop->rp->primary))->maint_off));
+
+	COMPQUIET(dbenv, NULL);
+	COMPQUIET(infop, NULL);
+}
+
+#ifdef CONFIG_TEST
+/*
+ * __txn_id_set --
+ *	Set the current transaction ID and current maximum unused ID (for
+ *	testing purposes only).
+ *
+ * PUBLIC: int __txn_id_set __P((DB_ENV *, u_int32_t, u_int32_t));
+ */
 int
-txn_stat(dbenv, statp, db_malloc)
+__txn_id_set(dbenv, cur_txnid, max_txnid)
 	DB_ENV *dbenv;
-	DB_TXN_STAT **statp;
-	void *(*db_malloc) __P((size_t));
+	u_int32_t cur_txnid, max_txnid;
 {
 	DB_TXNMGR *mgr;
 	DB_TXNREGION *region;
-	DB_TXN_STAT *stats;
-	TXN_DETAIL *txnp;
-	size_t nbytes;
-	u_int32_t nactive, ndx;
-	int ret, slop;
-
-#ifdef HAVE_RPC
-	if (F_ISSET(dbenv, DB_ENV_RPCCLIENT))
-		return (__dbcl_txn_stat(dbenv, statp, db_malloc));
-#endif
-
-	PANIC_CHECK(dbenv);
-	ENV_REQUIRES_CONFIG(dbenv, dbenv->tx_handle, DB_INIT_TXN);
+	int ret;
 
-	*statp = NULL;
+	ENV_REQUIRES_CONFIG(dbenv, dbenv->tx_handle, "txn_id_set", DB_INIT_TXN);
 
-	slop = 200;
 	mgr = dbenv->tx_handle;
 	region = mgr->reginfo.primary;
+	region->last_txnid = cur_txnid;
+	region->cur_maxid = max_txnid;
 
-retry:	R_LOCK(dbenv, &mgr->reginfo);
-	nactive = region->nactive;
-	R_UNLOCK(dbenv, &mgr->reginfo);
-
-	/*
-	 * Allocate extra active structures to handle any transactions that
-	 * are created while we have the region unlocked.
-	 */
-	nbytes = sizeof(DB_TXN_STAT) + sizeof(DB_TXN_ACTIVE) * (nactive + slop);
-	if ((ret = __os_malloc(dbenv, nbytes, db_malloc, &stats)) != 0)
-		return (ret);
-
-	R_LOCK(dbenv, &mgr->reginfo);
-	stats->st_last_txnid = region->last_txnid;
-	stats->st_last_ckp = region->last_ckp;
-	stats->st_maxtxns = region->maxtxns;
-	stats->st_naborts = region->naborts;
-	stats->st_nbegins = region->nbegins;
-	stats->st_ncommits = region->ncommits;
-	stats->st_pending_ckp = region->pending_ckp;
-	stats->st_time_ckp = region->time_ckp;
-	stats->st_nactive = region->nactive;
-	if (stats->st_nactive > nactive + 200) {
-		R_UNLOCK(dbenv, &mgr->reginfo);
-		slop *= 2;
-		goto retry;
+	ret = 0;
+	if (cur_txnid < TXN_MINIMUM) {
+		__db_err(dbenv, "Current ID value %lu below minimum",
+		    cur_txnid);
+		ret = EINVAL;
 	}
-	stats->st_maxnactive = region->maxnactive;
-	stats->st_txnarray = (DB_TXN_ACTIVE *)&stats[1];
-
-	ndx = 0;
-	for (txnp = SH_TAILQ_FIRST(&region->active_txn, __txn_detail);
-	    txnp != NULL;
-	    txnp = SH_TAILQ_NEXT(txnp, links, __txn_detail)) {
-		stats->st_txnarray[ndx].txnid = txnp->txnid;
-		if (txnp->parent == INVALID_ROFF)
-			stats->st_txnarray[ndx].parentid = TXN_INVALID_ID;
-		else
-			stats->st_txnarray[ndx].parentid =
-			    ((TXN_DETAIL *)R_ADDR(&mgr->reginfo,
-			    txnp->parent))->txnid;
-		stats->st_txnarray[ndx].lsn = txnp->begin_lsn;
-		ndx++;
-
-		if (ndx >= stats->st_nactive)
-			break;
+	if (max_txnid < TXN_MINIMUM) {
+		__db_err(dbenv, "Maximum ID value %lu below minimum",
+		    max_txnid);
+		ret = EINVAL;
 	}
-
-	stats->st_region_wait = mgr->reginfo.rp->mutex.mutex_set_wait;
-	stats->st_region_nowait = mgr->reginfo.rp->mutex.mutex_set_nowait;
-	stats->st_regsize = mgr->reginfo.rp->size;
-
-	R_UNLOCK(dbenv, &mgr->reginfo);
-
-	*statp = stats;
-	return (0);
+	return (ret);
 }
+#endif
diff --git a/bdb/txn/txn_stat.c b/bdb/txn/txn_stat.c
new file mode 100644
index 00000000000..f7d84e8f4c6
--- /dev/null
+++ b/bdb/txn/txn_stat.c
@@ -0,0 +1,102 @@
+/*-
+ * See the file LICENSE for redistribution information.
+ *
+ * Copyright (c) 1996-2002
+ *	Sleepycat Software.  All rights reserved.
+ */
+
+#include "db_config.h"
+
+#ifndef lint
+static const char revid[] = "$Id: txn_stat.c,v 11.15 2002/04/26 23:00:36 bostic Exp $";
+#endif /* not lint */
+
+#ifndef NO_SYSTEM_INCLUDES
+#include <sys/types.h>
+
+#include <string.h>
+#endif
+
+#include "db_int.h"
+#include "dbinc/txn.h"
+
+/*
+ * __txn_stat --
+ *
+ * PUBLIC: int __txn_stat __P((DB_ENV *, DB_TXN_STAT **, u_int32_t));
+ */
+int
+__txn_stat(dbenv, statp, flags)
+	DB_ENV *dbenv;
+	DB_TXN_STAT **statp;
+	u_int32_t flags;
+{
+	DB_TXNMGR *mgr;
+	DB_TXNREGION *region;
+	DB_TXN_STAT *stats;
+	TXN_DETAIL *txnp;
+	size_t nbytes;
+	u_int32_t ndx;
+	int ret;
+
+	PANIC_CHECK(dbenv);
+	ENV_REQUIRES_CONFIG(dbenv, dbenv->tx_handle, "txn_stat", DB_INIT_TXN);
+
+	*statp = NULL;
+	if ((ret = __db_fchk(dbenv,
+	    "DB_ENV->txn_stat", flags, DB_STAT_CLEAR)) != 0)
+		return (ret);
+
+	mgr = dbenv->tx_handle;
+	region = mgr->reginfo.primary;
+
+	/*
+	 * Allocate for the maximum active transactions -- the DB_TXN_ACTIVE
+	 * struct is small and the maximum number of active transactions is
+	 * not going to be that large.  Don't have to lock anything to look
+	 * at the region's maximum active transactions value, it's read-only
+	 * and never changes after the region is created.
+	 */
+	nbytes = sizeof(DB_TXN_STAT) + sizeof(DB_TXN_ACTIVE) * region->maxtxns;
+	if ((ret = __os_umalloc(dbenv, nbytes, &stats)) != 0)
+		return (ret);
+
+	R_LOCK(dbenv, &mgr->reginfo);
+	memcpy(stats, &region->stat, sizeof(*stats));
+	stats->st_last_txnid = region->last_txnid;
+	stats->st_last_ckp = region->last_ckp;
+	stats->st_time_ckp = region->time_ckp;
+	stats->st_txnarray = (DB_TXN_ACTIVE *)&stats[1];
+
+	ndx = 0;
+	for (txnp = SH_TAILQ_FIRST(&region->active_txn, __txn_detail);
+	    txnp != NULL;
+	    txnp = SH_TAILQ_NEXT(txnp, links, __txn_detail)) {
+		stats->st_txnarray[ndx].txnid = txnp->txnid;
+		if (txnp->parent == INVALID_ROFF)
+			stats->st_txnarray[ndx].parentid = TXN_INVALID;
+		else
+			stats->st_txnarray[ndx].parentid =
+			    ((TXN_DETAIL *)R_ADDR(&mgr->reginfo,
+			    txnp->parent))->txnid;
+		stats->st_txnarray[ndx].lsn = txnp->begin_lsn;
+		ndx++;
+	}
+
+	stats->st_region_wait = mgr->reginfo.rp->mutex.mutex_set_wait;
+	stats->st_region_nowait = mgr->reginfo.rp->mutex.mutex_set_nowait;
+	stats->st_regsize = mgr->reginfo.rp->size;
+	if (LF_ISSET(DB_STAT_CLEAR)) {
+		mgr->reginfo.rp->mutex.mutex_set_wait = 0;
+		mgr->reginfo.rp->mutex.mutex_set_nowait = 0;
+		memset(&region->stat, 0, sizeof(region->stat));
+		region->stat.st_maxtxns = region->maxtxns;
+		region->stat.st_maxnactive =
+		    region->stat.st_nactive = stats->st_nactive;
+	}
+
+	R_UNLOCK(dbenv, &mgr->reginfo);
+
+	*statp = stats;
+	return (0);
+}
diff --git a/bdb/txn/txn_util.c b/bdb/txn/txn_util.c
new file mode 100644
index 00000000000..cbfbc419615
--- /dev/null
+++ b/bdb/txn/txn_util.c
@@ -0,0 +1,234 @@
+/*-
+ * See the file LICENSE for redistribution information.
+ *
+ * Copyright (c) 2001-2002
+ *	Sleepycat Software.  All rights reserved.
+ */
+
+#include "db_config.h"
+
+#ifndef lint
+static const char revid[] = "$Id: txn_util.c,v 11.18 2002/08/06 06:25:12 bostic Exp $";
+#endif /* not lint */
+
+#ifndef NO_SYSTEM_INCLUDES
+#include <sys/types.h>
+#include <string.h>
+#endif
+
+#include "db_int.h"
+#include "dbinc/db_shash.h"
+#include "dbinc/lock.h"
+#include "dbinc/txn.h"
+
+typedef struct __txn_event TXN_EVENT;
+struct __txn_event {
+	TXN_EVENT_T op;
+	TAILQ_ENTRY(__txn_event) links;
+	union {
+		struct {
+			/* Delayed remove. */
+			char *name;
+			u_int8_t *fileid;
+		} r;
+		struct {
+			/* Lock event. */
+			DB_LOCK lock;
+			u_int32_t locker;
+			DB *dbp;
+		} t;
+	} u;
+};
+
+/*
+ * __txn_remevent --
+ *
+ * Creates a remove event that can be added to the commit list.
+ *
+ * PUBLIC: int __txn_remevent __P((DB_ENV *,
+ * PUBLIC:       DB_TXN *, const char *, u_int8_t*));
+ */
+int
+__txn_remevent(dbenv, txn, name, fileid)
+	DB_ENV *dbenv;
+	DB_TXN *txn;
+	const char *name;
+	u_int8_t *fileid;
+{
+	int ret;
+	TXN_EVENT *e;
+
+	e = NULL;
+	if ((ret = __os_calloc(dbenv, 1, sizeof(TXN_EVENT), &e)) != 0)
+		return (ret);
+
+	if ((ret = __os_strdup(dbenv, name, &e->u.r.name)) != 0)
+		goto err;
+
+	if (fileid != NULL) {
+		if ((ret = __os_calloc(dbenv,
+		    1, DB_FILE_ID_LEN, &e->u.r.fileid)) != 0)
+			return (ret);
+		memcpy(e->u.r.fileid, fileid, DB_FILE_ID_LEN);
+	}
+
+	e->op = TXN_REMOVE;
+	TAILQ_INSERT_TAIL(&txn->events, e, links);
+
+	return (0);
+
+err:	if (e != NULL)
+		__os_free(dbenv, e);
+
+	return (ret);
+}
+
+/*
+ * __txn_lockevent --
+ *
+ * Add a lockevent to the commit-queue.  The lock event indicates a locker
+ * trade.
+ *
+ * PUBLIC: int __txn_lockevent __P((DB_ENV *,
+ * PUBLIC:     DB_TXN *, DB *, DB_LOCK *, u_int32_t));
+ */
+int
+__txn_lockevent(dbenv, txn, dbp, lock, locker)
+	DB_ENV *dbenv;
+	DB_TXN *txn;
+	DB *dbp;
+	DB_LOCK *lock;
+	u_int32_t locker;
+{
+	int ret;
+	TXN_EVENT *e;
+
+	if (!LOCKING_ON(dbenv))
+		return (0);
+
+	e = NULL;
+	if ((ret = __os_calloc(dbenv, 1, sizeof(TXN_EVENT), &e)) != 0)
+		return (ret);
+
+	e->u.t.locker = locker;
+	e->u.t.lock = *lock;
+	e->u.t.dbp = dbp;
+	e->op = TXN_TRADE;
+	TAILQ_INSERT_TAIL(&txn->events, e, links);
+
+	return (0);
+}
+
+/*
+ * __txn_remlock --
+ *	Remove a lock event because the locker is going away.  We can remove
+ * by lock (using offset) or by locker_id (or by both).
+ *
+ * PUBLIC: void __txn_remlock __P((DB_ENV *, DB_TXN *, DB_LOCK *, u_int32_t));
+ */
+void
+__txn_remlock(dbenv, txn, lock, locker)
+	DB_ENV *dbenv;
+	DB_TXN *txn;
+	DB_LOCK *lock;
+	u_int32_t locker;
+{
+	TXN_EVENT *e, *next_e;
+
+	for (e = TAILQ_FIRST(&txn->events); e != NULL; e = next_e) {
+		next_e = TAILQ_NEXT(e, links);
+		if ((e->op != TXN_TRADE && e->op != TXN_TRADED) ||
+		    (e->u.t.lock.off != lock->off && e->u.t.locker != locker))
+			continue;
+		TAILQ_REMOVE(&txn->events, e, links);
+		__os_free(dbenv, e);
+	}
+
+	return;
+}
+
+/*
+ * __txn_doevents --
+ * Process the list of events associated with a transaction.  On commit,
+ * apply the events; on abort, just toss the entries.
+ *
+ * PUBLIC: int __txn_doevents __P((DB_ENV *, DB_TXN *, int, int));
+ */
+#define	DO_TRADE do {							\
+	memset(&req, 0, sizeof(req));					\
+	req.lock = e->u.t.lock;						\
+	req.op = DB_LOCK_TRADE;						\
+	t_ret = __lock_vec(dbenv, e->u.t.locker, 0, &req, 1, NULL);	\
+	if (t_ret == 0)							\
+		e->u.t.dbp->cur_lid = e->u.t.locker;			\
+	else if (t_ret == DB_NOTFOUND)					\
+		t_ret = 0;						\
+	if (t_ret != 0 && ret == 0)					\
+		ret = t_ret;						\
+	e->op = TXN_TRADED;						\
+} while (0)
+
+int
+__txn_doevents(dbenv, txn, is_commit, preprocess)
+	DB_ENV *dbenv;
+	DB_TXN *txn;
+	int is_commit, preprocess;
+{
+	DB_LOCKREQ req;
+	TXN_EVENT *e;
+	int ret, t_ret;
+
+	ret = 0;
+
+	/*
+	 * This phase only gets called if we have a phase where we
+	 * release read locks.  Since not all paths will call this
+	 * phase, we have to check for it below as well.  So, when
+	 * we do the trade, we update the opcode of the entry so that
+	 * we don't try the trade again.
+	 */
+	if (preprocess) {
+		for (e = TAILQ_FIRST(&txn->events);
+		    e != NULL; e = TAILQ_NEXT(e, links)) {
+			if (e->op != TXN_TRADE)
+				continue;
+			DO_TRADE;
+		}
+		return (ret);
+	}
+
+	while ((e = TAILQ_FIRST(&txn->events)) != NULL) {
+		TAILQ_REMOVE(&txn->events, e, links);
+		if (!is_commit)
+			goto dofree;
+		switch (e->op) {
+		case TXN_REMOVE:
+			if (e->u.r.fileid != NULL) {
+				if ((t_ret = dbenv->memp_nameop(dbenv,
+				    e->u.r.fileid,
+				    NULL, e->u.r.name, NULL)) != 0 && ret == 0)
+					ret = t_ret;
+				__os_free(dbenv, e->u.r.fileid);
+			} else if ((t_ret =
+			    __os_unlink(dbenv, e->u.r.name)) != 0 && ret == 0)
+				ret = t_ret;
+			__os_free(dbenv, e->u.r.name);
+			break;
+		case TXN_TRADE:
+			DO_TRADE;
+			/* Fall through */
+		case TXN_TRADED:
+			/* Downgrade the lock. */
+			if ((t_ret = __lock_downgrade(dbenv,
+			    &e->u.t.lock, DB_LOCK_READ, 0)) != 0 && ret == 0)
+				ret = t_ret;
+			break;
+		default:
+			/* This had better never happen. */
+			DB_ASSERT(0);
+		}
+dofree:		__os_free(dbenv, e);
+	}
+
+	return (ret);
+}