xref: /netbsd-src/sys/kern/uipc_mbuf.c (revision 5bbd2a12505d72a8177929a37b5cee489d0a1cfd)
1 /*	$NetBSD: uipc_mbuf.c,v 1.146 2012/04/29 16:36:53 dsl Exp $	*/
2 
3 /*-
4  * Copyright (c) 1999, 2001 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility,
9  * NASA Ames Research Center.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1982, 1986, 1988, 1991, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. Neither the name of the University nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  *
61  *	@(#)uipc_mbuf.c	8.4 (Berkeley) 2/14/95
62  */
63 
64 #include <sys/cdefs.h>
65 __KERNEL_RCSID(0, "$NetBSD: uipc_mbuf.c,v 1.146 2012/04/29 16:36:53 dsl Exp $");
66 
67 #include "opt_mbuftrace.h"
68 #include "opt_nmbclusters.h"
69 #include "opt_ddb.h"
70 
71 #include <sys/param.h>
72 #include <sys/systm.h>
73 #include <sys/atomic.h>
74 #include <sys/cpu.h>
75 #include <sys/proc.h>
76 #include <sys/mbuf.h>
77 #include <sys/kernel.h>
78 #include <sys/syslog.h>
79 #include <sys/domain.h>
80 #include <sys/protosw.h>
81 #include <sys/percpu.h>
82 #include <sys/pool.h>
83 #include <sys/socket.h>
84 #include <sys/sysctl.h>
85 
86 #include <net/if.h>
87 
88 pool_cache_t mb_cache;	/* mbuf cache */
89 pool_cache_t mcl_cache;	/* mbuf cluster cache */
90 
91 struct mbstat mbstat;
92 int	max_linkhdr;
93 int	max_protohdr;
94 int	max_hdr;
95 int	max_datalen;
96 
97 static int mb_ctor(void *, void *, int);
98 
99 static void	sysctl_kern_mbuf_setup(void);
100 
101 static struct sysctllog *mbuf_sysctllog;
102 
103 static struct mbuf *m_copym0(struct mbuf *, int, int, int, int);
104 static struct mbuf *m_split0(struct mbuf *, int, int, int);
105 static int m_copyback0(struct mbuf **, int, int, const void *, int, int);
106 
107 /* flags for m_copyback0 */
108 #define	M_COPYBACK0_COPYBACK	0x0001	/* copyback from cp */
109 #define	M_COPYBACK0_PRESERVE	0x0002	/* preserve original data */
110 #define	M_COPYBACK0_COW		0x0004	/* do copy-on-write */
111 #define	M_COPYBACK0_EXTEND	0x0008	/* extend chain */
112 
113 static const char mclpool_warnmsg[] =
114     "WARNING: mclpool limit reached; increase kern.mbuf.nmbclusters";
115 
116 MALLOC_DEFINE(M_MBUF, "mbuf", "mbuf");
117 
118 static percpu_t *mbstat_percpu;
119 
120 #ifdef MBUFTRACE
121 struct mownerhead mowners = LIST_HEAD_INITIALIZER(mowners);
122 struct mowner unknown_mowners[] = {
123 	MOWNER_INIT("unknown", "free"),
124 	MOWNER_INIT("unknown", "data"),
125 	MOWNER_INIT("unknown", "header"),
126 	MOWNER_INIT("unknown", "soname"),
127 	MOWNER_INIT("unknown", "soopts"),
128 	MOWNER_INIT("unknown", "ftable"),
129 	MOWNER_INIT("unknown", "control"),
130 	MOWNER_INIT("unknown", "oobdata"),
131 };
132 struct mowner revoked_mowner = MOWNER_INIT("revoked", "");
133 #endif
134 
135 #define	MEXT_ISEMBEDDED(m) ((m)->m_ext_ref == (m))
136 
137 #define	MCLADDREFERENCE(o, n)						\
138 do {									\
139 	KASSERT(((o)->m_flags & M_EXT) != 0);				\
140 	KASSERT(((n)->m_flags & M_EXT) == 0);				\
141 	KASSERT((o)->m_ext.ext_refcnt >= 1);				\
142 	(n)->m_flags |= ((o)->m_flags & M_EXTCOPYFLAGS);		\
143 	atomic_inc_uint(&(o)->m_ext.ext_refcnt);			\
144 	(n)->m_ext_ref = (o)->m_ext_ref;				\
145 	mowner_ref((n), (n)->m_flags);					\
146 	MCLREFDEBUGN((n), __FILE__, __LINE__);				\
147 } while (/* CONSTCOND */ 0)
148 
149 static int
150 nmbclusters_limit(void)
151 {
152 #if defined(PMAP_MAP_POOLPAGE)
153 	/* direct mapping, doesn't use space in kmem_map */
154 	vsize_t max_size = physmem / 4;
155 #else
156 	vsize_t max_size = MIN(physmem / 4, nkmempages / 4);
157 #endif
158 
159 	max_size = max_size * PAGE_SIZE / MCLBYTES;
160 #ifdef NMBCLUSTERS_MAX
161 	max_size = MIN(max_size, NMBCLUSTERS_MAX);
162 #endif
163 
164 #ifdef NMBCLUSTERS
165 	return MIN(max_size, NMBCLUSTERS);
166 #else
167 	return max_size;
168 #endif
169 }
170 
171 /*
172  * Initialize the mbuf allocator.
173  */
174 void
175 mbinit(void)
176 {
177 
178 	CTASSERT(sizeof(struct _m_ext) <= MHLEN);
179 	CTASSERT(sizeof(struct mbuf) == MSIZE);
180 
181 	sysctl_kern_mbuf_setup();
182 
183 	mb_cache = pool_cache_init(msize, 0, 0, 0, "mbpl",
184 	    NULL, IPL_VM, mb_ctor, NULL, NULL);
185 	KASSERT(mb_cache != NULL);
186 
187 	mcl_cache = pool_cache_init(mclbytes, 0, 0, 0, "mclpl", NULL,
188 	    IPL_VM, NULL, NULL, NULL);
189 	KASSERT(mcl_cache != NULL);
190 
191 	pool_cache_set_drain_hook(mb_cache, m_reclaim, NULL);
192 	pool_cache_set_drain_hook(mcl_cache, m_reclaim, NULL);
193 
194 	/*
195 	 * Set an arbitrary default limit on the number of mbuf clusters.
196 	 */
197 #ifdef NMBCLUSTERS
198 	nmbclusters = nmbclusters_limit();
199 #else
200 	nmbclusters = MAX(1024,
201 	    (vsize_t)physmem * PAGE_SIZE / MCLBYTES / 16);
202 	nmbclusters = MIN(nmbclusters, nmbclusters_limit());
203 #endif
204 
205 	/*
206 	 * Set the hard limit on the mclpool to the number of
207 	 * mbuf clusters the kernel is to support.  Log the limit
208 	 * reached message max once a minute.
209 	 */
210 	pool_cache_sethardlimit(mcl_cache, nmbclusters, mclpool_warnmsg, 60);
211 
212 	mbstat_percpu = percpu_alloc(sizeof(struct mbstat_cpu));
213 
214 	/*
215 	 * Set a low water mark for both mbufs and clusters.  This should
216 	 * help ensure that they can be allocated in a memory starvation
217 	 * situation.  This is important for e.g. diskless systems which
218 	 * must allocate mbufs in order for the pagedaemon to clean pages.
219 	 */
220 	pool_cache_setlowat(mb_cache, mblowat);
221 	pool_cache_setlowat(mcl_cache, mcllowat);
222 
223 #ifdef MBUFTRACE
224 	{
225 		/*
226 		 * Attach the unknown mowners.
227 		 */
228 		int i;
229 		MOWNER_ATTACH(&revoked_mowner);
230 		for (i = sizeof(unknown_mowners)/sizeof(unknown_mowners[0]);
231 		     i-- > 0; )
232 			MOWNER_ATTACH(&unknown_mowners[i]);
233 	}
234 #endif
235 }
236 
237 /*
238  * sysctl helper routine for the kern.mbuf subtree.
239  * nmbclusters, mblowat and mcllowat need range
240  * checking and pool tweaking after being reset.
241  */
242 static int
243 sysctl_kern_mbuf(SYSCTLFN_ARGS)
244 {
245 	int error, newval;
246 	struct sysctlnode node;
247 
248 	node = *rnode;
249 	node.sysctl_data = &newval;
250 	switch (rnode->sysctl_num) {
251 	case MBUF_NMBCLUSTERS:
252 	case MBUF_MBLOWAT:
253 	case MBUF_MCLLOWAT:
254 		newval = *(int*)rnode->sysctl_data;
255 		break;
256 	default:
257 		return (EOPNOTSUPP);
258 	}
259 
260 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
261 	if (error || newp == NULL)
262 		return (error);
263 	if (newval < 0)
264 		return (EINVAL);
265 
266 	switch (node.sysctl_num) {
267 	case MBUF_NMBCLUSTERS:
268 		if (newval < nmbclusters)
269 			return (EINVAL);
270 		if (newval > nmbclusters_limit())
271 			return (EINVAL);
272 		nmbclusters = newval;
273 		pool_cache_sethardlimit(mcl_cache, nmbclusters,
274 		    mclpool_warnmsg, 60);
275 		break;
276 	case MBUF_MBLOWAT:
277 		mblowat = newval;
278 		pool_cache_setlowat(mb_cache, mblowat);
279 		break;
280 	case MBUF_MCLLOWAT:
281 		mcllowat = newval;
282 		pool_cache_setlowat(mcl_cache, mcllowat);
283 		break;
284 	}
285 
286 	return (0);
287 }
288 
289 #ifdef MBUFTRACE
290 static void
291 mowner_conver_to_user_cb(void *v1, void *v2, struct cpu_info *ci)
292 {
293 	struct mowner_counter *mc = v1;
294 	struct mowner_user *mo_user = v2;
295 	int i;
296 
297 	for (i = 0; i < MOWNER_COUNTER_NCOUNTERS; i++) {
298 		mo_user->mo_counter[i] += mc->mc_counter[i];
299 	}
300 }
301 
302 static void
303 mowner_convert_to_user(struct mowner *mo, struct mowner_user *mo_user)
304 {
305 
306 	memset(mo_user, 0, sizeof(*mo_user));
307 	CTASSERT(sizeof(mo_user->mo_name) == sizeof(mo->mo_name));
308 	CTASSERT(sizeof(mo_user->mo_descr) == sizeof(mo->mo_descr));
309 	memcpy(mo_user->mo_name, mo->mo_name, sizeof(mo->mo_name));
310 	memcpy(mo_user->mo_descr, mo->mo_descr, sizeof(mo->mo_descr));
311 	percpu_foreach(mo->mo_counters, mowner_conver_to_user_cb, mo_user);
312 }
313 
314 static int
315 sysctl_kern_mbuf_mowners(SYSCTLFN_ARGS)
316 {
317 	struct mowner *mo;
318 	size_t len = 0;
319 	int error = 0;
320 
321 	if (namelen != 0)
322 		return (EINVAL);
323 	if (newp != NULL)
324 		return (EPERM);
325 
326 	LIST_FOREACH(mo, &mowners, mo_link) {
327 		struct mowner_user mo_user;
328 
329 		mowner_convert_to_user(mo, &mo_user);
330 
331 		if (oldp != NULL) {
332 			if (*oldlenp - len < sizeof(mo_user)) {
333 				error = ENOMEM;
334 				break;
335 			}
336 			error = copyout(&mo_user, (char *)oldp + len,
337 			    sizeof(mo_user));
338 			if (error)
339 				break;
340 		}
341 		len += sizeof(mo_user);
342 	}
343 
344 	if (error == 0)
345 		*oldlenp = len;
346 
347 	return (error);
348 }
349 #endif /* MBUFTRACE */
350 
351 static void
352 mbstat_conver_to_user_cb(void *v1, void *v2, struct cpu_info *ci)
353 {
354 	struct mbstat_cpu *mbsc = v1;
355 	struct mbstat *mbs = v2;
356 	int i;
357 
358 	for (i = 0; i < __arraycount(mbs->m_mtypes); i++) {
359 		mbs->m_mtypes[i] += mbsc->m_mtypes[i];
360 	}
361 }
362 
363 static void
364 mbstat_convert_to_user(struct mbstat *mbs)
365 {
366 
367 	memset(mbs, 0, sizeof(*mbs));
368 	mbs->m_drain = mbstat.m_drain;
369 	percpu_foreach(mbstat_percpu, mbstat_conver_to_user_cb, mbs);
370 }
371 
372 static int
373 sysctl_kern_mbuf_stats(SYSCTLFN_ARGS)
374 {
375 	struct sysctlnode node;
376 	struct mbstat mbs;
377 
378 	mbstat_convert_to_user(&mbs);
379 	node = *rnode;
380 	node.sysctl_data = &mbs;
381 	node.sysctl_size = sizeof(mbs);
382 	return sysctl_lookup(SYSCTLFN_CALL(&node));
383 }
384 
385 static void
386 sysctl_kern_mbuf_setup(void)
387 {
388 
389 	KASSERT(mbuf_sysctllog == NULL);
390 	sysctl_createv(&mbuf_sysctllog, 0, NULL, NULL,
391 		       CTLFLAG_PERMANENT,
392 		       CTLTYPE_NODE, "kern", NULL,
393 		       NULL, 0, NULL, 0,
394 		       CTL_KERN, CTL_EOL);
395 	sysctl_createv(&mbuf_sysctllog, 0, NULL, NULL,
396 		       CTLFLAG_PERMANENT,
397 		       CTLTYPE_NODE, "mbuf",
398 		       SYSCTL_DESCR("mbuf control variables"),
399 		       NULL, 0, NULL, 0,
400 		       CTL_KERN, KERN_MBUF, CTL_EOL);
401 
402 	sysctl_createv(&mbuf_sysctllog, 0, NULL, NULL,
403 		       CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE,
404 		       CTLTYPE_INT, "msize",
405 		       SYSCTL_DESCR("mbuf base size"),
406 		       NULL, msize, NULL, 0,
407 		       CTL_KERN, KERN_MBUF, MBUF_MSIZE, CTL_EOL);
408 	sysctl_createv(&mbuf_sysctllog, 0, NULL, NULL,
409 		       CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE,
410 		       CTLTYPE_INT, "mclbytes",
411 		       SYSCTL_DESCR("mbuf cluster size"),
412 		       NULL, mclbytes, NULL, 0,
413 		       CTL_KERN, KERN_MBUF, MBUF_MCLBYTES, CTL_EOL);
414 	sysctl_createv(&mbuf_sysctllog, 0, NULL, NULL,
415 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
416 		       CTLTYPE_INT, "nmbclusters",
417 		       SYSCTL_DESCR("Limit on the number of mbuf clusters"),
418 		       sysctl_kern_mbuf, 0, &nmbclusters, 0,
419 		       CTL_KERN, KERN_MBUF, MBUF_NMBCLUSTERS, CTL_EOL);
420 	sysctl_createv(&mbuf_sysctllog, 0, NULL, NULL,
421 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
422 		       CTLTYPE_INT, "mblowat",
423 		       SYSCTL_DESCR("mbuf low water mark"),
424 		       sysctl_kern_mbuf, 0, &mblowat, 0,
425 		       CTL_KERN, KERN_MBUF, MBUF_MBLOWAT, CTL_EOL);
426 	sysctl_createv(&mbuf_sysctllog, 0, NULL, NULL,
427 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
428 		       CTLTYPE_INT, "mcllowat",
429 		       SYSCTL_DESCR("mbuf cluster low water mark"),
430 		       sysctl_kern_mbuf, 0, &mcllowat, 0,
431 		       CTL_KERN, KERN_MBUF, MBUF_MCLLOWAT, CTL_EOL);
432 	sysctl_createv(&mbuf_sysctllog, 0, NULL, NULL,
433 		       CTLFLAG_PERMANENT,
434 		       CTLTYPE_STRUCT, "stats",
435 		       SYSCTL_DESCR("mbuf allocation statistics"),
436 		       sysctl_kern_mbuf_stats, 0, NULL, 0,
437 		       CTL_KERN, KERN_MBUF, MBUF_STATS, CTL_EOL);
438 #ifdef MBUFTRACE
439 	sysctl_createv(&mbuf_sysctllog, 0, NULL, NULL,
440 		       CTLFLAG_PERMANENT,
441 		       CTLTYPE_STRUCT, "mowners",
442 		       SYSCTL_DESCR("Information about mbuf owners"),
443 		       sysctl_kern_mbuf_mowners, 0, NULL, 0,
444 		       CTL_KERN, KERN_MBUF, MBUF_MOWNERS, CTL_EOL);
445 #endif /* MBUFTRACE */
446 }
447 
448 static int
449 mb_ctor(void *arg, void *object, int flags)
450 {
451 	struct mbuf *m = object;
452 
453 #ifdef POOL_VTOPHYS
454 	m->m_paddr = POOL_VTOPHYS(m);
455 #else
456 	m->m_paddr = M_PADDR_INVALID;
457 #endif
458 	return (0);
459 }
460 
461 void
462 m_reclaim(void *arg, int flags)
463 {
464 	struct domain *dp;
465 	const struct protosw *pr;
466 	struct ifnet *ifp;
467 	int s;
468 
469 	KERNEL_LOCK(1, NULL);
470 	s = splvm();
471 	DOMAIN_FOREACH(dp) {
472 		for (pr = dp->dom_protosw;
473 		     pr < dp->dom_protoswNPROTOSW; pr++)
474 			if (pr->pr_drain)
475 				(*pr->pr_drain)();
476 	}
477 	IFNET_FOREACH(ifp) {
478 		if (ifp->if_drain)
479 			(*ifp->if_drain)(ifp);
480 	}
481 	splx(s);
482 	mbstat.m_drain++;
483 	KERNEL_UNLOCK_ONE(NULL);
484 }
485 
486 /*
487  * Space allocation routines.
488  * These are also available as macros
489  * for critical paths.
490  */
491 struct mbuf *
492 m_get(int nowait, int type)
493 {
494 	struct mbuf *m;
495 
496 	KASSERT(type != MT_FREE);
497 
498 	m = pool_cache_get(mb_cache,
499 	    nowait == M_WAIT ? PR_WAITOK|PR_LIMITFAIL : 0);
500 	if (m == NULL)
501 		return NULL;
502 
503 	mbstat_type_add(type, 1);
504 	mowner_init(m, type);
505 	m->m_ext_ref = m;
506 	m->m_type = type;
507 	m->m_next = NULL;
508 	m->m_nextpkt = NULL;
509 	m->m_data = m->m_dat;
510 	m->m_flags = 0;
511 
512 	return m;
513 }
514 
515 struct mbuf *
516 m_gethdr(int nowait, int type)
517 {
518 	struct mbuf *m;
519 
520 	m = m_get(nowait, type);
521 	if (m == NULL)
522 		return NULL;
523 
524 	m->m_data = m->m_pktdat;
525 	m->m_flags = M_PKTHDR;
526 	m->m_pkthdr.rcvif = NULL;
527 	m->m_pkthdr.csum_flags = 0;
528 	m->m_pkthdr.csum_data = 0;
529 	SLIST_INIT(&m->m_pkthdr.tags);
530 
531 	return m;
532 }
533 
534 struct mbuf *
535 m_getclr(int nowait, int type)
536 {
537 	struct mbuf *m;
538 
539 	MGET(m, nowait, type);
540 	if (m == 0)
541 		return (NULL);
542 	memset(mtod(m, void *), 0, MLEN);
543 	return (m);
544 }
545 
546 void
547 m_clget(struct mbuf *m, int nowait)
548 {
549 
550 	MCLGET(m, nowait);
551 }
552 
553 struct mbuf *
554 m_free(struct mbuf *m)
555 {
556 	struct mbuf *n;
557 
558 	MFREE(m, n);
559 	return (n);
560 }
561 
562 void
563 m_freem(struct mbuf *m)
564 {
565 	struct mbuf *n;
566 
567 	if (m == NULL)
568 		return;
569 	do {
570 		MFREE(m, n);
571 		m = n;
572 	} while (m);
573 }
574 
575 #ifdef MBUFTRACE
576 /*
577  * Walk a chain of mbufs, claiming ownership of each mbuf in the chain.
578  */
579 void
580 m_claimm(struct mbuf *m, struct mowner *mo)
581 {
582 
583 	for (; m != NULL; m = m->m_next)
584 		MCLAIM(m, mo);
585 }
586 #endif
587 
588 /*
589  * Mbuffer utility routines.
590  */
591 
592 /*
593  * Lesser-used path for M_PREPEND:
594  * allocate new mbuf to prepend to chain,
595  * copy junk along.
596  */
597 struct mbuf *
598 m_prepend(struct mbuf *m, int len, int how)
599 {
600 	struct mbuf *mn;
601 
602 	MGET(mn, how, m->m_type);
603 	if (mn == NULL) {
604 		m_freem(m);
605 		return (NULL);
606 	}
607 	if (m->m_flags & M_PKTHDR) {
608 		M_MOVE_PKTHDR(mn, m);
609 	} else {
610 		MCLAIM(mn, m->m_owner);
611 	}
612 	mn->m_next = m;
613 	m = mn;
614 	if (len < MHLEN)
615 		MH_ALIGN(m, len);
616 	m->m_len = len;
617 	return (m);
618 }
619 
620 /*
621  * Make a copy of an mbuf chain starting "off0" bytes from the beginning,
622  * continuing for "len" bytes.  If len is M_COPYALL, copy to end of mbuf.
623  * The wait parameter is a choice of M_WAIT/M_DONTWAIT from caller.
624  */
625 int MCFail;
626 
627 struct mbuf *
628 m_copym(struct mbuf *m, int off0, int len, int wait)
629 {
630 
631 	return m_copym0(m, off0, len, wait, 0);	/* shallow copy on M_EXT */
632 }
633 
634 struct mbuf *
635 m_dup(struct mbuf *m, int off0, int len, int wait)
636 {
637 
638 	return m_copym0(m, off0, len, wait, 1);	/* deep copy */
639 }
640 
641 static struct mbuf *
642 m_copym0(struct mbuf *m, int off0, int len, int wait, int deep)
643 {
644 	struct mbuf *n, **np;
645 	int off = off0;
646 	struct mbuf *top;
647 	int copyhdr = 0;
648 
649 	if (off < 0 || len < 0)
650 		panic("m_copym: off %d, len %d", off, len);
651 	if (off == 0 && m->m_flags & M_PKTHDR)
652 		copyhdr = 1;
653 	while (off > 0) {
654 		if (m == 0)
655 			panic("m_copym: m == 0, off %d", off);
656 		if (off < m->m_len)
657 			break;
658 		off -= m->m_len;
659 		m = m->m_next;
660 	}
661 	np = &top;
662 	top = 0;
663 	while (len > 0) {
664 		if (m == 0) {
665 			if (len != M_COPYALL)
666 				panic("m_copym: m == 0, len %d [!COPYALL]",
667 				    len);
668 			break;
669 		}
670 		MGET(n, wait, m->m_type);
671 		*np = n;
672 		if (n == 0)
673 			goto nospace;
674 		MCLAIM(n, m->m_owner);
675 		if (copyhdr) {
676 			M_COPY_PKTHDR(n, m);
677 			if (len == M_COPYALL)
678 				n->m_pkthdr.len -= off0;
679 			else
680 				n->m_pkthdr.len = len;
681 			copyhdr = 0;
682 		}
683 		n->m_len = min(len, m->m_len - off);
684 		if (m->m_flags & M_EXT) {
685 			if (!deep) {
686 				n->m_data = m->m_data + off;
687 				MCLADDREFERENCE(m, n);
688 			} else {
689 				/*
690 				 * we are unsure about the way m was allocated.
691 				 * copy into multiple MCLBYTES cluster mbufs.
692 				 */
693 				MCLGET(n, wait);
694 				n->m_len = 0;
695 				n->m_len = M_TRAILINGSPACE(n);
696 				n->m_len = min(n->m_len, len);
697 				n->m_len = min(n->m_len, m->m_len - off);
698 				memcpy(mtod(n, void *), mtod(m, char *) + off,
699 				    (unsigned)n->m_len);
700 			}
701 		} else
702 			memcpy(mtod(n, void *), mtod(m, char *) + off,
703 			    (unsigned)n->m_len);
704 		if (len != M_COPYALL)
705 			len -= n->m_len;
706 		off += n->m_len;
707 #ifdef DIAGNOSTIC
708 		if (off > m->m_len)
709 			panic("m_copym0 overrun");
710 #endif
711 		if (off == m->m_len) {
712 			m = m->m_next;
713 			off = 0;
714 		}
715 		np = &n->m_next;
716 	}
717 	if (top == 0)
718 		MCFail++;
719 	return (top);
720 nospace:
721 	m_freem(top);
722 	MCFail++;
723 	return (NULL);
724 }
725 
726 /*
727  * Copy an entire packet, including header (which must be present).
728  * An optimization of the common case `m_copym(m, 0, M_COPYALL, how)'.
729  */
730 struct mbuf *
731 m_copypacket(struct mbuf *m, int how)
732 {
733 	struct mbuf *top, *n, *o;
734 
735 	MGET(n, how, m->m_type);
736 	top = n;
737 	if (!n)
738 		goto nospace;
739 
740 	MCLAIM(n, m->m_owner);
741 	M_COPY_PKTHDR(n, m);
742 	n->m_len = m->m_len;
743 	if (m->m_flags & M_EXT) {
744 		n->m_data = m->m_data;
745 		MCLADDREFERENCE(m, n);
746 	} else {
747 		memcpy(mtod(n, char *), mtod(m, char *), n->m_len);
748 	}
749 
750 	m = m->m_next;
751 	while (m) {
752 		MGET(o, how, m->m_type);
753 		if (!o)
754 			goto nospace;
755 
756 		MCLAIM(o, m->m_owner);
757 		n->m_next = o;
758 		n = n->m_next;
759 
760 		n->m_len = m->m_len;
761 		if (m->m_flags & M_EXT) {
762 			n->m_data = m->m_data;
763 			MCLADDREFERENCE(m, n);
764 		} else {
765 			memcpy(mtod(n, char *), mtod(m, char *), n->m_len);
766 		}
767 
768 		m = m->m_next;
769 	}
770 	return top;
771 nospace:
772 	m_freem(top);
773 	MCFail++;
774 	return NULL;
775 }
776 
777 /*
778  * Copy data from an mbuf chain starting "off" bytes from the beginning,
779  * continuing for "len" bytes, into the indicated buffer.
780  */
781 void
782 m_copydata(struct mbuf *m, int off, int len, void *vp)
783 {
784 	unsigned	count;
785 	void *		cp = vp;
786 
787 	if (off < 0 || len < 0)
788 		panic("m_copydata: off %d, len %d", off, len);
789 	while (off > 0) {
790 		if (m == NULL)
791 			panic("m_copydata: m == NULL, off %d", off);
792 		if (off < m->m_len)
793 			break;
794 		off -= m->m_len;
795 		m = m->m_next;
796 	}
797 	while (len > 0) {
798 		if (m == NULL)
799 			panic("m_copydata: m == NULL, len %d", len);
800 		count = min(m->m_len - off, len);
801 		memcpy(cp, mtod(m, char *) + off, count);
802 		len -= count;
803 		cp = (char *)cp + count;
804 		off = 0;
805 		m = m->m_next;
806 	}
807 }
808 
809 /*
810  * Concatenate mbuf chain n to m.
811  * n might be copied into m (when n->m_len is small), therefore data portion of
812  * n could be copied into an mbuf of different mbuf type.
813  * Any m_pkthdr is not updated.
814  */
815 void
816 m_cat(struct mbuf *m, struct mbuf *n)
817 {
818 
819 	while (m->m_next)
820 		m = m->m_next;
821 	while (n) {
822 		if (M_READONLY(m) || n->m_len > M_TRAILINGSPACE(m)) {
823 			/* just join the two chains */
824 			m->m_next = n;
825 			return;
826 		}
827 		/* splat the data from one into the other */
828 		memcpy(mtod(m, char *) + m->m_len, mtod(n, void *),
829 		    (u_int)n->m_len);
830 		m->m_len += n->m_len;
831 		n = m_free(n);
832 	}
833 }
834 
835 void
836 m_adj(struct mbuf *mp, int req_len)
837 {
838 	int len = req_len;
839 	struct mbuf *m;
840 	int count;
841 
842 	if ((m = mp) == NULL)
843 		return;
844 	if (len >= 0) {
845 		/*
846 		 * Trim from head.
847 		 */
848 		while (m != NULL && len > 0) {
849 			if (m->m_len <= len) {
850 				len -= m->m_len;
851 				m->m_len = 0;
852 				m = m->m_next;
853 			} else {
854 				m->m_len -= len;
855 				m->m_data += len;
856 				len = 0;
857 			}
858 		}
859 		m = mp;
860 		if (mp->m_flags & M_PKTHDR)
861 			m->m_pkthdr.len -= (req_len - len);
862 	} else {
863 		/*
864 		 * Trim from tail.  Scan the mbuf chain,
865 		 * calculating its length and finding the last mbuf.
866 		 * If the adjustment only affects this mbuf, then just
867 		 * adjust and return.  Otherwise, rescan and truncate
868 		 * after the remaining size.
869 		 */
870 		len = -len;
871 		count = 0;
872 		for (;;) {
873 			count += m->m_len;
874 			if (m->m_next == (struct mbuf *)0)
875 				break;
876 			m = m->m_next;
877 		}
878 		if (m->m_len >= len) {
879 			m->m_len -= len;
880 			if (mp->m_flags & M_PKTHDR)
881 				mp->m_pkthdr.len -= len;
882 			return;
883 		}
884 		count -= len;
885 		if (count < 0)
886 			count = 0;
887 		/*
888 		 * Correct length for chain is "count".
889 		 * Find the mbuf with last data, adjust its length,
890 		 * and toss data from remaining mbufs on chain.
891 		 */
892 		m = mp;
893 		if (m->m_flags & M_PKTHDR)
894 			m->m_pkthdr.len = count;
895 		for (; m; m = m->m_next) {
896 			if (m->m_len >= count) {
897 				m->m_len = count;
898 				break;
899 			}
900 			count -= m->m_len;
901 		}
902 		if (m)
903 			while (m->m_next)
904 				(m = m->m_next)->m_len = 0;
905 	}
906 }
907 
908 /*
909  * Rearrange an mbuf chain so that len bytes are contiguous
910  * and in the data area of an mbuf (so that mtod and dtom
911  * will work for a structure of size len).  Returns the resulting
912  * mbuf chain on success, frees it and returns null on failure.
913  * If there is room, it will add up to max_protohdr-len extra bytes to the
914  * contiguous region in an attempt to avoid being called next time.
915  */
916 int MPFail;
917 
918 struct mbuf *
919 m_pullup(struct mbuf *n, int len)
920 {
921 	struct mbuf *m;
922 	int count;
923 	int space;
924 
925 	/*
926 	 * If first mbuf has no cluster, and has room for len bytes
927 	 * without shifting current data, pullup into it,
928 	 * otherwise allocate a new mbuf to prepend to the chain.
929 	 */
930 	if ((n->m_flags & M_EXT) == 0 &&
931 	    n->m_data + len < &n->m_dat[MLEN] && n->m_next) {
932 		if (n->m_len >= len)
933 			return (n);
934 		m = n;
935 		n = n->m_next;
936 		len -= m->m_len;
937 	} else {
938 		if (len > MHLEN)
939 			goto bad;
940 		MGET(m, M_DONTWAIT, n->m_type);
941 		if (m == 0)
942 			goto bad;
943 		MCLAIM(m, n->m_owner);
944 		m->m_len = 0;
945 		if (n->m_flags & M_PKTHDR) {
946 			M_MOVE_PKTHDR(m, n);
947 		}
948 	}
949 	space = &m->m_dat[MLEN] - (m->m_data + m->m_len);
950 	do {
951 		count = min(min(max(len, max_protohdr), space), n->m_len);
952 		memcpy(mtod(m, char *) + m->m_len, mtod(n, void *),
953 		  (unsigned)count);
954 		len -= count;
955 		m->m_len += count;
956 		n->m_len -= count;
957 		space -= count;
958 		if (n->m_len)
959 			n->m_data += count;
960 		else
961 			n = m_free(n);
962 	} while (len > 0 && n);
963 	if (len > 0) {
964 		(void) m_free(m);
965 		goto bad;
966 	}
967 	m->m_next = n;
968 	return (m);
969 bad:
970 	m_freem(n);
971 	MPFail++;
972 	return (NULL);
973 }
974 
975 /*
976  * Like m_pullup(), except a new mbuf is always allocated, and we allow
977  * the amount of empty space before the data in the new mbuf to be specified
978  * (in the event that the caller expects to prepend later).
979  */
980 int MSFail;
981 
982 struct mbuf *
983 m_copyup(struct mbuf *n, int len, int dstoff)
984 {
985 	struct mbuf *m;
986 	int count, space;
987 
988 	if (len > (MHLEN - dstoff))
989 		goto bad;
990 	MGET(m, M_DONTWAIT, n->m_type);
991 	if (m == NULL)
992 		goto bad;
993 	MCLAIM(m, n->m_owner);
994 	m->m_len = 0;
995 	if (n->m_flags & M_PKTHDR) {
996 		M_MOVE_PKTHDR(m, n);
997 	}
998 	m->m_data += dstoff;
999 	space = &m->m_dat[MLEN] - (m->m_data + m->m_len);
1000 	do {
1001 		count = min(min(max(len, max_protohdr), space), n->m_len);
1002 		memcpy(mtod(m, char *) + m->m_len, mtod(n, void *),
1003 		    (unsigned)count);
1004 		len -= count;
1005 		m->m_len += count;
1006 		n->m_len -= count;
1007 		space -= count;
1008 		if (n->m_len)
1009 			n->m_data += count;
1010 		else
1011 			n = m_free(n);
1012 	} while (len > 0 && n);
1013 	if (len > 0) {
1014 		(void) m_free(m);
1015 		goto bad;
1016 	}
1017 	m->m_next = n;
1018 	return (m);
1019  bad:
1020 	m_freem(n);
1021 	MSFail++;
1022 	return (NULL);
1023 }
1024 
1025 /*
1026  * Partition an mbuf chain in two pieces, returning the tail --
1027  * all but the first len0 bytes.  In case of failure, it returns NULL and
1028  * attempts to restore the chain to its original state.
1029  */
1030 struct mbuf *
1031 m_split(struct mbuf *m0, int len0, int wait)
1032 {
1033 
1034 	return m_split0(m0, len0, wait, 1);
1035 }
1036 
1037 static struct mbuf *
1038 m_split0(struct mbuf *m0, int len0, int wait, int copyhdr)
1039 {
1040 	struct mbuf *m, *n;
1041 	unsigned len = len0, remain, len_save;
1042 
1043 	for (m = m0; m && len > m->m_len; m = m->m_next)
1044 		len -= m->m_len;
1045 	if (m == 0)
1046 		return (NULL);
1047 	remain = m->m_len - len;
1048 	if (copyhdr && (m0->m_flags & M_PKTHDR)) {
1049 		MGETHDR(n, wait, m0->m_type);
1050 		if (n == 0)
1051 			return (NULL);
1052 		MCLAIM(n, m0->m_owner);
1053 		n->m_pkthdr.rcvif = m0->m_pkthdr.rcvif;
1054 		n->m_pkthdr.len = m0->m_pkthdr.len - len0;
1055 		len_save = m0->m_pkthdr.len;
1056 		m0->m_pkthdr.len = len0;
1057 		if (m->m_flags & M_EXT)
1058 			goto extpacket;
1059 		if (remain > MHLEN) {
1060 			/* m can't be the lead packet */
1061 			MH_ALIGN(n, 0);
1062 			n->m_len = 0;
1063 			n->m_next = m_split(m, len, wait);
1064 			if (n->m_next == 0) {
1065 				(void) m_free(n);
1066 				m0->m_pkthdr.len = len_save;
1067 				return (NULL);
1068 			} else
1069 				return (n);
1070 		} else
1071 			MH_ALIGN(n, remain);
1072 	} else if (remain == 0) {
1073 		n = m->m_next;
1074 		m->m_next = 0;
1075 		return (n);
1076 	} else {
1077 		MGET(n, wait, m->m_type);
1078 		if (n == 0)
1079 			return (NULL);
1080 		MCLAIM(n, m->m_owner);
1081 		M_ALIGN(n, remain);
1082 	}
1083 extpacket:
1084 	if (m->m_flags & M_EXT) {
1085 		n->m_data = m->m_data + len;
1086 		MCLADDREFERENCE(m, n);
1087 	} else {
1088 		memcpy(mtod(n, void *), mtod(m, char *) + len, remain);
1089 	}
1090 	n->m_len = remain;
1091 	m->m_len = len;
1092 	n->m_next = m->m_next;
1093 	m->m_next = 0;
1094 	return (n);
1095 }
1096 /*
1097  * Routine to copy from device local memory into mbufs.
1098  */
1099 struct mbuf *
1100 m_devget(char *buf, int totlen, int off0, struct ifnet *ifp,
1101     void (*copy)(const void *from, void *to, size_t len))
1102 {
1103 	struct mbuf *m;
1104 	struct mbuf *top = 0, **mp = &top;
1105 	int off = off0, len;
1106 	char *cp;
1107 	char *epkt;
1108 
1109 	cp = buf;
1110 	epkt = cp + totlen;
1111 	if (off) {
1112 		/*
1113 		 * If 'off' is non-zero, packet is trailer-encapsulated,
1114 		 * so we have to skip the type and length fields.
1115 		 */
1116 		cp += off + 2 * sizeof(uint16_t);
1117 		totlen -= 2 * sizeof(uint16_t);
1118 	}
1119 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1120 	if (m == 0)
1121 		return (NULL);
1122 	m->m_pkthdr.rcvif = ifp;
1123 	m->m_pkthdr.len = totlen;
1124 	m->m_len = MHLEN;
1125 
1126 	while (totlen > 0) {
1127 		if (top) {
1128 			MGET(m, M_DONTWAIT, MT_DATA);
1129 			if (m == 0) {
1130 				m_freem(top);
1131 				return (NULL);
1132 			}
1133 			m->m_len = MLEN;
1134 		}
1135 		len = min(totlen, epkt - cp);
1136 		if (len >= MINCLSIZE) {
1137 			MCLGET(m, M_DONTWAIT);
1138 			if ((m->m_flags & M_EXT) == 0) {
1139 				m_free(m);
1140 				m_freem(top);
1141 				return (NULL);
1142 			}
1143 			m->m_len = len = min(len, MCLBYTES);
1144 		} else {
1145 			/*
1146 			 * Place initial small packet/header at end of mbuf.
1147 			 */
1148 			if (len < m->m_len) {
1149 				if (top == 0 && len + max_linkhdr <= m->m_len)
1150 					m->m_data += max_linkhdr;
1151 				m->m_len = len;
1152 			} else
1153 				len = m->m_len;
1154 		}
1155 		if (copy)
1156 			copy(cp, mtod(m, void *), (size_t)len);
1157 		else
1158 			memcpy(mtod(m, void *), cp, (size_t)len);
1159 		cp += len;
1160 		*mp = m;
1161 		mp = &m->m_next;
1162 		totlen -= len;
1163 		if (cp == epkt)
1164 			cp = buf;
1165 	}
1166 	return (top);
1167 }
1168 
1169 /*
1170  * Copy data from a buffer back into the indicated mbuf chain,
1171  * starting "off" bytes from the beginning, extending the mbuf
1172  * chain if necessary.
1173  */
1174 void
1175 m_copyback(struct mbuf *m0, int off, int len, const void *cp)
1176 {
1177 #if defined(DEBUG)
1178 	struct mbuf *origm = m0;
1179 	int error;
1180 #endif /* defined(DEBUG) */
1181 
1182 	if (m0 == NULL)
1183 		return;
1184 
1185 #if defined(DEBUG)
1186 	error =
1187 #endif /* defined(DEBUG) */
1188 	m_copyback0(&m0, off, len, cp,
1189 	    M_COPYBACK0_COPYBACK|M_COPYBACK0_EXTEND, M_DONTWAIT);
1190 
1191 #if defined(DEBUG)
1192 	if (error != 0 || (m0 != NULL && origm != m0))
1193 		panic("m_copyback");
1194 #endif /* defined(DEBUG) */
1195 }
1196 
1197 struct mbuf *
1198 m_copyback_cow(struct mbuf *m0, int off, int len, const void *cp, int how)
1199 {
1200 	int error;
1201 
1202 	/* don't support chain expansion */
1203 	KDASSERT(off + len <= m_length(m0));
1204 
1205 	error = m_copyback0(&m0, off, len, cp,
1206 	    M_COPYBACK0_COPYBACK|M_COPYBACK0_COW, how);
1207 	if (error) {
1208 		/*
1209 		 * no way to recover from partial success.
1210 		 * just free the chain.
1211 		 */
1212 		m_freem(m0);
1213 		return NULL;
1214 	}
1215 	return m0;
1216 }
1217 
1218 /*
1219  * m_makewritable: ensure the specified range writable.
1220  */
1221 int
1222 m_makewritable(struct mbuf **mp, int off, int len, int how)
1223 {
1224 	int error;
1225 #if defined(DEBUG)
1226 	struct mbuf *n;
1227 	int origlen, reslen;
1228 
1229 	origlen = m_length(*mp);
1230 #endif /* defined(DEBUG) */
1231 
1232 #if 0 /* M_COPYALL is large enough */
1233 	if (len == M_COPYALL)
1234 		len = m_length(*mp) - off; /* XXX */
1235 #endif
1236 
1237 	error = m_copyback0(mp, off, len, NULL,
1238 	    M_COPYBACK0_PRESERVE|M_COPYBACK0_COW, how);
1239 
1240 #if defined(DEBUG)
1241 	reslen = 0;
1242 	for (n = *mp; n; n = n->m_next)
1243 		reslen += n->m_len;
1244 	if (origlen != reslen)
1245 		panic("m_makewritable: length changed");
1246 	if (((*mp)->m_flags & M_PKTHDR) != 0 && reslen != (*mp)->m_pkthdr.len)
1247 		panic("m_makewritable: inconsist");
1248 #endif /* defined(DEBUG) */
1249 
1250 	return error;
1251 }
1252 
1253 /*
1254  * Copy the mbuf chain to a new mbuf chain that is as short as possible.
1255  * Return the new mbuf chain on success, NULL on failure.  On success,
1256  * free the old mbuf chain.
1257  */
1258 struct mbuf *
1259 m_defrag(struct mbuf *mold, int flags)
1260 {
1261 	struct mbuf *m0, *mn, *n;
1262 	size_t sz = mold->m_pkthdr.len;
1263 
1264 #ifdef DIAGNOSTIC
1265 	if ((mold->m_flags & M_PKTHDR) == 0)
1266 		panic("m_defrag: not a mbuf chain header");
1267 #endif
1268 
1269 	MGETHDR(m0, flags, MT_DATA);
1270 	if (m0 == NULL)
1271 		return NULL;
1272 	M_COPY_PKTHDR(m0, mold);
1273 	mn = m0;
1274 
1275 	do {
1276 		if (sz > MHLEN) {
1277 			MCLGET(mn, M_DONTWAIT);
1278 			if ((mn->m_flags & M_EXT) == 0) {
1279 				m_freem(m0);
1280 				return NULL;
1281 			}
1282 		}
1283 
1284 		mn->m_len = MIN(sz, MCLBYTES);
1285 
1286 		m_copydata(mold, mold->m_pkthdr.len - sz, mn->m_len,
1287 		     mtod(mn, void *));
1288 
1289 		sz -= mn->m_len;
1290 
1291 		if (sz > 0) {
1292 			/* need more mbufs */
1293 			MGET(n, M_NOWAIT, MT_DATA);
1294 			if (n == NULL) {
1295 				m_freem(m0);
1296 				return NULL;
1297 			}
1298 
1299 			mn->m_next = n;
1300 			mn = n;
1301 		}
1302 	} while (sz > 0);
1303 
1304 	m_freem(mold);
1305 
1306 	return m0;
1307 }
1308 
1309 int
1310 m_copyback0(struct mbuf **mp0, int off, int len, const void *vp, int flags,
1311     int how)
1312 {
1313 	int mlen;
1314 	struct mbuf *m, *n;
1315 	struct mbuf **mp;
1316 	int totlen = 0;
1317 	const char *cp = vp;
1318 
1319 	KASSERT(mp0 != NULL);
1320 	KASSERT(*mp0 != NULL);
1321 	KASSERT((flags & M_COPYBACK0_PRESERVE) == 0 || cp == NULL);
1322 	KASSERT((flags & M_COPYBACK0_COPYBACK) == 0 || cp != NULL);
1323 
1324 	/*
1325 	 * we don't bother to update "totlen" in the case of M_COPYBACK0_COW,
1326 	 * assuming that M_COPYBACK0_EXTEND and M_COPYBACK0_COW are exclusive.
1327 	 */
1328 
1329 	KASSERT((~flags & (M_COPYBACK0_EXTEND|M_COPYBACK0_COW)) != 0);
1330 
1331 	mp = mp0;
1332 	m = *mp;
1333 	while (off > (mlen = m->m_len)) {
1334 		off -= mlen;
1335 		totlen += mlen;
1336 		if (m->m_next == NULL) {
1337 			int tspace;
1338 extend:
1339 			if ((flags & M_COPYBACK0_EXTEND) == 0)
1340 				goto out;
1341 
1342 			/*
1343 			 * try to make some space at the end of "m".
1344 			 */
1345 
1346 			mlen = m->m_len;
1347 			if (off + len >= MINCLSIZE &&
1348 			    (m->m_flags & M_EXT) == 0 && m->m_len == 0) {
1349 				MCLGET(m, how);
1350 			}
1351 			tspace = M_TRAILINGSPACE(m);
1352 			if (tspace > 0) {
1353 				tspace = min(tspace, off + len);
1354 				KASSERT(tspace > 0);
1355 				memset(mtod(m, char *) + m->m_len, 0,
1356 				    min(off, tspace));
1357 				m->m_len += tspace;
1358 				off += mlen;
1359 				totlen -= mlen;
1360 				continue;
1361 			}
1362 
1363 			/*
1364 			 * need to allocate an mbuf.
1365 			 */
1366 
1367 			if (off + len >= MINCLSIZE) {
1368 				n = m_getcl(how, m->m_type, 0);
1369 			} else {
1370 				n = m_get(how, m->m_type);
1371 			}
1372 			if (n == NULL) {
1373 				goto out;
1374 			}
1375 			n->m_len = 0;
1376 			n->m_len = min(M_TRAILINGSPACE(n), off + len);
1377 			memset(mtod(n, char *), 0, min(n->m_len, off));
1378 			m->m_next = n;
1379 		}
1380 		mp = &m->m_next;
1381 		m = m->m_next;
1382 	}
1383 	while (len > 0) {
1384 		mlen = m->m_len - off;
1385 		if (mlen != 0 && M_READONLY(m)) {
1386 			char *datap;
1387 			int eatlen;
1388 
1389 			/*
1390 			 * this mbuf is read-only.
1391 			 * allocate a new writable mbuf and try again.
1392 			 */
1393 
1394 #if defined(DIAGNOSTIC)
1395 			if ((flags & M_COPYBACK0_COW) == 0)
1396 				panic("m_copyback0: read-only");
1397 #endif /* defined(DIAGNOSTIC) */
1398 
1399 			/*
1400 			 * if we're going to write into the middle of
1401 			 * a mbuf, split it first.
1402 			 */
1403 			if (off > 0) {
1404 				n = m_split0(m, off, how, 0);
1405 				if (n == NULL)
1406 					goto enobufs;
1407 				m->m_next = n;
1408 				mp = &m->m_next;
1409 				m = n;
1410 				off = 0;
1411 				continue;
1412 			}
1413 
1414 			/*
1415 			 * XXX TODO coalesce into the trailingspace of
1416 			 * the previous mbuf when possible.
1417 			 */
1418 
1419 			/*
1420 			 * allocate a new mbuf.  copy packet header if needed.
1421 			 */
1422 			MGET(n, how, m->m_type);
1423 			if (n == NULL)
1424 				goto enobufs;
1425 			MCLAIM(n, m->m_owner);
1426 			if (off == 0 && (m->m_flags & M_PKTHDR) != 0) {
1427 				M_MOVE_PKTHDR(n, m);
1428 				n->m_len = MHLEN;
1429 			} else {
1430 				if (len >= MINCLSIZE)
1431 					MCLGET(n, M_DONTWAIT);
1432 				n->m_len =
1433 				    (n->m_flags & M_EXT) ? MCLBYTES : MLEN;
1434 			}
1435 			if (n->m_len > len)
1436 				n->m_len = len;
1437 
1438 			/*
1439 			 * free the region which has been overwritten.
1440 			 * copying data from old mbufs if requested.
1441 			 */
1442 			if (flags & M_COPYBACK0_PRESERVE)
1443 				datap = mtod(n, char *);
1444 			else
1445 				datap = NULL;
1446 			eatlen = n->m_len;
1447 			while (m != NULL && M_READONLY(m) &&
1448 			    n->m_type == m->m_type && eatlen > 0) {
1449 				mlen = min(eatlen, m->m_len);
1450 				if (datap) {
1451 					m_copydata(m, 0, mlen, datap);
1452 					datap += mlen;
1453 				}
1454 				m->m_data += mlen;
1455 				m->m_len -= mlen;
1456 				eatlen -= mlen;
1457 				if (m->m_len == 0)
1458 					*mp = m = m_free(m);
1459 			}
1460 			if (eatlen > 0)
1461 				n->m_len -= eatlen;
1462 			n->m_next = m;
1463 			*mp = m = n;
1464 			continue;
1465 		}
1466 		mlen = min(mlen, len);
1467 		if (flags & M_COPYBACK0_COPYBACK) {
1468 			memcpy(mtod(m, char *) + off, cp, (unsigned)mlen);
1469 			cp += mlen;
1470 		}
1471 		len -= mlen;
1472 		mlen += off;
1473 		off = 0;
1474 		totlen += mlen;
1475 		if (len == 0)
1476 			break;
1477 		if (m->m_next == NULL) {
1478 			goto extend;
1479 		}
1480 		mp = &m->m_next;
1481 		m = m->m_next;
1482 	}
1483 out:	if (((m = *mp0)->m_flags & M_PKTHDR) && (m->m_pkthdr.len < totlen)) {
1484 		KASSERT((flags & M_COPYBACK0_EXTEND) != 0);
1485 		m->m_pkthdr.len = totlen;
1486 	}
1487 
1488 	return 0;
1489 
1490 enobufs:
1491 	return ENOBUFS;
1492 }
1493 
1494 void
1495 m_move_pkthdr(struct mbuf *to, struct mbuf *from)
1496 {
1497 
1498 	KASSERT((to->m_flags & M_EXT) == 0);
1499 	KASSERT((to->m_flags & M_PKTHDR) == 0 || m_tag_first(to) == NULL);
1500 	KASSERT((from->m_flags & M_PKTHDR) != 0);
1501 
1502 	to->m_pkthdr = from->m_pkthdr;
1503 	to->m_flags = from->m_flags & M_COPYFLAGS;
1504 	to->m_data = to->m_pktdat;
1505 
1506 	from->m_flags &= ~M_PKTHDR;
1507 }
1508 
1509 /*
1510  * Apply function f to the data in an mbuf chain starting "off" bytes from the
1511  * beginning, continuing for "len" bytes.
1512  */
1513 int
1514 m_apply(struct mbuf *m, int off, int len,
1515     int (*f)(void *, void *, unsigned int), void *arg)
1516 {
1517 	unsigned int count;
1518 	int rval;
1519 
1520 	KASSERT(len >= 0);
1521 	KASSERT(off >= 0);
1522 
1523 	while (off > 0) {
1524 		KASSERT(m != NULL);
1525 		if (off < m->m_len)
1526 			break;
1527 		off -= m->m_len;
1528 		m = m->m_next;
1529 	}
1530 	while (len > 0) {
1531 		KASSERT(m != NULL);
1532 		count = min(m->m_len - off, len);
1533 
1534 		rval = (*f)(arg, mtod(m, char *) + off, count);
1535 		if (rval)
1536 			return (rval);
1537 
1538 		len -= count;
1539 		off = 0;
1540 		m = m->m_next;
1541 	}
1542 
1543 	return (0);
1544 }
1545 
1546 /*
1547  * Return a pointer to mbuf/offset of location in mbuf chain.
1548  */
1549 struct mbuf *
1550 m_getptr(struct mbuf *m, int loc, int *off)
1551 {
1552 
1553 	while (loc >= 0) {
1554 		/* Normal end of search */
1555 		if (m->m_len > loc) {
1556 	    		*off = loc;
1557 	    		return (m);
1558 		} else {
1559 	    		loc -= m->m_len;
1560 
1561 	    		if (m->m_next == NULL) {
1562 				if (loc == 0) {
1563  					/* Point at the end of valid data */
1564 		    			*off = m->m_len;
1565 		    			return (m);
1566 				} else
1567 		  			return (NULL);
1568 	    		} else
1569 	      			m = m->m_next;
1570 		}
1571     	}
1572 
1573 	return (NULL);
1574 }
1575 
1576 /*
1577  * m_ext_free: release a reference to the mbuf external storage.
1578  *
1579  * => free the mbuf m itsself as well.
1580  */
1581 
1582 void
1583 m_ext_free(struct mbuf *m)
1584 {
1585 	bool embedded = MEXT_ISEMBEDDED(m);
1586 	bool dofree = true;
1587 	u_int refcnt;
1588 
1589 	KASSERT((m->m_flags & M_EXT) != 0);
1590 	KASSERT(MEXT_ISEMBEDDED(m->m_ext_ref));
1591 	KASSERT((m->m_ext_ref->m_flags & M_EXT) != 0);
1592 	KASSERT((m->m_flags & M_EXT_CLUSTER) ==
1593 	    (m->m_ext_ref->m_flags & M_EXT_CLUSTER));
1594 
1595 	if (__predict_true(m->m_ext.ext_refcnt == 1)) {
1596 		refcnt = m->m_ext.ext_refcnt = 0;
1597 	} else {
1598 		refcnt = atomic_dec_uint_nv(&m->m_ext.ext_refcnt);
1599 	}
1600 	if (refcnt > 0) {
1601 		if (embedded) {
1602 			/*
1603 			 * other mbuf's m_ext_ref still points to us.
1604 			 */
1605 			dofree = false;
1606 		} else {
1607 			m->m_ext_ref = m;
1608 		}
1609 	} else {
1610 		/*
1611 		 * dropping the last reference
1612 		 */
1613 		if (!embedded) {
1614 			m->m_ext.ext_refcnt++; /* XXX */
1615 			m_ext_free(m->m_ext_ref);
1616 			m->m_ext_ref = m;
1617 		} else if ((m->m_flags & M_EXT_CLUSTER) != 0) {
1618 			pool_cache_put_paddr((struct pool_cache *)
1619 			    m->m_ext.ext_arg,
1620 			    m->m_ext.ext_buf, m->m_ext.ext_paddr);
1621 		} else if (m->m_ext.ext_free) {
1622 			(*m->m_ext.ext_free)(m,
1623 			    m->m_ext.ext_buf, m->m_ext.ext_size,
1624 			    m->m_ext.ext_arg);
1625 			/*
1626 			 * 'm' is already freed by the ext_free callback.
1627 			 */
1628 			dofree = false;
1629 		} else {
1630 			free(m->m_ext.ext_buf, m->m_ext.ext_type);
1631 		}
1632 	}
1633 	if (dofree) {
1634 		pool_cache_put(mb_cache, m);
1635 	}
1636 }
1637 
1638 #if defined(DDB)
1639 void
1640 m_print(const struct mbuf *m, const char *modif, void (*pr)(const char *, ...))
1641 {
1642 	char ch;
1643 	bool opt_c = false;
1644 	char buf[512];
1645 
1646 	while ((ch = *(modif++)) != '\0') {
1647 		switch (ch) {
1648 		case 'c':
1649 			opt_c = true;
1650 			break;
1651 		}
1652 	}
1653 
1654 nextchain:
1655 	(*pr)("MBUF %p\n", m);
1656 	snprintb(buf, sizeof(buf), M_FLAGS_BITS, (u_int)m->m_flags);
1657 	(*pr)("  data=%p, len=%d, type=%d, flags=%s\n",
1658 	    m->m_data, m->m_len, m->m_type, buf);
1659 	(*pr)("  owner=%p, next=%p, nextpkt=%p\n", m->m_owner, m->m_next,
1660 	    m->m_nextpkt);
1661 	(*pr)("  leadingspace=%u, trailingspace=%u, readonly=%u\n",
1662 	    (int)M_LEADINGSPACE(m), (int)M_TRAILINGSPACE(m),
1663 	    (int)M_READONLY(m));
1664 	if ((m->m_flags & M_PKTHDR) != 0) {
1665 		snprintb(buf, sizeof(buf), M_CSUM_BITS, m->m_pkthdr.csum_flags);
1666 		(*pr)("  pktlen=%d, rcvif=%p, csum_flags=0x%s, csum_data=0x%"
1667 		    PRIx32 ", segsz=%u\n",
1668 		    m->m_pkthdr.len, m->m_pkthdr.rcvif,
1669 		    buf, m->m_pkthdr.csum_data, m->m_pkthdr.segsz);
1670 	}
1671 	if ((m->m_flags & M_EXT)) {
1672 		(*pr)("  ext_refcnt=%u, ext_buf=%p, ext_size=%zd, "
1673 		    "ext_free=%p, ext_arg=%p\n",
1674 		    m->m_ext.ext_refcnt,
1675 		    m->m_ext.ext_buf, m->m_ext.ext_size,
1676 		    m->m_ext.ext_free, m->m_ext.ext_arg);
1677 	}
1678 	if ((~m->m_flags & (M_EXT|M_EXT_PAGES)) == 0) {
1679 		vaddr_t sva = (vaddr_t)m->m_ext.ext_buf;
1680 		vaddr_t eva = sva + m->m_ext.ext_size;
1681 		int n = (round_page(eva) - trunc_page(sva)) >> PAGE_SHIFT;
1682 		int i;
1683 
1684 		(*pr)("  pages:");
1685 		for (i = 0; i < n; i ++) {
1686 			(*pr)(" %p", m->m_ext.ext_pgs[i]);
1687 		}
1688 		(*pr)("\n");
1689 	}
1690 
1691 	if (opt_c) {
1692 		m = m->m_next;
1693 		if (m != NULL) {
1694 			goto nextchain;
1695 		}
1696 	}
1697 }
1698 #endif /* defined(DDB) */
1699 
1700 void
1701 mbstat_type_add(int type, int diff)
1702 {
1703 	struct mbstat_cpu *mb;
1704 	int s;
1705 
1706 	s = splvm();
1707 	mb = percpu_getref(mbstat_percpu);
1708 	mb->m_mtypes[type] += diff;
1709 	percpu_putref(mbstat_percpu);
1710 	splx(s);
1711 }
1712 
1713 #if defined(MBUFTRACE)
1714 void
1715 mowner_attach(struct mowner *mo)
1716 {
1717 
1718 	KASSERT(mo->mo_counters == NULL);
1719 	mo->mo_counters = percpu_alloc(sizeof(struct mowner_counter));
1720 
1721 	/* XXX lock */
1722 	LIST_INSERT_HEAD(&mowners, mo, mo_link);
1723 }
1724 
1725 void
1726 mowner_detach(struct mowner *mo)
1727 {
1728 
1729 	KASSERT(mo->mo_counters != NULL);
1730 
1731 	/* XXX lock */
1732 	LIST_REMOVE(mo, mo_link);
1733 
1734 	percpu_free(mo->mo_counters, sizeof(struct mowner_counter));
1735 	mo->mo_counters = NULL;
1736 }
1737 
1738 void
1739 mowner_init(struct mbuf *m, int type)
1740 {
1741 	struct mowner_counter *mc;
1742 	struct mowner *mo;
1743 	int s;
1744 
1745 	m->m_owner = mo = &unknown_mowners[type];
1746 	s = splvm();
1747 	mc = percpu_getref(mo->mo_counters);
1748 	mc->mc_counter[MOWNER_COUNTER_CLAIMS]++;
1749 	percpu_putref(mo->mo_counters);
1750 	splx(s);
1751 }
1752 
1753 void
1754 mowner_ref(struct mbuf *m, int flags)
1755 {
1756 	struct mowner *mo = m->m_owner;
1757 	struct mowner_counter *mc;
1758 	int s;
1759 
1760 	s = splvm();
1761 	mc = percpu_getref(mo->mo_counters);
1762 	if ((flags & M_EXT) != 0)
1763 		mc->mc_counter[MOWNER_COUNTER_EXT_CLAIMS]++;
1764 	if ((flags & M_CLUSTER) != 0)
1765 		mc->mc_counter[MOWNER_COUNTER_CLUSTER_CLAIMS]++;
1766 	percpu_putref(mo->mo_counters);
1767 	splx(s);
1768 }
1769 
1770 void
1771 mowner_revoke(struct mbuf *m, bool all, int flags)
1772 {
1773 	struct mowner *mo = m->m_owner;
1774 	struct mowner_counter *mc;
1775 	int s;
1776 
1777 	s = splvm();
1778 	mc = percpu_getref(mo->mo_counters);
1779 	if ((flags & M_EXT) != 0)
1780 		mc->mc_counter[MOWNER_COUNTER_EXT_RELEASES]++;
1781 	if ((flags & M_CLUSTER) != 0)
1782 		mc->mc_counter[MOWNER_COUNTER_CLUSTER_RELEASES]++;
1783 	if (all)
1784 		mc->mc_counter[MOWNER_COUNTER_RELEASES]++;
1785 	percpu_putref(mo->mo_counters);
1786 	splx(s);
1787 	if (all)
1788 		m->m_owner = &revoked_mowner;
1789 }
1790 
1791 static void
1792 mowner_claim(struct mbuf *m, struct mowner *mo)
1793 {
1794 	struct mowner_counter *mc;
1795 	int flags = m->m_flags;
1796 	int s;
1797 
1798 	s = splvm();
1799 	mc = percpu_getref(mo->mo_counters);
1800 	mc->mc_counter[MOWNER_COUNTER_CLAIMS]++;
1801 	if ((flags & M_EXT) != 0)
1802 		mc->mc_counter[MOWNER_COUNTER_EXT_CLAIMS]++;
1803 	if ((flags & M_CLUSTER) != 0)
1804 		mc->mc_counter[MOWNER_COUNTER_CLUSTER_CLAIMS]++;
1805 	percpu_putref(mo->mo_counters);
1806 	splx(s);
1807 	m->m_owner = mo;
1808 }
1809 
1810 void
1811 m_claim(struct mbuf *m, struct mowner *mo)
1812 {
1813 
1814 	if (m->m_owner == mo || mo == NULL)
1815 		return;
1816 
1817 	mowner_revoke(m, true, m->m_flags);
1818 	mowner_claim(m, mo);
1819 }
1820 #endif /* defined(MBUFTRACE) */
1821