xref: /openbsd-src/sys/kern/uipc_socket2.c (revision f763167468dba5339ed4b14b7ecaca2a397ab0f6)
1 /*	$OpenBSD: uipc_socket2.c,v 1.86 2017/08/11 21:24:19 mpi Exp $	*/
2 /*	$NetBSD: uipc_socket2.c,v 1.11 1996/02/04 02:17:55 christos Exp $	*/
3 
4 /*
5  * Copyright (c) 1982, 1986, 1988, 1990, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the University nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *
32  *	@(#)uipc_socket2.c	8.1 (Berkeley) 6/10/93
33  */
34 
35 #include <sys/param.h>
36 #include <sys/systm.h>
37 #include <sys/file.h>
38 #include <sys/malloc.h>
39 #include <sys/mbuf.h>
40 #include <sys/protosw.h>
41 #include <sys/domain.h>
42 #include <sys/socket.h>
43 #include <sys/socketvar.h>
44 #include <sys/signalvar.h>
45 #include <sys/event.h>
46 #include <sys/pool.h>
47 
48 /*
49  * Primitive routines for operating on sockets and socket buffers
50  */
51 
52 u_long	sb_max = SB_MAX;		/* patchable */
53 
54 extern struct pool mclpools[];
55 extern struct pool mbpool;
56 
57 /*
58  * Procedures to manipulate state flags of socket
59  * and do appropriate wakeups.  Normal sequence from the
60  * active (originating) side is that soisconnecting() is
61  * called during processing of connect() call,
62  * resulting in an eventual call to soisconnected() if/when the
63  * connection is established.  When the connection is torn down
64  * soisdisconnecting() is called during processing of disconnect() call,
65  * and soisdisconnected() is called when the connection to the peer
66  * is totally severed.  The semantics of these routines are such that
67  * connectionless protocols can call soisconnected() and soisdisconnected()
68  * only, bypassing the in-progress calls when setting up a ``connection''
69  * takes no time.
70  *
71  * From the passive side, a socket is created with
72  * two queues of sockets: so_q0 for connections in progress
73  * and so_q for connections already made and awaiting user acceptance.
74  * As a protocol is preparing incoming connections, it creates a socket
75  * structure queued on so_q0 by calling sonewconn().  When the connection
76  * is established, soisconnected() is called, and transfers the
77  * socket structure to so_q, making it available to accept().
78  *
79  * If a socket is closed with sockets on either
80  * so_q0 or so_q, these sockets are dropped.
81  *
82  * If higher level protocols are implemented in
83  * the kernel, the wakeups done here will sometimes
84  * cause software-interrupt process scheduling.
85  */
86 
87 void
88 soisconnecting(struct socket *so)
89 {
90 	soassertlocked(so);
91 	so->so_state &= ~(SS_ISCONNECTED|SS_ISDISCONNECTING);
92 	so->so_state |= SS_ISCONNECTING;
93 }
94 
95 void
96 soisconnected(struct socket *so)
97 {
98 	struct socket *head = so->so_head;
99 
100 	soassertlocked(so);
101 	so->so_state &= ~(SS_ISCONNECTING|SS_ISDISCONNECTING);
102 	so->so_state |= SS_ISCONNECTED;
103 	if (head && soqremque(so, 0)) {
104 		soqinsque(head, so, 1);
105 		sorwakeup(head);
106 		wakeup_one(&head->so_timeo);
107 	} else {
108 		wakeup(&so->so_timeo);
109 		sorwakeup(so);
110 		sowwakeup(so);
111 	}
112 }
113 
114 void
115 soisdisconnecting(struct socket *so)
116 {
117 	soassertlocked(so);
118 	so->so_state &= ~SS_ISCONNECTING;
119 	so->so_state |= (SS_ISDISCONNECTING|SS_CANTRCVMORE|SS_CANTSENDMORE);
120 	wakeup(&so->so_timeo);
121 	sowwakeup(so);
122 	sorwakeup(so);
123 }
124 
125 void
126 soisdisconnected(struct socket *so)
127 {
128 	soassertlocked(so);
129 	so->so_state &= ~(SS_ISCONNECTING|SS_ISCONNECTED|SS_ISDISCONNECTING);
130 	so->so_state |= (SS_CANTRCVMORE|SS_CANTSENDMORE|SS_ISDISCONNECTED);
131 	wakeup(&so->so_timeo);
132 	sowwakeup(so);
133 	sorwakeup(so);
134 }
135 
136 /*
137  * When an attempt at a new connection is noted on a socket
138  * which accepts connections, sonewconn is called.  If the
139  * connection is possible (subject to space constraints, etc.)
140  * then we allocate a new structure, properly linked into the
141  * data structure of the original socket, and return this.
142  * Connstatus may be 0 or SS_ISCONNECTED.
143  */
144 struct socket *
145 sonewconn(struct socket *head, int connstatus)
146 {
147 	struct socket *so;
148 	int soqueue = connstatus ? 1 : 0;
149 
150 	/*
151 	 * XXXSMP as long as `so' and `head' share the same lock, we
152 	 * can call soreserve() and pr_attach() below w/o expliclitly
153 	 * locking `so'.
154 	 */
155 	soassertlocked(head);
156 
157 	if (mclpools[0].pr_nout > mclpools[0].pr_hardlimit * 95 / 100)
158 		return (NULL);
159 	if (head->so_qlen + head->so_q0len > head->so_qlimit * 3)
160 		return (NULL);
161 	so = pool_get(&socket_pool, PR_NOWAIT|PR_ZERO);
162 	if (so == NULL)
163 		return (NULL);
164 	so->so_type = head->so_type;
165 	so->so_options = head->so_options &~ SO_ACCEPTCONN;
166 	so->so_linger = head->so_linger;
167 	so->so_state = head->so_state | SS_NOFDREF;
168 	so->so_proto = head->so_proto;
169 	so->so_timeo = head->so_timeo;
170 	so->so_pgid = head->so_pgid;
171 	so->so_euid = head->so_euid;
172 	so->so_ruid = head->so_ruid;
173 	so->so_egid = head->so_egid;
174 	so->so_rgid = head->so_rgid;
175 	so->so_cpid = head->so_cpid;
176 	so->so_siguid = head->so_siguid;
177 	so->so_sigeuid = head->so_sigeuid;
178 
179 	/*
180 	 * Inherit watermarks but those may get clamped in low mem situations.
181 	 */
182 	if (soreserve(so, head->so_snd.sb_hiwat, head->so_rcv.sb_hiwat)) {
183 		pool_put(&socket_pool, so);
184 		return (NULL);
185 	}
186 	so->so_snd.sb_wat = head->so_snd.sb_wat;
187 	so->so_snd.sb_lowat = head->so_snd.sb_lowat;
188 	so->so_snd.sb_timeo = head->so_snd.sb_timeo;
189 	so->so_rcv.sb_wat = head->so_rcv.sb_wat;
190 	so->so_rcv.sb_lowat = head->so_rcv.sb_lowat;
191 	so->so_rcv.sb_timeo = head->so_rcv.sb_timeo;
192 
193 	soqinsque(head, so, soqueue);
194 	if ((*so->so_proto->pr_attach)(so, 0)) {
195 		(void) soqremque(so, soqueue);
196 		pool_put(&socket_pool, so);
197 		return (NULL);
198 	}
199 	if (connstatus) {
200 		sorwakeup(head);
201 		wakeup(&head->so_timeo);
202 		so->so_state |= connstatus;
203 	}
204 	return (so);
205 }
206 
207 void
208 soqinsque(struct socket *head, struct socket *so, int q)
209 {
210 	soassertlocked(head);
211 
212 #ifdef DIAGNOSTIC
213 	if (so->so_onq != NULL)
214 		panic("soqinsque");
215 #endif
216 
217 	so->so_head = head;
218 	if (q == 0) {
219 		head->so_q0len++;
220 		so->so_onq = &head->so_q0;
221 	} else {
222 		head->so_qlen++;
223 		so->so_onq = &head->so_q;
224 	}
225 	TAILQ_INSERT_TAIL(so->so_onq, so, so_qe);
226 }
227 
228 int
229 soqremque(struct socket *so, int q)
230 {
231 	struct socket *head = so->so_head;
232 
233 	soassertlocked(head);
234 
235 	if (q == 0) {
236 		if (so->so_onq != &head->so_q0)
237 			return (0);
238 		head->so_q0len--;
239 	} else {
240 		if (so->so_onq != &head->so_q)
241 			return (0);
242 		head->so_qlen--;
243 	}
244 	TAILQ_REMOVE(so->so_onq, so, so_qe);
245 	so->so_onq = NULL;
246 	so->so_head = NULL;
247 	return (1);
248 }
249 
250 /*
251  * Socantsendmore indicates that no more data will be sent on the
252  * socket; it would normally be applied to a socket when the user
253  * informs the system that no more data is to be sent, by the protocol
254  * code (in case PRU_SHUTDOWN).  Socantrcvmore indicates that no more data
255  * will be received, and will normally be applied to the socket by a
256  * protocol when it detects that the peer will send no more data.
257  * Data queued for reading in the socket may yet be read.
258  */
259 
260 void
261 socantsendmore(struct socket *so)
262 {
263 	soassertlocked(so);
264 	so->so_state |= SS_CANTSENDMORE;
265 	sowwakeup(so);
266 }
267 
268 void
269 socantrcvmore(struct socket *so)
270 {
271 	soassertlocked(so);
272 	so->so_state |= SS_CANTRCVMORE;
273 	sorwakeup(so);
274 }
275 
276 int
277 solock(struct socket *so)
278 {
279 	int s = 0;
280 
281 	if ((so->so_proto->pr_domain->dom_family != PF_LOCAL) &&
282 	    (so->so_proto->pr_domain->dom_family != PF_ROUTE) &&
283 	    (so->so_proto->pr_domain->dom_family != PF_KEY))
284 		NET_LOCK();
285 	else
286 		s = -42;
287 
288 	return (s);
289 }
290 
291 void
292 sounlock(int s)
293 {
294 	if (s != -42)
295 		NET_UNLOCK();
296 }
297 
298 void
299 soassertlocked(struct socket *so)
300 {
301 	switch (so->so_proto->pr_domain->dom_family) {
302 	case PF_INET:
303 	case PF_INET6:
304 		NET_ASSERT_LOCKED();
305 		break;
306 	case PF_LOCAL:
307 	case PF_ROUTE:
308 	case PF_KEY:
309 	default:
310 		KERNEL_ASSERT_LOCKED();
311 		break;
312 	}
313 }
314 
315 int
316 sosleep(struct socket *so, void *ident, int prio, const char *wmesg, int timo)
317 {
318 	if ((so->so_proto->pr_domain->dom_family != PF_LOCAL) &&
319 	    (so->so_proto->pr_domain->dom_family != PF_ROUTE) &&
320 	    (so->so_proto->pr_domain->dom_family != PF_KEY)) {
321 		return rwsleep(ident, &netlock, prio, wmesg, timo);
322 	} else
323 		return tsleep(ident, prio, wmesg, timo);
324 }
325 
326 /*
327  * Wait for data to arrive at/drain from a socket buffer.
328  */
329 int
330 sbwait(struct socket *so, struct sockbuf *sb)
331 {
332 	soassertlocked(so);
333 
334 	sb->sb_flagsintr |= SB_WAIT;
335 	return (sosleep(so, &sb->sb_cc,
336 	    (sb->sb_flags & SB_NOINTR) ? PSOCK : PSOCK | PCATCH, "netio",
337 	    sb->sb_timeo));
338 }
339 
340 int
341 sblock(struct socket *so, struct sockbuf *sb, int wait)
342 {
343 	int error, prio = (sb->sb_flags & SB_NOINTR) ? PSOCK : PSOCK | PCATCH;
344 
345 	KERNEL_ASSERT_LOCKED();
346 	soassertlocked(so);
347 
348 	if ((sb->sb_flags & SB_LOCK) == 0) {
349 		sb->sb_flags |= SB_LOCK;
350 		return (0);
351 	}
352 	if (wait & M_NOWAIT)
353 		return (EWOULDBLOCK);
354 
355 	while (sb->sb_flags & SB_LOCK) {
356 		sb->sb_flags |= SB_WANT;
357 		error = sosleep(so, &sb->sb_flags, prio, "netlck", 0);
358 		if (error)
359 			return (error);
360 	}
361 	sb->sb_flags |= SB_LOCK;
362 	return (0);
363 }
364 
365 void
366 sbunlock(struct sockbuf *sb)
367 {
368 	KERNEL_ASSERT_LOCKED();
369 
370 	sb->sb_flags &= ~SB_LOCK;
371 	if (sb->sb_flags & SB_WANT) {
372 		sb->sb_flags &= ~SB_WANT;
373 		wakeup(&sb->sb_flags);
374 	}
375 }
376 
377 /*
378  * Wakeup processes waiting on a socket buffer.
379  * Do asynchronous notification via SIGIO
380  * if the socket has the SS_ASYNC flag set.
381  */
382 void
383 sowakeup(struct socket *so, struct sockbuf *sb)
384 {
385 	KERNEL_ASSERT_LOCKED();
386 	soassertlocked(so);
387 
388 	selwakeup(&sb->sb_sel);
389 	sb->sb_flagsintr &= ~SB_SEL;
390 	if (sb->sb_flagsintr & SB_WAIT) {
391 		sb->sb_flagsintr &= ~SB_WAIT;
392 		wakeup(&sb->sb_cc);
393 	}
394 	if (so->so_state & SS_ASYNC)
395 		csignal(so->so_pgid, SIGIO, so->so_siguid, so->so_sigeuid);
396 }
397 
398 /*
399  * Socket buffer (struct sockbuf) utility routines.
400  *
401  * Each socket contains two socket buffers: one for sending data and
402  * one for receiving data.  Each buffer contains a queue of mbufs,
403  * information about the number of mbufs and amount of data in the
404  * queue, and other fields allowing select() statements and notification
405  * on data availability to be implemented.
406  *
407  * Data stored in a socket buffer is maintained as a list of records.
408  * Each record is a list of mbufs chained together with the m_next
409  * field.  Records are chained together with the m_nextpkt field. The upper
410  * level routine soreceive() expects the following conventions to be
411  * observed when placing information in the receive buffer:
412  *
413  * 1. If the protocol requires each message be preceded by the sender's
414  *    name, then a record containing that name must be present before
415  *    any associated data (mbuf's must be of type MT_SONAME).
416  * 2. If the protocol supports the exchange of ``access rights'' (really
417  *    just additional data associated with the message), and there are
418  *    ``rights'' to be received, then a record containing this data
419  *    should be present (mbuf's must be of type MT_CONTROL).
420  * 3. If a name or rights record exists, then it must be followed by
421  *    a data record, perhaps of zero length.
422  *
423  * Before using a new socket structure it is first necessary to reserve
424  * buffer space to the socket, by calling sbreserve().  This should commit
425  * some of the available buffer space in the system buffer pool for the
426  * socket (currently, it does nothing but enforce limits).  The space
427  * should be released by calling sbrelease() when the socket is destroyed.
428  */
429 
430 int
431 soreserve(struct socket *so, u_long sndcc, u_long rcvcc)
432 {
433 	soassertlocked(so);
434 
435 	if (sbreserve(so, &so->so_snd, sndcc))
436 		goto bad;
437 	if (sbreserve(so, &so->so_rcv, rcvcc))
438 		goto bad2;
439 	so->so_snd.sb_wat = sndcc;
440 	so->so_rcv.sb_wat = rcvcc;
441 	if (so->so_rcv.sb_lowat == 0)
442 		so->so_rcv.sb_lowat = 1;
443 	if (so->so_snd.sb_lowat == 0)
444 		so->so_snd.sb_lowat = MCLBYTES;
445 	if (so->so_snd.sb_lowat > so->so_snd.sb_hiwat)
446 		so->so_snd.sb_lowat = so->so_snd.sb_hiwat;
447 	return (0);
448 bad2:
449 	sbrelease(so, &so->so_snd);
450 bad:
451 	return (ENOBUFS);
452 }
453 
454 /*
455  * Allot mbufs to a sockbuf.
456  * Attempt to scale mbmax so that mbcnt doesn't become limiting
457  * if buffering efficiency is near the normal case.
458  */
459 int
460 sbreserve(struct socket *so, struct sockbuf *sb, u_long cc)
461 {
462 	KASSERT(sb == &so->so_rcv || sb == &so->so_snd);
463 	soassertlocked(so);
464 
465 	if (cc == 0 || cc > sb_max)
466 		return (1);
467 	sb->sb_hiwat = cc;
468 	sb->sb_mbmax = max(3 * MAXMCLBYTES,
469 	    min(cc * 2, sb_max + (sb_max / MCLBYTES) * MSIZE));
470 	if (sb->sb_lowat > sb->sb_hiwat)
471 		sb->sb_lowat = sb->sb_hiwat;
472 	return (0);
473 }
474 
475 /*
476  * In low memory situation, do not accept any greater than normal request.
477  */
478 int
479 sbcheckreserve(u_long cnt, u_long defcnt)
480 {
481 	if (cnt > defcnt && sbchecklowmem())
482 		return (ENOBUFS);
483 	return (0);
484 }
485 
486 int
487 sbchecklowmem(void)
488 {
489 	static int sblowmem;
490 
491 	if (mclpools[0].pr_nout < mclpools[0].pr_hardlimit * 60 / 100 ||
492 	    mbpool.pr_nout < mbpool.pr_hardlimit * 60 / 100)
493 		sblowmem = 0;
494 	if (mclpools[0].pr_nout > mclpools[0].pr_hardlimit * 80 / 100 ||
495 	    mbpool.pr_nout > mbpool.pr_hardlimit * 80 / 100)
496 		sblowmem = 1;
497 	return (sblowmem);
498 }
499 
500 /*
501  * Free mbufs held by a socket, and reserved mbuf space.
502  */
503 void
504 sbrelease(struct socket *so, struct sockbuf *sb)
505 {
506 
507 	sbflush(so, sb);
508 	sb->sb_hiwat = sb->sb_mbmax = 0;
509 }
510 
511 /*
512  * Routines to add and remove
513  * data from an mbuf queue.
514  *
515  * The routines sbappend() or sbappendrecord() are normally called to
516  * append new mbufs to a socket buffer, after checking that adequate
517  * space is available, comparing the function sbspace() with the amount
518  * of data to be added.  sbappendrecord() differs from sbappend() in
519  * that data supplied is treated as the beginning of a new record.
520  * To place a sender's address, optional access rights, and data in a
521  * socket receive buffer, sbappendaddr() should be used.  To place
522  * access rights and data in a socket receive buffer, sbappendrights()
523  * should be used.  In either case, the new data begins a new record.
524  * Note that unlike sbappend() and sbappendrecord(), these routines check
525  * for the caller that there will be enough space to store the data.
526  * Each fails if there is not enough space, or if it cannot find mbufs
527  * to store additional information in.
528  *
529  * Reliable protocols may use the socket send buffer to hold data
530  * awaiting acknowledgement.  Data is normally copied from a socket
531  * send buffer in a protocol with m_copym for output to a peer,
532  * and then removing the data from the socket buffer with sbdrop()
533  * or sbdroprecord() when the data is acknowledged by the peer.
534  */
535 
536 #ifdef SOCKBUF_DEBUG
537 void
538 sblastrecordchk(struct sockbuf *sb, const char *where)
539 {
540 	struct mbuf *m = sb->sb_mb;
541 
542 	while (m && m->m_nextpkt)
543 		m = m->m_nextpkt;
544 
545 	if (m != sb->sb_lastrecord) {
546 		printf("sblastrecordchk: sb_mb %p sb_lastrecord %p last %p\n",
547 		    sb->sb_mb, sb->sb_lastrecord, m);
548 		printf("packet chain:\n");
549 		for (m = sb->sb_mb; m != NULL; m = m->m_nextpkt)
550 			printf("\t%p\n", m);
551 		panic("sblastrecordchk from %s", where);
552 	}
553 }
554 
555 void
556 sblastmbufchk(struct sockbuf *sb, const char *where)
557 {
558 	struct mbuf *m = sb->sb_mb;
559 	struct mbuf *n;
560 
561 	while (m && m->m_nextpkt)
562 		m = m->m_nextpkt;
563 
564 	while (m && m->m_next)
565 		m = m->m_next;
566 
567 	if (m != sb->sb_mbtail) {
568 		printf("sblastmbufchk: sb_mb %p sb_mbtail %p last %p\n",
569 		    sb->sb_mb, sb->sb_mbtail, m);
570 		printf("packet tree:\n");
571 		for (m = sb->sb_mb; m != NULL; m = m->m_nextpkt) {
572 			printf("\t");
573 			for (n = m; n != NULL; n = n->m_next)
574 				printf("%p ", n);
575 			printf("\n");
576 		}
577 		panic("sblastmbufchk from %s", where);
578 	}
579 }
580 #endif /* SOCKBUF_DEBUG */
581 
582 #define	SBLINKRECORD(sb, m0)						\
583 do {									\
584 	if ((sb)->sb_lastrecord != NULL)				\
585 		(sb)->sb_lastrecord->m_nextpkt = (m0);			\
586 	else								\
587 		(sb)->sb_mb = (m0);					\
588 	(sb)->sb_lastrecord = (m0);					\
589 } while (/*CONSTCOND*/0)
590 
591 /*
592  * Append mbuf chain m to the last record in the
593  * socket buffer sb.  The additional space associated
594  * the mbuf chain is recorded in sb.  Empty mbufs are
595  * discarded and mbufs are compacted where possible.
596  */
597 void
598 sbappend(struct socket *so, struct sockbuf *sb, struct mbuf *m)
599 {
600 	struct mbuf *n;
601 
602 	if (m == NULL)
603 		return;
604 
605 	SBLASTRECORDCHK(sb, "sbappend 1");
606 
607 	if ((n = sb->sb_lastrecord) != NULL) {
608 		/*
609 		 * XXX Would like to simply use sb_mbtail here, but
610 		 * XXX I need to verify that I won't miss an EOR that
611 		 * XXX way.
612 		 */
613 		do {
614 			if (n->m_flags & M_EOR) {
615 				sbappendrecord(so, sb, m); /* XXXXXX!!!! */
616 				return;
617 			}
618 		} while (n->m_next && (n = n->m_next));
619 	} else {
620 		/*
621 		 * If this is the first record in the socket buffer, it's
622 		 * also the last record.
623 		 */
624 		sb->sb_lastrecord = m;
625 	}
626 	sbcompress(sb, m, n);
627 	SBLASTRECORDCHK(sb, "sbappend 2");
628 }
629 
630 /*
631  * This version of sbappend() should only be used when the caller
632  * absolutely knows that there will never be more than one record
633  * in the socket buffer, that is, a stream protocol (such as TCP).
634  */
635 void
636 sbappendstream(struct socket *so, struct sockbuf *sb, struct mbuf *m)
637 {
638 	KASSERT(sb == &so->so_rcv || sb == &so->so_snd);
639 	soassertlocked(so);
640 	KDASSERT(m->m_nextpkt == NULL);
641 	KASSERT(sb->sb_mb == sb->sb_lastrecord);
642 
643 	SBLASTMBUFCHK(sb, __func__);
644 
645 	sbcompress(sb, m, sb->sb_mbtail);
646 
647 	sb->sb_lastrecord = sb->sb_mb;
648 	SBLASTRECORDCHK(sb, __func__);
649 }
650 
651 #ifdef SOCKBUF_DEBUG
652 void
653 sbcheck(struct sockbuf *sb)
654 {
655 	struct mbuf *m, *n;
656 	u_long len = 0, mbcnt = 0;
657 
658 	for (m = sb->sb_mb; m; m = m->m_nextpkt) {
659 		for (n = m; n; n = n->m_next) {
660 			len += n->m_len;
661 			mbcnt += MSIZE;
662 			if (n->m_flags & M_EXT)
663 				mbcnt += n->m_ext.ext_size;
664 			if (m != n && n->m_nextpkt)
665 				panic("sbcheck nextpkt");
666 		}
667 	}
668 	if (len != sb->sb_cc || mbcnt != sb->sb_mbcnt) {
669 		printf("cc %lu != %lu || mbcnt %lu != %lu\n", len, sb->sb_cc,
670 		    mbcnt, sb->sb_mbcnt);
671 		panic("sbcheck");
672 	}
673 }
674 #endif
675 
676 /*
677  * As above, except the mbuf chain
678  * begins a new record.
679  */
680 void
681 sbappendrecord(struct socket *so, struct sockbuf *sb, struct mbuf *m0)
682 {
683 	struct mbuf *m;
684 
685 	KASSERT(sb == &so->so_rcv || sb == &so->so_snd);
686 	soassertlocked(so);
687 
688 	if (m0 == NULL)
689 		return;
690 
691 	/*
692 	 * Put the first mbuf on the queue.
693 	 * Note this permits zero length records.
694 	 */
695 	sballoc(sb, m0);
696 	SBLASTRECORDCHK(sb, "sbappendrecord 1");
697 	SBLINKRECORD(sb, m0);
698 	m = m0->m_next;
699 	m0->m_next = NULL;
700 	if (m && (m0->m_flags & M_EOR)) {
701 		m0->m_flags &= ~M_EOR;
702 		m->m_flags |= M_EOR;
703 	}
704 	sbcompress(sb, m, m0);
705 	SBLASTRECORDCHK(sb, "sbappendrecord 2");
706 }
707 
708 /*
709  * As above except that OOB data
710  * is inserted at the beginning of the sockbuf,
711  * but after any other OOB data.
712  */
713 void
714 sbinsertoob(struct sockbuf *sb, struct mbuf *m0)
715 {
716 	struct mbuf *m, **mp;
717 
718 	if (m0 == NULL)
719 		return;
720 
721 	SBLASTRECORDCHK(sb, "sbinsertoob 1");
722 
723 	for (mp = &sb->sb_mb; (m = *mp) != NULL; mp = &((*mp)->m_nextpkt)) {
724 	    again:
725 		switch (m->m_type) {
726 
727 		case MT_OOBDATA:
728 			continue;		/* WANT next train */
729 
730 		case MT_CONTROL:
731 			if ((m = m->m_next) != NULL)
732 				goto again;	/* inspect THIS train further */
733 		}
734 		break;
735 	}
736 	/*
737 	 * Put the first mbuf on the queue.
738 	 * Note this permits zero length records.
739 	 */
740 	sballoc(sb, m0);
741 	m0->m_nextpkt = *mp;
742 	if (*mp == NULL) {
743 		/* m0 is actually the new tail */
744 		sb->sb_lastrecord = m0;
745 	}
746 	*mp = m0;
747 	m = m0->m_next;
748 	m0->m_next = NULL;
749 	if (m && (m0->m_flags & M_EOR)) {
750 		m0->m_flags &= ~M_EOR;
751 		m->m_flags |= M_EOR;
752 	}
753 	sbcompress(sb, m, m0);
754 	SBLASTRECORDCHK(sb, "sbinsertoob 2");
755 }
756 
757 /*
758  * Append address and data, and optionally, control (ancillary) data
759  * to the receive queue of a socket.  If present,
760  * m0 must include a packet header with total length.
761  * Returns 0 if no space in sockbuf or insufficient mbufs.
762  */
763 int
764 sbappendaddr(struct socket *so, struct sockbuf *sb, struct sockaddr *asa,
765     struct mbuf *m0, struct mbuf *control)
766 {
767 	struct mbuf *m, *n, *nlast;
768 	int space = asa->sa_len;
769 
770 	if (m0 && (m0->m_flags & M_PKTHDR) == 0)
771 		panic("sbappendaddr");
772 	if (m0)
773 		space += m0->m_pkthdr.len;
774 	for (n = control; n; n = n->m_next) {
775 		space += n->m_len;
776 		if (n->m_next == NULL)	/* keep pointer to last control buf */
777 			break;
778 	}
779 	if (space > sbspace(so, sb))
780 		return (0);
781 	if (asa->sa_len > MLEN)
782 		return (0);
783 	MGET(m, M_DONTWAIT, MT_SONAME);
784 	if (m == NULL)
785 		return (0);
786 	m->m_len = asa->sa_len;
787 	memcpy(mtod(m, caddr_t), asa, asa->sa_len);
788 	if (n)
789 		n->m_next = m0;		/* concatenate data to control */
790 	else
791 		control = m0;
792 	m->m_next = control;
793 
794 	SBLASTRECORDCHK(sb, "sbappendaddr 1");
795 
796 	for (n = m; n->m_next != NULL; n = n->m_next)
797 		sballoc(sb, n);
798 	sballoc(sb, n);
799 	nlast = n;
800 	SBLINKRECORD(sb, m);
801 
802 	sb->sb_mbtail = nlast;
803 	SBLASTMBUFCHK(sb, "sbappendaddr");
804 
805 	SBLASTRECORDCHK(sb, "sbappendaddr 2");
806 
807 	return (1);
808 }
809 
810 int
811 sbappendcontrol(struct socket *so, struct sockbuf *sb, struct mbuf *m0,
812     struct mbuf *control)
813 {
814 	struct mbuf *m, *mlast, *n;
815 	int space = 0;
816 
817 	if (control == NULL)
818 		panic("sbappendcontrol");
819 	for (m = control; ; m = m->m_next) {
820 		space += m->m_len;
821 		if (m->m_next == NULL)
822 			break;
823 	}
824 	n = m;			/* save pointer to last control buffer */
825 	for (m = m0; m; m = m->m_next)
826 		space += m->m_len;
827 	if (space > sbspace(so, sb))
828 		return (0);
829 	n->m_next = m0;			/* concatenate data to control */
830 
831 	SBLASTRECORDCHK(sb, "sbappendcontrol 1");
832 
833 	for (m = control; m->m_next != NULL; m = m->m_next)
834 		sballoc(sb, m);
835 	sballoc(sb, m);
836 	mlast = m;
837 	SBLINKRECORD(sb, control);
838 
839 	sb->sb_mbtail = mlast;
840 	SBLASTMBUFCHK(sb, "sbappendcontrol");
841 
842 	SBLASTRECORDCHK(sb, "sbappendcontrol 2");
843 
844 	return (1);
845 }
846 
847 /*
848  * Compress mbuf chain m into the socket
849  * buffer sb following mbuf n.  If n
850  * is null, the buffer is presumed empty.
851  */
852 void
853 sbcompress(struct sockbuf *sb, struct mbuf *m, struct mbuf *n)
854 {
855 	int eor = 0;
856 	struct mbuf *o;
857 
858 	while (m) {
859 		eor |= m->m_flags & M_EOR;
860 		if (m->m_len == 0 &&
861 		    (eor == 0 ||
862 		    (((o = m->m_next) || (o = n)) &&
863 		    o->m_type == m->m_type))) {
864 			if (sb->sb_lastrecord == m)
865 				sb->sb_lastrecord = m->m_next;
866 			m = m_free(m);
867 			continue;
868 		}
869 		if (n && (n->m_flags & M_EOR) == 0 &&
870 		    /* M_TRAILINGSPACE() checks buffer writeability */
871 		    m->m_len <= MCLBYTES / 4 && /* XXX Don't copy too much */
872 		    m->m_len <= M_TRAILINGSPACE(n) &&
873 		    n->m_type == m->m_type) {
874 			memcpy(mtod(n, caddr_t) + n->m_len, mtod(m, caddr_t),
875 			    m->m_len);
876 			n->m_len += m->m_len;
877 			sb->sb_cc += m->m_len;
878 			if (m->m_type != MT_CONTROL && m->m_type != MT_SONAME)
879 				sb->sb_datacc += m->m_len;
880 			m = m_free(m);
881 			continue;
882 		}
883 		if (n)
884 			n->m_next = m;
885 		else
886 			sb->sb_mb = m;
887 		sb->sb_mbtail = m;
888 		sballoc(sb, m);
889 		n = m;
890 		m->m_flags &= ~M_EOR;
891 		m = m->m_next;
892 		n->m_next = NULL;
893 	}
894 	if (eor) {
895 		if (n)
896 			n->m_flags |= eor;
897 		else
898 			printf("semi-panic: sbcompress");
899 	}
900 	SBLASTMBUFCHK(sb, __func__);
901 }
902 
903 /*
904  * Free all mbufs in a sockbuf.
905  * Check that all resources are reclaimed.
906  */
907 void
908 sbflush(struct socket *so, struct sockbuf *sb)
909 {
910 	KASSERT(sb == &so->so_rcv || sb == &so->so_snd);
911 	KASSERT((sb->sb_flags & SB_LOCK) == 0);
912 
913 	while (sb->sb_mbcnt)
914 		sbdrop(so, sb, (int)sb->sb_cc);
915 
916 	KASSERT(sb->sb_cc == 0);
917 	KASSERT(sb->sb_datacc == 0);
918 	KASSERT(sb->sb_mb == NULL);
919 	KASSERT(sb->sb_mbtail == NULL);
920 	KASSERT(sb->sb_lastrecord == NULL);
921 }
922 
923 /*
924  * Drop data from (the front of) a sockbuf.
925  */
926 void
927 sbdrop(struct socket *so, struct sockbuf *sb, int len)
928 {
929 	struct mbuf *m, *mn;
930 	struct mbuf *next;
931 
932 	KASSERT(sb == &so->so_rcv || sb == &so->so_snd);
933 	soassertlocked(so);
934 
935 	next = (m = sb->sb_mb) ? m->m_nextpkt : 0;
936 	while (len > 0) {
937 		if (m == NULL) {
938 			if (next == NULL)
939 				panic("sbdrop");
940 			m = next;
941 			next = m->m_nextpkt;
942 			continue;
943 		}
944 		if (m->m_len > len) {
945 			m->m_len -= len;
946 			m->m_data += len;
947 			sb->sb_cc -= len;
948 			if (m->m_type != MT_CONTROL && m->m_type != MT_SONAME)
949 				sb->sb_datacc -= len;
950 			break;
951 		}
952 		len -= m->m_len;
953 		sbfree(sb, m);
954 		mn = m_free(m);
955 		m = mn;
956 	}
957 	while (m && m->m_len == 0) {
958 		sbfree(sb, m);
959 		mn = m_free(m);
960 		m = mn;
961 	}
962 	if (m) {
963 		sb->sb_mb = m;
964 		m->m_nextpkt = next;
965 	} else
966 		sb->sb_mb = next;
967 	/*
968 	 * First part is an inline SB_EMPTY_FIXUP().  Second part
969 	 * makes sure sb_lastrecord is up-to-date if we dropped
970 	 * part of the last record.
971 	 */
972 	m = sb->sb_mb;
973 	if (m == NULL) {
974 		sb->sb_mbtail = NULL;
975 		sb->sb_lastrecord = NULL;
976 	} else if (m->m_nextpkt == NULL)
977 		sb->sb_lastrecord = m;
978 }
979 
980 /*
981  * Drop a record off the front of a sockbuf
982  * and move the next record to the front.
983  */
984 void
985 sbdroprecord(struct sockbuf *sb)
986 {
987 	struct mbuf *m, *mn;
988 
989 	m = sb->sb_mb;
990 	if (m) {
991 		sb->sb_mb = m->m_nextpkt;
992 		do {
993 			sbfree(sb, m);
994 			mn = m_free(m);
995 		} while ((m = mn) != NULL);
996 	}
997 	SB_EMPTY_FIXUP(sb);
998 }
999 
1000 /*
1001  * Create a "control" mbuf containing the specified data
1002  * with the specified type for presentation on a socket buffer.
1003  */
1004 struct mbuf *
1005 sbcreatecontrol(caddr_t p, int size, int type, int level)
1006 {
1007 	struct cmsghdr *cp;
1008 	struct mbuf *m;
1009 
1010 	if (CMSG_SPACE(size) > MCLBYTES) {
1011 		printf("sbcreatecontrol: message too large %d\n", size);
1012 		return NULL;
1013 	}
1014 
1015 	if ((m = m_get(M_DONTWAIT, MT_CONTROL)) == NULL)
1016 		return (NULL);
1017 	if (CMSG_SPACE(size) > MLEN) {
1018 		MCLGET(m, M_DONTWAIT);
1019 		if ((m->m_flags & M_EXT) == 0) {
1020 			m_free(m);
1021 			return NULL;
1022 		}
1023 	}
1024 	cp = mtod(m, struct cmsghdr *);
1025 	memset(cp, 0, CMSG_SPACE(size));
1026 	memcpy(CMSG_DATA(cp), p, size);
1027 	m->m_len = CMSG_SPACE(size);
1028 	cp->cmsg_len = CMSG_LEN(size);
1029 	cp->cmsg_level = level;
1030 	cp->cmsg_type = type;
1031 	return (m);
1032 }
1033