/*
 * (MPSAFE)
 *
 * Copyright (c) 2004 Jeffrey M. Hsu.  All rights reserved.
 * Copyright (c) 2004 The DragonFly Project.  All rights reserved.
 *
 * This code is derived from software contributed to The DragonFly Project
 * by Jeffrey M. Hsu.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of The DragonFly Project nor the names of its
 *    contributors may be used to endorse or promote products derived
 *    from this software without specific, prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

/*
 * Copyright (c) 1982, 1986, 1988, 1991, 1993
 *	The Regents of the University of California.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the University nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * @(#)uipc_mbuf.c	8.2 (Berkeley) 1/4/94
 * $FreeBSD: src/sys/kern/uipc_mbuf.c,v 1.51.2.24 2003/04/15 06:59:29 silby Exp $
 */

#include "opt_param.h"
#include "opt_mbuf_stress_test.h"
#include <sys/param.h>
#include <sys/systm.h>
#include <sys/file.h>
#include <sys/malloc.h>
#include <sys/mbuf.h>
#include <sys/kernel.h>
#include <sys/sysctl.h>
#include <sys/domain.h>
#include <sys/objcache.h>
#include <sys/tree.h>
#include <sys/protosw.h>
#include <sys/uio.h>
#include <sys/thread.h>
#include <sys/proc.h>
#include <sys/globaldata.h>

#include <sys/spinlock2.h>

#include <machine/atomic.h>
#include <machine/limits.h>

#include <vm/vm.h>
#include <vm/vm_kern.h>
#include <vm/vm_extern.h>

#ifdef INVARIANTS
#include <machine/cpu.h>
#endif

/*
 * mbuf cluster meta-data
 */
struct mbcluster {
	int32_t	mcl_refs;
	void	*mcl_data;
};

/*
 * mbuf tracking for debugging purposes
 */
#ifdef MBUF_DEBUG

static MALLOC_DEFINE(M_MTRACK, "mtrack", "mtrack");

struct mbctrack;
RB_HEAD(mbuf_rb_tree, mbtrack);
RB_PROTOTYPE2(mbuf_rb_tree, mbtrack, rb_node, mbtrack_cmp, struct mbuf *);

struct mbtrack {
	RB_ENTRY(mbtrack) rb_node;
	int trackid;
	struct mbuf *m;
};

static int
mbtrack_cmp(struct mbtrack *mb1, struct mbtrack *mb2)
{
	if (mb1->m < mb2->m)
		return (-1);
	if (mb1->m > mb2->m)
		return (1);
	return (0);
}

RB_GENERATE2(mbuf_rb_tree, mbtrack, rb_node, mbtrack_cmp, struct mbuf *, m);

struct mbuf_rb_tree	mbuf_track_root;
static struct spinlock	mbuf_track_spin =
	SPINLOCK_INITIALIZER(mbuf_track_spin, "mbuf_track_spin");

static void
mbuftrack(struct mbuf *m)
{
	struct mbtrack *mbt;

	mbt = kmalloc(sizeof(*mbt), M_MTRACK, M_INTWAIT|M_ZERO);
	spin_lock(&mbuf_track_spin);
	mbt->m = m;
	if (mbuf_rb_tree_RB_INSERT(&mbuf_track_root, mbt)) {
		spin_unlock(&mbuf_track_spin);
		panic("%s: mbuf %p already being tracked", __func__, m);
	}
	spin_unlock(&mbuf_track_spin);
}

static void
mbufuntrack(struct mbuf *m)
{
	struct mbtrack *mbt;

	spin_lock(&mbuf_track_spin);
	mbt = mbuf_rb_tree_RB_LOOKUP(&mbuf_track_root, m);
	if (mbt == NULL) {
		spin_unlock(&mbuf_track_spin);
		panic("%s: mbuf %p was not tracked", __func__, m);
	} else {
		mbuf_rb_tree_RB_REMOVE(&mbuf_track_root, mbt);
		spin_unlock(&mbuf_track_spin);
		kfree(mbt, M_MTRACK);
	}
}

void
mbuftrackid(struct mbuf *m, int trackid)
{
	struct mbtrack *mbt;
	struct mbuf *n;

	spin_lock(&mbuf_track_spin);
	while (m) {
		n = m->m_nextpkt;
		while (m) {
			mbt = mbuf_rb_tree_RB_LOOKUP(&mbuf_track_root, m);
			if (mbt == NULL) {
				spin_unlock(&mbuf_track_spin);
				panic("%s: mbuf %p not tracked", __func__, m);
			}
			mbt->trackid = trackid;
			m = m->m_next;
		}
		m = n;
	}
	spin_unlock(&mbuf_track_spin);
}

static int
mbuftrack_callback(struct mbtrack *mbt, void *arg)
{
	struct sysctl_req *req = arg;
	char buf[64];
	int error;

	ksnprintf(buf, sizeof(buf), "mbuf %p track %d\n", mbt->m, mbt->trackid);

	spin_unlock(&mbuf_track_spin);
	error = SYSCTL_OUT(req, buf, strlen(buf));
	spin_lock(&mbuf_track_spin);
	if (error)
		return (-error);
	return (0);
}

static int
mbuftrack_show(SYSCTL_HANDLER_ARGS)
{
	int error;

	spin_lock(&mbuf_track_spin);
	error = mbuf_rb_tree_RB_SCAN(&mbuf_track_root, NULL,
				     mbuftrack_callback, req);
	spin_unlock(&mbuf_track_spin);
	return (-error);
}
SYSCTL_PROC(_kern_ipc, OID_AUTO, showmbufs, CTLFLAG_RD|CTLTYPE_STRING,
	    0, 0, mbuftrack_show, "A", "Show all in-use mbufs");

#else

#define mbuftrack(m)
#define mbufuntrack(m)

#endif

static void mbinit(void *);
SYSINIT(mbuf, SI_BOOT2_MACHDEP, SI_ORDER_FIRST, mbinit, NULL);

struct mbtypes_stat {
	u_long	stats[MT_NTYPES];
} __cachealign;

static struct mbtypes_stat	mbtypes[SMP_MAXCPU];

static struct mbstat mbstat[SMP_MAXCPU] __cachealign;
int	max_linkhdr;
int	max_protohdr;
int	max_hdr;
int	max_datalen;
int	m_defragpackets;
int	m_defragbytes;
int	m_defraguseless;
int	m_defragfailure;
#ifdef MBUF_STRESS_TEST
int	m_defragrandomfailures;
#endif

struct objcache *mbuf_cache, *mbufphdr_cache;
struct objcache *mclmeta_cache, *mjclmeta_cache;
struct objcache *mbufcluster_cache, *mbufphdrcluster_cache;
struct objcache *mbufjcluster_cache, *mbufphdrjcluster_cache;

struct lock	mbupdate_lk = LOCK_INITIALIZER("mbupdate", 0, LK_CANRECURSE);

int		nmbclusters;
static int	nmbjclusters;
int		nmbufs;

static int	mjclph_cachefrac;
static int	mjcl_cachefrac;
static int	mclph_cachefrac;
static int	mcl_cachefrac;

SYSCTL_INT(_kern_ipc, KIPC_MAX_LINKHDR, max_linkhdr, CTLFLAG_RW,
	   &max_linkhdr, 0, "Max size of a link-level header");
SYSCTL_INT(_kern_ipc, KIPC_MAX_PROTOHDR, max_protohdr, CTLFLAG_RW,
	   &max_protohdr, 0, "Max size of a protocol header");
SYSCTL_INT(_kern_ipc, KIPC_MAX_HDR, max_hdr, CTLFLAG_RW, &max_hdr, 0,
	   "Max size of link+protocol headers");
SYSCTL_INT(_kern_ipc, KIPC_MAX_DATALEN, max_datalen, CTLFLAG_RW,
	   &max_datalen, 0, "Max data payload size without headers");

static int do_mbstat(SYSCTL_HANDLER_ARGS);
SYSCTL_PROC(_kern_ipc, KIPC_MBSTAT, mbstat, CTLTYPE_STRUCT|CTLFLAG_RD,
	    0, 0, do_mbstat, "S,mbstat", "mbuf usage statistics");

static int do_mbtypes(SYSCTL_HANDLER_ARGS);
SYSCTL_PROC(_kern_ipc, OID_AUTO, mbtypes, CTLTYPE_ULONG|CTLFLAG_RD,
	    0, 0, do_mbtypes, "LU", "");

static int
do_mbstat(SYSCTL_HANDLER_ARGS)
{
	struct mbstat mbstat_total;
	struct mbstat *mbstat_totalp;
	int i;

	bzero(&mbstat_total, sizeof(mbstat_total));
	mbstat_totalp = &mbstat_total;

	for (i = 0; i < ncpus; i++) {
		mbstat_total.m_mbufs += mbstat[i].m_mbufs;
		mbstat_total.m_clusters += mbstat[i].m_clusters;
		mbstat_total.m_jclusters += mbstat[i].m_jclusters;
		mbstat_total.m_clfree += mbstat[i].m_clfree;
		mbstat_total.m_drops += mbstat[i].m_drops;
		mbstat_total.m_wait += mbstat[i].m_wait;
		mbstat_total.m_drain += mbstat[i].m_drain;
		mbstat_total.m_mcfail += mbstat[i].m_mcfail;
		mbstat_total.m_mpfail += mbstat[i].m_mpfail;
	}

	/*
	 * The following fields are not cumulative fields so just
	 * get their values once.
	 */
	mbstat_total.m_msize = mbstat[0].m_msize;
	mbstat_total.m_mclbytes = mbstat[0].m_mclbytes;
	mbstat_total.m_minclsize = mbstat[0].m_minclsize;
	mbstat_total.m_mlen = mbstat[0].m_mlen;
	mbstat_total.m_mhlen = mbstat[0].m_mhlen;

	return sysctl_handle_opaque(oidp, mbstat_totalp,
				    sizeof(mbstat_total), req);
}

static int
do_mbtypes(SYSCTL_HANDLER_ARGS)
{
	u_long totals[MT_NTYPES];
	int i, j;

	for (i = 0; i < MT_NTYPES; i++)
		totals[i] = 0;

	for (i = 0; i < ncpus; i++) {
		for (j = 0; j < MT_NTYPES; j++)
			totals[j] += mbtypes[i].stats[j];
	}

	return sysctl_handle_opaque(oidp, totals, sizeof(totals), req);
}

/*
 * The variables may be set as boot-time tunables or live.  Setting these
 * values too low can deadlock your network.  Network interfaces may also
 * adjust nmbclusters and/or nmbjclusters to account for preloading the
 * hardware rings.
 */
static int sysctl_nmbclusters(SYSCTL_HANDLER_ARGS);
static int sysctl_nmbjclusters(SYSCTL_HANDLER_ARGS);
static int sysctl_nmbufs(SYSCTL_HANDLER_ARGS);
SYSCTL_PROC(_kern_ipc, KIPC_NMBCLUSTERS, nmbclusters, CTLTYPE_INT | CTLFLAG_RW,
	    0, 0, sysctl_nmbclusters, "I",
	    "Maximum number of mbuf clusters available");
SYSCTL_PROC(_kern_ipc, OID_AUTO, nmbjclusters, CTLTYPE_INT | CTLFLAG_RW,
	    0, 0, sysctl_nmbjclusters, "I",
	    "Maximum number of mbuf jclusters available");
SYSCTL_PROC(_kern_ipc, OID_AUTO, nmbufs, CTLTYPE_INT | CTLFLAG_RW,
	    0, 0, sysctl_nmbufs, "I",
	    "Maximum number of mbufs available");

SYSCTL_INT(_kern_ipc, OID_AUTO, mjclph_cachefrac, CTLFLAG_RD,
	   &mjclph_cachefrac, 0,
	   "Fraction of cacheable mbuf jclusters w/ pkthdr");
SYSCTL_INT(_kern_ipc, OID_AUTO, mjcl_cachefrac, CTLFLAG_RD,
	   &mjcl_cachefrac, 0,
	   "Fraction of cacheable mbuf jclusters");
SYSCTL_INT(_kern_ipc, OID_AUTO, mclph_cachefrac, CTLFLAG_RD,
	   &mclph_cachefrac, 0,
	   "Fraction of cacheable mbuf clusters w/ pkthdr");
SYSCTL_INT(_kern_ipc, OID_AUTO, mcl_cachefrac, CTLFLAG_RD,
	   &mcl_cachefrac, 0, "Fraction of cacheable mbuf clusters");

SYSCTL_INT(_kern_ipc, OID_AUTO, m_defragpackets, CTLFLAG_RD,
	   &m_defragpackets, 0, "Number of defragment packets");
SYSCTL_INT(_kern_ipc, OID_AUTO, m_defragbytes, CTLFLAG_RD,
	   &m_defragbytes, 0, "Number of defragment bytes");
SYSCTL_INT(_kern_ipc, OID_AUTO, m_defraguseless, CTLFLAG_RD,
	   &m_defraguseless, 0,
	   "Number of useless defragment mbuf chain operations");
SYSCTL_INT(_kern_ipc, OID_AUTO, m_defragfailure, CTLFLAG_RD,
	   &m_defragfailure, 0,
	   "Number of failed defragment mbuf chain operations");
#ifdef MBUF_STRESS_TEST
SYSCTL_INT(_kern_ipc, OID_AUTO, m_defragrandomfailures, CTLFLAG_RW,
	   &m_defragrandomfailures, 0, "");
#endif

static MALLOC_DEFINE(M_MBUF, "mbuf", "mbuf");
static MALLOC_DEFINE(M_MBUFCL, "mbufcl", "mbufcl");
static MALLOC_DEFINE(M_MCLMETA, "mclmeta", "mclmeta");

static void m_reclaim (void);
static void m_mclref(void *arg);
static void m_mclfree(void *arg);
static void m_mjclfree(void *arg);

static void mbupdatelimits(void);

/*
 * Generally scale default mbufs to maxproc.
 *
 * NOTE: Default NMBUFS must take into account a possible DOS attack
 *	 using fd passing on unix domain sockets.
 */
#ifndef NMBCLUSTERS
#define NMBCLUSTERS	(512 + maxproc * 4)
#endif
#ifndef BASE_CACHEFRAC
#define BASE_CACHEFRAC	16
#endif
#ifndef MJCLPH_CACHEFRAC
#define MJCLPH_CACHEFRAC (BASE_CACHEFRAC * 2)
#endif
#ifndef MJCL_CACHEFRAC
#define MJCL_CACHEFRAC	(BASE_CACHEFRAC * 2)
#endif
#ifndef MCLPH_CACHEFRAC
#define MCLPH_CACHEFRAC	(BASE_CACHEFRAC * 2)
#endif
#ifndef MCL_CACHEFRAC
#define MCL_CACHEFRAC	(BASE_CACHEFRAC * 2)
#endif
#ifndef NMBJCLUSTERS
#define NMBJCLUSTERS	(NMBCLUSTERS / 4)
#endif
#ifndef NMBUFS
#define NMBUFS		(nmbclusters / 2 + maxfiles)
#endif

#define NMBCLUSTERS_MIN	(NMBCLUSTERS / 2)
#define NMBJCLUSTERS_MIN (NMBJCLUSTERS / 2)
#define NMBUFS_MIN	(NMBUFS / 2)

/*
 * Perform sanity checks of tunables declared above.
 */
static void
tunable_mbinit(void *dummy __unused)
{
	/*
	 * This has to be done before VM init.
	 */
	nmbclusters = NMBCLUSTERS;
	TUNABLE_INT_FETCH("kern.ipc.nmbclusters", &nmbclusters);
	mjclph_cachefrac = MJCLPH_CACHEFRAC;
	TUNABLE_INT_FETCH("kern.ipc.mjclph_cachefrac", &mjclph_cachefrac);
	mjcl_cachefrac = MJCL_CACHEFRAC;
	TUNABLE_INT_FETCH("kern.ipc.mjcl_cachefrac", &mjcl_cachefrac);
	mclph_cachefrac = MCLPH_CACHEFRAC;
	TUNABLE_INT_FETCH("kern.ipc.mclph_cachefrac", &mclph_cachefrac);
	mcl_cachefrac = MCL_CACHEFRAC;
	TUNABLE_INT_FETCH("kern.ipc.mcl_cachefrac", &mcl_cachefrac);

	/*
	 * WARNING! each mcl cache feeds two mbuf caches, so the minimum
	 *	    cachefrac is 2.  For safety, use 3.
	 */
	if (mjclph_cachefrac < 3)
		mjclph_cachefrac = 3;
	if (mjcl_cachefrac < 3)
		mjcl_cachefrac = 3;
	if (mclph_cachefrac < 3)
		mclph_cachefrac = 3;
	if (mcl_cachefrac < 3)
		mcl_cachefrac = 3;

	nmbjclusters = NMBJCLUSTERS;
	TUNABLE_INT_FETCH("kern.ipc.nmbjclusters", &nmbjclusters);

	nmbufs = NMBUFS;
	TUNABLE_INT_FETCH("kern.ipc.nmbufs", &nmbufs);

	/* Sanity checks */
	if (nmbufs < nmbclusters * 2)
		nmbufs = nmbclusters * 2;
}
SYSINIT(tunable_mbinit, SI_BOOT1_TUNABLES, SI_ORDER_ANY,
	tunable_mbinit, NULL);

static void
mbinclimit(int *limit, int inc, int minlim)
{
	int new_limit;

	lockmgr(&mbupdate_lk, LK_EXCLUSIVE);

	new_limit = *limit + inc;
	if (new_limit < minlim)
		new_limit = minlim;

	if (*limit != new_limit) {
		*limit = new_limit;
		mbupdatelimits();
	}

	lockmgr(&mbupdate_lk, LK_RELEASE);
}

static int
mbsetlimit(int *limit, int new_limit, int minlim)
{
	if (new_limit < minlim)
		return EINVAL;

	lockmgr(&mbupdate_lk, LK_EXCLUSIVE);
	mbinclimit(limit, new_limit - *limit, minlim);
	lockmgr(&mbupdate_lk, LK_RELEASE);
	return 0;
}

static int
sysctl_mblimit(SYSCTL_HANDLER_ARGS, int *limit, int minlim)
{
	int error, value;

	value = *limit;
	error = sysctl_handle_int(oidp, &value, 0, req);
	if (error || req->newptr == NULL)
		return error;

	return mbsetlimit(limit, value, minlim);
}

/*
 * Sysctl support to update nmbclusters, nmbjclusters, and nmbufs.
 */
static int
sysctl_nmbclusters(SYSCTL_HANDLER_ARGS)
{
	return sysctl_mblimit(oidp, arg1, arg2, req, &nmbclusters,
			      NMBCLUSTERS_MIN);
}

static int
sysctl_nmbjclusters(SYSCTL_HANDLER_ARGS)
{
	return sysctl_mblimit(oidp, arg1, arg2, req, &nmbjclusters,
			      NMBJCLUSTERS_MIN);
}

static int
sysctl_nmbufs(SYSCTL_HANDLER_ARGS)
{
	return sysctl_mblimit(oidp, arg1, arg2, req, &nmbufs, NMBUFS_MIN);
}

void
mcl_inclimit(int inc)
{
	mbinclimit(&nmbclusters, inc, NMBCLUSTERS_MIN);
}

void
mjcl_inclimit(int inc)
{
	mbinclimit(&nmbjclusters, inc, NMBJCLUSTERS_MIN);
}

void
mb_inclimit(int inc)
{
	mbinclimit(&nmbufs, inc, NMBUFS_MIN);
}

/*
 * The mbuf object cache only guarantees that m_next and m_nextpkt are
 * NULL and that m_data points to the beginning of the data area.  In
 * particular, m_len and m_pkthdr.len are uninitialized.  It is the
 * responsibility of the caller to initialize those fields before use.
 */
static __inline boolean_t
mbuf_ctor(void *obj, void *private __unused, int ocflags __unused)
{
	struct mbuf *m = obj;

	m->m_next = NULL;
	m->m_nextpkt = NULL;
	m->m_data = m->m_dat;
	m->m_flags = 0;

	return (TRUE);
}

/*
 * Initialize the mbuf and the packet header fields.
 */
static boolean_t
mbufphdr_ctor(void *obj, void *private __unused, int ocflags __unused)
{
	struct mbuf *m = obj;

	m->m_next = NULL;
	m->m_nextpkt = NULL;
	m->m_data = m->m_pktdat;
	m->m_flags = M_PKTHDR | M_PHCACHE;

	m->m_pkthdr.rcvif = NULL;	/* eliminate XXX JH */
	SLIST_INIT(&m->m_pkthdr.tags);
	m->m_pkthdr.csum_flags = 0;	/* eliminate XXX JH */
	m->m_pkthdr.fw_flags = 0;	/* eliminate XXX JH */

	return (TRUE);
}

/*
 * A mbcluster object consists of 2K (MCLBYTES) cluster and a refcount.
 */
static boolean_t
mclmeta_ctor(void *obj, void *private __unused, int ocflags)
{
	struct mbcluster *cl = obj;
	void *buf;

	if (ocflags & M_NOWAIT)
		buf = kmalloc(MCLBYTES, M_MBUFCL, M_NOWAIT | M_ZERO);
	else
		buf = kmalloc(MCLBYTES, M_MBUFCL, M_INTWAIT | M_ZERO);
	if (buf == NULL)
		return (FALSE);
	cl->mcl_refs = 0;
	cl->mcl_data = buf;
	return (TRUE);
}

static boolean_t
mjclmeta_ctor(void *obj, void *private __unused, int ocflags)
{
	struct mbcluster *cl = obj;
	void *buf;

	if (ocflags & M_NOWAIT)
		buf = kmalloc(MJUMPAGESIZE, M_MBUFCL, M_NOWAIT | M_ZERO);
	else
		buf = kmalloc(MJUMPAGESIZE, M_MBUFCL, M_INTWAIT | M_ZERO);
	if (buf == NULL)
		return (FALSE);
	cl->mcl_refs = 0;
	cl->mcl_data = buf;
	return (TRUE);
}

static void
mclmeta_dtor(void *obj, void *private __unused)
{
	struct mbcluster *mcl = obj;

	KKASSERT(mcl->mcl_refs == 0);
	kfree(mcl->mcl_data, M_MBUFCL);
}

static void
linkjcluster(struct mbuf *m, struct mbcluster *cl, u_int size)
{
	/*
	 * Add the cluster to the mbuf.  The caller will detect that the
	 * mbuf now has an attached cluster.
	 */
	m->m_ext.ext_arg = cl;
	m->m_ext.ext_buf = cl->mcl_data;
	m->m_ext.ext_ref = m_mclref;
	if (size != MCLBYTES)
		m->m_ext.ext_free = m_mjclfree;
	else
		m->m_ext.ext_free = m_mclfree;
	m->m_ext.ext_size = size;
	atomic_add_int(&cl->mcl_refs, 1);

	m->m_data = m->m_ext.ext_buf;
	m->m_flags |= M_EXT | M_EXT_CLUSTER;
}

static void
linkcluster(struct mbuf *m, struct mbcluster *cl)
{
	linkjcluster(m, cl, MCLBYTES);
}

static boolean_t
mbufphdrcluster_ctor(void *obj, void *private, int ocflags)
{
	struct mbuf *m = obj;
	struct mbcluster *cl;

	mbufphdr_ctor(obj, private, ocflags);
	cl = objcache_get(mclmeta_cache, ocflags);
	if (cl == NULL) {
		++mbstat[mycpu->gd_cpuid].m_drops;
		return (FALSE);
	}
	m->m_flags |= M_CLCACHE;
	linkcluster(m, cl);
	return (TRUE);
}

static boolean_t
mbufphdrjcluster_ctor(void *obj, void *private, int ocflags)
{
	struct mbuf *m = obj;
	struct mbcluster *cl;

	mbufphdr_ctor(obj, private, ocflags);
	cl = objcache_get(mjclmeta_cache, ocflags);
	if (cl == NULL) {
		++mbstat[mycpu->gd_cpuid].m_drops;
		return (FALSE);
	}
	m->m_flags |= M_CLCACHE;
	linkjcluster(m, cl, MJUMPAGESIZE);
	return (TRUE);
}

static boolean_t
mbufcluster_ctor(void *obj, void *private, int ocflags)
{
	struct mbuf *m = obj;
	struct mbcluster *cl;

	mbuf_ctor(obj, private, ocflags);
	cl = objcache_get(mclmeta_cache, ocflags);
	if (cl == NULL) {
		++mbstat[mycpu->gd_cpuid].m_drops;
		return (FALSE);
	}
	m->m_flags |= M_CLCACHE;
	linkcluster(m, cl);
	return (TRUE);
}

static boolean_t
mbufjcluster_ctor(void *obj, void *private, int ocflags)
{
	struct mbuf *m = obj;
	struct mbcluster *cl;

	mbuf_ctor(obj, private, ocflags);
	cl = objcache_get(mjclmeta_cache, ocflags);
	if (cl == NULL) {
		++mbstat[mycpu->gd_cpuid].m_drops;
		return (FALSE);
	}
	m->m_flags |= M_CLCACHE;
	linkjcluster(m, cl, MJUMPAGESIZE);
	return (TRUE);
}

/*
 * Used for both the cluster and cluster PHDR caches.
 *
 * The mbuf may have lost its cluster due to sharing, deal
 * with the situation by checking M_EXT.
 */
static void
mbufcluster_dtor(void *obj, void *private)
{
	struct mbuf *m = obj;
	struct mbcluster *mcl;

	if (m->m_flags & M_EXT) {
		KKASSERT((m->m_flags & M_EXT_CLUSTER) != 0);
		mcl = m->m_ext.ext_arg;
		KKASSERT(mcl->mcl_refs == 1);
		mcl->mcl_refs = 0;
		if (m->m_flags & M_EXT && m->m_ext.ext_size != MCLBYTES)
			objcache_put(mjclmeta_cache, mcl);
		else
			objcache_put(mclmeta_cache, mcl);
	}
}

struct objcache_malloc_args mbuf_malloc_args = { MSIZE, M_MBUF };
struct objcache_malloc_args mclmeta_malloc_args =
	{ sizeof(struct mbcluster), M_MCLMETA };

static void
mbinit(void *dummy __unused)
{
	int limit, mb_limit, cl_limit, ncl_limit, jcl_limit, i;

	/*
	 * Initialize statistics
	 */
	for (i = 0; i < ncpus; i++) {
		mbstat[i].m_msize = MSIZE;
		mbstat[i].m_mclbytes = MCLBYTES;
		mbstat[i].m_mjumpagesize = MJUMPAGESIZE;
		mbstat[i].m_minclsize = MINCLSIZE;
		mbstat[i].m_mlen = MLEN;
		mbstat[i].m_mhlen = MHLEN;
	}

	/*
	 * Create object caches and save cluster limits, which will
	 * be used to adjust backing kmalloc pools' limit later.
	 */

	mb_limit = cl_limit = 0;

	limit = nmbufs;
	mbuf_cache = objcache_create("mbuf",
	    limit, nmbufs / BASE_CACHEFRAC,
	    mbuf_ctor, NULL, NULL,
	    objcache_malloc_alloc, objcache_malloc_free, &mbuf_malloc_args);
	mb_limit += limit;

	limit = nmbufs;
	mbufphdr_cache = objcache_create("mbuf pkthdr",
	    limit, nmbufs / BASE_CACHEFRAC,
	    mbufphdr_ctor, NULL, NULL,
	    objcache_malloc_alloc, objcache_malloc_free, &mbuf_malloc_args);
	mb_limit += limit;

	ncl_limit = nmbclusters;
	mclmeta_cache = objcache_create("mbuf cluster",
	    ncl_limit, nmbclusters / BASE_CACHEFRAC,
	    mclmeta_ctor, mclmeta_dtor, NULL,
	    objcache_malloc_alloc, objcache_malloc_free, &mclmeta_malloc_args);
	cl_limit += ncl_limit;

	jcl_limit = nmbjclusters;
	mjclmeta_cache = objcache_create("mbuf jcluster",
	    jcl_limit, nmbjclusters / BASE_CACHEFRAC,
	    mjclmeta_ctor, mclmeta_dtor, NULL,
	    objcache_malloc_alloc, objcache_malloc_free, &mclmeta_malloc_args);
	cl_limit += jcl_limit;

	limit = nmbclusters;
	mbufcluster_cache = objcache_create("mbuf+cl",
	    limit, nmbclusters / mcl_cachefrac,
	    mbufcluster_ctor, mbufcluster_dtor, NULL,
	    objcache_malloc_alloc, objcache_malloc_free, &mbuf_malloc_args);
	mb_limit += limit;

	limit = nmbclusters;
	mbufphdrcluster_cache = objcache_create("mbuf pkthdr+cl",
	    limit, nmbclusters / mclph_cachefrac,
	    mbufphdrcluster_ctor, mbufcluster_dtor, NULL,
	    objcache_malloc_alloc, objcache_malloc_free, &mbuf_malloc_args);
	mb_limit += limit;

	limit = nmbjclusters;
	mbufjcluster_cache = objcache_create("mbuf+jcl",
	    limit, nmbjclusters / mjcl_cachefrac,
	    mbufjcluster_ctor, mbufcluster_dtor, NULL,
	    objcache_malloc_alloc, objcache_malloc_free, &mbuf_malloc_args);
	mb_limit += limit;

	limit = nmbjclusters;
	mbufphdrjcluster_cache = objcache_create("mbuf pkthdr+jcl",
	    limit, nmbjclusters / mjclph_cachefrac,
	    mbufphdrjcluster_ctor, mbufcluster_dtor, NULL,
	    objcache_malloc_alloc, objcache_malloc_free, &mbuf_malloc_args);
	mb_limit += limit;

	/*
	 * Adjust backing kmalloc pools' limit
	 *
	 * NOTE: We raise the limit by another 1/8 to take the effect
	 * of loosememuse into account.
	 */
	cl_limit += cl_limit / 8;
	kmalloc_raise_limit(mclmeta_malloc_args.mtype,
			    mclmeta_malloc_args.objsize * (size_t)cl_limit);
	kmalloc_raise_limit(M_MBUFCL,
			    (MCLBYTES * (size_t)ncl_limit) +
			    (MJUMPAGESIZE * (size_t)jcl_limit));

	mb_limit += mb_limit / 8;
	kmalloc_raise_limit(mbuf_malloc_args.mtype,
			    mbuf_malloc_args.objsize * (size_t)mb_limit);
}

/*
 * Adjust mbuf limits after changes have been made
 *
 * Caller must hold mbupdate_lk
 */
static void
mbupdatelimits(void)
{
	int limit, mb_limit, cl_limit, ncl_limit, jcl_limit;

	KASSERT(lockowned(&mbupdate_lk), ("mbupdate_lk is not held"));

	/*
	 * Figure out adjustments to object caches after nmbufs, nmbclusters,
	 * or nmbjclusters has been modified.
	 */
	mb_limit = cl_limit = 0;

	limit = nmbufs;
	objcache_set_cluster_limit(mbuf_cache, limit);
	mb_limit += limit;

	limit = nmbufs;
	objcache_set_cluster_limit(mbufphdr_cache, limit);
	mb_limit += limit;

	ncl_limit = nmbclusters;
	objcache_set_cluster_limit(mclmeta_cache, ncl_limit);
	cl_limit += ncl_limit;

	jcl_limit = nmbjclusters;
	objcache_set_cluster_limit(mjclmeta_cache, jcl_limit);
	cl_limit += jcl_limit;

	limit = nmbclusters;
	objcache_set_cluster_limit(mbufcluster_cache, limit);
	mb_limit += limit;

	limit = nmbclusters;
	objcache_set_cluster_limit(mbufphdrcluster_cache, limit);
	mb_limit += limit;

	limit = nmbjclusters;
	objcache_set_cluster_limit(mbufjcluster_cache, limit);
	mb_limit += limit;

	limit = nmbjclusters;
	objcache_set_cluster_limit(mbufphdrjcluster_cache, limit);
	mb_limit += limit;

	/*
	 * Adjust backing kmalloc pools' limit
	 *
	 * NOTE: We raise the limit by another 1/8 to take the effect
	 * of loosememuse into account.
	 */
	cl_limit += cl_limit / 8;
	kmalloc_raise_limit(mclmeta_malloc_args.mtype,
			    mclmeta_malloc_args.objsize * (size_t)cl_limit);
	kmalloc_raise_limit(M_MBUFCL,
			    (MCLBYTES * (size_t)ncl_limit) +
			    (MJUMPAGESIZE * (size_t)jcl_limit));
	mb_limit += mb_limit / 8;
	kmalloc_raise_limit(mbuf_malloc_args.mtype,
			    mbuf_malloc_args.objsize * (size_t)mb_limit);
}

/*
 * Return the number of references to this mbuf's data.  0 is returned
 * if the mbuf is not M_EXT, a reference count is returned if it is
 * M_EXT | M_EXT_CLUSTER, and 99 is returned if it is a special M_EXT.
 */
int
m_sharecount(struct mbuf *m)
{
	switch (m->m_flags & (M_EXT | M_EXT_CLUSTER)) {
	case 0:
		return (0);
	case M_EXT:
		return (99);
	case M_EXT | M_EXT_CLUSTER:
		return (((struct mbcluster *)m->m_ext.ext_arg)->mcl_refs);
	}
	/* NOTREACHED */
	return (0);		/* to shut up compiler */
}

/*
 * change mbuf to new type
 */
void
m_chtype(struct mbuf *m, int type)
{
	struct globaldata *gd = mycpu;

	++mbtypes[gd->gd_cpuid].stats[type];
	--mbtypes[gd->gd_cpuid].stats[m->m_type];
	m->m_type = type;
}

static void
m_reclaim(void)
{
	struct domain *dp;
	struct protosw *pr;

	kprintf("Debug: m_reclaim() called\n");

	SLIST_FOREACH(dp, &domains, dom_next) {
		for (pr = dp->dom_protosw; pr < dp->dom_protoswNPROTOSW; pr++) {
			if (pr->pr_drain)
				(*pr->pr_drain)();
		}
	}
	++mbstat[mycpu->gd_cpuid].m_drain;
}

static __inline void
updatestats(struct mbuf *m, int type)
{
	struct globaldata *gd = mycpu;

	m->m_type = type;
	mbuftrack(m);
#ifdef MBUF_DEBUG
	KASSERT(m->m_next == NULL, ("mbuf %p: bad m_next in get", m));
	KASSERT(m->m_nextpkt == NULL, ("mbuf %p: bad m_nextpkt in get", m));
#endif

	++mbtypes[gd->gd_cpuid].stats[type];
	++mbstat[gd->gd_cpuid].m_mbufs;

}

/*
 * Allocate an mbuf.
 */
struct mbuf *
m_get(int how, int type)
{
	struct mbuf *m;
	int ntries = 0;
	int ocf = MB_OCFLAG(how);

retryonce:

	m = objcache_get(mbuf_cache, ocf);

	if (m == NULL) {
		if ((ocf & M_WAITOK) && ntries++ == 0) {
			struct objcache *reclaimlist[] = {
				mbufphdr_cache,
				mbufcluster_cache,
				mbufphdrcluster_cache,
				mbufjcluster_cache,
				mbufphdrjcluster_cache
			};
			const int nreclaims = NELEM(reclaimlist);

			if (!objcache_reclaimlist(reclaimlist, nreclaims))
				m_reclaim();
			goto retryonce;
		}
		++mbstat[mycpu->gd_cpuid].m_drops;
		return (NULL);
	}
#ifdef MBUF_DEBUG
	KASSERT(m->m_data == m->m_dat, ("mbuf %p: bad m_data in get", m));
#endif
	m->m_len = 0;

	updatestats(m, type);
	return (m);
}

struct mbuf *
m_gethdr(int how, int type)
{
	struct mbuf *m;
	int ocf = MB_OCFLAG(how);
	int ntries = 0;

retryonce:

	m = objcache_get(mbufphdr_cache, ocf);

	if (m == NULL) {
		if ((ocf & M_WAITOK) && ntries++ == 0) {
			struct objcache *reclaimlist[] = {
				mbuf_cache,
				mbufcluster_cache, mbufphdrcluster_cache,
				mbufjcluster_cache, mbufphdrjcluster_cache
			};
			const int nreclaims = NELEM(reclaimlist);

			if (!objcache_reclaimlist(reclaimlist, nreclaims))
				m_reclaim();
			goto retryonce;
		}
		++mbstat[mycpu->gd_cpuid].m_drops;
		return (NULL);
	}
#ifdef MBUF_DEBUG
	KASSERT(m->m_data == m->m_pktdat, ("mbuf %p: bad m_data in get", m));
#endif
	m->m_len = 0;
	m->m_pkthdr.len = 0;

	updatestats(m, type);
	return (m);
}

/*
 * Get a mbuf (not a mbuf cluster!) and zero it.
 *
 * Deprecated.
 */
struct mbuf *
m_getclr(int how, int type)
{
	struct mbuf *m;

	m = m_get(how, type);
	if (m != NULL)
		bzero(m->m_data, MLEN);
	return (m);
}

static struct mbuf *
m_getcl_cache(int how, short type, int flags, struct objcache *mbclc,
	      struct objcache *mbphclc, u_long *cl_stats)
{
	struct mbuf *m = NULL;
	int ocflags = MB_OCFLAG(how);
	int ntries = 0;

retryonce:

	if (flags & M_PKTHDR)
		m = objcache_get(mbphclc, ocflags);
	else
		m = objcache_get(mbclc, ocflags);

	if (m == NULL) {
		if ((ocflags & M_WAITOK) && ntries++ == 0) {
			struct objcache *reclaimlist[1];

			if (flags & M_PKTHDR)
				reclaimlist[0] = mbclc;
			else
				reclaimlist[0] = mbphclc;
			if (!objcache_reclaimlist(reclaimlist, 1))
				m_reclaim();
			goto retryonce;
		}
		++mbstat[mycpu->gd_cpuid].m_drops;
		return (NULL);
	}

#ifdef MBUF_DEBUG
	KASSERT(m->m_data == m->m_ext.ext_buf,
		("mbuf %p: bad m_data in get", m));
#endif
	m->m_type = type;
	m->m_len = 0;
	m->m_pkthdr.len = 0;	/* just do it unconditionally */

	mbuftrack(m);

	++mbtypes[mycpu->gd_cpuid].stats[type];
	++(*cl_stats);
	return (m);
}

struct mbuf *
m_getjcl(int how, short type, int flags, size_t size)
{
	struct objcache *mbclc, *mbphclc;
	u_long *cl_stats;

	switch (size) {
	case MCLBYTES:
		mbclc = mbufcluster_cache;
		mbphclc = mbufphdrcluster_cache;
		cl_stats = &mbstat[mycpu->gd_cpuid].m_clusters;
		break;

	default:
		mbclc = mbufjcluster_cache;
		mbphclc = mbufphdrjcluster_cache;
		cl_stats = &mbstat[mycpu->gd_cpuid].m_jclusters;
		break;
	}
	return m_getcl_cache(how, type, flags, mbclc, mbphclc, cl_stats);
}

/*
 * Returns an mbuf with an attached cluster.
 * Because many network drivers use this kind of buffers a lot, it is
 * convenient to keep a small pool of free buffers of this kind.
 * Even a small size such as 10 gives about 10% improvement in the
 * forwarding rate in a bridge or router.
 */
struct mbuf *
m_getcl(int how, short type, int flags)
{
	return m_getcl_cache(how, type, flags,
			     mbufcluster_cache, mbufphdrcluster_cache,
			     &mbstat[mycpu->gd_cpuid].m_clusters);
}

/*
 * Allocate chain of requested length.
 */
struct mbuf *
m_getc(int len, int how, int type)
{
	struct mbuf *n, *nfirst = NULL, **ntail = &nfirst;
	int nsize;

	while (len > 0) {
		n = m_getl(len, how, type, 0, &nsize);
		if (n == NULL)
			goto failed;
		n->m_len = 0;
		*ntail = n;
		ntail = &n->m_next;
		len -= nsize;
	}
	return (nfirst);

failed:
	m_freem(nfirst);
	return (NULL);
}

/*
 * Allocate len-worth of mbufs and/or mbuf clusters (whatever fits best)
 * and return a pointer to the head of the allocated chain. If m0 is
 * non-null, then we assume that it is a single mbuf or an mbuf chain to
 * which we want len bytes worth of mbufs and/or clusters attached, and so
 * if we succeed in allocating it, we will just return a pointer to m0.
 *
 * If we happen to fail at any point during the allocation, we will free
 * up everything we have already allocated and return NULL.
 *
 * Deprecated.  Use m_getc() and m_cat() instead.
 */
struct mbuf *
m_getm(struct mbuf *m0, int len, int type, int how)
{
	struct mbuf *nfirst;

	nfirst = m_getc(len, how, type);

	if (m0 != NULL) {
		m_last(m0)->m_next = nfirst;
		return (m0);
	}

	return (nfirst);
}

/*
 * Adds a cluster to a normal mbuf, M_EXT is set on success.
 * Deprecated.  Use m_getcl() instead.
 */
void
m_mclget(struct mbuf *m, int how)
{
	struct mbcluster *mcl;

	KKASSERT((m->m_flags & M_EXT) == 0);
	mcl = objcache_get(mclmeta_cache, MB_OCFLAG(how));
	if (mcl != NULL) {
		linkcluster(m, mcl);
		++mbstat[mycpu->gd_cpuid].m_clusters;
	} else {
		++mbstat[mycpu->gd_cpuid].m_drops;
	}
}

/*
 * Updates to mbcluster must be MPSAFE.  Only an entity which already has
 * a reference to the cluster can ref it, so we are in no danger of
 * racing an add with a subtract.  But the operation must still be atomic
 * since multiple entities may have a reference on the cluster.
 *
 * m_mclfree() is almost the same but it must contend with two entities
 * freeing the cluster at the same time.
 */
static void
m_mclref(void *arg)
{
	struct mbcluster *mcl = arg;

	atomic_add_int(&mcl->mcl_refs, 1);
}

/*
 * When dereferencing a cluster we have to deal with a N->0 race, where
 * N entities free their references simultaneously.  To do this we use
 * atomic_fetchadd_int().
 */
static void
m_mclfree(void *arg)
{
	struct mbcluster *mcl = arg;

	if (atomic_fetchadd_int(&mcl->mcl_refs, -1) == 1) {
		--mbstat[mycpu->gd_cpuid].m_clusters;
		objcache_put(mclmeta_cache, mcl);
	}
}

static void
m_mjclfree(void *arg)
{
	struct mbcluster *mcl = arg;

	if (atomic_fetchadd_int(&mcl->mcl_refs, -1) == 1) {
		--mbstat[mycpu->gd_cpuid].m_jclusters;
		objcache_put(mjclmeta_cache, mcl);
	}
}

/*
 * Free a single mbuf and any associated external storage.  The successor,
 * if any, is returned.
 *
 * We do need to check non-first mbuf for m_aux, since some of existing
 * code does not call M_PREPEND properly.
 * (example: call to bpf_mtap from drivers)
 */

struct mbuf *
#ifdef MBUF_DEBUG
_m_free(struct mbuf *m, const char *func)
#else
m_free(struct mbuf *m)
#endif
{
	struct mbuf *n;
	struct globaldata *gd = mycpu;

	KASSERT(m->m_type != MT_FREE, ("freeing free mbuf %p", m));
	KASSERT(M_TRAILINGSPACE(m) >= 0, ("overflowed mbuf %p", m));
	--mbtypes[gd->gd_cpuid].stats[m->m_type];

	n = m->m_next;

	/*
	 * Make sure the mbuf is in constructed state before returning it
	 * to the objcache.
	 */
	m->m_next = NULL;
	mbufuntrack(m);
#ifdef MBUF_DEBUG
	m->m_hdr.mh_lastfunc = func;
#endif
#ifdef notyet
	KKASSERT(m->m_nextpkt == NULL);
#else
	if (m->m_nextpkt != NULL) {
		static int afewtimes = 10;

		if (afewtimes-- > 0) {
			kprintf("mfree: m->m_nextpkt != NULL\n");
			print_backtrace(-1);
		}
		m->m_nextpkt = NULL;
	}
#endif
	if (m->m_flags & M_PKTHDR) {
		m_tag_delete_chain(m);		/* eliminate XXX JH */
	}

	m->m_flags &= (M_EXT | M_EXT_CLUSTER | M_CLCACHE | M_PHCACHE);

	/*
	 * Clean the M_PKTHDR state so we can return the mbuf to its original
	 * cache.  This is based on the PHCACHE flag which tells us whether
	 * the mbuf was originally allocated out of a packet-header cache
	 * or a non-packet-header cache.
	 */
	if (m->m_flags & M_PHCACHE) {
		m->m_flags |= M_PKTHDR;
		m->m_pkthdr.rcvif = NULL;	/* eliminate XXX JH */
		m->m_pkthdr.csum_flags = 0;	/* eliminate XXX JH */
		m->m_pkthdr.fw_flags = 0;	/* eliminate XXX JH */
		SLIST_INIT(&m->m_pkthdr.tags);
	}

	/*
	 * Handle remaining flags combinations.  M_CLCACHE tells us whether
	 * the mbuf was originally allocated from a cluster cache or not,
	 * and is totally separate from whether the mbuf is currently
	 * associated with a cluster.
	 */
	switch (m->m_flags & (M_CLCACHE | M_EXT | M_EXT_CLUSTER)) {
	case M_CLCACHE | M_EXT | M_EXT_CLUSTER:
		/*
		 * mbuf+cluster cache case.  The mbuf was allocated from the
		 * combined mbuf_cluster cache and can be returned to the
		 * cache if the cluster hasn't been shared.
		 */
		if (m_sharecount(m) == 1) {
			/*
			 * The cluster has not been shared, we can just
			 * reset the data pointer and return the mbuf
			 * to the cluster cache.  Note that the reference
			 * count is left intact (it is still associated with
			 * an mbuf).
			 */
			m->m_data = m->m_ext.ext_buf;
			if ((m->m_flags & M_EXT) &&
			    m->m_ext.ext_size != MCLBYTES) {
				if (m->m_flags & M_PHCACHE)
					objcache_put(mbufphdrjcluster_cache, m);
				else
					objcache_put(mbufjcluster_cache, m);
				--mbstat[mycpu->gd_cpuid].m_jclusters;
			} else {
				if (m->m_flags & M_PHCACHE)
					objcache_put(mbufphdrcluster_cache, m);
				else
					objcache_put(mbufcluster_cache, m);
				--mbstat[mycpu->gd_cpuid].m_clusters;
			}
		} else {
			/*
			 * Hell.  Someone else has a ref on this cluster,
			 * we have to disconnect it which means we can't
			 * put it back into the mbufcluster_cache, we
			 * have to destroy the mbuf.
			 *
			 * Other mbuf references to the cluster will typically
			 * be M_EXT | M_EXT_CLUSTER but without M_CLCACHE.
			 *
			 * XXX we could try to connect another cluster to it.
			 */
			m->m_ext.ext_free(m->m_ext.ext_arg);
			m->m_flags &= ~(M_EXT | M_EXT_CLUSTER);
			if (m->m_ext.ext_size == MCLBYTES) {
				if (m->m_flags & M_PHCACHE)
					objcache_dtor(mbufphdrcluster_cache, m);
				else
					objcache_dtor(mbufcluster_cache, m);
			} else {
				if (m->m_flags & M_PHCACHE)
					objcache_dtor(mbufphdrjcluster_cache, m);
				else
					objcache_dtor(mbufjcluster_cache, m);
			}
		}
		break;
	case M_EXT | M_EXT_CLUSTER:
	case M_EXT:
		/*
		 * Normal cluster association case, disconnect the cluster from
		 * the mbuf.  The cluster may or may not be custom.
		 */
		m->m_ext.ext_free(m->m_ext.ext_arg);
		m->m_flags &= ~(M_EXT | M_EXT_CLUSTER);
		/* FALLTHROUGH */
	case 0:
		/*
		 * return the mbuf to the mbuf cache.
		 */
		if (m->m_flags & M_PHCACHE) {
			m->m_data = m->m_pktdat;
			objcache_put(mbufphdr_cache, m);
		} else {
			m->m_data = m->m_dat;
			objcache_put(mbuf_cache, m);
		}
		--mbstat[mycpu->gd_cpuid].m_mbufs;
		break;
	default:
		if (!panicstr)
			panic("bad mbuf flags %p %08x", m, m->m_flags);
		break;
	}
	return (n);
}

#ifdef MBUF_DEBUG

void
_m_freem(struct mbuf *m, const char *func)
{
	while (m)
		m = _m_free(m, func);
}

#else

void
m_freem(struct mbuf *m)
{
	while (m)
		m = m_free(m);
}

#endif /* MBUF_DEBUG */

void
m_extadd(struct mbuf *m, void *buf, u_int size, void (*reff)(void *),
	 void (*freef)(void *), void *arg)
{
	m->m_ext.ext_arg = arg;
	m->m_ext.ext_buf = buf;
	m->m_ext.ext_ref = reff;
	m->m_ext.ext_free = freef;
	m->m_ext.ext_size = size;
	reff(arg);
	m->m_data = buf;
	m->m_flags |= M_EXT;
}

/*
 * mbuf utility routines
 */

/*
 * Lesser-used path for M_PREPEND: allocate new mbuf to prepend to chain and
 * copy junk along.
 */
struct mbuf *
m_prepend(struct mbuf *m, int len, int how)
{
	struct mbuf *mn;

	if (m->m_flags & M_PKTHDR)
		mn = m_gethdr(how, m->m_type);
	else
		mn = m_get(how, m->m_type);
	if (mn == NULL) {
		m_freem(m);
		return (NULL);
	}
	if (m->m_flags & M_PKTHDR)
		M_MOVE_PKTHDR(mn, m);
	mn->m_next = m;
	m = mn;
	if (len < MHLEN)
		MH_ALIGN(m, len);
	m->m_len = len;
	return (m);
}

/*
 * Make a copy of an mbuf chain starting "off0" bytes from the beginning,
 * continuing for "len" bytes.  If len is M_COPYALL, copy to end of mbuf.
 * The wait parameter is a choice of M_WAITOK/M_NOWAIT from caller.
 * Note that the copy is read-only, because clusters are not copied,
 * only their reference counts are incremented.
 */
struct mbuf *
m_copym(const struct mbuf *m, int off0, int len, int wait)
{
	struct mbuf *n, **np;
	int off = off0;
	struct mbuf *top;
	int copyhdr = 0;

	KASSERT(off >= 0, ("%s: negative off %d", __func__, off));
	KASSERT(len >= 0, ("%s: negative len %d", __func__, len));
	if (off == 0 && (m->m_flags & M_PKTHDR))
		copyhdr = 1;
	while (off > 0) {
		KASSERT(m != NULL,
			("%s: offset > size of mbuf chain", __func__));
		if (off < m->m_len)
			break;
		off -= m->m_len;
		m = m->m_next;
	}
	np = &top;
	top = NULL;
	while (len > 0) {
		if (m == NULL) {
			KASSERT(len == M_COPYALL,
				("%s: length > size of mbuf chain", __func__));
			break;
		}
		/*
		 * Because we are sharing any cluster attachment below,
		 * be sure to get an mbuf that does not have a cluster
		 * associated with it.
		 */
		if (copyhdr)
			n = m_gethdr(wait, m->m_type);
		else
			n = m_get(wait, m->m_type);
		*np = n;
		if (n == NULL)
			goto nospace;
		if (copyhdr) {
			if (!m_dup_pkthdr(n, m, wait))
				goto nospace;
			if (len == M_COPYALL)
				n->m_pkthdr.len -= off0;
			else
				n->m_pkthdr.len = len;
			copyhdr = 0;
		}
		n->m_len = min(len, m->m_len - off);
		if (m->m_flags & M_EXT) {
			KKASSERT((n->m_flags & M_EXT) == 0);
			n->m_data = m->m_data + off;
			m->m_ext.ext_ref(m->m_ext.ext_arg);
			n->m_ext = m->m_ext;
			n->m_flags |= m->m_flags & (M_EXT | M_EXT_CLUSTER);
		} else {
			bcopy(mtod(m, caddr_t) + off, mtod(n, caddr_t),
			      n->m_len);
		}
		if (len != M_COPYALL)
			len -= n->m_len;
		off = 0;
		m = m->m_next;
		np = &n->m_next;
	}
	if (top == NULL)
		++mbstat[mycpu->gd_cpuid].m_mcfail;
	return (top);
nospace:
	m_freem(top);
	++mbstat[mycpu->gd_cpuid].m_mcfail;
	return (NULL);
}

/*
 * Copy an entire packet, including header (which must be present).
 * An optimization of the common case `m_copym(m, 0, M_COPYALL, how)'.
 * Note that the copy is read-only, because clusters are not copied,
 * only their reference counts are incremented.
 * Preserve alignment of the first mbuf so if the creator has left
 * some room at the beginning (e.g. for inserting protocol headers)
 * the copies also have the room available.
 */
struct mbuf *
m_copypacket(struct mbuf *m, int how)
{
	struct mbuf *top, *n, *o;

	n = m_gethdr(how, m->m_type);
	top = n;
	if (!n)
		goto nospace;

	if (!m_dup_pkthdr(n, m, how))
		goto nospace;
	n->m_len = m->m_len;
	if (m->m_flags & M_EXT) {
		KKASSERT((n->m_flags & M_EXT) == 0);
		n->m_data = m->m_data;
		m->m_ext.ext_ref(m->m_ext.ext_arg);
		n->m_ext = m->m_ext;
		n->m_flags |= m->m_flags & (M_EXT | M_EXT_CLUSTER);
	} else {
		n->m_data = n->m_pktdat + (m->m_data - m->m_pktdat);
		bcopy(mtod(m, void *), mtod(n, void *), n->m_len);
	}

	m = m->m_next;
	while (m) {
		o = m_get(how, m->m_type);
		if (!o)
			goto nospace;

		n->m_next = o;
		n = n->m_next;

		n->m_len = m->m_len;
		if (m->m_flags & M_EXT) {
			KKASSERT((n->m_flags & M_EXT) == 0);
			n->m_data = m->m_data;
			m->m_ext.ext_ref(m->m_ext.ext_arg);
			n->m_ext = m->m_ext;
			n->m_flags |= m->m_flags & (M_EXT | M_EXT_CLUSTER);
		} else {
			bcopy(mtod(m, void *), mtod(n, void *), n->m_len);
		}

		m = m->m_next;
	}
	return top;
nospace:
	m_freem(top);
	++mbstat[mycpu->gd_cpuid].m_mcfail;
	return (NULL);
}

/*
 * Copy data from an mbuf chain starting "off" bytes from the beginning,
 * continuing for "len" bytes, into the indicated buffer.
 */
void
m_copydata(const struct mbuf *m, int off, int len, void *_cp)
{
	caddr_t cp = _cp;
	unsigned count;

	KASSERT(off >= 0, ("%s: negative off %d", __func__, off));
	KASSERT(len >= 0, ("%s: negative len %d", __func__, len));
	while (off > 0) {
		KASSERT(m != NULL,
			("%s: offset > size of mbuf chain", __func__));
		if (off < m->m_len)
			break;
		off -= m->m_len;
		m = m->m_next;
	}
	while (len > 0) {
		KASSERT(m != NULL,
			("%s: length > size of mbuf chain", __func__));
		count = min(m->m_len - off, len);
		bcopy(mtod(m, caddr_t) + off, cp, count);
		len -= count;
		cp += count;
		off = 0;
		m = m->m_next;
	}
}

/*
 * Copy a packet header mbuf chain into a completely new chain, including
 * copying any mbuf clusters.  Use this instead of m_copypacket() when
 * you need a writable copy of an mbuf chain.
 */
struct mbuf *
m_dup(struct mbuf *m, int how)
{
	struct mbuf **p, *n, *top = NULL;
	int remain, moff, nsize, chunk;

	/* Sanity check */
	if (m == NULL)
		return (NULL);

	KASSERT((m->m_flags & M_PKTHDR) != 0, ("%s: !PKTHDR", __func__));

	/* While there's more data, get a new mbuf, tack it on, and fill it */
	remain = m->m_pkthdr.len;
	moff = 0;
	p = &top;
	while (remain > 0 || top == NULL) {	/* allow m->m_pkthdr.len == 0 */
		/* Get the next new mbuf */
		n = m_getl(remain, how, m->m_type, top == NULL ? M_PKTHDR : 0,
			   &nsize);
		if (n == NULL)
			goto nospace;
		if (top == NULL)
			if (!m_dup_pkthdr(n, m, how))
				goto nospace0;

		/* Link it into the new chain */
		*p = n;
		p = &n->m_next;

		/* Copy data from original mbuf(s) into new mbuf */
		n->m_len = 0;
		while (n->m_len < nsize && m != NULL) {
			chunk = min(nsize - n->m_len, m->m_len - moff);
			bcopy(m->m_data + moff, n->m_data + n->m_len, chunk);
			moff += chunk;
			n->m_len += chunk;
			remain -= chunk;
			if (moff == m->m_len) {
				m = m->m_next;
				moff = 0;
			}
		}

		/* Check correct total mbuf length */
		KASSERT((remain > 0 && m != NULL) || (remain == 0 && m == NULL),
			("%s: bogus m_pkthdr.len", __func__));
	}
	return (top);

nospace:
	m_freem(top);
nospace0:
	++mbstat[mycpu->gd_cpuid].m_mcfail;
	return (NULL);
}

/*
 * Copy the non-packet mbuf data chain into a new set of mbufs, including
 * copying any mbuf clusters.  This is typically used to realign a data
 * chain by nfs_realign().
 *
 * The original chain is left intact.  how should be M_WAITOK or M_NOWAIT
 * and NULL can be returned if M_NOWAIT is passed.
 *
 * Be careful to use cluster mbufs, a large mbuf chain converted to non
 * cluster mbufs can exhaust our supply of mbufs.
 */
struct mbuf *
m_dup_data(struct mbuf *m, int how)
{
	struct mbuf **p, *n, *top = NULL;
	int mlen, moff, chunk, gsize, nsize;

	/* Degenerate case */
	if (m == NULL)
		return (NULL);

	/*
	 * Optimize the mbuf allocation but do not get too carried away.
	 */
	if (m->m_next || m->m_len > MLEN)
		if (m->m_flags & M_EXT && m->m_ext.ext_size == MCLBYTES)
			gsize = MCLBYTES;
		else
			gsize = MJUMPAGESIZE;
	else
		gsize = MLEN;

	/* Chain control */
	p = &top;
	n = NULL;
	nsize = 0;

	/*
	 * Scan the mbuf chain until nothing is left, the new mbuf chain
	 * will be allocated on the fly as needed.
	 */
	while (m) {
		mlen = m->m_len;
		moff = 0;

		while (mlen) {
			KKASSERT(m->m_type == MT_DATA);
			if (n == NULL) {
				n = m_getl(gsize, how, MT_DATA, 0, &nsize);
				if (n == NULL)
					goto nospace;
				n->m_len = 0;
				*p = n;
				p = &n->m_next;
			}
			chunk = imin(mlen, nsize);
			bcopy(m->m_data + moff, n->m_data + n->m_len, chunk);
			mlen -= chunk;
			moff += chunk;
			n->m_len += chunk;
			nsize -= chunk;
			if (nsize == 0)
				n = NULL;
		}
		m = m->m_next;
	}
	*p = NULL;
	return(top);
nospace:
	*p = NULL;
	m_freem(top);
	++mbstat[mycpu->gd_cpuid].m_mcfail;
	return (NULL);
}

/*
 * Concatenate mbuf chain n to m.
 * Both chains must be of the same type (e.g. MT_DATA).
 * Any m_pkthdr is not updated.
 */
void
m_cat(struct mbuf *m, struct mbuf *n)
{
	m = m_last(m);
	while (n) {
		if (m->m_flags & M_EXT ||
		    m->m_data + m->m_len + n->m_len >= &m->m_dat[MLEN]) {
			/* just join the two chains */
			m->m_next = n;
			return;
		}
		/* splat the data from one into the other */
		bcopy(mtod(n, caddr_t), mtod(m, caddr_t) + m->m_len, n->m_len);
		m->m_len += n->m_len;
		n = m_free(n);
	}
}

void
m_adj(struct mbuf *mp, int req_len)
{
	struct mbuf *m;
	int count, len = req_len;

	if ((m = mp) == NULL)
		return;
	if (len >= 0) {
		/*
		 * Trim from head.
		 */
		while (m != NULL && len > 0) {
			if (m->m_len <= len) {
				len -= m->m_len;
				m->m_len = 0;
				m = m->m_next;
			} else {
				m->m_len -= len;
				m->m_data += len;
				len = 0;
			}
		}
		m = mp;
		if (mp->m_flags & M_PKTHDR)
			m->m_pkthdr.len -= (req_len - len);
	} else {
		/*
		 * Trim from tail.  Scan the mbuf chain,
		 * calculating its length and finding the last mbuf.
		 * If the adjustment only affects this mbuf, then just
		 * adjust and return.  Otherwise, rescan and truncate
		 * after the remaining size.
		 */
		len = -len;
		count = 0;
		for (;;) {
			count += m->m_len;
			if (m->m_next == NULL)
				break;
			m = m->m_next;
		}
		if (m->m_len >= len) {
			m->m_len -= len;
			if (mp->m_flags & M_PKTHDR)
				mp->m_pkthdr.len -= len;
			return;
		}
		count -= len;
		if (count < 0)
			count = 0;
		/*
		 * Correct length for chain is "count".
		 * Find the mbuf with last data, adjust its length,
		 * and toss data from remaining mbufs on chain.
		 */
		m = mp;
		if (m->m_flags & M_PKTHDR)
			m->m_pkthdr.len = count;
		for (; m; m = m->m_next) {
			if (m->m_len >= count) {
				m->m_len = count;
				break;
			}
			count -= m->m_len;
		}
		while ((m = m->m_next) != NULL)
			m->m_len = 0;
	}
}

/*
 * Set the m_data pointer of a newly-allocated mbuf
 * to place an object of the specified size at the
 * end of the mbuf, longword aligned.
 */
void
m_align(struct mbuf *m, int len)
{
	int adjust;

	if (m->m_flags & M_EXT)
		adjust = m->m_ext.ext_size - len;
	else if (m->m_flags & M_PKTHDR)
		adjust = MHLEN - len;
	else
		adjust = MLEN - len;
	m->m_data += rounddown2(adjust, sizeof(long));
}

/*
 * Create a writable copy of the mbuf chain.  While doing this
 * we compact the chain with a goal of producing a chain with
 * at most two mbufs.  The second mbuf in this chain is likely
 * to be a cluster.  The primary purpose of this work is to create
 * a writable packet for encryption, compression, etc.  The
 * secondary goal is to linearize the data so the data can be
 * passed to crypto hardware in the most efficient manner possible.
 */
struct mbuf *
m_unshare(struct mbuf *m0, int how)
{
	struct mbuf *m, *mprev;
	struct mbuf *n, *mfirst, *mlast;
	int len, off;

	mprev = NULL;
	for (m = m0; m != NULL; m = mprev->m_next) {
		/*
		 * Regular mbufs are ignored unless there's a cluster
		 * in front of it that we can use to coalesce.  We do
		 * the latter mainly so later clusters can be coalesced
		 * also w/o having to handle them specially (i.e. convert
		 * mbuf+cluster -> cluster).  This optimization is heavily
		 * influenced by the assumption that we're running over
		 * Ethernet where MCLBYTES is large enough that the max
		 * packet size will permit lots of coalescing into a
		 * single cluster.  This in turn permits efficient
		 * crypto operations, especially when using hardware.
		 */
		if ((m->m_flags & M_EXT) == 0) {
			if (mprev != NULL && (mprev->m_flags & M_EXT) &&
			    m->m_len <= M_TRAILINGSPACE(mprev)) {
				/* XXX: this ignores mbuf types */
				memcpy(mtod(mprev, caddr_t) + mprev->m_len,
				       mtod(m, caddr_t), m->m_len);
				mprev->m_len += m->m_len;
				/* unlink from chain and reclaim */
				mprev->m_next = m->m_next;
				m_free(m);
			} else {
				mprev = m;
			}
			continue;
		}
		/*
		 * Writable mbufs are left alone (for now).
		 */
		if (M_WRITABLE(m)) {
			mprev = m;
			continue;
		}

		/*
		 * Not writable, replace with a copy or coalesce with
		 * the previous mbuf if possible (since we have to copy
		 * it anyway, we try to reduce the number of mbufs and
		 * clusters so that future work is easier).
		 */
		KASSERT(m->m_flags & M_EXT, ("m_flags 0x%x", m->m_flags));
		/* NB: we only coalesce into a cluster or larger */
		if (mprev != NULL && (mprev->m_flags & M_EXT) &&
		    m->m_len <= M_TRAILINGSPACE(mprev)) {
			/* XXX: this ignores mbuf types */
			memcpy(mtod(mprev, caddr_t) + mprev->m_len,
			       mtod(m, caddr_t), m->m_len);
			mprev->m_len += m->m_len;
			/* unlink from chain and reclaim */
			mprev->m_next = m->m_next;
			m_free(m);
			continue;
		}

		/*
		 * Allocate new space to hold the copy...
		 */
		/* XXX why can M_PKTHDR be set past the first mbuf? */
		if (mprev == NULL && (m->m_flags & M_PKTHDR)) {
			/*
			 * NB: if a packet header is present we must
			 * allocate the mbuf separately from any cluster
			 * because M_MOVE_PKTHDR will smash the data
			 * pointer and drop the M_EXT marker.
			 */
			MGETHDR(n, how, m->m_type);
			if (n == NULL) {
				m_freem(m0);
				return (NULL);
			}
			M_MOVE_PKTHDR(n, m);
			MCLGET(n, how);
			if ((n->m_flags & M_EXT) == 0) {
				m_free(n);
				m_freem(m0);
				return (NULL);
			}
		} else {
			n = m_getcl(how, m->m_type, m->m_flags);
			if (n == NULL) {
				m_freem(m0);
				return (NULL);
			}
		}
		/*
		 * ... and copy the data.  We deal with jumbo mbufs
		 * (i.e. m_len > MCLBYTES) by splitting them into
		 * clusters.  We could just malloc a buffer and make
		 * it external but too many device drivers don't know
		 * how to break up the non-contiguous memory when
		 * doing DMA.
		 */
		len = m->m_len;
		off = 0;
		mfirst = n;
		mlast = NULL;
		for (;;) {
			int cc = min(len, MCLBYTES);
			memcpy(mtod(n, caddr_t), mtod(m, caddr_t) + off, cc);
			n->m_len = cc;
			if (mlast != NULL)
				mlast->m_next = n;
			mlast = n;

			len -= cc;
			if (len <= 0)
				break;
			off += cc;

			n = m_getcl(how, m->m_type, m->m_flags);
			if (n == NULL) {
				m_freem(mfirst);
				m_freem(m0);
				return (NULL);
			}
		}
		n->m_next = m->m_next;
		if (mprev == NULL)
			m0 = mfirst;		/* new head of chain */
		else
			mprev->m_next = mfirst;	/* replace old mbuf */
		m_free(m);			/* release old mbuf */
		mprev = mfirst;
	}
	return (m0);
}

/*
 * Rearrange an mbuf chain so that len bytes are contiguous
 * and in the data area of an mbuf (so that mtod will work for a structure
 * of size len).  Returns the resulting mbuf chain on success, frees it and
 * returns null on failure.  If there is room, it will add up to
 * max_protohdr-len extra bytes to the contiguous region in an attempt to
 * avoid being called next time.
 */
struct mbuf *
m_pullup(struct mbuf *n, int len)
{
	struct mbuf *m;
	int count;
	int space;

	/*
	 * If first mbuf has no cluster, and has room for len bytes
	 * without shifting current data, pullup into it,
	 * otherwise allocate a new mbuf to prepend to the chain.
	 */
	if (!(n->m_flags & M_EXT) &&
	    n->m_data + len < &n->m_dat[MLEN] &&
	    n->m_next) {
		if (n->m_len >= len)
			return (n);
		m = n;
		n = n->m_next;
		len -= m->m_len;
	} else {
		if (len > MHLEN)
			goto bad;
		if (n->m_flags & M_PKTHDR)
			m = m_gethdr(M_NOWAIT, n->m_type);
		else
			m = m_get(M_NOWAIT, n->m_type);
		if (m == NULL)
			goto bad;
		m->m_len = 0;
		if (n->m_flags & M_PKTHDR)
			M_MOVE_PKTHDR(m, n);
	}
	space = &m->m_dat[MLEN] - (m->m_data + m->m_len);
	do {
		count = min(min(max(len, max_protohdr), space), n->m_len);
		bcopy(mtod(n, caddr_t), mtod(m, caddr_t) + m->m_len, count);
		len -= count;
		m->m_len += count;
		n->m_len -= count;
		space -= count;
		if (n->m_len)
			n->m_data += count;
		else
			n = m_free(n);
	} while (len > 0 && n);
	if (len > 0) {
		m_free(m);
		goto bad;
	}
	m->m_next = n;
	return (m);
bad:
	m_freem(n);
	++mbstat[mycpu->gd_cpuid].m_mcfail;
	return (NULL);
}

/*
 * Partition an mbuf chain in two pieces, returning the tail --
 * all but the first len0 bytes.  In case of failure, it returns NULL and
 * attempts to restore the chain to its original state.
 *
 * Note that the resulting mbufs might be read-only, because the new
 * mbuf can end up sharing an mbuf cluster with the original mbuf if
 * the "breaking point" happens to lie within a cluster mbuf. Use the
 * M_WRITABLE() macro to check for this case.
 */
struct mbuf *
m_split(struct mbuf *m0, int len0, int wait)
{
	struct mbuf *m, *n;
	unsigned len = len0, remain;

	for (m = m0; m && len > m->m_len; m = m->m_next)
		len -= m->m_len;
	if (m == NULL)
		return (NULL);
	remain = m->m_len - len;
	if (m0->m_flags & M_PKTHDR) {
		n = m_gethdr(wait, m0->m_type);
		if (n == NULL)
			return (NULL);
		n->m_pkthdr.rcvif = m0->m_pkthdr.rcvif;
		n->m_pkthdr.len = m0->m_pkthdr.len - len0;
		m0->m_pkthdr.len = len0;
		if (m->m_flags & M_EXT)
			goto extpacket;
		if (remain > MHLEN) {
			/* m can't be the lead packet */
			MH_ALIGN(n, 0);
			n->m_next = m_split(m, len, wait);
			if (n->m_next == NULL) {
				m_free(n);
				return (NULL);
			} else {
				n->m_len = 0;
				return (n);
			}
		} else
			MH_ALIGN(n, remain);
	} else if (remain == 0) {
		n = m->m_next;
		m->m_next = NULL;
		return (n);
	} else {
		n = m_get(wait, m->m_type);
		if (n == NULL)
			return (NULL);
		M_ALIGN(n, remain);
	}
extpacket:
	if (m->m_flags & M_EXT) {
		KKASSERT((n->m_flags & M_EXT) == 0);
		n->m_data = m->m_data + len;
		m->m_ext.ext_ref(m->m_ext.ext_arg);
		n->m_ext = m->m_ext;
		n->m_flags |= m->m_flags & (M_EXT | M_EXT_CLUSTER);
	} else {
		bcopy(mtod(m, caddr_t) + len, mtod(n, caddr_t), remain);
	}
	n->m_len = remain;
	m->m_len = len;
	n->m_next = m->m_next;
	m->m_next = NULL;
	return (n);
}

/*
 * Routine to copy from device local memory into mbufs.
 * Note: "offset" is ill-defined and always called as 0, so ignore it.
 */
struct mbuf *
m_devget(void *_buf, int len, int offset __unused, struct ifnet *ifp)
{
	struct mbuf *m, *mfirst = NULL, **mtail;
	caddr_t buf = _buf;
	int nsize, flags;

	KKASSERT(offset == 0);
	mtail = &mfirst;
	flags = M_PKTHDR;

	while (len > 0) {
		m = m_getl(len, M_NOWAIT, MT_DATA, flags, &nsize);
		if (m == NULL) {
			m_freem(mfirst);
			return (NULL);
		}
		m->m_len = min(len, nsize);

		if (flags & M_PKTHDR) {
			if (len + max_linkhdr <= nsize)
				m->m_data += max_linkhdr;
			m->m_pkthdr.rcvif = ifp;
			m->m_pkthdr.len = len;
			flags = 0;
		}

		bcopy(buf, m->m_data, m->m_len);
		buf += m->m_len;
		len -= m->m_len;
		*mtail = m;
		mtail = &m->m_next;
	}

	return (mfirst);
}

/*
 * Routine to pad mbuf to the specified length 'padto'.
 */
int
m_devpad(struct mbuf *m, int padto)
{
	struct mbuf *last = NULL;
	int padlen;

	if (padto <= m->m_pkthdr.len)
		return 0;

	padlen = padto - m->m_pkthdr.len;

	/* if there's only the packet-header and we can pad there, use it. */
	if (m->m_pkthdr.len == m->m_len && M_TRAILINGSPACE(m) >= padlen) {
		last = m;
	} else {
		/*
		 * Walk packet chain to find last mbuf. We will either
		 * pad there, or append a new mbuf and pad it
		 */
		for (last = m; last->m_next != NULL; last = last->m_next)
			; /* EMPTY */

		/* `last' now points to last in chain. */
		if (M_TRAILINGSPACE(last) < padlen) {
			struct mbuf *n;

			/* Allocate new empty mbuf, pad it.  Compact later. */
			MGET(n, M_NOWAIT, MT_DATA);
			if (n == NULL)
				return ENOBUFS;
			n->m_len = 0;
			last->m_next = n;
			last = n;
		}
	}
	KKASSERT(M_TRAILINGSPACE(last) >= padlen);
	KKASSERT(M_WRITABLE(last));

	/* Now zero the pad area */
	bzero(mtod(last, caddr_t) + last->m_len, padlen);
	last->m_len += padlen;
	m->m_pkthdr.len += padlen;
	return 0;
}

/*
 * Copy data from a buffer back into the indicated mbuf chain,
 * starting "off" bytes from the beginning, extending the mbuf
 * chain if necessary.
 *
 * Note that m0->m_len may be 0 (e.g., a newly allocated mbuf).
 */
static __inline int
_m_copyback2(struct mbuf *m0, int off, int len, const void *_cp, int how,
	     boolean_t allow_alloc)
{
	struct mbuf *m = m0, *n;
	c_caddr_t cp = _cp;
	int mlen, tlen, nsize, totlen = 0, error = ENOBUFS;

	KASSERT(off >= 0, ("%s: negative off %d", __func__, off));
	KASSERT(len >= 0, ("%s: negative len %d", __func__, len));

	if (m0 == NULL)
		return (0);

	while (off > m->m_len) {
		if (m->m_next == NULL && (tlen = M_TRAILINGSPACE(m)) > 0) {
			/* Use the trailing space of the last mbuf. */
			mlen = min(off - m->m_len, tlen);
			bzero(mtod(m, caddr_t) + m->m_len, mlen);
			m->m_len += mlen;
		}
		off -= m->m_len;
		totlen += m->m_len;
		if (m->m_next == NULL) {
			if (!allow_alloc)
				goto out;
			n = m_getl(off + len, how, m->m_type, 0, &nsize);
			if (n == NULL)
				goto out;
			n->m_len = min(nsize, off + len);
			bzero(mtod(n, void *), n->m_len);
			m->m_next = n;
		}
		m = m->m_next;
	}
	while (len > 0) {
		if (m->m_next == NULL &&
		    m->m_len < off + len &&
		    (tlen = M_TRAILINGSPACE(m)) > 0) {
			/* Use the trailing space of the last mbuf. */
			m->m_len += min(off + len - m->m_len, tlen);
		}
		mlen = min(m->m_len - off, len);
		bcopy(cp, mtod(m, caddr_t) + off, mlen);
		off = 0;
		cp += mlen;
		len -= mlen;
		totlen += mlen + off;
		if (len == 0)
			break;
		if (m->m_next == NULL) {
			if (!allow_alloc)
				goto out;
			n = m_getl(len, how, m->m_type, 0, &nsize);
			if (n == NULL)
				goto out;
			n->m_len = min(nsize, len);
			m->m_next = n;
		}
		m = m->m_next;
	}
	error = 0;

out:
	if ((m0->m_flags & M_PKTHDR) && (m0->m_pkthdr.len < totlen))
		m0->m_pkthdr.len = totlen;

	return (error);
}

int
m_copyback2(struct mbuf *m0, int off, int len, const void *cp, int how)
{
	return _m_copyback2(m0, off, len, cp, how, TRUE);
}

/*
 * Similar to m_copyback2() but forbid mbuf expansion.  The caller must
 * ensure that the mbuf (chain) is big enough; otherwise, the copyback
 * would fail with diagnostics printed to the console.
 */
void
m_copyback(struct mbuf *m0, int off, int len, const void *cp)
{
	if (_m_copyback2(m0, off, len, cp, 0, FALSE) != 0) {
		kprintf("%s: unexpected mbuf expansion required, "
			"code path needs to be fixed:\n", __func__);
		print_backtrace(8);
	}
}

/*
 * Append the specified data to the indicated mbuf chain,
 * Extend the mbuf chain if the new data does not fit in
 * existing space.
 *
 * Return 1 if able to complete the job; otherwise 0.
 */
int
m_append(struct mbuf *m0, int len, const void *_cp)
{
	struct mbuf *m, *n;
	c_caddr_t cp = _cp;
	int remainder, space;

	for (m = m0; m->m_next != NULL; m = m->m_next)
		;
	remainder = len;
	space = M_TRAILINGSPACE(m);
	if (space > 0) {
		/*
		 * Copy into available space.
		 */
		if (space > remainder)
			space = remainder;
		bcopy(cp, mtod(m, caddr_t) + m->m_len, space);
		m->m_len += space;
		cp += space, remainder -= space;
	}
	while (remainder > 0) {
		/*
		 * Allocate a new mbuf; could check space
		 * and allocate a cluster instead.
		 */
		n = m_get(M_NOWAIT, m->m_type);
		if (n == NULL)
			break;
		n->m_len = min(MLEN, remainder);
		bcopy(cp, mtod(n, caddr_t), n->m_len);
		cp += n->m_len, remainder -= n->m_len;
		m->m_next = n;
		m = n;
	}
	if (m0->m_flags & M_PKTHDR)
		m0->m_pkthdr.len += len - remainder;
	return (remainder == 0);
}

/*
 * Apply function f to the data in an mbuf chain starting "off" bytes from
 * the beginning, continuing for "len" bytes.
 */
int
m_apply(struct mbuf *m, int off, int len,
	int (*f)(void *, void *, u_int), void *arg)
{
	u_int count;
	int rval;

	KASSERT(off >= 0, ("%s: negative off %d", __func__, off));
	KASSERT(len >= 0, ("%s: negative len %d", __func__, len));
	while (off > 0) {
		KASSERT(m != NULL,
			("%s: offset > size of mbuf chain", __func__));
		if (off < m->m_len)
			break;
		off -= m->m_len;
		m = m->m_next;
	}
	while (len > 0) {
		KASSERT(m != NULL,
			("%s: offset > size of mbuf chain", __func__));
		count = min(m->m_len - off, len);
		rval = (*f)(arg, mtod(m, caddr_t) + off, count);
		if (rval)
			return (rval);
		len -= count;
		off = 0;
		m = m->m_next;
	}
	return (0);
}

/*
 * Return a pointer to mbuf/offset of location in mbuf chain.
 */
struct mbuf *
m_getptr(struct mbuf *m, int loc, int *off)
{
	while (loc >= 0) {
		/* Normal end of search. */
		if (m->m_len > loc) {
			*off = loc;
			return (m);
		} else {
			loc -= m->m_len;
			if (m->m_next == NULL) {
				if (loc == 0) {
					/* Point at the end of valid data. */
					*off = m->m_len;
					return (m);
				}
				return (NULL);
			}
			m = m->m_next;
		}
	}
	return (NULL);
}

void
m_print(const struct mbuf *m)
{
	int len;
	const struct mbuf *m2;
	char *hexstr;

	len = m->m_pkthdr.len;
	m2 = m;
	hexstr = kmalloc(HEX_NCPYLEN(len), M_TEMP, M_ZERO | M_WAITOK);
	while (len) {
		kprintf("%p %s\n", m2, hexncpy(m2->m_data, m2->m_len, hexstr,
			HEX_NCPYLEN(m2->m_len), "-"));
		len -= m2->m_len;
		m2 = m2->m_next;
	}
	kfree(hexstr, M_TEMP);
	return;
}

/*
 * "Move" mbuf pkthdr from "from" to "to".
 * "from" must have M_PKTHDR set, and "to" must be empty.
 */
void
m_move_pkthdr(struct mbuf *to, struct mbuf *from)
{
	KASSERT((to->m_flags & M_PKTHDR), ("%s: not packet header", __func__));

	to->m_flags |= from->m_flags & M_COPYFLAGS;
	to->m_pkthdr = from->m_pkthdr;		/* especially tags */
	SLIST_INIT(&from->m_pkthdr.tags);	/* purge tags from src */
}

/*
 * Duplicate "from"'s mbuf pkthdr in "to".
 * "from" must have M_PKTHDR set, and "to" must be empty.
 * In particular, this does a deep copy of the packet tags.
 */
int
m_dup_pkthdr(struct mbuf *to, const struct mbuf *from, int how)
{
	KASSERT((to->m_flags & M_PKTHDR), ("%s: not packet header", __func__));

	to->m_flags = (from->m_flags & M_COPYFLAGS) |
		      (to->m_flags & ~M_COPYFLAGS);
	to->m_pkthdr = from->m_pkthdr;
	SLIST_INIT(&to->m_pkthdr.tags);
	return (m_tag_copy_chain(to, from, how));
}

/*
 * Defragment a mbuf chain, returning the shortest possible
 * chain of mbufs and clusters.  If allocation fails and
 * this cannot be completed, NULL will be returned, but
 * the passed in chain will be unchanged.  Upon success,
 * the original chain will be freed, and the new chain
 * will be returned.
 *
 * If a non-packet header is passed in, the original
 * mbuf (chain?) will be returned unharmed.
 *
 * m_defrag_nofree doesn't free the passed in mbuf.
 */
struct mbuf *
m_defrag(struct mbuf *m0, int how)
{
	struct mbuf *m_new;

	if ((m_new = m_defrag_nofree(m0, how)) == NULL)
		return (NULL);
	if (m_new != m0)
		m_freem(m0);
	return (m_new);
}

struct mbuf *
m_defrag_nofree(struct mbuf *m0, int how)
{
	struct mbuf	*m_new = NULL, *m_final = NULL;
	int		progress = 0, length, nsize;

	if (!(m0->m_flags & M_PKTHDR))
		return (m0);

#ifdef MBUF_STRESS_TEST
	if (m_defragrandomfailures) {
		int temp = karc4random() & 0xff;
		if (temp == 0xba)
			goto nospace;
	}
#endif

	m_final = m_getl(m0->m_pkthdr.len, how, MT_DATA, M_PKTHDR, &nsize);
	if (m_final == NULL)
		goto nospace;
	m_final->m_len = 0;	/* in case m0->m_pkthdr.len is zero */

	if (m_dup_pkthdr(m_final, m0, how) == 0)
		goto nospace;

	m_new = m_final;

	while (progress < m0->m_pkthdr.len) {
		length = m0->m_pkthdr.len - progress;
		if (length > MCLBYTES)
			length = MCLBYTES;

		if (m_new == NULL) {
			m_new = m_getl(length, how, MT_DATA, 0, &nsize);
			if (m_new == NULL)
				goto nospace;
		}

		m_copydata(m0, progress, length, mtod(m_new, void *));
		progress += length;
		m_new->m_len = length;
		if (m_new != m_final)
			m_cat(m_final, m_new);
		m_new = NULL;
	}
	if (m0->m_next == NULL)
		m_defraguseless++;
	m_defragpackets++;
	m_defragbytes += m_final->m_pkthdr.len;
	return (m_final);
nospace:
	m_defragfailure++;
	if (m_new)
		m_free(m_new);
	m_freem(m_final);
	return (NULL);
}

/*
 * Move data from uio into mbufs.
 */
struct mbuf *
m_uiomove(struct uio *uio)
{
	struct mbuf *m;			/* current working mbuf */
	struct mbuf *head = NULL;	/* result mbuf chain */
	struct mbuf **mp = &head;
	int flags = M_PKTHDR;
	int nsize;
	int error;
	int resid;

	do {
		if (uio->uio_resid > INT_MAX)
			resid = INT_MAX;
		else
			resid = (int)uio->uio_resid;
		m = m_getl(resid, M_WAITOK, MT_DATA, flags, &nsize);
		if (flags) {
			m->m_pkthdr.len = 0;
			/* Leave room for protocol headers. */
			if (resid < MHLEN)
				MH_ALIGN(m, resid);
			flags = 0;
		}
		m->m_len = imin(nsize, resid);
		error = uiomove(mtod(m, caddr_t), m->m_len, uio);
		if (error) {
			m_free(m);
			goto failed;
		}
		*mp = m;
		mp = &m->m_next;
		head->m_pkthdr.len += m->m_len;
	} while (uio->uio_resid > 0);

	return (head);

failed:
	m_freem(head);
	return (NULL);
}

struct mbuf *
m_last(struct mbuf *m)
{
	while (m->m_next)
		m = m->m_next;
	return (m);
}

/*
 * Return the number of bytes in an mbuf chain.
 * If lastm is not NULL, also return the last mbuf.
 */
u_int
m_lengthm(struct mbuf *m, struct mbuf **lastm)
{
	u_int len = 0;
	struct mbuf *prev = m;

	while (m) {
		len += m->m_len;
		prev = m;
		m = m->m_next;
	}
	if (lastm != NULL)
		*lastm = prev;
	return (len);
}

/*
 * Like m_lengthm(), except also keep track of mbuf usage.
 */
u_int
m_countm(struct mbuf *m, struct mbuf **lastm, u_int *pmbcnt)
{
	u_int len = 0, mbcnt = 0;
	struct mbuf *prev = m;

	while (m) {
		len += m->m_len;
		mbcnt += MSIZE;
		if (m->m_flags & M_EXT)
			mbcnt += m->m_ext.ext_size;
		prev = m;
		m = m->m_next;
	}
	if (lastm != NULL)
		*lastm = prev;
	*pmbcnt = mbcnt;
	return (len);
}