a) macro-ization of all mbuf and random number

   access plus timers. This makes the code
   more portable and able to change out the
   mbuf or timer system used more easily ;-)
b) removal of all use of pkt-hdr's until only
   the places we need them (before ip_output routines).
c) remove a bunch of code not needed due to <b> aka
   worrying about pkthdr's :-)
d) There was one last reorder problem it looks where
   if a restart occur's and we release and relock (at
   the point where we setup our alias vtag) we would
   end up possibly getting the wrong TSN in place. The
   code that fixed the TSN's just needed to be shifted
   around BEFORE the release of the lock.. also code that
   set the state (since this also could contribute).
Approved by:	gnn

1 files changed, 182 insertions, 228 deletions

diff --git a/sys/netinet/sctputil.c b/sys/netinet/sctputil.c
index 18fe59d..6882cee 100644
--- a/sys/netinet/sctputil.c
+++ b/sys/netinet/sctputil.c
@@ -63,8 +63,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/uio.h>
 #include <sys/jail.h>
 
-#include <sys/callout.h>
-
 #include <net/radix.h>
 #include <net/route.h>
 
@@ -300,12 +298,12 @@ sctp_log_mb(struct mbuf *m, int from)
 	sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 	sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_MBUF;
 	sctp_clog[sctp_cwnd_log_at].x.mb.mp = m;
-	sctp_clog[sctp_cwnd_log_at].x.mb.mbuf_flags = (uint8_t) (m->m_flags);
-	sctp_clog[sctp_cwnd_log_at].x.mb.size = (uint16_t) (m->m_len);
-	sctp_clog[sctp_cwnd_log_at].x.mb.data = m->m_data;
-	if (m->m_flags & M_EXT) {
-		sctp_clog[sctp_cwnd_log_at].x.mb.ext = m->m_ext.ext_buf;
-		sctp_clog[sctp_cwnd_log_at].x.mb.refcnt = (uint8_t) (*m->m_ext.ref_cnt);
+	sctp_clog[sctp_cwnd_log_at].x.mb.mbuf_flags = (uint8_t) (SCTP_BUF_GET_FLAGS(m));
+	sctp_clog[sctp_cwnd_log_at].x.mb.size = (uint16_t) (SCTP_BUF_LEN(m));
+	sctp_clog[sctp_cwnd_log_at].x.mb.data = SCTP_BUF_AT(m, 0);
+	if (SCTP_BUF_IS_EXTENDED(m)) {
+		sctp_clog[sctp_cwnd_log_at].x.mb.ext = SCTP_BUF_EXTEND_BASE(m);
+		sctp_clog[sctp_cwnd_log_at].x.mb.refcnt = (uint8_t) (SCTP_BUF_EXTEND_REFCNT(m));
 	} else {
 		sctp_clog[sctp_cwnd_log_at].x.mb.ext = 0;
 		sctp_clog[sctp_cwnd_log_at].x.mb.refcnt = 0;
@@ -567,7 +565,7 @@ sctp_fill_stat_log(struct mbuf *m)
 	if (m == NULL)
 		return (EINVAL);
 
-	size_limit = (m->m_len - sizeof(struct sctp_cwnd_log_req));
+	size_limit = (SCTP_BUF_LEN(m) - sizeof(struct sctp_cwnd_log_req));
 	if (size_limit < sizeof(struct sctp_cwnd_log)) {
 		return (EINVAL);
 	}
@@ -637,7 +635,7 @@ sctp_fill_stat_log(struct mbuf *m)
 		if (at >= SCTP_STAT_LOG_SIZE)
 			at = 0;
 	}
-	m->m_len = (cnt_out * sizeof(struct sctp_cwnd_log)) + sizeof(struct sctp_cwnd_log_req);
+	SCTP_BUF_LEN(m) = (cnt_out * sizeof(struct sctp_cwnd_log)) + sizeof(struct sctp_cwnd_log_req);
 	return (0);
 }
 
@@ -875,15 +873,15 @@ sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb)
 
 	asoc = &stcb->asoc;
 
-	callout_stop(&asoc->hb_timer.timer);
-	callout_stop(&asoc->dack_timer.timer);
-	callout_stop(&asoc->strreset_timer.timer);
-	callout_stop(&asoc->asconf_timer.timer);
-	callout_stop(&asoc->autoclose_timer.timer);
-	callout_stop(&asoc->delayed_event_timer.timer);
+	SCTP_OS_TIMER_STOP(&asoc->hb_timer.timer);
+	SCTP_OS_TIMER_STOP(&asoc->dack_timer.timer);
+	SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
+	SCTP_OS_TIMER_STOP(&asoc->asconf_timer.timer);
+	SCTP_OS_TIMER_STOP(&asoc->autoclose_timer.timer);
+	SCTP_OS_TIMER_STOP(&asoc->delayed_event_timer.timer);
 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
-		callout_stop(&net->fr_timer.timer);
-		callout_stop(&net->pmtu_timer.timer);
+		SCTP_OS_TIMER_STOP(&net->fr_timer.timer);
+		SCTP_OS_TIMER_STOP(&net->pmtu_timer.timer);
 	}
 }
 
@@ -935,7 +933,7 @@ sctp_select_initial_TSN(struct sctp_pcb *m)
 	 * the initial stream sequence number, using RFC1750 as a good
 	 * guideline
 	 */
-	u_long x, *xp;
+	uint32_t x, *xp;
 	uint8_t *p;
 
 	if (m->initial_sequence_debug != 0) {
@@ -950,9 +948,9 @@ sctp_select_initial_TSN(struct sctp_pcb *m)
 		sctp_fill_random_store(m);
 	}
 	p = &m->random_store[(int)m->store_at];
-	xp = (u_long *)p;
+	xp = (uint32_t *) p;
 	x = *xp;
-	m->store_at += sizeof(u_long);
+	m->store_at += sizeof(uint32_t);
 	return (x);
 }
 
@@ -1015,6 +1013,7 @@ sctp_init_asoc(struct sctp_inpcb *m, struct sctp_association *asoc,
 	if (override_tag) {
 		struct timeval now;
 
+		SCTP_GETTIME_TIMEVAL(&now);
 		if (sctp_is_vtag_good(m, override_tag, &now)) {
 			asoc->my_vtag = override_tag;
 		} else {
@@ -1319,7 +1318,7 @@ sctp_timeout_handler(void *t)
 		printf("Timer type %d goes off\n", tmr->type);
 	}
 #endif				/* SCTP_DEBUG */
-	if (!callout_active(&tmr->timer)) {
+	if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
 		splx(s);
 		if (inp) {
 			SCTP_INP_DECR_REF(inp);
@@ -1336,7 +1335,7 @@ sctp_timeout_handler(void *t)
 		atomic_add_int(&stcb->asoc.refcnt, -1);
 	}
 	/* mark as being serviced now */
-	callout_deactivate(&tmr->timer);
+	SCTP_OS_TIMER_DEACTIVATE(&tmr->timer);
 
 	/* call the handler for the appropriate timer type */
 	switch (tmr->type) {
@@ -1602,9 +1601,7 @@ sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 	int to_ticks;
 	struct sctp_timer *tmr;
 
-
-	if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) &&
-	    (inp == NULL))
+	if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL))
 		return (EFAULT);
 
 	to_ticks = 0;
@@ -1929,7 +1926,7 @@ sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 #endif				/* SCTP_DEBUG */
 		return (EFAULT);
 	}
-	if (callout_pending(&tmr->timer)) {
+	if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
 		/*
 		 * we do NOT allow you to have it already running. if it is
 		 * we leave the current one up unchanged
@@ -1947,7 +1944,7 @@ sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 	tmr->net = (void *)net;
 	tmr->self = (void *)tmr;
 	tmr->ticks = ticks;
-	callout_reset(&tmr->timer, to_ticks, sctp_timeout_handler, tmr);
+	SCTP_OS_TIMER_START(&tmr->timer, to_ticks, sctp_timeout_handler, tmr);
 	return (0);
 }
 
@@ -2111,7 +2108,7 @@ sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 	}
 	tmr->self = NULL;
 	tmr->stopped_from = from;
-	callout_stop(&tmr->timer);
+	SCTP_OS_TIMER_STOP(&tmr->timer);
 	return (0);
 }
 
@@ -2165,8 +2162,8 @@ sctp_calculate_len(struct mbuf *m)
 
 	at = m;
 	while (at) {
-		tlen += at->m_len;
-		at = at->m_next;
+		tlen += SCTP_BUF_LEN(at);
+		at = SCTP_BUF_NEXT(at);
 	}
 	return (tlen);
 }
@@ -2179,11 +2176,11 @@ sctp_calculate_sum(struct mbuf *m, int32_t * pktlen, uint32_t offset)
 	/*
 	 * given a mbuf chain with a packetheader offset by 'offset'
 	 * pointing at a sctphdr (with csum set to 0) go through the chain
-	 * of m_next's and calculate the SCTP checksum. This is currently
-	 * Adler32 but will change to CRC32x soon. Also has a side bonus
-	 * calculate the total length of the mbuf chain. Note: if offset is
-	 * greater than the total mbuf length, checksum=1, pktlen=0 is
-	 * returned (ie. no real error code)
+	 * of SCTP_BUF_NEXT()'s and calculate the SCTP checksum. This is
+	 * currently Adler32 but will change to CRC32x soon. Also has a side
+	 * bonus calculate the total length of the mbuf chain. Note: if
+	 * offset is greater than the total mbuf length, checksum=1,
+	 * pktlen=0 is returned (ie. no real error code)
 	 */
 	if (pktlen == NULL)
 		return (0);
@@ -2201,11 +2198,11 @@ sctp_calculate_sum(struct mbuf *m, int32_t * pktlen, uint32_t offset)
 	/*
 	 * given a mbuf chain with a packetheader offset by 'offset'
 	 * pointing at a sctphdr (with csum set to 0) go through the chain
-	 * of m_next's and calculate the SCTP checksum. This is currently
-	 * Adler32 but will change to CRC32x soon. Also has a side bonus
-	 * calculate the total length of the mbuf chain. Note: if offset is
-	 * greater than the total mbuf length, checksum=1, pktlen=0 is
-	 * returned (ie. no real error code)
+	 * of SCTP_BUF_NEXT()'s and calculate the SCTP checksum. This is
+	 * currently Adler32 but will change to CRC32x soon. Also has a side
+	 * bonus calculate the total length of the mbuf chain. Note: if
+	 * offset is greater than the total mbuf length, checksum=1,
+	 * pktlen=0 is returned (ie. no real error code)
 	 */
 	int32_t tlen = 0;
 	struct mbuf *at;
@@ -2213,8 +2210,8 @@ sctp_calculate_sum(struct mbuf *m, int32_t * pktlen, uint32_t offset)
 
 	at = m;
 	while (at) {
-		tlen += at->m_len;
-		at = at->m_next;
+		tlen += SCTP_BUF_LEN(at);
+		at = SCTP_BUF_NEXT(at);
 	}
 	the_sum = (uint32_t) (in_cksum_skip(m, tlen, offset));
 	if (pktlen != NULL)
@@ -2231,11 +2228,11 @@ sctp_calculate_sum(struct mbuf *m, int32_t * pktlen, uint32_t offset)
 	/*
 	 * given a mbuf chain with a packetheader offset by 'offset'
 	 * pointing at a sctphdr (with csum set to 0) go through the chain
-	 * of m_next's and calculate the SCTP checksum. This is currently
-	 * Adler32 but will change to CRC32x soon. Also has a side bonus
-	 * calculate the total length of the mbuf chain. Note: if offset is
-	 * greater than the total mbuf length, checksum=1, pktlen=0 is
-	 * returned (ie. no real error code)
+	 * of SCTP_BUF_NEXT()'s and calculate the SCTP checksum. This is
+	 * currently Adler32 but will change to CRC32x soon. Also has a side
+	 * bonus calculate the total length of the mbuf chain. Note: if
+	 * offset is greater than the total mbuf length, checksum=1,
+	 * pktlen=0 is returned (ie. no real error code)
 	 */
 	int32_t tlen = 0;
 
@@ -2250,38 +2247,39 @@ sctp_calculate_sum(struct mbuf *m, int32_t * pktlen, uint32_t offset)
 
 	at = m;
 	/* find the correct mbuf and offset into mbuf */
-	while ((at != NULL) && (offset > (uint32_t) at->m_len)) {
-		offset -= at->m_len;	/* update remaining offset left */
-		at = at->m_next;
+	while ((at != NULL) && (offset > (uint32_t) SCTP_BUF_LEN(at))) {
+		offset -= SCTP_BUF_LEN(at);	/* update remaining offset
+						 * left */
+		at = SCTP_BUF_NEXT(at);
 	}
 	while (at != NULL) {
-		if ((at->m_len - offset) > 0) {
+		if ((SCTP_BUF_LEN(at) - offset) > 0) {
 #ifdef SCTP_USE_ADLER32
 			base = update_adler32(base,
-			    (unsigned char *)(at->m_data + offset),
-			    (unsigned int)(at->m_len - offset));
+			    (unsigned char *)(SCTP_BUF_AT(at, offset)),
+			    (unsigned int)(SCTP_BUF_LEN(at) - offset));
 #else
-			if ((at->m_len - offset) < 4) {
+			if ((SCTP_BUF_LEN(at) - offset) < 4) {
 				/* Use old method if less than 4 bytes */
 				base = old_update_crc32(base,
-				    (unsigned char *)(at->m_data + offset),
-				    (unsigned int)(at->m_len - offset));
+				    (unsigned char *)(SCTP_BUF_AT(at, offset)),
+				    (unsigned int)(SCTP_BUF_LEN(at) - offset));
 			} else {
 				base = update_crc32(base,
-				    (unsigned char *)(at->m_data + offset),
-				    (unsigned int)(at->m_len - offset));
+				    (unsigned char *)(SCTP_BUF_AT(at, offset)),
+				    (unsigned int)(SCTP_BUF_LEN(at) - offset));
 			}
 #endif				/* SCTP_USE_ADLER32 */
-			tlen += at->m_len - offset;
+			tlen += SCTP_BUF_LEN(at) - offset;
 			/* we only offset once into the first mbuf */
 		}
 		if (offset) {
-			if (offset < at->m_len)
+			if (offset < SCTP_BUF_LEN(at))
 				offset = 0;
 			else
-				offset -= at->m_len;
+				offset -= SCTP_BUF_LEN(at);
 		}
-		at = at->m_next;
+		at = SCTP_BUF_NEXT(at);
 	}
 	if (pktlen != NULL) {
 		*pktlen = tlen;
@@ -2471,26 +2469,26 @@ sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t * in_ptr)
 
 	/* find the desired start location */
 	while ((m != NULL) && (off > 0)) {
-		if (off < m->m_len)
+		if (off < SCTP_BUF_LEN(m))
 			break;
-		off -= m->m_len;
-		m = m->m_next;
+		off -= SCTP_BUF_LEN(m);
+		m = SCTP_BUF_NEXT(m);
 	}
 	if (m == NULL)
 		return (NULL);
 
 	/* is the current mbuf large enough (eg. contiguous)? */
-	if ((m->m_len - off) >= len) {
+	if ((SCTP_BUF_LEN(m) - off) >= len) {
 		return (mtod(m, caddr_t)+off);
 	} else {
 		/* else, it spans more than one mbuf, so save a temp copy... */
 		while ((m != NULL) && (len > 0)) {
-			count = min(m->m_len - off, len);
+			count = min(SCTP_BUF_LEN(m) - off, len);
 			bcopy(mtod(m, caddr_t)+off, ptr, count);
 			len -= count;
 			ptr += count;
 			off = 0;
-			m = m->m_next;
+			m = SCTP_BUF_NEXT(m);
 		}
 		if ((m == NULL) && (len > 0))
 			return (NULL);
@@ -2530,8 +2528,8 @@ sctp_add_pad_tombuf(struct mbuf *m, int padlen)
 		 * The easy way. We hope the majority of the time we hit
 		 * here :)
 		 */
-		dp = (uint8_t *) (mtod(m, caddr_t)+m->m_len);
-		m->m_len += padlen;
+		dp = (uint8_t *) (mtod(m, caddr_t)+SCTP_BUF_LEN(m));
+		SCTP_BUF_LEN(m) += padlen;
 	} else {
 		/* Hard way we must grow the mbuf */
 		struct mbuf *tmp;
@@ -2542,9 +2540,9 @@ sctp_add_pad_tombuf(struct mbuf *m, int padlen)
 			return (ENOSPC);
 		}
 		/* setup and insert in middle */
-		tmp->m_next = m->m_next;
-		tmp->m_len = padlen;
-		m->m_next = tmp;
+		SCTP_BUF_NEXT(tmp) = SCTP_BUF_NEXT(m);
+		SCTP_BUF_LEN(tmp) = padlen;
+		SCTP_BUF_NEXT(m) = tmp;
 		dp = mtod(tmp, uint8_t *);
 	}
 	/* zero out the pad */
@@ -2566,10 +2564,10 @@ sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf)
 		return (sctp_add_pad_tombuf(last_mbuf, padval));
 	} else {
 		while (m_at) {
-			if (m_at->m_next == NULL) {
+			if (SCTP_BUF_NEXT(m_at) == NULL) {
 				return (sctp_add_pad_tombuf(m_at, padval));
 			}
-			m_at = m_at->m_next;
+			m_at = SCTP_BUF_NEXT(m_at);
 		}
 	}
 	return (EFAULT);
@@ -2616,11 +2614,11 @@ sctp_notify_assoc_change(uint32_t event, struct sctp_tcb *stcb,
 		/* event not enabled */
 		return;
 	}
-	m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_change), 1, M_DONTWAIT, 1, MT_DATA);
+	m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_change), 0, M_DONTWAIT, 1, MT_DATA);
 	if (m_notify == NULL)
 		/* no space left */
 		return;
-	m_notify->m_len = 0;
+	SCTP_BUF_LEN(m_notify) = 0;
 
 	sac = mtod(m_notify, struct sctp_assoc_change *);
 	sac->sac_type = SCTP_ASSOC_CHANGE;
@@ -2632,11 +2630,8 @@ sctp_notify_assoc_change(uint32_t event, struct sctp_tcb *stcb,
 	sac->sac_outbound_streams = stcb->asoc.streamoutcnt;
 	sac->sac_inbound_streams = stcb->asoc.streamincnt;
 	sac->sac_assoc_id = sctp_get_associd(stcb);
-	m_notify->m_flags |= M_EOR | M_NOTIFICATION;
-	m_notify->m_pkthdr.len = sizeof(struct sctp_assoc_change);
-	m_notify->m_pkthdr.rcvif = 0;
-	m_notify->m_len = sizeof(struct sctp_assoc_change);
-	m_notify->m_next = NULL;
+	SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_change);
+	SCTP_BUF_NEXT(m_notify) = NULL;
 	control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
 	    0, 0, 0, 0, 0, 0,
 	    m_notify);
@@ -2645,9 +2640,10 @@ sctp_notify_assoc_change(uint32_t event, struct sctp_tcb *stcb,
 		sctp_m_freem(m_notify);
 		return;
 	}
-	control->length = m_notify->m_len;
+	control->length = SCTP_BUF_LEN(m_notify);
 	/* not that we need this */
 	control->tail_mbuf = m_notify;
+	control->spec_flags = M_NOTIFICATION;
 	sctp_add_to_readq(stcb->sctp_ep, stcb,
 	    control,
 	    &stcb->sctp_socket->so_rcv, 1);
@@ -2669,10 +2665,10 @@ sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
 		/* event not enabled */
 		return;
 
-	m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 1, M_DONTWAIT, 1, MT_DATA);
+	m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 0, M_DONTWAIT, 1, MT_DATA);
 	if (m_notify == NULL)
 		return;
-	m_notify->m_len = 0;
+	SCTP_BUF_LEN(m_notify) = 0;
 	spc = mtod(m_notify, struct sctp_paddr_change *);
 	spc->spc_type = SCTP_PEER_ADDR_CHANGE;
 	spc->spc_flags = 0;
@@ -2686,11 +2682,8 @@ sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
 	spc->spc_error = error;
 	spc->spc_assoc_id = sctp_get_associd(stcb);
 
-	m_notify->m_flags |= M_EOR | M_NOTIFICATION;
-	m_notify->m_pkthdr.len = sizeof(struct sctp_paddr_change);
-	m_notify->m_pkthdr.rcvif = 0;
-	m_notify->m_len = sizeof(struct sctp_paddr_change);
-	m_notify->m_next = NULL;
+	SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_paddr_change);
+	SCTP_BUF_NEXT(m_notify) = NULL;
 
 	/* append to socket */
 	control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
@@ -2701,7 +2694,8 @@ sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
 		sctp_m_freem(m_notify);
 		return;
 	}
-	control->length = m_notify->m_len;
+	control->length = SCTP_BUF_LEN(m_notify);
+	control->spec_flags = M_NOTIFICATION;
 	/* not that we need this */
 	control->tail_mbuf = m_notify;
 	sctp_add_to_readq(stcb->sctp_ep, stcb,
@@ -2724,11 +2718,11 @@ sctp_notify_send_failed(struct sctp_tcb *stcb, uint32_t error,
 		return;
 
 	length = sizeof(struct sctp_send_failed) + chk->send_size;
-	m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_send_failed), 1, M_DONTWAIT, 1, MT_DATA);
+	m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_send_failed), 0, M_DONTWAIT, 1, MT_DATA);
 	if (m_notify == NULL)
 		/* no space left */
 		return;
-	m_notify->m_len = 0;
+	SCTP_BUF_LEN(m_notify) = 0;
 	ssf = mtod(m_notify, struct sctp_send_failed *);
 	ssf->ssf_type = SCTP_SEND_FAILED;
 	if (error == SCTP_NOTIFY_DATAGRAM_UNSENT)
@@ -2745,11 +2739,8 @@ sctp_notify_send_failed(struct sctp_tcb *stcb, uint32_t error,
 	ssf->ssf_info.sinfo_context = chk->rec.data.context;
 	ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
 	ssf->ssf_assoc_id = sctp_get_associd(stcb);
-	m_notify->m_next = chk->data;
-	m_notify->m_flags |= M_NOTIFICATION;
-	m_notify->m_pkthdr.len = length;
-	m_notify->m_pkthdr.rcvif = 0;
-	m_notify->m_len = sizeof(struct sctp_send_failed);
+	SCTP_BUF_NEXT(m_notify) = chk->data;
+	SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed);
 
 	/* Steal off the mbuf */
 	chk->data = NULL;
@@ -2758,7 +2749,7 @@ sctp_notify_send_failed(struct sctp_tcb *stcb, uint32_t error,
 	 * is going away we don't want to overfill the socket buffer for a
 	 * non-reader
 	 */
-	if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < m_notify->m_len) {
+	if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
 		sctp_m_freem(m_notify);
 		return;
 	}
@@ -2771,6 +2762,7 @@ sctp_notify_send_failed(struct sctp_tcb *stcb, uint32_t error,
 		sctp_m_freem(m_notify);
 		return;
 	}
+	control->spec_flags = M_NOTIFICATION;
 	sctp_add_to_readq(stcb->sctp_ep, stcb,
 	    control,
 	    &stcb->sctp_socket->so_rcv, 1);
@@ -2791,11 +2783,11 @@ sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
 		return;
 
 	length = sizeof(struct sctp_send_failed) + sp->length;
-	m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 1, M_DONTWAIT, 1, MT_DATA);
+	m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 0, M_DONTWAIT, 1, MT_DATA);
 	if (m_notify == NULL)
 		/* no space left */
 		return;
-	m_notify->m_len = 0;
+	SCTP_BUF_LEN(m_notify) = 0;
 	ssf = mtod(m_notify, struct sctp_send_failed *);
 	ssf->ssf_type = SCTP_SEND_FAILED;
 	if (error == SCTP_NOTIFY_DATAGRAM_UNSENT)
@@ -2812,11 +2804,8 @@ sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
 	ssf->ssf_info.sinfo_context = sp->context;
 	ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
 	ssf->ssf_assoc_id = sctp_get_associd(stcb);
-	m_notify->m_next = sp->data;
-	m_notify->m_flags |= M_NOTIFICATION;
-	m_notify->m_pkthdr.len = length;
-	m_notify->m_pkthdr.rcvif = 0;
-	m_notify->m_len = sizeof(struct sctp_send_failed);
+	SCTP_BUF_NEXT(m_notify) = sp->data;
+	SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed);
 
 	/* Steal off the mbuf */
 	sp->data = NULL;
@@ -2825,7 +2814,7 @@ sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
 	 * is going away we don't want to overfill the socket buffer for a
 	 * non-reader
 	 */
-	if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < m_notify->m_len) {
+	if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
 		sctp_m_freem(m_notify);
 		return;
 	}
@@ -2838,6 +2827,7 @@ sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
 		sctp_m_freem(m_notify);
 		return;
 	}
+	control->spec_flags = M_NOTIFICATION;
 	sctp_add_to_readq(stcb->sctp_ep, stcb,
 	    control,
 	    &stcb->sctp_socket->so_rcv, 1);
@@ -2857,11 +2847,11 @@ sctp_notify_adaptation_layer(struct sctp_tcb *stcb,
 		/* event not enabled */
 		return;
 
-	m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 1, M_DONTWAIT, 1, MT_DATA);
+	m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 0, M_DONTWAIT, 1, MT_DATA);
 	if (m_notify == NULL)
 		/* no space left */
 		return;
-	m_notify->m_len = 0;
+	SCTP_BUF_LEN(m_notify) = 0;
 	sai = mtod(m_notify, struct sctp_adaptation_event *);
 	sai->sai_type = SCTP_ADAPTATION_INDICATION;
 	sai->sai_flags = 0;
@@ -2869,11 +2859,8 @@ sctp_notify_adaptation_layer(struct sctp_tcb *stcb,
 	sai->sai_adaptation_ind = error;
 	sai->sai_assoc_id = sctp_get_associd(stcb);
 
-	m_notify->m_flags |= M_EOR | M_NOTIFICATION;
-	m_notify->m_pkthdr.len = sizeof(struct sctp_adaptation_event);
-	m_notify->m_pkthdr.rcvif = 0;
-	m_notify->m_len = sizeof(struct sctp_adaptation_event);
-	m_notify->m_next = NULL;
+	SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_adaptation_event);
+	SCTP_BUF_NEXT(m_notify) = NULL;
 
 	/* append to socket */
 	control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
@@ -2884,7 +2871,8 @@ sctp_notify_adaptation_layer(struct sctp_tcb *stcb,
 		sctp_m_freem(m_notify);
 		return;
 	}
-	control->length = m_notify->m_len;
+	control->length = SCTP_BUF_LEN(m_notify);
+	control->spec_flags = M_NOTIFICATION;
 	/* not that we need this */
 	control->tail_mbuf = m_notify;
 	sctp_add_to_readq(stcb->sctp_ep, stcb,
@@ -2906,11 +2894,11 @@ sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb,
 		/* event not enabled */
 		return;
 
-	m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 1, M_DONTWAIT, 1, MT_DATA);
+	m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 0, M_DONTWAIT, 1, MT_DATA);
 	if (m_notify == NULL)
 		/* no space left */
 		return;
-	m_notify->m_len = 0;
+	SCTP_BUF_LEN(m_notify) = 0;
 	pdapi = mtod(m_notify, struct sctp_pdapi_event *);
 	pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
 	pdapi->pdapi_flags = 0;
@@ -2918,11 +2906,8 @@ sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb,
 	pdapi->pdapi_indication = error;
 	pdapi->pdapi_assoc_id = sctp_get_associd(stcb);
 
-	m_notify->m_flags |= M_EOR | M_NOTIFICATION;
-	m_notify->m_pkthdr.len = sizeof(struct sctp_pdapi_event);
-	m_notify->m_pkthdr.rcvif = 0;
-	m_notify->m_len = sizeof(struct sctp_pdapi_event);
-	m_notify->m_next = NULL;
+	SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_pdapi_event);
+	SCTP_BUF_NEXT(m_notify) = NULL;
 	control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
 	    0, 0, 0, 0, 0, 0,
 	    m_notify);
@@ -2931,7 +2916,8 @@ sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb,
 		sctp_m_freem(m_notify);
 		return;
 	}
-	control->length = m_notify->m_len;
+	control->spec_flags = M_NOTIFICATION;
+	control->length = SCTP_BUF_LEN(m_notify);
 	/* not that we need this */
 	control->tail_mbuf = m_notify;
 	control->held_length = 0;
@@ -2941,13 +2927,13 @@ sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb,
 	}
 	sb = &stcb->sctp_socket->so_rcv;
 #ifdef SCTP_SB_LOGGING
-	sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, m_notify->m_len);
+	sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m_notify));
 #endif
 	sctp_sballoc(stcb, sb, m_notify);
 #ifdef SCTP_SB_LOGGING
 	sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
 #endif
-	atomic_add_int(&control->length, m_notify->m_len);
+	atomic_add_int(&control->length, SCTP_BUF_LEN(m_notify));
 	control->end_added = 1;
 	if (stcb->asoc.control_pdapi)
 		TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next);
@@ -2984,22 +2970,18 @@ sctp_notify_shutdown_event(struct sctp_tcb *stcb)
 		/* event not enabled */
 		return;
 
-	m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 1, M_DONTWAIT, 1, MT_DATA);
+	m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 0, M_DONTWAIT, 1, MT_DATA);
 	if (m_notify == NULL)
 		/* no space left */
 		return;
-	m_notify->m_len = 0;
 	sse = mtod(m_notify, struct sctp_shutdown_event *);
 	sse->sse_type = SCTP_SHUTDOWN_EVENT;
 	sse->sse_flags = 0;
 	sse->sse_length = sizeof(struct sctp_shutdown_event);
 	sse->sse_assoc_id = sctp_get_associd(stcb);
 
-	m_notify->m_flags |= M_EOR | M_NOTIFICATION;
-	m_notify->m_pkthdr.len = sizeof(struct sctp_shutdown_event);
-	m_notify->m_pkthdr.rcvif = 0;
-	m_notify->m_len = sizeof(struct sctp_shutdown_event);
-	m_notify->m_next = NULL;
+	SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_shutdown_event);
+	SCTP_BUF_NEXT(m_notify) = NULL;
 
 	/* append to socket */
 	control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
@@ -3010,7 +2992,8 @@ sctp_notify_shutdown_event(struct sctp_tcb *stcb)
 		sctp_m_freem(m_notify);
 		return;
 	}
-	control->length = m_notify->m_len;
+	control->spec_flags = M_NOTIFICATION;
+	control->length = SCTP_BUF_LEN(m_notify);
 	/* not that we need this */
 	control->tail_mbuf = m_notify;
 	sctp_add_to_readq(stcb->sctp_ep, stcb,
@@ -3031,11 +3014,11 @@ sctp_notify_stream_reset(struct sctp_tcb *stcb,
 		/* event not enabled */
 		return;
 
-	m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 1, M_DONTWAIT, 1, MT_DATA);
+	m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
 	if (m_notify == NULL)
 		/* no space left */
 		return;
-	m_notify->m_len = 0;
+	SCTP_BUF_LEN(m_notify) = 0;
 	len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
 	if (len > M_TRAILINGSPACE(m_notify)) {
 		/* never enough room */
@@ -3058,12 +3041,9 @@ sctp_notify_stream_reset(struct sctp_tcb *stcb,
 			strreset->strreset_list[i] = ntohs(list[i]);
 		}
 	}
-	m_notify->m_flags |= M_EOR | M_NOTIFICATION;
-	m_notify->m_pkthdr.len = len;
-	m_notify->m_pkthdr.rcvif = 0;
-	m_notify->m_len = len;
-	m_notify->m_next = NULL;
-	if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < m_notify->m_len) {
+	SCTP_BUF_LEN(m_notify) = len;
+	SCTP_BUF_NEXT(m_notify) = NULL;
+	if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
 		/* no space */
 		sctp_m_freem(m_notify);
 		return;
@@ -3077,7 +3057,8 @@ sctp_notify_stream_reset(struct sctp_tcb *stcb,
 		sctp_m_freem(m_notify);
 		return;
 	}
-	control->length = m_notify->m_len;
+	control->spec_flags = M_NOTIFICATION;
+	control->length = SCTP_BUF_LEN(m_notify);
 	/* not that we need this */
 	control->tail_mbuf = m_notify;
 	sctp_add_to_readq(stcb->sctp_ep, stcb,
@@ -3669,7 +3650,7 @@ sctp_print_address_pkt(struct ip *iph, struct sctphdr *sh)
 
 #define SCTP_SBLINKRECORD(sb, m0) do {					\
 	if ((sb)->sb_lastrecord != NULL)				\
-		(sb)->sb_lastrecord->m_nextpkt = (m0);			\
+		SCTP_BUF_NEXT_PKT((sb)->sb_lastrecord) = (m0);			\
 	else								\
 		(sb)->sb_mb = (m0);					\
 	(sb)->sb_lastrecord = (m0);					\
@@ -3725,13 +3706,13 @@ sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
 			m = control->data;
 			while (m) {
 #ifdef SCTP_SB_LOGGING
-				sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, m->m_len);
+				sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
 #endif
 				sctp_sbfree(control, stcb, &old_so->so_rcv, m);
 #ifdef SCTP_SB_LOGGING
 				sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
 #endif
-				m = m->m_next;
+				m = SCTP_BUF_NEXT(m);
 			}
 		}
 		control = nctl;
@@ -3753,13 +3734,13 @@ sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
 		m = control->data;
 		while (m) {
 #ifdef SCTP_SB_LOGGING
-			sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, m->m_len);
+			sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
 #endif
 			sctp_sballoc(stcb, &new_so->so_rcv, m);
 #ifdef SCTP_SB_LOGGING
 			sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
 #endif
-			m = m->m_next;
+			m = SCTP_BUF_NEXT(m);
 		}
 		control = nctl;
 	}
@@ -3795,15 +3776,15 @@ sctp_add_to_readq(struct sctp_inpcb *inp,
 	control->held_length = 0;
 	control->length = 0;
 	while (m) {
-		if (m->m_len == 0) {
+		if (SCTP_BUF_LEN(m) == 0) {
 			/* Skip mbufs with NO length */
 			if (prev == NULL) {
 				/* First one */
 				control->data = sctp_m_free(m);
 				m = control->data;
 			} else {
-				prev->m_next = sctp_m_free(m);
-				m = prev->m_next;
+				SCTP_BUF_NEXT(prev) = sctp_m_free(m);
+				m = SCTP_BUF_NEXT(prev);
 			}
 			if (m == NULL) {
 				control->tail_mbuf = prev;;
@@ -3812,21 +3793,19 @@ sctp_add_to_readq(struct sctp_inpcb *inp,
 		}
 		prev = m;
 #ifdef SCTP_SB_LOGGING
-		sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, m->m_len);
+		sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
 #endif
 		sctp_sballoc(stcb, sb, m);
 #ifdef SCTP_SB_LOGGING
 		sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
 #endif
-		atomic_add_int(&control->length, m->m_len);
-		m = m->m_next;
+		atomic_add_int(&control->length, SCTP_BUF_LEN(m));
+		m = SCTP_BUF_NEXT(m);
 	}
 	if (prev != NULL) {
 		control->tail_mbuf = prev;
-		if (end) {
-			prev->m_flags |= M_EOR;
-		}
 	} else {
+		/* Everything got collapsed out?? */
 		return;
 	}
 	if (end) {
@@ -3871,8 +3850,7 @@ get_out:
 		}
 		return (-1);
 	}
-	if ((control->tail_mbuf) &&
-	    (control->tail_mbuf->m_flags & M_EOR)) {
+	if (control->end_added) {
 		/* huh this one is complete? */
 		goto get_out;
 	}
@@ -3881,30 +3859,30 @@ get_out:
 		goto get_out;
 	}
 	while (mm) {
-		if (mm->m_len == 0) {
+		if (SCTP_BUF_LEN(mm) == 0) {
 			/* Skip mbufs with NO lenght */
 			if (prev == NULL) {
 				/* First one */
 				m = sctp_m_free(mm);
 				mm = m;
 			} else {
-				prev->m_next = sctp_m_free(mm);
-				mm = prev->m_next;
+				SCTP_BUF_NEXT(prev) = sctp_m_free(mm);
+				mm = SCTP_BUF_NEXT(prev);
 			}
 			continue;
 		}
 		prev = mm;
-		len += mm->m_len;
+		len += SCTP_BUF_LEN(mm);
 		if (sb) {
 #ifdef SCTP_SB_LOGGING
-			sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, mm->m_len);
+			sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(mm));
 #endif
 			sctp_sballoc(stcb, sb, mm);
 #ifdef SCTP_SB_LOGGING
 			sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
 #endif
 		}
-		mm = mm->m_next;
+		mm = SCTP_BUF_NEXT(mm);
 	}
 	if (prev) {
 		tail = prev;
@@ -3922,7 +3900,6 @@ get_out:
 	}
 	if (end) {
 		/* message is complete */
-		tail->m_flags |= M_EOR;
 		if (control == stcb->asoc.control_pdapi) {
 			stcb->asoc.control_pdapi = NULL;
 		}
@@ -3932,7 +3909,7 @@ get_out:
 	atomic_add_int(&control->length, len);
 	if (control->tail_mbuf) {
 		/* append */
-		control->tail_mbuf->m_next = m;
+		SCTP_BUF_NEXT(control->tail_mbuf) = m;
 		control->tail_mbuf = tail;
 	} else {
 		/* nothing there */
@@ -3980,7 +3957,7 @@ sctp_generate_invmanparam(int err)
 	if (m) {
 		struct sctp_paramhdr *ph;
 
-		m->m_len = sizeof(struct sctp_paramhdr);
+		SCTP_BUF_LEN(m) = sizeof(struct sctp_paramhdr);
 		ph = mtod(m, struct sctp_paramhdr *);
 		ph->param_length = htons(sizeof(struct sctp_paramhdr));
 		ph->param_type = htons(err);
@@ -4147,13 +4124,6 @@ sctp_find_ifa_by_addr(struct sockaddr *sa)
 	return (NULL);
 }
 
-
-
-
-
-
-
-
 static void
 sctp_user_rcvd(struct sctp_tcb *stcb, int *freed_so_far, int hold_rlock,
     uint32_t rwnd_req)
@@ -4463,13 +4433,12 @@ restart_nosblocks:
 
 			m = control->data;
 			while (m) {
-				cnt += m->m_len;
-				if (m->m_next == NULL) {
+				cnt += SCTP_BUF_LEN(m);
+				if (SCTP_BUF_NEXT(m) == NULL) {
 					control->tail_mbuf = m;
-					m->m_flags |= M_EOR;
 					control->end_added = 1;
 				}
-				m = m->m_next;
+				m = SCTP_BUF_NEXT(m);
 			}
 			control->length = cnt;
 		} else {
@@ -4572,7 +4541,7 @@ found_one:
 				s_extra->next_ppid = nxt->sinfo_ppid;
 				s_extra->next_stream = nxt->sinfo_stream;
 				if (nxt->tail_mbuf != NULL) {
-					if (nxt->tail_mbuf->m_flags & M_EOR) {
+					if (nxt->end_added) {
 						s_extra->next_flags |= SCTP_NEXT_MSG_ISCOMPLETE;
 					}
 				}
@@ -4653,7 +4622,7 @@ get_more_data:
 		while (m) {
 			/* Move out all we can */
 			cp_len = (int)uio->uio_resid;
-			my_len = (int)m->m_len;
+			my_len = (int)SCTP_BUF_LEN(m);
 			if (cp_len > my_len) {
 				/* not enough in this buf */
 				cp_len = my_len;
@@ -4685,8 +4654,8 @@ get_more_data:
 				/* error we are out of here */
 				goto release;
 			}
-			if ((m->m_next == NULL) &&
-			    (cp_len >= m->m_len) &&
+			if ((SCTP_BUF_NEXT(m) == NULL) &&
+			    (cp_len >= SCTP_BUF_LEN(m)) &&
 			    ((control->end_added == 0) ||
 			    (control->end_added && (TAILQ_NEXT(control, next) == NULL)))
 			    ) {
@@ -4694,13 +4663,13 @@ get_more_data:
 				sctp_misc_ints(SCTP_SORCV_DOESLCK,
 				    so->so_rcv.sb_cc,
 				    cp_len,
-				    m->m_len,
+				    SCTP_BUF_LEN(m),
 				    control->length);
 #endif
 				SCTP_INP_READ_LOCK(inp);
 				hold_rlock = 1;
 			}
-			if (cp_len == m->m_len) {
+			if (cp_len == SCTP_BUF_LEN(m)) {
 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
 				sctp_misc_ints(SCTP_SORCV_DOESADJ,
 				    so->so_rcv.sb_cc,
@@ -4708,22 +4677,23 @@ get_more_data:
 				    cp_len,
 				    0);
 #endif
-				if (m->m_flags & M_EOR) {
+				if ((SCTP_BUF_NEXT(m) == NULL) &&
+				    (control->end_added)) {
 					out_flags |= MSG_EOR;
 				}
-				if (m->m_flags & M_NOTIFICATION) {
+				if (control->spec_flags & M_NOTIFICATION) {
 					out_flags |= MSG_NOTIFICATION;
 				}
 				/* we ate up the mbuf */
 				if (in_flags & MSG_PEEK) {
 					/* just looking */
-					m = m->m_next;
+					m = SCTP_BUF_NEXT(m);
 					copied_so_far += cp_len;
 				} else {
 					/* dispose of the mbuf */
 #ifdef SCTP_SB_LOGGING
 					sctp_sblog(&so->so_rcv,
-					    control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, m->m_len);
+					    control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
 #endif
 					sctp_sbfree(control, stcb, &so->so_rcv, m);
 #ifdef SCTP_SB_LOGGING
@@ -4783,21 +4753,12 @@ get_more_data:
 				}
 			} else {
 				/* Do we need to trim the mbuf? */
-				if (m->m_flags & M_NOTIFICATION) {
+				if (control->spec_flags & M_NOTIFICATION) {
 					out_flags |= MSG_NOTIFICATION;
 				}
 				if ((in_flags & MSG_PEEK) == 0) {
-					if (out_flags & MSG_NOTIFICATION) {
-						/*
-						 * remark this one with the
-						 * notify flag, they read
-						 * only part of the
-						 * notification.
-						 */
-						m->m_flags |= M_NOTIFICATION;
-					}
-					m->m_data += cp_len;
-					m->m_len -= cp_len;
+					SCTP_BUF_RESV_UF(m, cp_len);
+					SCTP_BUF_LEN(m) -= cp_len;
 #ifdef SCTP_SB_LOGGING
 					sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, cp_len);
 #endif
@@ -5037,10 +4998,10 @@ get_more_data2:
 					hold_rlock = 1;
 				}
 			}
-			if (control->tail_mbuf->m_flags & M_EOR) {
+			if (control->end_added) {
 				out_flags |= MSG_EOR;
 			}
-			if (control->data->m_flags & M_NOTIFICATION) {
+			if (control->spec_flags & M_NOTIFICATION) {
 				out_flags |= MSG_NOTIFICATION;
 			}
 			if (uio)
@@ -5050,15 +5011,15 @@ get_more_data2:
 			while (m) {
 #ifdef SCTP_SB_LOGGING
 				sctp_sblog(&so->so_rcv,
-				    control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, m->m_len);
+				    control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
 #endif
 				sctp_sbfree(control, stcb, &so->so_rcv, m);
-				freed_so_far += m->m_len;
+				freed_so_far += SCTP_BUF_LEN(m);
 #ifdef SCTP_SB_LOGGING
 				sctp_sblog(&so->so_rcv,
 				    control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
 #endif
-				m = m->m_next;
+				m = SCTP_BUF_NEXT(m);
 			}
 			control->data = control->tail_mbuf = NULL;
 			control->length = 0;
@@ -5126,29 +5087,29 @@ get_more_data2:
 					hold_rlock = 1;
 				}
 			}
-			if (m->m_flags & M_NOTIFICATION) {
+			if (control->spec_flags & M_NOTIFICATION) {
 				out_flags |= MSG_NOTIFICATION;
 			}
 			while ((m) && (cp_len > 0)) {
-				if (cp_len >= m->m_len) {
+				if (cp_len >= SCTP_BUF_LEN(m)) {
 					*mp = m;
-					atomic_subtract_int(&control->length, m->m_len);
+					atomic_subtract_int(&control->length, SCTP_BUF_LEN(m));
 					if (uio)
-						uio->uio_resid -= m->m_len;
-					cp_len -= m->m_len;
-					control->data = m->m_next;
-					m->m_next = NULL;
+						uio->uio_resid -= SCTP_BUF_LEN(m);
+					cp_len -= SCTP_BUF_LEN(m);
+					control->data = SCTP_BUF_NEXT(m);
+					SCTP_BUF_NEXT(m) = NULL;
 #ifdef SCTP_SB_LOGGING
 					sctp_sblog(&so->so_rcv,
-					    control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, m->m_len);
+					    control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
 #endif
 					sctp_sbfree(control, stcb, &so->so_rcv, m);
-					freed_so_far += m->m_len;
+					freed_so_far += SCTP_BUF_LEN(m);
 #ifdef SCTP_SB_LOGGING
 					sctp_sblog(&so->so_rcv,
 					    control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
 #endif
-					mp = &m->m_next;
+					mp = &SCTP_BUF_NEXT(m);
 					m = control->data;
 				} else {
 					/*
@@ -5156,8 +5117,8 @@ get_more_data2:
 					 * this mbuf only.
 					 */
 					if (uio)
-						uio->uio_resid -= m->m_len;
-					cp_len -= m->m_len;
+						uio->uio_resid -= SCTP_BUF_LEN(m);
+					cp_len -= SCTP_BUF_LEN(m);
 					if (hold_rlock) {
 						SCTP_INP_READ_UNLOCK(inp);
 						hold_rlock = 0;
@@ -5185,8 +5146,8 @@ get_more_data2:
 					    stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
 						no_rcv_needed = 1;
 					}
-					m->m_data += cp_len;
-					m->m_len -= cp_len;
+					SCTP_BUF_RESV_UF(m, cp_len);
+					SCTP_BUF_LEN(m) -= cp_len;
 #ifdef SCTP_SB_LOGGING
 					sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, cp_len);
 #endif
@@ -5203,13 +5164,6 @@ get_more_data2:
 					sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
 					    SCTP_LOG_SBRESULT, 0);
 #endif
-					if (out_flags & MSG_NOTIFICATION) {
-						/*
-						 * remark the first mbuf if
-						 * they took a partial read.
-						 */
-						control->data->m_flags |= M_NOTIFICATION;
-					}
 					goto release;
 				}
 			}
@@ -5290,7 +5244,7 @@ out:
 struct mbuf *
 sctp_m_free(struct mbuf *m)
 {
-	if (m->m_flags & M_EXT) {
+	if (SCTP_BUF_IS_EXTENDED(m)) {
 		sctp_log_mb(m, SCTP_MBUF_IFREE);
 	}
 	return (m_free(m));