PANIC! UNIX System Crash Dump Analysis Handbook (Bk/CD-ROM)

The structure datab (also known as a dblk , again from a typedef) identifies the actual buffer holding the data. It also contains a type code to differentiate between real data and various control messages. In SunOS 4.x, the data block also contained real data if the amount was small enough ” 8 bytes or less. This involved less overhead than allocating and pointing to a separate data buffer area for such a small amount of data. This usage could be seen in the netstat command's output, where Streams buffers were identified as being "within-dblk." In Solaris 2 this feature was removed, probably because it cost as much to catch this special case in code as it saved in data space. So, we have slightly different structures in the two OS versions, but the idea remains the same. The data block contains:

• db_base ” A pointer to the base address of the buffer

• db_lim ” Indicates the upper limit of the buffer (the end + 1) for use with the write pointer

• db_size ” The amount of space in the buffer (the allocated size )

• db_ref ” A reference count for message blocks that point to this data block

• db_type ” A type code for the data contained in this buffer. The type code for the first block in the message is used for the remainder of the blocks, in the case where the message is continued across several blocks. The type code in succeeding data blocks (pointed to by the message blocks) is ignored.

The data block contains the size of the buffer but not any pointers to the data. These pointers are maintained by the message block itself. Because some networking operations involve adding or removing headers, you can't be sure that the beginning of the buffer really corresponds to the beginning of the data.