1.\" Copyright (c) 2000 FreeBSD Inc. 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 13.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 14.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 15.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 16.\" ARE DISCLAIMED. IN NO EVENT SHALL [your name] OR CONTRIBUTORS BE LIABLE 17.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 20.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 21.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 22.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 23.\" SUCH DAMAGE. 24.\" 25.\" $FreeBSD: src/share/man/man9/mbuf.9,v 1.27.2.1 2003/05/28 13:53:18 yar Exp $ 26.\" 27.Dd December 27, 2023 28.Dt MBUF 9 29.Os 30.\" 31.Sh NAME 32.Nm mbuf 33.Nd "memory management in the kernel IPC subsystem" 34.\" 35.Sh SYNOPSIS 36.In sys/param.h 37.In sys/systm.h 38.In sys/mbuf.h 39.\" 40.Ss Mbuf allocation macros 41.Fn MGET "struct mbuf *mbuf" "int how" "short type" 42.Fn MGETHDR "struct mbuf *mbuf" "int how" "short type" 43.Fn MCLGET "struct mbuf *mbuf" "int how" 44.\" 45.Ss Mbuf utility macros 46.Ft void * 47.Fn mtod "struct mbuf *mbuf" "type" 48.Fn M_ALIGN "struct mbuf *mbuf" "u_int len" 49.Fn MH_ALIGN "struct mbuf *mbuf" "u_int len" 50.Ft int 51.Fn M_LEADINGSPACE "struct mbuf *mbuf" 52.Ft int 53.Fn M_TRAILINGSPACE "struct mbuf *mbuf" 54.Fn M_PREPEND "struct mbuf *mbuf" "int len" "int how" 55.\" 56.Ss Mbuf allocation functions 57.Ft struct mbuf * 58.Fn m_get "int how" "int type" 59.Ft struct mbuf * 60.Fn m_getm "struct mbuf *orig" "int len" "int how" "int type" 61.Ft struct mbuf * 62.Fn m_getclr "int how" "int type" 63.Ft struct mbuf * 64.Fn m_gethdr "int how" "int type" 65.Ft struct mbuf * 66.Fn m_free "struct mbuf *mbuf" 67.Ft void 68.Fn m_freem "struct mbuf *mbuf" 69.\" 70.Ss Mbuf utility functions 71.Ft void 72.Fn m_adj "struct mbuf *mbuf" "int len" 73.Ft struct mbuf * 74.Fn m_prepend "struct mbuf *mbuf" "int len" "int how" 75.Ft struct mbuf * 76.Fn m_pullup "struct mbuf *mbuf" "int len" 77.Ft struct mbuf * 78.Fn m_copym "const struct mbuf *mbuf" "int offset" "int len" "int how" 79.Ft struct mbuf * 80.Fn m_copypacket "struct mbuf *mbuf" "int how" 81.Ft struct mbuf * 82.Fn m_dup "struct mbuf *mbuf" "int how" 83.Ft void 84.Fn m_copydata "const struct mbuf *mbuf" "int offset" "int len" "void *buf" 85.Ft void 86.Fn m_copyback "struct mbuf *mbuf" "int offset" "int len" "const void *buf" 87.Ft int 88.Fn m_copyback2 "struct mbuf *mbuf" "int offset" "int len" "const void *buf" "int how" 89.Ft struct mbuf * 90.Fo m_devget 91.Fa "void *buf" 92.Fa "int len" 93.Fa "int offset" 94.Fa "struct ifnet *ifp" 95.Fc 96.Ft void 97.Fn m_cat "struct mbuf *m" "struct mbuf *n" 98.Ft struct mbuf * 99.Fn m_split "struct mbuf *mbuf" "int len" "int how" 100.Ft struct mbuf * 101.Fn m_unshare "struct mbuf *mbuf" "int how" 102.\" 103.Sh DESCRIPTION 104An mbuf is a basic unit of memory management in the kernel IPC subsystem. 105Network packets and socket buffers are stored in mbufs. 106A network packet may span multiple mbufs arranged into a chain 107(linked list), 108which allows adding or trimming 109network headers with little overhead. 110.Pp 111While a developer should not bother with mbuf internals without serious 112reason in order to avoid incompatibilities with future changes, it 113is useful to understand the mbuf's general structure. 114.Pp 115An mbuf consists of a variable-sized header and a small internal 116buffer for data. 117The mbuf's total size, 118.Dv MSIZE , 119is a constant defined in 120.In sys/param.h . 121The mbuf header includes: 122.Pp 123.Bl -tag -width "m_nextpkt" -compact -offset indent 124.It Fa m_next 125a pointer to the next buffer in the chain 126.It Fa m_nextpkt 127a pointer to the next chain in the queue 128.It Fa m_data 129a pointer to the data 130.It Fa m_len 131the length of the data 132.It Fa m_type 133the type of data 134.It Fa m_flags 135the mbuf flags 136.El 137.Pp 138The mbuf flag bits are defined as follows: 139.Bd -literal 140/* mbuf flags */ 141#define M_EXT 0x0001 /* has associated external storage */ 142#define M_PKTHDR 0x0002 /* start of record */ 143#define M_EOR 0x0004 /* end of record */ 144#define M_PROTO1 0x0010 /* protocol-specific */ 145#define M_PROTO2 0x0020 /* protocol-specific */ 146#define M_PROTO3 0x0040 /* protocol-specific */ 147#define M_PROTO4 0x0080 /* protocol-specific */ 148#define M_PROTO5 0x0100 /* protocol-specific */ 149 150/* mbuf pkthdr flags, also in m_flags */ 151#define M_BCAST 0x0200 /* send/received as link-level broadcast */ 152#define M_MCAST 0x0400 /* send/received as link-level multicast */ 153#define M_FRAG 0x0800 /* packet is fragment of larger packet */ 154#define M_FIRSTFRAG 0x1000 /* packet is first fragment */ 155#define M_LASTFRAG 0x2000 /* packet is last fragment */ 156.Ed 157.Pp 158The available mbuf types are defined as follows: 159.Bd -literal 160/* mbuf types */ 161#define MT_FREE 0 /* should be on free list */ 162#define MT_DATA 1 /* dynamic (data) allocation */ 163#define MT_HEADER 2 /* packet header */ 164#define MT_SONAME 8 /* socket name */ 165#define MT_FTABLE 11 /* fragment reassembly header */ 166#define MT_CONTROL 14 /* extra-data protocol message */ 167#define MT_OOBDATA 15 /* expedited data */ 168.Ed 169.Pp 170If the 171.Dv M_PKTHDR 172flag is set, a 173.Li struct pkthdr m_pkthdr 174is added to the mbuf header. 175It contains a pointer to the interface 176the packet has been received from 177.Pq Fa struct ifnet *rcvif , 178and the total packet length 179.Pq Fa int len . 180.Pp 181If small enough, data is stored in the mbuf's internal data buffer. 182If the data is sufficiently large, another mbuf may be added to the chain, 183or external storage may be associated with the mbuf. 184.Dv MHLEN 185bytes of data can fit into an mbuf with the 186.Dv M_PKTHDR 187flag set, 188.Dv MLEN 189bytes can otherwise. 190.Pp 191If external storage is being associated with an mbuf, the 192.Dv m_ext 193header is added at the cost of losing the internal data buffer. 194It includes a pointer to external storage, the size of the storage, 195a pointer to a function used for freeing the storage, 196a pointer to an optional argument that can be passed to the function, 197and a pointer to a reference counter. 198An mbuf using external storage has the 199.Dv M_EXT 200flag set. 201.Pp 202The system supplies a default type of external storage buffer called an 203.Dq mbuf cluster . 204Mbuf clusters can be allocated and configured with the use of the 205.Dv MCLGET 206macro. 207Each cluster is 208.Dv MCLBYTES 209in size, where 210.Dv MCLBYTES 211is a machine-dependent constant. 212The system defines an advisory macro 213.Dv MINCLSIZE , 214which is the smallest amount of data to put into a cluster. 215It's equal to the sum of 216.Dv MLEN 217and 218.Dv MHLEN . 219It is typically preferable to store data into an mbuf's data region, if size 220permits, as opposed to allocating a separate mbuf cluster to hold the same 221data. 222.\" 223.Ss Macros and Functions 224There are numerous predefined macros and functions that provide the 225developer with common utilities. 226.\" 227.Bl -ohang -offset indent 228.It Fn mtod mbuf type 229Convert an mbuf pointer to a data pointer. 230The macro expands to the data pointer cast to the pointer of the specified type. 231.Sy Note : 232It is advisable to ensure that there is enough contiguous data in the mbuf. 233See 234.Fn m_pullup 235for details. 236.It Fn MGET mbuf how type 237Allocate an mbuf and initialize it to contain internal data. 238.Fa mbuf 239will point to the allocated mbuf on success, or be set to 240.Dv NULL 241on failure. 242The 243.Fa how 244argument is to be set to 245.Dv M_WAITOK 246or 247.Dv M_NOWAIT . 248If 249.Fa how 250is 251.Dv M_WAITOK , 252this macro will await resources if necessary; 253if 254.Fa how 255is 256.Dv M_NOWAIT 257and resources are not available, this macro fails. 258A number of other mbuf-related 259functions and macros have the same argument because they may 260at some point need to allocate new mbufs. 261.It Fn MGETHDR mbuf how type 262Allocate an mbuf and initialize it to contain a packet header 263and internal data. 264See 265.Fn MGET 266for details. 267.It Fn MCLGET mbuf how 268Allocate and attach an mbuf cluster to an mbuf. 269If the macro fails, the 270.Dv M_EXT 271flag won't be set in the mbuf. 272.It Fn M_PREPEND mbuf len how 273This macro operates on an mbuf chain. 274It is an optimized wrapper for 275.Fn m_prepend 276that can make use of possible empty space before data 277(e.g. left after trimming of a link-layer header). 278The new chain pointer or 279.Dv NULL 280is in 281.Fa mbuf 282after the call. 283.El 284.Pp 285The functions are: 286.Bl -ohang -offset indent 287.It Fn m_get how type 288A function version of 289.Fn MGET 290for non-critical paths. 291.It Fn m_getm orig len how type 292Allocate 293.Fa len 294bytes worth of mbufs and mbuf clusters if necessary and append the resulting 295allocated chain to the 296.Fa orig 297mbuf chain, if it is 298.No non- Ns Dv NULL . 299If the allocation fails at any point, 300free whatever was allocated and return 301.Dv NULL . 302If 303.Fa orig 304is 305.No non- Ns Dv NULL , 306it will not be freed. 307It is possible to use 308.Fn m_getm 309to either append 310.Fa len 311bytes to an existing mbuf or mbuf chain 312(for example, one which may be sitting in a pre-allocated ring) 313or to simply perform an all-or-nothing mbuf and mbuf cluster allocation. 314.It Fn m_gethdr how type 315A function version of 316.Fn MGETHDR 317for non-critical paths. 318.It Fn m_getclr how type 319Allocate an mbuf and zero out the data region. 320.El 321.Pp 322The functions below operate on mbuf chains. 323.Bl -ohang -offset indent 324.It Fn m_freem mbuf 325Free an entire mbuf chain, including any external 326storage. 327.\" 328.It Fn m_adj mbuf len 329Trim 330.Fa len 331bytes from the head of an mbuf chain if 332.Fa len 333is positive, from the tail otherwise. 334.\" 335.It Fn m_prepend mbuf len how 336Allocate a new mbuf and prepend it to the chain, handle 337.Dv M_PKTHDR 338properly. 339.Sy Note : 340It doesn't allocate any clusters, so 341.Fa len 342must be less than 343.Dv MLEN 344or 345.Dv MHLEN , 346depending on the 347.Dv M_PKTHDR 348flag setting. 349.\" 350.It Fn m_pullup mbuf len 351Arrange that the first 352.Fa len 353bytes of an mbuf chain are contiguous and lay in the data area of 354.Fa mbuf , 355so they are accessible with 356.Fn mtod mbuf type . 357Return the new chain on success, 358.Dv NULL 359on failure 360(the chain is freed in this case). 361.Sy Note : 362It doesn't allocate any clusters, so 363.Fa len 364must be less than 365.Dv MHLEN . 366.\" 367.It Fn m_copym mbuf offset len how 368Make a copy of an mbuf chain starting 369.Fa offset 370bytes from the beginning, continuing for 371.Fa len 372bytes. 373If 374.Fa len 375is 376.Dv M_COPYALL , 377copy to the end of the mbuf chain. 378.Sy Note : 379The copy is read-only, because clusters are not 380copied, only their reference counts are incremented. 381.\" 382.It Fn m_copypacket mbuf how 383Copy an entire packet including header, which must be present. 384This is an optimized version of the common case 385.Fn m_copym mbuf 0 M_COPYALL how . 386.Sy Note : 387the copy is read-only, because clusters are not 388copied, only their reference counts are incremented. 389.\" 390.It Fn m_dup mbuf how 391Copy a packet header mbuf chain into a completely new chain, including 392copying any mbuf clusters. 393Use this instead of 394.Fn m_copypacket 395when you need a writable copy of an mbuf chain. 396.\" 397.It Fn m_copydata mbuf offset len buf 398Copy data from an mbuf chain starting 399.Fa off 400bytes from the beginning, continuing for 401.Fa len 402bytes, into the indicated buffer 403.Fa buf . 404.\" 405.It Fn m_copyback mbuf offset len buf 406Similar to the 407.Fn m_copyback2 408function below, but 409.Em forbid mbuf expansion . 410So the caller must ensure that the mbuf (chain) has enough space; 411otherwise, the copy would fail and it would be hard for the caller 412to discriminate due to the lack of a return value. 413In the failure case, the input mbuf (chain) may be modified but 414will not be freed. 415.\" 416.It Fn m_copyback2 mbuf offset len buf how 417Copy 418.Fa len 419bytes from the buffer 420.Fa buf 421back into the indicated mbuf chain, 422starting at 423.Fa offset 424bytes from the beginning of the chain, extending the mbuf chain if necessary. 425Mbuf clusters will be allocated if appropriate. 426.Sy Note : 427It's safe to set 428.Fa offset 429beyond the current chain end: zeroed mbufs will be allocated to fill the 430space. 431.\" 432.It Fn m_devget buf len offset ifp 433Copy data from a device local memory pointed to by 434.Fa buf 435to an mbuf chain, using 436.Fn bcopy . 437.\" 438.It Fn m_cat m n 439Concatenate 440.Fa n 441to 442.Fa m . 443Both chains must be of the same type. 444.Fa N 445is still valid after the function returned. 446.Sy Note : 447It does not handle 448.Dv M_PKTHDR 449and friends. 450.\" 451.It Fn m_split mbuf len how 452Partition an mbuf chain in two pieces, returning the tail: 453all but the first 454.Fa len 455bytes. 456In case of failure, it returns 457.Dv NULL 458and attempts to restore the chain to its original state. 459.It Fn m_unshare mbuf how 460Create a version of the specified mbuf chain whose 461contents can be safely modified without affecting other users. 462If allocation fails and this operation can not be completed, 463.Dv NULL 464will be returned. 465The original mbuf chain is always reclaimed and the reference 466count of any shared mbuf clusters is decremented. 467As a side-effect of this process the returned 468mbuf chain may be compacted. 469.Pp 470This function is especially useful in the transmit path of 471network code, when data must be encrypted or otherwise 472altered prior to transmission. 473. 474.El 475.Sh STRESS TESTING 476When running a kernel compiled with the option 477.Dv MBUF_STRESS_TEST , 478the following 479.Xr sysctl 8 Ns 480-controlled options may be used to create 481various failure/extreme cases for testing of network drivers 482and other parts of the kernel that rely on 483.Vt mbufs . 484.Bl -tag -width ident 485.It Va net.inet.ip.mbuf_frag_size 486Causes 487.Fn ip_output 488to fragment outgoing 489.Vt mbuf chains 490into fragments of the specified size. 491Setting this variable to 1 is an excellent way to 492test the long 493.Vt mbuf chain 494handling ability of network drivers. 495.It Va kern.ipc.m_defragrandomfailures 496Causes the function 497.Fn m_defrag 498to randomly fail, returning 499.Dv NULL . 500Any piece of code which uses 501.Fn m_defrag 502should be tested with this feature. 503.El 504.Sh RETURN VALUES 505See above. 506.Sh HISTORY 507.\" Please correct me if I'm wrong 508Mbufs appeared in an early version of 509.Bx . 510Besides for being used for network packets, they were used 511to store various dynamic structures, such as routing table 512entries, interface addresses, protocol control blocks, etc. 513.Sh AUTHORS 514The original 515.Nm 516man page was written by 517.An Yar Tikhiy . 518