1.\" Copyright (c) 2000 FreeBSD Inc. 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 13.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 14.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 15.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 16.\" ARE DISCLAIMED. IN NO EVENT SHALL [your name] OR CONTRIBUTORS BE LIABLE 17.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 20.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 21.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 22.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 23.\" SUCH DAMAGE. 24.\" 25.\" $FreeBSD: src/share/man/man9/mbuf.9,v 1.27.2.1 2003/05/28 13:53:18 yar Exp $ 26.\" 27.Dd February 19, 2015 28.Dt MBUF 9 29.Os 30.\" 31.Sh NAME 32.Nm mbuf 33.Nd "memory management in the kernel IPC subsystem" 34.\" 35.Sh SYNOPSIS 36.In sys/param.h 37.In sys/systm.h 38.In sys/mbuf.h 39.\" 40.Ss Mbuf allocation macros 41.Fn MGET "struct mbuf *mbuf" "int how" "short type" 42.Fn MGETHDR "struct mbuf *mbuf" "int how" "short type" 43.Fn MCLGET "struct mbuf *mbuf" "int how" 44.\" 45.Ss Mbuf utility macros 46.Ft void * 47.Fn mtod "struct mbuf *mbuf" "type" 48.Fn M_ALIGN "struct mbuf *mbuf" "u_int len" 49.Fn MH_ALIGN "struct mbuf *mbuf" "u_int len" 50.Ft int 51.Fn M_LEADINGSPACE "struct mbuf *mbuf" 52.Ft int 53.Fn M_TRAILINGSPACE "struct mbuf *mbuf" 54.Fn M_PREPEND "struct mbuf *mbuf" "int len" "int how" 55.\" 56.Ss Mbuf allocation functions 57.Ft struct mbuf * 58.Fn m_get "int how" "int type" 59.Ft struct mbuf * 60.Fn m_getm "struct mbuf *orig" "int len" "int how" "int type" 61.Ft struct mbuf * 62.Fn m_getclr "int how" "int type" 63.Ft struct mbuf * 64.Fn m_gethdr "int how" "int type" 65.Ft struct mbuf * 66.Fn m_free "struct mbuf *mbuf" 67.Ft void 68.Fn m_freem "struct mbuf *mbuf" 69.\" 70.Ss Mbuf utility functions 71.Ft void 72.Fn m_adj "struct mbuf *mbuf" "int len" 73.Ft struct mbuf * 74.Fn m_prepend "struct mbuf *mbuf" "int len" "int how" 75.Ft struct mbuf * 76.Fn m_pullup "struct mbuf *mbuf" "int len" 77.Ft struct mbuf * 78.Fn m_copym "const struct mbuf *mbuf" "int offset" "int len" "int how" 79.Ft struct mbuf * 80.Fn m_copypacket "struct mbuf *mbuf" "int how" 81.Ft struct mbuf * 82.Fn m_dup "struct mbuf *mbuf" "int how" 83.Ft void 84.Fn m_copydata "const struct mbuf *mbuf" "int offset" "int len" "caddr_t buf" 85.Ft void 86.Fn m_copyback "struct mbuf *mbuf" "int offset" "int len" "caddr_t buf" 87.Ft struct mbuf * 88.Fo m_devget 89.Fa "char *buf" 90.Fa "int len" 91.Fa "int offset" 92.Fa "struct ifnet *ifp" 93.Fa "void (*copy)(volatile const void *from, volatile void *to, size_t len)" 94.Fc 95.Ft void 96.Fn m_cat "struct mbuf *m" "struct mbuf *n" 97.Ft struct mbuf * 98.Fn m_split "struct mbuf *mbuf" "int len" "int how" 99.Ft struct mbuf * 100.Fn m_unshare "struct mbuf *mbuf" "int how" 101.\" 102.Sh DESCRIPTION 103An mbuf is a basic unit of memory management in the kernel IPC subsystem. 104Network packets and socket buffers are stored in mbufs. 105A network packet may span multiple mbufs arranged into a chain 106(linked list), 107which allows adding or trimming 108network headers with little overhead. 109.Pp 110While a developer should not bother with mbuf internals without serious 111reason in order to avoid incompatibilities with future changes, it 112is useful to understand the mbuf's general structure. 113.Pp 114An mbuf consists of a variable-sized header and a small internal 115buffer for data. 116The mbuf's total size, 117.Dv MSIZE , 118is a machine-dependent constant defined in 119.In machine/param.h . 120The mbuf header includes: 121.Pp 122.Bl -tag -width "m_nextpkt" -compact -offset indent 123.It Fa m_next 124a pointer to the next buffer in the chain 125.It Fa m_nextpkt 126a pointer to the next chain in the queue 127.It Fa m_data 128a pointer to the data 129.It Fa m_len 130the length of the data 131.It Fa m_type 132the type of data 133.It Fa m_flags 134the mbuf flags 135.El 136.Pp 137The mbuf flag bits are defined as follows: 138.Bd -literal 139/* mbuf flags */ 140#define M_EXT 0x0001 /* has associated external storage */ 141#define M_PKTHDR 0x0002 /* start of record */ 142#define M_EOR 0x0004 /* end of record */ 143#define M_PROTO1 0x0010 /* protocol-specific */ 144#define M_PROTO2 0x0020 /* protocol-specific */ 145#define M_PROTO3 0x0040 /* protocol-specific */ 146#define M_PROTO4 0x0080 /* protocol-specific */ 147#define M_PROTO5 0x0100 /* protocol-specific */ 148 149/* mbuf pkthdr flags, also in m_flags */ 150#define M_BCAST 0x0200 /* send/received as link-level broadcast */ 151#define M_MCAST 0x0400 /* send/received as link-level multicast */ 152#define M_FRAG 0x0800 /* packet is fragment of larger packet */ 153#define M_FIRSTFRAG 0x1000 /* packet is first fragment */ 154#define M_LASTFRAG 0x2000 /* packet is last fragment */ 155.Ed 156.Pp 157The available mbuf types are defined as follows: 158.Bd -literal 159/* mbuf types */ 160#define MT_FREE 0 /* should be on free list */ 161#define MT_DATA 1 /* dynamic (data) allocation */ 162#define MT_HEADER 2 /* packet header */ 163#define MT_SONAME 8 /* socket name */ 164#define MT_FTABLE 11 /* fragment reassembly header */ 165#define MT_CONTROL 14 /* extra-data protocol message */ 166#define MT_OOBDATA 15 /* expedited data */ 167.Ed 168.Pp 169If the 170.Dv M_PKTHDR 171flag is set, a 172.Li struct pkthdr m_pkthdr 173is added to the mbuf header. 174It contains a pointer to the interface 175the packet has been received from 176.Pq Fa struct ifnet *rcvif , 177and the total packet length 178.Pq Fa int len . 179.Pp 180If small enough, data is stored in the mbuf's internal data buffer. 181If the data is sufficiently large, another mbuf may be added to the chain, 182or external storage may be associated with the mbuf. 183.Dv MHLEN 184bytes of data can fit into an mbuf with the 185.Dv M_PKTHDR 186flag set, 187.Dv MLEN 188bytes can otherwise. 189.Pp 190If external storage is being associated with an mbuf, the 191.Dv m_ext 192header is added at the cost of losing the internal data buffer. 193It includes a pointer to external storage, the size of the storage, 194a pointer to a function used for freeing the storage, 195a pointer to an optional argument that can be passed to the function, 196and a pointer to a reference counter. 197An mbuf using external storage has the 198.Dv M_EXT 199flag set. 200.Pp 201The system supplies a default type of external storage buffer called an 202.Dq mbuf cluster . 203Mbuf clusters can be allocated and configured with the use of the 204.Dv MCLGET 205macro. 206Each cluster is 207.Dv MCLBYTES 208in size, where 209.Dv MCLBYTES 210is a machine-dependent constant. 211The system defines an advisory macro 212.Dv MINCLSIZE , 213which is the smallest amount of data to put into a cluster. 214It's equal to the sum of 215.Dv MLEN 216and 217.Dv MHLEN . 218It is typically preferable to store data into an mbuf's data region, if size 219permits, as opposed to allocating a separate mbuf cluster to hold the same 220data. 221.\" 222.Ss Macros and Functions 223There are numerous predefined macros and functions that provide the 224developer with common utilities. 225.\" 226.Bl -ohang -offset indent 227.It Fn mtod mbuf type 228Convert an mbuf pointer to a data pointer. 229The macro expands to the data pointer cast to the pointer of the specified type. 230.Sy Note : 231It is advisable to ensure that there is enough contiguous data in the mbuf. 232See 233.Fn m_pullup 234for details. 235.It Fn MGET mbuf how type 236Allocate an mbuf and initialize it to contain internal data. 237.Fa mbuf 238will point to the allocated mbuf on success, or be set to 239.Dv NULL 240on failure. 241The 242.Fa how 243argument is to be set to 244.Dv M_WAITOK 245or 246.Dv M_NOWAIT . 247It specifies whether the caller is willing to block if necessary. 248If 249.Fa how 250is set to 251.Dv M_WAITOK , 252a failed allocation will result in the caller being put 253to sleep for a designated 254.Va kern.ipc.mbuf_wait 255.Xr ( sysctl 8 256tunable) 257number of ticks. 258A number of other mbuf-related 259functions and macros have the same argument because they may 260at some point need to allocate new mbufs. 261.It Fn MGETHDR mbuf how type 262Allocate an mbuf and initialize it to contain a packet header 263and internal data. 264See 265.Fn MGET 266for details. 267.It Fn MCLGET mbuf how 268Allocate and attach an mbuf cluster to an mbuf. 269If the macro fails, the 270.Dv M_EXT 271flag won't be set in the mbuf. 272.It Fn M_PREPEND mbuf len how 273This macro operates on an mbuf chain. 274It is an optimized wrapper for 275.Fn m_prepend 276that can make use of possible empty space before data 277(e.g. left after trimming of a link-layer header). 278The new chain pointer or 279.Dv NULL 280is in 281.Fa mbuf 282after the call. 283.El 284.Pp 285The functions are: 286.Bl -ohang -offset indent 287.It Fn m_get how type 288A function version of 289.Fn MGET 290for non-critical paths. 291.It Fn m_getm orig len how type 292Allocate 293.Fa len 294bytes worth of mbufs and mbuf clusters if necessary and append the resulting 295allocated chain to the 296.Fa orig 297mbuf chain, if it is 298.No non- Ns Dv NULL . 299If the allocation fails at any point, 300free whatever was allocated and return 301.Dv NULL . 302If 303.Fa orig 304is 305.No non- Ns Dv NULL , 306it will not be freed. 307It is possible to use 308.Fn m_getm 309to either append 310.Fa len 311bytes to an existing mbuf or mbuf chain 312(for example, one which may be sitting in a pre-allocated ring) 313or to simply perform an all-or-nothing mbuf and mbuf cluster allocation. 314.It Fn m_gethdr how type 315A function version of 316.Fn MGETHDR 317for non-critical paths. 318.It Fn m_getclr how type 319Allocate an mbuf and zero out the data region. 320.El 321.Pp 322The functions below operate on mbuf chains. 323.Bl -ohang -offset indent 324.It Fn m_freem mbuf 325Free an entire mbuf chain, including any external 326storage. 327.\" 328.It Fn m_adj mbuf len 329Trim 330.Fa len 331bytes from the head of an mbuf chain if 332.Fa len 333is positive, from the tail otherwise. 334.\" 335.It Fn m_prepend mbuf len how 336Allocate a new mbuf and prepend it to the chain, handle 337.Dv M_PKTHDR 338properly. 339.Sy Note : 340It doesn't allocate any clusters, so 341.Fa len 342must be less than 343.Dv MLEN 344or 345.Dv MHLEN , 346depending on the 347.Dv M_PKTHDR 348flag setting. 349.\" 350.It Fn m_pullup mbuf len 351Arrange that the first 352.Fa len 353bytes of an mbuf chain are contiguous and lay in the data area of 354.Fa mbuf , 355so they are accessible with 356.Fn mtod mbuf type . 357Return the new chain on success, 358.Dv NULL 359on failure 360(the chain is freed in this case). 361.Sy Note : 362It doesn't allocate any clusters, so 363.Fa len 364must be less than 365.Dv MHLEN . 366.\" 367.It Fn m_copym mbuf offset len how 368Make a copy of an mbuf chain starting 369.Fa offset 370bytes from the beginning, continuing for 371.Fa len 372bytes. 373If 374.Fa len 375is 376.Dv M_COPYALL , 377copy to the end of the mbuf chain. 378.Sy Note : 379The copy is read-only, because clusters are not 380copied, only their reference counts are incremented. 381.\" 382.It Fn m_copypacket mbuf how 383Copy an entire packet including header, which must be present. 384This is an optimized version of the common case 385.Fn m_copym mbuf 0 M_COPYALL how . 386.Sy Note : 387the copy is read-only, because clusters are not 388copied, only their reference counts are incremented. 389.\" 390.It Fn m_dup mbuf how 391Copy a packet header mbuf chain into a completely new chain, including 392copying any mbuf clusters. 393Use this instead of 394.Fn m_copypacket 395when you need a writable copy of an mbuf chain. 396.\" 397.It Fn m_copydata mbuf offset len buf 398Copy data from an mbuf chain starting 399.Fa off 400bytes from the beginning, continuing for 401.Fa len 402bytes, into the indicated buffer 403.Fa buf . 404.\" 405.It Fn m_copyback mbuf offset len buf 406Copy 407.Fa len 408bytes from the buffer 409.Fa buf 410back into the indicated mbuf chain, 411starting at 412.Fa offset 413bytes from the beginning of the chain, extending the mbuf chain if necessary. 414.Sy Note : 415It doesn't allocate any clusters, just adds mbufs to the chain. 416It's safe to set 417.Fa offset 418beyond the current chain end: zeroed mbufs will be allocated to fill the 419space. 420.\" 421.It Fn m_devget buf len offset ifp copy 422Copy data from a device local memory pointed to by 423.Fa buf 424to an mbuf chain. 425The copy is done using a specified copy routine 426.Fa copy , 427or 428.Fn bcopy 429if 430.Fa copy 431is 432.Dv NULL . 433.\" 434.It Fn m_cat m n 435Concatenate 436.Fa n 437to 438.Fa m . 439Both chains must be of the same type. 440.Fa N 441is still valid after the function returned. 442.Sy Note : 443It does not handle 444.Dv M_PKTHDR 445and friends. 446.\" 447.It Fn m_split mbuf len how 448Partition an mbuf chain in two pieces, returning the tail: 449all but the first 450.Fa len 451bytes. 452In case of failure, it returns 453.Dv NULL 454and attempts to restore the chain to its original state. 455.It Fn m_unshare mbuf how 456Create a version of the specified mbuf chain whose 457contents can be safely modified without affecting other users. 458If allocation fails and this operation can not be completed, 459.Dv NULL 460will be returned. 461The original mbuf chain is always reclaimed and the reference 462count of any shared mbuf clusters is decremented. 463As a side-effect of this process the returned 464mbuf chain may be compacted. 465.Pp 466This function is especially useful in the transmit path of 467network code, when data must be encrypted or otherwise 468altered prior to transmission. 469. 470.El 471.Sh STRESS TESTING 472When running a kernel compiled with the option 473.Dv MBUF_STRESS_TEST , 474the following 475.Xr sysctl 8 Ns 476-controlled options may be used to create 477various failure/extreme cases for testing of network drivers 478and other parts of the kernel that rely on 479.Vt mbufs . 480.Bl -tag -width ident 481.It Va net.inet.ip.mbuf_frag_size 482Causes 483.Fn ip_output 484to fragment outgoing 485.Vt mbuf chains 486into fragments of the specified size. 487Setting this variable to 1 is an excellent way to 488test the long 489.Vt mbuf chain 490handling ability of network drivers. 491.It Va kern.ipc.m_defragrandomfailures 492Causes the function 493.Fn m_defrag 494to randomly fail, returning 495.Dv NULL . 496Any piece of code which uses 497.Fn m_defrag 498should be tested with this feature. 499.El 500.Sh RETURN VALUES 501See above. 502.Sh HISTORY 503.\" Please correct me if I'm wrong 504Mbufs appeared in an early version of 505.Bx . 506Besides for being used for network packets, they were used 507to store various dynamic structures, such as routing table 508entries, interface addresses, protocol control blocks, etc. 509.Sh AUTHORS 510The original 511.Nm 512man page was written by Yar Tikhiy. 513