1.\" Copyright (c) 2000 FreeBSD Inc. 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 13.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 14.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 15.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 16.\" ARE DISCLAIMED. IN NO EVENT SHALL [your name] OR CONTRIBUTORS BE LIABLE 17.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 20.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 21.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 22.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 23.\" SUCH DAMAGE. 24.\" 25.\" $FreeBSD: src/share/man/man9/mbuf.9,v 1.27.2.1 2003/05/28 13:53:18 yar Exp $ 26.\" 27.Dd September 17, 2010 28.Dt MBUF 9 29.Os 30.\" 31.Sh NAME 32.Nm mbuf 33.Nd "memory management in the kernel IPC subsystem" 34.\" 35.Sh SYNOPSIS 36.In sys/param.h 37.In sys/systm.h 38.In sys/mbuf.h 39.\" 40.Ss Mbuf allocation macros 41.Fn MGET "struct mbuf *mbuf" "int how" "short type" 42.Fn MGETHDR "struct mbuf *mbuf" "int how" "short type" 43.Fn MCLGET "struct mbuf *mbuf" "int how" 44.\" 45.Ss Mbuf utility macros 46.Ft void * 47.Fn mtod "struct mbuf *mbuf" "type" 48.Fn M_ALIGN "struct mbuf *mbuf" "u_int len" 49.Fn MH_ALIGN "struct mbuf *mbuf" "u_int len" 50.Ft int 51.Fn M_LEADINGSPACE "struct mbuf *mbuf" 52.Ft int 53.Fn M_TRAILINGSPACE "struct mbuf *mbuf" 54.Fn M_PREPEND "struct mbuf *mbuf" "int len" "int how" 55.\" 56.Ss Mbuf allocation functions 57.Ft struct mbuf * 58.Fn m_get "int how" "int type" 59.Ft struct mbuf * 60.Fn m_getm "struct mbuf *orig" "int len" "int how" "int type" 61.Ft struct mbuf * 62.Fn m_getclr "int how" "int type" 63.Ft struct mbuf * 64.Fn m_gethdr "int how" "int type" 65.Ft struct mbuf * 66.Fn m_free "struct mbuf *mbuf" 67.Ft void 68.Fn m_freem "struct mbuf *mbuf" 69.\" 70.Ss Mbuf utility functions 71.Ft void 72.Fn m_adj "struct mbuf *mbuf" "int len" 73.Ft struct mbuf * 74.Fn m_prepend "struct mbuf *mbuf" "int len" "int how" 75.Ft struct mbuf * 76.Fn m_pullup "struct mbuf *mbuf" "int len" 77.Ft struct mbuf * 78.Fn m_copym "const struct mbuf *mbuf" "int offset" "int len" "int how" 79.Ft struct mbuf * 80.Fn m_copypacket "struct mbuf *mbuf" "int how" 81.Ft struct mbuf * 82.Fn m_dup "struct mbuf *mbuf" "int how" 83.Ft void 84.Fn m_copydata "const struct mbuf *mbuf" "int offset" "int len" "caddr_t buf" 85.Ft void 86.Fn m_copyback "struct mbuf *mbuf" "int offset" "int len" "caddr_t buf" 87.Ft struct mbuf * 88.Fo m_devget 89.Fa "char *buf" 90.Fa "int len" 91.Fa "int offset" 92.Fa "struct ifnet *ifp" 93.Fa "void (*copy)(volatile const void *from, volatile void *to, size_t len)" 94.Fc 95.Ft void 96.Fn m_cat "struct mbuf *m" "struct mbuf *n" 97.Ft struct mbuf * 98.Fn m_split "struct mbuf *mbuf" "int len" "int how" 99.Ft struct mbuf * 100.Fn m_unshare "struct mbuf *mbuf" "int how" 101.\" 102.Sh DESCRIPTION 103An mbuf is a basic unit of memory management in the kernel IPC subsystem. 104Network packets and socket buffers are stored in mbufs. 105A network packet may span multiple mbufs arranged into a chain 106(linked list), 107which allows adding or trimming 108network headers with little overhead. 109.Pp 110While a developer should not bother with mbuf internals without serious 111reason in order to avoid incompatibilities with future changes, it 112is useful to understand the mbuf's general structure. 113.Pp 114An mbuf consists of a variable-sized header and a small internal 115buffer for data. 116The mbuf's total size, 117.Dv MSIZE , 118is a machine-dependent constant defined in 119.In machine/param.h . 120The mbuf header includes: 121.Pp 122.Bl -tag -width "m_nextpkt" -compact -offset indent 123.It Fa m_next 124a pointer to the next buffer in the chain 125.It Fa m_nextpkt 126a pointer to the next chain in the queue 127.It Fa m_data 128a pointer to the data 129.It Fa m_len 130the length of the data 131.It Fa m_type 132the type of data 133.It Fa m_flags 134the mbuf flags 135.El 136.Pp 137The mbuf flag bits are defined as follows: 138.Bd -literal 139/* mbuf flags */ 140#define M_EXT 0x0001 /* has associated external storage */ 141#define M_PKTHDR 0x0002 /* start of record */ 142#define M_EOR 0x0004 /* end of record */ 143#define M_PROTO1 0x0010 /* protocol-specific */ 144#define M_PROTO2 0x0020 /* protocol-specific */ 145#define M_PROTO3 0x0040 /* protocol-specific */ 146#define M_PROTO4 0x0080 /* protocol-specific */ 147#define M_PROTO5 0x0100 /* protocol-specific */ 148 149/* mbuf pkthdr flags, also in m_flags */ 150#define M_BCAST 0x0200 /* send/received as link-level broadcast */ 151#define M_MCAST 0x0400 /* send/received as link-level multicast */ 152#define M_FRAG 0x0800 /* packet is fragment of larger packet */ 153#define M_FIRSTFRAG 0x1000 /* packet is first fragment */ 154#define M_LASTFRAG 0x2000 /* packet is last fragment */ 155.Ed 156.Pp 157The available mbuf types are defined as follows: 158.Bd -literal 159/* mbuf types */ 160#define MT_FREE 0 /* should be on free list */ 161#define MT_DATA 1 /* dynamic (data) allocation */ 162#define MT_HEADER 2 /* packet header */ 163#define MT_SONAME 8 /* socket name */ 164#define MT_FTABLE 11 /* fragment reassembly header */ 165#define MT_CONTROL 14 /* extra-data protocol message */ 166#define MT_OOBDATA 15 /* expedited data */ 167.Ed 168.Pp 169If the 170.Dv M_PKTHDR 171flag is set, a 172.Li struct pkthdr m_pkthdr 173is added to the mbuf header. 174It contains a pointer to the interface 175the packet has been received from 176.Pq Fa struct ifnet *rcvif , 177and the total packet length 178.Pq Fa int len . 179.Pp 180If small enough, data is stored in the mbuf's internal data buffer. 181If the data is sufficiently large, another mbuf may be added to the chain, 182or external storage may be associated with the mbuf. 183.Dv MHLEN 184bytes of data can fit into an mbuf with the 185.Dv M_PKTHDR 186flag set, 187.Dv MLEN 188bytes can otherwise. 189.Pp 190If external storage is being associated with an mbuf, the 191.Dv m_ext 192header is added at the cost of losing the internal data buffer. 193It includes a pointer to external storage, the size of the storage, 194a pointer to a function used for freeing the storage, 195a pointer to an optional argument that can be passed to the function, 196and a pointer to a reference counter. 197An mbuf using external storage has the 198.Dv M_EXT 199flag set. 200.Pp 201The system supplies a default type of external storage buffer called an 202.Dq mbuf cluster . 203Mbuf clusters can be allocated and configured with the use of the 204.Dv MCLGET 205macro. 206Each cluster is 207.Dv MCLBYTES 208in size, where 209.Dv MCLBYTES 210is a machine-dependent constant. 211The system defines an advisory macro 212.Dv MINCLSIZE , 213which is the smallest amount of data to put into a cluster. 214It's equal to the sum of 215.Dv MLEN 216and 217.Dv MHLEN . 218It is typically preferable to store data into an mbuf's data region, if size 219permits, as opposed to allocating a separate mbuf cluster to hold the same 220data. 221.\" 222.Ss Macros and Functions 223There are numerous predefined macros and functions that provide the 224developer with common utilities. 225.\" 226.Bl -ohang -offset indent 227.It Fn mtod mbuf type 228Convert an mbuf pointer to a data pointer. 229The macro expands to the data pointer cast to the pointer of the specified type. 230.Sy Note : 231It is advisable to ensure that there is enough contiguous data in the mbuf. 232See 233.Fn m_pullup 234for details. 235.It Fn MGET mbuf how type 236Allocate an mbuf and initialize it to contain internal data. 237.Fa mbuf 238will point to the allocated mbuf on success, or be set to 239.Dv NULL 240on failure. 241The 242.Fa how 243argument is to be set to 244.Dv MB_WAIT 245or 246.Dv MB_DONTWAIT . 247It specifies whether the caller is willing to block if necessary. 248If 249.Fa how 250is set to 251.Dv MB_WAIT , 252a failed allocation will result in the caller being put 253to sleep for a designated 254.Va kern.ipc.mbuf_wait 255.Xr ( sysctl 8 256tunable) 257number of ticks. 258A number of other mbuf-related 259functions and macros have the same argument because they may 260at some point need to allocate new mbufs. 261.Pp 262Programmers should be careful not to confuse the mbuf allocation flag 263.Dv MB_DONTWAIT 264with the 265.Xr kmalloc 9 266allocation flag, 267.Dv M_NOWAIT . 268They are not the same. 269.It Fn MGETHDR mbuf how type 270Allocate an mbuf and initialize it to contain a packet header 271and internal data. 272See 273.Fn MGET 274for details. 275.It Fn MCLGET mbuf how 276Allocate and attach an mbuf cluster to an mbuf. 277If the macro fails, the 278.Dv M_EXT 279flag won't be set in the mbuf. 280.It Fn M_PREPEND mbuf len how 281This macro operates on an mbuf chain. 282It is an optimized wrapper for 283.Fn m_prepend 284that can make use of possible empty space before data 285(e.g. left after trimming of a link-layer header). 286The new chain pointer or 287.Dv NULL 288is in 289.Fa mbuf 290after the call. 291.El 292.Pp 293The functions are: 294.Bl -ohang -offset indent 295.It Fn m_get how type 296A function version of 297.Fn MGET 298for non-critical paths. 299.It Fn m_getm orig len how type 300Allocate 301.Fa len 302bytes worth of mbufs and mbuf clusters if necessary and append the resulting 303allocated chain to the 304.Fa orig 305mbuf chain, if it is 306.No non- Ns Dv NULL . 307If the allocation fails at any point, 308free whatever was allocated and return 309.Dv NULL . 310If 311.Fa orig 312is 313.No non- Ns Dv NULL , 314it will not be freed. 315It is possible to use 316.Fn m_getm 317to either append 318.Fa len 319bytes to an existing mbuf or mbuf chain 320(for example, one which may be sitting in a pre-allocated ring) 321or to simply perform an all-or-nothing mbuf and mbuf cluster allocation. 322.It Fn m_gethdr how type 323A function version of 324.Fn MGETHDR 325for non-critical paths. 326.It Fn m_getclr how type 327Allocate an mbuf and zero out the data region. 328.El 329.Pp 330The functions below operate on mbuf chains. 331.Bl -ohang -offset indent 332.It Fn m_freem mbuf 333Free an entire mbuf chain, including any external 334storage. 335.\" 336.It Fn m_adj mbuf len 337Trim 338.Fa len 339bytes from the head of an mbuf chain if 340.Fa len 341is positive, from the tail otherwise. 342.\" 343.It Fn m_prepend mbuf len how 344Allocate a new mbuf and prepend it to the chain, handle 345.Dv M_PKTHDR 346properly. 347.Sy Note : 348It doesn't allocate any clusters, so 349.Fa len 350must be less than 351.Dv MLEN 352or 353.Dv MHLEN , 354depending on the 355.Dv M_PKTHDR 356flag setting. 357.\" 358.It Fn m_pullup mbuf len 359Arrange that the first 360.Fa len 361bytes of an mbuf chain are contiguous and lay in the data area of 362.Fa mbuf , 363so they are accessible with 364.Fn mtod mbuf type . 365Return the new chain on success, 366.Dv NULL 367on failure 368(the chain is freed in this case). 369.Sy Note : 370It doesn't allocate any clusters, so 371.Fa len 372must be less than 373.Dv MHLEN . 374.\" 375.It Fn m_copym mbuf offset len how 376Make a copy of an mbuf chain starting 377.Fa offset 378bytes from the beginning, continuing for 379.Fa len 380bytes. 381If 382.Fa len 383is 384.Dv M_COPYALL , 385copy to the end of the mbuf chain. 386.Sy Note : 387The copy is read-only, because clusters are not 388copied, only their reference counts are incremented. 389.\" 390.It Fn m_copypacket mbuf how 391Copy an entire packet including header, which must be present. 392This is an optimized version of the common case 393.Fn m_copym mbuf 0 M_COPYALL how . 394.Sy Note : 395the copy is read-only, because clusters are not 396copied, only their reference counts are incremented. 397.\" 398.It Fn m_dup mbuf how 399Copy a packet header mbuf chain into a completely new chain, including 400copying any mbuf clusters. 401Use this instead of 402.Fn m_copypacket 403when you need a writable copy of an mbuf chain. 404.\" 405.It Fn m_copydata mbuf offset len buf 406Copy data from an mbuf chain starting 407.Fa off 408bytes from the beginning, continuing for 409.Fa len 410bytes, into the indicated buffer 411.Fa buf . 412.\" 413.It Fn m_copyback mbuf offset len buf 414Copy 415.Fa len 416bytes from the buffer 417.Fa buf 418back into the indicated mbuf chain, 419starting at 420.Fa offset 421bytes from the beginning of the chain, extending the mbuf chain if necessary. 422.Sy Note : 423It doesn't allocate any clusters, just adds mbufs to the chain. 424It's safe to set 425.Fa offset 426beyond the current chain end: zeroed mbufs will be allocated to fill the 427space. 428.\" 429.It Fn m_devget buf len offset ifp copy 430Copy data from a device local memory pointed to by 431.Fa buf 432to an mbuf chain. 433The copy is done using a specified copy routine 434.Fa copy , 435or 436.Fn bcopy 437if 438.Fa copy 439is 440.Dv NULL . 441.\" 442.It Fn m_cat m n 443Concatenate 444.Fa n 445to 446.Fa m . 447Both chains must be of the same type. 448.Fa N 449is still valid after the function returned. 450.Sy Note : 451It does not handle 452.Dv M_PKTHDR 453and friends. 454.\" 455.It Fn m_split mbuf len how 456Partition an mbuf chain in two pieces, returning the tail: 457all but the first 458.Fa len 459bytes. 460In case of failure, it returns 461.Dv NULL 462and attempts to restore the chain to its original state. 463.It Fn m_unshare mbuf how 464Create a version of the specified mbuf chain whose 465contents can be safely modified without affecting other users. 466If allocation fails and this operation can not be completed, 467.Dv NULL 468will be returned. 469The original mbuf chain is always reclaimed and the reference 470count of any shared mbuf clusters is decremented. 471As a side-effect of this process the returned 472mbuf chain may be compacted. 473.Pp 474This function is especially useful in the transmit path of 475network code, when data must be encrypted or otherwise 476altered prior to transmission. 477. 478.El 479.Sh STRESS TESTING 480When running a kernel compiled with the option 481.Dv MBUF_STRESS_TEST , 482the following 483.Xr sysctl 8 Ns 484-controlled options may be used to create 485various failure/extreme cases for testing of network drivers 486and other parts of the kernel that rely on 487.Vt mbufs . 488.Bl -tag -width ident 489.It Va net.inet.ip.mbuf_frag_size 490Causes 491.Fn ip_output 492to fragment outgoing 493.Vt mbuf chains 494into fragments of the specified size. 495Setting this variable to 1 is an excellent way to 496test the long 497.Vt mbuf chain 498handling ability of network drivers. 499.It Va kern.ipc.m_defragrandomfailures 500Causes the function 501.Fn m_defrag 502to randomly fail, returning 503.Dv NULL . 504Any piece of code which uses 505.Fn m_defrag 506should be tested with this feature. 507.El 508.Sh RETURN VALUES 509See above. 510.Sh HISTORY 511.\" Please correct me if I'm wrong 512Mbufs appeared in an early version of 513.Bx . 514Besides for being used for network packets, they were used 515to store various dynamic structures, such as routing table 516entries, interface addresses, protocol control blocks, etc. 517.Sh AUTHORS 518The original 519.Nm 520man page was written by Yar Tikhiy. 521