1.\" Copyright (c) 2000 FreeBSD Inc. 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 13.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 14.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 15.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 16.\" ARE DISCLAIMED. IN NO EVENT SHALL [your name] OR CONTRIBUTORS BE LIABLE 17.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 20.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 21.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 22.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 23.\" SUCH DAMAGE. 24.\" 25.\" $FreeBSD: src/share/man/man9/mbuf.9,v 1.27.2.1 2003/05/28 13:53:18 yar Exp $ 26.\" 27.Dd November 6, 2023 28.Dt MBUF 9 29.Os 30.\" 31.Sh NAME 32.Nm mbuf 33.Nd "memory management in the kernel IPC subsystem" 34.\" 35.Sh SYNOPSIS 36.In sys/param.h 37.In sys/systm.h 38.In sys/mbuf.h 39.\" 40.Ss Mbuf allocation macros 41.Fn MGET "struct mbuf *mbuf" "int how" "short type" 42.Fn MGETHDR "struct mbuf *mbuf" "int how" "short type" 43.Fn MCLGET "struct mbuf *mbuf" "int how" 44.\" 45.Ss Mbuf utility macros 46.Ft void * 47.Fn mtod "struct mbuf *mbuf" "type" 48.Fn M_ALIGN "struct mbuf *mbuf" "u_int len" 49.Fn MH_ALIGN "struct mbuf *mbuf" "u_int len" 50.Ft int 51.Fn M_LEADINGSPACE "struct mbuf *mbuf" 52.Ft int 53.Fn M_TRAILINGSPACE "struct mbuf *mbuf" 54.Fn M_PREPEND "struct mbuf *mbuf" "int len" "int how" 55.\" 56.Ss Mbuf allocation functions 57.Ft struct mbuf * 58.Fn m_get "int how" "int type" 59.Ft struct mbuf * 60.Fn m_getm "struct mbuf *orig" "int len" "int how" "int type" 61.Ft struct mbuf * 62.Fn m_getclr "int how" "int type" 63.Ft struct mbuf * 64.Fn m_gethdr "int how" "int type" 65.Ft struct mbuf * 66.Fn m_free "struct mbuf *mbuf" 67.Ft void 68.Fn m_freem "struct mbuf *mbuf" 69.\" 70.Ss Mbuf utility functions 71.Ft void 72.Fn m_adj "struct mbuf *mbuf" "int len" 73.Ft struct mbuf * 74.Fn m_prepend "struct mbuf *mbuf" "int len" "int how" 75.Ft struct mbuf * 76.Fn m_pullup "struct mbuf *mbuf" "int len" 77.Ft struct mbuf * 78.Fn m_copym "const struct mbuf *mbuf" "int offset" "int len" "int how" 79.Ft struct mbuf * 80.Fn m_copypacket "struct mbuf *mbuf" "int how" 81.Ft struct mbuf * 82.Fn m_dup "struct mbuf *mbuf" "int how" 83.Ft void 84.Fn m_copydata "const struct mbuf *mbuf" "int offset" "int len" "caddr_t buf" 85.Ft void 86.Fn m_copyback "struct mbuf *mbuf" "int offset" "int len" "caddr_t buf" 87.Ft struct mbuf * 88.Fo m_devget 89.Fa "char *buf" 90.Fa "int len" 91.Fa "int offset" 92.Fa "struct ifnet *ifp" 93.Fc 94.Ft void 95.Fn m_cat "struct mbuf *m" "struct mbuf *n" 96.Ft struct mbuf * 97.Fn m_split "struct mbuf *mbuf" "int len" "int how" 98.Ft struct mbuf * 99.Fn m_unshare "struct mbuf *mbuf" "int how" 100.\" 101.Sh DESCRIPTION 102An mbuf is a basic unit of memory management in the kernel IPC subsystem. 103Network packets and socket buffers are stored in mbufs. 104A network packet may span multiple mbufs arranged into a chain 105(linked list), 106which allows adding or trimming 107network headers with little overhead. 108.Pp 109While a developer should not bother with mbuf internals without serious 110reason in order to avoid incompatibilities with future changes, it 111is useful to understand the mbuf's general structure. 112.Pp 113An mbuf consists of a variable-sized header and a small internal 114buffer for data. 115The mbuf's total size, 116.Dv MSIZE , 117is a machine-dependent constant defined in 118.In machine/param.h . 119The mbuf header includes: 120.Pp 121.Bl -tag -width "m_nextpkt" -compact -offset indent 122.It Fa m_next 123a pointer to the next buffer in the chain 124.It Fa m_nextpkt 125a pointer to the next chain in the queue 126.It Fa m_data 127a pointer to the data 128.It Fa m_len 129the length of the data 130.It Fa m_type 131the type of data 132.It Fa m_flags 133the mbuf flags 134.El 135.Pp 136The mbuf flag bits are defined as follows: 137.Bd -literal 138/* mbuf flags */ 139#define M_EXT 0x0001 /* has associated external storage */ 140#define M_PKTHDR 0x0002 /* start of record */ 141#define M_EOR 0x0004 /* end of record */ 142#define M_PROTO1 0x0010 /* protocol-specific */ 143#define M_PROTO2 0x0020 /* protocol-specific */ 144#define M_PROTO3 0x0040 /* protocol-specific */ 145#define M_PROTO4 0x0080 /* protocol-specific */ 146#define M_PROTO5 0x0100 /* protocol-specific */ 147 148/* mbuf pkthdr flags, also in m_flags */ 149#define M_BCAST 0x0200 /* send/received as link-level broadcast */ 150#define M_MCAST 0x0400 /* send/received as link-level multicast */ 151#define M_FRAG 0x0800 /* packet is fragment of larger packet */ 152#define M_FIRSTFRAG 0x1000 /* packet is first fragment */ 153#define M_LASTFRAG 0x2000 /* packet is last fragment */ 154.Ed 155.Pp 156The available mbuf types are defined as follows: 157.Bd -literal 158/* mbuf types */ 159#define MT_FREE 0 /* should be on free list */ 160#define MT_DATA 1 /* dynamic (data) allocation */ 161#define MT_HEADER 2 /* packet header */ 162#define MT_SONAME 8 /* socket name */ 163#define MT_FTABLE 11 /* fragment reassembly header */ 164#define MT_CONTROL 14 /* extra-data protocol message */ 165#define MT_OOBDATA 15 /* expedited data */ 166.Ed 167.Pp 168If the 169.Dv M_PKTHDR 170flag is set, a 171.Li struct pkthdr m_pkthdr 172is added to the mbuf header. 173It contains a pointer to the interface 174the packet has been received from 175.Pq Fa struct ifnet *rcvif , 176and the total packet length 177.Pq Fa int len . 178.Pp 179If small enough, data is stored in the mbuf's internal data buffer. 180If the data is sufficiently large, another mbuf may be added to the chain, 181or external storage may be associated with the mbuf. 182.Dv MHLEN 183bytes of data can fit into an mbuf with the 184.Dv M_PKTHDR 185flag set, 186.Dv MLEN 187bytes can otherwise. 188.Pp 189If external storage is being associated with an mbuf, the 190.Dv m_ext 191header is added at the cost of losing the internal data buffer. 192It includes a pointer to external storage, the size of the storage, 193a pointer to a function used for freeing the storage, 194a pointer to an optional argument that can be passed to the function, 195and a pointer to a reference counter. 196An mbuf using external storage has the 197.Dv M_EXT 198flag set. 199.Pp 200The system supplies a default type of external storage buffer called an 201.Dq mbuf cluster . 202Mbuf clusters can be allocated and configured with the use of the 203.Dv MCLGET 204macro. 205Each cluster is 206.Dv MCLBYTES 207in size, where 208.Dv MCLBYTES 209is a machine-dependent constant. 210The system defines an advisory macro 211.Dv MINCLSIZE , 212which is the smallest amount of data to put into a cluster. 213It's equal to the sum of 214.Dv MLEN 215and 216.Dv MHLEN . 217It is typically preferable to store data into an mbuf's data region, if size 218permits, as opposed to allocating a separate mbuf cluster to hold the same 219data. 220.\" 221.Ss Macros and Functions 222There are numerous predefined macros and functions that provide the 223developer with common utilities. 224.\" 225.Bl -ohang -offset indent 226.It Fn mtod mbuf type 227Convert an mbuf pointer to a data pointer. 228The macro expands to the data pointer cast to the pointer of the specified type. 229.Sy Note : 230It is advisable to ensure that there is enough contiguous data in the mbuf. 231See 232.Fn m_pullup 233for details. 234.It Fn MGET mbuf how type 235Allocate an mbuf and initialize it to contain internal data. 236.Fa mbuf 237will point to the allocated mbuf on success, or be set to 238.Dv NULL 239on failure. 240The 241.Fa how 242argument is to be set to 243.Dv M_WAITOK 244or 245.Dv M_NOWAIT . 246If 247.Fa how 248is 249.Dv M_WAITOK , 250this macro will await resources if necessary; 251if 252.Fa how 253is 254.Dv M_NOWAIT 255and resources are not available, this macro fails. 256A number of other mbuf-related 257functions and macros have the same argument because they may 258at some point need to allocate new mbufs. 259.It Fn MGETHDR mbuf how type 260Allocate an mbuf and initialize it to contain a packet header 261and internal data. 262See 263.Fn MGET 264for details. 265.It Fn MCLGET mbuf how 266Allocate and attach an mbuf cluster to an mbuf. 267If the macro fails, the 268.Dv M_EXT 269flag won't be set in the mbuf. 270.It Fn M_PREPEND mbuf len how 271This macro operates on an mbuf chain. 272It is an optimized wrapper for 273.Fn m_prepend 274that can make use of possible empty space before data 275(e.g. left after trimming of a link-layer header). 276The new chain pointer or 277.Dv NULL 278is in 279.Fa mbuf 280after the call. 281.El 282.Pp 283The functions are: 284.Bl -ohang -offset indent 285.It Fn m_get how type 286A function version of 287.Fn MGET 288for non-critical paths. 289.It Fn m_getm orig len how type 290Allocate 291.Fa len 292bytes worth of mbufs and mbuf clusters if necessary and append the resulting 293allocated chain to the 294.Fa orig 295mbuf chain, if it is 296.No non- Ns Dv NULL . 297If the allocation fails at any point, 298free whatever was allocated and return 299.Dv NULL . 300If 301.Fa orig 302is 303.No non- Ns Dv NULL , 304it will not be freed. 305It is possible to use 306.Fn m_getm 307to either append 308.Fa len 309bytes to an existing mbuf or mbuf chain 310(for example, one which may be sitting in a pre-allocated ring) 311or to simply perform an all-or-nothing mbuf and mbuf cluster allocation. 312.It Fn m_gethdr how type 313A function version of 314.Fn MGETHDR 315for non-critical paths. 316.It Fn m_getclr how type 317Allocate an mbuf and zero out the data region. 318.El 319.Pp 320The functions below operate on mbuf chains. 321.Bl -ohang -offset indent 322.It Fn m_freem mbuf 323Free an entire mbuf chain, including any external 324storage. 325.\" 326.It Fn m_adj mbuf len 327Trim 328.Fa len 329bytes from the head of an mbuf chain if 330.Fa len 331is positive, from the tail otherwise. 332.\" 333.It Fn m_prepend mbuf len how 334Allocate a new mbuf and prepend it to the chain, handle 335.Dv M_PKTHDR 336properly. 337.Sy Note : 338It doesn't allocate any clusters, so 339.Fa len 340must be less than 341.Dv MLEN 342or 343.Dv MHLEN , 344depending on the 345.Dv M_PKTHDR 346flag setting. 347.\" 348.It Fn m_pullup mbuf len 349Arrange that the first 350.Fa len 351bytes of an mbuf chain are contiguous and lay in the data area of 352.Fa mbuf , 353so they are accessible with 354.Fn mtod mbuf type . 355Return the new chain on success, 356.Dv NULL 357on failure 358(the chain is freed in this case). 359.Sy Note : 360It doesn't allocate any clusters, so 361.Fa len 362must be less than 363.Dv MHLEN . 364.\" 365.It Fn m_copym mbuf offset len how 366Make a copy of an mbuf chain starting 367.Fa offset 368bytes from the beginning, continuing for 369.Fa len 370bytes. 371If 372.Fa len 373is 374.Dv M_COPYALL , 375copy to the end of the mbuf chain. 376.Sy Note : 377The copy is read-only, because clusters are not 378copied, only their reference counts are incremented. 379.\" 380.It Fn m_copypacket mbuf how 381Copy an entire packet including header, which must be present. 382This is an optimized version of the common case 383.Fn m_copym mbuf 0 M_COPYALL how . 384.Sy Note : 385the copy is read-only, because clusters are not 386copied, only their reference counts are incremented. 387.\" 388.It Fn m_dup mbuf how 389Copy a packet header mbuf chain into a completely new chain, including 390copying any mbuf clusters. 391Use this instead of 392.Fn m_copypacket 393when you need a writable copy of an mbuf chain. 394.\" 395.It Fn m_copydata mbuf offset len buf 396Copy data from an mbuf chain starting 397.Fa off 398bytes from the beginning, continuing for 399.Fa len 400bytes, into the indicated buffer 401.Fa buf . 402.\" 403.It Fn m_copyback mbuf offset len buf 404Copy 405.Fa len 406bytes from the buffer 407.Fa buf 408back into the indicated mbuf chain, 409starting at 410.Fa offset 411bytes from the beginning of the chain, extending the mbuf chain if necessary. 412.Sy Note : 413It doesn't allocate any clusters, just adds mbufs to the chain. 414It's safe to set 415.Fa offset 416beyond the current chain end: zeroed mbufs will be allocated to fill the 417space. 418.\" 419.It Fn m_devget buf len offset ifp 420Copy data from a device local memory pointed to by 421.Fa buf 422to an mbuf chain, using 423.Fn bcopy . 424.\" 425.It Fn m_cat m n 426Concatenate 427.Fa n 428to 429.Fa m . 430Both chains must be of the same type. 431.Fa N 432is still valid after the function returned. 433.Sy Note : 434It does not handle 435.Dv M_PKTHDR 436and friends. 437.\" 438.It Fn m_split mbuf len how 439Partition an mbuf chain in two pieces, returning the tail: 440all but the first 441.Fa len 442bytes. 443In case of failure, it returns 444.Dv NULL 445and attempts to restore the chain to its original state. 446.It Fn m_unshare mbuf how 447Create a version of the specified mbuf chain whose 448contents can be safely modified without affecting other users. 449If allocation fails and this operation can not be completed, 450.Dv NULL 451will be returned. 452The original mbuf chain is always reclaimed and the reference 453count of any shared mbuf clusters is decremented. 454As a side-effect of this process the returned 455mbuf chain may be compacted. 456.Pp 457This function is especially useful in the transmit path of 458network code, when data must be encrypted or otherwise 459altered prior to transmission. 460. 461.El 462.Sh STRESS TESTING 463When running a kernel compiled with the option 464.Dv MBUF_STRESS_TEST , 465the following 466.Xr sysctl 8 Ns 467-controlled options may be used to create 468various failure/extreme cases for testing of network drivers 469and other parts of the kernel that rely on 470.Vt mbufs . 471.Bl -tag -width ident 472.It Va net.inet.ip.mbuf_frag_size 473Causes 474.Fn ip_output 475to fragment outgoing 476.Vt mbuf chains 477into fragments of the specified size. 478Setting this variable to 1 is an excellent way to 479test the long 480.Vt mbuf chain 481handling ability of network drivers. 482.It Va kern.ipc.m_defragrandomfailures 483Causes the function 484.Fn m_defrag 485to randomly fail, returning 486.Dv NULL . 487Any piece of code which uses 488.Fn m_defrag 489should be tested with this feature. 490.El 491.Sh RETURN VALUES 492See above. 493.Sh HISTORY 494.\" Please correct me if I'm wrong 495Mbufs appeared in an early version of 496.Bx . 497Besides for being used for network packets, they were used 498to store various dynamic structures, such as routing table 499entries, interface addresses, protocol control blocks, etc. 500.Sh AUTHORS 501The original 502.Nm 503man page was written by 504.An Yar Tikhiy . 505