| MBUF(9) | Kernel Developer's Manual | MBUF(9) | 
mbuf — memory
    management in the kernel IPC subsystem
#include
    <sys/param.h>
  
  #include <sys/systm.h>
  
  #include <sys/mbuf.h>
MGET(struct
    mbuf *mbuf, int
    how, short
  type);
MGETHDR(struct
    mbuf *mbuf, int
    how, short
  type);
int
  
  MCLGET(struct
    mbuf *mbuf, int
    how);
MEXTADD(struct mbuf
    *mbuf, char *buf, u_int
    size, void (*free)(struct mbuf *),
    void *opt_arg1, void *opt_arg2,
    int flags, int type);
mtod(struct
    mbuf *mbuf,
  type);
M_ALIGN(struct
    mbuf *mbuf, u_int
    len);
MH_ALIGN(struct
    mbuf *mbuf, u_int
    len);
int
  
  M_LEADINGSPACE(struct
    mbuf *mbuf);
int
  
  M_TRAILINGSPACE(struct
    mbuf *mbuf);
M_MOVE_PKTHDR(struct
    mbuf *to, struct mbuf
    *from);
M_PREPEND(struct
    mbuf *mbuf, int
    len, int how);
MCHTYPE(struct
    mbuf *mbuf, short
    type);
int
  
  M_WRITABLE(struct
    mbuf *mbuf);
struct mbuf *
  
  m_get(int
    how, short
  type);
struct mbuf *
  
  m_get2(int
    size, int how,
    short type,
    int flags);
struct mbuf *
  
  m_getm(struct
    mbuf *orig, int
    len, int how,
    short type);
struct mbuf *
  
  m_getjcl(int
    how, short type,
    int flags,
    int size);
struct mbuf *
  
  m_getcl(int
    how, short type,
    int flags);
struct mbuf *
  
  m_gethdr(int
    how, short
  type);
struct mbuf *
  
  m_free(struct
    mbuf *mbuf);
void
  
  m_freem(struct
    mbuf *mbuf);
void
  
  m_adj(struct
    mbuf *mbuf, int
    len);
void
  
  m_align(struct
    mbuf *mbuf, int
    len);
int
  
  m_append(struct
    mbuf *mbuf, int
    len, c_caddr_t
  cp);
struct mbuf *
  
  m_prepend(struct
    mbuf *mbuf, int
    len, int how);
struct mbuf *
  
  m_copyup(struct
    mbuf *mbuf, int
    len, int
  dstoff);
struct mbuf *
  
  m_pullup(struct
    mbuf *mbuf, int
    len);
struct mbuf *
  
  m_pulldown(struct
    mbuf *mbuf, int
    offset, int len,
    int *offsetp);
struct mbuf *
  
  m_copym(struct
    mbuf *mbuf, int
    offset, int len,
    int how);
struct mbuf *
  
  m_copypacket(struct
    mbuf *mbuf, int
    how);
struct mbuf *
  
  m_dup(const
    struct mbuf *mbuf, int
    how);
void
  
  m_copydata(const
    struct mbuf *mbuf, int
    offset, int len,
    caddr_t buf);
void
  
  m_copyback(struct
    mbuf *mbuf, int
    offset, int len,
    caddr_t buf);
struct mbuf *
  
  m_devget(char *buf,
    int len, int offset,
    struct ifnet *ifp, void (*copy)(char
    *from, caddr_t to, u_int len));
void
  
  m_cat(struct
    mbuf *m, struct mbuf
    *n);
void
  
  m_catpkt(struct
    mbuf *m, struct mbuf
    *n);
u_int
  
  m_fixhdr(struct
    mbuf *mbuf);
int
  
  m_dup_pkthdr(struct
    mbuf *to, const struct
    mbuf *from, int
    how);
void
  
  m_move_pkthdr(struct
    mbuf *to, struct mbuf
    *from);
u_int
  
  m_length(struct
    mbuf *mbuf, struct mbuf
    **last);
struct mbuf *
  
  m_split(struct
    mbuf *mbuf, int
    len, int how);
int
  
  m_apply(struct
    mbuf *mbuf, int
    off, int len,
    int (*f)(void *arg, void *data,
    u_int len), void
    *arg);
struct mbuf *
  
  m_getptr(struct
    mbuf *mbuf, int
    loc, int *off);
struct mbuf *
  
  m_defrag(struct
    mbuf *m0, int
  how);
struct mbuf *
  
  m_collapse(struct
    mbuf *m0, int how,
    int maxfrags);
struct mbuf *
  
  m_unshare(struct
    mbuf *m0, int
  how);
An mbuf is a basic unit of memory management in the kernel IPC subsystem. Network packets and socket buffers are stored in mbufs. A network packet may span multiple mbufs arranged into a mbuf chain (linked list), which allows adding or trimming network headers with little overhead.
While a developer should not bother with mbuf internals without serious reason in order to avoid incompatibilities with future changes, it is useful to understand the general structure of an mbuf.
An mbuf consists of a variable-sized header
    and a small internal buffer for data. The total size of an
    mbuf, MSIZE, is a constant
    defined in <sys/param.h>.
    The mbuf header includes:
The mbuf flag bits are defined as follows:
/* mbuf flags */ #define M_EXT 0x00000001 /* has associated external storage */ #define M_PKTHDR 0x00000002 /* start of record */ #define M_EOR 0x00000004 /* end of record */ #define M_RDONLY 0x00000008 /* associated data marked read-only */ #define M_PROTO1 0x00001000 /* protocol-specific */ #define M_PROTO2 0x00002000 /* protocol-specific */ #define M_PROTO3 0x00004000 /* protocol-specific */ #define M_PROTO4 0x00008000 /* protocol-specific */ #define M_PROTO5 0x00010000 /* protocol-specific */ #define M_PROTO6 0x00020000 /* protocol-specific */ #define M_PROTO7 0x00040000 /* protocol-specific */ #define M_PROTO8 0x00080000 /* protocol-specific */ #define M_PROTO9 0x00100000 /* protocol-specific */ #define M_PROTO10 0x00200000 /* protocol-specific */ #define M_PROTO11 0x00400000 /* protocol-specific */ #define M_PROTO12 0x00800000 /* protocol-specific */ /* mbuf pkthdr flags (also stored in m_flags) */ #define M_BCAST 0x00000010 /* send/received as link-level broadcast */ #define M_MCAST 0x00000020 /* send/received as link-level multicast */
The available mbuf types are defined as follows:
/* mbuf types */ #define MT_DATA 1 /* dynamic (data) allocation */ #define MT_HEADER MT_DATA /* packet header */ #define MT_SONAME 8 /* socket name */ #define MT_CONTROL 14 /* extra-data protocol message */ #define MT_OOBDATA 15 /* expedited data */
The available external buffer types are defined as follows:
/* external buffer types */ #define EXT_CLUSTER 1 /* mbuf cluster */ #define EXT_SFBUF 2 /* sendfile(2)'s sf_bufs */ #define EXT_JUMBOP 3 /* jumbo cluster 4096 bytes */ #define EXT_JUMBO9 4 /* jumbo cluster 9216 bytes */ #define EXT_JUMBO16 5 /* jumbo cluster 16184 bytes */ #define EXT_PACKET 6 /* mbuf+cluster from packet zone */ #define EXT_MBUF 7 /* external mbuf reference */ #define EXT_NET_DRV 252 /* custom ext_buf provided by net driver(s) */ #define EXT_MOD_TYPE 253 /* custom module's ext_buf type */ #define EXT_DISPOSABLE 254 /* can throw this buffer away w/page flipping */ #define EXT_EXTREF 255 /* has externally maintained ref_cnt ptr */
If the M_PKTHDR flag is set, a
    struct pkthdr m_pkthdr is added
    to the mbuf header. It contains a pointer to the
    interface the packet has been received from (struct
    ifnet *rcvif), and the total packet length
    (int len). Optionally, it may
    also contain an attached list of packet tags (struct
    m_tag). See mbuf_tags(9) for details. Fields used in
    offloading checksum calculation to the hardware are kept in
    m_pkthdr as well. See
    HARDWARE-ASSISTED
    CHECKSUM CALCULATION for details.
If small enough, data is stored in the internal data buffer of an
    mbuf. If the data is sufficiently large, another
    mbuf may be added to the mbuf
    chain, or external storage may be associated with the
    mbuf. MHLEN bytes of data can
    fit into an mbuf with the
    M_PKTHDR flag set, MLEN
    bytes can otherwise.
If external storage is being associated with an
    mbuf, the m_ext header is added
    at the cost of losing the internal data buffer. It includes a pointer to
    external storage, the size of the storage, a pointer to a function used for
    freeing the storage, a pointer to an optional argument that can be passed to
    the function, and a pointer to a reference counter. An
    mbuf using external storage has the
    M_EXT flag set.
The system supplies a macro for allocating the desired external
    storage buffer, MEXTADD.
The allocation and management of the reference counter is handled by the subsystem.
The system also supplies a default type of external storage buffer
    called an mbuf cluster. Mbuf
    clusters can be allocated and configured with the use of the
    MCLGET macro. Each mbuf
    cluster is MCLBYTES in size, where MCLBYTES is
    a machine-dependent constant. The system defines an advisory macro
    MINCLSIZE, which is the smallest amount of data to
    put into an mbuf cluster. It is equal to
    MHLEN plus one. It is typically preferable to store
    data into the data region of an mbuf, if size permits,
    as opposed to allocating a separate mbuf cluster to
    hold the same data.
There are numerous predefined macros and functions that provide the developer with common utilities.
mtod(mbuf,
    type)m_pullup()
      for details.MGET(mbuf,
    how, type)NULL on failure. The how
      argument is to be set to M_WAITOK or
      M_NOWAIT. It specifies whether the caller is
      willing to block if necessary. A number of other functions and macros
      related to mbufs have the same argument because they
      may at some point need to allocate new mbufs.MGETHDR(mbuf,
    how, type)MGET() for
      details.MEXTADD(mbuf,
    buf, size,
    free, opt_arg1,
    opt_arg2, flags,
    type)M_EXT flag will be set. The
      buf and size arguments are the
      address and length, respectively, of the data. The
      free argument points to a function which will be
      called to free the data when the mbuf is freed; it is only used if
      type is EXT_EXTREF. The
      opt_arg1 and opt_arg2
      arguments will be saved in ext_arg1 and
      ext_arg2 fields of the struct
      m_ext of the mbuf. The flags argument
      specifies additional mbuf flags; it is not necessary
      to specify M_EXT. Finally, the
      type argument specifies the type of external data,
      which controls how it will be disposed of when the
      mbuf is freed. In most cases, the correct value is
      EXT_EXTREF.MCLGET(mbuf,
    how)M_EXT flag on the mbuf, but this is now
      discouraged to avoid unnecessary awareness of the implementation of
      external storage in protocol stacks and device drivers.M_ALIGN(mbuf,
    len)MGET() or m_get().MH_ALIGN(mbuf,
    len)M_ALIGN() does, but
      only for mbuf newly allocated with
      MGETHDR() or m_gethdr(),
      or initialized by
      m_dup_pkthdr()
      or
      m_move_pkthdr().m_align(mbuf,
    len)M_ALIGN() but handles
      any type of mbuf.M_LEADINGSPACE(mbuf)M_TRAILINGSPACE(mbuf)M_PREPEND(mbuf,
    len, how)m_prepend() that can make
      use of possible empty space before data (e.g. left after trimming of a
      link-layer header). The new mbuf chain pointer or
      NULL is in mbuf after the
      call.M_MOVE_PKTHDR(to,
    from)m_move_pkthdr(to,
      from).M_WRITABLE(mbuf)M_RDONLY and if either mbuf
      does not contain external storage or, if it does, then if the reference
      count of the storage is not greater than 1. The
      M_RDONLY flag can be set in
      mbuf->m_flags. This can be achieved during setup
      of the external storage, by passing the M_RDONLY
      bit as a flags argument to the
      MEXTADD() macro, or can be directly set in
      individual mbufs.MCHTYPE(mbuf,
    type)The functions are:
m_get(how,
    type)MGET()
      for non-critical paths.m_get2(size,
    how, type,
    flags)m_getm(orig,
    len, how,
    type)NULL. If the
      allocation fails at any point, free whatever was allocated and return
      NULL. If orig is
      non-NULL, it will not be
      freed. It is possible to use m_getm() to either
      append len bytes to an existing
      mbuf or mbuf chain (for
      example, one which may be sitting in a pre-allocated ring) or to simply
      perform an all-or-nothing mbuf and
      mbuf cluster allocation.m_gethdr(how,
    type)MGETHDR() for non-critical
      paths.m_getcl(how,
    type, flags)NULL on failure.m_getjcl(how,
    type, flags,
    size)m_getcl() but it the size of the
      cluster allocated will be large enough for size
      bytes.m_free(mbuf)The functions below operate on mbuf chains.
m_freem(mbuf)m_adj(mbuf,
    len)m_append(mbuf,
    len, cp)m_prepend(mbuf,
    len, how)M_PKTHDR
      properly. Note: It does not allocate any
      mbuf clusters, so len must be
      less than MLEN or MHLEN,
      depending on the M_PKTHDR flag setting.m_copyup(mbuf,
    len, dstoff)m_pullup() but copies
      len bytes of data into a new mbuf at
      dstoff bytes into the mbuf. The
      dstoff argument aligns the data and leaves room for
      a link layer header. Returns the new mbuf chain on
      success, and frees the mbuf chain and returns
      NULL on failure. Note: The
      function does not allocate mbuf clusters, so
      len + dstoff must be less than
      MHLEN.m_pullup(mbuf,
    len)mtod(mbuf,
      type). It is important to remember that this may
      involve reallocating some mbufs and moving data so all pointers
      referencing data within the old mbuf chain must be recalculated or made
      invalid. Return the new mbuf chain on success,
      NULL on failure (the mbuf
      chain is freed in this case). Note: It does not
      allocate any mbuf clusters, so
      len must be less than or equal to
      MHLEN.m_pulldown(mbuf,
    offset, len,
    offsetp)mtod(mbuf,
      type). len must be smaller
      than, or equal to, the size of an mbuf cluster.
      Return a pointer to an intermediate mbuf in the
      chain containing the requested region; the offset in the data region of
      the mbuf chain to the data contained in the returned
      mbuf is stored in *offsetp. If
      offsetp is NULL, the region may be accessed using
      mtod(mbuf,
      type). If offsetp is non-NULL,
      the region may be accessed using
      mtod(mbuf,
      uint8_t) + *offsetp. The region of the mbuf chain
      between its beginning and offset is not modified,
      therefore it is safe to hold pointers to data within this region before
      calling m_pulldown().m_copym(mbuf,
    offset, len,
    how)M_COPYALL, copy to the end of the
      mbuf chain. Note: The copy is
      read-only, because the mbuf clusters are not copied,
      only their reference counts are incremented.m_copypacket(mbuf,
    how)m_copym(mbuf,
      0, M_COPYALL,
      how). Note: the copy is read-only,
      because the mbuf clusters are not copied, only their
      reference counts are incremented.m_dup(mbuf,
    how)m_copypacket() when you need a writable copy of an
      mbuf chain.m_copydata(mbuf,
    offset, len,
    buf)m_copyback(mbuf,
    offset, len,
    buf)m_length(mbuf,
    last)m_dup_pkthdr(to,
    from, how)M_PKTHDR initially set, and
      to must be empty on entry.m_move_pkthdr(to,
    from)M_PKTHDR initially set, and
      to must be empty on entry. Upon the function's
      completion, from will have the flag
      M_PKTHDR and the per-packet attributes
    cleared.m_fixhdr(mbuf)m_devget(buf,
    len, offset,
    ifp, copy)bcopy()
      if copy is NULL.m_cat(m,
    n)m_cat() returns. m_cat()
      does not update any packet header fields or free mbuf tags.m_catpkt(m,
    n)m_cat() that operates on packets.
      Both m and n must contain
      packet headers. n is not guaranteed to be valid
      after m_catpkt() returns.m_split(mbuf,
    len, how)NULL and attempts to restore
      the mbuf chain to its original state.m_apply(mbuf,
    off, len,
    f, arg)m_pullup() which
      would otherwise be unnecessary or undesirable. arg
      is a convenience argument which is passed to the callback function
      f.
    Each time
        f() is
        called, it will be passed arg, a pointer to the
        data in the current mbuf, and the length
        len of the data in this mbuf to which the function
        should be applied.
The function should return zero to indicate
        success; otherwise, if an error is indicated, then
        m_apply()
        will return the error and stop iterating through the
        mbuf chain.
m_getptr(mbuf,
    loc, off)m_defrag(m0,
    how)NULL will be returned and the original chain will
      be unchanged. Upon success, the original chain will be freed and the new
      chain will be returned. how should be either
      M_WAITOK or M_NOWAIT,
      depending on the caller's preference.
    This function is especially useful in network drivers, where certain long mbuf chains must be shortened before being added to TX descriptor lists.
m_collapse(m0,
    how, maxfrags)NULL
      will be returned, with the original chain possibly modified. As with
      m_defrag(),
      how should be one of
      M_WAITOK or M_NOWAIT.NULL will be
      returned. The original mbuf chain is always reclaimed and the reference
      count of any shared mbuf clusters is decremented.
      how should be either
      M_WAITOK or M_NOWAIT,
      depending on the caller's preference. As a side-effect of this process the
      returned mbuf chain may be compacted.
    This function is especially useful in the transmit path of network code, when data must be encrypted or otherwise altered prior to transmission.
This section currently applies to TCP/IP only. In order to save the host CPU resources, computing checksums is offloaded to the network interface hardware if possible. The m_pkthdr member of the leading mbuf of a packet contains two fields used for that purpose, int csum_flags and int csum_data. The meaning of those fields depends on the direction a packet flows in, and on whether the packet is fragmented. Henceforth, csum_flags or csum_data of a packet will denote the corresponding field of the m_pkthdr member of the leading mbuf in the mbuf chain containing the packet.
On output, checksum offloading is attempted after the outgoing interface has been determined for a packet. The interface-specific field ifnet.if_data.ifi_hwassist (see ifnet(9)) is consulted for the capabilities of the interface to assist in computing checksums. The csum_flags field of the packet header is set to indicate which actions the interface is supposed to perform on it. The actions unsupported by the network interface are done in the software prior to passing the packet down to the interface driver; such actions will never be requested through csum_flags.
The flags demanding a particular action from an interface are as follows:
CSUM_IPCSUM_TCPCSUM_UDPShould a TCP or UDP checksum be offloaded to the hardware, the field csum_data will contain the byte offset of the checksum field relative to the end of the IP header. In this case, the checksum field will be initially set by the TCP/IP module to the checksum of the pseudo header defined by the TCP and UDP specifications.
On input, an interface indicates the actions it has performed on a packet by setting one or more of the following flags in csum_flags associated with the packet:
CSUM_IP_CHECKEDCSUM_IP_VALIDCSUM_IP_CHECKED.CSUM_DATA_VALIDCSUM_PSEUDO_HDRCSUM_DATA_VALID to
      indicate that the IP data checksum found in
      csum_data allows for the pseudo header defined by
      the TCP and UDP specifications. Otherwise the checksum of the pseudo
      header must be calculated by the host CPU and added to
      csum_data to obtain the final checksum to be used
      for TCP or UDP validation purposes.If a particular network interface just indicates success or
    failure of TCP or UDP checksum validation without returning the exact value
    of the checksum to the host CPU, its driver can mark
    CSUM_DATA_VALID and
    CSUM_PSEUDO_HDR in csum_flags,
    and set csum_data to 0xFFFF
    hexadecimal to indicate a valid checksum. It is a peculiarity of the
    algorithm used that the Internet checksum calculated over any valid packet
    will be 0xFFFF as long as the original checksum
    field is included.
When running a kernel compiled with the option
    MBUF_STRESS_TEST, the following
    sysctl(8)-controlled options may be used to create various
    failure/extreme cases for testing of network drivers and other parts of the
    kernel that rely on mbufs.
ip_output()
      to fragment outgoing mbuf chains into fragments of
      the specified size. Setting this variable to 1 is an excellent way to test
      the long mbuf chain handling ability of network
      drivers.m_defrag()
      to randomly fail, returning NULL. Any piece of
      code which uses m_defrag() should be tested with
      this feature.See above.
Mbufs appeared in an early version of BSD. Besides being used for network packets, they were used to store various dynamic structures, such as routing table entries, interface addresses, protocol control blocks, etc. In more recent FreeBSD use of mbufs is almost entirely limited to packet storage, with uma(9) zones being used directly to store other network-related memory.
Historically, the mbuf allocator has been a special-purpose memory allocator able to run in interrupt contexts and allocating from a special kernel address space map. As of FreeBSD 5.3, the mbuf allocator is a wrapper around uma(9), allowing caching of mbufs, clusters, and mbuf + cluster pairs in per-CPU caches, as well as bringing other benefits of slab allocation.
The original mbuf manual page was written
    by Yar Tikhiy. The uma(9)
    mbuf allocator was written by
  
  Bosko Milekic.
| September 27, 2017 | Debian |