mbuf(9)

NAME

mbuf - memory management in the kernel IPC subsystem

SYNOPSIS

#include <sys/param.h>
#include <sys/systm.h>
#include <sys/mbuf.h>
Mbuf allocation macros
MGET(struct mbuf *mbuf, int how, short type);
MGETHDR(struct mbuf *mbuf, int how, short type);
MCLGET(struct mbuf *mbuf, int how);
MEXTADD(struct mbuf *mbuf, caddr_t buf, u_int size,
        void (*free)(void *opt_args), void *opt_args,  short
flags,
        int type);
MEXTFREE(struct mbuf *mbuf);
MEXT_ADD_REF(struct mbuf *mbuf);
MEXT_REM_REF(struct mbuf *mbuf);
MFREE(struct mbuf *mbuf, struct mbuf *successor);
Mbuf utility macros
mtod(struct mbuf *mbuf, type);
int
MEXT_IS_REF(struct mbuf *mbuf);
M_ALIGN(struct mbuf *mbuf, u_int len);
MH_ALIGN(struct mbuf *mbuf, u_int len);
int
M_LEADINGSPACE(struct mbuf *mbuf);
int
M_TRAILINGSPACE(struct mbuf *mbuf);
M_MOVE_PKTHDR(struct mbuf *to, struct mbuf *from);
M_PREPEND(struct mbuf *mbuf, int len, int how);
MCHTYPE(struct mbuf *mbuf, u_int type);
int
M_WRITABLE(struct mbuf *mbuf);
Mbuf allocation functions
struct mbuf *
m_get(int how, int type);
struct mbuf *
m_getm(struct mbuf *orig, int len, int how, int type);
struct mbuf *
m_getcl(int how, short type, int flags);
struct mbuf *
m_getclr(int how, int type);
struct mbuf *
m_gethdr(int how, int type);
struct mbuf *
m_free(struct mbuf *mbuf);
void
m_freem(struct mbuf *mbuf);
Mbuf utility functions
void
m_adj(struct mbuf *mbuf, int len);
void
m_align(struct mbuf *mbuf, int len);
int
m_append(struct mbuf *mbuf, int len, c_caddr_t cp);
struct mbuf *
m_prepend(struct mbuf *mbuf, int len, int how);
struct mbuf *
m_copyup(struct mbuf *mbuf, int len, int dstoff);
struct mbuf *
m_pullup(struct mbuf *mbuf, int len);
struct mbuf *
m_copym(struct mbuf *mbuf, int offset, int len, int how);
struct mbuf *
m_copypacket(struct mbuf *mbuf, int how);
struct mbuf *
m_dup(struct mbuf *mbuf, int how);
void
m_copydata(const  struct  mbuf  *mbuf,  int offset, int len,
caddr_t buf);
void
m_copyback(struct mbuf *mbuf, int offset, int  len,  caddr_t
buf);
struct mbuf *
m_devget(char *buf, int len, int offset, struct ifnet *ifp,
        void (*copy)(char *from, caddr_t to, u_int len));
void
m_cat(struct mbuf *m, struct mbuf *n);
u_int
m_fixhdr(struct mbuf *mbuf);
void
m_dup_pkthdr(struct mbuf *to, struct mbuf *from);
void
m_move_pkthdr(struct mbuf *to, struct mbuf *from);
u_int
m_length(struct mbuf *mbuf, struct mbuf **last);
struct mbuf *
m_split(struct mbuf *mbuf, int len, int how);
int
m_apply(struct mbuf *mbuf, int off, int len,
        int  (*f)(void  *arg,  void  *data, u_int len), void
*arg);
struct mbuf *
m_getptr(struct mbuf *mbuf, int loc, int *off);
struct mbuf *
m_defrag(struct mbuf *m0, int how);
struct mbuf *
m_unshare(struct mbuf *m0, int how);

DESCRIPTION

An mbuf is a basic unit of memory management in the kernel
IPC subsystem. Network packets and socket buffers are stored in mbufs. A
network packet may span multiple mbufs arranged into a mbuf chain (linked
list), which allows adding or trimming network headers with little over
head.
While a developer should not bother with mbuf internals
without serious reason in order to avoid incompatibilities with future
changes, it is useful to understand the general structure of an mbuf.
An mbuf consists of a variable-sized header and a small in
ternal buffer for data. The total size of an mbuf, MSIZE, is a constant
defined in The mbuf header includes:: m_next (struct mbuf *) A pointer to the next mbuf; in the mbuf
chain.
m_nextpkt (struct mbuf *) A pointer to the next mbuf
chain in the: queue.
m_data (caddr_t) A pointer to data attached to
this mbuf.
m_len (int) The length of the data.
m_type (short) The type of the data.
m_flags (int) The mbuf flags.
The mbuf flag bits are defined as follows:
/* mbuf flags */ #define M_EXT 0x0001 /* has associated external
storage */ #define M_PKTHDR 0x0002 /* start of record */ #define M_EOR 0x0004 /* end of record */ #define M_RDONLY 0x0008 /* associated data marked
read-only */ #define M_PROTO1 0x0010 /* protocol-specific */ #define M_PROTO2 0x0020 /* protocol-specific */ #define M_PROTO3 0x0040 /* protocol-specific */ #define M_PROTO4 0x0080 /* protocol-specific */ #define M_PROTO5 0x0100 /* protocol-specific */ #define M_PROTO6 0x4000 /* protocol-specific (avoid
M_BCAST conflict) */ #define M_FREELIST 0x8000 /* mbuf is on the free list
*/
/* mbuf pkthdr flags (also stored in m_flags) */ #define M_BCAST 0x0200 /* send/received as link
level broadcast */ #define M_MCAST 0x0400 /* send/received as link
level multicast */ #define M_FRAG 0x0800 /* packet is fragment of
larger packet */ #define M_FIRSTFRAG 0x1000 /* packet is first fragment
*/ #define M_LASTFRAG 0x2000 /* packet is last fragment
*/
The available mbuf types are defined as follows:
/* mbuf types */ #define MT_DATA 1 /* dynamic (data) allocation
*/ #define MT_HEADER 2 /* packet header */ #define MT_SONAME 8 /* socket name */ #define MT_FTABLE 11 /* fragment reassembly head
er */ #define MT_CONTROL 14 /* extra-data protocol mes
sage */ #define MT_OOBDATA 15 /* expedited data */
If the M_PKTHDR flag is set, a struct pkthdr m_pkthdr is
added to the mbuf header. It contains a pointer to the interface the
packet has been received from (struct ifnet *rcvif), and the total packet
length (int len). Optionally, it may also contain an attached list of
packet tags
(struct m_tag). See mbuf_tags(9) for details. Fields used
in offloading
checksum calculation to the hardware are kept in m_pkthdr as
well. See HARDWARE-ASSISTED CHECKSUM CALCULATION for details.
If small enough, data is stored in the internal data buffer
of an mbuf. If the data is sufficiently large, another mbuf may be added
to the mbuf chain, or external storage may be associated with the mbuf.
MHLEN bytes of data can fit into an mbuf with the M_PKTHDR flag set,
MLEN bytes can otherwise.
If external storage is being associated with an mbuf, the
m_ext header is
added at the cost of losing the internal data buffer. It
includes a pointer to external storage, the size of the storage, a
pointer to a function used for freeing the storage, a pointer to an op
tional argument that can be passed to the function, and a pointer to a ref
erence counter. An mbuf using external storage has the M_EXT flag set.
The system supplies a macro for allocating the desired ex
ternal storage buffer, MEXTADD.
The allocation and management of the reference counter is
handled by the subsystem. The developer can check whether the reference
count for the external storage of a given mbuf is greater than 1 with the
MEXT_IS_REF macro. Similarly, the developer can directly add and remove
references, if absolutely necessary, with the use of the MEXT_ADD_REF
and MEXT_REM_REF macros.
The system also supplies a default type of external storage
buffer called an mbuf cluster. Mbuf clusters can be allocated and config
ured with the use of the MCLGET macro. Each mbuf cluster is MCLBYTES in
size, where MCLBYTES is a machine-dependent constant. The system de
fines an advisory macro MINCLSIZE, which is the smallest amount of data to put
into an mbuf cluster. It is equal to the sum of MLEN and MHLEN. It is
typically preferable to store data into the data region of an mbuf, if
size permits, as opposed to allocating a separate mbuf cluster to
hold the same data.
Macros and Functions: There are numerous predefined macros and functions that pro; vide the
developer with common utilities.

mtod(mbuf, type)
Convert an mbuf pointer to a data pointer. The macro

expands to
the data pointer cast to the pointer of the specified

type. Note:
It is advisable to ensure that there is enough con

tiguous data in
mbuf. See m_pullup() for details.

MGET(mbuf, how, type)
Allocate an mbuf and initialize it to contain internal

data. mbuf
will point to the allocated mbuf on success, or be set

to NULL on
failure. The how argument is to be set to M_TRYWAIT

or M_DONTWAIT.
It specifies whether the caller is willing to block if

necessary.
If how is set to M_TRYWAIT, a failed allocation will

result in the
caller being put to sleep for a designated

kern.ipc.mbuf_wait
(sysctl(8) tunable) number of ticks. A number of oth

er functions
and macros related to mbufs have the same argument be

cause they may
at some point need to allocate new mbufs.

Programmers should be careful not to confuse the mbuf

allocation
flag M_DONTWAIT with the malloc(9) allocation flag,

M_NOWAIT. They
are not the same.

MGETHDR(mbuf, how, type)
Allocate an mbuf and initialize it to contain a packet

header and
internal data. See MGET() for details.

MCLGET(mbuf, how)
Allocate and attach an mbuf cluster to mbuf. If the

macro fails,
the M_EXT flag will not be set in mbuf.

M_ALIGN(mbuf, len)
Set the pointer mbuf->m_data to place an object of the

size len at
the end of the internal data area of mbuf, long word

aligned.
Applicable only if mbuf is newly allocated with MGET()

or m_get().

MH_ALIGN(mbuf, len)
Serves the same purpose as M_ALIGN() does, but only

for mbuf newly
allocated with MGETHDR() or m_gethdr(), or initialized

by
m_dup_pkthdr() or m_move_pkthdr().

m_align(mbuf, len)
Services the same purpose as M_ALIGN() but handles any

type of
mbuf.

M_LEADINGSPACE(mbuf)
Returns the number of bytes available before the be

ginning of data
in mbuf.

M_TRAILINGSPACE(mbuf)
Returns the number of bytes available after the end of

data in
mbuf.

M_PREPEND(mbuf, len, how)
This macro operates on an mbuf chain. It is an opti

mized wrapper
for m_prepend() that can make use of possible empty

space before
data (e.g. left after trimming of a link-layer head

er). The new
mbuf chain pointer or NULL is in mbuf after the call.

M_MOVE_PKTHDR(to, from)
Using this macro is equivalent to calling

m_move_pkthdr(to, from).

M_WRITABLE(mbuf)
This macro will evaluate true if mbuf is not marked

M_RDONLY and if
either mbuf does not contain external storage or, if

it does, then
if the reference count of the storage is not greater

than 1. The
M_RDONLY flag can be set in mbuf->m_flags. This can

be achieved
during setup of the external storage, by passing the

M_RDONLY bit
as a flags argument to the MEXTADD() macro, or can be

directly set
in individual mbufs.

MCHTYPE(mbuf, type)
Change the type of mbuf to type. This is a relatively

expensive
operation and should be avoided.; The functions are:

m_get(how, type)
A function version of MGET() for non-critical paths.

m_getm(orig, len, how, type) Allocate len bytes worth of mbufs and mbuf clusters if

necessary
and append the resulting allocated mbuf chain to the

mbuf chain
orig, if it is non-NULL. If the allocation fails at

any point,
free whatever was allocated and return NULL. If orig

is non-NULL,
it will not be freed. It is possible to use m_getm()

to either
append len bytes to an existing mbuf or mbuf chain

(for example,
one which may be sitting in a pre-allocated ring) or

to simply perform an all-or-nothing mbuf and mbuf cluster alloca

tion.

m_gethdr(how, type)
A function version of MGETHDR() for non-critical

paths.

m_getcl(how, type, flags)
Fetch an mbuf with a mbuf cluster attached to it. If

one of the
allocations fails, the entire allocation fails. This

routine is
the preferred way of fetching both the mbuf and mbuf

cluster
together, as it avoids having to unlock/relock between

allocations.
Returns NULL on failure.

m_getclr(how, type)
Allocate an mbuf and zero out the data region.

m_free(mbuf)
Frees mbuf. Returns m_next of the freed mbuf.; The functions below operate on mbuf chains.

m_freem(mbuf)
Free an entire mbuf chain, including any external

storage.

m_adj(mbuf, len)
Trim len bytes from the head of an mbuf chain if len

is positive,
from the tail otherwise.

m_append(mbuf, len, cp)
Append len bytes of data cp to the mbuf chain. Extend

the mbuf
chain if the new data does not fit in existing space.

m_prepend(mbuf, len, how)
Allocate a new mbuf and prepend it to the mbuf chain,

handle
M_PKTHDR properly. Note: It does not allocate any

mbuf clusters,
so len must be less than MLEN or MHLEN, depending on

the M_PKTHDR
flag setting.

m_copyup(mbuf, len, dstoff) Similar to m_pullup() but copies len bytes of data in

to a new mbuf
at dstoff bytes into the mbuf. The dstoff argument

aligns the data
and leaves room for a link layer header. Returns the

new mbuf
chain on success, and frees the mbuf chain and returns

NULL on
failure. Note: The function does not allocate mbuf

clusters, so
len + dstoff must be less than MHLEN.

m_pullup(mbuf, len)
Arrange that the first len bytes of an mbuf chain are

contiguous
and lay in the data area of mbuf, so they are accessi

ble with
mtod(mbuf, type). Return the new mbuf chain on suc

cess, NULL on
failure (the mbuf chain is freed in this case). Note:

It does not
allocate any mbuf clusters, so len must be less than

MHLEN.

m_copym(mbuf, offset, len, how) Make a copy of an mbuf chain starting offset bytes

from the beginning, continuing for len bytes. If len is M_COPYALL,

copy to the
end of the mbuf chain. Note: The copy is read-only,

because the
mbuf clusters are not copied, only their reference

counts are
incremented.

m_copypacket(mbuf, how)
Copy an entire packet including header, which must be

present.
This is an optimized version of the common case

m_copym(mbuf, 0,
M_COPYALL, how). Note: the copy is read-only, because

the mbuf
clusters are not copied, only their reference counts

are incremented.

m_dup(mbuf, how)
Copy a packet header mbuf chain into a completely new

mbuf chain,
including copying any mbuf clusters. Use this instead

of
m_copypacket() when you need a writable copy of an

mbuf chain.

m_copydata(mbuf, offset, len, buf) Copy data from an mbuf chain starting off bytes from

the beginning,
continuing for len bytes, into the indicated buffer

buf.

m_copyback(mbuf, offset, len, buf) Copy len bytes from the buffer buf back into the indi

cated mbuf
chain, starting at offset bytes from the beginning of

the mbuf
chain, extending the mbuf chain if necessary. Note:

It does not
allocate any mbuf clusters, just adds mbufs to the

mbuf chain. It
is safe to set offset beyond the current mbuf chain

end: zeroed
mbufs will be allocated to fill the space.

m_length(mbuf, last)
Return the length of the mbuf chain, and optionally a

pointer to
the last mbuf.

m_dup_pkthdr(to, from, how) Upon the function's completion, the mbuf to will con

tain an identical copy of from->m_pkthdr and the per-packet at

tributes found in
the mbuf chain from. The mbuf from must have the flag

M_PKTHDR
initially set, and to must be empty on entry.

m_move_pkthdr(to, from)
Move m_pkthdr and the per-packet attributes from the

mbuf chain
from to the mbuf to. The mbuf from must have the flag

M_PKTHDR
initially set, and to must be empty on entry. Upon

the function's
completion, from will have the flag M_PKTHDR and the

per-packet
attributes cleared.

m_fixhdr(mbuf)
Set the packet-header length to the length of the mbuf

chain.

m_devget(buf, len, offset, ifp, copy) Copy data from a device local memory pointed to by buf

to an mbuf
chain. The copy is done using a specified copy rou

tine copy, or
bcopy() if copy is NULL.

m_cat(m, n)
Concatenate n to m. Both mbuf chains must be of the

same type. N
is still valid after the function returned. Note: It

does not handle M_PKTHDR and friends.

m_split(mbuf, len, how)
Partition an mbuf chain in two pieces, returning the

tail: all but
the first len bytes. In case of failure, it returns

NULL and
attempts to restore the mbuf chain to its original

state.

m_apply(mbuf, off, len, f, arg) Apply a function to an mbuf chain, at offset off, for

length len
bytes. Typically used to avoid calls to m_pullup()

which would
otherwise be unnecessary or undesirable. arg is a

convenience
argument which is passed to the callback function f.

Each time f() is called, it will be passed arg, a

pointer to the
data in the current mbuf, and the length len of the

data in this
mbuf to which the function should be applied.

The function should return zero to indicate success;

otherwise, if
an error is indicated, then m_apply() will return the

error and
stop iterating through the mbuf chain.

m_getptr(mbuf, loc, off)
Return a pointer to the mbuf containing the data lo

cated at loc
bytes from the beginning of the mbuf chain. The cor

responding offset into the mbuf will be stored in *off.

m_defrag(m0, how)
Defragment an mbuf chain, returning the shortest pos

sible chain of
mbufs and clusters. If allocation fails and this can

not be completed, NULL will be returned and the original chain

will be
unchanged. Upon success, the original chain will be

freed and the
new chain will be returned. how should be either

M_TRYWAIT or
M_DONTWAIT, depending on the caller's preference.

This function is especially useful in network drivers,

where certain long mbuf chains must be shortened before being

added to TX
descriptor lists.

m_unshare(m0, how)
Create a version of the specified mbuf chain whose

contents can be
safely modified without affecting other users. If al

location fails
and this operation can not be completed, NULL will be

returned.
The original mbuf chain is always reclaimed and the

reference count
of any shared mbuf clusters is decremented. how

should be either
M_TRYWAIT or M_DONTWAIT, depending on the caller's

preference. As
a side-effect of this process the returned mbuf chain

may be compacted.

This function is especially useful in the transmit

path of network
code, when data must be encrypted or otherwise altered

prior to
transmission.

HARDWARE-ASSISTED CHECKSUM CALCULATION

This section currently applies to TCP/IP only. In order to
save the host CPU resources, computing checksums is offloaded to the net
work interface
hardware if possible. The m_pkthdr member of the leading
mbuf of a packet contains two fields used for that purpose, int
csum_flags and int
csum_data. The meaning of those fields depends on the di
rection a packet flows in, and on whether the packet is fragmented. Hence
forth,
csum_flags or csum_data of a packet will denote the corre
sponding field
of the m_pkthdr member of the leading mbuf in the mbuf chain
containing the packet.
On output, checksum offloading is attempted after the outgo
ing interface has been determined for a packet. The interface-specific
field
ifnet.if_data.ifi_hwassist (see ifnet(9)) is consulted for
the capabilities of the interface to assist in computing checksums. The
csum_flags
field of the packet header is set to indicate which actions
the interface is supposed to perform on it. The actions unsupported by
the network interface are done in the software prior to passing the
packet down to the interface driver; such actions will never be requested
through
csum_flags.
The flags demanding a particular action from an interface
are as follows:: CSUM_IP The IP header checksum is to be computed; and stored
in the corresponding field of the pack

et. The hardware is expected to know the format of

an IP header
to determine the offset of the IP check

sum field.
CSUM_TCP The TCP checksum is to be computed.
(See below.)
CSUM_UDP The UDP checksum is to be computed.
(See below.)
Should a TCP or UDP checksum be offloaded to the hardware,
the field
csum_data will contain the byte offset of the checksum field
relative to the end of the IP header. In this case, the checksum field
will be initially set by the TCP/IP module to the checksum of the pseu
do header defined by the TCP and UDP specifications.
For outbound packets which have been fragmented by the host
CPU, the following will also be true, regardless of the checksum flag
settings:: +o all fragments will have the flag M_FRAG set in; their m_flags
field;; +o the first and the last fragments in the chain will; have
M_FIRSTFRAG or M_LASTFRAG set in their m_flags,

correspondingly;; +o the first fragment in the chain will have the to; tal number of
fragments contained in its csum_data field.
The last rule for fragmented packets takes precedence over
the one for a TCP or UDP checksum. Nevertheless, offloading a TCP or UDP
checksum is possible for a fragmented packet if the flag CSUM_IP_FRAGS
is set in the
field ifnet.if_data.ifi_hwassist associated with the network
interface. However, in this case the interface is expected to figure
out the location of the checksum field within the sequence of fragments
by itself
because csum_data contains a fragment count instead of a
checksum offset value.
On input, an interface indicates the actions it has per
formed on a packet
by setting one or more of the following flags in csum_flags
associated with the packet:: CSUM_IP_CHECKED The IP header checksum has been; computed.; CSUM_IP_VALID The IP header has a valid check; sum. This flag
can appear only in combination

with
CSUM_IP_CHECKED.
CSUM_DATA_VALID The checksum of the data portion
of the IP: packet has been computed and; stored in the
field csum_data in network byte; order.
CSUM_PSEUDO_HDR Can be set only along with
CSUM_DATA_VALID to: indicate that the IP data check; sum found in
csum_data allows for the pseudo; header defined
by the TCP and UDP specifica; tions. Otherwise
the checksum of the pseudo header; must be calculated by the host CPU and added; to csum_data
to obtain the final checksum to; be used for
TCP or UDP validation purposes.
If a particular network interface just indicates success or
failure of TCP or UDP checksum validation without returning the exact
value of the checksum to the host CPU, its driver can mark CSUM_DA
TA_VALID and
CSUM_PSEUDO_HDR in csum_flags, and set csum_data to 0xFFFF
hexadecimal to indicate a valid checksum. It is a peculiarity of the algo
rithm used that the Internet checksum calculated over any valid packet
will be 0xFFFF as long as the original checksum field is included.
For inbound packets which are IP fragments, all csum_data
fields will be summed during reassembly to obtain the final checksum value
passed to an
upper layer in the csum_data field of the reassembled pack
et. The
csum_flags fields of all fragments will be consolidated us
ing logical AND
to obtain the final value for csum_flags. Thus, in order to
successfully offload checksum computation for fragmented data, all frag
ments should
have the same value of csum_flags.

STRESS TESTING

When running a kernel compiled with the option
MBUF_STRESS_TEST, the following sysctl(8)-controlled options may be used to create
various failure/extreme cases for testing of network drivers and other
parts of the kernel that rely on mbufs.
net.inet.ip.mbuf_frag_size: Causes ip_output() to fragment outgoing mbuf chains; into fragments
of the specified size. Setting this variable to 1 is; an excellent
way to test the long mbuf chain handling ability of; network
drivers.
kern.ipc.m_defragrandomfailures: Causes the function m_defrag() to randomly fail, re; turning NULL.
Any piece of code which uses m_defrag() should be; tested with this
feature.

RETURN VALUES

See above.

HISTORY

Mbufs appeared in an early version of BSD. Besides being
used for network packets, they were used to store various dynamic struc
tures, such as routing table entries, interface addresses, protocol control
blocks, etc.

AUTHORS

The original mbuf manual page was written by Yar Tikhiy.
BSD March 15, 2006

docs.sk

comprehensive documentation repository

See also

mbuf(9)

NAME

SYNOPSIS

DESCRIPTION

HARDWARE-ASSISTED CHECKSUM CALCULATION

STRESS TESTING

RETURN VALUES

SEE ALSO

HISTORY

AUTHORS