Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages


home | help
MBUF(9)			 BSD Kernel Developer's	Manual		       MBUF(9)

     mbuf -- memory management in the kernel IPC subsystem

     #include <sys/param.h>
     #include <sys/systm.h>
     #include <sys/mbuf.h>

   Mbuf	allocation macros
     MGET(struct mbuf *mbuf, int how, short type);

     MGETHDR(struct mbuf *mbuf,	int how, short type);

     MCLGET(struct mbuf	*mbuf, int how);

     MEXTADD(struct mbuf *mbuf,	caddr_t	buf, u_int size,
	 void (*free)(void *opt_args), void *opt_args, short flags, int	type);

     MEXTFREE(struct mbuf *mbuf);

     MEXT_ADD_REF(struct mbuf *mbuf);

     MEXT_REM_REF(struct mbuf *mbuf);

     MFREE(struct mbuf *mbuf, struct mbuf *successor);

   Mbuf	utility	macros
     mtod(struct mbuf *mbuf, type);

     MEXT_IS_REF(struct	mbuf *mbuf);

     M_ALIGN(struct mbuf *mbuf,	u_int len);

     MH_ALIGN(struct mbuf *mbuf, u_int len);

     M_LEADINGSPACE(struct mbuf	*mbuf);

     M_TRAILINGSPACE(struct mbuf *mbuf);

     M_MOVE_PKTHDR(struct mbuf *to, struct mbuf	*from);

     M_PREPEND(struct mbuf *mbuf, int len, int how);

     MCHTYPE(struct mbuf *mbuf,	u_int type);

     M_WRITABLE(struct mbuf *mbuf);

   Mbuf	allocation functions
     struct mbuf *
     m_get(int how, int	type);

     struct mbuf *
     m_getm(struct mbuf	*orig, int len,	int how, int type);

     struct mbuf *
     m_getcl(int how, short type, int flags);

     struct mbuf *
     m_getclr(int how, int type);

     struct mbuf *
     m_gethdr(int how, int type);

     struct mbuf *
     m_free(struct mbuf	*mbuf);

     m_freem(struct mbuf *mbuf);

   Mbuf	utility	functions
     m_adj(struct mbuf *mbuf, int len);

     struct mbuf *
     m_prepend(struct mbuf *mbuf, int len, int how);

     struct mbuf *
     m_pullup(struct mbuf *mbuf, int len);

     struct mbuf *
     m_copym(struct mbuf *mbuf,	int offset, int	len, int how);

     struct mbuf *
     m_copypacket(struct mbuf *mbuf, int how);

     struct mbuf *
     m_dup(struct mbuf *mbuf, int how);

     m_copydata(const struct mbuf *mbuf, int offset, int len, caddr_t buf);

     m_copyback(struct mbuf *mbuf, int offset, int len,	caddr_t	buf);

     struct mbuf *
     m_devget(char *buf, int len, int offset, struct ifnet *ifp,
	 void (*copy)(char *from, caddr_t to, u_int len));

     m_cat(struct mbuf *m, struct mbuf *n);

     m_fixhdr(struct mbuf *mbuf);

     m_dup_pkthdr(struct mbuf *to, struct mbuf *from);

     m_move_pkthdr(struct mbuf *to, struct mbuf	*from);

     m_length(struct mbuf *mbuf, struct	mbuf **last);

     struct mbuf *
     m_split(struct mbuf *mbuf,	int len, int how);

     m_apply(struct mbuf *mbuf,	int off, int len,
	 int (*f)(void *arg, void *data, u_int len), void *arg);

     struct mbuf *
     m_getptr(struct mbuf *mbuf, int loc, int *off);

     struct mbuf *
     m_defrag(struct mbuf *m0, int how);

     An	mbuf is	a basic	unit of	memory management in the kernel	IPC subsystem.
     Network packets and socket	buffers	are stored in mbufs.  A	network	packet
     may span multiple mbufs arranged into a mbuf chain	(linked	list), which
     allows adding or trimming network headers with little overhead.

     While a developer should not bother with mbuf internals without serious
     reason in order to	avoid incompatibilities	with future changes, it	is
     useful to understand the general structure	of an mbuf.

     An	mbuf consists of a variable-sized header and a small internal buffer
     for data.	The total size of an mbuf, MSIZE, is a constant	defined	in
     <sys/param.h>.  The mbuf header includes:

	   m_next     (struct mbuf *) A	pointer	to the next mbuf in the	mbuf

	   m_nextpkt  (struct mbuf *) A	pointer	to the next mbuf chain in the

	   m_data     (caddr_t)	A pointer to data attached to this mbuf.

	   m_len      (int) The	length of the data.

	   m_type     (short) The type of the data.

	   m_flags    (int) The	mbuf flags.

     The mbuf flag bits	are defined as follows:

     /*	mbuf flags */
     #define M_EXT	     0x0001  /*	has associated external	storage	*/
     #define M_PKTHDR	     0x0002  /*	start of record	*/
     #define M_EOR	     0x0004  /*	end of record */
     #define M_RDONLY	     0x0008  /*	associated data	marked read-only */
     #define M_PROTO1	     0x0010  /*	protocol-specific */
     #define M_PROTO2	     0x0020  /*	protocol-specific */
     #define M_PROTO3	     0x0040  /*	protocol-specific */
     #define M_PROTO4	     0x0080  /*	protocol-specific */
     #define M_PROTO5	     0x0100  /*	protocol-specific */
     #define M_PROTO6	     0x4000  /*	protocol-specific (avoid M_BCAST conflict) */
     #define M_FREELIST	     0x8000  /*	mbuf is	on the free list */

     /*	mbuf pkthdr flags (also	stored in m_flags) */
     #define M_BCAST	     0x0200  /*	send/received as link-level broadcast */
     #define M_MCAST	     0x0400  /*	send/received as link-level multicast */
     #define M_FRAG	     0x0800  /*	packet is fragment of larger packet */
     #define M_FIRSTFRAG     0x1000  /*	packet is first	fragment */
     #define M_LASTFRAG	     0x2000  /*	packet is last fragment	*/

     The available mbuf	types are defined as follows:

     /*	mbuf types */
     #define MT_DATA	     1	     /*	dynamic	(data) allocation */
     #define MT_HEADER	     2	     /*	packet header */
     #define MT_SONAME	     8	     /*	socket name */
     #define MT_FTABLE	     11	     /*	fragment reassembly header */
     #define MT_CONTROL	     14	     /*	extra-data protocol message */
     #define MT_OOBDATA	     15	     /*	expedited data */

     If	the M_PKTHDR flag is set, a struct pkthdr m_pkthdr is added to the
     mbuf header.  It contains a pointer to the	interface the packet has been
     received from (struct ifnet *rcvif), and the total	packet length (int
     len).  Optionally,	it may also contain an attached	list of	packet tags
     (struct m_tag).  See mbuf_tags(9) for details.  Fields used in offloading
     checksum calculation to the hardware are kept in m_pkthdr as well.	 See

     If	small enough, data is stored in	the internal data buffer of an mbuf.
     If	the data is sufficiently large,	another	mbuf may be added to the mbuf
     chain, or external	storage	may be associated with the mbuf.  MHLEN	bytes
     of	data can fit into an mbuf with the M_PKTHDR flag set, MLEN bytes can

     If	external storage is being associated with an mbuf, the m_ext header is
     added at the cost of losing the internal data buffer.  It includes	a
     pointer to	external storage, the size of the storage, a pointer to	a
     function used for freeing the storage, a pointer to an optional argument
     that can be passed	to the function, and a pointer to a reference counter.
     An	mbuf using external storage has	the M_EXT flag set.

     The system	supplies a macro for allocating	the desired external storage
     buffer, MEXTADD.

     The allocation and	management of the reference counter is handled by the
     subsystem.	 The developer can check whether the reference count for the
     external storage of a given mbuf is greater than 1	with the MEXT_IS_REF
     macro.  Similarly,	the developer can directly add and remove references,
     if	absolutely necessary, with the use of the MEXT_ADD_REF and
     MEXT_REM_REF macros.

     The system	also supplies a	default	type of	external storage buffer	called
     an	mbuf cluster.  Mbuf clusters can be allocated and configured with the
     use of the	MCLGET macro.  Each mbuf cluster is MCLBYTES in	size, where
     MCLBYTES is a machine-dependent constant.	The system defines an advisory
     macro MINCLSIZE, which is the smallest amount of data to put into an mbuf
     cluster.  It's equal to the sum of	MLEN and MHLEN.	 It is typically
     preferable	to store data into the data region of an mbuf, if size per-
     mits, as opposed to allocating a separate mbuf cluster to hold the	same

   Macros and Functions
     There are numerous	predefined macros and functions	that provide the de-
     veloper with common utilities.

	   mtod(mbuf, type)
	   Convert an mbuf pointer to a	data pointer.  The macro expands to
	   the data pointer cast to the	pointer	of the specified type.	Note:
	   It is advisable to ensure that there	is enough contiguous data in
	   mbuf.  See m_pullup() for details.

	   MGET(mbuf, how, type)
	   Allocate an mbuf and	initialize it to contain internal data.	 mbuf
	   will	point to the allocated mbuf on success,	or be set to NULL on
	   failure.  The how argument is to be set to M_TRYWAIT	or M_DONTWAIT.
	   It specifies	whether	the caller is willing to block if necessary.
	   If how is set to M_TRYWAIT, a failed	allocation will	result in the
	   caller being	put to sleep for a designated kern.ipc.mbuf_wait
	   (sysctl(8) tunable) number of ticks.	 A number of other functions
	   and macros related to mbufs have the	same argument because they may
	   at some point need to allocate new mbufs.

	   Programmers should be careful not to	confuse	the mbuf allocation
	   flag	M_DONTWAIT with	the malloc(9) allocation flag, M_NOWAIT.  They
	   are not the same.

	   MGETHDR(mbuf, how, type)
	   Allocate an mbuf and	initialize it to contain a packet header and
	   internal data.  See MGET() for details.

	   MCLGET(mbuf,	how)
	   Allocate and	attach an mbuf cluster to mbuf.	 If the	macro fails,
	   the M_EXT flag won't	be set in mbuf.

	   M_ALIGN(mbuf, len)
	   Set the pointer mbuf-_m_data	to place an object of the size len at
	   the end of the internal data	area of	mbuf, long word	aligned.  Ap-
	   plicable only if mbuf is newly allocated with MGET()	or m_get().

	   MH_ALIGN(mbuf, len)
	   Serves the same purpose as M_ALIGN()	does, but only for mbuf	newly
	   allocated with MGETHDR() or m_gethdr(), or initialized by
	   m_dup_pkthdr() or m_move_pkthdr().

	   Returns the number of bytes available before	the beginning of data
	   in mbuf.

	   Returns the number of bytes available after the end of data in

	   M_PREPEND(mbuf, len,	how)
	   This	macro operates on an mbuf chain.  It is	an optimized wrapper
	   for m_prepend() that	can make use of	possible empty space before
	   data	(e.g. left after trimming of a link-layer header).  The	new
	   mbuf	chain pointer or NULL is in mbuf after the call.

	   M_MOVE_PKTHDR(to, from)
	   Using this macro is equivalent to calling m_move_pkthdr(to, from).

	   This	macro will evaluate true if mbuf is not	marked M_RDONLY	and if
	   either mbuf does not	contain	external storage or, if	it does, then
	   if the reference count of the storage is not	greater	than 1.	 The
	   M_RDONLY flag can be	set in mbuf-_m_flags.  This can	be achieved
	   during setup	of the external	storage, by passing the	M_RDONLY bit
	   as a	flags argument to the MEXTADD()	macro, or can be directly set
	   in individual mbufs.

	   MCHTYPE(mbuf, type)
	   Change the type of mbuf to type.  This is a relatively expensive
	   operation and should	be avoided.

     The functions are:

	   m_get(how, type)
	   A function version of MGET()	for non-critical paths.

	   m_getm(orig,	len, how, type)
	   Allocate len	bytes worth of mbufs and mbuf clusters if necessary
	   and append the resulting allocated mbuf chain to the	mbuf chain
	   orig, if it is non-NULL.  If	the allocation fails at	any point,
	   free	whatever was allocated and return NULL.	 If orig is non-NULL,
	   it will not be freed.  It is	possible to use	m_getm() to either ap-
	   pend	len bytes to an	existing mbuf or mbuf chain (for example, one
	   which may be	sitting	in a pre-allocated ring) or to simply perform
	   an all-or-nothing mbuf and mbuf cluster allocation.

	   m_gethdr(how, type)
	   A function version of MGETHDR() for non-critical paths.

	   m_getcl(how,	type, flags)
	   Fetch an mbuf with a	mbuf cluster attached to it.  If one of	the
	   allocations fails, the entire allocation fails.  This routine is
	   the preferred way of	fetching both the mbuf and mbuf	cluster	to-
	   gether, as it avoids	having to unlock/relock	between	allocations.
	   Returns NULL	on failure.

	   m_getclr(how, type)
	   Allocate an mbuf and	zero out the data region.

	   Frees mbuf.	Returns	m_next of the freed mbuf.

     The functions below operate on mbuf chains.

	   Free	an entire mbuf chain, including	any external storage.

	   m_adj(mbuf, len)
	   Trim	len bytes from the head	of an mbuf chain if len	is positive,
	   from	the tail otherwise.

	   m_prepend(mbuf, len,	how)
	   Allocate a new mbuf and prepend it to the mbuf chain, handle
	   M_PKTHDR properly.  Note: It	doesn't	allocate any mbuf clusters, so
	   len must be less than MLEN or MHLEN,	depending on the M_PKTHDR flag

	   m_pullup(mbuf, len)
	   Arrange that	the first len bytes of an mbuf chain are contiguous
	   and lay in the data area of mbuf, so	they are accessible with
	   mtod(mbuf, type).  Return the new mbuf chain	on success, NULL on
	   failure (the	mbuf chain is freed in this case).  Note: It doesn't
	   allocate any	mbuf clusters, so len must be less than	MHLEN.

	   m_copym(mbuf, offset, len, how)
	   Make	a copy of an mbuf chain	starting offset	bytes from the begin-
	   ning, continuing for	len bytes.  If len is M_COPYALL, copy to the
	   end of the mbuf chain.  Note: The copy is read-only,	because	the
	   mbuf	clusters are not copied, only their reference counts are in-

	   m_copypacket(mbuf, how)
	   Copy	an entire packet including header, which must be present.
	   This	is an optimized	version	of the common case m_copym(mbuf, 0,
	   M_COPYALL, how).  Note: the copy is read-only, because the mbuf
	   clusters are	not copied, only their reference counts	are incre-

	   m_dup(mbuf, how)
	   Copy	a packet header	mbuf chain into	a completely new mbuf chain,
	   including copying any mbuf clusters.	 Use this instead of
	   m_copypacket() when you need	a writable copy	of an mbuf chain.

	   m_copydata(mbuf, offset, len, buf)
	   Copy	data from an mbuf chain	starting off bytes from	the beginning,
	   continuing for len bytes, into the indicated	buffer buf.

	   m_copyback(mbuf, offset, len, buf)
	   Copy	len bytes from the buffer buf back into	the indicated mbuf
	   chain, starting at offset bytes from	the beginning of the mbuf
	   chain, extending the	mbuf chain if necessary.  Note:	It doesn't al-
	   locate any mbuf clusters, just adds mbufs to	the mbuf chain.	 It's
	   safe	to set offset beyond the current mbuf chain end: zeroed	mbufs
	   will	be allocated to	fill the space.

	   m_length(mbuf, last)
	   Return the length of	the mbuf chain,	and optionally a pointer to
	   the last mbuf.

	   m_dup_pkthdr(to, from, how)
	   Upon	the function's completion, the mbuf to will contain an identi-
	   cal copy of from-_m_pkthdr and the per-packet attributes found in
	   the mbuf chain from.	 The mbuf from must have the flag M_PKTHDR
	   initially set, and to must be empty on entry.

	   m_move_pkthdr(to, from)
	   Move	m_pkthdr and the per-packet attributes from the	mbuf chain
	   from	to the mbuf to.	 The mbuf from must have the flag M_PKTHDR
	   initially set, and to must be empty on entry.  Upon the function's
	   completion, from will have the flag M_PKTHDR	and the	per-packet at-
	   tributes cleared.

	   Set the packet-header length	to the length of the mbuf chain.

	   m_devget(buf, len, offset, ifp, copy)
	   Copy	data from a device local memory	pointed	to by buf to an	mbuf
	   chain.  The copy is done using a specified copy routine copy, or
	   bcopy() if copy is NULL.

	   m_cat(m, n)
	   Concatenate n to m.	Both mbuf chains must be of the	same type.  N
	   is still valid after	the function returned.	Note: It does not han-
	   dle M_PKTHDR	and friends.

	   m_split(mbuf, len, how)
	   Partition an	mbuf chain in two pieces, returning the	tail: all but
	   the first len bytes.	 In case of failure, it	returns	NULL and at-
	   tempts to restore the mbuf chain to its original state.

	   m_apply(mbuf, off, len, f, arg)
	   Apply a function to an mbuf chain, at offset	off, for length	len
	   bytes.  Typically used to avoid calls to m_pullup() which would
	   otherwise be	unnecessary or undesirable.  arg is a convenience ar-
	   gument which	is passed to the callback function f.

	   Each	time f() is called, it will be passed arg, a pointer to	the
	   data	in the current mbuf, and the length len	of the data in this
	   mbuf	to which the function should be	applied.

	   The function	should return zero to indicate success;	otherwise, if
	   an error is indicated, then m_apply() will return the error and
	   stop	iterating through the mbuf chain.

	   m_getptr(mbuf, loc, off)
	   Return a pointer to the mbuf	containing the data located at loc
	   bytes from the beginning of the mbuf	chain.	The corresponding off-
	   set into the	mbuf will be stored in *off.

	   m_defrag(m0,	how)
	   Defragment an mbuf chain, returning the shortest possible chain of
	   mbufs and clusters.	If allocation fails and	this can not be	com-
	   pleted, NULL	will be	returned and the original chain	will be	un-
	   changed.  Upon success, the original	chain will be freed and	the
	   new chain will be returned.	how should be either M_TRYWAIT or
	   M_DONTWAIT, depending on the	caller's preference.

	   This	function is especially useful in network drivers, where	cer-
	   tain	long mbuf chains must be shortened before being	added to TX
	   descriptor lists.

     This section currently applies to TCP/IP only.  In	order to save the host
     CPU resources, computing checksums	is offloaded to	the network interface
     hardware if possible.  The	m_pkthdr member	of the leading mbuf of a
     packet contains two fields	used for that purpose, int csum_flags and int
     csum_data.	 The meaning of	those fields depends on	the direction a	packet
     flows in, and on whether the packet is fragmented.	 Henceforth,
     csum_flags	or csum_data of	a packet will denote the corresponding field
     of	the m_pkthdr member of the leading mbuf	in the mbuf chain containing
     the packet.

     On	output,	checksum offloading is attempted after the outgoing interface
     has been determined for a packet.	The interface-specific field
     ifnet.if_data.ifi_hwassist	(see ifnet(9)) is consulted for	the capabili-
     ties of the interface to assist in	computing checksums.  The csum_flags
     field of the packet header	is set to indicate which actions the interface
     is	supposed to perform on it.  The	actions	unsupported by the network in-
     terface are done in the software prior to passing the packet down to the
     interface driver; such actions will never be requested through

     The flags demanding a particular action from an interface are as follows:

	   CSUM_IP   The IP header checksum is to be computed and stored in
		     the corresponding field of	the packet.  The hardware is
		     expected to know the format of an IP header to determine
		     the offset	of the IP checksum field.

	   CSUM_TCP  The TCP checksum is to be computed.  (See below.)

	   CSUM_UDP  The UDP checksum is to be computed.  (See below.)

     Should a TCP or UDP checksum be offloaded to the hardware,	the field
     csum_data will contain the	byte offset of the checksum field relative to
     the end of	the IP header.	In this	case, the checksum field will be ini-
     tially set	by the TCP/IP module to	the checksum of	the pseudo header de-
     fined by the TCP and UDP specifications.

     For outbound packets which	have been fragmented by	the host CPU, the fol-
     lowing will also be true, regardless of the checksum flag settings:

	   o   all fragments will have the flag	M_FRAG set in their m_flags

	   o   the first and the last fragments	in the chain will have
	       M_FIRSTFRAG or M_LASTFRAG set in	their m_flags, correspond-

	   o   the first fragment in the chain will have the total number of
	       fragments contained in its csum_data field.

     The last rule for fragmented packets takes	precedence over	the one	for a
     TCP or UDP	checksum.  Nevertheless, offloading a TCP or UDP checksum is
     possible for a fragmented packet if the flag CSUM_IP_FRAGS	is set in the
     field ifnet.if_data.ifi_hwassist associated with the network interface.
     However, in this case the interface is expected to	figure out the loca-
     tion of the checksum field	within the sequence of fragments by itself be-
     cause csum_data contains a	fragment count instead of a checksum offset

     On	input, an interface indicates the actions it has performed on a	packet
     by	setting	one or more of the following flags in csum_flags associated
     with the packet:

	   CSUM_IP_CHECKED  The	IP header checksum has been computed.

	   CSUM_IP_VALID    The	IP header has a	valid checksum.	 This flag can
			    appear only	in combination with CSUM_IP_CHECKED.

	   CSUM_DATA_VALID  The	checksum of the	data portion of	the IP packet
			    has	been computed and stored in the	field
			    csum_data in network byte order.

	   CSUM_PSEUDO_HDR  Can	be set only along with CSUM_DATA_VALID to in-
			    dicate that	the IP data checksum found in
			    csum_data allows for the pseudo header defined by
			    the	TCP and	UDP specifications.  Otherwise the
			    checksum of	the pseudo header must be calculated
			    by the host	CPU and	added to csum_data to obtain
			    the	final checksum to be used for TCP or UDP vali-
			    dation purposes.

     If	a particular network interface just indicates success or failure of
     TCP or UDP	checksum validation without returning the exact	value of the
     checksum to the host CPU, its driver can mark CSUM_DATA_VALID and
     CSUM_PSEUDO_HDR in	csum_flags, and	set csum_data to 0xFFFF	hexadecimal to
     indicate a	valid checksum.	 It is a peculiarity of	the algorithm used
     that the Internet checksum	calculated over	any valid packet will be
     0xFFFF as long as the original checksum field is included.

     For inbound packets which are IP fragments, all csum_data fields will be
     summed during reassembly to obtain	the final checksum value passed	to an
     upper layer in the	csum_data field	of the reassembled packet.  The
     csum_flags	fields of all fragments	will be	consolidated using logical AND
     to	obtain the final value for csum_flags.	Thus, in order to successfully
     offload checksum computation for fragmented data, all fragments should
     have the same value of csum_flags.

     When running a kernel compiled with the option MBUF_STRESS_TEST, the fol-
     lowing sysctl(8)-controlled options may be	used to	create various fail-
     ure/extreme cases for testing of network drivers and other	parts of the
     kernel that rely on mbufs.

	    Causes ip_output() to fragment outgoing mbuf chains	into fragments
	    of the specified size.  Setting this variable to 1 is an excellent
	    way	to test	the long mbuf chain handling ability of	network	driv-

	    Causes the function	m_defrag() to randomly fail, returning NULL.
	    Any	piece of code which uses m_defrag() should be tested with this

     See above.

     ifnet(9), mbuf_tags(9)

     Mbufs appeared in an early	version	of BSD.	 Besides being used for	net-
     work packets, they	were used to store various dynamic structures, such as
     routing table entries, interface addresses, protocol control blocks, etc.

     The original mbuf man page	was written by Yar Tikhiy.

BSD				August 27, 2004				   BSD


Want to link to this manual page? Use this URL:

home | help