Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages


home | help
MBUF(9)                FreeBSD Kernel Developer's Manual               MBUF(9)

     mbuf -- memory management in the kernel IPC subsystem

     #include <sys/param.h>
     #include <sys/systm.h>
     #include <sys/mbuf.h>

   Mbuf allocation macros
     MGET(struct mbuf *mbuf, int how, short type);

     MGETHDR(struct mbuf *mbuf, int how, short type);

     MCLGET(struct mbuf *mbuf, int how);

     MEXTADD(struct mbuf *mbuf, caddr_t buf, u_int size,
         void (*free)(void *opt_args), void *opt_args, short flags, int type);

     MEXTFREE(struct mbuf *mbuf);

     MEXT_ADD_REF(struct mbuf *mbuf);

     MEXT_REM_REF(struct mbuf *mbuf);

     MFREE(struct mbuf *mbuf, struct mbuf *successor);

   Mbuf utility macros
     mtod(struct mbuf *mbuf, type);

     MEXT_IS_REF(struct mbuf *mbuf);

     M_ALIGN(struct mbuf *mbuf, u_int len);

     MH_ALIGN(struct mbuf *mbuf, u_int len);

     M_LEADINGSPACE(struct mbuf *mbuf);

     M_TRAILINGSPACE(struct mbuf *mbuf);

     M_MOVE_PKTHDR(struct mbuf *to, struct mbuf *from);

     M_PREPEND(struct mbuf *mbuf, int len, int how);

     MCHTYPE(struct mbuf *mbuf, u_int type);

     M_WRITABLE(struct mbuf *mbuf);

   Mbuf allocation functions
     struct mbuf *
     m_get(int how, int type);

     struct mbuf *
     m_getm(struct mbuf *orig, int len, int how, int type);

     struct mbuf *
     m_getcl(int how, short type, int flags);

     struct mbuf *
     m_getclr(int how, int type);

     struct mbuf *
     m_gethdr(int how, int type);

     struct mbuf *
     m_free(struct mbuf *mbuf);

     m_freem(struct mbuf *mbuf);

   Mbuf utility functions
     m_adj(struct mbuf *mbuf, int len);

     m_align(struct mbuf *mbuf, int len);

     m_append(struct mbuf *mbuf, int len, c_caddr_t cp);

     struct mbuf *
     m_prepend(struct mbuf *mbuf, int len, int how);

     struct mbuf *
     m_copyup(struct mbuf *mbuf, int len, int dstoff);

     struct mbuf *
     m_pullup(struct mbuf *mbuf, int len);

     struct mbuf *
     m_copym(struct mbuf *mbuf, int offset, int len, int how);

     struct mbuf *
     m_copypacket(struct mbuf *mbuf, int how);

     struct mbuf *
     m_dup(struct mbuf *mbuf, int how);

     m_copydata(const struct mbuf *mbuf, int offset, int len, caddr_t buf);

     m_copyback(struct mbuf *mbuf, int offset, int len, caddr_t buf);

     struct mbuf *
     m_devget(char *buf, int len, int offset, struct ifnet *ifp,
         void (*copy)(char *from, caddr_t to, u_int len));

     m_cat(struct mbuf *m, struct mbuf *n);

     m_fixhdr(struct mbuf *mbuf);

     m_dup_pkthdr(struct mbuf *to, struct mbuf *from);

     m_move_pkthdr(struct mbuf *to, struct mbuf *from);

     m_length(struct mbuf *mbuf, struct mbuf **last);

     struct mbuf *
     m_split(struct mbuf *mbuf, int len, int how);

     m_apply(struct mbuf *mbuf, int off, int len,
         int (*f)(void *arg, void *data, u_int len), void *arg);

     struct mbuf *
     m_getptr(struct mbuf *mbuf, int loc, int *off);

     struct mbuf *
     m_defrag(struct mbuf *m0, int how);

     struct mbuf *
     m_unshare(struct mbuf *m0, int how);

     An mbuf is a basic unit of memory management in the kernel IPC subsystem.
     Network packets and socket buffers are stored in mbufs.  A network packet
     may span multiple mbufs arranged into a mbuf chain (linked list), which
     allows adding or trimming network headers with little overhead.

     While a developer should not bother with mbuf internals without serious
     reason in order to avoid incompatibilities with future changes, it is
     useful to understand the general structure of an mbuf.

     An mbuf consists of a variable-sized header and a small internal buffer
     for data.  The total size of an mbuf, MSIZE, is a constant defined in
     <sys/param.h>.  The mbuf header includes:

           m_next     (struct mbuf *) A pointer to the next mbuf in the mbuf

           m_nextpkt  (struct mbuf *) A pointer to the next mbuf chain in the

           m_data     (caddr_t) A pointer to data attached to this mbuf.

           m_len      (int) The length of the data.

           m_type     (short) The type of the data.

           m_flags    (int) The mbuf flags.

     The mbuf flag bits are defined as follows:

     /* mbuf flags */
     #define M_EXT           0x0001  /* has associated external storage */
     #define M_PKTHDR        0x0002  /* start of record */
     #define M_EOR           0x0004  /* end of record */
     #define M_RDONLY        0x0008  /* associated data marked read-only */
     #define M_PROTO1        0x0010  /* protocol-specific */
     #define M_PROTO2        0x0020  /* protocol-specific */
     #define M_PROTO3        0x0040  /* protocol-specific */
     #define M_PROTO4        0x0080  /* protocol-specific */
     #define M_PROTO5        0x0100  /* protocol-specific */
     #define M_PROTO6        0x4000  /* protocol-specific (avoid M_BCAST conflict) */
     #define M_FREELIST      0x8000  /* mbuf is on the free list */

     /* mbuf pkthdr flags (also stored in m_flags) */
     #define M_BCAST         0x0200  /* send/received as link-level broadcast */
     #define M_MCAST         0x0400  /* send/received as link-level multicast */
     #define M_FRAG          0x0800  /* packet is fragment of larger packet */
     #define M_FIRSTFRAG     0x1000  /* packet is first fragment */
     #define M_LASTFRAG      0x2000  /* packet is last fragment */

     The available mbuf types are defined as follows:

     /* mbuf types */
     #define MT_DATA         1       /* dynamic (data) allocation */
     #define MT_HEADER       2       /* packet header */
     #define MT_SONAME       8       /* socket name */
     #define MT_FTABLE       11      /* fragment reassembly header */
     #define MT_CONTROL      14      /* extra-data protocol message */
     #define MT_OOBDATA      15      /* expedited data */

     If the M_PKTHDR flag is set, a struct pkthdr m_pkthdr is added to the
     mbuf header.  It contains a pointer to the interface the packet has been
     received from (struct ifnet *rcvif), and the total packet length (int
     len).  Optionally, it may also contain an attached list of packet tags
     (struct m_tag).  See mbuf_tags(9) for details.  Fields used in offloading
     checksum calculation to the hardware are kept in m_pkthdr as well.  See

     If small enough, data is stored in the internal data buffer of an mbuf.
     If the data is sufficiently large, another mbuf may be added to the mbuf
     chain, or external storage may be associated with the mbuf.  MHLEN bytes
     of data can fit into an mbuf with the M_PKTHDR flag set, MLEN bytes can

     If external storage is being associated with an mbuf, the m_ext header is
     added at the cost of losing the internal data buffer.  It includes a
     pointer to external storage, the size of the storage, a pointer to a
     function used for freeing the storage, a pointer to an optional argument
     that can be passed to the function, and a pointer to a reference counter.
     An mbuf using external storage has the M_EXT flag set.

     The system supplies a macro for allocating the desired external storage
     buffer, MEXTADD.

     The allocation and management of the reference counter is handled by the
     subsystem.  The developer can check whether the reference count for the
     external storage of a given mbuf is greater than 1 with the MEXT_IS_REF
     macro.  Similarly, the developer can directly add and remove references,
     if absolutely necessary, with the use of the MEXT_ADD_REF and
     MEXT_REM_REF macros.

     The system also supplies a default type of external storage buffer called
     an mbuf cluster.  Mbuf clusters can be allocated and configured with the
     use of the MCLGET macro.  Each mbuf cluster is MCLBYTES in size, where
     MCLBYTES is a machine-dependent constant.  The system defines an advisory
     macro MINCLSIZE, which is the smallest amount of data to put into an mbuf
     cluster.  It is equal to the sum of MLEN and MHLEN.  It is typically
     preferable to store data into the data region of an mbuf, if size per-
     mits, as opposed to allocating a separate mbuf cluster to hold the same

   Macros and Functions
     There are numerous predefined macros and functions that provide the
     developer with common utilities.

           mtod(mbuf, type)
           Convert an mbuf pointer to a data pointer.  The macro expands to
           the data pointer cast to the pointer of the specified type.  Note:
           It is advisable to ensure that there is enough contiguous data in
           mbuf.  See m_pullup() for details.

           MGET(mbuf, how, type)
           Allocate an mbuf and initialize it to contain internal data.  mbuf
           will point to the allocated mbuf on success, or be set to NULL on
           failure.  The how argument is to be set to M_TRYWAIT or M_DONTWAIT.
           It specifies whether the caller is willing to block if necessary.
           If how is set to M_TRYWAIT, a failed allocation will result in the
           caller being put to sleep for a designated kern.ipc.mbuf_wait
           (sysctl(8) tunable) number of ticks.  A number of other functions
           and macros related to mbufs have the same argument because they may
           at some point need to allocate new mbufs.

           Programmers should be careful not to confuse the mbuf allocation
           flag M_DONTWAIT with the malloc(9) allocation flag, M_NOWAIT.  They
           are not the same.

           MGETHDR(mbuf, how, type)
           Allocate an mbuf and initialize it to contain a packet header and
           internal data.  See MGET() for details.

           MCLGET(mbuf, how)
           Allocate and attach an mbuf cluster to mbuf.  If the macro fails,
           the M_EXT flag will not be set in mbuf.

           M_ALIGN(mbuf, len)
           Set the pointer mbuf-_m_data to place an object of the size len at
           the end of the internal data area of mbuf, long word aligned.
           Applicable only if mbuf is newly allocated with MGET() or m_get().

           MH_ALIGN(mbuf, len)
           Serves the same purpose as M_ALIGN() does, but only for mbuf newly
           allocated with MGETHDR() or m_gethdr(), or initialized by
           m_dup_pkthdr() or m_move_pkthdr().

           m_align(mbuf, len)
           Services the same purpose as M_ALIGN() but handles any type of

           Returns the number of bytes available before the beginning of data
           in mbuf.

           Returns the number of bytes available after the end of data in

           M_PREPEND(mbuf, len, how)
           This macro operates on an mbuf chain.  It is an optimized wrapper
           for m_prepend() that can make use of possible empty space before
           data (e.g. left after trimming of a link-layer header).  The new
           mbuf chain pointer or NULL is in mbuf after the call.

           M_MOVE_PKTHDR(to, from)
           Using this macro is equivalent to calling m_move_pkthdr(to, from).

           This macro will evaluate true if mbuf is not marked M_RDONLY and if
           either mbuf does not contain external storage or, if it does, then
           if the reference count of the storage is not greater than 1.  The
           M_RDONLY flag can be set in mbuf-_m_flags.  This can be achieved
           during setup of the external storage, by passing the M_RDONLY bit
           as a flags argument to the MEXTADD() macro, or can be directly set
           in individual mbufs.

           MCHTYPE(mbuf, type)
           Change the type of mbuf to type.  This is a relatively expensive
           operation and should be avoided.

     The functions are:

           m_get(how, type)
           A function version of MGET() for non-critical paths.

           m_getm(orig, len, how, type)
           Allocate len bytes worth of mbufs and mbuf clusters if necessary
           and append the resulting allocated mbuf chain to the mbuf chain
           orig, if it is non-NULL.  If the allocation fails at any point,
           free whatever was allocated and return NULL.  If orig is non-NULL,
           it will not be freed.  It is possible to use m_getm() to either
           append len bytes to an existing mbuf or mbuf chain (for example,
           one which may be sitting in a pre-allocated ring) or to simply per-
           form an all-or-nothing mbuf and mbuf cluster allocation.

           m_gethdr(how, type)
           A function version of MGETHDR() for non-critical paths.

           m_getcl(how, type, flags)
           Fetch an mbuf with a mbuf cluster attached to it.  If one of the
           allocations fails, the entire allocation fails.  This routine is
           the preferred way of fetching both the mbuf and mbuf cluster
           together, as it avoids having to unlock/relock between allocations.
           Returns NULL on failure.

           m_getclr(how, type)
           Allocate an mbuf and zero out the data region.

           Frees mbuf.  Returns m_next of the freed mbuf.

     The functions below operate on mbuf chains.

           Free an entire mbuf chain, including any external storage.

           m_adj(mbuf, len)
           Trim len bytes from the head of an mbuf chain if len is positive,
           from the tail otherwise.

           m_append(mbuf, len, cp)
           Append len bytes of data cp to the mbuf chain.  Extend the mbuf
           chain if the new data does not fit in existing space.

           m_prepend(mbuf, len, how)
           Allocate a new mbuf and prepend it to the mbuf chain, handle
           M_PKTHDR properly.  Note: It does not allocate any mbuf clusters,
           so len must be less than MLEN or MHLEN, depending on the M_PKTHDR
           flag setting.

           m_copyup(mbuf, len, dstoff)
           Similar to m_pullup() but copies len bytes of data into a new mbuf
           at dstoff bytes into the mbuf.  The dstoff argument aligns the data
           and leaves room for a link layer header.  Returns the new mbuf
           chain on success, and frees the mbuf chain and returns NULL on
           failure.  Note: The function does not allocate mbuf clusters, so
           len + dstoff must be less than MHLEN.

           m_pullup(mbuf, len)
           Arrange that the first len bytes of an mbuf chain are contiguous
           and lay in the data area of mbuf, so they are accessible with
           mtod(mbuf, type).  Return the new mbuf chain on success, NULL on
           failure (the mbuf chain is freed in this case).  Note: It does not
           allocate any mbuf clusters, so len must be less than MHLEN.

           m_copym(mbuf, offset, len, how)
           Make a copy of an mbuf chain starting offset bytes from the begin-
           ning, continuing for len bytes.  If len is M_COPYALL, copy to the
           end of the mbuf chain.  Note: The copy is read-only, because the
           mbuf clusters are not copied, only their reference counts are

           m_copypacket(mbuf, how)
           Copy an entire packet including header, which must be present.
           This is an optimized version of the common case m_copym(mbuf, 0,
           M_COPYALL, how).  Note: the copy is read-only, because the mbuf
           clusters are not copied, only their reference counts are incre-

           m_dup(mbuf, how)
           Copy a packet header mbuf chain into a completely new mbuf chain,
           including copying any mbuf clusters.  Use this instead of
           m_copypacket() when you need a writable copy of an mbuf chain.

           m_copydata(mbuf, offset, len, buf)
           Copy data from an mbuf chain starting off bytes from the beginning,
           continuing for len bytes, into the indicated buffer buf.

           m_copyback(mbuf, offset, len, buf)
           Copy len bytes from the buffer buf back into the indicated mbuf
           chain, starting at offset bytes from the beginning of the mbuf
           chain, extending the mbuf chain if necessary.  Note: It does not
           allocate any mbuf clusters, just adds mbufs to the mbuf chain.  It
           is safe to set offset beyond the current mbuf chain end: zeroed
           mbufs will be allocated to fill the space.

           m_length(mbuf, last)
           Return the length of the mbuf chain, and optionally a pointer to
           the last mbuf.

           m_dup_pkthdr(to, from, how)
           Upon the function's completion, the mbuf to will contain an identi-
           cal copy of from-_m_pkthdr and the per-packet attributes found in
           the mbuf chain from.  The mbuf from must have the flag M_PKTHDR
           initially set, and to must be empty on entry.

           m_move_pkthdr(to, from)
           Move m_pkthdr and the per-packet attributes from the mbuf chain
           from to the mbuf to.  The mbuf from must have the flag M_PKTHDR
           initially set, and to must be empty on entry.  Upon the function's
           completion, from will have the flag M_PKTHDR and the per-packet
           attributes cleared.

           Set the packet-header length to the length of the mbuf chain.

           m_devget(buf, len, offset, ifp, copy)
           Copy data from a device local memory pointed to by buf to an mbuf
           chain.  The copy is done using a specified copy routine copy, or
           bcopy() if copy is NULL.

           m_cat(m, n)
           Concatenate n to m.  Both mbuf chains must be of the same type.  N
           is still valid after the function returned.  Note: It does not han-
           dle M_PKTHDR and friends.

           m_split(mbuf, len, how)
           Partition an mbuf chain in two pieces, returning the tail: all but
           the first len bytes.  In case of failure, it returns NULL and
           attempts to restore the mbuf chain to its original state.

           m_apply(mbuf, off, len, f, arg)
           Apply a function to an mbuf chain, at offset off, for length len
           bytes.  Typically used to avoid calls to m_pullup() which would
           otherwise be unnecessary or undesirable.  arg is a convenience
           argument which is passed to the callback function f.

           Each time f() is called, it will be passed arg, a pointer to the
           data in the current mbuf, and the length len of the data in this
           mbuf to which the function should be applied.

           The function should return zero to indicate success; otherwise, if
           an error is indicated, then m_apply() will return the error and
           stop iterating through the mbuf chain.

           m_getptr(mbuf, loc, off)
           Return a pointer to the mbuf containing the data located at loc
           bytes from the beginning of the mbuf chain.  The corresponding off-
           set into the mbuf will be stored in *off.

           m_defrag(m0, how)
           Defragment an mbuf chain, returning the shortest possible chain of
           mbufs and clusters.  If allocation fails and this can not be com-
           pleted, NULL will be returned and the original chain will be
           unchanged.  Upon success, the original chain will be freed and the
           new chain will be returned.  how should be either M_TRYWAIT or
           M_DONTWAIT, depending on the caller's preference.

           This function is especially useful in network drivers, where cer-
           tain long mbuf chains must be shortened before being added to TX
           descriptor lists.

           m_unshare(m0, how)
           Create a version of the specified mbuf chain whose contents can be
           safely modified without affecting other users.  If allocation fails
           and this operation can not be completed, NULL will be returned.
           The original mbuf chain is always reclaimed and the reference count
           of any shared mbuf clusters is decremented.  how should be either
           M_TRYWAIT or M_DONTWAIT, depending on the caller's preference.  As
           a side-effect of this process the returned mbuf chain may be com-

           This function is especially useful in the transmit path of network
           code, when data must be encrypted or otherwise altered prior to

     This section currently applies to TCP/IP only.  In order to save the host
     CPU resources, computing checksums is offloaded to the network interface
     hardware if possible.  The m_pkthdr member of the leading mbuf of a
     packet contains two fields used for that purpose, int csum_flags and int
     csum_data.  The meaning of those fields depends on the direction a packet
     flows in, and on whether the packet is fragmented.  Henceforth,
     csum_flags or csum_data of a packet will denote the corresponding field
     of the m_pkthdr member of the leading mbuf in the mbuf chain containing
     the packet.

     On output, checksum offloading is attempted after the outgoing interface
     has been determined for a packet.  The interface-specific field
     ifnet.if_data.ifi_hwassist (see ifnet(9)) is consulted for the capabili-
     ties of the interface to assist in computing checksums.  The csum_flags
     field of the packet header is set to indicate which actions the interface
     is supposed to perform on it.  The actions unsupported by the network
     interface are done in the software prior to passing the packet down to
     the interface driver; such actions will never be requested through

     The flags demanding a particular action from an interface are as follows:

           CSUM_IP   The IP header checksum is to be computed and stored in
                     the corresponding field of the packet.  The hardware is
                     expected to know the format of an IP header to determine
                     the offset of the IP checksum field.

           CSUM_TCP  The TCP checksum is to be computed.  (See below.)

           CSUM_UDP  The UDP checksum is to be computed.  (See below.)

     Should a TCP or UDP checksum be offloaded to the hardware, the field
     csum_data will contain the byte offset of the checksum field relative to
     the end of the IP header.  In this case, the checksum field will be ini-
     tially set by the TCP/IP module to the checksum of the pseudo header
     defined by the TCP and UDP specifications.

     For outbound packets which have been fragmented by the host CPU, the fol-
     lowing will also be true, regardless of the checksum flag settings:

           +o   all fragments will have the flag M_FRAG set in their m_flags

           +o   the first and the last fragments in the chain will have
               M_FIRSTFRAG or M_LASTFRAG set in their m_flags, correspond-

           +o   the first fragment in the chain will have the total number of
               fragments contained in its csum_data field.

     The last rule for fragmented packets takes precedence over the one for a
     TCP or UDP checksum.  Nevertheless, offloading a TCP or UDP checksum is
     possible for a fragmented packet if the flag CSUM_IP_FRAGS is set in the
     field ifnet.if_data.ifi_hwassist associated with the network interface.
     However, in this case the interface is expected to figure out the loca-
     tion of the checksum field within the sequence of fragments by itself
     because csum_data contains a fragment count instead of a checksum offset

     On input, an interface indicates the actions it has performed on a packet
     by setting one or more of the following flags in csum_flags associated
     with the packet:

           CSUM_IP_CHECKED  The IP header checksum has been computed.

           CSUM_IP_VALID    The IP header has a valid checksum.  This flag can
                            appear only in combination with CSUM_IP_CHECKED.

           CSUM_DATA_VALID  The checksum of the data portion of the IP packet
                            has been computed and stored in the field
                            csum_data in network byte order.

           CSUM_PSEUDO_HDR  Can be set only along with CSUM_DATA_VALID to
                            indicate that the IP data checksum found in
                            csum_data allows for the pseudo header defined by
                            the TCP and UDP specifications.  Otherwise the
                            checksum of the pseudo header must be calculated
                            by the host CPU and added to csum_data to obtain
                            the final checksum to be used for TCP or UDP vali-
                            dation purposes.

     If a particular network interface just indicates success or failure of
     TCP or UDP checksum validation without returning the exact value of the
     checksum to the host CPU, its driver can mark CSUM_DATA_VALID and
     CSUM_PSEUDO_HDR in csum_flags, and set csum_data to 0xFFFF hexadecimal to
     indicate a valid checksum.  It is a peculiarity of the algorithm used
     that the Internet checksum calculated over any valid packet will be
     0xFFFF as long as the original checksum field is included.

     For inbound packets which are IP fragments, all csum_data fields will be
     summed during reassembly to obtain the final checksum value passed to an
     upper layer in the csum_data field of the reassembled packet.  The
     csum_flags fields of all fragments will be consolidated using logical AND
     to obtain the final value for csum_flags.  Thus, in order to successfully
     offload checksum computation for fragmented data, all fragments should
     have the same value of csum_flags.

     When running a kernel compiled with the option MBUF_STRESS_TEST, the fol-
     lowing sysctl(8)-controlled options may be used to create various fail-
     ure/extreme cases for testing of network drivers and other parts of the
     kernel that rely on mbufs.

            Causes ip_output() to fragment outgoing mbuf chains into fragments
            of the specified size.  Setting this variable to 1 is an excellent
            way to test the long mbuf chain handling ability of network driv-

            Causes the function m_defrag() to randomly fail, returning NULL.
            Any piece of code which uses m_defrag() should be tested with this

     See above.

     ifnet(9), mbuf_tags(9)

     Mbufs appeared in an early version of BSD.  Besides being used for net-
     work packets, they were used to store various dynamic structures, such as
     routing table entries, interface addresses, protocol control blocks, etc.

     The original mbuf manual page was written by Yar Tikhiy.

FreeBSD 6.2                     March 15, 2006                     FreeBSD 6.2


Want to link to this manual page? Use this URL:

home | help