OpenBSD manual page server

Manual Page Search Parameters
MBUF(9) Kernel Developer's Manual MBUF(9)

mbuf — kernel memory management for networking protocols

#include <sys/mbuf.h>

struct mbuf *
m_copym2(struct mbuf *m, int off, int len, int wait);

struct mbuf *
m_copym(struct mbuf *m, int off, int len, int wait);

struct mbuf *
m_free(struct mbuf *m);

MFREE(struct mbuf *m, struct mbuf *n);

struct mbuf *
m_get(int how, int type);

MGET(struct mbuf *m, int how, int type);

struct mbuf *
m_getclr(int how, int type);

struct mbuf *
m_gethdr(int how, int type);

MGETHDR(struct mbuf *m, int how, int type);

struct mbuf *
m_prepend(struct mbuf *m, int len, int how);

M_PREPEND(struct mbuf *m, int plen, int how);

struct mbuf *
m_pulldown(struct mbuf *m, int off, int len, int *offp);

struct mbuf *
m_pullup(struct mbuf *n, int len);

struct mbuf *
m_split(struct mbuf *m0, int len0, int wait);

struct mbuf *
m_inject(struct mbuf *m0, int len0, int siz, int wait);

struct mbuf *
m_getptr(struct mbuf *m, int loc, int *off);

void
m_adj(struct mbuf *mp, int req_len);

int
m_copyback(struct mbuf *m0, int off, int len, const void *cp, int wait);

int
m_defrag(struct mbuf *m, int wait);

void
m_freem(struct mbuf *m);

void
m_reclaim(void);

void
m_copydata(struct mbuf *m, int off, int len, caddr_t cp);

void
m_cat(struct mbuf *m, struct mbuf *n);

struct mbuf *
m_devget(char *buf, int totlen, int off, struct ifnet *ifp);

int
m_apply(struct mbuf *m, int off, int len, int (*func)(caddr_t, caddr_t, unsigned int), caddr_t fstate);

MCLGET(struct mbuf *m, int how);

struct mbuf *
MCLGETI(struct mbuf *m, int how, struct ifnet *ifp, int len);

MEXTADD(struct mbuf *m, caddr_t buf, u_int size, int flags, void (*free)(caddr_t, u_int, void *), void *arg);

M_ALIGN(struct mbuf *m, int len);

MH_ALIGN(struct mbuf *m, int len);

M_READONLY(struct mbuf *m);

M_LEADINGSPACE(struct mbuf *m);

M_TRAILINGSPACE(struct mbuf *m);

int
m_dup_pkthdr(struct mbuf *to, struct mbuf *from, int how);

void
ml_init(struct mbuf_list *ml);

void
ml_enqueue(struct mbuf_list *ml, struct mbuf *m);

struct mbuf *
ml_dequeue(struct mbuf_list *ml);

struct mbuf *
ml_dechain(struct mbuf_list *ml);

struct mbuf *
ml_filter(struct mbuf_list *ml, int (*filter)(void *, struct mbuf *), void *context);

unsigned int
ml_len(struct mbuf_list *ml);

int
ml_empty(struct mbuf_list *ml);

struct mbuf_list
MBUF_LIST_INITIALIZER();

MBUF_LIST_FOREACH(struct mbuf_list *ml, VARNAME);

mq_init(struct mbuf_queue *mq, unsigned int maxlen, int ipl);

int
mq_enqueue(struct mbuf_queue *mq, struct mbuf *m);

struct mbuf *
mq_dequeue(struct mbuf_queue *mq);

int
mq_enlist(struct mbuf_queue *mq, struct mbuf_list *ml);

void
mq_delist(struct mbuf_queue *mq, struct mbuf_list *ml);

struct mbuf *
mq_dechain(struct mbuf_queue *mq);

struct mbuf *
mq_filter(struct mbuf_queue *mq, int (*filter)(void *, struct mbuf *), void *context);

unsigned int
mq_len(struct mbuf_queue *mq);

int
mq_empty(struct mbuf_queue *mq);

unsigned int
mq_drops(struct mbuf_queue *mq);

void
mq_set_maxlen(struct mbuf_queue *mq, unsigned int);

struct mbuf_queue
MBUF_QUEUE_INITIALIZER(unsigned int maxlen, int ipl);

#define MSIZE           256

#define MLEN            (MSIZE - sizeof(struct m_hdr))
#define MHLEN           (MLEN - sizeof(struct pkthdr))

#define MAXMCLBYTES     (64 * 1024)
#define MINCLSIZE       (MHLEN + MLEN + 1)
#define M_MAXCOMPRESS   (MHLEN / 2)

#define MCLSHIFT        11

#define MCLBYTES        (1 << MCLSHIFT)
#define MCLOFSET        (MCLBYTES - 1)

#define mtod(m,t)       ((t)((m)->m_data))

struct m_hdr {
        struct  mbuf *mh_next;
        struct  mbuf *mh_nextpkt;
        caddr_t mh_data;
        u_int   mh_len;
        short   mh_type;
        u_short mh_flags;
};

struct pkthdr {
	struct  ifnet *rcvif;
	SLIST_HEAD(packet_tags, m_tag) tags;
	int     len;
	u_int16_t tagsset;
	u_int16_t pad;
	u_int16_t csum_flags;
	u_int16_t ether_vtag;
	u_int	 ph_rtableid;
	void	*ph_cookie;
	struct	pkthdr_pf pf;
};

struct pkthdr_pf {
	struct pf_state_key *statekey;
	struct inpcb *inp;
	u_int32_t qid;
	u_int16_t tag;
	u_int8_t  flags;
	u_int8_t  routed;
	u_int8_t  prio;
	u_int8_t  pad[3];
};

struct mbuf_ext {
	caddr_t ext_buf;
	void    (*ext_free)(caddr_t, u_int, void *);
	void    *ext_arg;
	u_int   ext_size;
	struct mbuf *ext_nextref;
	struct mbuf *ext_prevref;
};

struct mbuf {
        struct  m_hdr m_hdr;
        union {
                struct {
                        struct  pkthdr MH_pkthdr;
                        union {
                                struct  mbuf_ext MH_ext;
                                char    MH_databuf[MHLEN];
                        } MH_dat;
                } MH;
                char    M_databuf[MLEN];
        } M_dat;
};

#define m_next          m_hdr.mh_next
#define m_len           m_hdr.mh_len
#define m_data          m_hdr.mh_data
#define m_type          m_hdr.mh_type
#define m_flags         m_hdr.mh_flags
#define m_nextpkt       m_hdr.mh_nextpkt
#define m_pkthdr        M_dat.MH.MH_pkthdr
#define m_ext           M_dat.MH.MH_dat.MH_ext
#define m_pktdat        M_dat.MH.MH_dat.MH_databuf
#define m_dat           M_dat.M_databuf

The mbuf functions provide a way to manage the memory buffers used by the kernel's networking subsystem. Several functions and macros are used to allocate and deallocate mbufs, but also to get, inject, remove, copy, modify, prepend or append data inside these mbufs. The size of an mbuf is defined by MSIZE.

An mbuf structure is defined as an m_hdr structure followed by a union. The header contains the following elements:

mh_next
A pointer to the next mbuf in the mbuf chain.
mh_nextpkt
A pointer to the next mbuf chain (i.e., packet) in the queue.
mh_data
Indicates the address of the beginning of data in the mbuf.
mh_len
Indicates the amount of data in the mbuf.
mh_type
Indicates the type of data contained in the mbuf (see below).
mh_flags
Flags (see below).

The mh_type variable can take the following values:

the mbuf should be on the free list.
the data in the mbuf was dynamically allocated.
the data contains a packet header.
the data is a socket name.
the data are socket options.
the data is a fragment reassembly header.
the mbuf contains extra-data protocol message.
the data consists of out-of-band data.

The mh_flags variable can take the following values:

mbuf has associated external storage.
the mbuf is the first that forms a packet.
end of record.
external storage is writable.
protocol-specific.
m_pkthdr.ether_vtag variable is valid.
for mbuf statistics.
dropped by bpf(4) filter.
packet send/received as link-level broadcast.
packet send/received as link-level multicast.
packet was encrypted (ESP-transport).
packet was authenticated (AH or ESP).
header was IP-in-IP encapsulated by tunnel mode IPsec.
Zero the data part of the mbufs in the mbuf chain pointed to by m_free.
header was decompressed.
link layer specific flag.

An external cluster is used when the data to hold in the mbuf is large. The size of an external cluster is between MCLBYTES and MAXMCLBYTES. A cluster should be used when the size of the data reach MINCLSIZE (the minimum size to be held by an external cluster).

The combination of the M_EXT and M_PKTHDR flags give four types of mbuf. When none of these constants are in use, the mbuf is a "normal" one, where the data part of the mbuf has the following elements:

m_dat
buffer holding the data (size MLEN).

When only M_PKTHDR is set, the data contained in the mbuf is a packet header. The data itself is contained in the mbuf (just like the previous case), but part of the mbuf is used to store a packet header. The data part has then the following elements:

m_pkthdr
packet header, containing the length of the data, a pointer to the interface on which the data was received, checksum information and list of mbuf_tags(9).
m_pktdat
buffer holding the data (size MHLEN).

The m_pkthdr.csum_flags variable can take the following values:

IPv4 checksum needed.
TCP checksum needed.
UDP checksum needed.
ICMP/ICMPv6 checksum needed.
IPv4 checksum verified.
IPv4 checksum bad.
TCP checksum verified.
TCP checksum bad.
UDP checksum verified.
UDP checksum bad.
ICMP/ICMPv6 checksum verified.
ICMP/ICMPv6 checksum bad.

When only M_EXT flag is set, an external storage buffer is being used to hold the data, which is no longer stored in the mbuf. The data part of the mbuf has now the following elements:

m_pkthdr
a packet header, just like the previous case, but it is empty. No information is stored here.
m_ext
a structure containing information about the external storage buffer. The information consists of the address of the external buffer, a pointer to the function used to free the buffer, a pointer to the arguments of the function, the size of the buffer, the type of the buffer, and pointers to the previous and next mbufs using this cluster.

When both the M_EXT and M_PKTHDR flags are set, an external storage buffer is being used to store the data and this data contains a packet header. The structure used is the same as the previous one except that the m_pkthdr element is not empty, it contains the same information as when M_PKTHDR is used alone.

(struct mbuf *m, int off, int len, int wait)
Copy an mbuf chain starting at off bytes from the beginning and continuing for len bytes. If off is zero and m has the M_PKTHDR flag set, the header is copied. If len is M_COPYALL the whole mbuf is copied. The wait parameter can be M_WAIT or M_DONTWAIT. It does not copy clusters, it just increases their reference count.
(struct mbuf *m, int off, int len, int wait)
The same as m_copym() except that it copies cluster mbufs, whereas m_copym() just increases the reference count of the clusters.
(struct mbuf *m)
Free the mbuf pointed to by m. A pointer to the successor of the mbuf, if it exists, is returned by the function.
(struct mbuf *m, struct mbuf *n)
Free the mbuf pointed to by m and use n to point to the next mbuf in the chain if it exists. See m_free().
(int how, int type)
Return a pointer to an mbuf of the type specified. If the how argument is M_WAITOK, the function may call tsleep(9) to await resources. If how is M_DONTWAIT and resources are not available, m_get() returns NULL.
(struct mbuf *m, int how, int type)
Return a pointer to an mbuf in m of the type specified. See m_get() for a description of how.
(int how, int type)
Return a pointer to an mbuf of the type specified, and clear the data area of the mbuf. See m_get() for a description of how.
(int how, int type)
Return a pointer to an mbuf of the type specified after initializing it to contain a packet header. See m_get() for a description of how.
(struct mbuf *m, int how, int type)
Return a pointer to an mbuf of the type specified after initializing it to contain a packet header. See m_get() for a description of how.
m_prepend(struct mbuf *m, int len, int how)
Allocate a new mbuf and prepend it to the mbuf chain pointed to by m. If m points to an mbuf with a packet header, it is moved to the new mbuf that has been prepended. The return value is a pointer on the new mbuf chain. If this function fails to allocate a new mbuf, m is freed. See m_get() for a description of how.

() should never be called directly. Use () instead.

M_PREPEND(struct mbuf *m, int plen, int how)
Prepend space of size plen to the mbuf pointed to by m. If a new mbuf must be allocated, how specifies whether to wait or not. If this function fails to allocate a new mbuf, m is freed.
(struct mbuf *m, int off, int len, int *offp)
Ensure that the data in the mbuf chain starting at off and ending at off+len will be put in a continuous memory region. If memory must be allocated, then it will fail if the len argument is greater than MAXMCLBYTES. The pointer returned points to an mbuf in the chain and the new offset for data in this mbuf is *offp. If this function fails, m is freed.
(struct mbuf *n, int len)
Ensure that the data in the mbuf chain starting at the beginning of the chain and ending at len will be put in continuous memory region. If memory must be allocated, then it will fail if the len argument is greater than MAXMCLBYTES. If this function fails, n is freed.
(struct mbuf *m0, int len0, int wait)
Split an mbuf chain in two pieces, returning a pointer to the tail (which is made of the previous mbuf chain except the first len0 bytes).
(struct mbuf *m0, int len0, int siz, int wait)
Inject a new mbuf chain of length siz into the mbuf chain pointed to by m0 at position len0. If there is enough space for an object of size siz in the appropriate location, no memory will be allocated. On failure, the function returns NULL (the mbuf is left untouched) and on success, a pointer to the first injected mbuf is returned.
(struct mbuf *m, int loc, int *off)
Returns a pointer to the mbuf containing the data located at loc bytes of the beginning. The offset in the new mbuf is pointed to by off.
(struct mbuf *mp, int req_len)
Trims req_len bytes of data from the mbuf chain pointed to by mp. If req_len is positive, the data will be trimmed from the head of the mbuf chain and if it is negative, it will be trimmed from the tail of the mbuf chain.
(struct mbuf *m0, int off, int len, caddr_t cp, int wait)
Copy data from a buffer pointed to by cp back into the mbuf chain pointed to by m0 starting at off bytes from the beginning, extending the mbuf chain if necessary, sleeping for mbufs if wait is M_WAIT. If M_NOWAIT is set and no mbufs are available, m_copyback() returns ENOBUFS. The mbuf chain must be initialized properly, including setting m_len.
(struct mbuf *m, int wait)
Defragment the data mbufs referenced by m by replacing the chain with a copy of their contents made into a single mbuf or cluster. wait specifies whether it can wait or not for the replacement storage. m_defrag() returns 0 on success or ENOBUFS on failure. The mbuf pointer m remains in existence and unchanged on failure.
(struct mbuf *m)
Free the mbuf chain pointed to by m.
(void)
Ask protocols to free unused memory space.
(struct mbuf *m, int off, int len, caddr_t cp)
Copy data from the mbuf chain pointed to by m starting at off bytes from the beginning and continuing for len bytes into the buffer pointed to by cp.
(struct mbuf *m, struct mbuf *n)
Concatenate the mbuf chain pointed to by n to the mbuf chain pointed to by m. The mbuf chains must be of the same type.
(char *buf, int totlen, int off, struct ifnet *ifp)
Copy totlen bytes of data from device local memory pointed to by buf. The data is copied into an mbuf chain at offset off and a pointer to the head of the chain is returned. Returns NULL on failure.
(struct mbuf *m, int off, int len, int (*func)(caddr_t, caddr_t, unsigned int), caddr_t fstate)
Apply the function func to the data in the mbuf chain pointed to by m starting at off bytes from the beginning and continuing for len bytes.
(struct mbuf *m, datatype)
Return a pointer to the data contained in the specified mbuf m cast to datatype.
(struct mbuf *m, int how)
Allocate and add an mbuf cluster to the mbuf pointed to by m. On success, the flag M_EXT is set in the mbuf. See m_get() for a description of how.
(struct mbuf *m, int how, struct ifnet *ifp, int len)
If m is NULL, allocate it. Then allocate and add an mbuf cluster of length len to the mbuf pointed to by m. Returns either the mbuf m that was passed in, or the newly allocated one which was allocated; in either case the flag M_EXT is set in the mbuf. See m_get() for a description of how.
(struct mbuf *m, caddr_t buf, u_int size, int flags, void (*free)(caddr_t, u_int, void *), void *arg)
Add pre-allocated storage to the mbuf pointed to by m. On success, the flag M_EXT is set in the mbuf, and M_EXTWR is specified in flags.
(struct mbuf *m, int len)
Set the m_data pointer of the newly allocated mbuf with m_get() or MGET() pointed to by m to an object of the specified size len at the end of the mbuf, longword aligned.
(m, len)
Same as M_ALIGN() except it is for an mbuf allocated with m_gethdr() or MGETHDR().
(struct mbuf *m)
Check if the data of the mbuf pointed to by m is read-only. This is true for non-cluster external storage and for clusters that are being referenced by more than one mbuf.
(struct mbuf *m)
Compute the amount of space available before the current start of data in the mbuf pointed to by m.
(struct mbuf *m)
Compute the amount of space available after the end of data in the mbuf pointed to by m.
(struct mbuf *to, struct mbuf *from, int how)
Copy mbuf packet header, including mbuf tags, from from to to. See m_get() for a description of how.

The mbuf list and mbuf queue API provides implementions of data structures and operations for managing lists of mbufs or for queueing mbufs and lists of mbufs between contexts.

mbuf_list structures support the following functionality:

  1. Insertion of a new mbuf at the end of the list.
  2. Removal of an mbuf from the head of the list.
  3. Removal of the entire chain of mbufs on the list.
(struct mbuf_list *ml)
Initialise the ml mbuf_list structure.
()
An initialiser for an mbuf_list structure declaration.
(struct mbuf_list *ml, struct mbuf *m)
Enqueue mbuf m on the end of the ml mbuf list.
(struct mbuf_list *ml)
Dequeue an mbuf from the front of the ml mbuf list.
(struct mbuf_list *ml)
Dequeues all mbufs from the ml mbuf list.
(struct mbuf_list *ml, int (*filter)(void *, struct mbuf *), void *context);
Iterates over the mbufs on the ml mbuf list, passing each of them to the filter function. If the filter returns non-zero, the packet is removed from the ml mbuf list to be returned as part of an mbuf chain by ml_filter(). context is passed as the first argument to each call of filter.
(struct mbuf_list *ml)
Return the number of mbufs on the ml mbuf list.
(struct mbuf_list *ml)
Return if the ml mbuf list is empty.
(struct mbuf_list *ml, VARNAME)
A convenience macro that can be used to iterate over the contents of the ml mbuf list. VARNAME identifies the name (not the address) of an mbuf pointer that will be set to each entry on the list. Note that it is unsafe to modify the list while iterating over it.

mbuf_queue data structures provide a superset of the functionality available in mbuf_lists, and protect themselves internally with a mutex(9), making them useful for moving mbufs between contexts or subsystems. Additionally, mbuf_queues provide a limit on the number of mbufs that may be queued. The additional functionality mbuf_queues provides is:

  1. Insertion of the mbufs in an mbuf_list at the end of the queue.
  2. Removal of all the mbufs on the queue as an mbuf_list.
(struct mbuf_queue *mq, unsigned int maxlen, int ipl)
Initialises the mbuf queue structure mq. The maximum number of mbufs that can be queued is specified with maxlen. The highest interrupt priority level the queue will be operated at is specified via ipl.
(unsigned int maxlen, int ipl)
Initialises an mbuf queue structure declaration. The maximum number of mbufs that can be queued is specified with maxlen. The highest interrupt priority level the queue will be operated at is specified via ipl.
(struct mbuf_queue *mq, struct mbuf *m)
Enqueue mbuf m on the end of the mq mbuf queue.
(struct mbuf_queue *mq)
Dequeue an mbuf from the front of the mq mbuf queue.
(struct mbuf_queue *mq, struct mbuf_list *ml)
Enqueue all the mbufs on the ml mbuf list on to the end of the mq mbuf queue. Note, the number of mbufs placed on the queue may exceed its maximum length.
(struct mbuf_queue *mq, struct mbuf_list *ml)
Dequeue all the mbufs on the mq mbuf queue on to the ml mbuf list.
(struct mbuf_queue *mq)
Dequeue all mbufs from the mq mbuf queue.
(struct mbuf_queue *mq, int (*filter)(void *, struct mbuf *), void *context);
Iterates over the mbufs on the mq mbuf queue, passing each of them to the filter function. If the filter returns non-zero, the packet is removed from the mq mbuf queue to be returned as part of an mbuf chain by mq_filter(). context is passed as the first argument to each call of filter.
(struct mbuf_queue *mq)
Return the number of mbufs on the ml mbuf queue.
(struct mbuf_queue *mq)
Return if the mq mbuf queue is empty.
(struct mbuf_queue *mq)
Return how many mbufs were dropped and freed by m_freem(9) if the mq mbuf queue was too full.
(struct mbuf_queue *mq, unsigned int)
Alter the maximum number of mbufs that can be queued on the mq mbuf queue. Note, mq_set_maxlen() will only set a new limit, it will not free any excess mbufs that may already exist on the queue.

ml_init(), ml_enqueue(), ml_dequeue(), ml_dechain(), ml_len(), ml_empty(), MBUF_LIST_INITIALIZER(), MBUF_LIST_FOREACH(), mq_init(), mq_enqueue(), mq_dequeue(), mq_enlist(), mq_delist(), mq_dechain(), mq_len(), mq_empty(), mq_drops(), mq_set_maxlen(), MBUF_QUEUE_INITIALIZER() can be called during autoconf, from process context, or from interrupt context.

ml_dequeue() and mq_dequeue() return the mbuf that was at the head of their respective list or queue. If the list or queue was empty, NULL is returned.

ml_dechain() and mq_dechain() return all the mbufs that were on the respective list or queues via a pointer to an mbuf with the chain accessible via m_nextpkt members. If the list or queue was empty, NULL is returned.

ml_filter() and mq_filter() return the mbufs that were successfully matched by the filter function on the respective list or queue via a pointer to a chain of mbufs. If no packets matched the filter, NULL is returned.

ml_len() and mq_len() return the number of mbufs on the list or queue respectively.

ml_empty() and mq_empty() return a non-zero value if the list or queue is empty, otherwise 0.

mq_enqueue() returns 0 if the mbuf was successfully queued, or non-zero if the mbuf was freed because it would cause the queue to exceed its maximum length.

mq_enlist() returns the number of mbufs that were dropped from the list if the length of the queue exceeded its maximum length.

mq_drops() returns the number of mbufs that were freed during mq_enqueue() operations that would have caused the queue to exceed its maximum length.

The mbuf management functions are implemented in the files sys/kern/uipc_mbuf.c and sys/kern/uipc_mbuf2.c. The function prototypes and the macros are located in sys/sys/mbuf.h.

netstat(1), mbuf_tags(9), mutex(9), spl(9)

Jun-Ichiro Hagino, Mbuf issues in 4.4BSD IPv6/IPsec support (experiences from KAME IPv6/IPsec implementation), Proceedings of the Freenix Track: 2000 USENIX Annual Technical Conference, June 2000.

February 19, 2015 OpenBSD-5.7