1 .\" Copyright (c) 2000 FreeBSD Inc.
2 .\" All rights reserved.
4 .\" Redistribution and use in source and binary forms, with or without
5 .\" modification, are permitted provided that the following conditions
7 .\" 1. Redistributions of source code must retain the above copyright
8 .\" notice, this list of conditions and the following disclaimer.
9 .\" 2. Redistributions in binary form must reproduce the above copyright
10 .\" notice, this list of conditions and the following disclaimer in the
11 .\" documentation and/or other materials provided with the distribution.
13 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
14 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
16 .\" ARE DISCLAIMED. IN NO EVENT SHALL [your name] OR CONTRIBUTORS BE LIABLE
17 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
18 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
19 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
20 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
21 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
22 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 .Dd September 27, 2017
33 .Nd "memory management in the kernel IPC subsystem"
40 .Ss Mbuf allocation macros
41 .Fn MGET "struct mbuf *mbuf" "int how" "short type"
42 .Fn MGETHDR "struct mbuf *mbuf" "int how" "short type"
44 .Fn MCLGET "struct mbuf *mbuf" "int how"
46 .Fa "struct mbuf *mbuf"
49 .Fa "void (*free)(struct mbuf *)"
56 .Ss Mbuf utility macros
57 .Fn mtod "struct mbuf *mbuf" "type"
58 .Fn M_ALIGN "struct mbuf *mbuf" "u_int len"
59 .Fn MH_ALIGN "struct mbuf *mbuf" "u_int len"
61 .Fn M_LEADINGSPACE "struct mbuf *mbuf"
63 .Fn M_TRAILINGSPACE "struct mbuf *mbuf"
64 .Fn M_MOVE_PKTHDR "struct mbuf *to" "struct mbuf *from"
65 .Fn M_PREPEND "struct mbuf *mbuf" "int len" "int how"
66 .Fn MCHTYPE "struct mbuf *mbuf" "short type"
68 .Fn M_WRITABLE "struct mbuf *mbuf"
70 .Ss Mbuf allocation functions
72 .Fn m_get "int how" "short type"
74 .Fn m_get2 "int size" "int how" "short type" "int flags"
76 .Fn m_getm "struct mbuf *orig" "int len" "int how" "short type"
78 .Fn m_getjcl "int how" "short type" "int flags" "int size"
80 .Fn m_getcl "int how" "short type" "int flags"
82 .Fn m_gethdr "int how" "short type"
84 .Fn m_free "struct mbuf *mbuf"
86 .Fn m_freem "struct mbuf *mbuf"
88 .Ss Mbuf utility functions
90 .Fn m_adj "struct mbuf *mbuf" "int len"
92 .Fn m_align "struct mbuf *mbuf" "int len"
94 .Fn m_append "struct mbuf *mbuf" "int len" "c_caddr_t cp"
96 .Fn m_prepend "struct mbuf *mbuf" "int len" "int how"
98 .Fn m_copyup "struct mbuf *mbuf" "int len" "int dstoff"
100 .Fn m_pullup "struct mbuf *mbuf" "int len"
102 .Fn m_pulldown "struct mbuf *mbuf" "int offset" "int len" "int *offsetp"
104 .Fn m_copym "struct mbuf *mbuf" "int offset" "int len" "int how"
106 .Fn m_copypacket "struct mbuf *mbuf" "int how"
108 .Fn m_dup "const struct mbuf *mbuf" "int how"
110 .Fn m_copydata "const struct mbuf *mbuf" "int offset" "int len" "caddr_t buf"
112 .Fn m_copyback "struct mbuf *mbuf" "int offset" "int len" "caddr_t buf"
118 .Fa "struct ifnet *ifp"
119 .Fa "void (*copy)(char *from, caddr_t to, u_int len)"
122 .Fn m_cat "struct mbuf *m" "struct mbuf *n"
124 .Fn m_catpkt "struct mbuf *m" "struct mbuf *n"
126 .Fn m_fixhdr "struct mbuf *mbuf"
128 .Fn m_dup_pkthdr "struct mbuf *to" "const struct mbuf *from" "int how"
130 .Fn m_move_pkthdr "struct mbuf *to" "struct mbuf *from"
132 .Fn m_length "struct mbuf *mbuf" "struct mbuf **last"
134 .Fn m_split "struct mbuf *mbuf" "int len" "int how"
136 .Fn m_apply "struct mbuf *mbuf" "int off" "int len" "int (*f)(void *arg, void *data, u_int len)" "void *arg"
138 .Fn m_getptr "struct mbuf *mbuf" "int loc" "int *off"
140 .Fn m_defrag "struct mbuf *m0" "int how"
142 .Fn m_collapse "struct mbuf *m0" "int how" "int maxfrags"
144 .Fn m_unshare "struct mbuf *m0" "int how"
149 is a basic unit of memory management in the kernel IPC subsystem.
150 Network packets and socket buffers are stored in
152 A network packet may span multiple
157 which allows adding or trimming
158 network headers with little overhead.
160 While a developer should not bother with
162 internals without serious
163 reason in order to avoid incompatibilities with future changes, it
164 is useful to understand the general structure of an
169 consists of a variable-sized header and a small internal
174 is a constant defined in
179 .Bl -tag -width "m_nextpkt" -offset indent
182 A pointer to the next
188 A pointer to the next
193 A pointer to data attached to this
197 The length of the data.
200 The type of the data.
210 flag bits are defined as follows:
213 #define M_EXT 0x00000001 /* has associated external storage */
214 #define M_PKTHDR 0x00000002 /* start of record */
215 #define M_EOR 0x00000004 /* end of record */
216 #define M_RDONLY 0x00000008 /* associated data marked read-only */
217 #define M_PROTO1 0x00001000 /* protocol-specific */
218 #define M_PROTO2 0x00002000 /* protocol-specific */
219 #define M_PROTO3 0x00004000 /* protocol-specific */
220 #define M_PROTO4 0x00008000 /* protocol-specific */
221 #define M_PROTO5 0x00010000 /* protocol-specific */
222 #define M_PROTO6 0x00020000 /* protocol-specific */
223 #define M_PROTO7 0x00040000 /* protocol-specific */
224 #define M_PROTO8 0x00080000 /* protocol-specific */
225 #define M_PROTO9 0x00100000 /* protocol-specific */
226 #define M_PROTO10 0x00200000 /* protocol-specific */
227 #define M_PROTO11 0x00400000 /* protocol-specific */
228 #define M_PROTO12 0x00800000 /* protocol-specific */
230 /* mbuf pkthdr flags (also stored in m_flags) */
231 #define M_BCAST 0x00000010 /* send/received as link-level broadcast */
232 #define M_MCAST 0x00000020 /* send/received as link-level multicast */
237 types are defined as follows:
240 #define MT_DATA 1 /* dynamic (data) allocation */
241 #define MT_HEADER MT_DATA /* packet header */
242 #define MT_SONAME 8 /* socket name */
243 #define MT_CONTROL 14 /* extra-data protocol message */
244 #define MT_OOBDATA 15 /* expedited data */
247 The available external buffer types are defined as follows:
249 /* external buffer types */
250 #define EXT_CLUSTER 1 /* mbuf cluster */
251 #define EXT_SFBUF 2 /* sendfile(2)'s sf_bufs */
252 #define EXT_JUMBOP 3 /* jumbo cluster 4096 bytes */
253 #define EXT_JUMBO9 4 /* jumbo cluster 9216 bytes */
254 #define EXT_JUMBO16 5 /* jumbo cluster 16184 bytes */
255 #define EXT_PACKET 6 /* mbuf+cluster from packet zone */
256 #define EXT_MBUF 7 /* external mbuf reference */
257 #define EXT_NET_DRV 252 /* custom ext_buf provided by net driver(s) */
258 #define EXT_MOD_TYPE 253 /* custom module's ext_buf type */
259 #define EXT_DISPOSABLE 254 /* can throw this buffer away w/page flipping */
260 #define EXT_EXTREF 255 /* has externally maintained ref_cnt ptr */
266 .Vt struct pkthdr Va m_pkthdr
270 It contains a pointer to the interface
271 the packet has been received from
272 .Pq Vt struct ifnet Va *rcvif ,
273 and the total packet length
275 Optionally, it may also contain an attached list of packet tags
276 .Pq Vt "struct m_tag" .
280 Fields used in offloading checksum calculation to the hardware are kept in
284 .Sx HARDWARE-ASSISTED CHECKSUM CALCULATION
287 If small enough, data is stored in the internal data buffer of an
289 If the data is sufficiently large, another
293 or external storage may be associated with the
296 bytes of data can fit into an
304 If external storage is being associated with an
308 header is added at the cost of losing the internal data buffer.
309 It includes a pointer to external storage, the size of the storage,
310 a pointer to a function used for freeing the storage,
311 a pointer to an optional argument that can be passed to the function,
312 and a pointer to a reference counter.
315 using external storage has the
319 The system supplies a macro for allocating the desired external storage
323 The allocation and management of the reference counter is handled by the
326 The system also supplies a default type of external storage buffer called an
329 can be allocated and configured with the use of the
336 in size, where MCLBYTES is a machine-dependent constant.
337 The system defines an advisory macro
339 which is the smallest amount of data to put into an
344 It is typically preferable to store data into the data region of an
346 if size permits, as opposed to allocating a separate
348 to hold the same data.
350 .Ss Macros and Functions
351 There are numerous predefined macros and functions that provide the
352 developer with common utilities.
354 .Bl -ohang -offset indent
355 .It Fn mtod mbuf type
358 pointer to a data pointer.
359 The macro expands to the data pointer cast to the specified
362 It is advisable to ensure that there is enough contiguous data in
367 .It Fn MGET mbuf how type
370 and initialize it to contain internal data.
372 will point to the allocated
374 on success, or be set to
379 argument is to be set to
383 It specifies whether the caller is willing to block if necessary.
384 A number of other functions and macros related to
386 have the same argument because they may
387 at some point need to allocate new
389 .It Fn MGETHDR mbuf how type
392 and initialize it to contain a packet header
397 .It Fn MEXTADD mbuf buf size free opt_arg1 opt_arg2 flags type
398 Associate externally managed data with
400 Any internal data contained in the mbuf will be discarded, and the
407 arguments are the address and length, respectively, of the data.
410 argument points to a function which will be called to free the data
411 when the mbuf is freed; it is only used if
419 arguments will be saved in
428 argument specifies additional
430 flags; it is not necessary to specify
434 argument specifies the type of external data, which controls how it
435 will be disposed of when the
438 In most cases, the correct value is
440 .It Fn MCLGET mbuf how
441 Allocate and attach an
445 On success, a non-zero value returned; otherwise, 0.
446 Historically, consumers would check for success by testing the
448 flag on the mbuf, but this is now discouraged to avoid unnecessary awareness
449 of the implementation of external storage in protocol stacks and device
451 .It Fn M_ALIGN mbuf len
454 to place an object of the size
456 at the end of the internal data area of
461 is newly allocated with
465 .It Fn MH_ALIGN mbuf len
466 Serves the same purpose as
478 .It Fn m_align mbuf len
479 Services the same purpose as
481 but handles any type of mbuf.
482 .It Fn M_LEADINGSPACE mbuf
483 Returns the number of bytes available before the beginning
486 .It Fn M_TRAILINGSPACE mbuf
487 Returns the number of bytes available after the end of data in
489 .It Fn M_PREPEND mbuf len how
490 This macro operates on an
492 It is an optimized wrapper for
494 that can make use of possible empty space before data
495 (e.g.\& left after trimming of a link-layer header).
503 .It Fn M_MOVE_PKTHDR to from
504 Using this macro is equivalent to calling
505 .Fn m_move_pkthdr to from .
506 .It Fn M_WRITABLE mbuf
507 This macro will evaluate true if
513 does not contain external storage or,
515 then if the reference count of the storage is not greater than 1.
520 This can be achieved during setup of the external storage,
527 macro, or can be directly set in individual
529 .It Fn MCHTYPE mbuf type
534 This is a relatively expensive operation and should be avoided.
538 .Bl -ohang -offset indent
539 .It Fn m_get how type
540 A function version of
542 for non-critical paths.
543 .It Fn m_get2 size how type flags
546 with enough space to hold specified amount of data.
547 .It Fn m_getm orig len how type
554 if necessary and append the resulting allocated
560 .No non- Ns Dv NULL .
561 If the allocation fails at any point,
562 free whatever was allocated and return
567 .No non- Ns Dv NULL ,
568 it will not be freed.
569 It is possible to use
577 (for example, one which may be sitting in a pre-allocated ring)
578 or to simply perform an all-or-nothing
583 .It Fn m_gethdr how type
584 A function version of
586 for non-critical paths.
587 .It Fn m_getcl how type flags
593 If one of the allocations fails, the entire allocation fails.
594 This routine is the preferred way of fetching both the
598 together, as it avoids having to unlock/relock between allocations.
602 .It Fn m_getjcl how type flags size
605 but it the size of the cluster allocated will be large enough for
617 The functions below operate on
619 .Bl -ohang -offset indent
623 including any external storage.
625 .It Fn m_adj mbuf len
628 bytes from the head of an
632 is positive, from the tail otherwise.
634 .It Fn m_append mbuf len cp
641 Extend the mbuf chain if the new data does not fit in
644 .It Fn m_prepend mbuf len how
647 and prepend it to the
653 It does not allocate any
665 .It Fn m_copyup mbuf len dstoff
670 bytes of data into a new mbuf at
675 argument aligns the data and leaves room for a link layer header.
685 The function does not allocate
692 .It Fn m_pullup mbuf len
693 Arrange that the first
697 are contiguous and lay in the data area of
699 so they are accessible with
701 It is important to remember that this may involve
702 reallocating some mbufs and moving data so all pointers
703 referencing data within the old mbuf chain
704 must be recalculated or made invalid.
712 is freed in this case).
714 It does not allocate any
718 must be less than or equal to
721 .It Fn m_pulldown mbuf offset len offsetp
730 are contiguous and lay in the data area of
732 so they are accessible with
735 must be smaller than, or equal to, the size of an
737 Return a pointer to an intermediate
739 in the chain containing the requested region;
740 the offset in the data region of the
742 to the data contained in the returned mbuf is stored in
746 is NULL, the region may be accessed using
750 is non-NULL, the region may be accessed using
751 .Fn mtod mbuf uint8_t
753 The region of the mbuf chain between its beginning and
755 is not modified, therefore it is safe to hold pointers to data within
756 this region before calling
759 .It Fn m_copym mbuf offset len how
764 bytes from the beginning, continuing for
771 copy to the end of the
774 The copy is read-only, because the
776 are not copied, only their reference counts are incremented.
778 .It Fn m_copypacket mbuf how
779 Copy an entire packet including header, which must be present.
780 This is an optimized version of the common case
781 .Fn m_copym mbuf 0 M_COPYALL how .
783 the copy is read-only, because the
785 are not copied, only their reference counts are incremented.
787 .It Fn m_dup mbuf how
790 into a completely new
792 including copying any
796 when you need a writable copy of an
799 .It Fn m_copydata mbuf offset len buf
804 bytes from the beginning, continuing for
806 bytes, into the indicated buffer
809 .It Fn m_copyback mbuf offset len buf
812 bytes from the buffer
814 back into the indicated
818 bytes from the beginning of the
824 It does not allocate any
836 will be allocated to fill the space.
838 .It Fn m_length mbuf last
839 Return the length of the
841 and optionally a pointer to the last
844 .It Fn m_dup_pkthdr to from how
845 Upon the function's completion, the
848 will contain an identical copy of
850 and the per-packet attributes found in the
860 must be empty on entry.
862 .It Fn m_move_pkthdr to from
865 and the per-packet attributes from the
878 must be empty on entry.
879 Upon the function's completion,
883 and the per-packet attributes cleared.
886 Set the packet-header length to the length of the
889 .It Fn m_devget buf len offset ifp copy
890 Copy data from a device local memory pointed to by
894 The copy is done using a specified copy routine
910 must be of the same type.
912 is not guaranteed to be valid after
916 does not update any packet header fields or free mbuf tags.
921 that operates on packets.
926 must contain packet headers.
928 is not guaranteed to be valid after
932 .It Fn m_split mbuf len how
935 in two pieces, returning the tail:
939 In case of failure, it returns
941 and attempts to restore the
943 to its original state.
945 .It Fn m_apply mbuf off len f arg
946 Apply a function to an
953 Typically used to avoid calls to
955 which would otherwise be unnecessary or undesirable.
957 is a convenience argument which is passed to the callback function
962 is called, it will be passed
966 in the current mbuf, and the length
968 of the data in this mbuf to which the function should be applied.
970 The function should return zero to indicate success;
971 otherwise, if an error is indicated, then
973 will return the error and stop iterating through the
976 .It Fn m_getptr mbuf loc off
977 Return a pointer to the mbuf containing the data located at
979 bytes from the beginning of the
981 The corresponding offset into the mbuf will be stored in
983 .It Fn m_defrag m0 how
984 Defragment an mbuf chain, returning the shortest possible
985 chain of mbufs and clusters.
986 If allocation fails and this can not be completed,
988 will be returned and the original chain will be unchanged.
989 Upon success, the original chain will be freed and the new
990 chain will be returned.
996 depending on the caller's preference.
998 This function is especially useful in network drivers, where
999 certain long mbuf chains must be shortened before being added
1000 to TX descriptor lists.
1001 .It Fn m_collapse m0 how maxfrags
1002 Defragment an mbuf chain, returning a chain of at most
1005 If allocation fails or the chain cannot be collapsed as requested,
1007 will be returned, with the original chain possibly modified.
1015 .It Fn m_unshare m0 how
1016 Create a version of the specified mbuf chain whose
1017 contents can be safely modified without affecting other users.
1018 If allocation fails and this operation can not be completed,
1021 The original mbuf chain is always reclaimed and the reference
1022 count of any shared mbuf clusters is decremented.
1028 depending on the caller's preference.
1029 As a side-effect of this process the returned
1030 mbuf chain may be compacted.
1032 This function is especially useful in the transmit path of
1033 network code, when data must be encrypted or otherwise
1034 altered prior to transmission.
1036 .Sh HARDWARE-ASSISTED CHECKSUM CALCULATION
1037 This section currently applies to TCP/IP only.
1038 In order to save the host CPU resources, computing checksums is
1039 offloaded to the network interface hardware if possible.
1042 member of the leading
1044 of a packet contains two fields used for that purpose,
1045 .Vt int Va csum_flags
1047 .Vt int Va csum_data .
1048 The meaning of those fields depends on the direction a packet flows in,
1049 and on whether the packet is fragmented.
1055 will denote the corresponding field of the
1057 member of the leading
1061 containing the packet.
1063 On output, checksum offloading is attempted after the outgoing
1064 interface has been determined for a packet.
1065 The interface-specific field
1066 .Va ifnet.if_data.ifi_hwassist
1069 is consulted for the capabilities of the interface to assist in
1070 computing checksums.
1073 field of the packet header is set to indicate which actions the interface
1074 is supposed to perform on it.
1075 The actions unsupported by the network interface are done in the
1076 software prior to passing the packet down to the interface driver;
1077 such actions will never be requested through
1080 The flags demanding a particular action from an interface are as follows:
1081 .Bl -tag -width ".Dv CSUM_TCP" -offset indent
1083 The IP header checksum is to be computed and stored in the
1084 corresponding field of the packet.
1085 The hardware is expected to know the format of an IP header
1086 to determine the offset of the IP checksum field.
1088 The TCP checksum is to be computed.
1091 The UDP checksum is to be computed.
1095 Should a TCP or UDP checksum be offloaded to the hardware,
1098 will contain the byte offset of the checksum field relative to the
1099 end of the IP header.
1100 In this case, the checksum field will be initially
1101 set by the TCP/IP module to the checksum of the pseudo header
1102 defined by the TCP and UDP specifications.
1104 On input, an interface indicates the actions it has performed
1105 on a packet by setting one or more of the following flags in
1107 associated with the packet:
1108 .Bl -tag -width ".Dv CSUM_IP_CHECKED" -offset indent
1109 .It Dv CSUM_IP_CHECKED
1110 The IP header checksum has been computed.
1111 .It Dv CSUM_IP_VALID
1112 The IP header has a valid checksum.
1113 This flag can appear only in combination with
1114 .Dv CSUM_IP_CHECKED .
1115 .It Dv CSUM_DATA_VALID
1116 The checksum of the data portion of the IP packet has been computed
1117 and stored in the field
1119 in network byte order.
1120 .It Dv CSUM_PSEUDO_HDR
1121 Can be set only along with
1123 to indicate that the IP data checksum found in
1125 allows for the pseudo header defined by the TCP and UDP specifications.
1126 Otherwise the checksum of the pseudo header must be calculated by
1127 the host CPU and added to
1129 to obtain the final checksum to be used for TCP or UDP validation purposes.
1132 If a particular network interface just indicates success or
1133 failure of TCP or UDP checksum validation without returning
1134 the exact value of the checksum to the host CPU, its driver can mark
1144 hexadecimal to indicate a valid checksum.
1145 It is a peculiarity of the algorithm used that the Internet checksum
1146 calculated over any valid packet will be
1148 as long as the original checksum field is included.
1150 When running a kernel compiled with the option
1151 .Dv MBUF_STRESS_TEST ,
1154 -controlled options may be used to create
1155 various failure/extreme cases for testing of network drivers
1156 and other parts of the kernel that rely on
1158 .Bl -tag -width ident
1159 .It Va net.inet.ip.mbuf_frag_size
1162 to fragment outgoing
1164 into fragments of the specified size.
1165 Setting this variable to 1 is an excellent way to
1168 handling ability of network drivers.
1169 .It Va kern.ipc.m_defragrandomfailures
1172 to randomly fail, returning
1174 Any piece of code which uses
1176 should be tested with this feature.
1184 .\" Please correct me if I'm wrong
1186 appeared in an early version of
1188 Besides being used for network packets, they were used
1189 to store various dynamic structures, such as routing table
1190 entries, interface addresses, protocol control blocks, etc.
1195 is almost entirely limited to packet storage, with
1197 zones being used directly to store other network-related memory.
1201 allocator has been a special-purpose memory allocator able to run in
1202 interrupt contexts and allocating from a special kernel address space map.
1207 allocator is a wrapper around
1213 + cluster pairs in per-CPU caches, as well as bringing other benefits of
1218 manual page was written by
1223 allocator was written by