MBUF(9)

📦 version 12.2, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 MBUF(9) — Kernel Developer's Manual 💖

okay so bestie, buckle UP 🎀 this is mbuf, and it's literally the memory management situation in the kernel IPC subsystem. grab a snack, this is a long one (it comes in three parts, so we're not even done yet). ✨

🌸 NAME 🌸

mbuf — memory management in the kernel IPC subsystem 🫶

✨ SYNOPSIS ✨

#include <sys/param.h>
#include <sys/systm.h>
#include <sys/mbuf.h>

🎀 Mbuf allocation macros

MGET(struct mbuf *mbuf, int how, short type);

MGETHDR(struct mbuf *mbuf, int how, short type);

int
MCLGET(struct mbuf *mbuf, int how);

MEXTADD(struct mbuf *mbuf, char *buf, u_int size,
    void (*free)(struct mbuf *), void *opt_arg1, void *opt_arg2,
    int flags, int type);

🦋 Mbuf utility macros

mtod(struct mbuf *mbuf, type);

M_ALIGN(struct mbuf *mbuf, u_int len);

MH_ALIGN(struct mbuf *mbuf, u_int len);

int
M_LEADINGSPACE(struct mbuf *mbuf);

int
M_TRAILINGSPACE(struct mbuf *mbuf);

M_MOVE_PKTHDR(struct mbuf *to, struct mbuf *from);

M_PREPEND(struct mbuf *mbuf, int len, int how);

MCHTYPE(struct mbuf *mbuf, short type);

int
M_WRITABLE(struct mbuf *mbuf);

💜 Mbuf allocation functions

struct mbuf *
m_get(int how, short type);

struct mbuf *
m_get2(int size, int how, short type, int flags);

struct mbuf *
m_getm(struct mbuf *orig, int len, int how, short type);

struct mbuf *
m_getjcl(int how, short type, int flags, int size);

struct mbuf *
m_getcl(int how, short type, int flags);

struct mbuf *
m_gethdr(int how, short type);

struct mbuf *
m_free(struct mbuf *mbuf);

void
m_freem(struct mbuf *mbuf);

🌈 Mbuf utility functions

void
m_adj(struct mbuf *mbuf, int len);

void
m_align(struct mbuf *mbuf, int len);

int
m_append(struct mbuf *mbuf, int len, c_caddr_t cp);

struct mbuf *
m_prepend(struct mbuf *mbuf, int len, int how);

struct mbuf *
m_copyup(struct mbuf *mbuf, int len, int dstoff);

struct mbuf *
m_pullup(struct mbuf *mbuf, int len);

struct mbuf *
m_pulldown(struct mbuf *mbuf, int offset, int len, int *offsetp);

struct mbuf *
m_copym(struct mbuf *mbuf, int offset, int len, int how);

struct mbuf *
m_copypacket(struct mbuf *mbuf, int how);

struct mbuf *
m_dup(const struct mbuf *mbuf, int how);

void
m_copydata(const struct mbuf *mbuf, int offset, int len, caddr_t buf);

void
m_copyback(struct mbuf *mbuf, int offset, int len, caddr_t buf);

struct mbuf *
m_devget(char *buf, int len, int offset, struct ifnet *ifp,
    void (*copy)(char *from, caddr_t to, u_int len));

void
m_cat(struct mbuf *m, struct mbuf *n);

void
m_catpkt(struct mbuf *m, struct mbuf *n);

u_int
m_fixhdr(struct mbuf *mbuf);

int
m_dup_pkthdr(struct mbuf *to, const struct mbuf *from, int how);

void
m_move_pkthdr(struct mbuf *to, struct mbuf *from);

u_int
m_length(struct mbuf *mbuf, struct mbuf **last);

struct mbuf *
m_split(struct mbuf *mbuf, int len, int how);

int
m_apply(struct mbuf *mbuf, int off, int len,
    int (*f)(void *arg, void *data, u_int len), void *arg);

struct mbuf *
m_getptr(struct mbuf *mbuf, int loc, int *off);

struct mbuf *
m_defrag(struct mbuf *m0, int how);

struct mbuf *
m_collapse(struct mbuf *m0, int how, int maxfrags);

struct mbuf *
m_unshare(struct mbuf *m0, int how);

💅 DESCRIPTION 💅

okay so an mbuf is a basic unit of memory management in the kernel IPC subsystem. that's the whole vibe. 🌸 network packets and socket buffers get stored in mbufs. and a network packet can span multiple mbufs arranged into an mbuf chain (a linked list, iykyk), which is literally the whole point — it lets you add or trim network headers with little overhead. iconic design fr fr. 👑

now, real talk: a developer should not bother with mbuf internals without a serious reason, because you'll get incompatible with future changes and that's a bad time 😭. but it is useful to understand the general structure of an mbuf, so here we go.

an mbuf consists of a variable-sized header and a small internal buffer for data. the total size of an mbuf, MSIZE, is a constant defined in <sys/param.h>. the mbuf header includes:

m_next (struct mbuf *) — a pointer to the next mbuf in the mbuf chain.
m_nextpkt (struct mbuf *) — a pointer to the next mbuf chain in the queue.
m_data (caddr_t) — a pointer to data attached to this mbuf.
m_len (int) — the length of the data.
m_type (short) — the type of the data.
m_flags (int) — the mbuf flags.

the mbuf flag bits are defined as follows:

/* mbuf flags */
#define M_EXT           0x00000001 /* has associated external storage */
#define M_PKTHDR        0x00000002 /* start of record */
#define M_EOR           0x00000004 /* end of record */
#define M_RDONLY        0x00000008 /* associated data marked read-only */
#define M_PROTO1        0x00001000 /* protocol-specific */
#define M_PROTO2        0x00002000 /* protocol-specific */
#define M_PROTO3        0x00004000 /* protocol-specific */
#define M_PROTO4        0x00008000 /* protocol-specific */
#define M_PROTO5        0x00010000 /* protocol-specific */
#define M_PROTO6        0x00020000 /* protocol-specific */
#define M_PROTO7        0x00040000 /* protocol-specific */
#define M_PROTO8        0x00080000 /* protocol-specific */
#define M_PROTO9        0x00100000 /* protocol-specific */
#define M_PROTO10       0x00200000 /* protocol-specific */
#define M_PROTO11       0x00400000 /* protocol-specific */
#define M_PROTO12       0x00800000 /* protocol-specific */

/* mbuf pkthdr flags (also stored in m_flags) */
#define M_BCAST         0x00000010 /* send/received as link-level broadcast */
#define M_MCAST         0x00000020 /* send/received as link-level multicast */

the available mbuf types are defined as follows:

/* mbuf types */
#define MT_DATA         1       /* dynamic (data) allocation */
#define MT_HEADER       MT_DATA /* packet header */
#define MT_SONAME       8       /* socket name */
#define MT_CONTROL      14      /* extra-data protocol message */
#define MT_OOBDATA      15      /* expedited data */

the available external buffer types are defined as follows:

/* external buffer types */
#define EXT_CLUSTER     1       /* mbuf cluster */
#define EXT_SFBUF       2       /* sendfile(2)'s sf_bufs */
#define EXT_JUMBOP      3       /* jumbo cluster 4096 bytes */
#define EXT_JUMBO9      4       /* jumbo cluster 9216 bytes */
#define EXT_JUMBO16     5       /* jumbo cluster 16184 bytes */
#define EXT_PACKET      6       /* mbuf+cluster from packet zone */
#define EXT_MBUF        7       /* external mbuf reference */
#define EXT_NET_DRV     252     /* custom ext_buf provided by net driver(s) */
#define EXT_MOD_TYPE    253     /* custom module's ext_buf type */
#define EXT_DISPOSABLE  254     /* can throw this buffer away w/page flipping */
#define EXT_EXTREF      255     /* has externally maintained ref_cnt ptr */

if the M_PKTHDR flag is set, a struct pkthdr m_pkthdr gets added to the mbuf header. it contains a pointer to the interface the packet has been received from (struct ifnet *rcvif), and the total packet length (int len). optionally, it may also contain an attached list of packet tags (struct m_tag). see mbuf_tags(9) for the deets. fields used in offloading checksum calculation to the hardware are kept in m_pkthdr as well. see “HARDWARE-ASSISTED CHECKSUM CALCULATION” for the details. 🧚

if it's small enough, data is stored in the internal data buffer of an mbuf. if the data is sufficiently large, another mbuf may be added to the mbuf chain, or external storage may be associated with the mbuf. MHLEN bytes of data can fit into an mbuf with the M_PKTHDR flag set, MLEN bytes can otherwise. no cap. 💅

if external storage is being associated with an mbuf, the m_ext header is added at the cost of losing the internal data buffer. it includes a pointer to external storage, the size of the storage, a pointer to a function used for freeing the storage, a pointer to an optional argument that can be passed to the function, and a pointer to a reference counter. an mbuf using external storage has the M_EXT flag set. ✨

the system supplies a macro for allocating the desired external storage buffer, MEXTADD.

the allocation and management of the reference counter is handled by the subsystem.

the system also supplies a default type of external storage buffer called an mbuf cluster. mbuf clusters can be allocated and configured with the use of the MCLGET macro. each mbuf cluster is MCLBYTES in size, where MCLBYTES is a machine-dependent constant. the system defines an advisory macro MINCLSIZE, which is the smallest amount of data to put into an mbuf cluster. it is equal to MHLEN plus one. it's typically preferable to store data into the data region of an mbuf, if size permits, as opposed to allocating a separate mbuf cluster to hold the same data. lowkey just be efficient about it 🫶

👑 Macros and Functions 👑

there are numerous predefined macros and functions that provide the developer with common utilities. slay, let's go one by one:

mtod(mbuf, type) — convert an mbuf pointer to a data pointer. the macro expands to the data pointer cast to the specified type. > note: it is advisable to ensure that there is enough contiguous data in mbuf. see m_pullup() for details. 👀
MGET(mbuf, how, type) — allocate an mbuf and initialize it to contain internal data. mbuf will point to the allocated mbuf on success, or be set to NULL on failure. the how argument is to be set to M_WAITOK or M_NOWAIT. it specifies whether the caller is willing to block if necessary. a number of other functions and macros related to mbufs have the same argument because they may at some point need to allocate new mbufs. 😴
MGETHDR(mbuf, how, type) — allocate an mbuf and initialize it to contain a packet header and internal data. see MGET() for details.
MEXTADD(mbuf, buf, size, free, opt_arg1, opt_arg2, flags, type) — associate externally managed data with mbuf. any internal data contained in the mbuf will be discarded, and the M_EXT flag will be set. the buf and size arguments are the address and length, respectively, of the data. the free argument points to a function which will be called to free the data when the mbuf is freed; it is only used if type is EXT_EXTREF. the opt_arg1 and opt_arg2 arguments will be saved in ext_arg1 and ext_arg2 fields of the struct m_ext of the mbuf. the flags argument specifies additional mbuf flags; it is not necessary to specify M_EXT. finally, the type argument specifies the type of external data, which controls how it will be disposed of when the mbuf is freed. in most cases, the correct value is EXT_EXTREF. 💖

more parts coming, bestie — don't go anywhere 🦋

MCLGET(mbuf, how) — bestie this one allocates a cluster and attaches it to mbuf. If it worked you get a non-zero value back, otherwise you get 0. 💀 History lesson: people used to check for success by peeking at the M_EXT flag on the mbuf, but that's lowkey discouraged now — it forces protocol stacks and device drivers to know way too much about how external storage is implemented, and we don't do that anymore, okay?
M_ALIGN(mbuf, len) — sets the pointer mbuf->m_data so an object of size len sits at the end of mbuf's internal data area, all long-word aligned and cute. ⭐ Only valid if mbuf was freshly allocated with MGET() or m_get(), no exceptions bestie.
MH_ALIGN(mbuf, len) — same energy as M_ALIGN() but strictly for mbufs freshly allocated with MGETHDR() or m_gethdr(), or ones initialized by m_dup_pkthdr() or m_move_pkthdr(). Know the difference, it matters. 💅
m_align(mbuf, len) — does what M_ALIGN() does but for any type of mbuf. So flexible, we love her.
M_LEADINGSPACE(mbuf) — tells you how many bytes are chillin' before the start of the data in mbuf. 🌸
M_TRAILINGSPACE(mbuf) — tells you how many bytes are chillin' after the end of the data in mbuf. Symmetry, iconic.
M_PREPEND(mbuf, len, how) — okay so this macro works on an entire mbuf chain. It's an optimized wrapper for m_prepend() that can exploit empty space sitting before the data (like the space left behind after trimming a link-layer header ✨). After the call, the new mbuf chain pointer — or NULL — lives in mbuf.
M_MOVE_PKTHDR(to, from) — using this macro is literally just equivalent to calling m_move_pkthdr(to, from). That's it, that's the whole thing. 🫶
M_WRITABLE(mbuf) — this macro evaluates true if mbuf is not marked M_RDONLY and if either mbuf doesn't hold external storage, or, if it does, then the reference count of that storage is not greater than 1. The M_RDONLY flag can be set in mbuf->m_flags. You can do that during setup of the external storage by passing the M_RDONLY bit as a flags argument to the MEXTADD() macro, or you can just directly set it in individual mbufs. Your call bestie. 💖
MCHTYPE(mbuf, type) — changes the type of mbuf to type. Heads up: this is a relatively expensive operation and you should avoid it. It's giving "only if you have to". 😭

✨ The Functions ✨

m_get(how, type) — a function version of MGET() for non-critical paths. 🌈
m_get2(size, how, type, flags) — allocates an mbuf with enough space to hold the specified amount of data. Simple, effective, slay.
m_getm(orig, len, how, type) — allocates len bytes worth of mbufs and mbuf clusters if necessary, then appends the resulting allocated mbuf chain to the mbuf chain orig, if it's non-NULL. If the allocation fails at any point, it frees whatever was allocated and returns NULL. If orig is non-NULL, it will not be freed. 👑 Fun fact: you can use m_getm() to either append len bytes to an existing mbuf or mbuf chain (like one sitting in a pre-allocated ring, iykyk) or to just do a full all-or-nothing mbuf and mbuf cluster allocation.
m_gethdr(how, type) — a function version of MGETHDR() for non-critical paths. 🦋
m_getcl(how, type, flags) — fetches an mbuf with a mbuf cluster already attached. If one of the allocations fails, the whole thing fails — no partial slay here. This routine is the preferred way of fetching both the mbuf and mbuf cluster together, because it avoids having to unlock/relock between allocations. Returns NULL on failure. 💜
m_getjcl(how, type, flags, size) — like m_getcl() but the size of the cluster allocated will be large enough for size bytes. Bigger cluster, same vibe. ✨
m_free(mbuf) — frees mbuf and returns m_next of the freed mbuf. Bye bestie 👋

💅 The functions below operate on mbuf chains 💅

m_freem(mbuf) — frees an entire mbuf chain, external storage included. Full clear, no leftovers. 🧹
m_adj(mbuf, len) — trims len bytes off the head of an mbuf chain if len is positive, and off the tail otherwise. Choose your fighter. ✂️
m_append(mbuf, len, cp) — appends len bytes of data cp onto the mbuf chain, extending the chain if the new data doesn't fit in the existing space. 🌸
m_prepend(mbuf, len, how) — allocates a new mbuf and prepends it to the mbuf chain, handling M_PKTHDR properly. > Note: it does not allocate any mbuf clusters, so len must be less than MLEN or MHLEN, depending on the M_PKTHDR flag setting. Don't test her.
m_copyup(mbuf, len, dstoff) — similar to m_pullup() but it copies len bytes of data into a new mbuf at dstoff bytes into the mbuf. The dstoff argument aligns the data and leaves room for a link layer header — thoughtful queen 💅. Returns the new mbuf chain on success, and on failure it frees the mbuf chain and returns NULL. > Note: the function does not allocate mbuf clusters, so len + dstoff must be less than MHLEN.
m_pullup(mbuf, len) — arranges that the first len bytes of an mbuf chain are contiguous and sit in the data area of mbuf, so they're accessible with mtod(mbuf, type). Important bestie: this may involve reallocating some mbufs and moving data around, so every pointer referencing data within the old mbuf chain must be recalculated or made invalid. 😭 Returns the new mbuf chain on success, NULL on failure (and the mbuf chain is freed in that case). > Note: it does not allocate any mbuf clusters, so len must be less than or equal to MHLEN.
m_pulldown(mbuf, offset, len, offsetp) — arranges that len bytes between offset and offset + len in the mbuf chain are contiguous and lay in the data area of mbuf, so they're accessible with mtod(mbuf, type). len must be smaller than, or equal to, the size of an mbuf cluster. Returns a pointer to an intermediate mbuf in the chain containing the requested region; the offset in the data region of the mbuf chain to the data contained in the returned mbuf is stored in *offsetp. If offsetp is NULL, the region may be accessed using mtod(mbuf, type). If offsetp is non-NULL, the region may be accessed using mtod(mbuf, uint8_t) + *offsetp. And the best part: the region of the mbuf chain between its beginning and offset is not modified, so it's safe to hold pointers to data within this region before calling m_pulldown(). 🫶
m_copym(mbuf, offset, len, how) — makes a copy of an mbuf chain starting offset bytes from the beginning, continuing for len bytes. If len is M_COPYALL, it copies to the end of the mbuf chain. > Note: the copy is read-only, because the mbuf clusters aren't copied — only their reference counts are incremented. 💖
m_copypacket(mbuf, how) — copies an entire packet including the header, which must be present. This is an optimized version of the common case m_copym(mbuf, 0, M_COPYALL, how). > Note: the copy is read-only, because the mbuf clusters aren't copied — only their reference counts are incremented.
m_dup(mbuf, how) — copies a packet header mbuf chain into a completely new mbuf chain, mbuf clusters and all. Use this instead of m_copypacket() when you need a writable copy of an mbuf chain. 🔥
m_copydata(mbuf, offset, len, buf) — copies data from an mbuf chain starting off bytes from the beginning, continuing for len bytes, into the indicated buffer buf. 🌈
m_copyback(mbuf, offset, len, buf) — copies len bytes from the buffer buf back into the indicated mbuf chain, starting at offset bytes from the beginning of the mbuf chain, extending the mbuf chain if necessary. > Note: it does not allocate any mbuf clusters, just adds mbufs to the mbuf chain. And it's safe to set offset beyond the current mbuf chain end — zeroed mbufs will be allocated to fill the space. ✨
m_length(mbuf, last) — returns the length of the mbuf chain, and optionally a pointer to the last mbuf. Two birds, one function. 🎀
m_dup_pkthdr(to, from, how) — once this function is done, the mbuf to will contain an identical copy of from->m_pkthdr plus the per-packet attributes found in the mbuf chain from. The mbuf from must have the flag M_PKTHDR initially set, and to must be empty on entry. Rules are rules bestie. 💅
m_move_pkthdr(to, from) — moves m_pkthdr and the per-packet attributes from the mbuf chain from to the mbuf to. The mbuf from must have the flag M_PKTHDR initially set, and to must be empty on entry. Once it's done, from will have the flag M_PKTHDR and the per-packet attributes cleared. Handoff complete 🫶
m_fixhdr(mbuf) — sets the packet-header length to the length of the mbuf chain. Keeping it consistent, as she should. ⭐
m_devget(buf, len, offset, ifp, copy) — copies data from device local memory pointed to by buf into an mbuf chain. The copy is done using the specified copy routine copy, or bcopy() if copy is NULL. 🦋
m_cat(m, n) — concatenates n onto m. Both mbuf chains must be of the same type. n is not guaranteed to be valid after m_cat() returns. Also m_cat() doesn't update any packet header fields or free mbuf tags — it's just the concatenation, no extra credit. 😭
m_catpkt(m, n) — a variant of m_cat() that operates on packets. Both m and n must contain packet headers. n is not guaranteed to be valid after m_catpkt() returns. Same rules, packet edition. 💜
m_split(mbuf, len, how) — partitions an mbuf chain into two pieces, returning the tail: all but the first len bytes. In case of failure it returns NULL and attempts to restore the mbuf chain to its original state. She tries her best okay 😭
m_apply(mbuf, off, len, f, arg) — applies a function to an mbuf chain, at offset off, for length len bytes. Typically used to avoid calls to m_pullup() that would otherwise be unnecessary or undesirable. arg is a convenience argument passed straight through to the callback function f. ✨

Each time f() is called, it gets passed arg, a pointer to the data in the current mbuf, and the length len of the data in this mbuf that the function should be applied to. 🌸

The function should return zero to indicate success; otherwise, if an error is indicated, then m_apply() will return the error and stop iterating through the mbuf chain. No cap. 🔥

m_getptr(mbuf, loc, off) — returns a pointer to the mbuf containing the data located at loc bytes from the beginning of the mbuf chain. The corresponding offset into the mbuf gets stored in *off. 💖
m_defrag(m0, how) — This one's whole job is to defragment an mbuf chain, returning the shortest possible chain of mbufs and clusters. If allocation fails and this can not be completed, NULL will be returned and the original chain will be unchanged. Upon success, the original chain will be freed and the new chain will be returned. how should be either M_WAITOK or M_NOWAIT, depending on the caller's preference.

This function is especially useful in network drivers, where certain long mbuf chains must be shortened before being added to TX descriptor lists. 💅

m_collapse(m0, how, maxfrags) — Defragment an mbuf chain, returning a chain of at most maxfrags mbufs and clusters. If allocation fails or the chain cannot be collapsed as requested, NULL will be returned, with the original chain possibly modified. As with m_defrag(), how should be one of M_WAITOK or M_NOWAIT.
m_unshare(m0, how) — Create a version of the specified mbuf chain whose contents can be safely modified without affecting other users. If allocation fails and this operation can not be completed, NULL will be returned. The original mbuf chain is always reclaimed and the reference count of any shared mbuf clusters is decremented. how should be either M_WAITOK or M_NOWAIT, depending on the caller's preference. As a side-effect of this process the returned mbuf chain may be compacted.

This function is especially useful in the transmit path of network code, when data must be encrypted or otherwise altered prior to transmission. 🔥

✨ HARDWARE-ASSISTED CHECKSUM CALCULATION ✨

This section currently applies to TCP/IP only. In order to save the host CPU resources, computing checksums is offloaded to the network interface hardware if possible. The m_pkthdr member of the leading mbuf of a packet contains two fields used for that purpose, int csum_flags and int csum_data. The meaning of those fields depends on the direction a packet flows in, and on whether the packet is fragmented. Henceforth, csum_flags or csum_data of a packet will denote the corresponding field of the m_pkthdr member of the leading mbuf in the mbuf chain containing the packet.

On output, checksum offloading is attempted after the outgoing interface has been determined for a packet. The interface-specific field ifnet.if_data.ifi_hwassist (see ifnet(9)) is consulted for the capabilities of the interface to assist in computing checksums. The csum_flags field of the packet header is set to indicate which actions the interface is supposed to perform on it. The actions unsupported by the network interface are done in the software prior to passing the packet down to the interface driver; such actions will never be requested through csum_flags.

The flags demanding a particular action from an interface are as follows:

CSUM_IP — The IP header checksum is to be computed and stored in the corresponding field of the packet. The hardware is expected to know the format of an IP header to determine the offset of the IP checksum field.
CSUM_TCP — The TCP checksum is to be computed. (See below.)
CSUM_UDP — The UDP checksum is to be computed. (See below.)

Should a TCP or UDP checksum be offloaded to the hardware, the field csum_data will contain the byte offset of the checksum field relative to the end of the IP header. In this case, the checksum field will be initially set by the TCP/IP module to the checksum of the pseudo header defined by the TCP and UDP specifications.

On input, an interface indicates the actions it has performed on a packet by setting one or more of the following flags in csum_flags associated with the packet:

CSUM_IP_CHECKED — The IP header checksum has been computed.
CSUM_IP_VALID — The IP header has a valid checksum. This flag can appear only in combination with CSUM_IP_CHECKED.
CSUM_DATA_VALID — The checksum of the data portion of the IP packet has been computed and stored in the field csum_data in network byte order.
CSUM_PSEUDO_HDR — Can be set only along with CSUM_DATA_VALID to indicate that the IP data checksum found in csum_data allows for the pseudo header defined by the TCP and UDP specifications. Otherwise the checksum of the pseudo header must be calculated by the host CPU and added to csum_data to obtain the final checksum to be used for TCP or UDP validation purposes.

If a particular network interface just indicates success or failure of TCP or UDP checksum validation without returning the exact value of the checksum to the host CPU, its driver can mark CSUM_DATA_VALID and CSUM_PSEUDO_HDR in csum_flags, and set csum_data to 0xFFFF hexadecimal to indicate a valid checksum. It is a peculiarity of the algorithm used that the Internet checksum calculated over any valid packet will be 0xFFFF as long as the original checksum field is included.

💀 STRESS TESTING 💀

When running a kernel compiled with the option MBUF_STRESS_TEST, the following sysctl(8)-controlled options may be used to create various failure/extreme cases for testing of network drivers and other parts of the kernel that rely on mbufs.

net.inet.ip.mbuf_frag_size — Causes ip_output() to fragment outgoing mbuf chains into fragments of the specified size. Setting this variable to 1 is an excellent way to test the long mbuf chain handling ability of network drivers.
kern.ipc.m_defragrandomfailures — Causes the function m_defrag() to randomly fail, returning NULL. Any piece of code which uses m_defrag() should be tested with this feature.

🌈 RETURN VALUES 🌈

See above.

🫶 SEE ALSO 🫶

ifnet(9), mbuf_tags(9)

📜 HISTORY 📜

Mbufs appeared in an early version of BSD. Besides being used for network packets, they were used to store various dynamic structures, such as routing table entries, interface addresses, protocol control blocks, etc. In more recent FreeBSD use of mbufs is almost entirely limited to packet storage, with uma(9) zones being used directly to store other network-related memory.

Historically, the mbuf allocator has been a special-purpose memory allocator able to run in interrupt contexts and allocating from a special kernel address space map. As of FreeBSD 5.3, the mbuf allocator is a wrapper around uma(9), allowing caching of mbufs, clusters, and mbuf + cluster pairs in per-CPU caches, as well as bringing other benefits of slab allocation.

👑 AUTHORS 👑

The original mbuf manual page was written by Yar Tikhiy. The uma(9) mbuf allocator was written by Bosko Milekic.

That's the whole vibe, bestie. This page is from Debian, dated September 27, 2017, and it's the MBUF(9) manual. Slay. 💅✨

📦 where this page comes from

debian bookworm: freebsd-manpages 12.2-1 · BSD-2-Clause-FreeBSD AND BSD-4-Clause
debian trixie: freebsd-manpages 12.2-2 · BSD-2-Clause-FreeBSD AND BSD-4-Clause
ubuntu jammy: freebsd-manpages 12.2-1 · BSD-2-Clause-FreeBSD AND BSD-4-Clause
ubuntu noble: freebsd-manpages 12.2-1 · BSD-2-Clause-FreeBSD AND BSD-4-Clause
ubuntu questing: freebsd-manpages 12.2-2
ubuntu resolute: freebsd-manpages 12.2-2build1 · BSD-2-Clause-FreeBSD AND BSD-4-Clause
ubuntu stonking: freebsd-manpages 12.2-2build1 · BSD-2-Clause-FreeBSD AND BSD-4-Clause
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-18: a language model's rewrite of the original, under its terms