MALLOC(9)                    OpenBSD Kernel Manual                   MALLOC(9)

NAME
     malloc - kernel memory allocator

SYNOPSIS
     #include <sys/types.h>
     #include <sys/malloc.h>

     void *
     malloc(unsigned long size, int type, int flags);

     MALLOC(space, cast, unsigned long size, int type, int flags);

     void
     free(void *addr, int type);

     FREE(void *addr, int type);

DESCRIPTION
     The malloc() function allocates uninitialized memory in kernel address
     space for an object whose size is specified by size.  free() releases
     memory at address addr that was previously allocated by malloc() for re-
     use.  The MALLOC() macro variant is functionally equivalent to

           (space) = (cast)malloc((u_long)(size), type, flags)

     and the FREE() macro variant is equivalent to

           free((caddr_t)(addr), type)

     These macros should only be used when the size argument is a constant.

     Unlike its standard C library counterpart (malloc(3)), the kernel version
     takes two more arguments.  The flags argument further qualifies
     malloc()'s operational characteristics as follows:

           M_WAITOK
                This is defined to be 0, and is therefore most useful as an
                aid to code readability.  In effect, it is the same as having
                no other flags specified.  If memory is currently unavailable,
                malloc() may call sleep to wait for resources to be released
                by other processes.

           M_NOWAIT
                Causes malloc() to return NULL if the request cannot be imme-
                diately fulfilled due to resource shortage.

           M_CANFAIL
                In the M_WAITOK case, if not enough memory is available, re-
                turn NULL instead of calling panic(9).  M_CANFAIL has no ef-
                fect if M_NOWAIT is specified.

     The type argument broadly identifies the kernel subsystem for which the
     allocated memory was needed, and is commonly used to maintain statistics
     about kernel memory usage.  The following types are currently defined:

           M_FREE          Should be on free list.
           M_MBUF          Mbuf memory.
           M_DEVBUF        Device driver memory.
           M_DEBUG         malloc debug structures.
           M_PCB           Protocol control blocks.
           M_RTABLE        Routing tables.
           M_FTABLE        Fragment reassembly headers.
           M_IFADDR        Interface addresses.
           M_SOOPTS        Socket options.
           M_SYSCTL        Sysctl persistent buffers.
           M_IOCTLOPS      Ioctl data buffers.
           M_IOV           Large IOVs.
           M_MOUNT         VFS mount structs.
           M_NFSREQ        NFS request headers.
           M_NFSMNT        NFS mount structures.
           M_NFSNODE       NFS vnode private part.
           M_VNODE         Dynamically allocated vnodes.
           M_CACHE         Dynamically allocated cache entries.
           M_DQUOT         UFS quota entries.
           M_UFSMNT        UFS mount structures.
           M_SHM           SVID compatible shared memory segments.
           M_VMMAP         VM map structures.
           M_SEM           SVID compatible semaphores.
           M_DIRHASH       UFS directory hash structures.
           M_VMPMAP        VM pmap data.
           M_FILE          Open file structures.
           M_FILEDESC      Open file descriptor tables.
           M_PROC          Proc structures.
           M_SUBPROC       Proc sub-structures.
           M_VCLUSTER      Cluster for VFS.
           M_MFSNODE       MFS vnode private part.
           M_NETADDR       Export host address structures.
           M_NFSSVC        NFS server structures.
           M_NFSUID        NFS uid mapping structures.
           M_NFSD          NFS server daemon structures.
           M_IPMOPTS       Internet multicast options.
           M_IPMADDR       Internet multicast addresses.
           M_IFMADDR       Link-level multicast addresses.
           M_MRTABLE       Multicast routing tables.
           M_ISOFSMNT      ISOFS mount structures.
           M_ISOFSNODE     ISOFS vnode private part.
           M_MSDOSFSMNT    MSDOS FS mount structures.
           M_MSDOSFSFAT    MSDOS FS FAT tables.
           M_MSDOSFSNODE   MSDOS FS vnode private part.
           M_TTYS          Allocated tty structures.
           M_EXEC          Argument lists & other mem used by exec.
           M_MISCFSMNT     Misc. FS mount structures.
           M_ADOSFSMNT     ADOSFS mount structures.
           M_ANODE         ADOSFS anode structures and tables.
           M_ADOSFSBITMAP  ADOSFS bitmap.
           M_PFKEY         Pfkey data.
           M_TDB           Transforms database.
           M_XDATA         IPsec data.
           M_PAGEDEP       File page dependencies.
           M_INODEDEP      Inode dependencies.
           M_NEWBLK        New block allocation.
           M_RAIDFRAME     RAIDframe data.
           M_UVMAMAP       UVM amap and related.
           M_UVMAOBJ       UVM aobj and related.
           M_USB           USB general.
           M_USBDEV        USB device driver.
           M_USBHC         USB host controller.
           M_MEMDESC       Memory range.
           M_CRYPTO_DATA   crypto(4) data buffers.
           M_CREDENTIALS   ipsec(4) related credentials.
           M_PACKET_TAGS   Packet-attached information tags.
           M1394CTL        IEEE 1394 control structures.
           M1394DATA       IEEE 1394 data buffers.
           M_EMULDATA      Per process emulation data.
           M_IP6OPT        IPv6 options.
           M_IP6NDP        IPv6 neighbour discovery structures.
           M_IP6RR         IPv6 router renumbering prefix.
           M_RR_ADDR       IPv6 router renumbering interface identifiers.
           M_TEMP          Miscellaneous temporary data buffers.
           M_NTFSMNT       NTFS mount structures.
           M_NTFSNTNODE    NTFS ntnode information.
           M_NTFSNODE      NTFS fnode information.
           M_NTFSDIR       NTFS directory buffers.
           M_NTFSHASH      NTFS ntnode hash tables.
           M_NTFSVATTR     NTFS file attribute information.
           M_NTFSRDATA     NTFS resident data.
           M_NTFSDECOMP    NTFS decompression temporary storage.
           M_NTFSRUN       NTFS vrun storage.
           M_KEVENT        kqueue(2) data structures.
           M_BLUETOOTH     Bluetooth data structures.
           M_BWMETER       Multicast upcall bandwidth meters.
           M_UDFMOUNT      UDF mount structures.
           M_UDFFENTRY     UDF file entries.
           M_UDFFID        UDF file ids.

     Statistics based on the type argument are maintained only if the kernel
     option KMEMSTATS is used when compiling the kernel (the default in
     current OpenBSD kernels) and can be examined by using `vmstat -m'.

RETURN VALUES
     malloc() returns a kernel virtual address that is suitably aligned for
     storage of any type of object.

DIAGNOSTICS
     A kernel compiled with the DIAGNOSTIC configuration option attempts to
     detect memory corruption caused by such things as writing outside the al-
     located area and unbalanced calls to the malloc() and free() functions.
     Failing consistency checks will cause a panic or a system console mes-
     sage:

           o   panic: ``malloc - bogus type''
           o   panic: ``malloc: out of space in kmem_map''
           o   panic: ``malloc: allocation too large''
           o   panic: ``malloc: wrong bucket''
           o   panic: ``malloc: lost data''
           o   panic: ``free: unaligned addr''
           o   panic: ``free: duplicated free''
           o   panic: ``free: multiple frees''
           o   panic: ``kmeminit: minbucket too small/struct freelist too
               big''
           o   ``multiply freed item <addr>''
           o   ``Data modified on freelist: <data object description>''

DEBUGGING
     A kernel compiled with the MALLOC_DEBUG option allows for more extensive
     debugging of memory allocations.  The debug_malloc_type,
     debug_malloc_size, debug_malloc_size_lo and debug_malloc_size_hi vari-
     ables choose which allocation to debug.  debug_malloc_type should be set
     to the memory type and debug_malloc_size should be set to the memory size
     to debug.  0 can be used as a wildcard.  debug_malloc_size_lo and
     debug_malloc_size_hi can be used to specify a range of sizes if the exact
     size to debug is not known.  When those are used, debug_malloc_size needs
     to be set to the wildcard.  M_DEBUG can also be specified as an alloca-
     tion type to force allocation with debugging.

     Every call to malloc() with a memory type and size that matches the de-
     bugged type and size will allocate two virtual pages.  The pointer re-
     turned will be aligned so that the requested area will end at the page
     boundary and the second virtual page will be left unmapped.  This way we
     can catch reads and writes outside the allocated area.

     Every call to free() with memory that was returned by the debugging mal-
     loc will cause the memory area to become unmapped so that we can catch
     dangling reads and writes to freed memory.

     There are no special diagnostics if any errors are caught by the debug-
     ging malloc.  The errors will look like normal access to unmapped memory.
     On a memory access error, the show malloc command in ddb(4) can be in-
     voked to see what memory areas are allocated and freed.  If the faulting
     address is within two pages from an address on the allocated list, there
     was an access outside the allocated area.  If the faulting address is
     within two pages from an address on the free list, there was an access to
     freed memory.

     Care needs to be taken when using the MALLOC_DEBUG option:  the memory
     consumption can run away pretty quickly and there is a severe performance
     degradation when allocating and freeing debugged memory types.

SEE ALSO
     vmstat(8)

OpenBSD 4.0                     August 6, 2005                               4
