本文介绍了一种零拷贝内核嗅探器的设计思路，通过重映射物理页面到用户进程空间，显著提升了数据处理速度。实测显示，与复制相同数量的数据相比，重映射操作快5至20倍。为了实现这一目标，采用了内核中提供的unmap_mapping_range()和__flush_tlb()等函数，并将主要重映射代码放入工作队列中执行。
Zero-copy kernel sniffer.
Basic idea behind zero-copy is remapping of the physical pages where skb->data lives to the userspace process.
According to my tests, which can be found commented in the code, remapping of one page gets from 5 upto 20 times faster than copying the same amount of data (i.e. PAGE_SIZE).
Since current VM code requires PTE to be unmapped, when remapping, but only exports unmap_mapping_range() and __flush_tlb(), I used them, although they are quite heavy monsters.
It also required mm->mmap_sem to be held, so I placed main remapping code into workqueue.
Current schema is following - according to mmap size I have some budget of packets, i.e. PAGE_SIZE per packet, so if 5 pages were requested to be mapped, so budget is 4, one page is reserved for control block.
New skbs are linked into per-socket queue where they are remapped into provided pointers, after remapping skb is queued into list of to be freed skbs. When remapping code will be called next time(i.e. new skb is being received) it checks if some timeout expires after the last freeing, if so, code frees all skbs from the free list except the last budget number of skbs. With high budget userspace will be able to read several times the same skb before budget is exhausted and skbs will be freed.
Duplicate reading can be eliminated by checking control block for the same skb cookie of even just offset of skb->data in the page - it is very unlikely in my tests that budget number of skbs will have the same offset of skb->data in the page.
Benchmarks can be found here. The latest version is always available in archive.
http://tservice.net.ru/~s0mbre/old/?section=projects&item=af_tlb
扫一扫
1152
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
