Re: Ref: zerocopy +netfilter performance problem.

Re: Ref: zerocopy +netfilter performance problem.

[Ravi Chamarti]

Hi,

Thanks for your response Alexey. I appreciate it. 

--- kuznet@ms2.inr.ac.ru wrote:
> Hello!
> 
> > My question is that is this copy is required for
> > netfilter to work? Do we somehow get around
> > with netfilter to work such that the zerocopy path
> > passes the packet without any copy?
> 
> Yes & yes.
> 
> Existing netfilter modules do not understand
> fragmented skbs,
> and as soon as netfilter folks are lazy even to move
> the check
> to relevant modules, even smart hooks has to be
> harmed by this.

How many netfilter modules exist which do not
understand fragmented skbs and need to look at the
skb data? 

Will the following approach work? 

if the somehow hook register shows interest only in
header (by setting a flag, may be in nf_hooks_ops 
struct), then we can avoid the copy of the fragmented
skb's data and all other cases, we copy fragmented
skb's data to a kernel buffer. The side effect is that
a flag field is introduced into nf_hook_ops struct
which makes netfilter modules to recompile. Are there
any other side affects or better approaches?


regards
Ravi Chamarti


__________________________________________________
Do You Yahoo!?
Make a great connection at Yahoo! Personals.
http://personals.yahoo.com

Re: Ref: zerocopy +netfilter performance problem.

[kuznet]

Hello!

> How many netfilter modules exist which do not

All of them.

> if the somehow hook register shows interest only in
> header

All the headers except for IP header can be split, at least
defragmenter generates them.

So, not this but rather: "does it understand that skb may be not linear?"

It will work of course.

Alexey

Ref: zerocopy +netfilter performance problem.

[Ravi Chamarti]

Hi all.

I am kind of new to this forum and am not sure whether
to pose this question in linux-kernel or linux-net

I am using linux kernel 2.4.4 and having performance
problem using zerocopy code and netfilter code in the
kernel.

I have been using zerocopy path through network stack
and things are going fine with that. Until I tried
enabling netfilter support in the kernel. The way I am
using zerocopy code is by passing kernel physical
pages directly to tcp_sendpage and letting network
code and NIC do the rest.


I enabled only network packet filter option inorder to
register my own nf_hook. I haven't enabled other
options like netfitler debugging/socket
filtering/conntrack/iptables/ipchains compt. 
Idea is to register my hook and do a little work with
the packet header but not with the data. I do have one
small hook which just return NF_ACCEPT and do nothing
with the packet. 

I am not intending to use any netfilter hooks for
zerocopy path, however would like to use netfiler
hooks for some non-zerocopy path traffic. 


What I see that a skb with frag list is getting copied
in the netfilter hook call (nf_hook_slow) ( I guess
skb_linearize routine is remapping all physical pages
and copies into a kernel buffer). 


My question is that is this copy is required for
netfilter to work? Do we somehow get around
with netfilter to work such that the zerocopy path
passes the packet without any copy?

Thanks
Ravi Chamarti.


__________________________________________________
Do You Yahoo!?
Make a great connection at Yahoo! Personals.
http://personals.yahoo.com