Subject: Re: bpf performance suckage
To: None <>
From: Darren Reed <>
List: tech-net
Date: 06/20/2000 12:58:12
In some email I received from, sie wrote:
> 	new code will behave just like traditional 4.4BSDdoes, so packets will
> 	be packed like this:
> 	- single header mbuf (MHLEN) if len <= MHLEN
> 	- header mbuf + normal mbuf (MHLEN + MLEN) if len <= MHLEN + MLEN
> 	- single cluster mbuf (MCLBYTES), or multiple cluster mbufs otherwise
> 	with the new code, upper-layer headers on a IPv6 packet would exceed
> 	the first mbuf easily.  if bpf code looks at first mbuf only, we will
> 	fail to catch IPv6 packet by bpf.

Hmmm.  I've changed my local bpf_filter() to be like this:

 * Execute the filter program starting at pc on the packet p
 * wirelen is the length of the original packet
 * buflen is the amount of data present
 * For the kernel, p is assumed to be a pointer to an mbuf if buflen is 0,
 * in all other cases, p is a pointer to a buffer and buflen is its size.
bpf_filter(pc, p, wirelen, buflen)
        register struct bpf_insn *pc;
        register u_char *p;
        u_int wirelen;
        register u_int buflen;    
        register u_int32 A, X;
        register int k;
        int32 mem[BPF_MEMWORDS];
#ifdef        KERNEL 
        struct mbuf *m, *n;
        int merr, len;                  

        if (buflen == 0) {
                m = (struct mbuf *)p;
                p = mtod(m, char *);
                buflen = m->m_len;
        } else
                m = NULL;
                case BPF_LD|BPF_W|BPF_ABS:
                        k = pc->k;
                        if (k + sizeof(int32) > buflen) {
#ifdef KERNEL 
                                if (m == NULL)
                                        return 0;
                                A = m_xword(m, k, &merr);
                                if (merr != 0)
                                        return 0;
                                return 0;

I believe that will work for you ?  Do you want me to send you the
bpf_filter.c I'm testing so you can test it with your changes ?