Subject: Re: bpf/pcap performance
To: Darren Reed <darrenr@reed.wattle.id.au>
From: Guy Harris <guy@alum.mit.edu>
List: tech-net
Date: 04/10/2004 02:29:32
On Sat, Apr 10, 2004 at 07:30:15AM +1000, Darren Reed wrote:
> A merged change of the above plus a copy of FreeBSD's changes from 1.86,
> adapted for NetBSD are below.  I've not tested them yet beyond compiling
> them up and making sure the kernel links cleanly :)

BTW, there's some odd code in "bpfread()":

		if (d->bd_rtout != -1)
			error = tsleep((caddr_t)d, PRINET|PCATCH, "bpf",
					  d->bd_rtout);
		else {
			if (d->bd_rtout == -1) {
				/* User requested non-blocking I/O */
				error = EWOULDBLOCK;
			} else
				error = 0;
		}

In the outer "else", "d->bd_rtout" is known to be -1, so that should
probably just be

		if (d->bd_rtout != -1)
			error = tsleep((caddr_t)d, PRINET|PCATCH, "bpf",
					  d->bd_rtout);
		else {
			/* User requested non-blocking I/O */
			error = EWOULDBLOCK;
		}

Also, one of the changes imported from FreeBSD:

> ***************
> *** 1177,1182 ****
> --- 1223,1233 ----
>   	for (m0 = m; m0 != 0; m0 = m0->m_next)
>   		pktlen += m0->m_len;
>   
> + 	if (pktlen == m->m_len) {
> + 		bpf_tap(arg, mtod(m, u_char *), pktlen);
> + 		return;
> + 	}
> + 
>   	for (d = bp->bif_dlist; d != 0; d = d->bd_next) {
>   		++d->bd_rcount;
>   		slen = bpf_filter(d->bd_filter, (u_char *)m, pktlen, 0);

might introduce a bug - see FreeBSD PR kern/56441:

	In file 'sys/net/bpf.c' have a error introduced in CVS revision
	1.95.  This error is critical for the programs with used flag
	BIOCGSEESENT.  Locally generated packet may be copied in user
	space if flag BIOCGSEESENT set to one.  Function 'bpf_tap' must
	be used only for incoming packets.  But function 'bpf_mtap' uses
	'bpf_tap'.  It is fast.  But it's wrong.