Re: HEADS UP: zerocopy bpf commits impending

On Mon, 24 Mar 2008, Petri Helenius wrote:

> Pardon the basic question, but is the current patchset "zero copy" or "one 
> copy"? The paper I saw a link to described a mechanism to eliminate one of 
> the two copies the traditional bpf approach makes but I haven't taken a look 
> into the actual code.

The short answer is "one-copy".  This eliminates the copy between the kernel 
and user space, but not the possibility of in-kernel copying.  In practice, 
that in-kernel copying is frequently desirable as:

(1) It allows packing of headers into a buffer when a small snaplen is used,
     which greatly reduces memory overhead when capturing, for example, just
     TCP headers and not payloads.

(2) It allows us to more easily maintain independence between separate BPF
     sessions, and in particular, to avoid leaking memory between kernel,
     userspace, and different BPF consumers.

If doing full capture of all packet data to userspace, the approach we took 
would improve performance, but would still involve one full copy of packet 
data in kernel.  Further work would be required to eliminate that copy.

Robert N M Watson
Computer Laboratory
University of Cambridge