search

alexandernst / monks

Procmon alternative for Linux
71 stars 34 forks source link

Move from NetLink to Mmap #21

Closed alexandernst closed 10 years ago

alexandernst commented 11 years ago

I'd like to move away from the entire NetLink madness to mmap. I think procmon will gain in both speed and stability.

Anyways, I have been looking at the link you gave me ( http://people.ee.ethz.ch/~arkeller/linux/kernel_user_space_howto.html#ss8.1 ) here http://stackoverflow.com/questions/19233717/sharing-or-sending-data-from-lkm-to-userland and it seems as I'll have to face two big problems.

The first one is how to notify userland that there is more data availabe. I kept reading the link and I found I could use http://people.ee.ethz.ch/~arkeller/linux/kernel_user_space_howto.html#ss6.1 to notify userland when it should read more data.

But then, here it goes the second big problem: mmap is just writing to a buffer, like a file. Right now I'm saving and sending each message (containing name of program, pid, operation, details, etc... the syscall_info struct) like a piece of data, encoded and decoded with the de/serialize.c files. Each message looks like:

(size_t msg_size)(char msg_data)

So it's really easy to just read the msg_size from there, and then read that size and cast it to a syscall_info struct.

The problem is that I won't be able to do the same thing when I'm doing mmap, as everything will be written continuosly. Or will I?

Anyways, I'm open to any suggestions about this @milabs :)

milabs commented 11 years ago

I don't really think that netlink is not a good idea, but if you need the information about the mmap implementation take a look at the PFQ project. It aims to direct NIC packets capturing at wire speed and the performance is a key goal. As I see it they used mmap'ed area to share kernel-user ring buffers. Besides that, they registered a special proto family PF_Q so the socket created with that type can be used for mmaping and polling.

Well, see the project for details :)

alexandernst commented 11 years ago

I haven't decided yet to move from NetLink to Mmap, still thinking about it. Main reason of thinking about moving to something else is that I don't really know if NetLink is going to be able to send that much data without lagging. I mean, the average size of syscall_info would be around 200-500 bytes, and each syscall can be called from 0 to 20.000 (even more?) times per second. Let's take an average of 50 times/sec. If we hijack 150 syscalls, that would be 150 * 50 * 500 = 3750000 bytes (3662kb) that NetLink would need to send every second. (Not counting peaks).

Also, I really don't like how I need to run that while(1) loop to read from NetLink. Maybe libnl has something that will let me fix at least this thing. @milabs

alexandernst commented 10 years ago

Closing this, we're staying with NetLink :)