Linux 网卡驱动sk_buff内核源码随笔

这几天在调试有关网卡驱动的东西，有很多地方不清楚。有关网卡驱动部分主要有两个很重要的结构体：struct net_device 和struct sk_buff。 驱动大部分都是围绕这两个东西进行操作的，包括加协议头尾，去头去尾等。为了搞清楚协议栈如何处理数据包，周末闲来无事就看看内核代码去了解下这部分东西，并做了简要记录：

/*
 *sk_buff->h		：传输层头	 ：udp头和tcp头
 *sk_buff->nh		：网络层头	 ：ip头
 *sk_buff->mac	    ：数据链路层头 ：mac头
 *
 *
 *sk_buff->head	：指向数据缓冲区头部
 *sk_buff->data	：指向实际数据的头部
 *sk_buff->tail	：指向实际数据的尾部
 *sk_buff->end	：指向数据缓冲区尾部
 *
 *
 *sk_buff控制区	：struct sk_buff所在的区域
 *线性数据区		：数据缓冲区域 ： sk_buff->head~sk_buff->end 之间的区域
 *非线性数据区	：数据缓冲区域的补充区域 ：skb_shared_info区域
 *
 *
 *sk_buff->truesize：线性数据区+非线性数据区+sizeof(struct sk_buff)
 *sk_buff->len     ：线性数据区+非线性数据区
 *sk_buff->data_len：非线性数据区
 *
 *
 *一个完整的网络帧(skb_buff)包括:
 *        线性数据区 + 非线性数据区 + skb_buff控制区
 *
 * skb_clone() ：只复制skb_buff控制区，其中新分配的skb_buff和原来的skb_buff共享线性数据区和非线性数据区
 *
 * pskb_copy() ：复制skb_buff控制区 + 线性数据区，共享非线性数据区
 *
 * skb_copy()  ：复制skb_buff控制区 + 线性数据区 + 非线性数据区
 *
 *
 *
 *
 */

源码附上：

struct sk_buff { /*表示接收或发送数据包的包头信息，其成员变量在从一层向另一层传递时会发生修改*/
	/* These two members must be first. */
	struct sk_buff		*next;
	struct sk_buff		*prev;

	struct sk_buff_head	*list;
	struct sock			*sk;
	struct timeval			stamp;
	struct net_device		*dev;
	struct net_device		*input_dev;
	struct net_device		*real_dev;

	union {
		struct tcphdr		*th;
		struct udphdr		*uh;
		struct icmphdr	*icmph;
		struct igmphdr	*igmph;
		struct iphdr		*ipiph;
		struct ipv6hdr	*ipv6h;
		unsigned char		*raw;
	} h;								/*传输层*/

	union {
		struct iphdr		*iph;
		struct ipv6hdr	*ipv6h;
		struct arphdr		*arph;
		unsigned char		*raw;
	} nh;							/*网络层*/

	union {
	  	unsigned char 	*raw;
	} mac;							/*链路层*/

	struct  dst_entry		*dst;	/*记录了到达目的地的路由信息，以及其他的一些网络特征信息*/
	struct	sec_path		*sp;

	/*
	 * This is the control buffer. It is free to use for every
	 * layer. Please put your private variables there. If you
	 * want to keep them across layers you have to do a skb_clone()
	 * first. This is owned by whoever has the skb queued ATM.
	 */
	char					 cb[40];

	/*
 	 *
	 *在sk_buff这个里面没有实际的数据，这里仅仅是控制信息，数据是通过后面的data指针指向其他内存块的！
	 *那个内存块中是线性数据和非线性数据！那么len 就是length(线性数据) + length(非线性数据),alloc分配的长度
	 *
	 */
	unsigned int		len,	/* len : 代表整个数据区域的长度！skb的组成是有sk_buff控制 + 线性数据 + 非线性数据(skb_shared_info) 组成！*/
					data_len, /*data_len: 指的是length(非线性数据)*/
					mac_len,
					csum;
	unsigned char		local_df,
					cloned:1,
					nohdr:1,		/*仅仅引用数据区域*/
					pkt_type,
					ip_summed;
	__u32			priority;
	unsigned short	protocol,
					security;

	void				(*destructor)(struct sk_buff *skb);

#ifdef CONFIG_NETFILTER
        unsigned long		nfmark;			/*nfmark，用于钩子之间通信*/
	__u32				nfcache;
	__u32				nfctinfo;
	struct nf_conntrack	*nfct;

#ifdef CONFIG_NETFILTER_DEBUG
        unsigned int			nf_debug;
#endif

#ifdef CONFIG_BRIDGE_NETFILTER
	struct nf_bridge_info	*nf_bridge;
#endif
#endif /* CONFIG_NETFILTER */
#if defined(CONFIG_HIPPI)
	union {
		__u32			ifield;
	} private;
#endif
#ifdef CONFIG_NET_SCHED
       __u32			tc_index;        /* traffic control index */
#ifdef CONFIG_NET_CLS_ACT
	__u32          		 tc_verd;               /* traffic control verdict */
	__u32           		tc_classid;            /* traffic control classid */
#endif

#endif

	/*
	 *	划重点！
	 *
	 * These elements must be at the end, see alloc_skb() for details.
	 *
	 */
	unsigned int		truesize;
	atomic_t			users;
	unsigned char		*head,	/*指向分配给的线性数据内存首地址*/
					*data,	/*指向保存数据内容的首地址*/
					*tail,	/*指向数据的结尾*/
					*end;	/*指向分配的内存块的结尾*/
};

​
/**
 *	skb_copy	-	create private copy of an sk_buff  如果要修改数据，使用该函数。不仅复制sk_buff控制区，也复制数据区。是一个完整的备份
 *	@skb: buffer to copy
 *	@gfp_mask: allocation priority
 *
 *	Make a copy of both an &sk_buff and its data. This is used when the
 *	caller wishes to modify the data and needs a private copy of the
 *	data to alter. Returns %NULL on failure or the pointer to the buffer
 *	on success. The returned buffer has a reference count of 1.
 *
 *	As by-product this function converts non-linear &sk_buff to linear
 *	one, so that &sk_buff becomes completely private and caller is allowed
 *	to modify all the data of returned buffer. This means that this
 *	function is not recommended for use in circumstances when only
 *	header is going to be modified. Use pskb_copy() instead.
 */

struct sk_buff *skb_copy(const struct sk_buff *skb, int gfp_mask)
{
	int headerlen = skb->data - skb->head;
	/*
	 *	Allocate the copy buffer
	 */
	struct sk_buff *n = alloc_skb(skb->end - skb->head + skb->data_len, /*分配的空间大小为：sizeof（线性数据区  + 非线性数据区）*/
				      gfp_mask);
	if (!n)
		return NULL;

	/* Set the data pointer */
	skb_reserve(n, headerlen);	/*skb_reserve 分配headerlen大小的headroom 空间*/
	/* Set the tail pointer and length */
	skb_put(n, skb->len);
	n->csum	     = skb->csum;
	n->ip_summed = skb->ip_summed;

	if (skb_copy_bits(skb, -headerlen, n->head, headerlen + skb->len))
		BUG();

	copy_skb_header(n, skb);
	return n;
}

​

/**
 *	pskb_copy	-	create copy of an sk_buff with private head.
 *	@skb: buffer to copy
 *	@gfp_mask: allocation priority
 *
 *	Make a copy of both an &sk_buff and part of its data, located
 *	in header. Fragmented data remain shared. This is used when
 *	the caller wishes to modify only header of &sk_buff and needs
 *	private copy of the header to alter. Returns %NULL on failure
 *	or the pointer to the buffer on success.
 *	The returned buffer has a reference count of 1.
 */

struct sk_buff *pskb_copy(struct sk_buff *skb, int gfp_mask)/*复制sk_buff控制区和线性数据区，非线性数据区依然共享*/
{
	/*
	 *	Allocate the copy buffer
	 */
	struct sk_buff *n = alloc_skb(skb->end - skb->head, gfp_mask);

	if (!n)
		goto out;

	/* Set the data pointer */
	skb_reserve(n, skb->data - skb->head);
	/* Set the tail pointer and length */
	skb_put(n, skb_headlen(skb));
	/* Copy the bytes */
	memcpy(n->data, skb->data, n->len);
	n->csum	     = skb->csum;
	n->ip_summed = skb->ip_summed;

	n->data_len  = skb->data_len;
	n->len	     = skb->len;

	if (skb_shinfo(skb)->nr_frags) {
		int i;

		for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
			skb_shinfo(n)->frags[i] = skb_shinfo(skb)->frags[i];
			get_page(skb_shinfo(n)->frags[i].page);
		}
		skb_shinfo(n)->nr_frags = i;
	}

	if (skb_shinfo(skb)->frag_list) {
		skb_shinfo(n)->frag_list = skb_shinfo(skb)->frag_list;
		skb_clone_fraglist(n);
	}

	copy_skb_header(n, skb);
out:
	return n;
}

/**
 *	skb_clone	-	duplicate an sk_buff ：只复制一个和skb_buff,该skb_buff的指针的值与原来的skb值相同
 *	@skb: buffer to clone
 *	@gfp_mask: allocation priority
 *
 *	Duplicate an &sk_buff. The new one is not owned by a socket. Both
 *	copies share the same packet data but not structure. The new
 *	buffer has a reference count of 1. If the allocation fails the
 *	function returns %NULL otherwise the new buffer is returned.
 *
 *	If this function is called from an interrupt gfp_mask() must be
 *	%GFP_ATOMIC.
 */

struct sk_buff *skb_clone(struct sk_buff *skb, int gfp_mask)
{
	struct sk_buff *n = kmem_cache_alloc(skbuff_head_cache, gfp_mask);

	if (!n)
		return NULL;

#define C(x) n->x = skb->x     /*只复制控制区，因此定义一个宏函数方便复制操作*/

	n->next = n->prev = NULL;
	n->list = NULL;
	n->sk = NULL;
	C(stamp);
	C(dev);
	C(real_dev);
	C(h);
	C(nh);
	C(mac);
	C(dst);
	dst_clone(skb->dst);
	C(sp);
#ifdef CONFIG_INET
	secpath_get(skb->sp);
#endif
	memcpy(n->cb, skb->cb, sizeof(skb->cb));
	C(len);
	C(data_len);
	C(csum);
	C(local_df);
	n->cloned = 1;
	n->nohdr = 0;
	C(pkt_type);
	C(ip_summed);
	C(priority);
	C(protocol);
	C(security);
	n->destructor = NULL;
#ifdef CONFIG_NETFILTER
	C(nfmark);
	C(nfcache);
	C(nfct);
	nf_conntrack_get(skb->nfct);
	C(nfctinfo);
#ifdef CONFIG_NETFILTER_DEBUG
	C(nf_debug);
#endif
#ifdef CONFIG_BRIDGE_NETFILTER
	C(nf_bridge);
	nf_bridge_get(skb->nf_bridge);
#endif
#endif /*CONFIG_NETFILTER*/
#if defined(CONFIG_HIPPI)
	C(private);
#endif
#ifdef CONFIG_NET_SCHED
	C(tc_index);
#ifdef CONFIG_NET_CLS_ACT
	n->tc_verd = SET_TC_VERD(skb->tc_verd,0);
	n->tc_verd = CLR_TC_OK2MUNGE(skb->tc_verd);
	n->tc_verd = CLR_TC_MUNGED(skb->tc_verd);
	C(input_dev);
	C(tc_classid);
#endif

#endif
	C(truesize);
	atomic_set(&n->users, 1);
	C(head);
	C(data);
	C(tail);
	C(end);

	atomic_inc(&(skb_shinfo(skb)->dataref));
	skb->cloned = 1;

	return n;
}