Linux 报文从网卡到协议栈之间处理的过程

背景

         作为一个Linux内核开发的程序员，时常会被问到内核收报的处理过程，很多时候可以快速讲出一个大概，但关注的重点多在内核协议栈的报文处理过程，对于报文从到达网卡再到上送协议栈之间的处理过程总是很模糊，因此想就此过程进行学习研究，故有了本篇博客。

收包过程

        网络收报处理的过程分为几个步骤：

        1）硬件接收，网卡通过物理层或者数据链路层接收到数据帧

        2) DMA传输，网卡通过DMA引擎将报文拷贝到ring_buffer缓冲区，并触发硬件中断，通知CPU有报文到来。

        3）CPU硬件中断处理，将报文从ring_buffer中拷贝到内核报文缓冲区skb_buffer中，并放入报文接收队列中。

        4）触发收报软中断NET_RX_ACTION

        5）软中断处理，将报文从接收队列移入处理队列，并上送内核协议栈

        6）内核协议栈报文处理

        这里需要说明的是Linux 内核只负责L2-L4层的内容，L1物理层硬件负责，L4以上应用层负责。

主题分析

        网络收报离不开网卡驱动，以Ubuntu 为例，常用的Intel网卡驱动为e1000模块，这里以e1000为例，介绍网卡收报过程，在此之前需要对驱动加载、网卡探测、请求中断等一系列过程有个了解。

        在Linux 内核中，驱动以模块的形式存在，即驱动实质是一个内核模块，在Linux 内核启动，模块初始化过程中加载注册驱动，函数调用过程如下：

         驱动注册过程如下：

static int __init e100_init_module(void)
{
	if (((1 << debug) - 1) & NETIF_MSG_DRV) {
		pr_info("%s, %s\n", DRV_DESCRIPTION, DRV_VERSION);
		pr_info("%s\n", DRV_COPYRIGHT);
	}
	return pci_register_driver(&e100_driver);
}

        由此可知e1000驱动为e100_driver，通过pci_register_driver注册到内核中，e100_driver定义如下：

static struct pci_driver e100_driver = {
	.name =         DRV_NAME, /* 驱动名 */
	.id_table =     e100_id_table,
	.probe =        e100_probe, /* 网卡探测函数 */
	.remove =       e100_remove, /* 网卡移除时调用，主要释放网卡相关资源 */
#ifdef CONFIG_PM
	/* Power Management hooks */
	.suspend =      e100_suspend,
	.resume =       e100_resume,
#endif
	.shutdown =     e100_shutdown, /* 网卡shutdown */
	.err_handler = &e100_err_handler,
};

        pci_register_driver注册的实质就是将对应网卡的驱动挂载在相应的总线下，这样当网卡插入pci总线时，总线启动扫描并遍历下面挂载的所有驱动，依据设备信息（如厂商Id，设备ID信息等）去匹配相应驱动id_table内容，匹配后调用驱动的probe函数为网卡请求中断号，注册中断处理函数等一系列操作。

        从e100_driver的定义可以出，驱动的几个核心函数为：e100_probe、e100_remove、e100_shutdown，这里我们主要介绍和收报有关的e100_probe 函数的处理逻辑。

probe函数

        probe函数处理逻辑如下：

static int e100_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
{
	struct net_device *netdev;
	struct nic *nic;
	int err;

	/* 申请并分配网络设备结构体变量netdev */
	if (!(netdev = alloc_etherdev(sizeof(struct nic))))
		return -ENOMEM;

	/* 设置网络设备硬件特征 */
	netdev->hw_features |= NETIF_F_RXFCS;
	netdev->priv_flags |= IFF_SUPP_NOFCS;
	netdev->hw_features |= NETIF_F_RXALL;

	/* 设置网络设备操作函数： 如open ,close，tx_xmit, do_ioctl等 */
	netdev->netdev_ops = &e100_netdev_ops;
	SET_ETHTOOL_OPS(netdev, &e100_ethtool_ops); /*设置网络设备配置操作接口 */
	netdev->watchdog_timeo = E100_WATCHDOG_PERIOD;
	strncpy(netdev->name, pci_name(pdev), sizeof(netdev->name) - 1);

	nic = netdev_priv(netdev);
	/* 设置网卡poll函数，用于通过dma从网卡缓冲区拉取报文到ring_buffer */
	netif_napi_add(netdev, &nic->napi, e100_poll, E100_NAPI_WEIGHT);
	nic->netdev = netdev;
	nic->pdev = pdev;
	nic->msg_enable = (1 << debug) - 1;
	nic->mdio_ctrl = mdio_ctrl_hw;
	pci_set_drvdata(pdev, netdev);

	/* 激活PCI设备 */
	if ((err = pci_enable_device(pdev))) {
		netif_err(nic, probe, nic->netdev, "Cannot enable PCI device, aborting\n");
		goto err_out_free_dev;
	}

	if (!(pci_resource_flags(pdev, 0) & IORESOURCE_MEM)) {
		netif_err(nic, probe, nic->netdev, "Cannot find proper PCI device base address, aborting\n");
		err = -ENODEV;
		goto err_out_disable_pdev;
	}

	/* 分配I/O内存区域 */
	if ((err = pci_request_regions(pdev, DRV_NAME))) {
		netif_err(nic, probe, nic->netdev, "Cannot obtain PCI resources, aborting\n");
		goto err_out_disable_pdev;
	}

	/* 打上dma_mask   意味值网卡支持dma        */
	if ((err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32)))) {
		netif_err(nic, probe, nic->netdev, "No usable DMA configuration, aborting\n");
		goto err_out_free_res;
	}

	SET_NETDEV_DEV(netdev, &pdev->dev);

	if (use_io)
		netif_info(nic, probe, nic->netdev, "using i/o access mode\n");

	/* 映射I/O 内存   */
	nic->csr = pci_iomap(pdev, (use_io ? 1 : 0), sizeof(struct csr));
	if (!nic->csr) {
		netif_err(nic, probe, nic->netdev, "Cannot map device registers, aborting\n");
		err = -ENOMEM;
		goto err_out_free_res;
	}

	if (ent->driver_data)
		nic->flags |= ich;
	else
		nic->flags &= ~ich;

	e100_get_defaults(nic);

	/* D100 MAC doesn't allow rx of vlan packets with normal MTU */
	if (nic->mac < mac_82558_D101_A4)
		netdev->features |= NETIF_F_VLAN_CHALLENGED;

	/* locks must be initialized before calling hw_reset */
	spin_lock_init(&nic->cb_lock);
	spin_lock_init(&nic->cmd_lock);
	spin_lock_init(&nic->mdio_lock);

	/* Reset the device before pci_set_master() in case device is in some
	 * funky state and has an interrupt pending - hint: we don't have the
	 * interrupt handler registered yet. */
	 /* 硬件复位 */
	e100_hw_reset(nic);

	pci_set_master(pdev);

	init_timer(&nic->watchdog);
	nic->watchdog.function = e100_watchdog;
	nic->watchdog.data = (unsigned long)nic;

	INIT_WORK(&nic->tx_timeout_task, e100_tx_timeout_task);

	if ((err = e100_alloc(nic))) {
		netif_err(nic, probe, nic->netdev, "Cannot alloc driver memory, aborting\n");
		goto err_out_iounmap;
	}

	if ((err = e100_eeprom_load(nic)))
		goto err_out_free;

	/* phy 寄存器复位 */
	e100_phy_init(nic);

	memcpy(netdev->dev_addr, nic->eeprom, ETH_ALEN);
	if (!is_valid_ether_addr(netdev->dev_addr)) {
		if (!eeprom_bad_csum_allow) {
			netif_err(nic, probe, nic->netdev, "Invalid MAC address from EEPROM, aborting\n");
			err = -EAGAIN;
			goto err_out_free;
		} else {
			netif_err(nic, probe, nic->netdev, "Invalid MAC address from EEPROM, you MUST configure one.\n");
		}
	}

	/* Wol magic packet can be enabled from eeprom */
	if ((nic->mac >= mac_82558_D101_A4) &&
	   (nic->eeprom[eeprom_id] & eeprom_id_wol)) {
		nic->flags |= wol_magic;
		device_set_wakeup_enable(&pdev->dev, true);
	}

	/* ack any pending wake events, disable PME */
	pci_pme_active(pdev, false);

	strcpy(netdev->name, "eth%d");
	/* 网络设备注册 */
	if ((err = register_netdev(netdev))) {
		netif_err(nic, probe, nic->netdev, "Cannot register net device, aborting\n");
		goto err_out_free;
	}
	/* 创建dma 缓冲池 */
	nic->cbs_pool = pci_pool_create(netdev->name,
			   nic->pdev,
			   nic->params.cbs.max * sizeof(struct cb),
			   sizeof(u32),
			   0);
	netif_info(nic, probe, nic->netdev,
		   "addr 0x%llx, irq %d, MAC addr %pM\n",
		   (unsigned long long)pci_resource_start(pdev, use_io ? 1 : 0),
		   pdev->irq, netdev->dev_addr);

	return 0;

err_out_free:
	e100_free(nic);
err_out_iounmap:
	pci_iounmap(pdev, nic->csr);
err_out_free_res:
	pci_release_regions(pdev);
err_out_disable_pdev:
	pci_disable_device(pdev);
err_out_free_dev:
	pci_set_drvdata(pdev, NULL);
	free_netdev(netdev);
	return err;
}

        通过上述代码可以看出里probe函数主要是分配、初始化、注册网络设备，分配并映射I/O缓冲区，为网卡收发包作准备，需要特别说明的是网卡的epoll函数也是在网卡设备注册时指定的，此后当报文到达网卡，软中断处理时可以依据poll函数拉取报文；网络设备操作函数 e100_netdev_ops，定义如下：

static const struct net_device_ops e100_netdev_ops = {
	.ndo_open		= e100_open,
	.ndo_stop		= e100_close,
	.ndo_start_xmit		= e100_xmit_frame,
	.ndo_validate_addr	= eth_validate_addr,
	.ndo_set_rx_mode	= e100_set_multicast_list,
	.ndo_set_mac_address	= e100_set_mac_address,
	.ndo_change_mtu		= e100_change_mtu,
	.ndo_do_ioctl		= e100_do_ioctl,
	.ndo_tx_timeout		= e100_tx_timeout,
#ifdef CONFIG_NET_POLL_CONTROLLER
	.ndo_poll_controller	= e100_netpoll,
#endif
	.ndo_set_features	= e100_set_features,
};

        这里介绍下e100_open，因为我们关注的关于网卡的中断号请求，中断处理函数都在这里。

e100_open

         e100_open 核心逻辑是调用了e100_up，因此我们重点关注下e100_up的处理。

static int e100_up(struct nic *nic)
{
	int err;

	/* 分配报文接收链表 */
	if ((err = e100_rx_alloc_list(nic)))
		return err;
	/* 分配初始化相应的dma 地址 */
	if ((err = e100_alloc_cbs(nic)))
		goto err_rx_clean_list;
	/* 硬件初始化 */
	if ((err = e100_hw_init(nic)))
		goto err_clean_cbs;
	e100_set_multicast_list(nic->netdev);
	/* 开始接收 */
	e100_start_receiver(nic, NULL);
	mod_timer(&nic->watchdog, jiffies);
	/* 请求中断号，并注册中断处理函数 */
	if ((err = request_irq(nic->pdev->irq, e100_intr, IRQF_SHARED,
		nic->netdev->name, nic->netdev)))
		goto err_no_irq;
	/* 唤醒传输队列 */
	netif_wake_queue(nic->netdev);
	/* 使能 napi调度 */
	napi_enable(&nic->napi);
	/* enable ints _after_ enabling poll, preventing a race between
	 * disable ints+schedule */
	/* 开启中断 */
	e100_enable_irq(nic);
	return 0;

err_no_irq:
	del_timer_sync(&nic->watchdog);
err_clean_cbs:
	e100_clean_cbs(nic);
err_rx_clean_list:
	e100_rx_clean_list(nic);
	return err;
}

        由此可见 e100网卡的中断处理函数为e100_intr，硬件中断处理是网卡收包到上送协议栈之间的关键，也是本博客的重点。

硬中断处理

static irqreturn_t e100_intr(int irq, void *dev_id)
{
	struct net_device *netdev = dev_id;
	struct nic *nic = netdev_priv(netdev);
	u8 stat_ack = ioread8(&nic->csr->scb.stat_ack);

	netif_printk(nic, intr, KERN_DEBUG, nic->netdev,
		     "stat_ack = 0x%02X\n", stat_ack);

	/* 中断确认 */
	if (stat_ack == stat_ack_not_ours ||	/* Not our interrupt */
	   stat_ack == stat_ack_not_present)	/* Hardware is ejected */
		return IRQ_NONE;

	/* Ack interrupt(s) */
	iowrite8(stat_ack, &nic->csr->scb.stat_ack); /* 中断状态回写*/

	/* We hit Receive No Resource (RNR); restart RU after cleaning */
	if (stat_ack & stat_ack_rnr) /* 中断状态判断是否需要延迟接收 */
		nic->ru_running = RU_SUSPENDED;

	/* 检查napi是否可调度，若是，关硬件中断，napi调度    */
	if (likely(napi_schedule_prep(&nic->napi))) {
		/* 硬件关中断 */
		e100_disable_irq(nic);

		/* napi 调度，目的：将网卡poll函数挂载到当前cpu待执行的poll链表中，并触发软中断 */
		__napi_schedule(&nic->napi);
	}

	return IRQ_HANDLED;
}

        由此可见，e100_intr主要做了如下几件事：

        1）中断状态确认，并回写。

        2）napi 调度，将网卡poll函数挂载到当前cpu待执行的poll链表中，并触发软中断__raise_softirq_irqoff(NET_RX_SOFTIRQ);

软中断处理

        收包软中断对应NET_RX_SOFTIRQ，处理函数注册如下：

open_softirq(NET_RX_SOFTIRQ, net_rx_action);

可见NET_RX_SOFTIRQ对应的处理函数为net_rx_action。

static __latent_entropy void net_rx_action(struct softirq_action *h)
{
	struct softnet_data *sd = this_cpu_ptr(&softnet_data);
	unsigned long time_limit = jiffies +
		usecs_to_jiffies(READ_ONCE(netdev_budget_usecs));
	int budget = READ_ONCE(netdev_budget);
	LIST_HEAD(list);
	LIST_HEAD(repoll);

start:
	sd->in_net_rx_action = true; /* 设置软中断收包标志，
		在触发软中断前首先判断该标志，如果正在收包则无需再触发软中断，
		poll函数会轮询处理所有待处理的报文 */
	local_irq_disable();
	list_splice_init(&sd->poll_list, &list);
	local_irq_enable();

	for (;;) {
		struct napi_struct *n;

		skb_defer_free_flush(sd);

		if (list_empty(&list)) {
			if (list_empty(&repoll)) {
				sd->in_net_rx_action = false;
				barrier();
				/* We need to check if ____napi_schedule()
				 * had refilled poll_list while
				 * sd->in_net_rx_action was true.
				 */
				if (!list_empty(&sd->poll_list))
					goto start;
				if (!sd_has_rps_ipi_waiting(sd))
					goto end;
			}
			break;
		}

		/* 轮询sd->poll_list上的所有napi设备 */
		n = list_first_entry(&list, struct napi_struct, poll_list);
		budget -= napi_poll(n, &repoll); /* 调用poll函数从网卡驱动中读取一定数量的skb */

		/* If softirq window is exhausted then punt.
		 * Allow this to run for 2 jiffies since which will allow
		 * an average latency of 1.5/HZ.
		 */
		if (unlikely(budget <= 0 ||
			     time_after_eq(jiffies, time_limit))) {
			sd->time_squeeze++;
			break;
		}
	}

	local_irq_disable();

	list_splice_tail_init(&sd->poll_list, &list);
	list_splice_tail(&repoll, &list);
	list_splice(&list, &sd->poll_list);
	if (!list_empty(&sd->poll_list)) /* 如果poll list不空，表示还有skb未接收完，继续触发软中断 */
		__raise_softirq_irqoff(NET_RX_SOFTIRQ);
	else
		sd->in_net_rx_action = false;

	/* 开启本地硬中断，*/
	net_rps_action_and_irq_enable(sd);
end:;
}

         软中断处理的核心是调用napi_poll函数轮询拉取报文，并上送协议栈。具体逻辑如下：

static int __napi_poll(struct napi_struct *n, bool *repoll)
{
	int work, weight;

	weight = n->weight; /* 表示一次软中断可以处理报文的个数最大数值 */

	/* This NAPI_STATE_SCHED test is for avoiding a race
	 * with netpoll's poll_napi().  Only the entity which
	 * obtains the lock and sees NAPI_STATE_SCHED set will
	 * actually make the ->poll() call.  Therefore we avoid
	 * accidentally calling ->poll() when NAPI is not scheduled.
	 */
	work = 0;
	/* 判断napi可调度状态位，若NAPI_STATE_SCHED置位则调用对应的poll函数，对于napi设备对应
		网卡提供的poll函数，以e100_poll为例，对应e100_poll,非NAPI函数对应process_backlog */
	if (test_bit(NAPI_STATE_SCHED, &n->state)) {
		work = n->poll(n, weight);
		trace_napi_poll(n, work, weight);
	}

	if (unlikely(work > weight))
		netdev_err_once(n->dev, "NAPI poll function %pS returned %d, exceeding its budget of %d.\n",
				n->poll, work, weight);

	if (likely(work < weight))
		return work;

	/* Drivers must not modify the NAPI state if they
	 * consume the entire weight.  In such cases this code
	 * still "owns" the NAPI instance and therefore can
	 * move the instance around on the list at-will.
	 */
	if (unlikely(napi_disable_pending(n))) {
		napi_complete(n);
		return work;
	}

	/* The NAPI context has more processing work, but busy-polling
	 * is preferred. Exit early.
	 */
	if (napi_prefer_busy_poll(n)) {
		if (napi_complete_done(n, work)) {
			/* If timeout is not set, we need to make sure
			 * that the NAPI is re-scheduled.
			 */
			napi_schedule(n);
		}
		return work;
	}

	if (n->gro_bitmask) {
		/* flush too old packets
		 * If HZ < 1000, flush all packets.
		 */
		napi_gro_flush(n, HZ >= 1000);
	}

	/* 将接收报文上送协议栈 */
	gro_normal_list(n);

	/* Some drivers may have called napi_schedule
	 * prior to exhausting their budget.
	 */
	if (unlikely(!list_empty(&n->poll_list))) {
		pr_warn_once("%s: Budget exhausted after napi rescheduled\n",
			     n->dev ? n->dev->name : "backlog");
		return work;
	}

	*repoll = true;

	return work;
}

        e100对应处理函数为e100_poll，处理逻辑如下：

static int e100_poll(struct napi_struct *napi, int budget)
{
	struct nic *nic = container_of(napi, struct nic, napi);
	unsigned int work_done = 0;

	e100_rx_clean(nic, &work_done, budget);
	e100_tx_clean(nic);

	/* If budget fully consumed, continue polling */
	if (work_done == budget)
		return budget;

	/* only re-enable interrupt if stack agrees polling is really done */
	if (likely(napi_complete_done(napi, work_done)))
		e100_enable_irq(nic);

	return work_done;
}

        其中和收包相关的处理为：e100_rx_clean，通过dma技术将报文直接从网卡内存缓冲区拉取报文到网卡的rx->list（事先分配好的内存区域，即常说的ring_buffer）。

        报文上送协议栈函数调用过程如下：

        至此，网卡收包的处理过程已基本结束，很多地方可能不够细节，待后续完善补充，希望能和大家一起交流学习。