一句话：提出 DAMN 分配器，在保持 IOMMU 保护的同时消除网络数据包额外拷贝，使性能接近无保护系统。
论文关注操作系统利用 IOMMU 防护恶意或错误网络 DMA 时的性能问题。传统方案在每次数据包 DMA 前后立即映射/取消映射缓冲区；较新方案则保持包不可 DMA，并复制到永久映射缓冲区，但额外拷贝拖慢多千兆网络。作者指出在 DMA 映射/取消映射边界强制保护过于严格：只需保证内核读取后设备不能再修改数据，因此无需在该层切换缓冲区所有权。为此提出 DAMN（DMA-Aware Malloc for Networking）分配器，从永久映射于 IOMMU 的内存池中分配和释放包缓冲区，并修改网络栈使用该分配器；仅在内核需要数据时复制，通常将额外拷贝转化为用户-内核边界的标准拷贝。最终在提供完整 IOMMU 保护的同时取得与无保护系统相当的性能。
DMA operations can access memory buffers only if they are "mapped" in the IOMMU, so operating systems protect themselves against malicious/errant network DMAs by mapping and unmapping each packet immediately before/after it is DMAed. This approach was recently found to be riskier and less performant than keeping packets non-DMAable and instead copying their content to/from permanently-mapped buffers. Still, the extra copy hampers performance of multi-gigabit networking. We observe that achieving protection at the DMA (un)map boundary is needlessly constraining, as devices must be prevented from changing the data only after the kernel reads it. So there is no real need to switch ownership of buffers between kernel and device at the DMA (un)mapping layer, as opposed to the approach taken by all existing IOMMU protection schemes. We thus eliminate the extra copy by (1)~implementing a new allocator called DMA-Aware Malloc for Networking (DAMN), which (de)allocates packet buffers from a memory pool permanently mapped in the IOMMU; (2)~modifying the network stack to use this allocator; and (3)~copying packet data only when the kernel needs it, which usually morphs the aforementioned extra copy into the kernel's standard copy operation performed at the user-kernel boundary. DAMN thus provides full IOMMU protection with performance comparable to that of an unprotected system.
DOI 原文 ·
@inproceedings{paperbot4276,
title = {DAMN},
author = {Alex Markuze and Igor Smolyar and Adam Morrison and Dan Tsafrir},
booktitle = {ASPLOS},
year = {2018},
doi = {10.1145/3173162.3173175}
}