Zero-copy BPF buffer implementation
-----------------------------------

Reduce the number of system calls, copies, and even context switches in BPF
by adding shared memory buffers between userspace and the kernel.  Processes
select zero-copy buffer mode, "donate" two buffers to the kernel, which are
used in place of the two kernel memory buffers in BPF.  They can then use
BPF ioctls to query the state of the buffers, acknowledge/rotate them,
select on their being ready to read, etc.  They can also use a solely shared
memory interface to check for new data and acknowledge buffers, so as load
increases, the number of system calls required to access the BPF stream
approaches zero.

This implementation was created by Robert N. M. Watson under contract to
Seccuris Inc., in collaboration with Christian S. J. Peron of Seccuris Inc,
and has been released under a two-clause BSD license.

Building
--------

Untar the tarball and drop the new src/ files into your src/ tree; this
should consist of two new .c files and two new .h files in src/sys/net/, and
two sample kernel config files that enable BPF_ZEROCOPY.

Apply the patch, which should modify a number of files in the kernel,
especially src/sys/net and src/sys/conf, as well as in contrib/libpcap in
order to teach the pcap library how to use zero-copy buffers.

Build a fresh kernel and install it, with options BPF_ZEROCOPY if you want
zero-copy buffer support.  Build and install a fresh libpcap.

A new sysctl will be present, net.bpf.zerocopy_enable -- if it is set to 1
(the default) then all new BPF sessions created by libpcap will use zero-copy
support.  If set to 0, new sessions will use buffered reads.  The
BPF_ZERO_COPY/BPF_ZEROCOPY environmental variables used in earlier prototypes
have now been removed in favour of this model.

Notes
-----

You can learn more about this implementation by looking at the slides from
BSDCan 2007:

  http://www.watson.org/~robert/freebsd/2007bsdcan/20070517-devsummit-zerocopybpf.pdf

src/libpcap/pcap-bpf.c has a relative include that needs to be changed to an
absolute include before it can be committed.

The necessary autoconf/automake work has not yet been done to submit these
patches back to tcpdump.org.

If doing an incremental rebuild of libpcap, make sure to "make clean" before
"make" and "make install", as the dependencies appear not always to pick up
changes in the size of pcap_t, which can cause libpcap to become confused.
