9 ms·

Unfortunately, these days crypto really is a mandatory feature, and sendfile doesn't work with TLS anyway. (IMO it should - secure communication should be an O

by comex 10y ago

Unfortunately, these days crypto really is a mandatory feature, and sendfile doesn't work with TLS anyway. (IMO it should - secure communication should be an OS-level service rather than requiring each application to figure it out, just like the OS provides TCP rather than requiring each application to implement reliable connections - but that's another story.)

geofft 10y ago
Hmmm. sendfile is great because it lets the kernel arrange for DMA straight from disk to the network card, in addition to bypassing context switches and copies to and from userspace buffers. If the kernel gains an SSL stack (the encrypted version of the file is going to be different for each connection), you can't DMA and you'll need to make copies into kernelspace buffers to do the encryption on. Is skipping the context switch enough to make a meaningful performance different?
- feld 10y ago
  Yes. And I believe Solaris was the first to discover this. Here's a paper Netflix put out covering their first attempt. Measurable gains, hopefully more coming in the future. https://openconnect.netflix.com/publications/asiabsd_2015_tls.pdf https://openconnect.netflix.com/publications/asiabsd_2015_tl... edit: check this post first https://news.ycombinator.com/item?id=12037748 https://news.ycombinator.com/item?id=12037748
  - zrm 10y ago
    If you do it that way you could add hardware encryption support to the network card and be back to using DMA.
  - geofft 10y ago
    Oh, that's fascinating and awesome! Thanks for the links.
- lomnakkus 10y ago
  > Is skipping the context switch enough to make a meaningful performance different? Only in (very) high-bandwidth cases and (maybe!) for low-power cases. For most things it's just added complexity for no benefit.