title: When to use network system calls vs. sk_buff within a KM
body: <p>While trying to learn more about linux kernel networking ... I have a kernel module that contains a protocol which runs on top of TCP. Its almost an application layer protocol I'm experimenting with. The calls are passed in via the normal system call interface as executed from userspace. </p>
  
  <p>So network calls from within my (layer above TCP) module generally look like this ...</p>
  
  <pre><code>ret = sock-&gt;ops-&gt;connect(sock, (struct sockaddr *) &amp;myprot.daddr,
      sizeof(myprot.daddr), flags);
  </code></pre>
  
  <p>I've used sendmsg/recvmsg successfully within my KM to send and receive data from a client to a server (from two separate kernel instances). The calls within the KM generally looks as follows:</p>
  
  <pre><code>ret = sock-&gt;ops-&gt;sendmsg(iocb, myprot.skt, &amp;msg, sizeof(struct msghdr));
  
  ret = sock-&gt;ops-&gt;recvmsg(iocb, sock, msg, total_len, flags);
  </code></pre>
  
  <p>What I'm trying to understand now is how and when to use sk_buff to do the same thing. I.e. when to use system calls such as what I use above, and when to directly access the network stack via sk_buff to send and receive data.</p>
  
  <p>I've found many examples of how to send and receive data from within transport layers using sk_buff, but nothing from a layer above the transport that is also contained in a kernel module and using sk_buff.</p>
  
  <p><strong>Update for clarification.</strong></p>
  
  <p>I've overridden struct proto_ops and replaced the member methods for my own protocols use which do correspond to system calls from user space. I do understand that sk_buff is the buffer system for the kernel and is where packets are enqueued. However. I don't see any reason why I can't use the protocol-specific functions of struct proto_ops which also handles sockets and the data enqueued on them (though at a higher level). So it seems to me there are two ways to access sk_buffs depending upon where one wants to access them.</p>
  
  <p>If I'm working in the transport layer and want to access data anywheres within the network stack (e.g. transport, ip, mac), I could directly access sk_buffs, but if I am working above the transport layer, I would use the abstracted protocol specific member functions that correspond to system calls. After all, they both eventually work on sk_buffs.</p>
  
  <p>I guess my confusion, or what I'm trying to confirm that I'm doing right or wrong by knowing the difference in these two ways to access sk_buffs and from where, is ... if I'm sending data over a transport from TCP within the kernel, than I can just make use of the proto_ops system calls that relate to TCP unless I need more control in which I would then make use of the lower level skb functions to manage the queues.</p>