On Fri, 28 May 2021 17:02:01 +0800 Xuan Zhuo <xuanzhuo@xxxxxxxxxxxxxxxxx> wrote: > On Fri, 28 May 2021 10:55:58 +0200, Toke Høiland-Jørgensen <toke@xxxxxxxxxx> wrote: > > Xuan Zhuo <xuanzhuo@xxxxxxxxxxxxxxxxx> writes: > > > > > In xsk mode, users cannot use AF_PACKET(tcpdump) to observe the current > > > rx/tx data packets. This feature is very important in many cases. So > > > this patch allows AF_PACKET to obtain xsk packages. > > > > You can use xdpdump to dump the packets from the XDP program before it > > gets redirected into the XSK: > > https://github.com/xdp-project/xdp-tools/tree/master/xdp-dump > > Wow, this is a good idea. Yes, it is rather cool (credit to Eelco). Notice the extra info you can capture from 'exit', like XDP return codes, if_index, rx_queue. The tool uses the perf ring-buffer to send/copy data to userspace. This is actually surprisingly fast, but I still think AF_XDP will be faster (but it usually 'steals' the packet). Another (crazy?) idea is to extend this (and xdpdump), is to leverage Hangbin's recent XDP_REDIRECT extension e624d4ed4aa8 ("xdp: Extend xdp_redirect_map with broadcast support"). We now have a xdp_redirect_map flag BPF_F_BROADCAST, what if we create a BPF_F_CLONE_PASS flag? The semantic meaning of BPF_F_CLONE_PASS flag is to copy/clone the packet for the specified map target index (e.g AF_XDP map), but afterwards it does like veth/cpumap and creates an SKB from the xdp_frame (see __xdp_build_skb_from_frame()) and send to netstack. (Feel free to kick me if this doesn't make any sense) -- Best regards, Jesper Dangaard Brouer MSc.CS, Principal Kernel Engineer at Red Hat LinkedIn: http://www.linkedin.com/in/brouer
