Hi all, I have an idea about using the DMA rings of a networking card as a tracing buffer. Hereby I want to thank the Linux community for the discussions about how “basically” tracing buffers in Linux currently works. In my minds I currently have two possible use-cases why doing this: 1. A generic tracing buffer filtering and matching offloading engine 2. Directly transmit the tracing buffer to a remote tracer application For example, my tracing use case DLM viewer [0], can use 1 to easily “tag” each event according to specific trace event field key/values pairs to completely offload this handling from the CPU. The use-case 2 can be used for distributed networking tracing e.g. my tracer is on a remote machine running and expecting time synchronized traces. There are probably more ideas around that can be taken from the networking subsystem. Receiving the tracing buffer (after processed through the NIC ASIC) AF_XDP could be used to get directly the data from the NIC DMA. Bouncing buffers should be avoided as possible. I don’t want to go more into the details but a NIC ASIC can be programmed, e.g. matching is only a shift,mask and compare operation followed by an action e.g. drop. How it will look in detail I am not sure yet, but I hope the idea is clear so far. :) I would simply start with trying introducing a tracing networking interface (as my current software NIC), put trace events into skb, loopback them into my tracing networking interface and run wireshark on it. Then try to use software parts of the networking subsystem to filter trace events out and see if it works in theory. Bringing it to real hardware, doing it on real NIC DMA rings and offloading the filter/matching operations is another future step. For my remote tracer application and time synchronized tracing, I am sure. I can get more metadata involved into my trace events that are coming from time sensitive networking equipment - this is definitely something I would like to look into. So that's it about the idea that I have and I am asking for any comments. Does this sound like a useful thing? Can something already be done with splice(), etc. and direct the tracing buffer to the NIC DMA over user space (without bouncing buffers)? Somebody already had a similar idea? - Alex [0] https://lwn.net/Articles/897257/