AF_XDP and packet timestamp

AF_XDP and packet timestamp

[Eric Leblond]

Hello,

I did start to work on AF_XDP support for Suricata. API was really easy
to use via libbpf.

From Suricata point of view, the current system with default
configuration is lacking an important information. I don't have access
to the timestamp of the packet. I'm in particular interested by the
hardware timestamp as it would allow to do reordering in some capture
cases.

Is there a way to get the information via AF_XDP. I've seen the
discussion on hardware hints but there was no code example I was able
to find. 

BR,
-- 
Eric Leblond <eric@regit.org>

Re: AF_XDP and packet timestamp

[Ilias Apalodimas]

Hi Eric, 

> Hello,
> 
> I did start to work on AF_XDP support for Suricata. API was really easy
> to use via libbpf.
> 
> From Suricata point of view, the current system with default
> configuration is lacking an important information. I don't have access
> to the timestamp of the packet. I'm in particular interested by the
> hardware timestamp as it would allow to do reordering in some capture
> cases.
There's no timestamp available to my knowledge
> 
> Is there a way to get the information via AF_XDP. I've seen the
> discussion on hardware hints but there was no code example I was able
> to find. 
This is an awful hack i did when i needed similar information [1]
Essentially i am copying a software 'timestamp' (in my case rdtsc() since i
needed to measure packet timings from AF_XDP -> userspace), into the meta_data
of XDP.
The way i did it is obviously wrong since it has to be added per driver.
> 
> BR,
> -- 
> Eric Leblond <eric@regit.org>
> 

[1] https://github.com/xdp-project/xdp-project/blob/master/areas/arm64/xdp_for_tsn.org

Cheers
/Ilias

Re: AF_XDP and packet timestamp

[Toke Høiland-Jørgensen]

Eric Leblond <eric@regit.org> writes:

> Hello,
>
> I did start to work on AF_XDP support for Suricata. API was really easy
> to use via libbpf.
>
> From Suricata point of view, the current system with default
> configuration is lacking an important information. I don't have access
> to the timestamp of the packet. I'm in particular interested by the
> hardware timestamp as it would allow to do reordering in some capture
> cases.
>
> Is there a way to get the information via AF_XDP. I've seen the
> discussion on hardware hints but there was no code example I was able
> to find.

Making more information from the hardware available to XDP is currently
on our list of things we plan to enable in the future:
https://github.com/xdp-project/xdp-project/blob/master/xdp-project.org#metadata-available-to-programs

I just added timestamps as a field we want in there (so we don't
forget).

I.e., no, there is no way to get this information from XDP (and thus not
from AF_XDP either) yet...

-Toke

Re: AF_XDP and packet timestamp

[Jesper Dangaard Brouer]

On Mon, 17 Jun 2019 13:03:14 +0200
Toke Høiland-Jørgensen <toke@redhat.com> wrote:

> Eric Leblond <eric@regit.org> writes:
> 
> > Hello,
> >
> > I did start to work on AF_XDP support for Suricata. API was really easy
> > to use via libbpf.
> >
> > From Suricata point of view, the current system with default
> > configuration is lacking an important information. I don't have access
> > to the timestamp of the packet. I'm in particular interested by the
> > hardware timestamp as it would allow to do reordering in some capture
> > cases.
> >
> > Is there a way to get the information via AF_XDP. I've seen the
> > discussion on hardware hints but there was no code example I was able
> > to find.  
> 
> Making more information from the hardware available to XDP is currently
> on our list of things we plan to enable in the future:
> https://github.com/xdp-project/xdp-project/blob/master/xdp-project.org#metadata-available-to-programs
> 
> I just added timestamps as a field we want in there (so we don't
> forget).
> 
> I.e., no, there is no way to get this information from XDP (and thus not
> from AF_XDP either) yet...

We/XDP don't have access to hardware info, yet... BUT I plan to add
this, e.g. see my slides[1].  (Where to place this HW info, and how to
make it avail to both XDP and netstack, didn't reach a conclusion at
NetConf2019, so the "roadmap" is fuzzy).

To get a software timestamp into AF_XDP, simply use helper
bpf_ktime_get_ns() to get the time, and store info into metadata area
(placed in front of packet) via helper bpf_xdp_adjust_meta() example
see[2].  Then AF_XDP userspace can read this metadata area, which is
placed just in front of packet headers.


[1] http://vger.kernel.org/netconf2019_files/xdp-metadata-discussion.pdf
[2] https://github.com/torvalds/linux/blob/master/samples/bpf/xdp2skb_meta_kern.c
-- 
Best regards,
  Jesper Dangaard Brouer
  MSc.CS, Principal Kernel Engineer at Red Hat
  LinkedIn: http://www.linkedin.com/in/brouer