perf(send): AF_XDP TX path — Phase 2 PR 2 of AF_XDP plan

[skullcrushercmd]

Summary

Phase 2 PR 2 of 4 of the AF_XDP integration plan (AnyVM-Tech/AnyScan PR #65). This PR ships the AF_XDP transmit path so scanner threads can push SYN/UDP/ICMP probes through libxdp's XSK API instead of TPACKET_V2, matching the existing AF_PACKET sender bit-for-bit on packet construction and rate-limiting while bypassing the kernel netdev TX path.

This is a stacked PR. It depends on the dispatch refactor + --io-engine flag from Phase 2 PR 1 (branch perf/portscan-afxdp-phase2-pr1, commit 998c66b). PR 1 must land in main first, or this branch should be rebased onto whatever commit lands the dispatch refactor.

PR 3 (the recv counterpart + io_engine_af_xdp vtable registration) and PR 4 (the Makefile / install / systemd plumbing) follow.

Files

File	Type	Purpose
include/xdp-defs.h	new	UMEM / ring sizing constants, bind-mode enum, opaque xdp_tx_state / xdp_rx_state forward decls. Gated on #ifdef USE_AF_XDP.
include/scanner.h	modify	Declares afxdp_tx_init_per_thread, afxdp_tx_teardown_per_thread, xdp_sender_thread under #ifdef USE_AF_XDP.
include/scanner_defs.h	modify	thread_context_t gains struct xdp_tx_state *xdp_tx + struct xdp_rx_state *xdp_rx pointers under #ifdef USE_AF_XDP. Forward-declared so this header doesn't pull <xdp/xsk.h>.
src/send-afxdp.c	new	Per-thread XSK + UMEM setup, DRV+ZC → DRV-copy → SKB bind ladder, TX descriptor batching, completion-ring drain, kick path.

Diff stat: 4 files changed, 496 insertions(+), 0 deletions.

TX loop shape (plan §3.4)

loop while (running && !stop_signal && current_global_idx < end_idx):
    drain completion ring → recycle frames
    build up to BATCH_SIZE packets directly into UMEM frames pulled from free stack
        (filtered indices skip without consuming a frame — no slot leak)
    xsk_ring_prod__reserve(built_count) with bounded retry ladder if ring full
    fill descs with (addr,len), xsk_ring_prod__submit(built_count)
    sendto(xsk_fd, NULL, 0, MSG_DONTWAIT, ...) iff xsk_ring_prod__needs_wakeup
    atomic_fetch_add stats; rate_limit_batch  (unchanged from AF_PACKET path)

The key difference vs. sender.c: AF_PACKET's TPACKET_V2 ring auto-recycles frames via tp_status; AF_XDP requires the userspace TX loop to track which UMEM frames the kernel has returned via the completion ring. That bookkeeping (the free-frame stack + afxdp_drain_completion_ring) is the only substantive new code; everything above the I/O socket boundary (BlackRock cipher, blacklist, alive-queue, rate limit, stats) is reused unchanged.

Bind-mode fallback ladder (plan §4.3)

attempt 1: XDP_FLAGS_DRV_MODE | XDP_ZEROCOPY      → drv+zerocopy   (fastest, ENA on c6in.metal)
attempt 2: XDP_FLAGS_DRV_MODE | XDP_COPY          → drv+copy       (driver attach, copies via skb)
attempt 3: XDP_FLAGS_SKB_MODE | XDP_COPY          → skb            (generic, bypasses qdisc only)

INHIBIT_PROG_LOAD is set on every attempt because we are TX-only (rx == NULL); libxdp does not need to load the default xsks_map redirect program. XDP_USE_NEED_WAKEUP is always set so we can gate sendto kicks behind xsk_ring_prod__needs_wakeup.

What is deliberately NOT in this PR

• The io_engine_af_xdp vtable struct in src/engine.c. Phase 2 PR 3 defines it once the matching xdp_receiver_thread lands.
• The Makefile USE_AF_XDP=1 conditional. Phase 2 PR 4. Without that block this whole translation unit is #ifdef'd out, so the default (AF_PACKET) build is unchanged.

Build dependency note: as a stack of additive PRs, make USE_AF_XDP=1 builds will fail to link until PR 3 lands the io_engine_af_xdp vtable (engine.c references it as extern under USE_AF_XDP). Default (AF_PACKET) builds — the only configuration shipped to ops today — are unchanged. The dispatch path also continues to print "USE_AF_XDP=1 not set" for --io-engine=af_xdp until both the vtable and the Makefile flag ship.

Test plan

Verified locally:

• make (default, AF_PACKET-only) — clean. Pre-existing strncpy warning in receiver.c is unchanged.
• make test — 11/11 io_engine_dispatch.sh smoke tests pass.
• gcc -Wall -O3 -Iinclude -DUSE_AF_XDP -c on every translation unit (main, conf, engine, net, utils, sender, receiver, parsing, crypto-blackrock*, send-afxdp) — clean. Confirms USE_AF_XDP compiles cleanly across the codebase even though it cannot link yet (see "Build dependency note" above).
• All four added/modified files: wc -l totals 496 — within range of the plan estimate (~280 LOC for send-afxdp.c proper plus comments / header).

Not verified here — needs c6in.metal live bench (plan §5.3):

• Actual XSK bind on an ENA NIC and the DRV+ZC vs DRV+COPY vs SKB ladder behaviour against the production AMI.
• amzn-drivers#221 ZC driver-reset interaction.
• ENA "lower-half-channels" zero-copy constraint. Current code attempts the bind with queue_id = thread_id and falls back on failure, but does not proactively cap thread count via ethtool -l. PR 3 / PR 4 add the channel-count probe.
• Veth loopback bench from plan §5.1. That requires a netns harness and an RX counterpart; lands with PR 3.

Refs

• Plan: AnyVM-Tech/AnyScan PR #65 — plans/2026-04-27-portscan-afxdp-plan-v1.md §3.4 (TX loop), §3.5 (ENA specifics), §4.3 (bind ladder).
• Phase 2 PR 1 (dispatch refactor + scanner fork): AnyScan PR #67, this fork's perf/portscan-afxdp-phase2-pr1 branch.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5844d61a26

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Retry unsent targets after TX ring reservation failure

ctx->work.current_global_idx is advanced before the batch is guaranteed a slot in the AF_XDP TX ring. If xsk_ring_prod__reserve later fails under ring backpressure, the failure path only returns UMEM frames and continues, so those already-consumed targets are silently dropped instead of retried. This can create deterministic scan coverage gaps (missed IP/port probes) whenever TX stalls.

Useful? React with 👍 / 👎.

[skullcrushercmd]

Good catch — you're right that this was a deterministic coverage gap, not just a perf wart. Fixed in b2b0514.

Two related rollback paths added:

1. Outer rollback on TX-ring reservation failure. Snapshot current_global_idx at the start of every batch (idx_at_batch_start). If xsk_ring_prod__reserve never lands within the 32-attempt retry ladder (each kicking the kernel + draining the completion ring), restore the snapshot and free all built frames so the next outer iteration re-processes the same targets. BlackRock is deterministic in current_global_idx so re-processing rebuilds identical packets; only the per-thread xorshift32 state for IP id / TCP seq mutates, which is fine (those fields are random by design). A brief usleep(10) gives the kernel time to drain so we don't busy-spin the same indices.

2. Inner rollback on frame-allocation failure. Found while auditing the rollback logic — the same shape exists when afxdp_alloc_frame returns < 0 (all 8192 frames in flight). The current iteration had already done current_global_idx++ before alloc was attempted; without the matching decrement that target would be silently dropped on the first sustained burst of in-flight frames. The fix decrements current_global_idx by 1 before breaking out of the inner loop, mirroring AF_PACKET's "tp_status busy → bail without advancing" semantics at the top of sender.c's inner loop.

Net behaviour now: under sustained TX backpressure or a full free-frame pool, the loop re-processes the same targets next iteration instead of dropping them. The retry budget + usleep keeps the loop from livelocking; the rollback keeps scan coverage deterministic regardless of TX pace.

Verified:

• make (default, AF_PACKET) clean.
• make test — 11/11 dispatch smoke tests pass.
• gcc -Wall -O3 -DUSE_AF_XDP -c src/send-afxdp.c clean.