From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=74.125.82.197 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794117623; b=KFmDy96wnRNWiUW36UPaMu0hpBIy00ExvDzGyntmM3JFNlwVRaicEkavSrBLv9UXAVQa puLtcj8fmBzj3YtbqKH7j18h89GO2dLDVpi0BmjH57W+hNZaEMMsEjovWxXXoDhk1uKD+ RuHS8HdPaoXFw7WU64+YV5Oo++JCAbbcNc2Lx2q1M2ispGk7mI34XWMjw6LkdCEoIRM19 j3t0q5DVDFcJQoA7weC/pi0BnIw4Dskz4KshU2FoIta6+7NntGd0RB0z+mPKGYSOmeR6S gBYB3EmPko2daWNfvONgrlOfiim8XnhMF9tvUACeWnawn/ANlS0rs6JhuxEEqwCYVdg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794117623; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Received:Date:In-Reply-To: Mime-Version:References:X-Mailer:Message-ID:Subject:From:To:Cc: Content-Type; bh=gFMZKE8rB1qHEs9YGj4+e/8ZQgkxp9yc4uMWlT943Dk=; b=I9A32GnqvW0z/TSohAkBrsFXmvsLRaqFyO7D8mQZVZ9k37fTEaqJhRuELF57pQ6/YS9T mDx/21r3pLtOymiyAbq+FnWXWVnyVZ6h9ZI/m2deSyN6mIN1HDhALTooffqMTXjJPmOIz 1udh4g5dphf97Pyfk1z1Oz99Lowqk42GCNOFezXjCnFmBXZudVUzBSERNIsNxp+Z3Guql aTz42dv7R7IKjskwJoCrrmGPIu+oBDjwVOyQ4eevHIEHQvWsT8dN+hjSHLPXY2eJcMvxy pVcA5vBEW+D9m9uIFh8egzfA+s/vtx/knzfCyKRm31XzJc5nD8OoP/qbXMOTz1Otk0A== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=google.com; spf=pass smtp.mailfrom=flex--almasrymina.bounces.google.com; dkim=pass header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20260707 header.b=oM1ut0Jl; arc=none smtp.remote-ip=74.125.82.197 Received: from mail-dy1-f197.google.com (mail-dy1-f197.google.com [74.125.82.197]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 975FB606EE90 for ; Sun, 8 Nov 2026 06:00:23 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 975FB606EE90 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--almasrymina.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20260707 header.b=oM1ut0Jl Received: by mail-dy1-f197.google.com with SMTP id 5a478bee46e88-30c0d568830so591895eec.1 for ; Sat, 07 Nov 2026 22:00:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20260707; t=1794117623; x=1794722423; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=gFMZKE8rB1qHEs9YGj4+e/8ZQgkxp9yc4uMWlT943Dk=; b=oM1ut0JlHy5QzoA3UcW9p1p1fGsiJbScpQkXNdjQOafFHv+idXGAGLXjf3FqNn+1B0 8hGy/QM5LQJIhtsz9yZWoQvj8heLc++gOZiLRJ/VGNDbRYx4eqxgyQhXllmam6PjeuPk 6LY4BJ12ZI0wgZ1zRvvuxla2MINsu4MQy6eLgtvMlx3TTJWwV9iplAfOitVcdvr2cFbM jqz8XNFBduB3sfTJ74NJt+wA4iblcr5NCEJaWQG6LGcBlo2tv3V+WMmKtulXqrUydCYh 6/ZrIpybAd8rwbmTkGNueHFhIZYlk+CHQQw4FnrwV9BCi0r6gHHmjHVC7FiGRC4SP4S8 DrlA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794117623; x=1794722423; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=gFMZKE8rB1qHEs9YGj4+e/8ZQgkxp9yc4uMWlT943Dk=; b=IOAg54UDosBhRaaHTQLOBlEpPPPl3Cl+NJCeR21VfgNmawH6R61x+VP7T/agEUscYV y8H2s5gfEXpBo38pt1rTZueiatbWCppmJs5PCnonf7prn+cHokoxU+7rKqWIdW9qkzhK MBe9blmXpON9yryM3Ty+GocRpVVJwJoiXyeIW9oYrjYZPjlKRxCPjrqm3O/xbxhwr9fk j3Uz9eT6h6O8nOx5HCDMJwqZD9wH+Ug74awBpihyVkxMgrFzmeSMWIJQFR2Q0H3yib8X nmW/Yq2pErsFQJCaYmWUj1s8nDGNokbzinCPTS8AxHpiee81iz7Ox4J+E9qSa5ODT48e SHcA== X-Forwarded-Encrypted: i=1; AKwUvBwxHidAbb3lTi/eSSNvhLSgxLv2CkqZRDPkZl0yDt/7O/IHxrVMygDRST1mXzs/OJMTcEF2mceZqVS7SUI=@vger.kernel.org X-Gm-Message-State: APuU4Z8Qlu8Qtp6MvLvoj36sxsraIEDZOFel2+cNV9cDSGjm2k78oO/g qw7SSmernYZ9+5cypXmUcNdkqi9aW1dXIXv+9Zl+Rbpv++LxjuKsZf1BLLjT+dO/tirn5yROdhb MBypEP6fPcs/4AQN8tMnz8oIgzw== X-Received: from dlev11.prod.google.com ([2002:a05:701b:464b:b0:189:931c:18ef]) (user=almasrymina job=prod-delivery.src-stubby-dispatcher) by 2002:a05:7022:e02:b0:191:3c:aae7 with SMTP id a92af1059eb24-1b39feec174mr1478394c88.26.1794117620448; Sat, 07 Nov 2026 22:00:20 -0800 (PST) Date: Sun, 8 Nov 2026 06:00:13 +0000 In-Reply-To: <20261108060016.2131509-1-almasrymina@google.com> X-Mailing-List: linux-hyperv@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Mime-Version: 1.0 References: <20261108060016.2131509-1-almasrymina@google.com> X-Mailer: git-send-email 2.56.0.455.g6c5a503b38-goog Message-ID: <20261108060016.2131509-3-almasrymina@google.com> Subject: [PATCH net-next v2 2/5] net: skbuff: refcount spliced page_pool frags via skb_pipe_buf_ops From: Mina Almasry To: netdev@vger.kernel.org Cc: Mina Almasry , Jesper Dangaard Brouer , Ilias Apalodimas , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Neal Cardwell , Kuniyuki Iwashima , Pavel Begunkov , Bobby Eshleman , Stanislav Fomichev , linux-kernel@vger.kernel.org, Steffen Klassert , Herbert Xu , Willem de Bruijn , John Fastabend , Sabrina Dubroca , Andrew Lunn , "Michael S. Tsirkin" , Jason Wang , "=?UTF-8?q?Eugenio=20P=C3=A9rez?=" , Xuan Zhuo , Andrew Morton , David Hildenbrand , Lorenzo Stoakes , "Liam R. Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Alexei Starovoitov , Daniel Borkmann , Johannes Berg , Byungchul Park , Zi Yan , virtualization@lists.linux.dev, linux-mm@kvack.org, bpf@vger.kernel.org, linux-wireless@vger.kernel.org, Jonathan Corbet , Shuah Khan , Randy Dunlap , Lorenzo Bianconi , Wen Gu , Philo Lu , Justin Chen , Florian Fainelli , Vikas Gupta , Michael Chan , Pavan Chebbi , Doug Berger , Nicolai Buchwitz , Broadcom internal kernel review list , Satish Kharat , Wei Fang , Frank Li , Shenwei Wang , Joshua Washington , Harshitha Ramamurthy , Jijie Shao , Jian Shen , Fan Gong , Tony Nguyen , Przemek Kitszel , Marcin Wojtas , Russell King , Sunil Goutham , Geetha sowjanya , Ratheesh Kannoth , Subbaraya Sundeep , Bharat Bhushan , Felix Fietkau , Matthias Brugger , AngeloGioacchino Del Regno , Tariq Toukan , Saeed Mahameed , Mark Bloch , Leon Romanovsky , Ido Schimmel , Petr Machata , Horatiu Vultur , UNGLinuxDriver@microchip.com, Daniel Machon , Steen Hegelund , Haiyang Zhang , Wei Liu , Dexuan Cui , Yibo Dong , Brett Creeley , Justin Lai , Larry Chiu , "=?UTF-8?q?Niklas=20S=C3=B6derlund?=" , Paul Barker , Masahisa Kojima , Maxime Chevallier , Maxime Coquelin , Alexandre Torgue , FUJITA Tomonori , Siddharth Vadapalli , Roger Quadros , MD Danish Anwar , Jiawen Wu , Mengyuan Lou , Ronak Doshi , Ryder Lee , Shayne Chen , Sean Wang , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , Jordan Rhee , Ankit Garg , Tim Hostetler , Eric Joyner , Prabu Thayalan , "Nikhil P. Rao" , Chintan Vankar , Nora Schiffer , Alexander Sverdlin , Kevin Hao , Karl Mehltretter , Aleksandr Loktionov , Meghana Malladi , Jacob Keller , StanleyYP Wang , linux-doc@vger.kernel.org, imx@lists.linux.dev, linux-rdma@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-omap@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Update skb_splice_bits() (spd_fill_page(), sock_spd_release(), and skb_pipe_buf_ops) and skb_append_pagefrags() to acquire and release references via netmem_inc_ref(), netmem_dec_ref(), and skb_frag_ref() so page_pool RX fragments spliced into a pipe remain pinned in the pool while in the pipe and pair with skb_append_pagefrags() and skb_release_data() when spliced into a TX socket once netmem_inc_ref() and netmem_dec_ref() handle page_pool netmems. In tls_push_data(), fall back to copying when MSG_SPLICE_PAGES encounters a page_pool page because kTLS device offload record->frags[] tracks pages via raw struct page references rather than pp_ref_count before handing them to tls_push_sg(). Caveats: - Because pipe buffers created by skb_splice_bits() hold pp_ref_count until released (including across tee()), user pipes holding unconsumed spliced data keep those page_pool pages in-flight and DMA-mapped in the pool (bounded by pipe capacity and RLIMIT_NOFILE rather than sk_rcvbuf) until the pipe buffers are consumed or closed, with page_pool_destroy() deferring pool release via its periodic workqueue and page_pool_scrub() unmapping DMA. Signed-off-by: Mina Almasry --- net/core/skbuff.c | 31 +++++++++++++++++++++++++++---- net/tls/tls_device.c | 6 ++++++ 2 files changed, 33 insertions(+), 4 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 48f6764117243..19d4ce347c41b 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3114,9 +3114,32 @@ EXPORT_SYMBOL(skb_copy_bits); */ static void sock_spd_release(struct splice_pipe_desc *spd, unsigned int i) { - put_page(spd->pages[i]); + netmem_dec_ref(page_to_netmem(spd->pages[i])); } +static void skb_pipe_buf_release(struct pipe_inode_info *pipe, + struct pipe_buffer *buf) +{ + netmem_dec_ref(page_to_netmem(buf->page)); +} + +static bool skb_pipe_buf_get(struct pipe_inode_info *pipe, + struct pipe_buffer *buf) +{ + struct page *page = compound_head(buf->page); + + if (WARN_ON_ONCE(page_ref_count(page) <= 0)) + return false; + + netmem_inc_ref(page_to_netmem(page)); + return true; +} + +static const struct pipe_buf_operations skb_pipe_buf_ops = { + .release = skb_pipe_buf_release, + .get = skb_pipe_buf_get, +}; + static struct page *linear_to_page(struct page *page, unsigned int *len, unsigned int *offset, struct sock *sk) @@ -3165,7 +3188,7 @@ static bool spd_fill_page(struct splice_pipe_desc *spd, struct page *page, spd->partial[spd->nr_pages - 1].len += *len; return false; } - get_page(page); + netmem_inc_ref(page_to_netmem(page)); spd->pages[spd->nr_pages] = page; spd->partial[spd->nr_pages].len = *len; spd->partial[spd->nr_pages].offset = offset; @@ -3281,7 +3304,7 @@ int skb_splice_bits(struct sk_buff *skb, struct sock *sk, unsigned int offset, .pages = pages, .partial = partial, .nr_pages_max = MAX_SKB_FRAGS, - .ops = &nosteal_pipe_buf_ops, + .ops = &skb_pipe_buf_ops, .spd_release = sock_spd_release, }; int ret = 0; @@ -4692,8 +4715,8 @@ int skb_append_pagefrags(struct sk_buff *skb, struct page *page, skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], size); } else if (i < max_frags) { skb_zcopy_downgrade_managed(skb); - get_page(page); skb_fill_page_desc_noacc(skb, i, page, offset, size); + skb_frag_ref(skb, i); } else { return -EMSGSIZE; } diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c index 4cdfbb57ecff0..05abf8e23f78a 100644 --- a/net/tls/tls_device.c +++ b/net/tls/tls_device.c @@ -513,10 +513,16 @@ static int tls_push_data(struct sock *sk, goto handle_error; } + if (page_pool_page_is_pp(compound_head(*pages))) { + iov_iter_revert(iter, copy); + goto copy_data; + } + zc_pfrag.offset = off; zc_pfrag.size = copy; tls_append_frag(record, &zc_pfrag, copy); } else if (copy) { +copy_data: copy = min_t(size_t, copy, pfrag->size - pfrag->offset); rc = tls_device_copy_data(page_address(pfrag->page) + -- 2.56.0.455.g6c5a503b38-goog