Re: [PATCH 1/5] io_uring/zcrx: notify user when out of buffers

Re: [PATCH 1/5] io_uring/zcrx: notify user when out of buffers

[Pavel Begunkov]

On 4/22/26 12:25, Clément Léger wrote:
> From: Pavel Begunkov <asml.silence@gmail.com>
...
> +static void zcrx_notif_tw(struct io_tw_req tw_req, io_tw_token_t tw)
> +{
> +	struct io_kiocb *req = tw_req.req;
> +	struct io_ring_ctx *ctx = req->ctx;
> +
> +	io_post_aux_cqe(ctx, req->cqe.user_data, req->cqe.res, 0);
> +	percpu_ref_put(&ctx->refs);
> +	kfree_rcu(req, rcu_head);
> +}

Note to myself:

io_poison_req(req);
kmem_cache_free(req_cachep, req);

-- 
Pavel Begunkov

Re: [PATCH 1/5] io_uring/zcrx: notify user when out of buffers

[Pavel Begunkov]

On 4/22/26 12:25, Clément Léger wrote:
> From: Pavel Begunkov <asml.silence@gmail.com>
...>   static inline struct page *io_zcrx_iov_page(const struct net_iov *niov)
>   {
>   	struct io_zcrx_area *area = io_zcrx_iov_to_area(niov);
> @@ -531,6 +541,7 @@ static struct io_zcrx_ifq *io_zcrx_ifq_alloc(struct io_ring_ctx *ctx)
>   
>   	ifq->if_rxq = -1;
>   	spin_lock_init(&ifq->rq.lock);
> +	spin_lock_init(&ifq->ctx_lock);
>   	mutex_init(&ifq->pp_lock);
>   	refcount_set(&ifq->refs, 1);
>   	refcount_set(&ifq->user_refs, 1);
> @@ -585,6 +596,11 @@ static void io_zcrx_ifq_free(struct io_zcrx_ifq *ifq)
>   	if (ifq->dev)
>   		put_device(ifq->dev);
>   
> +	scoped_guard(spinlock_bh, &ifq->ctx_lock) {
> +		if (ifq->master_ctx)
> +			percpu_ref_put(&ifq->master_ctx->refs);
> +	}
> +

Something very odd happened here. It's not my patch but rather an edited
squash of two other patches. This particular hunk creates a circular
dependency, i.e. io_uring waits for this reference to be put down before
destroying the zcrx instance that triggers io_zcrx_ifq_free.

-- 
Pavel Begunkov

Re: [PATCH 2/5] io_uring/zcrx: notify user on frag copy fallback

[Pavel Begunkov]

On 4/22/26 12:25, Clément Léger wrote:
> Add a ZCRX_NOTIF_COPY notification type to signal userspace when a
> received fragment could not be delivered using zero-copy and was
> instead copied into a buffer.
> 
> Signed-off-by: Clément Léger <cleger@meta.com>
> ---
>   include/uapi/linux/io_uring/zcrx.h | 1 +
>   io_uring/zcrx.c                    | 7 ++++++-
>   io_uring/zcrx.h                    | 3 ++-
>   3 files changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/include/uapi/linux/io_uring/zcrx.h b/include/uapi/linux/io_uring/zcrx.h
> index b8596d7d47b6..e0c0079626c8 100644
> --- a/include/uapi/linux/io_uring/zcrx.h
> +++ b/include/uapi/linux/io_uring/zcrx.h
> @@ -70,6 +70,7 @@ enum zcrx_features {
>   
>   enum zcrx_notification_type {
>   	ZCRX_NOTIF_NO_BUFFERS = 1 << 0,
> +	ZCRX_NOTIF_COPY = 1 << 1
>   };
>   
>   struct zcrx_notification_desc {
> diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
> index 35ca28cb6583..732e585aa13a 100644
> --- a/io_uring/zcrx.c
> +++ b/io_uring/zcrx.c
> @@ -1510,8 +1510,13 @@ static int io_zcrx_copy_frag(struct io_kiocb *req, struct io_zcrx_ifq *ifq,
>   			     const skb_frag_t *frag, int off, int len)
>   {
>   	struct page *page = skb_frag_page(frag);
> +	int ret;
> +
> +	ret = io_zcrx_copy_chunk(req, ifq, page, off + skb_frag_off(frag), len);
> +	if (ret > 0)
> +		zcrx_send_notif(ifq, ZCRX_NOTIF_COPY);

We also copy the linear part if present, depends on the semantics
would make sense adding it there as well.

Pavel Begunkov