* [PATCH review-only 11/17] io_uring/zcrx: split append out of area creation
From: Pavel Begunkov @ 2026-07-11 10:40 UTC (permalink / raw)
To: io-uring; +Cc: asml.silence, netdev
In-Reply-To: <cover.1783616211.git.asml.silence@gmail.com>
A preparation patch, move appending an area from __zcrx_create_area()
to the caller.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
io_uring/zcrx.c | 21 ++++++++++++++++-----
1 file changed, 16 insertions(+), 5 deletions(-)
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 4936d92f6339..40cabf4384d1 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -471,6 +471,7 @@ static int io_zcrx_append_area(struct io_zcrx_ifq *ifq,
static int __zcrx_create_area(struct io_zcrx_ifq *ifq,
struct io_uring_zcrx_area_reg *area_reg,
+ struct io_zcrx_area **res_area,
u32 rx_buf_len)
{
int buf_size_shift = PAGE_SHIFT;
@@ -544,10 +545,8 @@ static int __zcrx_create_area(struct io_zcrx_ifq *ifq,
area->area_id = 0;
area_reg->rq_area_token = zcrx_area_id_to_token(area->area_id);
spin_lock_init(&area->freelist_lock);
-
- ret = io_zcrx_append_area(ifq, area);
- if (!ret)
- return 0;
+ *res_area = area;
+ return 0;
err:
if (area) {
io_zcrx_unmap_area(ifq, area);
@@ -560,7 +559,19 @@ static int io_zcrx_create_area(struct io_zcrx_ifq *ifq,
struct io_uring_zcrx_area_reg *area_reg,
struct io_uring_zcrx_ifq_reg *reg)
{
- return __zcrx_create_area(ifq, area_reg, reg->rx_buf_len);
+ struct io_zcrx_area *area;
+ int ret;
+
+ ret = __zcrx_create_area(ifq, area_reg, &area, reg->rx_buf_len);
+ if (ret)
+ return ret;
+
+ ret = io_zcrx_append_area(ifq, area);
+ if (ret) {
+ io_zcrx_free_area(ifq, area);
+ return ret;
+ }
+ return 0;
}
static struct io_zcrx_ifq *io_zcrx_ifq_alloc(struct io_ring_ctx *ctx)
--
2.54.0
^ permalink raw reply related
* [PATCH review-only 12/17] io_uring/zcrx: move freelist lock to struct zcrx
From: Pavel Begunkov @ 2026-07-11 10:40 UTC (permalink / raw)
To: io-uring; +Cc: asml.silence, netdev
In-Reply-To: <cover.1783616211.git.asml.silence@gmail.com>
freelist_lock, which protects slow path allocations, is currently stored
in struct io_zcrx_area. Once we add support for multiple queues, we'll
need a lock in the zcrx ctx, move it there.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
io_uring/zcrx.c | 14 +++++++-------
io_uring/zcrx.h | 2 +-
2 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 40cabf4384d1..81520bda230d 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -544,7 +544,6 @@ static int __zcrx_create_area(struct io_zcrx_ifq *ifq,
/* we're only supporting one area per ifq for now */
area->area_id = 0;
area_reg->rq_area_token = zcrx_area_id_to_token(area->area_id);
- spin_lock_init(&area->freelist_lock);
*res_area = area;
return 0;
err:
@@ -585,6 +584,7 @@ static struct io_zcrx_ifq *io_zcrx_ifq_alloc(struct io_ring_ctx *ctx)
ifq->if_rxq = -1;
spin_lock_init(&ifq->ctx_lock);
spin_lock_init(&ifq->rq.lock);
+ spin_lock_init(&ifq->alloc_lock);
mutex_init(&ifq->pp_lock);
refcount_set(&ifq->refs, 1);
refcount_set(&ifq->user_refs, 1);
@@ -659,8 +659,9 @@ static void io_put_zcrx_ifq(struct io_zcrx_ifq *ifq)
static void io_zcrx_return_niov_freelist(struct net_iov *niov)
{
struct io_zcrx_area *area = io_zcrx_iov_to_area(niov);
+ struct io_zcrx_ifq *ifq = area->ifq;
- guard(spinlock_bh)(&area->freelist_lock);
+ guard(spinlock_bh)(&ifq->alloc_lock);
if (WARN_ON_ONCE(area->free_count >= area->nia.num_niovs))
return;
area->freelist[area->free_count++] = net_iov_idx(niov);
@@ -670,7 +671,7 @@ static struct net_iov *zcrx_get_free_niov(struct io_zcrx_area *area)
{
unsigned niov_idx;
- lockdep_assert_held(&area->freelist_lock);
+ lockdep_assert_held(&area->ifq->alloc_lock);
if (unlikely(!area->free_count))
return NULL;
@@ -1262,7 +1263,7 @@ static unsigned io_zcrx_refill_slow(struct page_pool *pp, struct io_zcrx_ifq *if
struct io_zcrx_area *area = ifq->area;
unsigned allocated = 0;
- guard(spinlock_bh)(&area->freelist_lock);
+ guard(spinlock_bh)(&ifq->alloc_lock);
for (allocated = 0; allocated < to_alloc; allocated++) {
struct net_iov *niov = zcrx_get_free_niov(area);
@@ -1567,14 +1568,13 @@ static bool io_zcrx_queue_cqe(struct io_kiocb *req, struct net_iov *niov,
static struct net_iov *io_alloc_fallback_niov(struct io_zcrx_ifq *ifq)
{
- struct io_zcrx_area *area = ifq->area;
struct net_iov *niov = NULL;
if (!ifq->kern_readable)
return NULL;
- scoped_guard(spinlock_bh, &area->freelist_lock)
- niov = zcrx_get_free_niov(area);
+ scoped_guard(spinlock_bh, &ifq->alloc_lock)
+ niov = zcrx_get_free_niov(ifq->area);
if (niov)
page_pool_fragment_netmem(net_iov_to_netmem(niov), 1);
diff --git a/io_uring/zcrx.h b/io_uring/zcrx.h
index 0eb7ea35a9ff..302659669ba4 100644
--- a/io_uring/zcrx.h
+++ b/io_uring/zcrx.h
@@ -36,7 +36,6 @@ struct io_zcrx_area {
u16 area_id;
/* freelist */
- spinlock_t freelist_lock ____cacheline_aligned_in_smp;
u32 free_count;
u32 *freelist;
@@ -65,6 +64,7 @@ struct io_zcrx_ifq {
bool kern_readable;
struct zcrx_rq rq ____cacheline_aligned_in_smp;
+ spinlock_t alloc_lock ____cacheline_aligned_in_smp;
u32 if_rxq;
struct device *dev;
--
2.54.0
^ permalink raw reply related
* [PATCH review-only 13/17] io_uring/zcrx: array of areas
From: Pavel Begunkov @ 2026-07-11 10:40 UTC (permalink / raw)
To: io-uring; +Cc: asml.silence, netdev
In-Reply-To: <cover.1783616211.git.asml.silence@gmail.com>
Currently, we have only a one area per zcrx instance, and struct
io_zcrx_ifq stores a single pointer. To prepare for adding more areas,
replace it with an array of areas.
We'll be creating them at runtime, and the array is protected by 3
locks: ->pp_lock, ->alloc_lock and ->rq.lock. It takes all of them when
switching arrays, and readers should hold either of them.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
io_uring/zcrx.c | 95 ++++++++++++++++++++++++++++++++++++-------------
io_uring/zcrx.h | 5 ++-
2 files changed, 75 insertions(+), 25 deletions(-)
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 81520bda230d..474ffc217b0b 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -332,6 +332,14 @@ static void io_zcrx_unmap_area(struct io_zcrx_ifq *ifq,
}
}
+static void io_zcrx_unmap_areas(struct io_zcrx_ifq *ifq)
+{
+ unsigned area_idx;
+
+ for (area_idx = 0; area_idx < ifq->nr_areas; area_idx++)
+ io_zcrx_unmap_area(ifq, ifq->areas[area_idx]);
+}
+
static void zcrx_sync_for_device(struct page_pool *pp, struct io_zcrx_ifq *zcrx,
netmem_ref *netmems, unsigned nr)
{
@@ -459,13 +467,29 @@ static int io_zcrx_append_area(struct io_zcrx_ifq *ifq,
struct io_zcrx_area *area)
{
bool kern_readable = !area->mem.is_dmabuf;
+ struct io_zcrx_area **areas, **old_areas;
+ unsigned old_nr;
- if (WARN_ON_ONCE(ifq->area))
- return -EINVAL;
if (WARN_ON_ONCE(ifq->kern_readable != kern_readable))
return -EINVAL;
- ifq->area = area;
+ old_areas = ifq->areas;
+ old_nr = ifq->nr_areas;
+
+ areas = kmalloc_array(old_nr + 1, sizeof(areas[0]),
+ GFP_KERNEL_ACCOUNT | __GFP_ZERO);
+ if (!areas)
+ return -ENOMEM;
+ if (old_areas)
+ memcpy(areas, old_areas, old_nr * sizeof(areas[0]));
+ areas[old_nr] = area;
+
+ scoped_guard(spinlock_bh, &ifq->rq.lock) {
+ guard(spinlock_bh)(&ifq->alloc_lock);
+ ifq->areas = areas;
+ ifq->nr_areas = old_nr + 1;
+ }
+ kfree(old_areas);
return 0;
}
@@ -621,7 +645,7 @@ static void io_close_queue(struct io_zcrx_ifq *ifq)
if (ifq->if_rxq != -1)
netif_mp_close_rxq(netdev, ifq->if_rxq, &p);
- io_zcrx_unmap_area(ifq, ifq->area);
+ io_zcrx_unmap_areas(ifq);
netdev_unlock(netdev);
netdev_put(netdev, &netdev_tracker);
}
@@ -630,6 +654,8 @@ static void io_close_queue(struct io_zcrx_ifq *ifq)
static void io_zcrx_ifq_free(struct io_zcrx_ifq *ifq)
{
+ int i;
+
if (WARN_ON_ONCE(ifq->if_rxq != -1))
return;
if (WARN_ON_ONCE(ifq->netdev != NULL))
@@ -637,8 +663,8 @@ static void io_zcrx_ifq_free(struct io_zcrx_ifq *ifq)
if (WARN_ON_ONCE(ifq->master_ctx))
return;
- if (ifq->area)
- io_zcrx_free_area(ifq, ifq->area);
+ for (i = 0; i < ifq->nr_areas; i++)
+ io_zcrx_free_area(ifq, ifq->areas[i]);
if (ifq->mm_account)
mmdrop(ifq->mm_account);
if (ifq->dev)
@@ -647,6 +673,7 @@ static void io_zcrx_ifq_free(struct io_zcrx_ifq *ifq)
io_free_rbuf_ring(ifq);
free_uid(ifq->user);
mutex_destroy(&ifq->pp_lock);
+ kfree(ifq->areas);
kfree(ifq);
}
@@ -692,14 +719,10 @@ static void io_zcrx_return_niov(struct net_iov *niov)
page_pool_put_unrefed_netmem(niov->desc.pp, netmem, -1, false);
}
-static void io_zcrx_scrub(struct io_zcrx_ifq *ifq)
+static void io_zcrx_scrub_area(struct io_zcrx_ifq *ifq, struct io_zcrx_area *area)
{
- struct io_zcrx_area *area = ifq->area;
int i;
- if (!area)
- return;
-
/* Reclaim back all buffers given to the user space. */
for (i = 0; i < area->nia.num_niovs; i++) {
struct net_iov *niov = &area->nia.niovs[i];
@@ -713,6 +736,15 @@ static void io_zcrx_scrub(struct io_zcrx_ifq *ifq)
}
}
+static void io_zcrx_scrub(struct io_zcrx_ifq *ifq)
+{
+ int i;
+
+ guard(mutex)(&ifq->pp_lock);
+ for (i = 0; i < ifq->nr_areas; i++)
+ io_zcrx_scrub_area(ifq, ifq->areas[i]);
+}
+
static void zcrx_unregister_user(struct io_zcrx_ifq *ifq, struct io_ring_ctx *ctx)
{
scoped_guard(spinlock_bh, &ifq->ctx_lock) {
@@ -1185,12 +1217,15 @@ static inline bool io_parse_rqe(struct io_uring_zcrx_rqe *rqe,
unsigned niov_idx, area_idx;
struct io_zcrx_area *area;
+ lockdep_assert_held(&ifq->rq.lock);
+
area_idx = off >> IORING_ZCRX_AREA_SHIFT;
niov_idx = (off & ~IORING_ZCRX_AREA_MASK) >> ifq->niov_shift;
- if (unlikely(rqe->__pad || area_idx))
+ if (unlikely(rqe->__pad || area_idx >= ifq->nr_areas))
return false;
- area = ifq->area;
+ area_idx = array_index_nospec(area_idx, ifq->nr_areas);
+ area = ifq->areas[area_idx];
if (unlikely(niov_idx >= area->nia.num_niovs))
return false;
@@ -1260,18 +1295,24 @@ static unsigned io_zcrx_ring_refill(struct page_pool *pp,
static unsigned io_zcrx_refill_slow(struct page_pool *pp, struct io_zcrx_ifq *ifq,
netmem_ref *netmems, unsigned to_alloc)
{
- struct io_zcrx_area *area = ifq->area;
+ unsigned area_idx = 0;
unsigned allocated = 0;
guard(spinlock_bh)(&ifq->alloc_lock);
- for (allocated = 0; allocated < to_alloc; allocated++) {
- struct net_iov *niov = zcrx_get_free_niov(area);
+ while (allocated < to_alloc) {
+ struct net_iov *niov = zcrx_get_free_niov(ifq->areas[area_idx]);
+
+ if (!niov) {
+ area_idx++;
+ if (area_idx >= ifq->nr_areas)
+ break;
+ continue;
+ }
- if (!niov)
- break;
net_mp_niov_set_page_pool(pp, niov);
netmems[allocated] = net_iov_to_netmem(niov);
+ allocated++;
}
return allocated;
}
@@ -1407,8 +1448,8 @@ static void io_pp_uninstall(void *mp_priv, struct netdev_rx_queue *rxq)
struct pp_memory_provider_params *p = &rxq->mp_params;
struct io_zcrx_ifq *ifq = mp_priv;
+ io_zcrx_unmap_areas(ifq);
io_zcrx_drop_netdev(ifq);
- io_zcrx_unmap_area(ifq, ifq->area);
p->mp_ops = NULL;
p->mp_priv = NULL;
@@ -1569,16 +1610,22 @@ static bool io_zcrx_queue_cqe(struct io_kiocb *req, struct net_iov *niov,
static struct net_iov *io_alloc_fallback_niov(struct io_zcrx_ifq *ifq)
{
struct net_iov *niov = NULL;
+ unsigned area_idx;
if (!ifq->kern_readable)
return NULL;
- scoped_guard(spinlock_bh, &ifq->alloc_lock)
- niov = zcrx_get_free_niov(ifq->area);
+ guard(spinlock_bh)(&ifq->alloc_lock);
+
+ for (area_idx = 0; area_idx < ifq->nr_areas; area_idx++) {
+ niov = zcrx_get_free_niov(ifq->areas[area_idx]);
+ if (niov) {
+ page_pool_fragment_netmem(net_iov_to_netmem(niov), 1);
+ return niov;
+ }
+ }
- if (niov)
- page_pool_fragment_netmem(net_iov_to_netmem(niov), 1);
- return niov;
+ return NULL;
}
struct io_copy_cache {
diff --git a/io_uring/zcrx.h b/io_uring/zcrx.h
index 302659669ba4..05598f08eda0 100644
--- a/io_uring/zcrx.h
+++ b/io_uring/zcrx.h
@@ -57,7 +57,10 @@ struct zcrx_rq {
};
struct io_zcrx_ifq {
- struct io_zcrx_area *area;
+ /* read-protected by any of: ->pp_lock, ->alloc_lock, ->rq.lock */
+ struct io_zcrx_area **areas;
+ unsigned nr_areas;
+
unsigned niov_shift;
struct user_struct *user;
struct mm_struct *mm_account;
--
2.54.0
^ permalink raw reply related
* [PATCH review-only 14/17] io_uring/zcrx: pass area_id to __zcrx_create_area()
From: Pavel Begunkov @ 2026-07-11 10:40 UTC (permalink / raw)
To: io-uring; +Cc: asml.silence, netdev
In-Reply-To: <cover.1783616211.git.asml.silence@gmail.com>
Instead of generating an area id inside of __zcrx_create_area(), let the
caller to pass it. It needs the id to derive the user token, and we
might need to know it before creating and publishing the area.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
io_uring/zcrx.c | 21 +++++++++++++++------
1 file changed, 15 insertions(+), 6 deletions(-)
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 474ffc217b0b..3f61f942c393 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -44,6 +44,11 @@ static inline u64 zcrx_area_id_to_token(u32 area_id)
return (u64)area_id << IORING_ZCRX_AREA_SHIFT;
}
+static inline u32 zcrx_next_area_id(struct io_zcrx_ifq *zcrx)
+{
+ return zcrx->nr_areas;
+}
+
static inline struct io_zcrx_ifq *io_pp_to_ifq(struct page_pool *pp)
{
return pp->mp_priv;
@@ -472,6 +477,8 @@ static int io_zcrx_append_area(struct io_zcrx_ifq *ifq,
if (WARN_ON_ONCE(ifq->kern_readable != kern_readable))
return -EINVAL;
+ if (WARN_ON_ONCE(area->area_id != zcrx_next_area_id(ifq)))
+ return -EINVAL;
old_areas = ifq->areas;
old_nr = ifq->nr_areas;
@@ -494,9 +501,10 @@ static int io_zcrx_append_area(struct io_zcrx_ifq *ifq,
}
static int __zcrx_create_area(struct io_zcrx_ifq *ifq,
- struct io_uring_zcrx_area_reg *area_reg,
+ const struct io_uring_zcrx_area_reg *area_reg,
struct io_zcrx_area **res_area,
- u32 rx_buf_len)
+ u32 rx_buf_len,
+ u32 area_id)
{
int buf_size_shift = PAGE_SHIFT;
struct io_zcrx_area *area;
@@ -565,9 +573,7 @@ static int __zcrx_create_area(struct io_zcrx_ifq *ifq,
}
area->free_count = nr_iovs;
- /* we're only supporting one area per ifq for now */
- area->area_id = 0;
- area_reg->rq_area_token = zcrx_area_id_to_token(area->area_id);
+ area->area_id = area_id;
*res_area = area;
return 0;
err:
@@ -583,9 +589,12 @@ static int io_zcrx_create_area(struct io_zcrx_ifq *ifq,
struct io_uring_zcrx_ifq_reg *reg)
{
struct io_zcrx_area *area;
+ u32 id = zcrx_next_area_id(ifq);
int ret;
- ret = __zcrx_create_area(ifq, area_reg, &area, reg->rx_buf_len);
+ area_reg->rq_area_token = zcrx_area_id_to_token(id);
+
+ ret = __zcrx_create_area(ifq, area_reg, &area, reg->rx_buf_len, id);
if (ret)
return ret;
--
2.54.0
^ permalink raw reply related
* [PATCH review-only 15/17] io_uring/zcrx: add dynamic area creation
From: Pavel Begunkov @ 2026-07-11 10:40 UTC (permalink / raw)
To: io-uring; +Cc: asml.silence, netdev
In-Reply-To: <cover.1783616211.git.asml.silence@gmail.com>
It's not always possible for the user to predict during registration how
much memory zcrx will need to sustain the traffic. Allow to dynamically
add more areas with a new ctrl code ZCRX_CTRL_ADD_AREA.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
include/uapi/linux/io_uring/zcrx.h | 7 +++
io_uring/zcrx.c | 84 +++++++++++++++++++++++++-----
2 files changed, 79 insertions(+), 12 deletions(-)
diff --git a/include/uapi/linux/io_uring/zcrx.h b/include/uapi/linux/io_uring/zcrx.h
index 15c05c45ce36..08cdb173b04b 100644
--- a/include/uapi/linux/io_uring/zcrx.h
+++ b/include/uapi/linux/io_uring/zcrx.h
@@ -116,6 +116,7 @@ enum zcrx_ctrl_op {
ZCRX_CTRL_FLUSH_RQ,
ZCRX_CTRL_EXPORT,
ZCRX_CTRL_ARM_NOTIFICATION,
+ ZCRX_CTRL_ADD_AREA,
__ZCRX_CTRL_LAST,
};
@@ -134,6 +135,11 @@ struct zcrx_ctrl_arm_notif {
__u32 __resv[11];
};
+struct zcrx_ctrl_add_area {
+ __u64 area_ptr; /* pointer to struct io_uring_zcrx_area_reg */
+ __u64 __resv[5];
+};
+
struct zcrx_ctrl {
__u32 zcrx_id;
__u32 op; /* see enum zcrx_ctrl_op */
@@ -143,6 +149,7 @@ struct zcrx_ctrl {
struct zcrx_ctrl_export zc_export;
struct zcrx_ctrl_flush_rq zc_flush;
struct zcrx_ctrl_arm_notif zc_arm_notif;
+ struct zcrx_ctrl_add_area zc_area;
};
};
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 3f61f942c393..f7592a3c058d 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -36,6 +36,7 @@
#define ZCRX_REFILL_CAP MIN(64 * ZCRX_MAX_FRAGS_PER_PAGE, 1024)
#define IO_ZCRX_AREA_SUPPORTED_FLAGS (IORING_ZCRX_AREA_DMABUF)
+#define ZCRX_MAX_AREAS 1024
#define IO_DMA_ATTR (DMA_ATTR_SKIP_CPU_SYNC | DMA_ATTR_WEAK_ORDERING)
@@ -46,7 +47,7 @@ static inline u64 zcrx_area_id_to_token(u32 area_id)
static inline u32 zcrx_next_area_id(struct io_zcrx_ifq *zcrx)
{
- return zcrx->nr_areas;
+ return READ_ONCE(zcrx->nr_areas);
}
static inline struct io_zcrx_ifq *io_pp_to_ifq(struct page_pool *pp)
@@ -295,8 +296,6 @@ static int io_import_area(struct io_zcrx_ifq *ifq,
if (area_reg->flags & ~IO_ZCRX_AREA_SUPPORTED_FLAGS)
return -EINVAL;
- if (area_reg->rq_area_token)
- return -EINVAL;
if (area_reg->__resv2[0] || area_reg->__resv2[1])
return -EINVAL;
@@ -311,15 +310,11 @@ static int io_import_area(struct io_zcrx_ifq *ifq,
return io_import_umem(ifq, mem, area_reg);
}
-static void io_zcrx_unmap_area(struct io_zcrx_ifq *ifq,
- struct io_zcrx_area *area)
+static void __io_zcrx_unmap_area(struct io_zcrx_ifq *ifq,
+ struct io_zcrx_area *area)
{
int i;
- if (!area)
- return;
-
- guard(mutex)(&ifq->pp_lock);
if (!area->is_mapped)
return;
area->is_mapped = false;
@@ -337,6 +332,15 @@ static void io_zcrx_unmap_area(struct io_zcrx_ifq *ifq,
}
}
+static void io_zcrx_unmap_area(struct io_zcrx_ifq *ifq,
+ struct io_zcrx_area *area)
+{
+ if (!area)
+ return;
+ guard(mutex)(&ifq->pp_lock);
+ __io_zcrx_unmap_area(ifq, area);
+}
+
static void io_zcrx_unmap_areas(struct io_zcrx_ifq *ifq)
{
unsigned area_idx;
@@ -475,7 +479,9 @@ static int io_zcrx_append_area(struct io_zcrx_ifq *ifq,
struct io_zcrx_area **areas, **old_areas;
unsigned old_nr;
- if (WARN_ON_ONCE(ifq->kern_readable != kern_readable))
+ if (ifq->kern_readable != kern_readable)
+ return -EINVAL;
+ if (ifq->nr_areas + 1 > ZCRX_MAX_AREAS)
return -EINVAL;
if (WARN_ON_ONCE(area->area_id != zcrx_next_area_id(ifq)))
return -EINVAL;
@@ -516,7 +522,7 @@ static int __zcrx_create_area(struct io_zcrx_ifq *ifq,
return -EINVAL;
buf_size_shift = ilog2(rx_buf_len);
}
- if (WARN_ON_ONCE(ifq->niov_shift))
+ if (ifq->niov_shift && ifq->niov_shift != buf_size_shift)
return -EINVAL;
if (!ifq->dev && buf_size_shift != PAGE_SHIFT)
return -EOPNOTSUPP;
@@ -578,7 +584,7 @@ static int __zcrx_create_area(struct io_zcrx_ifq *ifq,
return 0;
err:
if (area) {
- io_zcrx_unmap_area(ifq, area);
+ __io_zcrx_unmap_area(ifq, area);
io_zcrx_free_area(ifq, area);
}
return ret;
@@ -1012,6 +1018,8 @@ int io_register_zcrx(struct io_ring_ctx *ctx,
if (copy_from_user(&area, u64_to_user_ptr(reg.area_ptr), sizeof(area)))
return -EFAULT;
+ if (area.rq_area_token)
+ return -EINVAL;
memset(¬if, 0, sizeof(notif));
if (reg.notif_desc && copy_from_user(¬if, u64_to_user_ptr(reg.notif_desc),
@@ -1074,6 +1082,8 @@ int io_register_zcrx(struct io_ring_ctx *ctx,
goto err;
}
+ WARN_ON_ONCE(!ifq->niov_shift);
+
reg.zcrx_id = id;
scoped_guard(mutex, &ctx->mmap_lock) {
@@ -1559,6 +1569,54 @@ static int zcrx_arm_notif(struct io_ring_ctx *ctx, struct io_zcrx_ifq *zcrx,
return 0;
}
+static int zcrx_ctrl_add_area(struct io_ring_ctx *ctx, struct io_zcrx_ifq *ifq,
+ struct zcrx_ctrl *ctrl)
+{
+ struct zcrx_ctrl_add_area *ctrl_add = &ctrl->zc_area;
+ struct io_uring_zcrx_area_reg __user *area_uptr;
+ struct io_uring_zcrx_area_reg area_reg;
+ struct io_zcrx_area *area = NULL;
+ int ret;
+
+ area_uptr = u64_to_user_ptr(ctrl_add->area_ptr);
+ if (copy_from_user(&area_reg, area_uptr, sizeof(area_reg)))
+ return -EFAULT;
+ if (!mem_is_zero(&ctrl_add->__resv, sizeof(ctrl_add->__resv)))
+ return -EINVAL;
+ if (area_reg.rq_area_token)
+ return -EINVAL;
+
+ while (true) {
+ u32 area_id = zcrx_next_area_id(ifq);
+
+ /*
+ * It's hard to roll back append and page faults under
+ * ->pp_lock is a bad idea. Grab and post an unstable area id
+ * first, and then check-retry under the lock.
+ */
+ area_reg.rq_area_token = zcrx_area_id_to_token(area_id);
+ if (copy_to_user(area_uptr, &area_reg, sizeof(area_reg)))
+ return -EFAULT;
+
+ guard(mutex)(&ifq->pp_lock);
+ if (area_id != zcrx_next_area_id(ifq))
+ continue;
+
+ ret = __zcrx_create_area(ifq, &area_reg, &area,
+ 1U << ifq->niov_shift, area_id);
+ if (ret)
+ break;
+
+ ret = io_zcrx_append_area(ifq, area);
+ if (ret)
+ __io_zcrx_unmap_area(ifq, area);
+ break;
+ }
+ if (ret && area)
+ io_zcrx_free_area(ifq, area);
+ return ret;
+}
+
int io_zcrx_ctrl(struct io_ring_ctx *ctx, void __user *arg, unsigned nr_args)
{
struct zcrx_ctrl ctrl;
@@ -1585,6 +1643,8 @@ int io_zcrx_ctrl(struct io_ring_ctx *ctx, void __user *arg, unsigned nr_args)
return zcrx_export(ctx, zcrx, &ctrl, arg);
case ZCRX_CTRL_ARM_NOTIFICATION:
return zcrx_arm_notif(ctx, zcrx, &ctrl);
+ case ZCRX_CTRL_ADD_AREA:
+ return zcrx_ctrl_add_area(ctx, zcrx, &ctrl);
}
return -EOPNOTSUPP;
--
2.54.0
^ permalink raw reply related
* [PATCH review-only 16/17] io_urint/zcrx: narrow var scope in io_zcrx_recv_skb()
From: Pavel Begunkov @ 2026-07-11 10:40 UTC (permalink / raw)
To: io-uring; +Cc: asml.silence, netdev
In-Reply-To: <cover.1783616211.git.asml.silence@gmail.com>
A preparation patch that limits scopes of a couple variables in
io_zcrx_recv_skb() and rename them, it makes it easier to reason about
the code.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
io_uring/zcrx.c | 35 ++++++++++++++++-------------------
1 file changed, 16 insertions(+), 19 deletions(-)
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index f7592a3c058d..74046a09911a 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -1836,8 +1836,7 @@ io_zcrx_recv_skb(read_descriptor_t *desc, struct sk_buff *skb,
struct io_kiocb *req = args->req;
struct sk_buff *frag_iter;
unsigned start, start_off = offset;
- int i, copy, end, off;
- int ret = 0;
+ int i, ret = 0;
len = min_t(size_t, len, desc->count);
/*
@@ -1875,20 +1874,19 @@ io_zcrx_recv_skb(read_descriptor_t *desc, struct sk_buff *skb,
for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
const skb_frag_t *frag;
+ unsigned frag_end;
if (WARN_ON(start > offset + len))
return -EFAULT;
frag = &skb_shinfo(skb)->frags[i];
- end = start + skb_frag_size(frag);
+ frag_end = start + skb_frag_size(frag);
- if (offset < end) {
- copy = end - offset;
- if (copy > len)
- copy = len;
+ if (offset < frag_end) {
+ unsigned copy = min(frag_end - offset, len);
+ unsigned frag_off = offset - start;
- off = offset - start;
- ret = io_zcrx_recv_frag(req, ifq, frag, off, copy);
+ ret = io_zcrx_recv_frag(req, ifq, frag, frag_off, copy);
if (ret < 0)
goto out;
@@ -1897,24 +1895,23 @@ io_zcrx_recv_skb(read_descriptor_t *desc, struct sk_buff *skb,
if (len == 0 || ret != copy)
goto out;
}
- start = end;
+ start = frag_end;
}
skb_walk_frags(skb, frag_iter) {
+ unsigned frag_end;
+
if (WARN_ON(start > offset + len))
return -EFAULT;
- end = start + frag_iter->len;
- if (offset < end) {
+ frag_end = start + frag_iter->len;
+ if (offset < frag_end) {
+ unsigned copy = min(frag_end - offset, len);
+ unsigned frag_off = offset - start;
size_t count;
- copy = end - offset;
- if (copy > len)
- copy = len;
-
- off = offset - start;
count = desc->count;
- ret = io_zcrx_recv_skb(desc, frag_iter, off, copy);
+ ret = io_zcrx_recv_skb(desc, frag_iter, frag_off, copy);
desc->count = count;
if (ret < 0)
goto out;
@@ -1924,7 +1921,7 @@ io_zcrx_recv_skb(read_descriptor_t *desc, struct sk_buff *skb,
if (len == 0 || ret != copy)
goto out;
}
- start = end;
+ start = frag_end;
}
out:
--
2.54.0
^ permalink raw reply related
* [PATCH review-only 17/17] io_uring/zcrx: don't reload skb_shinfo
From: Pavel Begunkov @ 2026-07-11 10:40 UTC (permalink / raw)
To: io-uring; +Cc: asml.silence, netdev
In-Reply-To: <cover.1783616211.git.asml.silence@gmail.com>
Keep skb_shinfo in a local variable so that it doesn't reload it on
every iteration of the loop.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
io_uring/zcrx.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 74046a09911a..0aa6455971d6 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -1836,6 +1836,7 @@ io_zcrx_recv_skb(read_descriptor_t *desc, struct sk_buff *skb,
struct io_kiocb *req = args->req;
struct sk_buff *frag_iter;
unsigned start, start_off = offset;
+ struct skb_shared_info *shi;
int i, ret = 0;
len = min_t(size_t, len, desc->count);
@@ -1871,17 +1872,15 @@ io_zcrx_recv_skb(read_descriptor_t *desc, struct sk_buff *skb,
}
start = skb_headlen(skb);
+ shi = skb_shinfo(skb);
- for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
- const skb_frag_t *frag;
- unsigned frag_end;
+ for (i = 0; i < shi->nr_frags; i++) {
+ const skb_frag_t *frag = &shi->frags[i];
+ unsigned frag_end = start + skb_frag_size(frag);
if (WARN_ON(start > offset + len))
return -EFAULT;
- frag = &skb_shinfo(skb)->frags[i];
- frag_end = start + skb_frag_size(frag);
-
if (offset < frag_end) {
unsigned copy = min(frag_end - offset, len);
unsigned frag_off = offset - start;
--
2.54.0
^ permalink raw reply related
* Re: [PATCH net v4 0/3] net/smc: bound wire-controlled CDC cursors against the local buffers
From: Bryam Vargas @ 2026-07-11 10:43 UTC (permalink / raw)
To: Dust Li
Cc: Wenjia Zhang, D . Wythe, Sidraya Jayagond, Eric Dumazet,
David S . Miller, Mahanta Jambigi, Wen Gu, Simon Horman,
Ursula Braun, Stefan Raspl, Tony Lu, Paolo Abeni, Jakub Kicinski,
netdev, linux-s390, linux-rdma, linux-kernel
In-Reply-To: <akzG4Hfeom6fNzFX@linux.alibaba.com>
On Tue, 7 Jul 2026 17:29:04 +0800, Dust Li wrote:
> Are you planning to land these clamps first, and then follow up with a
> separate validate/abort series?
Yes -- clamp series to net (Cc: stable), then the wire-boundary validate/abort to
net-next, which is the split from your v3 review. If you'd rather have the
validate/abort as the primary fix, or both in one series, say so and I'll
restructure it.
> Looking at your earlier A/B test, it simulates this logic in userspace to
> demonstrate the bug, but it doesn't actually trigger the bug in our
> current kernel.
Right -- the earlier one replayed the smc_curs_diff/copy arithmetic over a kmalloc
buffer. I built the end-to-end version: two AF_SMC sockets over the SMC-D loopback
(dibs), CONFIG_SMC=m with KASAN, receive path unmodified. Only the sender's on-wire
producer cursor is forged, modelling what a misbehaving peer sends:
cdc.prod.wrap = curs.wrap;
cdc.prod.count = curs.count;
+ if (forge) { /* peer just bumps the wrap, count stays 0 */
+ static u16 w;
+ cdc.prod.wrap = ++w;
+ cdc.prod.count = 0;
+ }
The client sends six 1-byte messages, the server recvs into a 2 MB buffer.
rmb_desc->len = 65504; the three arms on 7.2-rc1:
honest (no forge) recv 6 clean
forged, patch 2/3 clamp on recv 65504 clean (== rmb_desc->len)
forged, no clamp recv 393024 KASAN
In the last arm bytes_to_rcv reaches 6*len, so smc_rx_recvmsg()'s second wrap-around
chunk (copylen - first_chunk = 393024 - 65504) is read from ring offset 0, past the
RMB page:
BUG: KASAN: slab-use-after-free in _copy_to_iter
Read of size 327520 ... smc_rx_recvmsg <- smc_recvmsg <- __sys_recvfrom
(use-after-free rather than out-of-bounds only because the over-read lands in a freed
adjacent slab.) Happy to send the driver.
> the security risk here doesn't seem high to me, since SMC is only meant to
> be deployed in trusted environments.
Agreed it's low urgency there. The reason I'd still keep the bound in stable: it's a
peer-driven out-of-bounds read of kernel memory that a buggy, not only malicious,
peer can hit, and the clamp never resets an honest connection. The stable tag is
your call.
> once this is actually triggered, it means the data we've been handing to
> userspace is already wrong ... the connection should be terminated. So I
> don't really see much value in merging the bound-clamp patches first.
I'm not arguing against the abort -- a bad CDC means the connection can't be trusted
and should go down, and that's the net-next work. Two points on it.
The predicate has to test the accumulator, not the cursor. Every forged CDC here
carries count == 0, which is in [0, rmb_desc->len), so it passes any per-cursor
input check, including patch 1/3; only bytes_to_rcv goes out of range. A
cursor-boundary abort wouldn't catch this vector.
And placement: if the abort is queued (queue_work -> smc_conn_kill) after the
atomic_add, a recvmsg() under lock_sock can still read the inflated accumulator in
the window before teardown runs. A synchronous check that bails before the
atomic_add avoids that, and so does the consumer clamp.
If you'd prefer a single accumulator-abort in place of the -stable clamp, I'll
respin it that way and run the same A/B.
Bryam
^ permalink raw reply
* [RFC 00/10] io_uring: prototype for device memory tx
From: Pavel Begunkov @ 2026-07-11 10:48 UTC (permalink / raw)
To: netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Jamal Hadi Salim, io-uring, asml.silence
People were asking about io_uring tx with device memory, this is a quick
and dirty enablement for io_uring's IORING_OP_SEND[MSG]_ZC. It's more of
a testing prototype than to show the design as I'm not happy with uapi
and how it relies on zcrx, and will be redoing it.
It's piggy backed on top of a zcrx instance and relies on it managing
the rx queue and talking to the device. It also uses memory and mappings
from zcrx area. Since there is no proper iter type to pass netmems,
io_uring gives an ubuf/iovec iterator and relies on a new sg_from_iter
to setup skbs in the right way. Just as devmem TCP, it implmements
{get,put}_netmem by referencing, and verifies in
validate_xmit_unreadable_skb() that skbs go to the right device.
Pavel Begunkov (10):
net: pass ubuf to custom sg_from_iter callbacks
net: reject zcrx skbs to not registered devices
io_uring/zcrx: switch to pcpu refcounting
io_uring/zcrx: prepare areas to be exported for tx
io_uring/rsrc: introduce buf registration structure
io_uring/rsrc: extend buffer update
io_uring/rsrc: add uncloneable regbuf flag
io_uring/rsrc: add regbuf import flags
io_uring/rsrc: add zcrx backed registered buffers
io_uring/net: implement device memory send
include/linux/io_uring/net.h | 10 ++
include/linux/socket.h | 2 +-
include/net/netmem.h | 1 +
include/uapi/linux/io_uring.h | 28 ++++-
io_uring/net.c | 37 ++++--
io_uring/notif.h | 5 +-
io_uring/rsrc.c | 204 +++++++++++++++++++++++++++-------
io_uring/rsrc.h | 32 +++++-
io_uring/zcrx.c | 104 +++++++++++++++--
io_uring/zcrx.h | 14 ++-
net/core/datagram.c | 2 +-
net/core/dev.c | 10 +-
net/core/skbuff.c | 3 +
13 files changed, 381 insertions(+), 71 deletions(-)
--
2.54.0
^ permalink raw reply
* [RFC 01/10] net: pass ubuf to custom sg_from_iter callbacks
From: Pavel Begunkov @ 2026-07-11 10:48 UTC (permalink / raw)
To: netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Jamal Hadi Salim, io-uring, asml.silence
In-Reply-To: <cover.1783614400.git.asml.silence@gmail.com>
ubuf_info and callbacks for chunking zerocopy iterators into skbs comes
in pairs in msghdr, and in the future the callback will need to know
which ubuf_info it was called with. We can't derive it from the skb as
some paths set it after the call, so pass it in.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
include/linux/socket.h | 2 +-
io_uring/net.c | 8 ++++----
net/core/datagram.c | 2 +-
3 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/include/linux/socket.h b/include/linux/socket.h
index 2a8d7b14f1d1..5ae24847f5c4 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -90,7 +90,7 @@ struct msghdr {
unsigned int msg_flags; /* flags on received message */
__kernel_size_t msg_controllen; /* ancillary data buffer length */
struct ubuf_info *msg_ubuf;
- int (*sg_from_iter)(struct sk_buff *skb,
+ int (*sg_from_iter)(struct sk_buff *skb, struct ubuf_info *ubuf,
struct iov_iter *from, size_t length);
};
diff --git a/io_uring/net.c b/io_uring/net.c
index 00a7df803b99..cf273d6f02b1 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -116,9 +116,9 @@ struct io_recvzc {
struct io_zcrx_ifq *ifq;
};
-static int io_sg_from_iter_iovec(struct sk_buff *skb,
+static int io_sg_from_iter_iovec(struct sk_buff *skb, struct ubuf_info *ubuf,
struct iov_iter *from, size_t length);
-static int io_sg_from_iter(struct sk_buff *skb,
+static int io_sg_from_iter(struct sk_buff *skb, struct ubuf_info *ubuf,
struct iov_iter *from, size_t length);
int io_shutdown_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
@@ -1447,14 +1447,14 @@ int io_send_zc_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
return 0;
}
-static int io_sg_from_iter_iovec(struct sk_buff *skb,
+static int io_sg_from_iter_iovec(struct sk_buff *skb, struct ubuf_info *ubuf,
struct iov_iter *from, size_t length)
{
skb_zcopy_downgrade_managed(skb);
return zerocopy_fill_skb_from_iter(skb, from, length);
}
-static int io_sg_from_iter(struct sk_buff *skb,
+static int io_sg_from_iter(struct sk_buff *skb, struct ubuf_info *ubuf,
struct iov_iter *from, size_t length)
{
struct skb_shared_info *shinfo = skb_shinfo(skb);
diff --git a/net/core/datagram.c b/net/core/datagram.c
index c285c6465923..f15886f40efc 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -753,7 +753,7 @@ int __zerocopy_sg_from_iter(struct msghdr *msg, struct sock *sk,
int ret;
if (msg && msg->msg_ubuf && msg->sg_from_iter)
- ret = msg->sg_from_iter(skb, from, length);
+ ret = msg->sg_from_iter(skb, msg->msg_ubuf, from, length);
else if (binding)
ret = zerocopy_fill_skb_from_devmem(skb, from, length, binding);
else
--
2.54.0
^ permalink raw reply related
* [RFC 02/10] net: reject zcrx skbs to not registered devices
From: Pavel Begunkov @ 2026-07-11 10:48 UTC (permalink / raw)
To: netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Jamal Hadi Salim, io-uring, asml.silence
In-Reply-To: <cover.1783614400.git.asml.silence@gmail.com>
Tx of netmems that weren't created for the targeted device should be
rejected. Devmem TCP does it by looking up the net device in devmem TCP
private strucures. Introduce a netdev pointer in struct net_iov_area and
set it for zcrx so that we can check it in a more generic way. Keep the
existing devmem TCP path for the RFC version of the patch.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
include/net/netmem.h | 1 +
io_uring/zcrx.c | 3 +++
net/core/dev.c | 10 ++++++++--
3 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/include/net/netmem.h b/include/net/netmem.h
index bccacd21b6c3..71024c7ce884 100644
--- a/include/net/netmem.h
+++ b/include/net/netmem.h
@@ -103,6 +103,7 @@ struct net_iov_area {
struct net_iov *niovs;
size_t num_niovs;
+ struct net_device *netdev;
/* Offset into the dma-buf where this chunk starts. */
unsigned long base_virtual;
};
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 7ad52f499f87..ef82e064e796 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -516,6 +516,7 @@ static int io_zcrx_create_area(struct io_zcrx_ifq *ifq,
goto err;
}
+ area->nia.netdev = ifq->netdev;
area->free_count = nr_iovs;
/* we're only supporting one area per ifq for now */
area->area_id = 0;
@@ -554,6 +555,7 @@ static void io_zcrx_drop_netdev(struct io_zcrx_ifq *ifq)
if (!ifq->netdev)
return;
+ WRITE_ONCE(ifq->area->nia.netdev, NULL);
netdev_put(ifq->netdev, &ifq->netdev_tracker);
ifq->netdev = NULL;
}
@@ -568,6 +570,7 @@ static void io_close_queue(struct io_zcrx_ifq *ifq)
};
scoped_guard(mutex, &ifq->pp_lock) {
+ WRITE_ONCE(ifq->area->nia.netdev, NULL);
netdev = ifq->netdev;
netdev_tracker = ifq->netdev_tracker;
ifq->netdev = NULL;
diff --git a/net/core/dev.c b/net/core/dev.c
index 4b3d5cfdf6e0..703b55778c32 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4004,9 +4004,15 @@ static struct sk_buff *validate_xmit_unreadable_skb(struct sk_buff *skb,
shinfo = skb_shinfo(skb);
if (shinfo->nr_frags > 0) {
+ struct net_device *trgt_dev;
+
niov = netmem_to_net_iov(skb_frag_netmem(&shinfo->frags[0]));
- if (net_is_devmem_iov(niov) &&
- READ_ONCE(net_devmem_iov_binding(niov)->dev) != dev)
+ if (net_is_devmem_iov(niov))
+ trgt_dev = READ_ONCE(net_devmem_iov_binding(niov)->dev);
+ else
+ trgt_dev = READ_ONCE(net_iov_owner(niov)->netdev);
+
+ if (trgt_dev != dev)
goto out_free;
}
--
2.54.0
^ permalink raw reply related
* [RFC 03/10] io_uring/zcrx: switch to pcpu refcounting
From: Pavel Begunkov @ 2026-07-11 10:48 UTC (permalink / raw)
To: netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Jamal Hadi Salim, io-uring, asml.silence
In-Reply-To: <cover.1783614400.git.asml.silence@gmail.com>
We'll need a faster way to pin a zcrx instance for get_netmem(). Switch
refcounting to percpu_ref.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
io_uring/zcrx.c | 36 ++++++++++++++++++++++++++++++------
io_uring/zcrx.h | 4 +++-
2 files changed, 33 insertions(+), 7 deletions(-)
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index ef82e064e796..f501fc75d7b6 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -32,6 +32,8 @@
#define IO_DMA_ATTR (DMA_ATTR_SKIP_CPU_SYNC | DMA_ATTR_WEAK_ORDERING)
+static void ifq_pcpu_release(struct percpu_ref *ref);
+
static inline struct io_zcrx_ifq *io_pp_to_ifq(struct page_pool *pp)
{
return pp->mp_priv;
@@ -535,16 +537,22 @@ static int io_zcrx_create_area(struct io_zcrx_ifq *ifq,
static struct io_zcrx_ifq *io_zcrx_ifq_alloc(struct io_ring_ctx *ctx)
{
struct io_zcrx_ifq *ifq;
+ int ret;
ifq = kzalloc_obj(*ifq);
if (!ifq)
return NULL;
+ ret = percpu_ref_init(&ifq->refs, ifq_pcpu_release, 0, GFP_KERNEL_ACCOUNT);
+ if (ret) {
+ kfree(ifq);
+ return NULL;
+ }
+ percpu_ref_get(&ifq->refs);
ifq->if_rxq = -1;
spin_lock_init(&ifq->ctx_lock);
spin_lock_init(&ifq->rq.lock);
mutex_init(&ifq->pp_lock);
- refcount_set(&ifq->refs, 1);
refcount_set(&ifq->user_refs, 1);
return ifq;
}
@@ -606,13 +614,28 @@ static void io_zcrx_ifq_free(struct io_zcrx_ifq *ifq)
io_free_rbuf_ring(ifq);
free_uid(ifq->user);
mutex_destroy(&ifq->pp_lock);
+ percpu_ref_exit(&ifq->refs);
kfree(ifq);
}
+static inline void zcrx_release_work(struct work_struct *work)
+{
+ struct io_zcrx_ifq *ifq = container_of(work, struct io_zcrx_ifq, release_work);
+
+ io_zcrx_ifq_free(ifq);
+}
+
+static void ifq_pcpu_release(struct percpu_ref *ref)
+{
+ struct io_zcrx_ifq *ifq = container_of(ref, struct io_zcrx_ifq, refs);
+
+ INIT_WORK(&ifq->release_work, zcrx_release_work);
+ queue_work(system_wq, &ifq->release_work);
+}
+
static void io_put_zcrx_ifq(struct io_zcrx_ifq *ifq)
{
- if (refcount_dec_and_test(&ifq->refs))
- io_zcrx_ifq_free(ifq);
+ percpu_ref_put(&ifq->refs);
}
static void io_zcrx_return_niov_freelist(struct net_iov *niov)
@@ -683,6 +706,7 @@ static void zcrx_unregister_user(struct io_zcrx_ifq *ifq, struct io_ring_ctx *ct
if (refcount_dec_and_test(&ifq->user_refs)) {
io_close_queue(ifq);
io_zcrx_scrub(ifq);
+ percpu_ref_kill(&ifq->refs);
}
}
@@ -727,7 +751,7 @@ static int zcrx_export(struct io_ring_ctx *ctx, struct io_zcrx_ifq *ifq,
if (!mem_is_zero(ce, sizeof(*ce)))
return -EINVAL;
- refcount_inc(&ifq->refs);
+ percpu_ref_get(&ifq->refs);
refcount_inc(&ifq->user_refs);
file = anon_inode_create_getfile("[zcrx]", &zcrx_box_fops,
@@ -784,7 +808,7 @@ static int import_zcrx(struct io_ring_ctx *ctx,
return -EBADF;
ifq = file->private_data;
- refcount_inc(&ifq->refs);
+ percpu_ref_get(&ifq->refs);
refcount_inc(&ifq->user_refs);
scoped_guard(mutex, &ctx->mmap_lock) {
@@ -1285,7 +1309,7 @@ static int io_pp_zc_init(struct page_pool *pp)
if (pp->p.dma_dir != DMA_FROM_DEVICE)
return -EOPNOTSUPP;
- refcount_inc(&ifq->refs);
+ percpu_ref_get(&ifq->refs);
return 0;
}
diff --git a/io_uring/zcrx.h b/io_uring/zcrx.h
index fa00900e479e..205b9b40c74d 100644
--- a/io_uring/zcrx.h
+++ b/io_uring/zcrx.h
@@ -7,6 +7,7 @@
#include <linux/socket.h>
#include <net/page_pool/types.h>
#include <net/net_trackers.h>
+#include <linux/percpu-refcount.h>
#define ZCRX_SUPPORTED_REG_FLAGS (ZCRX_REG_IMPORT | ZCRX_REG_NODEV)
#define ZCRX_FEATURES (ZCRX_FEATURE_RX_PAGE_SIZE |\
@@ -64,7 +65,7 @@ struct io_zcrx_ifq {
struct device *dev;
struct net_device *netdev;
netdevice_tracker netdev_tracker;
- refcount_t refs;
+ struct percpu_ref refs;
/* counts userspace facing users like io_uring */
refcount_t user_refs;
@@ -81,6 +82,7 @@ struct io_zcrx_ifq {
u32 fired_notifs;
u64 notif_data;
struct zcrx_notif_stats *notif_stats;
+ struct work_struct release_work;
};
#if defined(CONFIG_IO_URING_ZCRX)
--
2.54.0
^ permalink raw reply related
* [RFC 04/10] io_uring/zcrx: prepare areas to be exported for tx
From: Pavel Begunkov @ 2026-07-11 10:48 UTC (permalink / raw)
To: netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Jamal Hadi Salim, io-uring, asml.silence
In-Reply-To: <cover.1783614400.git.asml.silence@gmail.com>
We're going to piggy back tx on top of zcrx, for that we need a separate
niov list without the pp field set and make sure net core can reference
them via get_netmem, which pins the zcrx instance.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
include/linux/io_uring/net.h | 10 ++++++
io_uring/zcrx.c | 65 +++++++++++++++++++++++++++++++++---
io_uring/zcrx.h | 10 ++++++
net/core/skbuff.c | 3 ++
4 files changed, 83 insertions(+), 5 deletions(-)
diff --git a/include/linux/io_uring/net.h b/include/linux/io_uring/net.h
index b58f39fed4d5..19f31f0d38d5 100644
--- a/include/linux/io_uring/net.h
+++ b/include/linux/io_uring/net.h
@@ -2,6 +2,8 @@
#ifndef _LINUX_IO_URING_NET_H
#define _LINUX_IO_URING_NET_H
+#include <net/netmem.h>
+
struct io_uring_cmd;
#if defined(CONFIG_IO_URING)
@@ -15,4 +17,12 @@ static inline int io_uring_cmd_sock(struct io_uring_cmd *cmd,
}
#endif
+#if defined(CONFIG_IO_URING_ZCRX)
+void zcrx_ref_niov(struct net_iov *niov);
+#else
+static inline void zcrx_ref_niov(struct net_iov *niov)
+{
+}
+#endif
+
#endif
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index f501fc75d7b6..28398f0d0014 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -9,6 +9,7 @@
#include <linux/rtnetlink.h>
#include <linux/skbuff_ref.h>
#include <linux/anon_inodes.h>
+#include <linux/io_uring/net.h>
#include <net/page_pool/helpers.h>
#include <net/page_pool/memory_provider.h>
@@ -100,6 +101,8 @@ static int io_populate_area_dma(struct io_zcrx_ifq *ifq,
if (net_mp_niov_set_dma_addr(niov, dma))
return -EFAULT;
+ if (net_mp_niov_set_dma_addr(&area->tx_niovs[niov_idx], dma))
+ return -EFAULT;
sg_len -= niov_size;
dma += niov_size;
niov_idx++;
@@ -118,7 +121,7 @@ static void io_release_dmabuf(struct io_zcrx_mem *mem)
if (mem->sgt)
dma_buf_unmap_attachment_unlocked(mem->attach, mem->sgt,
- DMA_FROM_DEVICE);
+ DMA_BIDIRECTIONAL);
if (mem->attach)
dma_buf_detach(mem->dmabuf, mem->attach);
if (mem->dmabuf)
@@ -162,7 +165,7 @@ static int io_import_dmabuf(struct io_zcrx_ifq *ifq,
goto err;
}
- mem->sgt = dma_buf_map_attachment_unlocked(mem->attach, DMA_FROM_DEVICE);
+ mem->sgt = dma_buf_map_attachment_unlocked(mem->attach, DMA_BIDIRECTIONAL);
if (IS_ERR(mem->sgt)) {
ret = PTR_ERR(mem->sgt);
mem->sgt = NULL;
@@ -226,7 +229,7 @@ static int io_import_umem(struct io_zcrx_ifq *ifq,
if (ifq->dev) {
ret = dma_map_sgtable(ifq->dev, &mem->page_sg_table,
- DMA_FROM_DEVICE, IO_DMA_ATTR);
+ DMA_BIDIRECTIONAL, IO_DMA_ATTR);
if (ret < 0)
goto out_err;
mapped = true;
@@ -247,7 +250,7 @@ static int io_import_umem(struct io_zcrx_ifq *ifq,
out_err:
if (mapped)
dma_unmap_sgtable(ifq->dev, &mem->page_sg_table,
- DMA_FROM_DEVICE, IO_DMA_ATTR);
+ DMA_BIDIRECTIONAL, IO_DMA_ATTR);
sg_free_table(&mem->page_sg_table);
unpin_user_pages(pages, nr_pages);
kvfree(pages);
@@ -310,7 +313,7 @@ static void io_zcrx_unmap_area(struct io_zcrx_ifq *ifq,
io_release_dmabuf(&area->mem);
} else {
dma_unmap_sgtable(ifq->dev, &area->mem.page_sg_table,
- DMA_FROM_DEVICE, IO_DMA_ATTR);
+ DMA_BIDIRECTIONAL, IO_DMA_ATTR);
}
}
@@ -494,6 +497,11 @@ static int io_zcrx_create_area(struct io_zcrx_ifq *ifq,
if (!area->nia.niovs)
goto err;
+ area->tx_niovs = kvmalloc_objs(area->tx_niovs[0], nr_iovs,
+ GFP_KERNEL_ACCOUNT | __GFP_ZERO);
+ if (!area->tx_niovs)
+ goto err;
+
area->freelist = kvmalloc_array(nr_iovs, sizeof(area->freelist[0]),
GFP_KERNEL_ACCOUNT | __GFP_ZERO);
if (!area->freelist)
@@ -510,6 +518,7 @@ static int io_zcrx_create_area(struct io_zcrx_ifq *ifq,
net_iov_init(niov, &area->nia, NET_IOV_IOURING);
area->freelist[i] = i;
atomic_set(&area->user_refs[i], 0);
+ net_iov_init(&area->tx_niovs[i], &area->nia, NET_IOV_IOURING);
}
if (ifq->dev) {
@@ -741,6 +750,13 @@ static const struct file_operations zcrx_box_fops = {
.release = zcrx_box_release,
};
+void zcrx_ref_niov(struct net_iov *niov)
+{
+ struct io_zcrx_ifq *ifq = io_zcrx_iov_to_area(niov)->ifq;
+
+ percpu_ref_get(&ifq->refs);
+}
+
static int zcrx_export(struct io_ring_ctx *ctx, struct io_zcrx_ifq *ifq,
struct zcrx_ctrl *ctrl, void __user *arg)
{
@@ -1817,3 +1833,42 @@ int io_zcrx_recv(struct io_kiocb *req, struct io_zcrx_ifq *ifq,
sock_rps_record_flow(sk);
return io_zcrx_tcp_recvmsg(req, ifq, sk, flags, issue_flags, len);
}
+
+int io_zcrx_fill_tx_skb(struct sk_buff *skb, struct io_zcrx_ifq *zcrx,
+ struct iov_iter *from, size_t length)
+{
+ int i = skb_shinfo(skb)->nr_frags;
+ unsigned niovs_emitted = 0;
+ struct io_zcrx_area *area = zcrx->area;
+ unsigned niov_size = 1U << zcrx->niov_shift;
+
+ if (i && skb_frags_readable(skb))
+ return -EINVAL;
+ length = min(length, iov_iter_count(from));
+
+ while (length) {
+ struct net_iov *niov;
+ size_t offset, size, niov_off;
+
+ if (i == MAX_SKB_FRAGS) {
+ percpu_ref_get_many(&zcrx->refs, niovs_emitted);
+ return -EMSGSIZE;
+ }
+
+ offset = (size_t)iter_iov_addr(from);
+ niov = &area->tx_niovs[offset >> zcrx->niov_shift];
+ niov_off = offset & (niov_size - 1);
+ size = min(length, niov_size - niov_off);
+ size = min(size, iter_iov_len(from));
+
+ skb_add_rx_frag_netmem(skb, i, net_iov_to_netmem(niov), niov_off,
+ size, size);
+ iov_iter_advance(from, size);
+ length -= size;
+ i++;
+ niovs_emitted++;
+ }
+
+ percpu_ref_get_many(&zcrx->refs, niovs_emitted);
+ return 0;
+}
diff --git a/io_uring/zcrx.h b/io_uring/zcrx.h
index 205b9b40c74d..406e0399bd7b 100644
--- a/io_uring/zcrx.h
+++ b/io_uring/zcrx.h
@@ -32,6 +32,7 @@ struct io_zcrx_area {
struct net_iov_area nia;
struct io_zcrx_ifq *ifq;
atomic_t *user_refs;
+ struct net_iov *tx_niovs;
bool is_mapped;
u16 area_id;
@@ -96,6 +97,10 @@ int io_zcrx_recv(struct io_kiocb *req, struct io_zcrx_ifq *ifq,
unsigned issue_flags, unsigned int *len);
struct io_mapped_region *io_zcrx_get_region(struct io_ring_ctx *ctx,
unsigned int id);
+
+int io_zcrx_fill_tx_skb(struct sk_buff *skb, struct io_zcrx_ifq *zcrx,
+ struct iov_iter *from, size_t length);
+
#else
static inline int io_register_zcrx(struct io_ring_ctx *ctx,
struct io_uring_zcrx_ifq_reg __user *arg)
@@ -124,6 +129,11 @@ static inline int io_zcrx_ctrl(struct io_ring_ctx *ctx,
{
return -EOPNOTSUPP;
}
+static inline int io_zcrx_fill_tx_skb(struct sk_buff *skb, struct io_zcrx_ifq *zcrx,
+ struct iov_iter *from, size_t length)
+{
+ return -EOPNOTSUPP;
+}
#endif
int io_recvzc(struct io_kiocb *req, unsigned int issue_flags);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 18dabb4e9cfa..f871e3f2299b 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -92,6 +92,7 @@
#include <linux/user_namespace.h>
#include <linux/indirect_call_wrapper.h>
#include <linux/textsearch.h>
+#include <linux/io_uring/net.h>
#include "dev.h"
#include "devmem.h"
@@ -7476,6 +7477,8 @@ void __get_netmem(netmem_ref netmem)
if (net_is_devmem_iov(niov))
net_devmem_get_net_iov(netmem_to_net_iov(netmem));
+ else if (niov->type == NET_IOV_IOURING)
+ zcrx_ref_niov(niov);
}
EXPORT_SYMBOL(__get_netmem);
--
2.54.0
^ permalink raw reply related
* [RFC 05/10] io_uring/rsrc: introduce buf registration structure
From: Pavel Begunkov @ 2026-07-11 10:48 UTC (permalink / raw)
To: netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Jamal Hadi Salim, io-uring, asml.silence
In-Reply-To: <cover.1783614400.git.asml.silence@gmail.com>
In preparation to following changes, instead of passing an iovec for
buffer registration introduce a new structure. It'll be moved to uapi
later, but for now it's initialised early from a user provided iovec.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
io_uring/rsrc.c | 47 ++++++++++++++++++++++++++++++++---------------
1 file changed, 32 insertions(+), 15 deletions(-)
diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index 8d0f2ee24e0c..8af371ba6c06 100644
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -27,8 +27,13 @@ struct io_rsrc_update {
u32 offset;
};
+struct io_uring_regbuf_desc {
+ __u64 uaddr;
+ __u64 size;
+};
+
static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx,
- struct iovec *iov);
+ struct io_uring_regbuf_desc *desc);
static int hpage_acct_ref(struct io_ring_ctx *ctx, struct page *hpage,
bool *acct_new)
@@ -81,6 +86,15 @@ static bool hpage_acct_unref(struct io_ring_ctx *ctx, struct page *hpage)
#define IO_CACHED_BVECS_SEGS 32
+static void io_iov_to_regbuf_desc(const struct iovec *iov,
+ struct io_uring_regbuf_desc *desc)
+{
+ *desc = (struct io_uring_regbuf_desc) {
+ .uaddr = (u64)(uintptr_t)iov->iov_base,
+ .size = iov->iov_len,
+ };
+}
+
int __io_account_mem(struct user_struct *user, unsigned long nr_pages)
{
unsigned long page_limit, cur_pages, new_pages;
@@ -381,6 +395,7 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx,
return -EINVAL;
for (done = 0; done < nr_args; done++) {
+ struct io_uring_regbuf_desc desc;
struct io_rsrc_node *node;
u64 tag = 0;
@@ -394,7 +409,9 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx,
err = -EFAULT;
break;
}
- node = io_sqe_buffer_register(ctx, iov);
+
+ io_iov_to_regbuf_desc(iov, &desc);
+ node = io_sqe_buffer_register(ctx, &desc);
if (IS_ERR(node)) {
err = PTR_ERR(node);
break;
@@ -853,26 +870,26 @@ bool io_check_coalesce_buffer(struct page **page_array, int nr_pages,
}
static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx,
- struct iovec *iov)
+ struct io_uring_regbuf_desc *desc)
{
+ unsigned long uaddr = (unsigned long)desc->uaddr;
+ size_t size = desc->size;
struct io_mapped_ubuf *imu = NULL;
struct page **pages = NULL;
struct io_rsrc_node *node;
unsigned long off;
- size_t size;
int ret, nr_pages, i;
struct io_imu_folio_data data;
bool coalesced = false;
- if (!iov->iov_base) {
- if (iov->iov_len)
+ if (!uaddr) {
+ if (size)
return ERR_PTR(-EFAULT);
/* remove the buffer without installing a new one */
return NULL;
}
- ret = io_validate_user_buf_range((unsigned long)iov->iov_base,
- iov->iov_len);
+ ret = io_validate_user_buf_range(uaddr, size);
if (ret)
return ERR_PTR(ret);
@@ -881,8 +898,7 @@ static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx,
return ERR_PTR(-ENOMEM);
ret = -ENOMEM;
- pages = io_pin_pages((unsigned long) iov->iov_base, iov->iov_len,
- &nr_pages);
+ pages = io_pin_pages(uaddr, size, &nr_pages);
if (IS_ERR(pages)) {
ret = PTR_ERR(pages);
pages = NULL;
@@ -904,10 +920,9 @@ static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx,
if (ret)
goto done;
- size = iov->iov_len;
/* store original address for later verification */
- imu->ubuf = (unsigned long) iov->iov_base;
- imu->len = iov->iov_len;
+ imu->ubuf = uaddr;
+ imu->len = size;
imu->folio_shift = PAGE_SHIFT;
imu->release = io_release_ubuf;
imu->priv = imu;
@@ -917,7 +932,7 @@ static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx,
imu->folio_shift = data.folio_shift;
refcount_set(&imu->refs, 1);
- off = (unsigned long)iov->iov_base & ~PAGE_MASK;
+ off = uaddr & ~PAGE_MASK;
if (coalesced)
off += data.first_folio_page_idx << PAGE_SHIFT;
@@ -969,6 +984,7 @@ int io_sqe_buffers_register(struct io_ring_ctx *ctx, void __user *arg,
memset(iov, 0, sizeof(*iov));
for (i = 0; i < nr_args; i++) {
+ struct io_uring_regbuf_desc desc;
struct io_rsrc_node *node;
u64 tag = 0;
@@ -992,7 +1008,8 @@ int io_sqe_buffers_register(struct io_ring_ctx *ctx, void __user *arg,
}
}
- node = io_sqe_buffer_register(ctx, iov);
+ io_iov_to_regbuf_desc(iov, &desc);
+ node = io_sqe_buffer_register(ctx, &desc);
if (IS_ERR(node)) {
ret = PTR_ERR(node);
break;
--
2.54.0
^ permalink raw reply related
* [RFC 06/10] io_uring/rsrc: extend buffer update
From: Pavel Begunkov @ 2026-07-11 10:48 UTC (permalink / raw)
To: netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Jamal Hadi Salim, io-uring, asml.silence
In-Reply-To: <cover.1783614400.git.asml.silence@gmail.com>
We need to pass more information to buffer registration than we can fit
into a single struct iovec. This patch allows users to optionally pass
struct io_uring_regbuf_desc. Apart from having more space for future use
cases, it also introduces registration types.
Currently, the type can be either of IO_REGBUF_TYPE_UADDR, which mirrors
the iovec path, or IO_REGBUF_TYPE_EMPTY for leaving a buffer table slot
empty. The next patch introduces a dmabuf backed type, and can be useful
for other extensions like splicing a list of user addresses (i.e.
iovec[]), interoperability with zcrx, kernel allocated memory like was
brough up by Cristoph. Note, the type only represents a registration
option, which is distinct from how io_uring internally stores it.
The flags field is not used yet but always useful to have, e.g. we can
encode read-only / write-only restrictions using it.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
include/uapi/linux/io_uring.h | 27 +++++++++++++-
io_uring/rsrc.c | 69 ++++++++++++++++++++++-------------
2 files changed, 69 insertions(+), 27 deletions(-)
diff --git a/include/uapi/linux/io_uring.h b/include/uapi/linux/io_uring.h
index 909fb7aea638..98b259901185 100644
--- a/include/uapi/linux/io_uring.h
+++ b/include/uapi/linux/io_uring.h
@@ -790,13 +790,38 @@ struct io_uring_rsrc_update {
struct io_uring_rsrc_update2 {
__u32 offset;
- __u32 resv;
+ __u32 flags;
__aligned_u64 data;
__aligned_u64 tags;
__u32 nr;
__u32 resv2;
};
+/* struct io_uring_rsrc_update2::flags */
+enum io_uring_rsrc_reg_flags {
+ /*
+ * Use the extended descriptor format for buffer updates,
+ * see struct io_uring_regbuf_desc
+ */
+ IORING_RSRC_UPDATE_EXTENDED = 1U << 1,
+};
+
+/* Buffer registration type, passed in struct io_uring_regbuf_desc::type */
+enum io_uring_regbuf_type {
+ IO_REGBUF_TYPE_EMPTY,
+ IO_REGBUF_TYPE_UADDR,
+
+ __IO_REGBUF_TYPE_MAX,
+};
+
+struct io_uring_regbuf_desc {
+ __u32 type; /* enum io_uring_regbuf_type */
+ __u32 flags;
+ __u64 size;
+ __u64 uaddr;
+ __u64 __resv[7];
+};
+
/* Skip updating fd indexes set to this value in the fd table */
#define IORING_REGISTER_FILES_SKIP (-2)
diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index 8af371ba6c06..24fc3232a66a 100644
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -27,11 +27,6 @@ struct io_rsrc_update {
u32 offset;
};
-struct io_uring_regbuf_desc {
- __u64 uaddr;
- __u64 size;
-};
-
static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx,
struct io_uring_regbuf_desc *desc);
@@ -90,9 +85,12 @@ static void io_iov_to_regbuf_desc(const struct iovec *iov,
struct io_uring_regbuf_desc *desc)
{
*desc = (struct io_uring_regbuf_desc) {
+ .type = IO_REGBUF_TYPE_UADDR,
.uaddr = (u64)(uintptr_t)iov->iov_base,
.size = iov->iov_len,
};
+ if (!desc->uaddr)
+ desc->type = IO_REGBUF_TYPE_EMPTY;
}
int __io_account_mem(struct user_struct *user, unsigned long nr_pages)
@@ -323,6 +321,8 @@ static int __io_sqe_files_update(struct io_ring_ctx *ctx,
return -ENXIO;
if (up->offset + nr_args > ctx->file_table.data.nr)
return -EINVAL;
+ if (up->flags)
+ return -EINVAL;
for (done = 0; done < nr_args; done++) {
u64 tag = 0;
@@ -382,9 +382,8 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx,
struct io_uring_rsrc_update2 *up,
unsigned int nr_args)
{
+ bool extended = up->flags & IORING_RSRC_UPDATE_EXTENDED;
u64 __user *tags = u64_to_user_ptr(up->tags);
- struct iovec fast_iov, *iov;
- struct iovec __user *uvec;
u64 user_data = up->data;
__u32 done;
int i, err;
@@ -393,29 +392,49 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx,
return -ENXIO;
if (up->offset + nr_args > ctx->buf_table.nr)
return -EINVAL;
+ if (up->flags & ~IORING_RSRC_UPDATE_EXTENDED)
+ return -EINVAL;
for (done = 0; done < nr_args; done++) {
struct io_uring_regbuf_desc desc;
struct io_rsrc_node *node;
u64 tag = 0;
- uvec = u64_to_user_ptr(user_data);
- iov = iovec_from_user(uvec, 1, 1, &fast_iov, io_is_compat(ctx));
- if (IS_ERR(iov)) {
- err = PTR_ERR(iov);
- break;
- }
if (tags && copy_from_user(&tag, &tags[done], sizeof(tag))) {
err = -EFAULT;
break;
}
- io_iov_to_regbuf_desc(iov, &desc);
+ if (extended) {
+ if (copy_from_user(&desc, u64_to_user_ptr(user_data),
+ sizeof(desc))) {
+ err = -EFAULT;
+ break;
+ }
+ user_data += sizeof(desc);
+ } else {
+ struct iovec __user *uvec = u64_to_user_ptr(user_data);
+ struct iovec fast_iov, *iov;
+
+ if (io_is_compat(ctx))
+ user_data += sizeof(struct compat_iovec);
+ else
+ user_data += sizeof(struct iovec);
+
+ iov = iovec_from_user(uvec, 1, 1, &fast_iov, io_is_compat(ctx));
+ if (IS_ERR(iov)) {
+ err = PTR_ERR(iov);
+ break;
+ }
+ io_iov_to_regbuf_desc(iov, &desc);
+ }
+
node = io_sqe_buffer_register(ctx, &desc);
if (IS_ERR(node)) {
err = PTR_ERR(node);
break;
}
+
if (tag) {
if (!node) {
err = -EINVAL;
@@ -426,10 +445,6 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx,
i = array_index_nospec(up->offset + done, ctx->buf_table.nr);
io_reset_rsrc_node(ctx, &ctx->buf_table, i);
ctx->buf_table.nodes[i] = node;
- if (io_is_compat(ctx))
- user_data += sizeof(struct compat_iovec);
- else
- user_data += sizeof(struct iovec);
}
return done ? done : err;
}
@@ -464,7 +479,7 @@ int io_register_files_update(struct io_ring_ctx *ctx, void __user *arg,
memset(&up, 0, sizeof(up));
if (copy_from_user(&up, arg, sizeof(struct io_uring_rsrc_update)))
return -EFAULT;
- if (up.resv || up.resv2)
+ if (up.resv2)
return -EINVAL;
return __io_register_rsrc_update(ctx, IORING_RSRC_FILE, &up, nr_args);
}
@@ -478,7 +493,7 @@ int io_register_rsrc_update(struct io_ring_ctx *ctx, void __user *arg,
return -EINVAL;
if (copy_from_user(&up, arg, sizeof(up)))
return -EFAULT;
- if (!up.nr || up.resv || up.resv2)
+ if (!up.nr || up.resv2)
return -EINVAL;
return __io_register_rsrc_update(ctx, type, &up, up.nr);
}
@@ -578,12 +593,9 @@ int io_files_update(struct io_kiocb *req, unsigned int issue_flags)
struct io_uring_rsrc_update2 up2;
int ret;
+ memset(&up2, 0, sizeof(up2));
up2.offset = up->offset;
up2.data = up->arg;
- up2.nr = 0;
- up2.tags = 0;
- up2.resv = 0;
- up2.resv2 = 0;
if (up->offset == IORING_FILE_INDEX_ALLOC) {
ret = io_files_update_with_index_alloc(req, issue_flags);
@@ -882,8 +894,13 @@ static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx,
struct io_imu_folio_data data;
bool coalesced = false;
- if (!uaddr) {
- if (size)
+ if (desc->type >= __IO_REGBUF_TYPE_MAX)
+ return ERR_PTR(-EINVAL);
+ if (!mem_is_zero(&desc->__resv, sizeof(desc->__resv)))
+ return ERR_PTR(-EINVAL);
+
+ if (desc->type == IO_REGBUF_TYPE_EMPTY) {
+ if (uaddr || size)
return ERR_PTR(-EFAULT);
/* remove the buffer without installing a new one */
return NULL;
--
2.54.0
^ permalink raw reply related
* [RFC 08/10] io_uring/rsrc: add regbuf import flags
From: Pavel Begunkov @ 2026-07-11 10:48 UTC (permalink / raw)
To: netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Jamal Hadi Salim, io-uring, asml.silence
In-Reply-To: <cover.1783614400.git.asml.silence@gmail.com>
We'll have special registered buffer types that can't be used with all
opcodes and need special handling. Add separate flags to control
registered buffer import, which will be used to specify what kind of
buffers the caller can handle.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
io_uring/rsrc.c | 8 ++++----
io_uring/rsrc.h | 24 ++++++++++++++++++++----
2 files changed, 24 insertions(+), 8 deletions(-)
diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index d57e8a0380b5..05877b4c0ee5 100644
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -1245,9 +1245,9 @@ inline struct io_rsrc_node *io_find_buf_node(struct io_kiocb *req,
return NULL;
}
-int io_import_reg_buf(struct io_kiocb *req, struct iov_iter *iter,
+int __io_import_reg_buf(struct io_kiocb *req, struct iov_iter *iter,
u64 buf_addr, size_t len, int ddir,
- unsigned issue_flags)
+ unsigned issue_flags, unsigned import_flags)
{
struct io_rsrc_node *node;
@@ -1656,9 +1656,9 @@ static int io_kern_bvec_size(struct iovec *iov, unsigned nr_iovs,
return 0;
}
-int io_import_reg_vec(int ddir, struct iov_iter *iter,
+int __io_import_reg_vec(int ddir, struct iov_iter *iter,
struct io_kiocb *req, struct iou_vec *vec,
- unsigned nr_iovs, unsigned issue_flags)
+ unsigned nr_iovs, unsigned issue_flags, unsigned import_flags)
{
struct io_rsrc_node *node;
struct io_mapped_ubuf *imu;
diff --git a/io_uring/rsrc.h b/io_uring/rsrc.h
index 83aa86e6f320..f12abaf63270 100644
--- a/io_uring/rsrc.h
+++ b/io_uring/rsrc.h
@@ -65,12 +65,28 @@ int io_rsrc_data_alloc(struct io_rsrc_data *data, unsigned nr);
struct io_rsrc_node *io_find_buf_node(struct io_kiocb *req,
unsigned issue_flags);
-int io_import_reg_buf(struct io_kiocb *req, struct iov_iter *iter,
+int __io_import_reg_buf(struct io_kiocb *req, struct iov_iter *iter,
u64 buf_addr, size_t len, int ddir,
- unsigned issue_flags);
-int io_import_reg_vec(int ddir, struct iov_iter *iter,
+ unsigned issue_flags, unsigned import_flags);
+int __io_import_reg_vec(int ddir, struct iov_iter *iter,
struct io_kiocb *req, struct iou_vec *vec,
- unsigned nr_iovs, unsigned issue_flags);
+ unsigned nr_iovs, unsigned issue_flags,
+ unsigned import_flags);
+
+static inline int io_import_reg_buf(struct io_kiocb *req, struct iov_iter *iter,
+ u64 buf_addr, size_t len, int ddir,
+ unsigned issue_flags)
+{
+ return __io_import_reg_buf(req, iter, buf_addr, len, ddir, issue_flags, 0);
+}
+
+static inline int io_import_reg_vec(int ddir, struct iov_iter *iter,
+ struct io_kiocb *req, struct iou_vec *vec,
+ unsigned nr_iovs, unsigned issue_flags)
+{
+ return __io_import_reg_vec(ddir, iter, req, vec, nr_iovs, issue_flags, 0);
+}
+
int io_prep_reg_iovec(struct io_kiocb *req, struct iou_vec *iv,
const struct iovec __user *uvec, size_t uvec_segs);
--
2.54.0
^ permalink raw reply related
* [RFC 07/10] io_uring/rsrc: add uncloneable regbuf flag
From: Pavel Begunkov @ 2026-07-11 10:48 UTC (permalink / raw)
To: netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Jamal Hadi Salim, io-uring, asml.silence
In-Reply-To: <cover.1783614400.git.asml.silence@gmail.com>
It's hard to implement cloning if the internal structure needs to be
mutable and/or relies on other ring resources. In preparation to such
buffer types, add a flag indicating that the buffer can't be cloned. It
might be possible to add cloning in the future for them, but that would
likely need reallocating the structure and reacquiring resources in case
by case manner.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
io_uring/rsrc.c | 5 +++++
io_uring/rsrc.h | 3 ++-
2 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index 24fc3232a66a..d57e8a0380b5 100644
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -1381,6 +1381,11 @@ static int io_clone_buffers(struct io_ring_ctx *ctx, struct io_ring_ctx *src_ctx
if (!src_node) {
dst_node = NULL;
} else {
+ if (src_node->buf->flags & IO_REGBUF_F_UNCLONEABLE) {
+ io_rsrc_data_free(ctx, &data);
+ return -ENOMEM;
+ }
+
dst_node = io_rsrc_node_alloc(ctx, IORING_RSRC_BUFFER);
if (!dst_node) {
io_rsrc_data_free(ctx, &data);
diff --git a/io_uring/rsrc.h b/io_uring/rsrc.h
index 98ae8ef51009..83aa86e6f320 100644
--- a/io_uring/rsrc.h
+++ b/io_uring/rsrc.h
@@ -29,7 +29,8 @@ enum {
};
enum {
- IO_REGBUF_F_KBUF = 1,
+ IO_REGBUF_F_KBUF = 1 << 0,
+ IO_REGBUF_F_UNCLONEABLE = 1 << 1,
};
struct io_mapped_ubuf {
--
2.54.0
^ permalink raw reply related
* [RFC 09/10] io_uring/rsrc: add zcrx backed registered buffers
From: Pavel Begunkov @ 2026-07-11 10:48 UTC (permalink / raw)
To: netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Jamal Hadi Salim, io-uring, asml.silence
In-Reply-To: <cover.1783614400.git.asml.silence@gmail.com>
Allow the user to take an existing zcrx instance and wrap it into a
registered buffer that will later be used for tx path. We don't want
leaking zcrx instances to other rings, so mark the buffer uncloneable.
The buffer also doesn't ping zcrx but relies on that zcrx can't be
unregistered.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
include/uapi/linux/io_uring.h | 1 +
io_uring/rsrc.c | 91 ++++++++++++++++++++++++++++++++++-
io_uring/rsrc.h | 5 ++
3 files changed, 95 insertions(+), 2 deletions(-)
diff --git a/include/uapi/linux/io_uring.h b/include/uapi/linux/io_uring.h
index 98b259901185..4e86ad3ee977 100644
--- a/include/uapi/linux/io_uring.h
+++ b/include/uapi/linux/io_uring.h
@@ -810,6 +810,7 @@ enum io_uring_rsrc_reg_flags {
enum io_uring_regbuf_type {
IO_REGBUF_TYPE_EMPTY,
IO_REGBUF_TYPE_UADDR,
+ IO_REGBUF_TYPE_ZCRX,
__IO_REGBUF_TYPE_MAX,
};
diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index 05877b4c0ee5..583e51748c62 100644
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -19,6 +19,7 @@
#include "rsrc.h"
#include "memmap.h"
#include "register.h"
+#include "zcrx.h"
struct io_rsrc_update {
struct file *file;
@@ -881,6 +882,53 @@ bool io_check_coalesce_buffer(struct page **page_array, int nr_pages,
return true;
}
+static void io_release_zcrx(void *priv)
+{
+}
+
+static struct io_rsrc_node *io_register_zcrx_buffer(struct io_ring_ctx *ctx,
+ struct io_uring_regbuf_desc *desc)
+{
+ struct io_mapped_ubuf *imu = NULL;
+ struct io_rsrc_node *node;
+ struct io_zcrx_ifq *zcrx;
+ u32 ifq_idx = desc->uaddr;
+
+
+ if (ifq_idx != desc->uaddr)
+ return ERR_PTR(-EINVAL);
+ node = io_rsrc_node_alloc(ctx, IORING_RSRC_BUFFER);
+ if (!node)
+ return ERR_PTR(-ENOMEM);
+ zcrx = xa_load(&ctx->zcrx_ctxs, ifq_idx);
+ if (!zcrx)
+ return ERR_PTR(-EINVAL);
+
+ WARN_ON_ONCE(!zcrx->area);
+
+ if (zcrx->area->mem.size != desc->size)
+ return ERR_PTR(-EINVAL);
+
+ imu = io_alloc_imu(ctx, 0);
+ if (!imu) {
+ io_cache_free(&ctx->node_cache, node);
+ return ERR_PTR(-ENOMEM);
+ }
+
+ imu->nr_bvecs = 0;
+ /* store original address for later verification */
+ imu->ubuf = 0;
+ imu->len = desc->size;
+ imu->folio_shift = PAGE_SHIFT;
+ imu->release = io_release_zcrx;
+ imu->priv = zcrx;
+ imu->flags = IO_REGBUF_F_UNCLONEABLE | IO_REGBUF_F_ZCRX;
+ imu->dir = IO_IMU_SOURCE;
+ refcount_set(&imu->refs, 1);
+ node->buf = imu;
+ return node;
+}
+
static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx,
struct io_uring_regbuf_desc *desc)
{
@@ -898,6 +946,8 @@ static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx,
return ERR_PTR(-EINVAL);
if (!mem_is_zero(&desc->__resv, sizeof(desc->__resv)))
return ERR_PTR(-EINVAL);
+ if (desc->type == IO_REGBUF_TYPE_ZCRX)
+ return io_register_zcrx_buffer(ctx, desc);
if (desc->type == IO_REGBUF_TYPE_EMPTY) {
if (uaddr || size)
@@ -1170,9 +1220,17 @@ static int io_import_kbuf(int ddir, struct iov_iter *iter,
return 0;
}
+static int io_import_from_zcrx(int ddir, struct iov_iter *iter,
+ struct io_mapped_ubuf *imu,
+ u64 buf_addr, size_t len)
+{
+ iov_iter_ubuf(iter, ddir, (void *)(unsigned long)buf_addr, len);
+ return 0;
+}
+
static int io_import_fixed(int ddir, struct iov_iter *iter,
struct io_mapped_ubuf *imu,
- u64 buf_addr, size_t len)
+ u64 buf_addr, size_t len, unsigned import_flags)
{
const struct bio_vec *bvec;
size_t folio_mask;
@@ -1185,6 +1243,13 @@ static int io_import_fixed(int ddir, struct iov_iter *iter,
return ret;
if (!(imu->dir & (1 << ddir)))
return -EFAULT;
+
+ if (imu->flags & IO_REGBUF_F_ZCRX) {
+ if (unlikely(!(import_flags & IO_REGBUF_IMPORT_ALLOW_ZCRX)))
+ return -EINVAL;
+ return io_import_from_zcrx(ddir, iter, imu, buf_addr, len);
+ }
+
if (unlikely(!len)) {
iov_iter_bvec(iter, ddir, NULL, 0, 0);
return 0;
@@ -1254,7 +1319,7 @@ int __io_import_reg_buf(struct io_kiocb *req, struct iov_iter *iter,
node = io_find_buf_node(req, issue_flags);
if (!node)
return -EFAULT;
- return io_import_fixed(ddir, iter, node->buf, buf_addr, len);
+ return io_import_fixed(ddir, iter, node->buf, buf_addr, len, import_flags);
}
static int io_buffer_acct_cloned_hpages(struct io_ring_ctx *ctx,
@@ -1656,6 +1721,22 @@ static int io_kern_bvec_size(struct iovec *iov, unsigned nr_iovs,
return 0;
}
+static int import_reg_vec_zcrx(int ddir, struct iov_iter *iter, struct iovec *iov,
+ unsigned nr_iovs)
+{
+ size_t size;
+ unsigned i;
+
+ for (i = 0; i < nr_iovs; i++) {
+ if (check_add_overflow(size, (size_t)iov[i].iov_len, &size))
+ return -EOVERFLOW;
+ }
+ if (size > MAX_RW_COUNT)
+ return -EINVAL;
+ iov_iter_init(iter, ddir, iov, nr_iovs, size);
+ return 0;
+}
+
int __io_import_reg_vec(int ddir, struct iov_iter *iter,
struct io_kiocb *req, struct iou_vec *vec,
unsigned nr_iovs, unsigned issue_flags, unsigned import_flags)
@@ -1676,6 +1757,12 @@ int __io_import_reg_vec(int ddir, struct iov_iter *iter,
iovec_off = vec->nr - nr_iovs;
iov = vec->iovec + iovec_off;
+ if (imu->flags & IO_REGBUF_F_ZCRX) {
+ if (unlikely(!(import_flags & IO_REGBUF_IMPORT_ALLOW_ZCRX)))
+ return -EINVAL;
+ return import_reg_vec_zcrx(ddir, iter, iov, nr_iovs);
+ }
+
if (imu->flags & IO_REGBUF_F_KBUF) {
int ret = io_kern_bvec_size(iov, nr_iovs, imu, &nr_segs);
diff --git a/io_uring/rsrc.h b/io_uring/rsrc.h
index f12abaf63270..a44f7dfcd470 100644
--- a/io_uring/rsrc.h
+++ b/io_uring/rsrc.h
@@ -31,6 +31,11 @@ enum {
enum {
IO_REGBUF_F_KBUF = 1 << 0,
IO_REGBUF_F_UNCLONEABLE = 1 << 1,
+ IO_REGBUF_F_ZCRX = 1 << 2,
+};
+
+enum {
+ IO_REGBUF_IMPORT_ALLOW_ZCRX = 1 << 0,
};
struct io_mapped_ubuf {
--
2.54.0
^ permalink raw reply related
* [RFC 10/10] io_uring/net: implement device memory send
From: Pavel Begunkov @ 2026-07-11 10:48 UTC (permalink / raw)
To: netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Jamal Hadi Salim, io-uring, asml.silence
In-Reply-To: <cover.1783614400.git.asml.silence@gmail.com>
Enable zerocopy sends with device memory by teaching it how to work with
IO_REGBUF_TYPE_ZCRX. There is no iterator type to represent what we
need, so do a little hack, pass an iovec instead and let a custom
sg_from_iter implementation to fill skbs with netmems.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
io_uring/net.c | 29 ++++++++++++++++++++++++-----
io_uring/notif.h | 5 ++++-
2 files changed, 28 insertions(+), 6 deletions(-)
diff --git a/io_uring/net.c b/io_uring/net.c
index cf273d6f02b1..2ffbb59ceee4 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -1497,6 +1497,14 @@ static int io_sg_from_iter(struct sk_buff *skb, struct ubuf_info *ubuf,
return ret;
}
+static int io_sg_from_zcrx_iter(struct sk_buff *skb, struct ubuf_info *ubuf,
+ struct iov_iter *from, size_t length)
+{
+ struct io_notif_data *nd = container_of(ubuf, struct io_notif_data, uarg);
+
+ return io_zcrx_fill_tx_skb(skb, nd->zcrx, from, length);
+}
+
static int io_send_zc_import(struct io_kiocb *req,
struct io_async_msghdr *kmsg,
unsigned int issue_flags)
@@ -1510,15 +1518,17 @@ static int io_send_zc_import(struct io_kiocb *req,
notif->buf_index = req->buf_index;
if (!(sr->flags & IORING_SEND_VECTORIZED)) {
- ret = io_import_reg_buf(notif, &kmsg->msg.msg_iter,
- (u64)(uintptr_t)sr->buf, sr->len,
- ITER_SOURCE, issue_flags);
+ ret = __io_import_reg_buf(notif, &kmsg->msg.msg_iter,
+ (u64)(uintptr_t)sr->buf, sr->len,
+ ITER_SOURCE, issue_flags,
+ IO_REGBUF_IMPORT_ALLOW_ZCRX);
} else {
unsigned uvec_segs = kmsg->msg.msg_iter.nr_segs;
- ret = io_import_reg_vec(ITER_SOURCE, &kmsg->msg.msg_iter,
+ ret = __io_import_reg_vec(ITER_SOURCE, &kmsg->msg.msg_iter,
notif, &kmsg->vec, uvec_segs,
- issue_flags);
+ issue_flags,
+ IO_REGBUF_IMPORT_ALLOW_ZCRX);
}
if (unlikely(ret))
@@ -1545,9 +1555,18 @@ int io_sendmsg_zc(struct io_kiocb *req, unsigned int issue_flags)
return -EAGAIN;
if (req->flags & REQ_F_IMPORT_BUFFER) {
+ struct io_mapped_ubuf *buf;
+
ret = io_send_zc_import(req, kmsg, issue_flags);
if (unlikely(ret))
return ret;
+
+ buf = sr->notif->buf_node->buf;
+
+ if (buf->flags & IO_REGBUF_TYPE_ZCRX) {
+ kmsg->msg.sg_from_iter = io_sg_from_zcrx_iter;
+ io_notif_to_data(sr->notif)->zcrx = buf->priv;
+ }
}
msg_flags = sr->msg_flags;
diff --git a/io_uring/notif.h b/io_uring/notif.h
index f3589cfef4a9..2dfd5bf23302 100644
--- a/io_uring/notif.h
+++ b/io_uring/notif.h
@@ -17,7 +17,10 @@ struct io_notif_data {
struct io_notif_data *next;
struct io_notif_data *head;
- unsigned account_pages;
+ union {
+ unsigned account_pages;
+ void *zcrx;
+ };
bool zc_report;
bool zc_used;
bool zc_copied;
--
2.54.0
^ permalink raw reply related
* Re: [PATCH 01/10] xfrm: propagate -EINPROGRESS from validate_xmit_xfrm()
From: patchwork-bot+netdevbpf @ 2026-07-11 11:00 UTC (permalink / raw)
To: Steffen Klassert; +Cc: davem, kuba, herbert, netdev
In-Reply-To: <20260710090349.343389-2-steffen.klassert@secunet.com>
Hello:
This series was applied to netdev/net.git (main)
by Steffen Klassert <steffen.klassert@secunet.com>:
On Fri, 10 Jul 2026 11:03:14 +0200 you wrote:
> From: Petr Wozniak <petr.wozniak@gmail.com>
>
> validate_xmit_xfrm() returns NULL both when a packet is dropped and
> when it is stolen by async crypto (-EINPROGRESS from ->xmit()).
> Callers cannot distinguish the two cases.
>
> f53c723902d1 ("net: Add asynchronous callbacks for xfrm on layer 2.")
> changed the semantics of a NULL return from "dropped" to "stolen or
> dropped", but __dev_queue_xmit() was not updated. On virtual/bridge
> interfaces (noqueue qdisc) __dev_queue_xmit() initialises rc=-ENOMEM
> and jumps to out: when skb is NULL, returning -ENOMEM to the caller
> even though the packet will be delivered correctly via xfrm_dev_resume().
>
> [...]
Here is the summary with links:
- [01/10] xfrm: propagate -EINPROGRESS from validate_xmit_xfrm()
https://git.kernel.org/netdev/net/c/6860b467f569
- [02/10] xfrm: fix stale skb->prev after async crypto steals a GSO segment
https://git.kernel.org/netdev/net/c/3f4c3919baf0
- [03/10] xfrm: nat_keepalive: avoid double free on send error
https://git.kernel.org/netdev/net/c/226f4a490d1a
- [04/10] xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
https://git.kernel.org/netdev/net/c/c283e9ada7fc
- [05/10] xfrm: cache the offload ifindex for netlink dumps
https://git.kernel.org/netdev/net/c/c4a5f0071cc6
- [06/10] xfrm: reject optional IPTFS templates in outbound policies
https://git.kernel.org/netdev/net/c/ea528f18231e
- [07/10] xfrm: clear mode callbacks after failed mode setup
https://git.kernel.org/netdev/net/c/2538bd3cd1ff
- [08/10] xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()
https://git.kernel.org/netdev/net/c/430ea57d6daf
- [09/10] xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
https://git.kernel.org/netdev/net/c/136992de9bb9
- [10/10] xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
https://git.kernel.org/netdev/net/c/f38f8cce2f7e
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net] macsec: fix promiscuity refcount leak in macsec_dev_open()
From: patchwork-bot+netdevbpf @ 2026-07-11 11:00 UTC (permalink / raw)
To: James Raphael Tiovalen
Cc: sd, netdev, stable, andrew+netdev, davem, edumazet, kuba, pabeni,
atenart, linux-kernel
In-Reply-To: <20260705113629.187490-1-jamestiotio@gmail.com>
Hello:
This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Sun, 5 Jul 2026 19:36:29 +0800 you wrote:
> When a MACsec interface with IFF_PROMISC set is brought up on top of a
> device that has hardware offload enabled, macsec_dev_open() first calls
> dev_set_promiscuity(real_dev, 1) and then propagates the open to the
> offload device. If that propagation fails, the error path jumps to the
> clear_allmulti label, which only reverts allmulti and the unicast
> address. The promiscuity taken on the lower device is never dropped, so
> real_dev is left permanently stuck in promiscuous mode. Its promiscuity
> count can no longer be balanced from software.
>
> [...]
Here is the summary with links:
- [net] macsec: fix promiscuity refcount leak in macsec_dev_open()
https://git.kernel.org/netdev/net/c/7410d11460eb
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* [PATCH v3] dt-bindings: net: microchip,lan78xx: convert to DT schema
From: Mikhail Lukianchikov @ 2026-07-11 10:55 UTC (permalink / raw)
To: Rengarajan.S
Cc: avermoal, andrew+netdev, conor+dt, davem, devicetree, edumazet,
krzk+dt, kuba, linux-kernel, netdev, pabeni, robh
Convert the Microchip LAN78xx family (LAN7800, LAN7801, LAN7850) binding
documentation from plain text to DT schema.
The conversion adds proper validation for the 'microchip,led-modes'
property inside the MDIO node.
Signed-off-by: Mikhail Lukianchikov <avermoal@gmail.com>
---
Changes in v3:
- Added $ref to ethernet-phy.yaml for PHY node to use standard PHY properties.
- Dropped redundant PHY description and manual 'reg' property definition.
- Dropped root node and fake compatibles in the example.
Link to v2: https://lore.kernel.org/netdev/20260709181724.24682-2-avermoal@gmail.com
.../bindings/net/microchip,lan7800.yaml | 96 +++++++++++++++++++
.../bindings/net/microchip,lan78xx.txt | 53 ----------
MAINTAINERS | 3 +-
3 files changed, 97 insertions(+), 55 deletions(-)
create mode 100644 Documentation/devicetree/bindings/net/microchip,lan7800.yaml
delete mode 100644 Documentation/devicetree/bindings/net/microchip,lan78xx.txt
diff --git a/Documentation/devicetree/bindings/net/microchip,lan7800.yaml b/Documentation/devicetree/bindings/net/microchip,lan7800.yaml
new file mode 100644
index 000000000000..730999d11e8a
--- /dev/null
+++ b/Documentation/devicetree/bindings/net/microchip,lan7800.yaml
@@ -0,0 +1,96 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/net/microchip,lan7800.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Microchip LAN7800/LAN7801/LAN7850 Gigabit Ethernet controller
+
+maintainers:
+ - Rengarajan Sundararajan <Rengarajan.S@microchip.com>
+
+description:
+ The LAN7800/LAN7801/LAN7850 devices are usually configured by
+ programming their OTP or with an external EEPROM, but some
+ platforms (e.g. Raspberry Pi 3 B+) have neither. The Device Tree
+ properties, if present, override the OTP and EEPROM.
+
+allOf:
+ - $ref: /schemas/usb/usb-device.yaml#
+ - $ref: /schemas/net/ethernet-controller.yaml#
+
+properties:
+ compatible:
+ enum:
+ - usb424,7800
+ - usb424,7801
+ - usb424,7850
+
+ reg:
+ maxItems: 1
+ description: USB port number
+
+ local-mac-address:
+ $ref: /schemas/types.yaml#/definitions/uint8-array
+ minItems: 6
+ maxItems: 6
+ description:
+ MAC address to use if not stored in OTP or EEPROM. If present,
+ overrides OTP/EEPROM.
+
+ mdio:
+ $ref: /schemas/net/mdio.yaml#
+ unevaluatedProperties: false
+
+ patternProperties:
+ "^ethernet-phy(@[0-9a-f]+)?$":
+ $ref: /schemas/net/ethernet-phy.yaml#
+ unevaluatedProperties: false
+ type: object
+
+ properties:
+ microchip,led-modes:
+ $ref: /schemas/types.yaml#/definitions/uint32-array
+ minItems: 1
+ maxItems: 4
+ description:
+ Array of LED mode values for each of up to 4 LEDs.
+ Omitted LEDs are turned off. Allowed values are defined
+ in include/dt-bindings/net/microchip-lan78xx.h.
+
+ required:
+ - reg
+
+required:
+ - compatible
+ - reg
+
+unevaluatedProperties: false
+
+examples:
+ - |
+ #include <dt-bindings/net/microchip-lan78xx.h>
+
+ usb {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ ethernet@1 {
+ compatible = "usb424,7800";
+ reg = <1>;
+ local-mac-address = [00 11 22 33 44 55];
+
+ mdio {
+ #address-cells = <1>;
+ #size-cells = <0>;
+ ethernet-phy@1 {
+ reg = <1>;
+ microchip,led-modes = <
+ LAN78XX_LINK_1000_ACTIVITY
+ LAN78XX_LINK_10_100_ACTIVITY
+ >;
+ };
+ };
+ };
+ };
+...
diff --git a/Documentation/devicetree/bindings/net/microchip,lan78xx.txt b/Documentation/devicetree/bindings/net/microchip,lan78xx.txt
deleted file mode 100644
index 11a679530ae6..000000000000
--- a/Documentation/devicetree/bindings/net/microchip,lan78xx.txt
+++ /dev/null
@@ -1,53 +0,0 @@
-Microchip LAN78xx Gigabit Ethernet controller
-
-The LAN78XX devices are usually configured by programming their OTP or with
-an external EEPROM, but some platforms (e.g. Raspberry Pi 3 B+) have neither.
-The Device Tree properties, if present, override the OTP and EEPROM.
-
-Required properties:
-- compatible: Should be one of "usb424,7800", "usb424,7801" or "usb424,7850".
-
-The MAC address will be determined using the optional properties
-defined in ethernet.txt.
-
-Optional properties of the embedded PHY:
-- microchip,led-modes: a 0..4 element vector, with each element configuring
- the operating mode of an LED. Omitted LEDs are turned off. Allowed values
- are defined in "include/dt-bindings/net/microchip-lan78xx.h".
-
-Example:
-
-/* Based on the configuration for a Raspberry Pi 3 B+ */
-&usb {
- usb-port@1 {
- compatible = "usb424,2514";
- reg = <1>;
- #address-cells = <1>;
- #size-cells = <0>;
-
- usb-port@1 {
- compatible = "usb424,2514";
- reg = <1>;
- #address-cells = <1>;
- #size-cells = <0>;
-
- ethernet: ethernet@1 {
- compatible = "usb424,7800";
- reg = <1>;
- local-mac-address = [ 00 11 22 33 44 55 ];
-
- mdio {
- #address-cells = <0x1>;
- #size-cells = <0x0>;
- eth_phy: ethernet-phy@1 {
- reg = <1>;
- microchip,led-modes = <
- LAN78XX_LINK_1000_ACTIVITY
- LAN78XX_LINK_10_100_ACTIVITY
- >;
- };
- };
- };
- };
- };
-};
diff --git a/MAINTAINERS b/MAINTAINERS
index f37a81950e25..157a677a284f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -27928,10 +27928,9 @@ F: drivers/usb/isp1760/*
USB LAN78XX ETHERNET DRIVER
M: Thangaraj Samynathan <Thangaraj.S@microchip.com>
M: Rengarajan Sundararajan <Rengarajan.S@microchip.com>
-M: UNGLinuxDriver@microchip.com
L: netdev@vger.kernel.org
S: Maintained
-F: Documentation/devicetree/bindings/net/microchip,lan78xx.txt
+F: Documentation/devicetree/bindings/net/microchip,lan7800.yaml
F: drivers/net/usb/lan78xx.*
F: include/dt-bindings/net/microchip-lan78xx.h
--
2.52.0
^ permalink raw reply related
* Re: [PATCH v2 net-next 00/14] net: Support per-netns device unregistration
From: patchwork-bot+netdevbpf @ 2026-07-11 11:10 UTC (permalink / raw)
To: Kuniyuki Iwashima
Cc: davem, edumazet, kuba, pabeni, andrew+netdev, horms, kuni1840,
netdev
In-Reply-To: <20260703001009.1572444-1-kuniyu@google.com>
Hello:
This series was applied to netdev/net-next.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Fri, 3 Jul 2026 00:09:11 +0000 you wrote:
> The biggest blocker to per-netns RTNL is netdev unregistration.
>
> It starts within a single netns, but it can eventually involve
> multiple namespaces.
>
> There are three types of such cross-netns devices:
>
> [...]
Here is the summary with links:
- [v2,net-next,01/14] rtnetlink: Lock sock_net(skb->sk) in rtnl_newlink().
https://git.kernel.org/netdev/net-next/c/5ecbbb179e0c
- [v2,net-next,02/14] rtnetlink: Call unregister_netdevice_many() only once in rtnl_link_unregister().
https://git.kernel.org/netdev/net-next/c/49c26d4bf1da
- [v2,net-next,03/14] rtnetlink: Add per-netns rtnl_work.
https://git.kernel.org/netdev/net-next/c/c6cfaf97837e
- [v2,net-next,04/14] net: Wrap default_device_exit_net() with __rtnl_net_lock().
https://git.kernel.org/netdev/net-next/c/2b12ec257849
- [v2,net-next,05/14] net: Hold __rtnl_net_lock() in netdev_wait_allrefs_any().
https://git.kernel.org/netdev/net-next/c/0fa296dd520e
- [v2,net-next,06/14] net: Add per-netns netdev unregistration infra.
https://git.kernel.org/netdev/net-next/c/af3634d4ac65
- [v2,net-next,07/14] net: Call unregister_netdevice_many() per netns.
https://git.kernel.org/netdev/net-next/c/d0008553a70a
- [v2,net-next,08/14] veth: Support per-netns device unregistration.
https://git.kernel.org/netdev/net-next/c/d7fda2c776b2
- [v2,net-next,09/14] bareudp: Protect bareudp_list with mutex.
https://git.kernel.org/netdev/net-next/c/a278ea7ba32a
- [v2,net-next,10/14] bareudp: Support per-netns netdev unregistration.
https://git.kernel.org/netdev/net-next/c/f1de92507a91
- [v2,net-next,11/14] ipvlan: Convert ipvl_port.count to refcount_t.
https://git.kernel.org/netdev/net-next/c/acb351b5a899
- [v2,net-next,12/14] ipvlan: Synchronise ipvlan_init() and ipvlan_uninit() for the same lower dev.
https://git.kernel.org/netdev/net-next/c/aabbdb8c76d7
- [v2,net-next,13/14] ipvlan: Protect ipvl_port.ipvlans with mutex.
https://git.kernel.org/netdev/net-next/c/35add1093e2f
- [v2,net-next,14/14] ipvlan: Support per-netns netdev unregistration.
https://git.kernel.org/netdev/net-next/c/00a40d809207
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next] net: ethernet: qualcomm: remove unneeded 'fast_io' parameter in regmap_config
From: patchwork-bot+netdevbpf @ 2026-07-11 11:10 UTC (permalink / raw)
To: Wolfram Sang
Cc: linux-kernel, jie.luo, andrew+netdev, davem, edumazet, kuba,
pabeni, netdev
In-Reply-To: <20260705164208.2184-2-wsa+renesas@sang-engineering.com>
Hello:
This patch was applied to netdev/net-next.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Sun, 5 Jul 2026 18:41:59 +0200 you wrote:
> When using MMIO with regmap, fast_io is implied. No need to set it
> again.
>
> Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
> ---
> No dependencies, can be applied directly to the subsystem tree. Buildbot is
> happy, too.
>
> [...]
Here is the summary with links:
- [net-next] net: ethernet: qualcomm: remove unneeded 'fast_io' parameter in regmap_config
https://git.kernel.org/netdev/net-next/c/f6f3b36c15ed
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net] net: openvswitch: reject oversized nested action attrs
From: patchwork-bot+netdevbpf @ 2026-07-11 11:20 UTC (permalink / raw)
To: Asim Viladi Oglu Manizada
Cc: netdev, dev, aconole, echaudro, i.maximets, davem, edumazet, kuba,
pabeni, horms, stable
In-Reply-To: <20260706094336.38639-1-manizada@pm.me>
Hello:
This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Mon, 06 Jul 2026 09:44:10 +0000 you wrote:
> Open vSwitch stores generated flow actions as nlattrs, whose nla_len
> field is u16. Commit a1e64addf3ff ("net: openvswitch: remove
> misbehaving actions length check") allowed the total sw_flow_actions
> stream to grow beyond 64 KiB, which is valid, but also removed the last
> guard preventing a generated nested action attribute from exceeding
> U16_MAX.
>
> [...]
Here is the summary with links:
- [net] net: openvswitch: reject oversized nested action attrs
https://git.kernel.org/netdev/net/c/3f1f75536668
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox