Re: [PATCH net-next v1 03/11] xdp: Copy buffers with restricted lifetime

["Björn Töpel" <bjorn@kernel.org>]

Mina Almasry <almasrymina@google.com> writes:

> On Tue, Nov 10, 2026 at 2:21 AM Björn Töpel <bjorn@kernel.org> wrote:
>>
>> UMEM stays mapped writable in userspace, and it has a fixed number of
>> chunks. The stack must not keep its chunks in an skb or an xdp_frame.
>> Mark the providers whose buffers the stack may keep with
>> MP_CAP_RETAIN, and copy packets of the others on XDP_PASS, on
>> conversion to a frame, and on redirects other than XSKMAP.
>>
>
> I'm not understanding why that needs special handling. Devmem stays
> mapped and writeable and did not need MP_CAP_RETAIN. Also, today the
> stack can keep any pp page in the socket's receive queue for arbitrary
> time without _RETAIN. I'm espcially confused you're not adding _RETAIN
> as a cap to existing providers, but their netmems can be retained.

This patch does give devmem and io_uring zcrx MP_CAP_RETAIN, and pages
need nothing... a pool without a provider is retainable. Only UMEM
isn't.

The stack never reads devmem or io_uring zcrx payloads, so it doesn't
matter that userspace can write them. UMEM is readable, and the stack
would parse headers and payload that the application can change under
it. An AF_XDP socket also has a fixed set of chunks, and chunks held in
skbs elsewhere starve it. Driver zero copy copies on XDP_PASS for the
same reasons, in xdp_build_skb_from_zc(); this does the same for
provider buffers.

>> The head chunk is writable by userspace, so it cannot hold
>> skb_shared_info, and virt_to_netmem() cannot find a net_iov head.
>> Drivers pass kernel memory for both to xdp_init_buff_netmem().
>>
>> A static key keeps the check off while no such page pool exists. A
>> frame copy is linear, so a multi-buffer packet of such a provider
>> cannot go to a device or CPU map.
>>
>
> Did this actually improve perf? I recall that when I benchmarked the
> performance improvement, it was questionable.

I have no numbers for it, and it goes in v2. With the frag walk gone, as
agreed with Stan, the only check left under the key is for page heads,
and no provider hands out pages.


Björn