Re: [PATCH net-next v1 04/11] xsk: Allocate UMEM chunks through page_pool
From: Stanislav Fomichev
Date: Tue Nov 10 2026 - 18:52:45 EST
On 11/10, Björn Töpel wrote:
> AF_XDP zero copy needs a second RX allocator in every driver. A
> page_pool driver can take UMEM chunks from a memory provider instead,
> and keep its refill, recycling and DMA sync code.
>
> Each aligned chunk becomes a net_iov, whose address netmem_address()
> finds without calling the provider. Userspace may post a chunk that
> the kernel still owns, so the provider tracks the owner of each chunk
> and drops such FILL entries. Chunks that a page pool releases stay in
> the kernel for reuse. Nothing installs the provider yet.
>
> Signed-off-by: Björn Töpel <bjorn@xxxxxxxxxx>
> ---
> include/net/netmem.h | 25 ++++-
> include/net/xdp.h | 2 +-
> net/xdp/Kconfig | 1 +
> net/xdp/Makefile | 2 +-
> net/xdp/xsk.h | 6 ++
> net/xdp/xsk_pp.c | 246 +++++++++++++++++++++++++++++++++++++++++++
> 6 files changed, 279 insertions(+), 3 deletions(-)
> create mode 100644 net/xdp/xsk_pp.c
>
> diff --git a/include/net/netmem.h b/include/net/netmem.h
> index b986ad616334..a3b67ef32b21 100644
> --- a/include/net/netmem.h
> +++ b/include/net/netmem.h
> @@ -69,6 +69,7 @@ DECLARE_STATIC_KEY_FALSE(page_pool_restricted);
> enum net_iov_type {
> NET_IOV_DMABUF,
> NET_IOV_IOURING,
> + NET_IOV_XSK,
> };
>
> /* A memory descriptor representing abstract networking I/O vectors.
> @@ -107,6 +108,10 @@ struct net_iov_area {
> size_t num_niovs;
> /* Each net_iov covers 1 << niov_shift bytes. */
> unsigned int niov_shift;
> + /* CPU address of the first net_iov, or NULL if the CPU cannot read
> + * the area.
> + */
> + void *vaddr;
> };
>
> static inline struct net_iov_area *net_iov_owner(const struct net_iov *niov)
> @@ -119,6 +124,18 @@ static inline unsigned int net_iov_idx(const struct net_iov *niov)
> return niov - net_iov_owner(niov)->niovs;
> }
>
> +static inline void *net_iov_address(const struct net_iov *niov)
> +{
> + const struct net_iov_area *area = net_iov_owner(niov);
> + unsigned long off;
> +
> + if (!area->vaddr)
> + return NULL;
> +
> + off = (unsigned long)net_iov_idx(niov) << area->niov_shift;
> + return area->vaddr + off;
> +}
> +
> /* Initialize a niov: stamp the owning area, the memory provider type.
> */
> static inline void net_iov_init(struct net_iov *niov,
> @@ -345,10 +362,16 @@ static inline void *__netmem_address(netmem_ref netmem)
> return page_address(__netmem_to_page(netmem));
> }
>
> +/**
> + * netmem_address - get the CPU address of the memory behind @netmem
> + * @netmem: netmem to get the address of
> + *
> + * Return: the address, or NULL if the CPU cannot read @netmem.
> + */
> static inline void *netmem_address(netmem_ref netmem)
> {
> if (netmem_is_net_iov(netmem))
> - return NULL;
> + return net_iov_address(netmem_to_net_iov(netmem));
>
> return __netmem_address(netmem);
> }
> diff --git a/include/net/xdp.h b/include/net/xdp.h
> index 1105bb9e3292..5ab7802ac4e1 100644
> --- a/include/net/xdp.h
> +++ b/include/net/xdp.h
> @@ -368,7 +368,7 @@ static inline bool xdp_buff_add_frag(struct xdp_buff *xdp, netmem_ref netmem,
>
> if (unlikely(netmem_is_pfmemalloc(netmem)))
> xdp_buff_set_frag_pfmemalloc(xdp);
> - if (unlikely(netmem_is_net_iov(netmem)))
> + if (unlikely(netmem_is_net_iov(netmem) && !netmem_address(netmem)))
> xdp_buff_set_frag_unreadable(xdp);
>
> return true;
> diff --git a/net/xdp/Kconfig b/net/xdp/Kconfig
> index 71af2febe72a..c9c68d3b3712 100644
> --- a/net/xdp/Kconfig
> +++ b/net/xdp/Kconfig
> @@ -2,6 +2,7 @@
> config XDP_SOCKETS
> bool "XDP sockets"
> depends on BPF_SYSCALL
> + select PAGE_POOL
> default n
> help
> XDP sockets allows a channel between XDP programs and
> diff --git a/net/xdp/Makefile b/net/xdp/Makefile
> index 30cdc4315f42..6e9d60f9f7f1 100644
> --- a/net/xdp/Makefile
> +++ b/net/xdp/Makefile
> @@ -1,4 +1,4 @@
> # SPDX-License-Identifier: GPL-2.0-only
> obj-$(CONFIG_XDP_SOCKETS) += xsk.o xdp_umem.o xsk_queue.o xskmap.o
> -obj-$(CONFIG_XDP_SOCKETS) += xsk_buff_pool.o
> +obj-$(CONFIG_XDP_SOCKETS) += xsk_buff_pool.o xsk_pp.o
> obj-$(CONFIG_XDP_SOCKETS_DIAG) += xsk_diag.o
> diff --git a/net/xdp/xsk.h b/net/xdp/xsk.h
> index 7c811b5cce76..4dab7b9a1487 100644
> --- a/net/xdp/xsk.h
> +++ b/net/xdp/xsk.h
> @@ -34,6 +34,12 @@ static inline struct xdp_sock *xdp_sk(struct sock *sk)
>
> void xsk_map_try_sock_delete(struct xsk_map *map, struct xdp_sock *xs,
> struct xdp_sock __rcu **map_entry);
> +struct xsk_pp;
> +
> +extern const struct memory_provider_ops xsk_pp_ops;
> +
> +struct xsk_pp *xsk_pp_create(struct xsk_buff_pool *pool);
> +void xsk_pp_put(struct xsk_pp *pp);
> void xsk_clear_pool_at_qid(struct net_device *dev, u16 queue_id);
> int xsk_reg_pool_at_qid(struct net_device *dev, struct xsk_buff_pool *pool,
> u16 queue_id);
> diff --git a/net/xdp/xsk_pp.c b/net/xdp/xsk_pp.c
> new file mode 100644
> index 000000000000..fdd55265a6cd
> --- /dev/null
> +++ b/net/xdp/xsk_pp.c
> @@ -0,0 +1,246 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* AF_XDP UMEM as a page pool memory provider
> + *
> + * Each aligned UMEM chunk is a readable net_iov with one owner at a time:
> + *
> + * userspace --FILL--> page pool --release--> reuse --alloc--> page pool
> + * ^ |
> + * +-----RX ring-------+
> + */
> +
> +#include <net/page_pool/helpers.h>
> +#include <net/page_pool/memory_provider.h>
> +#include <net/xdp_sock_drv.h>
> +
> +#include "xsk.h"
> +#include "xsk_queue.h"
> +
> +enum xsk_pp_chunk {
> + XSK_PP_USER, /* owned by userspace */
> + XSK_PP_POOL, /* owned by a page pool */
> + XSK_PP_REUSE, /* on the reuse stack */
Can you explain more about that reuse/reuse_cnt? When is the chunk reused?
How is it different from FILL->RX path?