Received: by 2002:a05:6a10:f3d0:0:0:0:0 with SMTP id a16csp502938pxv; Thu, 8 Jul 2021 07:26:04 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwVLj6P5R8eb6vKDT/rHnAVf1K5TSGSoL0Y7At+AjKstf7mPAajCGDFvnrotjp33NuFJAhu X-Received: by 2002:a02:3c17:: with SMTP id m23mr27053935jaa.84.1625754364199; Thu, 08 Jul 2021 07:26:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1625754364; cv=none; d=google.com; s=arc-20160816; b=oH6G+3vxy9pHzAwyZW0avUKxAw7dDfehOdolTX3g5Mm/Ha6gm/ZiPBG0YXxBW/LO9u Nju3l0UwBs2zkkS2pXnxM9D7bMhg4B+GK2xUvqo0mfFx5LSjEKATklLzxzrpCV2tRVb/ 5vWhaI7DoVq20rIIGJCESce/BV7jedFdmyvH4zjgiTjH7VzvROr0M6jilBjaVFgnMJH6 NHm6s78qwW3iFbORMH+xY1uLYvztwT2t7xNxpC25qc7brHalDdX0rEnCihUi8InOrA0A D6eCuq8Re/5KtsFXpokgpilgz30dxLTZFDazzjyyZalrtzLqVj2awsgjPAdhRoPV8U5S GRAA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:subject:message-id:date:from:in-reply-to :references:mime-version:dkim-signature; bh=aVcN0wM8xi5hqe86WHfBCgjLM4Jp5TwV0EbNkATkMaY=; b=CIGqjohrmyEP+DNnDR759Q98G/oqSZUb9948f8AifzpJNrAb0u4/was3xOF9KCY6ZW OeePKvyyLr6N2xx6MIo3GlB59TtcPfbZRudWQ5b2clGJ6Te04VFOelfLpn1RgGhS7OLP gY3Xlr3IQk55GEVNHw7c7GTiRjQy8oBJMZFeKUtOtDDEADB+6qoN5USgNeSb3Q4w658u h3mgZTd15imtWDZLYXUcUtReCSRfrB7Zt/IdNhYErYAJk73MQGK55pmGLJs7yQdVginN 4vLZI2ttbCJd8ihvzP6MtNKv2qhbiCbIZteX2BU01PwN0sMGxpuBn9ugE0id0XNBeAHa 7JJw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=b3CwmjIG; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id l24si2271707jaq.79.2021.07.08.07.25.51; Thu, 08 Jul 2021 07:26:04 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=b3CwmjIG; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231823AbhGHO1x (ORCPT + 99 others); Thu, 8 Jul 2021 10:27:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48130 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231515AbhGHO1x (ORCPT ); Thu, 8 Jul 2021 10:27:53 -0400 Received: from mail-ej1-x632.google.com (mail-ej1-x632.google.com [IPv6:2a00:1450:4864:20::632]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DB3DBC061574; Thu, 8 Jul 2021 07:25:09 -0700 (PDT) Received: by mail-ej1-x632.google.com with SMTP id o5so9975128ejy.7; Thu, 08 Jul 2021 07:25:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=aVcN0wM8xi5hqe86WHfBCgjLM4Jp5TwV0EbNkATkMaY=; b=b3CwmjIGZBugzq9AGvSe2gt2J5LWLT9DNiAiOoU6vzMq2srVo+KfSOC9ITWqNgEQlh JuJuAE5UQXurnmgXjml/MPBKbikpcVZdK/jXeYjzuwfNi9H5fcjzYZIsLZhOexiKYqGB jDM8uB/O1Zwz/IjRrOSZkMgB8tgIRAe7e5GZ7fWzaYw1YsrVbcfj5WX7A1MqpcRFKwwf gF0hsEzlcOEgPfTH0KKxdQyT8rUBrrL5g1v85Z+XR2/YpAaq39Cw5XZP36cibkoiFz+9 uRbzk9cBmRKWcdAKeca/1hWju2eTgnKViGlDnq8QRWZ2YBc/xR3ll4lXQzb0ruGVhf4Z 4zpQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=aVcN0wM8xi5hqe86WHfBCgjLM4Jp5TwV0EbNkATkMaY=; b=XdiQY2N/NUBz8au/c7XFGrJ7kKQp/dJ74KwaUPJGA/hc4VQVeXBvTaUHNj7U3VPRYJ DUPGqFJyZCbiHiuV87XHzIhQw7R//DqL0+jKBTbq3aNTvq5tONQ/llksVZx8RvoPjLXZ eGuPV0IhPD/jotT7P1h0sqVto9u60GEigNpAV5tBHbRIsozVNH1iGtlW7gizW8a3n7Tw WCA5CCSJlHeBjXoUnxbLw3og400d+KT93FyZlW4I89BJ9PctB5Vhc8DSGC0EJWDKw/rW OuRb4BfRQ8IobiRasStZ/k1QgbdsBgbLT128cpHYK6dzfPArQgiDIkgvpAzeU647MH+N 7prg== X-Gm-Message-State: AOAM530hFgDfNQp5Nlw7HU9pmFvw68cDhc3NvNqXuMU/ABq4wsIYuB4X YDwMF8H/68tFK6slVkLEXFHeiA8HgYsUxXrcSj8= X-Received: by 2002:a17:907:97c3:: with SMTP id js3mr31981518ejc.114.1625754308378; Thu, 08 Jul 2021 07:25:08 -0700 (PDT) MIME-Version: 1.0 References: <1625044676-12441-1-git-send-email-linyunsheng@huawei.com> <1625044676-12441-2-git-send-email-linyunsheng@huawei.com> <29403911-bc26-dd86-83b8-da3c1784d087@huawei.com> In-Reply-To: From: Alexander Duyck Date: Thu, 8 Jul 2021 07:24:57 -0700 Message-ID: Subject: Re: [PATCH net-next RFC 1/2] page_pool: add page recycling support based on elevated refcnt To: Ilias Apalodimas Cc: Yunsheng Lin , David Miller , Jakub Kicinski , linuxarm@openeuler.org, yisen.zhuang@huawei.com, Salil Mehta , thomas.petazzoni@bootlin.com, Marcin Wojtas , Russell King - ARM Linux , hawk@kernel.org, Alexei Starovoitov , Daniel Borkmann , John Fastabend , Andrew Morton , Peter Zijlstra , Will Deacon , Matthew Wilcox , Vlastimil Babka , fenghua.yu@intel.com, guro@fb.com, peterx@redhat.com, Feng Tang , Jason Gunthorpe , mcroce@microsoft.com, Hugh Dickins , Jonathan Lemon , Alexander Lobakin , Willem de Bruijn , wenxu@ucloud.cn, cong.wang@bytedance.com, Kevin Hao , nogikh@google.com, Marco Elver , Netdev , LKML , bpf Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Jul 8, 2021 at 7:21 AM Ilias Apalodimas wrote: > > > > > > > > [...] > > > > > > The above expectation is based on that the last user will always > > > > > call page_pool_put_full_page() in order to do the recycling or do > > > > > the resource cleanup(dma unmaping..etc). > > > > > > > > > > As the skb_free_head() and skb_release_data() have both checked the > > > > > skb->pp_recycle to call the page_pool_put_full_page() if needed, I > > > > > think we are safe for most case, the one case I am not so sure above > > > > > is the rx zero copy, which seems to also bump up the refcnt before > > > > > mapping the page to user space, we might need to ensure rx zero copy > > > > > is not the last user of the page or if it is the last user, make sure > > > > > it calls page_pool_put_full_page() too. > > > > > > > > Yes, but the skb->pp_recycle value is per skb, not per page. So my > > > > concern is that carrying around that value can be problematic as there > > > > are a number of possible cases where the pages might be > > > > unintentionally recycled. All it would take is for a packet to get > > > > cloned a few times and then somebody starts using pskb_expand_head and > > > > you would have multiple cases, possibly simultaneously, of entities > > > > trying to free the page. I just worry it opens us up to a number of > > > > possible races. > > > > > > Maybe I missde something, but I thought the cloned SKBs would never trigger > > > the recycling path, since they are protected by the atomic dataref check in > > > skb_release_data(). What am I missing? > > > > Are you talking about the head frag? So normally a clone wouldn't > > cause an issue because the head isn't changed. In the case of the > > head_frag we should be safe since pskb_expand_head will just kmalloc > > the new head and clears head_frag so it won't trigger > > page_pool_return_skb_page on the head_frag since the dataref just goes > > from 2 to 1. > > > > The problem is that pskb_expand_head memcopies the page frags over and > > takes a reference on the pages. At that point you would have two skbs > > both pointing to the same set of pages and each one ready to call > > page_pool_return_skb_page on the pages at any time and possibly racing > > with the other. > > Ok let me make sure I get the idea properly. > When pskb_expand_head is called, the new dataref will be 1, but the > head_frag will be set to 0, in which case the recycling code won't be > called for that skb. > So you are mostly worried about a race within the context of > pskb_expand_skb() between copying the frags, releasing the previous head > and preparing the new one (on a cloned skb)? The race is between freeing the two skbs. So the original and the clone w/ the expanded head will have separate instances of the page. I am pretty certain there is a race if the two of them start trying to free the page frags at the same time. Thanks, - Alex