Re: [PATCH net-next 09/10] net: devmem: add netdev_has_dmabuf_binding() helper

[Mina Almasry]

On Thu, Oct 8, 2026 at 6:28 AM Tariq Toukan <tariqt@xxxxxxxxxx> wrote:
> From: Dragos Tatulea <dtatulea@xxxxxxxxxx>
>
> A binding can outlive its xarray slot: it can still be referenced by
> in-flight TX skbs, whose DMA mappings are only valid for the device the
> dmabuf was attached to. Reporting such a binding as gone would let a
> driver swap the DMA device out from under those skbs. For this reason,
> track bindings for their whole lifetime on a new list.

(Note: LLM-assisted review comment below.)

Two suggestions on the core design here:

1. Add a synchronous DMA detach helper (e.g. netdev_unbind_dmabuf_dma_dev(dev,
   dma_dev)) alongside netdev_has_dmabuf_binding() so patch 08/10 can cleanly
   tear down active bindings on MLX5_DATA_DIRECT_UNBIND:
   - Separate DMA mapping lifetime (ends synchronously when queues stop and
     dev/vdev/dma_dev goes away) from CPU net_iov lifetime (ends in
     __net_devmem_dmabuf_binding_free() when binding->ref hits 0).
   - For bindings matching (dev, binding->attachment->dev == dma_dev), close
     bound RX queues (netif_mp_close_rxq()), erase binding->id from
     net_devmem_dmabuf_bindings, clear WRITE_ONCE(binding->dev, NULL) /
     WRITE_ONCE(binding->vdev, NULL), call synchronize_net(), and unmap/detach
     binding->sgt and binding->attachment synchronously (setting them to NULL
     so __net_devmem_dmabuf_binding_free() skips them later).
   - Note: core devmem also has a pre-existing bug on physical/virtual
     NETDEV_UNREGISTER where mp_dmabuf_devmem_uninstall() and TX bindings leave
     dma_buf mapped past pci_driver->remove() and TX bindings leave
     binding->dev / binding->vdev dangling; sharing a single core detach
     helper solves both cleanly with zero new fields in
     struct net_devmem_dmabuf_binding.

2. Once detach (and net_devmem_unbind_dmabuf() on TX unbind) clears
   WRITE_ONCE(binding->dev, NULL), runs synchronize_net(), and unmaps
   binding->sgt synchronously, any binding already erased from
   net_devmem_dmabuf_bindings is already DMA-unmapped and rejected by
   validate_xmit_unreadable_skb() (READ_ONCE(binding->dev) != dev). That
   eliminates the need for net_devmem_live_bindings_lock / live_list —
   iterating net_devmem_dmabuf_bindings under netdev_lock(dev) suffices for
   both netdev_has_dmabuf_binding() and netdev_unbind_dmabuf_dma_dev().

-- 
Thanks,
Mina