[PATCH net-next v3 0/6] net: devmem: support leased RX and TX queues on netdev unregister

From: Mina Almasry

Date: Sat Nov 14 2026 - 21:26:28 EST


Support leased RX and TX devmem bindings when either the virtual device
(e.g. netkit) or the physical backing net_device is unregistered:

1. Pass struct net_device **dev_ptr to net_devmem_lock_dev() so callers
can lock either binding->map_dev or binding->bind_dev.
2. Rename binding->dev and binding->vdev to binding->map_dev (physical
DMA device) and binding->bind_dev (device passed to bind-rx/bind-tx).
3. Introduce netif_lease_valid() and guard netif_mp_open_rxq(),
netif_mp_close_rxq(), and netif_rxq_cleanup_unlease() against an
unregistering physical device reached through a queue lease.
4. Always populate bind_dev on RX and TX bindings and handle teardown
and netdev unregistration of both bind_dev and map_dev.
5. Resolve the physical backing map_dev in netdev_nl_get_dma_dev() for
leased RX bindings, lock map_dev around net_devmem_bind_dmabuf() on
bind-rx when map_dev differs from netdev, assert both devices are
locked, and check netif_lease_valid(map_dev).
6. Add kselftests in nl_netdev.py covering leased RX and TX devmem
bindings across both virtual-first and physical-first netdev
unregistration orders.

v3:
- Rebase onto latest net-next/main.
- Add netif_lease_valid() helper and keep lease validity checks in the
lease-aware callers (netif_mp_open_rxq(), netif_mp_close_rxq(),
netif_rxq_cleanup_unlease(), and net_devmem_bind_dmabuf()) rather than
inside __netif_mp_open_rxq() / __netif_mp_close_rxq(), and document why
mp_params is cleared directly when !netif_lease_valid(dev) (Stanislav,
Sashiko).
- Guard the bound_rxqs loop in net_devmem_unbind_dmabuf() with
if (binding->bind_dev), keep the !netif_is_queue_leasee(dev) guard in
net_devmem_dev_unregister() in patch 4/6 until patch 5/6 resolves
binding->map_dev to the physical device so the series is bisectable at
every commit, and document the use-after-free in dma_unmap_sg_attrs() on
physical netdev teardown in patch 5/6 (Sashiko).
- In nl_netdev.py, verify dmabuf and lease on the physical queue after
binding, skip when queue_create returns EOPNOTSUPP, probe the physical
device on EOPNOTSUPP so a broken lease lookup is not masked as SKIP, and
clean up nk_ifname between loop iterations (Sashiko).
- v2: https://lore.kernel.org/netdev/20261108055809.2122934-1-almasrymina@xxxxxxxxxx/

v2:
- Split patch 3/4 from v1 into 3 smaller commits (patches 3/6..5/6).
- Clear rxq->mp_params and return 0 in __netif_mp_close_rxq() whenever
dev is already unregistering, avoiding queue reconfiguration on an
already-shut-down map_dev during cascaded lease teardown (Sashiko).
- Drop unnecessary xa_erase() in net_devmem_unbind_dmabuf() and use a
local map_dev variable in net_devmem_get_binding() (Stanislav).
- Restore ASSERT_EXCLUSIVE_WRITER(binding->bind_dev) in
mp_dmabuf_devmem_uninstall(), drop redundant bind_dev->reg_state check
in net_devmem_bind_dmabuf(), and expand commit message rationale
(Dragos, Stanislav).
- v1: https://lore.kernel.org/netdev/20261103232659.1340283-1-almasrymina@xxxxxxxxxx/

Mina Almasry (6):
net: devmem: pass net_device pointer to net_devmem_lock_dev()
net: devmem: rename binding dev and vdev to map_dev and bind_dev
net: guard memory provider RX queue open and close on unregister
net: devmem: always populate bind_dev and detach both devices on
unregister
net: devmem: resolve physical map_dev for leased RX bindings
selftests: net: add leased devmem RX and TX netdev unregister tests

net/core/dev.c | 2 +-
net/core/dev.h | 7 +
net/core/devmem.c | 123 ++++++++++--------
net/core/devmem.h | 25 ++--
net/core/netdev-genl.c | 58 +++++----
net/core/netdev_rx_queue.c | 31 ++++-
tools/testing/selftests/net/nl_netdev.py | 159 ++++++++++++++++++++++-
7 files changed, 304 insertions(+), 101 deletions(-)


base-commit: 6964ff21c5d8b75649211a52dbfd92753e605649
--
2.56.0.611.g1030f0b940-goog