Fix two device-unregistration lifecycle bugs in devmem TCP bindings and
add netdevsim support plus selftests covering both RX and TX device
unregistration:
1. net: devmem: unmap dma_buf synchronously on queue uninstall
Synchronously unmap and detach binding->attachment under binding->lock
when the last RX queue is uninstalled in mp_dmabuf_devmem_uninstall()
or closed in net_devmem_unbind_dmabuf(), and unmap unbound RX bindings
whose queue failed to restart on NETDEV_UNREGISTER, preventing
slab-use-after-free in dma_unmap_sg_attrs() when the binding is freed
after dma_dev.
2. net: devmem: detach TX bindings on NETDEV_UNREGISTER
Extend net_devmem_dev_unregister() to fully detach and unmap TX
bindings when binding->dev unregisters, or clear binding->vdev alone
when only a virtual device unregisters while binding->dev lives.
3. netdevsim: support devmem RX and TX bindings
Enable PP_FLAG_DMA_MAP | PP_FLAG_ALLOW_UNREADABLE_NETMEM, 64-bit DMA mask
on nsim_bus_dev, and NETMEM_TX_DMA on netdevsim so devmem RX/TX bindings
can be exercised in software selftests.
4. selftests: net: add devmem RX and TX netdev unregister tests
Add devmem_bind_rx_unregister_check and devmem_bind_tx_unregister_check
to tools/testing/selftests/net/nl_netdev.py.
Cc: Tariq Toukan <tariqt@nvidia.com>
Cc: Kaifeng Wang <kaifengw@google.com>
Cc: Dragos Tatulea <dtatulea@nvidia.com>
---
v4:
- 1/4: Unmap RX bindings in net_devmem_unbind_dmabuf() once their queues
are closed, and make netif_mp_close_rxq() report queue restart
failures, so the NETDEV_UNREGISTER walk only handles bindings whose
queue failed to restart. Drop net_devmem_lock: walk the bindings under
the xarray lock and take the instance lock of binding->dev in the
final free. (Stanislav) Record a queue in bound_rxqs before opening
it. (Sashiko)
- 2/4: Detach and unmap TX bindings directly from the walk, without a
grace period or a second pass. (Stanislav)
- Link to v3: https://lore.kernel.org/netdev/20261014161754.3782346-1-almasrymina@google.com/
v3:
- 1/4: Run the NETDEV_UNREGISTER walk under the netdev instance lock,
and skip it when the device only moves to another netns. (Sashiko)
- 2/4: Detach all matching TX bindings, then synchronize_net() once
before unmapping them. (Sashiko)
- 3/4: Only request page pool DMA mapping with CONFIG_HAS_DMA, refuse
pp_hold on memory provider pools, and drop unreadable skbs in the
software PSP checksum path. (Sashiko)
- 4/4: Check only the test's dma-buf in debugfs, skip instead of passing
silently, clean up on errors, compute UDMABUF_CREATE per arch, and
add the needed config options. (Sashiko, Dragos)
- Link to v2: https://lore.kernel.org/netdev/20261012174300.2338784-1-almasrymina@google.com/
v2:
- 1/4: Don't unmap when a leased queue is unleased. Keep bindings in
net_devmem_dmabuf_bindings until freed, hidden from TX lookups by an
xarray mark, and unmap unbound RX bindings on NETDEV_UNREGISTER. Update
the binding->lock and binding->ref comments. (Sashiko)
- 2/4: Detach TX bindings from the same net_devmem_lock-protected walk,
which now also covers unbound TX bindings, and clear the LIVE mark
instead of erasing the ID. The walk no longer uses RCU or takes
binding references (Stanislav).
- Link to v1: https://lore.kernel.org/netdev/20261010025532.839559-1-almasrymina@google.com/
Mina Almasry (4):
net: devmem: unmap dma_buf synchronously on queue uninstall
net: devmem: detach TX bindings on NETDEV_UNREGISTER
netdevsim: support devmem RX and TX bindings
selftests: net: add devmem RX and TX netdev unregister tests
drivers/net/netdevsim/bus.c | 1 +
drivers/net/netdevsim/netdev.c | 27 +++-
drivers/net/netdevsim/psp.c | 5 +
include/net/page_pool/memory_provider.h | 4 +-
net/core/devmem.c | 157 +++++++++++++++++++----
net/core/devmem.h | 11 +-
net/core/netdev-genl.c | 1 +
net/core/netdev_rx_queue.c | 26 ++--
tools/testing/selftests/net/config | 4 +
tools/testing/selftests/net/nl_netdev.py | 125 +++++++++++++++++-
10 files changed, 314 insertions(+), 47 deletions(-)
base-commit: aa07285705f8d5bac464eb1c5b7412f8e88b91e1
--
2.56.0.176.g3575e65682-goog