Re: [PATCH net-next v11 00/14] netkit: Support for io_uring zero-copy and AF_XDP

Daniel Borkmann
2026-04-07T09:50:58Z

Hi Jakub,

On 4/3/26 1:10 AM, Daniel Borkmann wrote:
> Containers use virtual netdevs to route traffic from a physical netdev
> in the host namespace. They do not have access to the physical netdev
> in the host and thus can't use memory providers or AF_XDP that require
> reconfiguring/restarting queues in the physical netdev.
>
> This patchset adds the concept of queue leasing to virtual netdevs that
> allow containers to use memory providers and AF_XDP at native speed.
> Leased queues are bound to a real queue in a physical netdev and act
> as a proxy.
>
> Memory providers and AF_XDP operations take an ifindex and queue id,
> so containers would pass in an ifindex for a virtual netdev and a queue
> id of a leased queue, which then gets proxied to the underlying real
> queue.
>
> We have implemented support for this concept in netkit and tested the
> latter against Nvidia ConnectX-6 (mlx5) as well as Broadcom BCM957504
> (bnxt_en) 100G NICs. For more details see the individual patches.
>
> v10->v11:
> - Fix missing mp_ops->uninstall upon unlease path (Gemini)
> - Fix dma device retrieval on tx queue when rx queue is leased (Gemini)
> - Rework ethtool channel checks to check rx/tx individually (Gemini)
> - The remainder of the Gemini findings were non-issues
> - Add more extensive net selftests around queue leasing corner cases
> - Rebase and retested everything with mlx5 + bnxt_en
I've look into the latest v11 findings from Gemini in the meantime, and
thought I'd share an update/comments related to them:

https://sashiko.dev/#/patchset/20260402231031.447597-1-daniel%40iogearbox.net

From all the claims related to the series, the one in the netkit device dump
looks reasonable to improve, iow, to not dump IFLA_NETKIT_SCRUB if in single
mode since we also reject the presence of the attribute during device creation,
change would look like:

- if (nla_put_u32(skb, IFLA_NETKIT_SCRUB, nk->scrub))
- return -EMSGSIZE;
+ if (nk->pair != NETKIT_DEVICE_SINGLE &&
+ nla_put_u32(skb, IFLA_NETKIT_SCRUB, nk->scrub))
+ return -EMSGSIZE;

Anyway, wrt the individual patch comments from Gemini:

Patch 2:
- The capable(CAP_NET_ADMIN) is intentional
Patch 6:
- Solved in your patch which is a good thing to do
https://patchwork.kernel.org/project/netdevbpf/patch/20260404001938.2425670-1-kuba@kernel.org/
-> Iiuc, its unreachable today due to other guards, but an explicit check
would definitely cement that
- The second double free or use-after-free on unregistered devices claim is
not true, there is an inconsistency in the io_uring vs devmem wrt clearing
mp_ops to NULL but the code handles both cases correctly
Patch 7:
- Independent of the series; oob queue index in io_uring/zcrx claims that
there is no bounds-check against real_num_rx_queues before being passed
to netdev_queue_get_dma_dev and from there into ndo_queue_get_dma_dev
callback
-> mlx5e_queue_get_dma_dev as the only implementation does bounds check
internally, it might make sense to have a guard in the core code if
more drivers implement the ndo_queue_get_dma_dev
- Order-dependent DMA dev validation in netdev_nl_get_dma_dev claim cannot
override memory provider state, mixed cases get rejected
Patch 9:
- Intentional, netkit proxies all xsk operations to the phys device
Patch 10:
- Above diff to not dump IFLA_NETKIT_SCRUB makes sense to me
- The changelink operations claim further below is intentional and for now
rejected with -EOPNOTSUPP given nothing new can be configured here
Patch 11:
- netkit notifier takes care of this and is part of this series

Some cases in patch 6 and 7 that don't require a specific driver are worth additional
tracking in the netkit leasing selftests to asset behavior though. Happy to fold that
+ the IFLA_NETKIT_SCRUB diff above into a v12 or as a follow-up, let me know.

Thanks a lot,
Daniel