Claude review: net: devmem: allow rx-buf-size > PAGE_SIZE per dmabuf binding

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

This is the core patch. The generalization from PAGE_SHIFT to `binding->niov_shift` is mechanically correct throughout.

**Substantive issues:**

1. **Missing upper bound on `rx_buf_size` in kernel validation:**

```c
if (!rx_buf_size || !is_power_of_2(rx_buf_size) ||
    rx_buf_size < PAGE_SIZE) {
    NL_SET_ERR_MSG(info->extack,
                   "rx_buf_size must be a power of 2 >= PAGE_SIZE");
    return -EINVAL;
}
```

There is no upper bound check. A user could pass `rx_buf_size = 2^31` (the largest power-of-two u32), producing `niov_shift = 31`. While this will likely fail later at the sg dma_addr/len alignment check, it's a confusing late error. Consider adding an upper bound here (the selftest enforces 2MB, the kernel should too, or at least something reasonable). This would also produce a clearer `NL_SET_ERR_MSG`.

2. **`mp_dmabuf_devmem_init` error code change:**

```c
-	if (pool->p.order != 0)
-		return -E2BIG;
+	if (pool->p.order != binding->niov_shift - PAGE_SHIFT)
+		return -EINVAL;
```

The change from `-E2BIG` to `-EINVAL` is a UAPI behavior change. If any existing userspace checks for `E2BIG` specifically, this would break. This is probably fine since the only consumer is the in-kernel page pool infrastructure, but worth a note in the commit message.

3. **`net_iov_virtual_addr` introduces a new local variable that's only partially used:**

```c
+	struct dmabuf_genpool_chunk_owner *co =
+		net_devmem_iov_to_chunk_owner(niov);
 
-	return owner->base_virtual +
-	       ((unsigned long)net_iov_idx(niov) << PAGE_SHIFT);
+	return net_iov_owner(niov)->base_virtual +
+	       ((unsigned long)net_iov_idx(niov) << co->binding->niov_shift);
```

`co` is introduced for `co->binding->niov_shift`, but `net_iov_owner(niov)` is called separately. Since `co` contains the `area` (which is the `net_iov_owner` result), this could just use `co->area.base_virtual` for consistency instead of calling `net_iov_owner()` again.

4. **`netdev-genl-gen.c` is auto-generated code.** The hand edits to the policy table should be verified by regenerating from the updated `netdev.yaml` spec. If the codegen produces different output, the patch should use the generated version.

**Minor/style:**

5. The `net_devmem_bind_dmabuf` signature diff shows reordering of `unsigned int sg_idx, i;` to `unsigned int sg_idx, i;` with changed whitespace/ordering. This is a no-op change that adds noise.

---
Generated by Claude Code Patch Reviewer