This is v5 of Corey's series [1]. It takes the PSE controller lookup out
of the MDIO probe path, so a modular PSE driver no longer makes the
PHY/DSA probe spin on -EPROBE_DEFER until the PSE module loads.
Patches 1-3 are the same three notifier patches as v4 [4], unchanged,
with Jonas's Tested-by. Patches 4 and 5 are new and fix two problems the
v4 review surfaced.
Patch 4: Aleksander reported [5] that v4 deadlocks on probe for an MDIO
bus registered from ndo_init (lantiq_etop, sni_ave, netsec): those
already hold rtnl via register_netdevice(), and v4's phy attach took
rtnl again underneath. Patch 4 swaps that rtnl for a dedicated mutex, so
the register path no longer recurses. The ethtool PSE paths take the
same mutex, so the use-after-free that rtnl used to close stays closed.
Aleksander confirmed it fixes his deadlock.
Patch 5: Paolo's review [6] pointed out that patch 3 defers the
pse_control_put() to phy_device_release(). A phy that is device_del()'d
but still pinned (an attached netdev) is off the mdio_bus_type klist, so
the PSE_UNREGISTERED notifier walk never clears its phydev->psec, and the
deferred put later touches a pcdev->pi[] the controller has already
freed. Patch 5 puts phydev->psec back in phy_device_remove(), which the
mutex from patch 4 now makes safe (the rtnl recursion that motivated the
deferral is gone), so the detach is synchronous and cannot outlive the
controller.
How it works: pse_core gets a notifier chain (REGISTERED / UNREGISTERED).
The phy layer subscribes, owns phydev->psec, and attaches the PSE handle
when the controller shows up instead of during probe. fwnode_mdio loses
its PSE awareness, so no -EPROBE_DEFER leaves it and the probe-retry loop
is gone.
Tested on a Realtek rtl93xx PoE switch with two HS104 PSE controllers on
i2c:
- clean boot, no probe-retry loop, no watchdog reset
- 10G SFP+ port: module hotplug works, no deadlock
- ethtool --set-pse enable/disable cuts and restores power to a PD
- i2c unbind -> rmmod -> modprobe: PSE detaches on unbind and re-attaches
on reload with power restored, no reboot. No lockdep splats.
Jonas confirmed the RTL8214FC deadlock he reported is gone. Aleksander
confirmed the lantiq_etop probe deadlock is gone.
Tested-by: Carlo Szelinsky <github@szelinsky.de>
Changes in v5:
- Add patch 4: replace rtnl with a dedicated mutex in the PSE attach
path, fixing the ndo_init probe deadlock Aleksander reported [5].
Tested-by Aleksander.
- Add patch 5: put phydev->psec back in phy_device_remove(), closing the
off-klist use-after-free Paolo raised [6].
- Patches 1-3 are unchanged.
Changes in v4:
- Add Tested-by from Jonas Jelonek. No code changes.
- Repost now that net-next has reopened (v3 was deferred during the
merge window).
Changes in v3:
- Drop patch 1 (regulator handle fix); it goes to net separately [2].
- Rebase on net-next. No code changes to the three patches.
v1 was an RFC by Corey [3].
[1] https://lore.kernel.org/netdev/20260620112440.1734404-1-github@szelinsky.de/
[2] https://lore.kernel.org/netdev/20260624204017.2752934-1-github@szelinsky.de/
[3] https://lore.kernel.org/netdev/20260423-pse-notifier-decouple-v1-0-86ed750a9d62@leavitt.info/
[4] https://lore.kernel.org/netdev/20260630091125.3162481-1-github@szelinsky.de/
[5] https://lore.kernel.org/netdev/bac5e6e9-7358-4ccb-87fc-9c40baa33682@wp.pl/
[6] https://lore.kernel.org/netdev/20260703071025.100797-1-pabeni@redhat.com/
Carlo Szelinsky (2):
net: phy: use a dedicated mutex instead of rtnl for PSE control attach
net: phy: release phydev->psec from phy_device_remove() again
Corey Leavitt (3):
net: pse-pd: add notifier chain for controller lifecycle events
net: pse-pd: fire lifecycle events on controller register/unregister
net: phy: own phydev->psec via PSE notifier and remove fwnode_mdio
hook
drivers/net/mdio/fwnode_mdio.c | 34 ------
drivers/net/phy/phy_device.c | 186 ++++++++++++++++++++++++++++++++-
drivers/net/phy/sfp.c | 2 +-
drivers/net/pse-pd/pse_core.c | 54 ++++++++++
include/linux/phy.h | 4 +
include/linux/pse-pd/pse.h | 41 ++++++++
net/ethtool/pse-pd.c | 15 ++-
7 files changed, 292 insertions(+), 44 deletions(-)
base-commit: cef9d6804030793cf8b8796fd6936197d065dd3e
--
2.43.0