This is v6 of Corey's series [1]. It takes the PSE controller lookup out
of the MDIO probe path, so a modular PSE driver no longer makes the
PHY/DSA probe spin on -EPROBE_DEFER until the PSE module loads.

Patches 1-3 are the same three notifier patches as v4 [4], unchanged,
with Jonas's Tested-by. Patches 4 and 5 fix two problems the v4 review
surfaced; v6 additionally fixes a build regression in v5 [7]'s patch 4.

Patch 4: Aleksander reported [5] that v4 deadlocks on probe for an MDIO
bus registered from ndo_init (lantiq_etop, sni_ave, netsec): those
already hold rtnl via register_netdevice(), and v4's phy attach took rtnl
again underneath. Patch 4 swaps that rtnl for a dedicated mutex, so the
register path no longer recurses. The ethtool PSE paths take the same
mutex, so the use-after-free that rtnl used to close stays closed. The
mutex lives in pse_core rather than phylib: net/ethtool is always built
into vmlinux but PHYLIB is tristate, so with CONFIG_PHYLIB=m or =n a
phylib export is unresolved (v5 failed to link there [8]); PSE_CONTROLLER
is bool, so pse_core is always reachable.

Patch 5: Paolo's review [6] pointed out that patch 3 defers the
pse_control_put() to phy_device_release(). A phy that is device_del()'d
but still pinned (an attached netdev) is off the mdio_bus_type klist, so
the PSE_UNREGISTERED notifier walk never clears its phydev->psec, and the
deferred put later touches a pcdev->pi[] the controller has already
freed. Patch 5 puts phydev->psec back in phy_device_remove(), which the
mutex from patch 4 now makes safe (the rtnl recursion that motivated the
deferral is gone), so the detach is synchronous and cannot outlive the
controller.

How it works: pse_core gets a notifier chain (REGISTERED / UNREGISTERED).
The phy layer subscribes, owns phydev->psec, and attaches the PSE handle
when the controller shows up instead of during probe. fwnode_mdio loses
its PSE awareness, so no -EPROBE_DEFER leaves it and the probe-retry loop
is gone.

Tested on a Realtek rtl93xx PoE switch with two HS104 PSE controllers on
i2c:

 - clean boot, no probe-retry loop, no watchdog reset
 - 10G SFP+ port: module hotplug works, no deadlock
 - ethtool --set-pse enable/disable cuts and restores power to a PD
 - i2c unbind -> rmmod -> modprobe: PSE detaches on unbind and re-attaches
   on reload with power restored, no reboot. No lockdep splats.

Jonas confirmed the RTL8214FC deadlock he reported is gone. Aleksander
confirmed the lantiq_etop probe deadlock is gone at boot.

Tested-by: Carlo Szelinsky <github@szelinsky.de>

Changes in v6:
 - Fix a build regression in v5: net/ethtool/pse-pd.c called the phylib
   export phy_pse_control_lock(), but net/ethtool is always in vmlinux
   while PHYLIB is tristate, so CONFIG_PHYLIB=m or =n failed to link. Move
   the mutex into pse_core (PSE_CONTROLLER is bool) and reach it through
   pse_phy_lock() / pse_phy_unlock(), with no-op stubs for
   !PSE_CONTROLLER. Folded into patch 4; no functional change. Reported by
   the kernel test robot [8] and by OpenWrt CI.
 - Fold phy_device_register_locked() back into phy_device_register(): with
   the attach no longer taking rtnl the two are identical.
 - Patches 1-3 unchanged.

Changes in v5:
 - Add patch 4: replace rtnl with a dedicated mutex in the PSE attach
   path, fixing the ndo_init probe deadlock Aleksander reported [5].
 - Add patch 5: put phydev->psec back in phy_device_remove(), closing the
   off-klist use-after-free Paolo raised [6].
 - Patches 1-3 unchanged.

Changes in v4:
 - Add Tested-by from Jonas Jelonek. No code changes.
 - Repost now that net-next has reopened (v3 was deferred during the
   merge window).

Changes in v3:
 - Drop patch 1 (regulator handle fix); it goes to net separately [2].
 - Rebase on net-next. No code changes to the three patches.

v1 was an RFC by Corey [3].

[1] https://lore.kernel.org/netdev/20260620112440.1734404-1-github@szelinsky.de/
[2] https://lore.kernel.org/netdev/20260624204017.2752934-1-github@szelinsky.de/
[3] https://lore.kernel.org/netdev/20260423-pse-notifier-decouple-v1-0-86ed750a9d62@leavitt.info/
[4] https://lore.kernel.org/netdev/20260630091125.3162481-1-github@szelinsky.de/
[5] https://lore.kernel.org/netdev/bac5e6e9-7358-4ccb-87fc-9c40baa33682@wp.pl/
[6] https://lore.kernel.org/netdev/20260703071025.100797-1-pabeni@redhat.com/
[7] https://lore.kernel.org/netdev/20260826220344.121865-1-github@szelinsky.de/
[8] https://lore.kernel.org/oe-kbuild-all/202608302204.fr1FGYBF-lkp@intel.com/

Carlo Szelinsky (2):
  net: phy: use a dedicated mutex instead of rtnl for PSE control attach
  net: phy: release phydev->psec from phy_device_remove() again

Corey Leavitt (3):
  net: pse-pd: add notifier chain for controller lifecycle events
  net: pse-pd: fire lifecycle events on controller register/unregister
  net: phy: own phydev->psec via PSE notifier and remove fwnode_mdio
    hook

 drivers/net/mdio/fwnode_mdio.c |  34 ----------
 drivers/net/phy/phy_device.c   | 119 ++++++++++++++++++++++++++++++++-
 drivers/net/pse-pd/pse_core.c  | 100 +++++++++++++++++++++++++++
 include/linux/pse-pd/pse.h     |  64 ++++++++++++++++++
 net/ethtool/pse-pd.c           |  16 +++--
 5 files changed, 293 insertions(+), 40 deletions(-)


base-commit: cef9d6804030793cf8b8796fd6936197d065dd3e
--
2.43.0

On 9/6/26 5:30 PM, Carlo Szelinsky wrote:
> This is v6 of Corey's series [1]. It takes the PSE controller lookup out
> of the MDIO probe path, so a modular PSE driver no longer makes the
> PHY/DSA probe spin on -EPROBE_DEFER until the PSE module loads.
> 
> Patches 1-3 are the same three notifier patches as v4 [4], unchanged,
> with Jonas's Tested-by. Patches 4 and 5 fix two problems the v4 review
> surfaced; v6 additionally fixes a build regression in v5 [7]'s patch 4.
> 
> Patch 4: Aleksander reported [5] that v4 deadlocks on probe for an MDIO
> bus registered from ndo_init (lantiq_etop, sni_ave, netsec): those
> already hold rtnl via register_netdevice(), and v4's phy attach took rtnl
> again underneath. Patch 4 swaps that rtnl for a dedicated mutex, so the
> register path no longer recurses. The ethtool PSE paths take the same
> mutex, so the use-after-free that rtnl used to close stays closed. The
> mutex lives in pse_core rather than phylib: net/ethtool is always built
> into vmlinux but PHYLIB is tristate, so with CONFIG_PHYLIB=m or =n a
> phylib export is unresolved (v5 failed to link there [8]); PSE_CONTROLLER
> is bool, so pse_core is always reachable.
> 
> Patch 5: Paolo's review [6] pointed out that patch 3 defers the
> pse_control_put() to phy_device_release(). A phy that is device_del()'d
> but still pinned (an attached netdev) is off the mdio_bus_type klist, so
> the PSE_UNREGISTERED notifier walk never clears its phydev->psec, and the
> deferred put later touches a pcdev->pi[] the controller has already
> freed. Patch 5 puts phydev->psec back in phy_device_remove(), which the
> mutex from patch 4 now makes safe (the rtnl recursion that motivated the
> deferral is gone), so the detach is synchronous and cannot outlive the
> controller.
> 
> How it works: pse_core gets a notifier chain (REGISTERED / UNREGISTERED).
> The phy layer subscribes, owns phydev->psec, and attaches the PSE handle
> when the controller shows up instead of during probe. fwnode_mdio loses
> its PSE awareness, so no -EPROBE_DEFER leaves it and the probe-retry loop
> is gone.
> 
> Tested on a Realtek rtl93xx PoE switch with two HS104 PSE controllers on
> i2c:
> 
>  - clean boot, no probe-retry loop, no watchdog reset
>  - 10G SFP+ port: module hotplug works, no deadlock
>  - ethtool --set-pse enable/disable cuts and restores power to a PD
>  - i2c unbind -> rmmod -> modprobe: PSE detaches on unbind and re-attaches
>    on reload with power restored, no reboot. No lockdep splats.
> 
> Jonas confirmed the RTL8214FC deadlock he reported is gone. Aleksander
> confirmed the lantiq_etop probe deadlock is gone at boot.
> 
> Tested-by: Carlo Szelinsky <github@szelinsky.de>
A bunch of 'high prio' sashiko reported issues are actually fixed by
patch 5/5, so IMHO not very relevant. Still I think there are a few
points to act upon.

@Carlo: please have a look at commit
c82ff94592fb68f529afe63ca7f5ddb7dae4ba83: you are supposed to reply to
LLM's comments.

/P