[PATCH net-next v6 0/5] net: pse-pd: decouple controller lookup from MDIO probe
From: Carlo Szelinsky <hidden>
Date: 2026-09-06 15:39:40
This is v6 of Corey's series [1]. It takes the PSE controller lookup out
of the MDIO probe path, so a modular PSE driver no longer makes the
PHY/DSA probe spin on -EPROBE_DEFER until the PSE module loads.
Patches 1-3 are the same three notifier patches as v4 [4], unchanged,
with Jonas's Tested-by. Patches 4 and 5 fix two problems the v4 review
surfaced; v6 additionally fixes a build regression in v5 [7]'s patch 4.
Patch 4: Aleksander reported [5] that v4 deadlocks on probe for an MDIO
bus registered from ndo_init (lantiq_etop, sni_ave, netsec): those
already hold rtnl via register_netdevice(), and v4's phy attach took rtnl
again underneath. Patch 4 swaps that rtnl for a dedicated mutex, so the
register path no longer recurses. The ethtool PSE paths take the same
mutex, so the use-after-free that rtnl used to close stays closed. The
mutex lives in pse_core rather than phylib: net/ethtool is always built
into vmlinux but PHYLIB is tristate, so with CONFIG_PHYLIB=m or =n a
phylib export is unresolved (v5 failed to link there [8]); PSE_CONTROLLER
is bool, so pse_core is always reachable.
Patch 5: Paolo's review [6] pointed out that patch 3 defers the
pse_control_put() to phy_device_release(). A phy that is device_del()'d
but still pinned (an attached netdev) is off the mdio_bus_type klist, so
the PSE_UNREGISTERED notifier walk never clears its phydev->psec, and the
deferred put later touches a pcdev->pi[] the controller has already
freed. Patch 5 puts phydev->psec back in phy_device_remove(), which the
mutex from patch 4 now makes safe (the rtnl recursion that motivated the
deferral is gone), so the detach is synchronous and cannot outlive the
controller.
How it works: pse_core gets a notifier chain (REGISTERED / UNREGISTERED).
The phy layer subscribes, owns phydev->psec, and attaches the PSE handle
when the controller shows up instead of during probe. fwnode_mdio loses
its PSE awareness, so no -EPROBE_DEFER leaves it and the probe-retry loop
is gone.
Tested on a Realtek rtl93xx PoE switch with two HS104 PSE controllers on
i2c:
- clean boot, no probe-retry loop, no watchdog reset
- 10G SFP+ port: module hotplug works, no deadlock
- ethtool --set-pse enable/disable cuts and restores power to a PD
- i2c unbind -> rmmod -> modprobe: PSE detaches on unbind and re-attaches
on reload with power restored, no reboot. No lockdep splats.
Jonas confirmed the RTL8214FC deadlock he reported is gone. Aleksander
confirmed the lantiq_etop probe deadlock is gone at boot.
Tested-by: Carlo Szelinsky <redacted>
Changes in v6:
- Fix a build regression in v5: net/ethtool/pse-pd.c called the phylib
export phy_pse_control_lock(), but net/ethtool is always in vmlinux
while PHYLIB is tristate, so CONFIG_PHYLIB=m or =n failed to link. Move
the mutex into pse_core (PSE_CONTROLLER is bool) and reach it through
pse_phy_lock() / pse_phy_unlock(), with no-op stubs for
!PSE_CONTROLLER. Folded into patch 4; no functional change. Reported by
the kernel test robot [8] and by OpenWrt CI.
- Fold phy_device_register_locked() back into phy_device_register(): with
the attach no longer taking rtnl the two are identical.
- Patches 1-3 unchanged.
Changes in v5:
- Add patch 4: replace rtnl with a dedicated mutex in the PSE attach
path, fixing the ndo_init probe deadlock Aleksander reported [5].
- Add patch 5: put phydev->psec back in phy_device_remove(), closing the
off-klist use-after-free Paolo raised [6].
- Patches 1-3 unchanged.
Changes in v4:
- Add Tested-by from Jonas Jelonek. No code changes.
- Repost now that net-next has reopened (v3 was deferred during the
merge window).
Changes in v3:
- Drop patch 1 (regulator handle fix); it goes to net separately [2].
- Rebase on net-next. No code changes to the three patches.
v1 was an RFC by Corey [3].
[1] https://lore.kernel.org/netdev/20260620112440.1734404-1-github@szelinsky.de/
[2] https://lore.kernel.org/netdev/20260624204017.2752934-1-github@szelinsky.de/
[3] https://lore.kernel.org/netdev/20260423-pse-notifier-decouple-v1-0-86ed750a9d62@leavitt.info/
[4] https://lore.kernel.org/netdev/20260630091125.3162481-1-github@szelinsky.de/
[5] https://lore.kernel.org/netdev/bac5e6e9-7358-4ccb-87fc-9c40baa33682@wp.pl/
[6] https://lore.kernel.org/netdev/20260703071025.100797-1-pabeni@redhat.com/
[7] https://lore.kernel.org/netdev/20260826220344.121865-1-github@szelinsky.de/
[8] https://lore.kernel.org/oe-kbuild-all/202608302204.fr1FGYBF-lkp@intel.com/
Carlo Szelinsky (2):
net: phy: use a dedicated mutex instead of rtnl for PSE control attach
net: phy: release phydev->psec from phy_device_remove() again
Corey Leavitt (3):
net: pse-pd: add notifier chain for controller lifecycle events
net: pse-pd: fire lifecycle events on controller register/unregister
net: phy: own phydev->psec via PSE notifier and remove fwnode_mdio
hook
drivers/net/mdio/fwnode_mdio.c | 34 ----------
drivers/net/phy/phy_device.c | 119 ++++++++++++++++++++++++++++++++-
drivers/net/pse-pd/pse_core.c | 100 +++++++++++++++++++++++++++
include/linux/pse-pd/pse.h | 64 ++++++++++++++++++
net/ethtool/pse-pd.c | 16 +++--
5 files changed, 293 insertions(+), 40 deletions(-)
base-commit: cef9d6804030793cf8b8796fd6936197d065dd3e
--
2.43.0