Re: [RFC PATCH net-next 3/9] net: pcs: Add helpers for registering and finding PCSs

[Sean Anderson]

On 7/12/22 11:51 AM, Russell King (Oracle) wrote:
> On Mon, Jul 11, 2022 at 05:47:26PM -0400, Sean Anderson wrote:
>> Hi Russell,
>> 
>> On 7/11/22 4:59 PM, Russell King (Oracle) wrote:
>> > Hi Sean,
>> > 
>> > It's a good attempt and may be nice to have, but I'm afraid the
>> > implementation has a flaw to do with the lifetime of data structures
>> > which always becomes a problem when we have multiple devices being
>> > used in aggregate.
>> > 
>> > On Mon, Jul 11, 2022 at 12:05:13PM -0400, Sean Anderson wrote:
>> >> +/**
>> >> + * pcs_get_tail() - Finish getting a PCS
>> >> + * @pcs: The PCS to get, or %NULL if one could not be found
>> >> + *
>> >> + * This performs common operations necessary when getting a PCS (chiefly
>> >> + * incrementing reference counts)
>> >> + *
>> >> + * Return: @pcs, or an error pointer on failure
>> >> + */
>> >> +static struct phylink_pcs *pcs_get_tail(struct phylink_pcs *pcs)
>> >> +{
>> >> +	if (!pcs)
>> >> +		return ERR_PTR(-EPROBE_DEFER);
>> >> +
>> >> +	if (!try_module_get(pcs->ops->owner))
>> >> +		return ERR_PTR(-ENODEV);
>> > 
>> > What you're trying to prevent here is the PCS going away - but holding a
>> > reference to the module doesn't prevent that with the driver model. The
>> > driver model design is such that a device can be unbound from its driver
>> > at any moment. Taking a reference to the module doesn't prevent that,
>> > all it does is ensure that the user can't remove the module. It doesn't
>> > mean that the "pcs" structure will remain allocated.
>> 
>> So how do things like (serdes) phys work? Presumably the same hazard
>> occurs any time a MAC uses a phy, because the phy can disappear at any time.
>> 
>> As it happens I can easily trigger an Oops by unbinding my serdes driver
>> and the plugging in an ethernet cable. Presumably this means that the phy
>> subsystem needs the devlink treatment? There are already several in-tree
>> MAC drivers using phys...
> 
> It's sadly another example of this kind of thing. When you consider
> that the system should operate in a safe manner with as few "gotchas"
> as possible, then being able to "easily trigger an Oops" is something
> that we should be avoiding. It's not hard to avoid - we have multiple
> mechanisms in the kernel now to deal with it. 

OK, so as mentioned above this exists in several MAC drivers already. How do
you propose to fix this?

> We have the component
> helper. We have devlinks. We can come up with other solutions such
> as what I mentioned in my previous reply (which I consider to be the
> superior solution in this case - because it doesn't mess up cases
> where a single struct device is associated with multiple network
> devices (such as on Armada 8040 based systems.)
> 
> It's really about "Quality of Implementation" - and I expect high
> quality. I don't want my systems crashing because I've tried to
> temporarily unbind some device.
> 
>> > The second issue that this creates is if a MAC driver creates the PCS
>> > and then "gets" it through this interface, then the MAC driver module
>> > ends up being locked in until the MAC driver devices are all unbound,
>> > which isn't friendly at all.
>> 
>> The intention here is not to use this for "internal" PCSs, but only for
>> external ones. I suppose you're referring to 
> 
> I wish I could say that intentions for use bear the test of time, but
> sadly I can not.

Well, we can burn that bridge when we come to it. For now, yes if you call
pcs_get_by_* from the same device where you call pcs_register then the device
will be "locked in".

>> > So, anything that proposes to create a new subsystem where we have
>> > multiple devices that make up an aggregate device needs to nicely cope
>> > with any of those devices going away. For that to happen in this
>> > instance, phylink would need to know that its in-use PCS for a
>> > particular MAC is going away, then it could force the link down before
>> > removing all references to the PCS device.
>> > 
>> > Another solution would be devlinks, but I am really not a fan of that
>> > when there may be a single struct device backing multiple network
>> > interfaces, where some of them may require PCS and others do not. One
>> > wouldn't want the network interface with nfs-root to suddenly go away
>> > because a PCS was unbound from its driver!
>> 
>> Well, you can also do
>> 
>> echo "mmc0:0001" > /sys/bus/mmc/drivers/mmcblk/unbind
>> 
>> which will (depending on your system) have the same effect.
>> 
>> If being able to unbind any driver at any time is intended,
>> then I don't think we can save userspace from itself.
> 
> If you unbind the device that contains your rootfs, you are absolutely
> correct. It's the same as taking down the network interface that gives
> you access to your NFS root.
> 
> However, neither of these cause the kernel to crash - they make
> userspace unusable.
> 
> So, let's say that it is acceptable that the kernel crashes if one
> unbinds a device. Why then bother with try_module_get() - if the user
> is silly enough to remove the module containing the PCS code, doesn't
> the same argument apply? "Shouldn't have done that then."
> 
> I don't see the logic.
> 

This was in response to your opposition to using devlink to manage the
PCS, since it would unbind the MAC as well. So what would happen here is
that someone would unbind the PCS, which would in turn unbind the MAC,
having the same effect as if the user manually unbound the MAC directly.

If you really want to avoid this, we'd need some kind of callback from
devlink to allow the MAC to say "well, I wasn't using that PCS anyway,"
or at the very least "let me clean up this (soon-to-be) dangling pointer."

--Sean