[RFC PATCH 4/8] driver core: Register opted-in devices through the staged sysfs path

[Pavol Sakac]

dev_set_sysfs_staged() opts a device in to staged registration before
device_add(). struct device gains one flag, DEV_FLAG_SYSFS_STAGED, in
the existing flags bitmap, so the struct does not grow.

device_add() stays a single code path with a staged bracket: it arms
staged creation once the parent kobject is resolved, everything it builds
in between lands in the staged subtree through unchanged code, and after
device_pm_add() sysfs_publish_dir() makes the whole subtree visible in
one step, before anything announces the device. bus_add_device() defers
its bus-klist insertion until just after publication, because
driver_attach() walks that klist and must not see a not-yet-published
device.

A class device with no parent lands under a class glue directory and
needs no special casing: cleanup_glue_dir() cannot see a staged child
through kobject_has_children(), but since commit ac43432cb1f5 ("driver
core: Fix use-after-free and double free on glue directory") that gate
also requires the caller's reference to be the last one, and a staged
device holds two.

Two transients are new and bounded. A symlink pointing at this device
from an already-published directory resolves -ENOENT until publication,
and an eager device_add() nested under the still-staged device fires its
KOBJ_ADD before its own path resolves. Neither opt-in reaches that
second case; code the opt-in caller does not control can, through the
two wakeup-source routes named in the uevent-deferral patch. Both close
at publication, before the ancestor's own KOBJ_ADD. The symlink
transient announces nothing; the nested child's KOBJ_ADD does announce
a path that does not yet resolve, and a later commit defers and replays
exactly these events. Opt-in is therefore appropriate for devices
whose nested children, if any, tolerate being fully registered,
enumerable and bindable, while their sysfs tree is not yet visible.

Publish-side code reads the kobject's sd_staged snapshot rather than this
flag, which is free to change once device_add() has sampled it.

Assisted-by: LLM
Signed-off-by: Pavol Sakac <sakacpav@xxxxxxxxx>
---
 drivers/base/base.h    |  1 +
 drivers/base/bus.c     | 29 ++++++++++++++++++++++++++++-
 drivers/base/core.c    | 27 +++++++++++++++++++++++++++
 include/linux/device.h | 11 +++++++++++
 4 files changed, 67 insertions(+), 1 deletion(-)

diff --git a/drivers/base/base.h b/drivers/base/base.h
index f5d608f4aaa5..5c8266dad7f8 100644
--- a/drivers/base/base.h
+++ b/drivers/base/base.h
@@ -157,6 +157,7 @@ static inline void auxiliary_bus_init(void) { }
 struct kobject *virtual_device_parent(void);
 
 int bus_add_device(struct device *dev);
+void bus_add_device_publish(struct device *dev);
 void bus_probe_device(struct device *dev);
 void bus_remove_device(struct device *dev);
 void bus_notify(struct device *dev, enum bus_notifier_event value);
diff --git a/drivers/base/bus.c b/drivers/base/bus.c
index d17bd91490ee..f5af3b1e2ee3 100644
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -588,7 +588,16 @@ int bus_add_device(struct device *dev)
 	if (error)
 		goto out_subsys;
 
-	klist_add_tail(&dev->p->knode_bus, &sp->klist_devices);
+	/*
+	 * A staged device must not appear on the bus klist (walked by
+	 * driver_attach()) until it has been published, or a driver could bind
+	 * to a not-yet-visible device.  Defer the insertion to
+	 * bus_add_device_publish().  The sp reference taken above is held until
+	 * device removal in both cases, and bus_remove_device() already
+	 * tolerates a never-inserted knode_bus via klist_node_attached().
+	 */
+	if (!kobject_sd_staged(&dev->kobj))
+		klist_add_tail(&dev->p->knode_bus, &sp->klist_devices);
 	return 0;
 
 out_subsys:
@@ -603,6 +612,24 @@ int bus_add_device(struct device *dev)
 	return error;
 }
 
+/**
+ * bus_add_device_publish - finish bus registration deferred past publication
+ * @dev: the now-published staged device
+ *
+ * Performs the bus klist insertion bus_add_device() deferred for a staged
+ * device; see the comment there.
+ */
+void bus_add_device_publish(struct device *dev)
+{
+	struct subsys_private *sp = bus_to_subsys(dev->bus);
+
+	if (!sp)
+		return;
+
+	klist_add_tail(&dev->p->knode_bus, &sp->klist_devices);
+	subsys_put(sp);
+}
+
 /**
  * bus_probe_device - probe drivers for a new device
  * @dev: device to probe
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 5dea641cbdb6..caba5610a04d 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -3740,6 +3740,14 @@ int device_add(struct device *dev)
 	if (kobj)
 		dev->kobj.parent = kobj;
 
+	/*
+	 * Glue-dir parents are safe: cleanup_glue_dir() only reaps a glue
+	 * dir whose kref is 1, and this device holds a glue-dir reference
+	 * from get_device_parent() for the whole staged window.  Assigned
+	 * unconditionally so a reused kobject cannot carry a stale bit.
+	 */
+	kobject_set_sd_staged(&dev->kobj, dev_sysfs_staged(dev));
+
 	/* use parent numa_node */
 	if (parent && (dev_to_node(dev) == NUMA_NO_NODE))
 		set_dev_node(dev, dev_to_node(parent));
@@ -3773,6 +3781,25 @@ int device_add(struct device *dev)
 		goto DPMError;
 	device_pm_add(dev);
 
+	/*
+	 * Publish the staged directory before anything makes the device
+	 * observable: the /sys/dev entry, the devtmpfs node,
+	 * BUS_NOTIFY_ADD_DEVICE, the KOBJ_ADD uevent and driver probing all
+	 * follow.  Once published, the deferred bus klist insertion puts the
+	 * device where driver_attach() can see it.  (The outside-in symlinks
+	 * whose target is this device -- class/bus/ACPI -- are created earlier
+	 * and resolve only at publication.)  Children added by notify hooks
+	 * inside the staged window were created staged-interior and are
+	 * published together with this device; their uevents may precede
+	 * their sysfs visibility.
+	 */
+	if (kobject_sd_staged(&dev->kobj)) {
+		error = sysfs_publish_dir(&dev->kobj);
+		if (error)
+			goto DevAttrError;
+		bus_add_device_publish(dev);
+	}
+
 	if (MAJOR(dev->devt)) {
 		error = device_create_file(dev, &dev_attr_dev);
 		if (error)
diff --git a/include/linux/device.h b/include/linux/device.h
index aee79fd6b32b..74701a8aa9d2 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -599,6 +599,15 @@ struct device_physical_location {
  *		ancestor device.
  * @DEV_FLAG_OFFLINE_DISABLED: If set, the device is permanently online.
  * @DEV_FLAG_OFFLINE: Set after successful invocation of bus type's .offline().
+ * @DEV_FLAG_SYSFS_STAGED: Opt in to staged sysfs registration.  device_add()
+ *		then builds the device's sysfs directory and all content added
+ *		before the publication point invisibly and off the sysfs root
+ *		lock, and publishes it in one step before the device becomes
+ *		observable to userspace or to drivers.  The per-device
+ *		sysfs-root lock cost stops scaling with the number of nodes in
+ *		the directory, which matters when many devices (for example
+ *		SR-IOV virtual functions) are registered in parallel.
+ *		Must be set before device_add().
  * @DEV_FLAG_COUNT: Number of defined struct_device_flags.
  */
 enum struct_device_flags {
@@ -612,6 +621,7 @@ enum struct_device_flags {
 	DEV_FLAG_OF_NODE_REUSED = 7,
 	DEV_FLAG_OFFLINE_DISABLED = 8,
 	DEV_FLAG_OFFLINE = 9,
+	DEV_FLAG_SYSFS_STAGED = 10,
 
 	DEV_FLAG_COUNT
 };
@@ -829,6 +839,7 @@ __create_dev_flag_accessors(dma_coherent, DEV_FLAG_DMA_COHERENT);
 __create_dev_flag_accessors(of_node_reused, DEV_FLAG_OF_NODE_REUSED);
 __create_dev_flag_accessors(offline_disabled, DEV_FLAG_OFFLINE_DISABLED);
 __create_dev_flag_accessors(offline, DEV_FLAG_OFFLINE);
+__create_dev_flag_accessors(sysfs_staged, DEV_FLAG_SYSFS_STAGED);
 
 #undef __create_dev_flag_accessors
 
-- 
2.47.3