netdev - Re: [PATCH v2 1/2] net: phy: realtek: Add rtl8211e rx/tx delays config

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 12 May 2019 22:41:32 -0700
From:   Guenter Roeck <linux@...ck-us.net>
To:     Serge Semin <fancer.lancer@...il.com>
Cc:     Andrew Lunn <andrew@...n.ch>,
        Florian Fainelli <f.fainelli@...il.com>,
        Heiner Kallweit <hkallweit1@...il.com>,
        "David S. Miller" <davem@...emloft.net>,
        Serge Semin <Sergey.Semin@...latforms.ru>,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 1/2] net: phy: realtek: Add rtl8211e rx/tx delays
 config

Hi,

On Sat, Apr 27, 2019 at 12:21:11AM +0300, Serge Semin wrote:
> There are two chip pins named TXDLY and RXDLY which actually adds the 2ns
> delays to TXC and RXC for TXD/RXD latching. Alas this is the only
> documented info regarding the RGMII timing control configurations the PHY
> provides. It turns out the same settings can be setup via MDIO registers
> hidden in the extension pages layout. Particularly the extension page 0xa4
> provides a register 0x1c, which bits 1 and 2 control the described delays.
> They are used to implement the "rgmii-{id,rxid,txid}" phy-mode.
> 
> The hidden RGMII configs register utilization was found in the rtl8211e
> U-boot driver:
> https://elixir.bootlin.com/u-boot/v2019.01/source/drivers/net/phy/realtek.c#L99
> 
> There is also a freebsd-folks discussion regarding this register:
> https://reviews.freebsd.org/D13591
> 
> It confirms that the register bits field must control the so called
> configuration pins described in the table 12-13 of the official PHY
> datasheet:
> 8:6 = PHY Address
> 5:4 = Auto-Negotiation
> 3 = Interface Mode Select
> 2 = RX Delay
> 1 = TX Delay
> 0 = SELRGV
> 
> Signed-off-by: Serge Semin <fancer.lancer@...il.com>
> Reviewed-by: Andrew Lunn <andrew@...n.ch>

This patch results in a crash when running arm:ast2500-evb in qemu.

[    4.894572] [00000000] *pgd=00000000
[    4.895329] Internal error: Oops: 80000005 [#1] ARM
[    4.896066] CPU: 0 PID: 1 Comm: swapper Not tainted 5.1.0-09698-g1fb3b52 #1
[    4.896364] Hardware name: Generic DT based system
[    4.896823] PC is at 0x0
[    4.897037] LR is at phy_select_page+0x3c/0x7c

Debugging shows that phydev->drv->write_page and phydev->drv->read_page
are NULL, so the crash isn't entirely surprising.

What I don't understand is how this can work in the first place.
The modified entry in realtek_drvs[] doesn't have read_page/write_page
functions defined, yet rtl8211e_config_init() depends on it.
What am I missing here ?

Thanks,
Guenter