netdev - Re: mv88e6240 configuration broken for B850v3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Ya6NF9OxSmLO9hv+@shell.armlinux.org.uk>
Date:   Mon, 6 Dec 2021 22:22:15 +0000
From:   "Russell King (Oracle)" <linux@...linux.org.uk>
To:     Vladimir Oltean <olteanv@...il.com>
Cc:     Martyn Welch <martyn.welch@...labora.com>,
        Andrew Lunn <andrew@...n.ch>,
        Vivien Didelot <vivien.didelot@...il.com>,
        Florian Fainelli <f.fainelli@...il.com>,
        netdev@...r.kernel.org, kernel@...labora.com
Subject: Re: mv88e6240 configuration broken for B850v3

On Mon, Dec 06, 2021 at 11:51:39PM +0200, Vladimir Oltean wrote:
> On Mon, Dec 06, 2021 at 09:27:33PM +0000, Russell King (Oracle) wrote:
> > On Mon, Dec 06, 2021 at 11:13:41PM +0200, Vladimir Oltean wrote:
> > > On Mon, Dec 06, 2021 at 08:51:09PM +0000, Russell King (Oracle) wrote:
> > > > With a bit of knowledge of how Marvell DSA switches work...
> > > > 
> > > > The "ppu" is the PHY polling unit. When the switch comes out of reset,
> > > > the PPU probes the MDIO bus, and sets the bit in the port status
> > > > register depending on whether it detects a PHY at the port address by
> > > > way of the PHY ID values. This bit is used to enable polling of the
> > > > PHY and is what mv88e6xxx_port_ppu_updates() reports. This bit will be
> > > > set for all internal PHYs unless we explicitly turn it off (we don't.)
> > > > Therefore, this is a reasonable assumption to make.
> > > > 
> > > > So, given that mv88e6xxx_port_ppu_updates() is most likely true as
> > > > I stated, it is also true that mv88e6xxx_phy_is_internal() is
> > > > "don't care".
> > > 
> > > And the reason why you bring the PPU into the discussion is because?
> > > If the issue manifests itself with or without it, and you come up with a
> > > proposal to set LINK_UNFORCED in mv88e6xxx_mac_config if the PPU is
> > > used, doesn't that, logically speaking, still leave the issue unsolved
> > > if the PPU is _not_ used for whatever reason?
> > > The bug has nothing to do with the PPU. It can be solved by checking for
> > > PPU in-band status as you say. Maybe. But I've got no idea why we don't
> > > address the elephant in the room, which is in dsa_port_link_register_of()?
> > 
> > I think I've covered that in the other sub-thread.
> > 
> > It could be that a previous configuration left the port forced down.
> > For example, if one were to kexec from one kernel that uses a
> > fixed-link that forced the link down, into the same kernel with a
> > different DT that uses PHY mode.
> > 
> > The old kernel may have called mac_link_down(MLO_AN_FIXED), and the
> > new kernel wouldn't know that. It comes along, and goes through the
> > configuration process and calls mac_link_up(MLO_AN_PHY)... and from
> > what you're suggesting, because these two calls use different MLO_AN_xxx
> > constants that's a bug.
> 
> Indeed I don't have detailed knowledge of Marvell hardware, but I'm
> surprised to see kexec being mentioned here as a potential source of
> configurations which the driver does not expect to handle. My belief was
> that kexec's requirements would be just to silence the device
> sufficiently such that it doesn't cause any surprises when things such
> interrupts are enabled (DMA isn't relevant for DSA switches).
> It wouldn't be responsible for leaving the hardware in any other state
> otherwise.
> 
> I see this logic in the driver, does it not take care of bringing the
> ports to a known state, regardless of what a previous boot stage may
> have done?
> 
> static int mv88e6xxx_switch_reset(struct mv88e6xxx_chip *chip)
> {
> 	int err;
> 
> 	err = mv88e6xxx_disable_ports(chip);
> 	if (err)
> 		return err;
> 
> 	mv88e6xxx_hardware_reset(chip);
> 
> 	return mv88e6xxx_software_reset(chip);
> }
> 
> So unless I'm fooled by mentally putting an equality sign between
> mv88e6xxx_switch_reset() and getting rid of whatever a previous kernel
> may have done, I don't think at all that the two cases are comparable:
> kexec and a previous call to mv88e6xxx_mac_link_down() initiated by
> dsa_port_link_register_of() from this kernel.

If the hardware reset is not wired to be under software control or is
not specified, then mv88e6xxx_hardware_reset() is a no-op.

mv88e6xxx_software_reset() does not fully reinitialise the switch.
To quote one switch manual for the SWReset bit "Register values are not
modified." That means if the link was forced down previously by writing
to the port control register, the port remains forced down until
software changes that register to unforce the link, or to force the
link up.

-- 
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 40Mbps down 10Mbps up. Decent connectivity at last!