Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Vicente Bergas <vicencb@gmail.com>
To:     Serge Semin <fancer.lancer@gmail.com>
Cc:     Heiner Kallweit <hkallweit1@gmail.com>,
        Russell King <rmk+kernel@armlinux.org.uk>,
        Andrew Lunn <andrew@lunn.ch>,
        Florian Fainelli <f.fainelli@gmail.com>,
        <netdev@vger.kernel.org>, <linux-kernel@vger.kernel.org>
Subject: Re: net: phy: realtek: regression, kernel null pointer dereference
Date:   Mon, 13 May 2019 14:19:17 +0200
MIME-Version: 1.0
Message-ID: <cf1e81d9-6f91-41fe-a390-b9688e5707f7@gmail.com>
In-Reply-To: <20190513105104.af7d7n337lxqac63@mobilestation>
References: <16f75ff4-e3e3-4d96-b084-e772e3ce1c2b@gmail.com>
 <742a2235-4571-aa7d-af90-14c708205c6f@gmail.com>
 <11446b0b-c8a4-4e5f-bfa0-0892b500f467@gmail.com>
 <61831f43-3b24-47d9-ec6f-15be6a4568c5@gmail.com>
 <0f16b2c5-ef2a-42a1-acdc-08fa9971b347@gmail.com>
 <20190513102941.4ocb3tz3wmh3pj4t@mobilestation>
 <20190513105104.af7d7n337lxqac63@mobilestation>
User-Agent: Trojita
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: quoted-printable
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Monday, May 13, 2019 12:51:05 PM CEST, Serge Semin wrote:
> On Mon, May 13, 2019 at 01:29:42PM +0300, Serge Semin wrote:
>> Hello Vincente,
>>=20
>> On Sat, May 11, 2019 at 05:06:04PM +0200, Vicente Bergas wrote: ...
>
> Hmm, just figured out, that in the datasheet RXDLY/TXDLY pins=20
> are actually grounded, so
> phy-mode=3D"rgmii" should work for you. Are you sure that on your=20
> actual hardware the
> resistors aren't placed differently?

That is correct, the schematic has pull-down resistors and placeholders for
pull-up resistors. On the board I can confirm the pull-ups are not
populated and the pull-downs are.
But the issue seems unrelated to this.

I have traced it down to a deadlock while trying to acquire a mutex.
It hangs here:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drive=
rs/net/phy/realtek.c?id=3D47782361aca2#n220
while waiting for this mutex:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drive=
rs/net/phy/mdio_bus.c?id=3D47782361aca2#n692

Regards,
  Vicen=C3=A7.

> The current config register state can be read from the 0x1c=20
> extension page. Something
> like this:
> --- a/drivers/net/phy/realtek.c
> +++ b/drivers/net/phy/realtek.c
> @@ -221,6 +221,9 @@ static int rtl8211e_config_init(struct=20
> phy_device *phydev)
>  =09if (ret)
>  =09=09goto err_restore_page;
> =20
> +=09ret =3D phy_read(phydev, 0x1c);
> +=09dev_info(&phydev->mdio.dev, "PHY config register %08x\n", ret);
> +
>  =09ret =3D phy_modify(phydev, 0x1c, RTL8211E_TX_DELAY | RTL8211E_RX_DELAY,=

>  =09=09=09 val);
> =20
> -Sergey