Bug 216195 - Maxlinear GPY115 UBSAN: shift-out-of-bounds
Summary: Maxlinear GPY115 UBSAN: shift-out-of-bounds
Status: NEW
Alias: None
Product: Networking
Classification: Unclassified
Component: Other (show other bugs)
Hardware: Intel Linux
: P1 normal
Assignee: Stephen Hemminger
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-07-01 08:26 UTC by Cedric
Modified: 2022-07-22 20:17 UTC (History)
2 users (show)

See Also:
Kernel Version: 5.15-5.17
Tree: Mainline
Regression: No


Attachments

Description Cedric 2022-07-01 08:26:11 UTC
This is related to specific (wired) Ethernet IC: Maxlinear Ethernet GPY115B
The network interface does show up in ifconfig but is not functioning, no ip-address is assigned.

During the bootup process I get the following warning:

    UBSAN: shift-out-of-bounds in 
    /build/linux-WLUive/linux- 
    5.15.0/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c:224:12
    Shift exponent 40 is too large for 32-bit type 'unsigned int'

This results in the following error:

    Maxlinear Ethernet GPY115B stmmac-3:01: gpy_config_aneg failed -110

The specific kernel I am running: 5.15.0-40-generic on Ubuntu but also tested this with Fedora Server 36 running kernel 5.17.
Config: CONFIG_MAXLINEAR_GPHY=m
The module is installed here: /usr/lib/modules/5.15.0-generic/kernel/drivers/net/phy/mxl-gpy.ko

Additional information:
https://askubuntu.com/questions/1416068/how-to-enable-maxlinear-phy-gpy115-drivers

Datasheet:
https://www.maxlinear.com/product/connectivity/wired/ethernet/ethernet-transceivers-phy/gpy115
Comment 2 Florian Fainelli 2022-07-02 01:54:14 UTC
It is not immediately clear how the undefined behavior relates to the Ethernet PHY reporting -ETIMEDOUT. Can you provide more details about your platform, in particular any Device Tree source showing how the Ethernet MAC node is defined so we can check that the number of queues is within the bounds?

Thanks
Comment 3 Cedric 2022-07-06 12:25:41 UTC
Hi Florian,

Is was not able to create a device tree, as far as my understanding goes there is no device tree for x86(-64) devices because it is generated dynamically? I am  no guru, so if you could point me in the direction on how to generate an device tree please let me know. Perhaps the info below is can be useful.

lspci output:

00:1d.1 Ethernet controller [0200]: Intel Corporation Device [8086:4ba1] (rev 11)
	Subsystem: Intel Corporation Device [8086:7270]
	Kernel driver in use: intel-eth-pci
	Kernel modules: dwmac_intel
00:1d.2 Ethernet controller [0200]: Intel Corporation Device [8086:4bb1] (rev 11)
	Subsystem: Intel Corporation Device [8086:7270]
	Kernel driver in use: intel-eth-pci
	Kernel modules: dwmac_intel


ethtool enps0s28f1 output: 

Settings for enp0s29f1:
	Supported ports: [  ]
	Supported link modes:   10baseT/Full
	                        100baseT/Full
	                        1000baseT/Full
	Supported pause frame use: Symmetric Receive-only
	Supports auto-negotiation: Yes
	Supported FEC modes: Not reported
	Advertised link modes:  10baseT/Full
	                        100baseT/Full
	                        1000baseT/Full
	Advertised pause frame use: Symmetric Receive-only
	Advertised auto-negotiation: Yes
	Advertised FEC modes: Not reported
	Link partner advertised link modes:  10baseT/Half 10baseT/Full
	                                     100baseT/Half 100baseT/Full
	                                     1000baseT/Full
	Link partner advertised pause frame use: No
	Link partner advertised auto-negotiation: No
	Link partner advertised FEC modes: Not reported
	Speed: 1000Mb/s
	Duplex: Full
	Auto-negotiation: on
	Port: Twisted Pair
	PHYAD: 1
	Transceiver: external
	MDI-X: Unknown
	Supports Wake-on: pg
	Wake-on: d
        Current message level: 0x0000003f (63)
                               drv probe link timer ifdown ifup
	Link detected: no



ip a output:
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp0s29f1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
    link/ether 84:8b:cd:4c:e2:45 brd ff:ff:ff:ff:ff:ff
3: enp0s29f2: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
    link/ether 84:8b:cd:4c:e6:f5 brd ff:ff:ff:ff:ff:ff
4: wlx<REDACTED>: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether <REDACTED> brd ff:ff:ff:ff:ff:ff
    inet <REDACTED> metric 600 brd <REDACTED> scope global dynamic wlx<REDACTED>
       valid_lft 591695sec preferred_lft 591695sec
    inet6 <REDACTED> scope link 
       valid_lft forever preferred_lft forever



lshw output:
  *-network:0
       description: Ethernet interface
       product: Intel Corporation
       vendor: Intel Corporation
       physical id: 1d.1
       bus info: pci@0000:00:1d.1
       logical name: enp0s29f1
       version: 11
       serial: 84:8b:cd:4c:e2:45
       size: 1Gbit/s
       capacity: 1Gbit/s
       width: 64 bits
       clock: 33MHz
       capabilities: pm msi bus_master cap_list ethernet physical 10bt-fd 100bt-fd 1000bt-fd autonegotiation
       configuration: autonegotiation=on broadcast=yes driver=st_gmac driverversion=Jan_2016 duplex=full latency=0 link=no multicast=yes port=twisted pair speed=1Gbit/s
       resources: irq:127 memory:6fc00000-6fc3ffff
  *-network:1
       description: Ethernet interface
       product: Intel Corporation
       vendor: Intel Corporation
       physical id: 1d.2
       bus info: pci@0000:00:1d.2
       logical name: enp0s29f2
       version: 11
       serial: 84:8b:cd:4c:e6:f5
       capacity: 1Gbit/s
       width: 64 bits
       clock: 33MHz
       capabilities: pm msi bus_master cap_list ethernet physical 10bt-fd 100bt-fd 1000bt-fd autonegotiation
       configuration: autonegotiation=on broadcast=yes driver=st_gmac driverversion=Jan_2016 duplex=half latency=0 link=no multicast=yes port=twisted pair
       resources: irq:161 memory:6fc40000-6fc7ffff
  *-network
       description: Wireless interface
       physical id: 7
       bus info: usb@1:4
       logical name: wlx<REDACTED>
       serial: <REDACTED>
       capabilities: ethernet physical wireless
       configuration: broadcast=yes driver=rt2800usb driverversion=5.15.0-40-generic firmware=0.36 ip=<REDACTED> link=yes multicast=yes wireless=IEEE 802.11
Comment 4 Cedric 2022-07-06 12:36:13 UTC
Driver queue info:

Ring parameters for enp0s29f1:
Pre-set maximums:
RX:		1024
RX Mini:	n/a
RX Jumbo:	n/a
TX:		1024
Current hardware settings:
RX:		512
RX Mini:	n/a
RX Jumbo:	n/a
TX:		512
Comment 5 Florian Fainelli 2022-07-15 01:44:35 UTC
It looks like this patch ought to fix your undefined behavior warning:

https://lore.kernel.org/all/20220713084728.1311465-1-junxiao.chang@intel.com/

can you try with that applied and see if the MaxLinear GPHY still times out?
Comment 6 Cedric 2022-07-15 10:20:43 UTC
Due to project deadlines I recently sent the device back to the manufacturer. However, I have informed their team that they can perhaps look into it this patch. I think it will be lucrative for them to fix this issue so my hope is that they will continue this thread.

Note You need to log in before you can comment on or make changes to this bug.