Skip to contentSkip to conversation

Thunderbolt security levels and NVM firmware upgrade

PATCH In review Mika Westerberg 5 participants 37 messages Jun 6, 2017 – Jul 25, 2017

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

v4 cover Thunderbolt security levels and NVM firmware upgrade

Hi,

This is fourth version of the patch series adding support for Thunderbolt security levels and NVM firmware upgrade. PCs running Intel Falcon Ridge or newer need these in order to connect devices if the security level is set to "user(SL1) or secure(SL2)" from BIOS.

The security levels were added to to prevent DMA attacks when PCIe is tunneled over Thunderbolt fabric where IOMMU is not available or cannot be enabled for different reasons.

This series converts the Thunderbolt driver to a Linux bus and makes each Thunderbolt device (aka Thunderbolt switch or router or endpoint) a Linux device which is connected to that bus addressed by their routing string (this is the addressing Thunderbolt uses).

With these patches the user can authorize devices using sysfs attributes like (following USB):

  # echo 1 > /sys/bus/thunderbolt/devices/0-1/authorized

If the BIOS security level is set to "secure" and the device supports secure connect on the first connect the device is uploaded a random key:

# key=$(openssl rand -hex 32)

  # echo $key > /sys/bus/thunderbolt/devices/0-1/key
  # echo 1 > /sys/bus/thunderbolt/devices/0-1/authorized

Next time the device is plugged in the user can verify (challenge) the device using the same key:

  # echo $key > /sys/bus/thunderbolt/devices/0-1/key
  # echo 2 > /sys/bus/thunderbolt/devices/0-1/authorized

The device identification information is found below each device sysfs node and includes following attributes:

device - Device ID
device_name - Name of the device
vendor - Vendor ID
vendor_name - Name of the vendor
unique_id - Unique ID string identifying this particular device

In addition these patches add support for upgrading NVM firmware running on a host or device by running something like:

  # dd if=KYK_TBT_FW_0018.bin of=/sys/bus/thunderbolt/devices/0-0/nvm_non_active0/nvmem
  # echo 1 > /sys/bus/thunderbolt/devices/0-0/nvm_authenticate

More information how to use the Thunderbolt bus can be found in patch [26/27].

Where Internal Connection Manager (ICM) firmware is available and usable, we use it in the driver. This also includes newer Apple Macbooks with Alpine Ridge. For older Macbooks the driver works as before but in addition the Thunderbolt bus is available there as well (including possibility to upgrade NVM firmware of connected devices).

Note for Macs the Linux native PCIe hotplug support does not work well with the Thunderbolt PCIe topologies where there is need to put all available resources to the PCIe downstream port where the PCIe chain is extended. This is something we need to fix. In the mean time is a way to work it around by passing "pci=hpbussize=10,hpmemsize=2M" or so to the kernel command line.

We are currently porting Amir's network driver on top of the Thunderbolt bus.

The previous version (v3) of the series can be found in:

https://lwn.net/Articles/724465/

Changes from v3:
- Rename tb_switch_find_vsec_cap() to tb_switch_find_vse_cap() to be consistent with PCI where VSEC stands for Vendor Specific Extended Capability.
- Rename TB_VSEC_CAP_* to TB_VSE_CAP accordingly.
- Add missing call to mutex_destroy() for tb->lock
- Disable host NVM upgrade when in native mode
- Add SoB from Andreas

Greg, I did not add your ack for the two patches (9 and 26) you acked because I think you are going to add your SoB to the series anyway when you apply the series. Let me know if you want me to add them. Thanks.

Lukas Wunner (1):
thunderbolt: Refactor and fix parsing of port drom entries

Mika Westerberg (26):
thunderbolt: Use const buffer pointer in write operations
thunderbolt: No need to read UID of the root switch on resume
thunderbolt: Do not try to read UID if DROM offset is read as 0
thunderbolt: Do not warn about newer DROM versions
thunderbolt: Add MSI-X support
thunderbolt: Rework capability handling
thunderbolt: Allow passing NULL to tb_ctl_free()
thunderbolt: Introduce thunderbolt bus and connection manager
thunderbolt: Convert switch to a device
thunderbolt: Fail switch adding operation if reading DROM fails
thunderbolt: Do not fail if DROM data CRC32 is invalid
thunderbolt: Read vendor and device name from DROM
thunderbolt: Move control channel messages to tb_msgs.h
thunderbolt: Expose get_route() to other files
thunderbolt: Expose make_header() to other files
thunderbolt: Let the connection manager handle all notifications
thunderbolt: Rework control channel to be more reliable
thunderbolt: Add new Thunderbolt PCI IDs
thunderbolt: Add support for NHI mailbox
thunderbolt: Store Thunderbolt generation in the switch structure
thunderbolt: Add support for DMA configuration based mailbox
thunderbolt: Do not touch the hardware if the NHI is gone on resume
thunderbolt: Add support for Internal Connection Manager (ICM)
thunderbolt: Add support for host and device NVM firmware upgrade
thunderbolt: Add documentation how Thunderbolt bus can be used
MAINTAINERS: Add maintainers for Thunderbolt driver

 Documentation/ABI/testing/sysfs-bus-thunderbolt |  110 +++
 Documentation/admin-guide/index.rst             |    1 +
 Documentation/admin-guide/thunderbolt.rst       |  199 ++++
 MAINTAINERS                                     |    3 +
 drivers/thunderbolt/Kconfig                     |   13 +-
 drivers/thunderbolt/Makefile                    |    2 +-
 drivers/thunderbolt/cap.c                       |  169 ++--
 drivers/thunderbolt/ctl.c                       |  665 +++++++++----
 drivers/thunderbolt/ctl.h                       |  105 +-
 drivers/thunderbolt/dma_port.c                  |  524 ++++++++++
 drivers/thunderbolt/dma_port.h                  |   34 +
 drivers/thunderbolt/domain.c                    |  456 +++++++++
 drivers/thunderbolt/eeprom.c                    |  119 ++-
 drivers/thunderbolt/icm.c                       | 1089 +++++++++++++++++++++
 drivers/thunderbolt/nhi.c                       |  306 +++++-
 drivers/thunderbolt/nhi.h                       |   93 +-
 drivers/thunderbolt/nhi_regs.h                  |   27 +
 drivers/thunderbolt/switch.c                    | 1178 +++++++++++++++++++++--
 drivers/thunderbolt/tb.c                        |  240 +++--
 drivers/thunderbolt/tb.h                        |  251 ++++-
 drivers/thunderbolt/tb_msgs.h                   |  260 +++++
 drivers/thunderbolt/tb_regs.h                   |   50 +-
 drivers/thunderbolt/tunnel_pci.c                |   17 +-
 23 files changed, 5329 insertions(+), 582 deletions(-)
 create mode 100644 Documentation/ABI/testing/sysfs-bus-thunderbolt
 create mode 100644 Documentation/admin-guide/thunderbolt.rst
 create mode 100644 drivers/thunderbolt/dma_port.c
 create mode 100644 drivers/thunderbolt/dma_port.h
 create mode 100644 drivers/thunderbolt/domain.c
 create mode 100644 drivers/thunderbolt/icm.c
 create mode 100644 drivers/thunderbolt/tb_msgs.h
Signature · 1 line
2.11.0
#1 lore raw

PATCH v4 1/27 thunderbolt: Use const buffer pointer in write operations

These functions should not (and do not) modify the argument in any way so make it const.

---
 drivers/thunderbolt/ctl.c | 8 ++++----
 drivers/thunderbolt/ctl.h | 4 ++--
 drivers/thunderbolt/tb.h  | 2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)
drivers/thunderbolt/ctl.c +4 -4
index 1146ff4210a9..1031d97407a8 100644
@@ -273,7 +273,7 @@ static void tb_cfg_print_error(struct tb_ctl *ctl,
 	}
 }
 
-static void cpu_to_be32_array(__be32 *dst, u32 *src, size_t len)
+static void cpu_to_be32_array(__be32 *dst, const u32 *src, size_t len)
 {
 	int i;
 	for (i = 0; i < len; i++)
@@ -333,7 +333,7 @@ static void tb_ctl_tx_callback(struct tb_ring *ring, struct ring_frame *frame,
  *
  * Return: Returns 0 on success or an error code on failure.
  */
-static int tb_ctl_tx(struct tb_ctl *ctl, void *data, size_t len,
+static int tb_ctl_tx(struct tb_ctl *ctl, const void *data, size_t len,
 		     enum tb_cfg_pkg_type type)
 {
 	int res;
@@ -650,7 +650,7 @@ struct tb_cfg_result tb_cfg_read_raw(struct tb_ctl *ctl, void *buffer,
  *
  * Offset and length are in dwords.
  */
-struct tb_cfg_result tb_cfg_write_raw(struct tb_ctl *ctl, void *buffer,
+struct tb_cfg_result tb_cfg_write_raw(struct tb_ctl *ctl, const void *buffer,
 		u64 route, u32 port, enum tb_cfg_space space,
 		u32 offset, u32 length, int timeout_msec)
 {
@@ -695,7 +695,7 @@ int tb_cfg_read(struct tb_ctl *ctl, void *buffer, u64 route, u32 port,
 	return res.err;
 }
 
-int tb_cfg_write(struct tb_ctl *ctl, void *buffer, u64 route, u32 port,
+int tb_cfg_write(struct tb_ctl *ctl, const void *buffer, u64 route, u32 port,
 		 enum tb_cfg_space space, u32 offset, u32 length)
 {
 	struct tb_cfg_result res = tb_cfg_write_raw(ctl, buffer, route, port,
drivers/thunderbolt/ctl.h +2 -2
index ba87d6e731dd..83ae54947082 100644
@@ -61,13 +61,13 @@ struct tb_cfg_result tb_cfg_read_raw(struct tb_ctl *ctl, void *buffer,
 				     u64 route, u32 port,
 				     enum tb_cfg_space space, u32 offset,
 				     u32 length, int timeout_msec);
-struct tb_cfg_result tb_cfg_write_raw(struct tb_ctl *ctl, void *buffer,
+struct tb_cfg_result tb_cfg_write_raw(struct tb_ctl *ctl, const void *buffer,
 				      u64 route, u32 port,
 				      enum tb_cfg_space space, u32 offset,
 				      u32 length, int timeout_msec);
 int tb_cfg_read(struct tb_ctl *ctl, void *buffer, u64 route, u32 port,
 		enum tb_cfg_space space, u32 offset, u32 length);
-int tb_cfg_write(struct tb_ctl *ctl, void *buffer, u64 route, u32 port,
+int tb_cfg_write(struct tb_ctl *ctl, const void *buffer, u64 route, u32 port,
 		 enum tb_cfg_space space, u32 offset, u32 length);
 int tb_cfg_get_upstream_port(struct tb_ctl *ctl, u64 route);
 
drivers/thunderbolt/tb.h +1 -1
index 61d57ba64035..ba2b85750335 100644
@@ -173,7 +173,7 @@ static inline int tb_port_read(struct tb_port *port, void *buffer,
 			   length);
 }
 
-static inline int tb_port_write(struct tb_port *port, void *buffer,
+static inline int tb_port_write(struct tb_port *port, const void *buffer,
 				enum tb_cfg_space space, u32 offset, u32 length)
 {
 	return tb_cfg_write(port->sw->tb->ctl,
Signature · 1 line
2.11.0
#2 lore raw

PATCH v4 2/27 thunderbolt: No need to read UID of the root switch on resume

In reply to Mika Westerberg

The root switch is part of the host controller and cannot be physically removed, so there is no point of reading UID again on resume in order to check if the root switch is still the same.

---
 drivers/thunderbolt/switch.c | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)
drivers/thunderbolt/switch.c +18 -11
index c6f30b1695a9..81f5164a6364 100644
@@ -452,19 +452,26 @@ void tb_sw_set_unplugged(struct tb_switch *sw)
 int tb_switch_resume(struct tb_switch *sw)
 {
 	int i, err;
-	u64 uid;
 	tb_sw_info(sw, "resuming switch\n");
 
-	err = tb_drom_read_uid_only(sw, &uid);
-	if (err) {
-		tb_sw_warn(sw, "uid read failed\n");
-		return err;
-	}
-	if (sw != sw->tb->root_switch && sw->uid != uid) {
-		tb_sw_info(sw,
-			"changed while suspended (uid %#llx -> %#llx)\n",
-			sw->uid, uid);
-		return -ENODEV;
+	/*
+	 * Check for UID of the connected switches except for root
+	 * switch which we assume cannot be removed.
+	 */
+	if (tb_route(sw)) {
+		u64 uid;
+
+		err = tb_drom_read_uid_only(sw, &uid);
+		if (err) {
+			tb_sw_warn(sw, "uid read failed\n");
+			return err;
+		}
+		if (sw->uid != uid) {
+			tb_sw_info(sw,
+				"changed while suspended (uid %#llx -> %#llx)\n",
+				sw->uid, uid);
+			return -ENODEV;
+		}
 	}
 
 	/* upload configuration */
Signature · 1 line
2.11.0
Reviewed-by on v4 2/27
#3 lore raw

Re: [PATCH v4 02/27] thunderbolt: No need to read UID of the root switch on resume

Quoted 6 lines · Mika Westerberg

The root switch is part of the host controller and cannot be physically
removed, so there is no point of reading UID again on resume in order to
check if the root switch is still the same.

FWIW,

Quoted 52 lines

---
 drivers/thunderbolt/switch.c | 29 ++++++++++++++++++-----------

 1 file changed, 18 insertions(+), 11 deletions(-)
drivers/thunderbolt/switch.c +0 -1
index c6f30b1695a9..81f5164a6364 100644
@@ -452,19 +452,26 @@ void tb_sw_set_unplugged(struct tb_switch *sw)
  int tb_switch_resume(struct tb_switch *sw)
  {
  	int i, err;
-	u64 uid;
  	tb_sw_info(sw, "resuming switch\n");

drivers/thunderbolt/switch.c +0 -8
-	err = tb_drom_read_uid_only(sw, &uid);
-	if (err) {
-		tb_sw_warn(sw, "uid read failed\n");
-		return err;
-	}
-	if (sw != sw->tb->root_switch && sw->uid != uid) {
-		tb_sw_info(sw,
-			"changed while suspended (uid %#llx ->

%#llx)\n",

drivers/thunderbolt/switch.c +18 -3
-			sw->uid, uid);
-		return -ENODEV;
+	/*
+	 * Check for UID of the connected switches except for root
+	 * switch which we assume cannot be removed.
+	 */
+	if (tb_route(sw)) {
+		u64 uid;
+
+		err = tb_drom_read_uid_only(sw, &uid);
+		if (err) {
+			tb_sw_warn(sw, "uid read failed\n");
+			return err;
+		}
+		if (sw->uid != uid) {
+			tb_sw_info(sw,
+				"changed while suspended (uid %#llx
-> %#llx)\n",
+				sw->uid, uid);
+			return -ENODEV;
+		}

  }

  /* upload configuration */

Signature · 2 lines
Andy Shevchenko <[email protected]>
Intel Finland Oy
#4 lore raw

PATCH v4 3/27 thunderbolt: Do not try to read UID if DROM offset is read as 0

In reply to Mika Westerberg

At least Falcon Ridge when in host mode does not have any kind of DROM available and reading DROM offset returns 0 for these. Do not try to read DROM any further in that case.

---
 drivers/thunderbolt/eeprom.c | 3 +++
 1 file changed, 3 insertions(+)
drivers/thunderbolt/eeprom.c +3 -0
index 6392990c984d..e4e64b130514 100644
@@ -276,6 +276,9 @@ int tb_drom_read_uid_only(struct tb_switch *sw, u64 *uid)
 	if (res)
 		return res;
 
+	if (drom_offset == 0)
+		return -ENODEV;
+
 	/* read uid */
 	res = tb_eeprom_read_n(sw, drom_offset, data, 9);
 	if (res)
Signature · 1 line
2.11.0
#5 lore raw

PATCH v4 4/27 thunderbolt: Do not warn about newer DROM versions

In reply to Mika Westerberg

DROM version 2 is compatible with the previous generation so no need to warn about that.

---
 drivers/thunderbolt/eeprom.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/thunderbolt/eeprom.c +1 -1
index e4e64b130514..eb2179c98b09 100644
@@ -488,7 +488,7 @@ int tb_drom_read(struct tb_switch *sw)
 		goto err;
 	}
 
-	if (header->device_rom_revision > 1)
+	if (header->device_rom_revision > 2)
 		tb_sw_warn(sw, "drom device_rom_revision %#x unknown\n",
 			header->device_rom_revision);
 
Signature · 1 line
2.11.0
#6 lore raw

PATCH v4 5/27 thunderbolt: Add MSI-X support

In reply to Mika Westerberg

Intel Thunderbolt controllers support up to 16 MSI-X vectors. Using MSI-X is preferred over MSI or legacy interrupt and may bring additional performance because there is no need to check the status registers which interrupt was triggered.

While there we convert comments in structs tb_ring and tb_nhi to follow kernel-doc format more closely.

This code is based on the work done by Amir Levy and Michael Jamet.

---
 drivers/thunderbolt/ctl.c      |   4 +-
 drivers/thunderbolt/nhi.c      | 165 +++++++++++++++++++++++++++++++++++------
 drivers/thunderbolt/nhi.h      |  56 +++++++++++---
 drivers/thunderbolt/nhi_regs.h |   9 +++
 4 files changed, 198 insertions(+), 36 deletions(-)
drivers/thunderbolt/ctl.c +2 -2
index 1031d97407a8..889a32dd21e7 100644
@@ -488,11 +488,11 @@ struct tb_ctl *tb_ctl_alloc(struct tb_nhi *nhi, hotplug_cb cb, void *cb_data)
 	if (!ctl->frame_pool)
 		goto err;
 
-	ctl->tx = ring_alloc_tx(nhi, 0, 10);
+	ctl->tx = ring_alloc_tx(nhi, 0, 10, RING_FLAG_NO_SUSPEND);
 	if (!ctl->tx)
 		goto err;
 
-	ctl->rx = ring_alloc_rx(nhi, 0, 10);
+	ctl->rx = ring_alloc_rx(nhi, 0, 10, RING_FLAG_NO_SUSPEND);
 	if (!ctl->rx)
 		goto err;
 
drivers/thunderbolt/nhi.c +143 -22

241 lines not on this page · raw message

drivers/thunderbolt/nhi.h +44 -12

97 lines not on this page · raw message

drivers/thunderbolt/nhi_regs.h +9 -0
index 75cf0691e6c5..48b98d3c7e6a 100644
@@ -95,7 +95,16 @@ struct ring_desc {
 #define REG_RING_INTERRUPT_BASE	0x38200
 #define RING_INTERRUPT_REG_COUNT(nhi) ((31 + 2 * nhi->hop_count) / 32)
 
+/* Interrupt Vector Allocation */
+#define REG_INT_VEC_ALLOC_BASE	0x38c40
+#define REG_INT_VEC_ALLOC_BITS	4
+#define REG_INT_VEC_ALLOC_MASK	GENMASK(3, 0)
+#define REG_INT_VEC_ALLOC_REGS	(32 / REG_INT_VEC_ALLOC_BITS)
+
 /* The last 11 bits contain the number of hops supported by the NHI port. */
 #define REG_HOP_COUNT		0x39640
 
+#define REG_DMA_MISC			0x39864
+#define REG_DMA_MISC_INT_AUTO_CLEAR     BIT(2)
+
 #endif
Signature · 1 line
2.11.0
#7 lore raw

PATCH v4 6/27 thunderbolt: Rework capability handling

In reply to Mika Westerberg

Organization of the capabilities in switches and ports is not so random after all. Rework the capability handling functionality so that it follows how capabilities are organized and provide two new functions (tb_switch_find_vse_cap() and tb_port_find_cap()) which can be used to extract capabilities for ports and switches. Then convert the current users over these.

---
 drivers/thunderbolt/cap.c        | 169 +++++++++++++++++++++------------------
 drivers/thunderbolt/switch.c     |   6 +-
 drivers/thunderbolt/tb.c         |   8 +-
 drivers/thunderbolt/tb.h         |   3 +-
 drivers/thunderbolt/tb_regs.h    |  50 +++++++++---
 drivers/thunderbolt/tunnel_pci.c |   8 +-
 6 files changed, 142 insertions(+), 102 deletions(-)
drivers/thunderbolt/cap.c +91 -78
index a7b47e7cddbd..38bc27a5ce4f 100644
@@ -9,6 +9,8 @@
 
 #include "tb.h"
 
+#define CAP_OFFSET_MAX		0xff
+#define VSE_CAP_OFFSET_MAX	0xffff
 
 struct tb_cap_any {
 	union {
@@ -18,99 +20,110 @@ struct tb_cap_any {
 	};
 } __packed;
 
-static bool tb_cap_is_basic(struct tb_cap_any *cap)
-{
-	/* basic.cap is u8. This checks only the lower 8 bit of cap. */
-	return cap->basic.cap != 5;
-}
-
-static bool tb_cap_is_long(struct tb_cap_any *cap)
+/**
+ * tb_port_find_cap() - Find port capability
+ * @port: Port to find the capability for
+ * @cap: Capability to look
+ *
+ * Returns offset to start of capability or %-ENOENT if no such
+ * capability was found. Negative errno is returned if there was an
+ * error.
+ */
+int tb_port_find_cap(struct tb_port *port, enum tb_port_cap cap)
 {
-	return !tb_cap_is_basic(cap)
-	       && cap->extended_short.next == 0
-	       && cap->extended_short.length == 0;
-}
+	u32 offset;
 
-static enum tb_cap tb_cap(struct tb_cap_any *cap)
-{
-	if (tb_cap_is_basic(cap))
-		return cap->basic.cap;
+	/*
+	 * DP out adapters claim to implement TMU capability but in
+	 * reality they do not so we hard code the adapter specific
+	 * capability offset here.
+	 */
+	if (port->config.type == TB_TYPE_DP_HDMI_OUT)
+		offset = 0x39;
 	else
-		/* extended_short/long have cap at the same offset. */
-		return cap->extended_short.cap;
+		offset = 0x1;
+
+	do {
+		struct tb_cap_any header;
+		int ret;
+
+		ret = tb_port_read(port, &header, TB_CFG_PORT, offset, 1);
+		if (ret)
+			return ret;
+
+		if (header.basic.cap == cap)
+			return offset;
+
+		offset = header.basic.next;
+	} while (offset);
+
+	return -ENOENT;
 }
 
-static u32 tb_cap_next(struct tb_cap_any *cap, u32 offset)
+static int tb_switch_find_cap(struct tb_switch *sw, enum tb_switch_cap cap)
 {
-	int next;
-	if (offset == 1) {
-		/*
-		 * The first pointer is part of the switch header and always
-		 * a simple pointer.
-		 */
-		next = cap->basic.next;
-	} else {
-		/*
-		 * Somehow Intel decided to use 3 different types of capability
-		 * headers. It is not like anyone could have predicted that
-		 * single byte offsets are not enough...
-		 */
-		if (tb_cap_is_basic(cap))
-			next = cap->basic.next;
-		else if (!tb_cap_is_long(cap))
-			next = cap->extended_short.next;
-		else
-			next = cap->extended_long.next;
+	int offset = sw->config.first_cap_offset;
+
+	while (offset > 0 && offset < CAP_OFFSET_MAX) {
+		struct tb_cap_any header;
+		int ret;
+
+		ret = tb_sw_read(sw, &header, TB_CFG_SWITCH, offset, 1);
+		if (ret)
+			return ret;
+
+		if (header.basic.cap == cap)
+			return offset;
+
+		offset = header.basic.next;
 	}
-	/*
-	 * "Hey, we could terminate some capability lists with a null offset
-	 *  and others with a pointer to the last element." - "Great idea!"
-	 */
-	if (next == offset)
-		return 0;
-	return next;
+
+	return -ENOENT;
 }
 
 /**
- * tb_find_cap() - find a capability
+ * tb_switch_find_vse_cap() - Find switch vendor specific capability
+ * @sw: Switch to find the capability for
+ * @vsec: Vendor specific capability to look
  *
- * Return: Returns a positive offset if the capability was found and 0 if not.
- * Returns an error code on failure.
+ * Functions enumerates vendor specific capabilities (VSEC) of a switch
+ * and returns offset when capability matching @vsec is found. If no
+ * such capability is found returns %-ENOENT. In case of error returns
+ * negative errno.
  */
-int tb_find_cap(struct tb_port *port, enum tb_cfg_space space, enum tb_cap cap)
+int tb_switch_find_vse_cap(struct tb_switch *sw, enum tb_switch_vse_cap vsec)
 {
-	u32 offset = 1;
 	struct tb_cap_any header;
-	int res;
-	int retries = 10;
-	while (retries--) {
-		res = tb_port_read(port, &header, space, offset, 1);
-		if (res) {
-			/* Intel needs some help with linked lists. */
-			if (space == TB_CFG_PORT && offset == 0xa
-			    && port->config.type == TB_TYPE_DP_HDMI_OUT) {
-				offset = 0x39;
-				continue;
-			}
-			return res;
-		}
-		if (offset != 1) {
-			if (tb_cap(&header) == cap)
+	int offset;
+
+	offset = tb_switch_find_cap(sw, TB_SWITCH_CAP_VSE);
+	if (offset < 0)
+		return offset;
+
+	while (offset > 0 && offset < VSE_CAP_OFFSET_MAX) {
+		int ret;
+
+		ret = tb_sw_read(sw, &header, TB_CFG_SWITCH, offset, 2);
+		if (ret)
+			return ret;
+
+		/*
+		 * Extended vendor specific capabilities come in two
+		 * flavors: short and long. The latter is used when
+		 * offset is over 0xff.
+		 */
+		if (offset >= CAP_OFFSET_MAX) {
+			if (header.extended_long.vsec_id == vsec)
 				return offset;
-			if (tb_cap_is_long(&header)) {
-				/* tb_cap_extended_long is 2 dwords */
-				res = tb_port_read(port, &header, space,
-						   offset, 2);
-				if (res)
-					return res;
-			}
+			offset = header.extended_long.next;
+		} else {
+			if (header.extended_short.vsec_id == vsec)
+				return offset;
+			if (!header.extended_short.length)
+				return -ENOENT;
+			offset = header.extended_short.next;
 		}
-		offset = tb_cap_next(&header, offset);
-		if (!offset)
-			return 0;
 	}
-	tb_port_WARN(port,
-		     "run out of retries while looking for cap %#x in config space %d, last offset: %#x\n",
-		     cap, space, offset);
-	return -EIO;
+
+	return -ENOENT;
 }
drivers/thunderbolt/switch.c +3 -3
index 81f5164a6364..b379b4183bac 100644
@@ -192,7 +192,7 @@ static int tb_init_port(struct tb_port *port)
 
 	/* Port 0 is the switch itself and has no PHY. */
 	if (port->config.type == TB_TYPE_PORT && port->port != 0) {
-		cap = tb_find_cap(port, TB_CFG_PORT, TB_CAP_PHY);
+		cap = tb_port_find_cap(port, TB_PORT_CAP_PHY);
 
 		if (cap > 0)
 			port->cap_phy = cap;
@@ -394,9 +394,9 @@ struct tb_switch *tb_switch_alloc(struct tb *tb, u64 route)
 		sw->ports[i].port = i;
 	}
 
-	cap = tb_find_cap(&sw->ports[0], TB_CFG_SWITCH, TB_CAP_PLUG_EVENTS);
+	cap = tb_switch_find_vse_cap(sw, TB_VSE_CAP_PLUG_EVENTS);
 	if (cap < 0) {
-		tb_sw_warn(sw, "cannot find TB_CAP_PLUG_EVENTS aborting\n");
+		tb_sw_warn(sw, "cannot find TB_VSE_CAP_PLUG_EVENTS aborting\n");
 		goto err;
 	}
 	sw->cap_plug_events = cap;
drivers/thunderbolt/tb.c +4 -4
index 24b6d30c3c86..6b44076e1380 100644
@@ -121,8 +121,8 @@ static struct tb_port *tb_find_unused_down_port(struct tb_switch *sw)
 			continue;
 		if (sw->ports[i].config.type != TB_TYPE_PCIE_DOWN)
 			continue;
-		cap = tb_find_cap(&sw->ports[i], TB_CFG_PORT, TB_CAP_PCIE);
-		if (cap <= 0)
+		cap = tb_port_find_cap(&sw->ports[i], TB_PORT_CAP_ADAP);
+		if (cap < 0)
 			continue;
 		res = tb_port_read(&sw->ports[i], &data, TB_CFG_PORT, cap, 1);
 		if (res < 0)
@@ -165,8 +165,8 @@ static void tb_activate_pcie_devices(struct tb *tb)
 		}
 
 		/* check whether port is already activated */
-		cap = tb_find_cap(up_port, TB_CFG_PORT, TB_CAP_PCIE);
-		if (cap <= 0)
+		cap = tb_port_find_cap(up_port, TB_PORT_CAP_ADAP);
+		if (cap < 0)
 			continue;
 		if (tb_port_read(up_port, &data, TB_CFG_PORT, cap, 1))
 			continue;
drivers/thunderbolt/tb.h +2 -1
index ba2b85750335..0b78bc4fbe61 100644
@@ -233,7 +233,8 @@ int tb_wait_for_port(struct tb_port *port, bool wait_if_unplugged);
 int tb_port_add_nfc_credits(struct tb_port *port, int credits);
 int tb_port_clear_counter(struct tb_port *port, int counter);
 
-int tb_find_cap(struct tb_port *port, enum tb_cfg_space space, enum tb_cap cap);
+int tb_switch_find_vse_cap(struct tb_switch *sw, enum tb_switch_vse_cap vsec);
+int tb_port_find_cap(struct tb_port *port, enum tb_port_cap cap);
 
 struct tb_path *tb_path_alloc(struct tb *tb, int num_hops);
 void tb_path_free(struct tb_path *path);
drivers/thunderbolt/tb_regs.h +38 -12

68 lines not on this page · raw message

drivers/thunderbolt/tunnel_pci.c +4 -4
index baf1cd370446..f4ce9845e42a 100644
@@ -147,10 +147,10 @@ bool tb_pci_is_invalid(struct tb_pci_tunnel *tunnel)
 static int tb_pci_port_active(struct tb_port *port, bool active)
 {
 	u32 word = active ? 0x80000000 : 0x0;
-	int cap = tb_find_cap(port, TB_CFG_PORT, TB_CAP_PCIE);
-	if (cap <= 0) {
-		tb_port_warn(port, "TB_CAP_PCIE not found: %d\n", cap);
-		return cap ? cap : -ENXIO;
+	int cap = tb_port_find_cap(port, TB_PORT_CAP_ADAP);
+	if (cap < 0) {
+		tb_port_warn(port, "TB_PORT_CAP_ADAP not found: %d\n", cap);
+		return cap;
 	}
 	return tb_port_write(port, &word, TB_CFG_PORT, cap, 1);
 }
Signature · 1 line
2.11.0
#8 lore raw

PATCH v4 7/27 thunderbolt: Allow passing NULL to tb_ctl_free()

In reply to Mika Westerberg

Following the usual pattern used in many places, we allow passing NULL pointer to tb_ctl_free(). Then the user can call the function regardless if it has allocated control channel or not making the code bit simpler.

---
 drivers/thunderbolt/ctl.c | 4 ++++
 1 file changed, 4 insertions(+)
drivers/thunderbolt/ctl.c +4 -0
index 889a32dd21e7..f8290a577b2b 100644
@@ -520,6 +520,10 @@ struct tb_ctl *tb_ctl_alloc(struct tb_nhi *nhi, hotplug_cb cb, void *cb_data)
 void tb_ctl_free(struct tb_ctl *ctl)
 {
 	int i;
+
+	if (!ctl)
+		return;
+
 	if (ctl->rx)
 		ring_free(ctl->rx);
 	if (ctl->tx)
Signature · 1 line
2.11.0
#9 lore raw

PATCH v4 8/27 thunderbolt: Introduce thunderbolt bus and connection manager

In reply to Mika Westerberg

Thunderbolt fabric consists of one or more switches. This fabric is called domain and it is controlled by an entity called connection manager. The connection manager can be either internal (driven by a firmware running on the host controller) or external (software driver). This driver currently implements support for the latter.

In order to manage switches and their properties more easily we model this domain structure as a Linux bus. Each host controller adds a domain device to this bus, and these devices are named as domainN where N stands for index or id of the current domain.

We then abstract connection manager specific operations into a new structure tb_cm_ops and convert the existing tb.c to fill those accordingly. This makes it easier to add support for the internal connection manager in subsequent patches.

---
 drivers/thunderbolt/Makefile     |   2 +-
 drivers/thunderbolt/domain.c     | 230 +++++++++++++++++++++++++++++++++++++++
 drivers/thunderbolt/nhi.c        |  31 ++++--
 drivers/thunderbolt/tb.c         | 156 ++++++++++++--------------
 drivers/thunderbolt/tb.h         |  70 +++++++++---
 drivers/thunderbolt/tunnel_pci.c |   9 +-
 6 files changed, 377 insertions(+), 121 deletions(-)
 create mode 100644 drivers/thunderbolt/domain.c
drivers/thunderbolt/Makefile +1 -1
index 5d1053cdfa54..e276a9a62261 100644
@@ -1,3 +1,3 @@
 obj-${CONFIG_THUNDERBOLT} := thunderbolt.o
 thunderbolt-objs := nhi.o ctl.o tb.o switch.o cap.o path.o tunnel_pci.o eeprom.o
-
+thunderbolt-objs += domain.o
drivers/thunderbolt/domain.c new file +230 -0

230 lines not on this page · raw message

drivers/thunderbolt/nhi.c +23 -8
index ed75c49748f5..c1113a3c4128 100644
@@ -586,16 +586,16 @@ static int nhi_suspend_noirq(struct device *dev)
 {
 	struct pci_dev *pdev = to_pci_dev(dev);
 	struct tb *tb = pci_get_drvdata(pdev);
-	thunderbolt_suspend(tb);
-	return 0;
+
+	return tb_domain_suspend_noirq(tb);
 }
 
 static int nhi_resume_noirq(struct device *dev)
 {
 	struct pci_dev *pdev = to_pci_dev(dev);
 	struct tb *tb = pci_get_drvdata(pdev);
-	thunderbolt_resume(tb);
-	return 0;
+
+	return tb_domain_resume_noirq(tb);
 }
 
 static void nhi_shutdown(struct tb_nhi *nhi)
@@ -715,12 +715,17 @@ static int nhi_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	iowrite32(3906250 / 10000, nhi->iobase + 0x38c00);
 
 	dev_info(&nhi->pdev->dev, "NHI initialized, starting thunderbolt\n");
-	tb = thunderbolt_alloc_and_start(nhi);
-	if (!tb) {
+	tb = tb_probe(nhi);
+	if (!tb)
+		return -ENODEV;
+
+	res = tb_domain_add(tb);
+	if (res) {
 		/*
 		 * At this point the RX/TX rings might already have been
 		 * activated. Do a proper shutdown.
 		 */
+		tb_domain_put(tb);
 		nhi_shutdown(nhi);
 		return -EIO;
 	}
@@ -733,7 +738,8 @@ static void nhi_remove(struct pci_dev *pdev)
 {
 	struct tb *tb = pci_get_drvdata(pdev);
 	struct tb_nhi *nhi = tb->nhi;
-	thunderbolt_shutdown_and_free(tb);
+
+	tb_domain_remove(tb);
 	nhi_shutdown(nhi);
 }
 
@@ -797,14 +803,23 @@ static struct pci_driver nhi_driver = {
 
 static int __init nhi_init(void)
 {
+	int ret;
+
 	if (!dmi_match(DMI_BOARD_VENDOR, "Apple Inc."))
 		return -ENOSYS;
-	return pci_register_driver(&nhi_driver);
+	ret = tb_domain_init();
+	if (ret)
+		return ret;
+	ret = pci_register_driver(&nhi_driver);
+	if (ret)
+		tb_domain_exit();
+	return ret;
 }
 
 static void __exit nhi_unload(void)
 {
 	pci_unregister_driver(&nhi_driver);
+	tb_domain_exit();
 }
 
 module_init(nhi_init);
drivers/thunderbolt/tb.c +69 -87

245 lines not on this page · raw message

drivers/thunderbolt/tb.h +53 -17

93 lines not on this page · raw message

drivers/thunderbolt/tunnel_pci.c +1 -8
index f4ce9845e42a..ca4475907d7a 100644
@@ -194,19 +194,13 @@ int tb_pci_restart(struct tb_pci_tunnel *tunnel)
  */
 int tb_pci_activate(struct tb_pci_tunnel *tunnel)
 {
-	int res;
 	if (tunnel->path_to_up->activated || tunnel->path_to_down->activated) {
 		tb_tunnel_WARN(tunnel,
 			       "trying to activate an already activated tunnel\n");
 		return -EINVAL;
 	}
 
-	res = tb_pci_restart(tunnel);
-	if (res)
-		return res;
-
-	list_add(&tunnel->list, &tunnel->tb->tunnel_list);
-	return 0;
+	return tb_pci_restart(tunnel);
 }
 
 
@@ -227,6 +221,5 @@ void tb_pci_deactivate(struct tb_pci_tunnel *tunnel)
 		tb_path_deactivate(tunnel->path_to_down);
 	if (tunnel->path_to_up->activated)
 		tb_path_deactivate(tunnel->path_to_up);
-	list_del_init(&tunnel->list);
 }
 
Signature · 1 line
2.11.0
#10 lore raw

PATCH v4 9/27 thunderbolt: Convert switch to a device

In reply to Mika Westerberg

Thunderbolt domain consists of switches that are connected to each other, forming a bus. This will convert each switch into a real Linux device structure and adds them to the domain. The advantage here is that we get all the goodies from the driver core, like reference counting and sysfs hierarchy for free.

Also expose device identification information to the userspace via new sysfs attributes.

In order to support internal connection manager (ICM) we separate switch configuration into its own function (tb_switch_configure()) which is only called by the existing native connection manager implementation used on Macs.

---
 Documentation/ABI/testing/sysfs-bus-thunderbolt |  22 ++
 drivers/thunderbolt/eeprom.c                    |   2 +
 drivers/thunderbolt/switch.c                    | 261 +++++++++++++++++++-----
 drivers/thunderbolt/tb.c                        |  40 +++-
 drivers/thunderbolt/tb.h                        |  45 +++-
 5 files changed, 303 insertions(+), 67 deletions(-)
 create mode 100644 Documentation/ABI/testing/sysfs-bus-thunderbolt
Documentation/ABI/testing/sysfs-bus-thunderbolt new file +22 -0
new file mode 100644
index 000000000000..9f1bd0086938
@@ -0,0 +1,22 @@
+What:		/sys/bus/thunderbolt/devices/.../device
+Date:		Sep 2017
+KernelVersion:	4.13
+Contact:	[email protected]
+Description:	This attribute contains id of this device extracted from
+		the device DROM.
+
+What:		/sys/bus/thunderbolt/devices/.../vendor
+Date:		Sep 2017
+KernelVersion:	4.13
+Contact:	[email protected]
+Description:	This attribute contains vendor id of this device extracted
+		from the device DROM.
+
+What:		/sys/bus/thunderbolt/devices/.../unique_id
+Date:		Sep 2017
+KernelVersion:	4.13
+Contact:	[email protected]
+Description:	This attribute contains unique_id string of this device.
+		This is either read from hardware registers (UUID on
+		newer hardware) or based on UID from the device DROM.
+		Can be used to uniquely identify particular device.
drivers/thunderbolt/eeprom.c +2 -0
index eb2179c98b09..7e485e3ef27e 100644
@@ -479,6 +479,8 @@ int tb_drom_read(struct tb_switch *sw)
 		goto err;
 	}
 	sw->uid = header->uid;
+	sw->vendor = header->vendor_id;
+	sw->device = header->model_id;
 
 	crc = tb_crc32(sw->drom + TB_DROM_DATA_START, header->data_len);
 	if (crc != header->data_crc32) {
drivers/thunderbolt/switch.c +207 -54

325 lines not on this page · raw message

drivers/thunderbolt/tb.c +31 -9
index 9f00a0f28d53..94ecac012428 100644
@@ -61,9 +61,21 @@ static void tb_scan_port(struct tb_port *port)
 		tb_port_WARN(port, "port already has a remote!\n");
 		return;
 	}
-	sw = tb_switch_alloc(port->sw->tb, tb_downstream_route(port));
+	sw = tb_switch_alloc(port->sw->tb, &port->sw->dev,
+			     tb_downstream_route(port));
 	if (!sw)
 		return;
+
+	if (tb_switch_configure(sw)) {
+		tb_switch_put(sw);
+		return;
+	}
+
+	if (tb_switch_add(sw)) {
+		tb_switch_put(sw);
+		return;
+	}
+
 	port->remote = tb_upstream_port(sw);
 	tb_upstream_port(sw)->remote = port;
 	tb_scan_switch(sw);
@@ -100,7 +112,7 @@ static void tb_free_unplugged_children(struct tb_switch *sw)
 		if (!port->remote)
 			continue;
 		if (port->remote->sw->is_unplugged) {
-			tb_switch_free(port->remote->sw);
+			tb_switch_remove(port->remote->sw);
 			port->remote = NULL;
 		} else {
 			tb_free_unplugged_children(port->remote->sw);
@@ -266,7 +278,7 @@ static void tb_handle_hotplug(struct work_struct *work)
 			tb_port_info(port, "unplugged\n");
 			tb_sw_set_unplugged(port->remote->sw);
 			tb_free_invalid_tunnels(tb);
-			tb_switch_free(port->remote->sw);
+			tb_switch_remove(port->remote->sw);
 			port->remote = NULL;
 		} else {
 			tb_port_info(port,
@@ -325,22 +337,32 @@ static void tb_stop(struct tb *tb)
 		tb_pci_deactivate(tunnel);
 		tb_pci_free(tunnel);
 	}
-
-	if (tb->root_switch)
-		tb_switch_free(tb->root_switch);
-	tb->root_switch = NULL;
-
+	tb_switch_remove(tb->root_switch);
 	tcm->hotplug_active = false; /* signal tb_handle_hotplug to quit */
 }
 
 static int tb_start(struct tb *tb)
 {
 	struct tb_cm *tcm = tb_priv(tb);
+	int ret;
 
-	tb->root_switch = tb_switch_alloc(tb, 0);
+	tb->root_switch = tb_switch_alloc(tb, &tb->dev, 0);
 	if (!tb->root_switch)
 		return -ENOMEM;
 
+	ret = tb_switch_configure(tb->root_switch);
+	if (ret) {
+		tb_switch_put(tb->root_switch);
+		return ret;
+	}
+
+	/* Announce the switch to the world */
+	ret = tb_switch_add(tb->root_switch);
+	if (ret) {
+		tb_switch_put(tb->root_switch);
+		return ret;
+	}
+
 	/* Full scan to discover devices added before the driver was loaded. */
 	tb_scan_switch(tb->root_switch);
 	tb_activate_pcie_devices(tb);
drivers/thunderbolt/tb.h +41 -4

81 lines not on this page · raw message

Signature · 1 line
2.11.0
#11 lore raw

PATCH v4 10/27 thunderbolt: Fail switch adding operation if reading DROM fails

In reply to Mika Westerberg

All non-root switches are expected to have DROM so if the operation fails, it might be due the user unlugging the device. There is no point continuing adding the switch further in that case. Just bail out.

For root switches (hosts) the DROM is either retrieved from a EFI variable, NVM or hard-coded.

---
 drivers/thunderbolt/switch.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/thunderbolt/switch.c +5 -2
index 0475bfc6c208..2390f08b94da 100644
@@ -535,8 +535,11 @@ int tb_switch_add(struct tb_switch *sw)
 	int i, ret;
 
 	/* read drom */
-	if (tb_drom_read(sw))
-		tb_sw_warn(sw, "tb_eeprom_read_rom failed, continuing\n");
+	ret = tb_drom_read(sw);
+	if (ret) {
+		tb_sw_warn(sw, "tb_eeprom_read_rom failed\n");
+		return ret;
+	}
 	tb_sw_info(sw, "uid: %#llx\n", sw->uid);
 
 	tb_switch_set_uuid(sw);
Signature · 1 line
2.11.0
#12 lore raw

PATCH v4 11/27 thunderbolt: Do not fail if DROM data CRC32 is invalid

In reply to Mika Westerberg

There are devices out there where CRC32 of the DROM is not correct. One reason for this is that the ICM firmware does not validate it and it seems that neither does the Apple driver. To be able to support such devices we continue parsing the DROM contents regardless of whether CRC32 failed or not. We still keep the warning there.

---
 drivers/thunderbolt/eeprom.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/thunderbolt/eeprom.c +1 -2
index 7e485e3ef27e..e2c1f8a45522 100644
@@ -485,9 +485,8 @@ int tb_drom_read(struct tb_switch *sw)
 	crc = tb_crc32(sw->drom + TB_DROM_DATA_START, header->data_len);
 	if (crc != header->data_crc32) {
 		tb_sw_warn(sw,
-			"drom data crc32 mismatch (expected: %#x, got: %#x), aborting\n",
+			"drom data crc32 mismatch (expected: %#x, got: %#x), continuing\n",
 			header->data_crc32, crc);
-		goto err;
 	}
 
 	if (header->device_rom_revision > 2)
Signature · 1 line
2.11.0
#13 lore raw

PATCH v4 12/27 thunderbolt: Refactor and fix parsing of port drom entries

In reply to Mika Westerberg

From: Lukas Wunner <[email protected]>

Currently tb_drom_parse_entry() is only able to parse drom entries of type TB_DROM_ENTRY_PORT. Rename it to tb_drom_parse_entry_port(). Fold tb_drom_parse_port_entry() into it.

Its return value is currently ignored. Evaluate it and abort parsing on error.

Change tb_drom_parse_entries() to accommodate for parsing of other entry types than TB_DROM_ENTRY_PORT.

---
 drivers/thunderbolt/eeprom.c | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)
drivers/thunderbolt/eeprom.c +16 -16
index e2c1f8a45522..5c7d80a109b1 100644
@@ -295,25 +295,13 @@ int tb_drom_read_uid_only(struct tb_switch *sw, u64 *uid)
 	return 0;
 }
 
-static void tb_drom_parse_port_entry(struct tb_port *port,
-		struct tb_drom_entry_port *entry)
-{
-	port->link_nr = entry->link_nr;
-	if (entry->has_dual_link_port)
-		port->dual_link_port =
-				&port->sw->ports[entry->dual_link_port_nr];
-}
-
-static int tb_drom_parse_entry(struct tb_switch *sw,
-		struct tb_drom_entry_header *header)
+static int tb_drom_parse_entry_port(struct tb_switch *sw,
+				    struct tb_drom_entry_header *header)
 {
 	struct tb_port *port;
 	int res;
 	enum tb_port_type type;
 
-	if (header->type != TB_DROM_ENTRY_PORT)
-		return 0;
-
 	port = &sw->ports[header->index];
 	port->disabled = header->port_disabled;
 	if (port->disabled)
@@ -332,7 +320,10 @@ static int tb_drom_parse_entry(struct tb_switch *sw,
 				header->len, sizeof(struct tb_drom_entry_port));
 			return -EIO;
 		}
-		tb_drom_parse_port_entry(port, entry);
+		port->link_nr = entry->link_nr;
+		if (entry->has_dual_link_port)
+			port->dual_link_port =
+				&port->sw->ports[entry->dual_link_port_nr];
 	}
 	return 0;
 }
@@ -347,6 +338,7 @@ static int tb_drom_parse_entries(struct tb_switch *sw)
 	struct tb_drom_header *header = (void *) sw->drom;
 	u16 pos = sizeof(*header);
 	u16 drom_size = header->data_len + TB_DROM_DATA_START;
+	int res;
 
 	while (pos < drom_size) {
 		struct tb_drom_entry_header *entry = (void *) (sw->drom + pos);
@@ -356,7 +348,15 @@ static int tb_drom_parse_entries(struct tb_switch *sw)
 			return -EIO;
 		}
 
-		tb_drom_parse_entry(sw, entry);
+		switch (entry->type) {
+		case TB_DROM_ENTRY_GENERIC:
+			break;
+		case TB_DROM_ENTRY_PORT:
+			res = tb_drom_parse_entry_port(sw, entry);
+			break;
+		}
+		if (res)
+			return res;
 
 		pos += entry->len;
 	}
Signature · 1 line
2.11.0
#14 lore raw

PATCH v4 13/27 thunderbolt: Read vendor and device name from DROM

In reply to Mika Westerberg

The device DROM contains name of the vendor and device among other things. Extract this information and expose it to the userspace via two new attributes.

---
 Documentation/ABI/testing/sysfs-bus-thunderbolt | 14 +++++++++++
 drivers/thunderbolt/eeprom.c                    | 32 +++++++++++++++++++++++++
 drivers/thunderbolt/switch.c                    | 22 +++++++++++++++++
 drivers/thunderbolt/tb.h                        |  4 ++++
 4 files changed, 72 insertions(+)
Documentation/ABI/testing/sysfs-bus-thunderbolt +14 -0
index 9f1bd0086938..29a516f53d2c 100644
@@ -5,6 +5,13 @@ Contact:	[email protected]
 Description:	This attribute contains id of this device extracted from
 		the device DROM.
 
+What:		/sys/bus/thunderbolt/devices/.../device_name
+Date:		Sep 2017
+KernelVersion:	4.13
+Contact:	[email protected]
+Description:	This attribute contains name of this device extracted from
+		the device DROM.
+
 What:		/sys/bus/thunderbolt/devices/.../vendor
 Date:		Sep 2017
 KernelVersion:	4.13
@@ -12,6 +19,13 @@ Contact:	[email protected]
 Description:	This attribute contains vendor id of this device extracted
 		from the device DROM.
 
+What:		/sys/bus/thunderbolt/devices/.../vendor_name
+Date:		Sep 2017
+KernelVersion:	4.13
+Contact:	[email protected]
+Description:	This attribute contains vendor name of this device extracted
+		from the device DROM.
+
 What:		/sys/bus/thunderbolt/devices/.../unique_id
 Date:		Sep 2017
 KernelVersion:	4.13
drivers/thunderbolt/eeprom.c +32 -0
index 5c7d80a109b1..d40a5f07fc4c 100644
@@ -204,6 +204,11 @@ struct tb_drom_entry_header {
 	enum tb_drom_entry_type type:1;
 } __packed;
 
+struct tb_drom_entry_generic {
+	struct tb_drom_entry_header header;
+	u8 data[0];
+} __packed;
+
 struct tb_drom_entry_port {
 	/* BYTES 0-1 */
 	struct tb_drom_entry_header header;
@@ -295,6 +300,32 @@ int tb_drom_read_uid_only(struct tb_switch *sw, u64 *uid)
 	return 0;
 }
 
+static int tb_drom_parse_entry_generic(struct tb_switch *sw,
+		struct tb_drom_entry_header *header)
+{
+	const struct tb_drom_entry_generic *entry =
+		(const struct tb_drom_entry_generic *)header;
+
+	switch (header->index) {
+	case 1:
+		/* Length includes 2 bytes header so remove it before copy */
+		sw->vendor_name = kstrndup(entry->data,
+			header->len - sizeof(*header), GFP_KERNEL);
+		if (!sw->vendor_name)
+			return -ENOMEM;
+		break;
+
+	case 2:
+		sw->device_name = kstrndup(entry->data,
+			header->len - sizeof(*header), GFP_KERNEL);
+		if (!sw->device_name)
+			return -ENOMEM;
+		break;
+	}
+
+	return 0;
+}
+
 static int tb_drom_parse_entry_port(struct tb_switch *sw,
 				    struct tb_drom_entry_header *header)
 {
@@ -350,6 +381,7 @@ static int tb_drom_parse_entries(struct tb_switch *sw)
 
 		switch (entry->type) {
 		case TB_DROM_ENTRY_GENERIC:
+			res = tb_drom_parse_entry_generic(sw, entry);
 			break;
 		case TB_DROM_ENTRY_PORT:
 			res = tb_drom_parse_entry_port(sw, entry);
drivers/thunderbolt/switch.c +22 -0
index 2390f08b94da..11f16a141686 100644
@@ -319,6 +319,15 @@ static ssize_t device_show(struct device *dev, struct device_attribute *attr,
 }
 static DEVICE_ATTR_RO(device);
 
+static ssize_t
+device_name_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct tb_switch *sw = tb_to_switch(dev);
+
+	return sprintf(buf, "%s\n", sw->device_name ? sw->device_name : "");
+}
+static DEVICE_ATTR_RO(device_name);
+
 static ssize_t vendor_show(struct device *dev, struct device_attribute *attr,
 			   char *buf)
 {
@@ -328,6 +337,15 @@ static ssize_t vendor_show(struct device *dev, struct device_attribute *attr,
 }
 static DEVICE_ATTR_RO(vendor);
 
+static ssize_t
+vendor_name_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct tb_switch *sw = tb_to_switch(dev);
+
+	return sprintf(buf, "%s\n", sw->vendor_name ? sw->vendor_name : "");
+}
+static DEVICE_ATTR_RO(vendor_name);
+
 static ssize_t unique_id_show(struct device *dev, struct device_attribute *attr,
 			      char *buf)
 {
@@ -339,7 +357,9 @@ static DEVICE_ATTR_RO(unique_id);
 
 static struct attribute *switch_attrs[] = {
 	&dev_attr_device.attr,
+	&dev_attr_device_name.attr,
 	&dev_attr_vendor.attr,
+	&dev_attr_vendor_name.attr,
 	&dev_attr_unique_id.attr,
 	NULL,
 };
@@ -358,6 +378,8 @@ static void tb_switch_release(struct device *dev)
 	struct tb_switch *sw = tb_to_switch(dev);
 
 	kfree(sw->uuid);
+	kfree(sw->device_name);
+	kfree(sw->vendor_name);
 	kfree(sw->ports);
 	kfree(sw->drom);
 	kfree(sw);
drivers/thunderbolt/tb.h +4 -0
index f7dfe733d71a..6d4910ef2eb9 100644
@@ -23,6 +23,8 @@
  * @uuid: UUID of the switch (or %NULL if not supported)
  * @vendor: Vendor ID of the switch
  * @device: Device ID of the switch
+ * @vendor_name: Name of the vendor (or %NULL if not known)
+ * @device_name: Name of the device (or %NULL if not known)
  * @cap_plug_events: Offset to the plug events capability (%0 if not found)
  * @is_unplugged: The switch is going away
  * @drom: DROM of the switch (%NULL if not found)
@@ -36,6 +38,8 @@ struct tb_switch {
 	uuid_be *uuid;
 	u16 vendor;
 	u16 device;
+	const char *vendor_name;
+	const char *device_name;
 	int cap_plug_events;
 	bool is_unplugged;
 	u8 *drom;
Signature · 1 line
2.11.0
#15 lore raw

PATCH v4 14/27 thunderbolt: Move control channel messages to tb_msgs.h

In reply to Mika Westerberg

We will be forwarding notifications received from the control channel to the connection manager implementations. This way they can decide what to do if anything when a notification is received.

To be able to use control channel messages from other files, move them to tb_msgs.h.

No functional changes intended.

---
 drivers/thunderbolt/ctl.c     |  76 -----------------------------
 drivers/thunderbolt/ctl.h     |  16 +------
 drivers/thunderbolt/tb_msgs.h | 108 ++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 109 insertions(+), 91 deletions(-)
 create mode 100644 drivers/thunderbolt/tb_msgs.h
drivers/thunderbolt/ctl.c +0 -76
index f8290a577b2b..24118c60b062 100644
@@ -52,82 +52,6 @@ struct tb_ctl {
 #define tb_ctl_info(ctl, format, arg...) \
 	dev_info(&(ctl)->nhi->pdev->dev, format, ## arg)
 
-
-/* configuration packets definitions */
-
-enum tb_cfg_pkg_type {
-	TB_CFG_PKG_READ = 1,
-	TB_CFG_PKG_WRITE = 2,
-	TB_CFG_PKG_ERROR = 3,
-	TB_CFG_PKG_NOTIFY_ACK = 4,
-	TB_CFG_PKG_EVENT = 5,
-	TB_CFG_PKG_XDOMAIN_REQ = 6,
-	TB_CFG_PKG_XDOMAIN_RESP = 7,
-	TB_CFG_PKG_OVERRIDE = 8,
-	TB_CFG_PKG_RESET = 9,
-	TB_CFG_PKG_PREPARE_TO_SLEEP = 0xd,
-};
-
-/* common header */
-struct tb_cfg_header {
-	u32 route_hi:22;
-	u32 unknown:10; /* highest order bit is set on replies */
-	u32 route_lo;
-} __packed;
-
-/* additional header for read/write packets */
-struct tb_cfg_address {
-	u32 offset:13; /* in dwords */
-	u32 length:6; /* in dwords */
-	u32 port:6;
-	enum tb_cfg_space space:2;
-	u32 seq:2; /* sequence number  */
-	u32 zero:3;
-} __packed;
-
-/* TB_CFG_PKG_READ, response for TB_CFG_PKG_WRITE */
-struct cfg_read_pkg {
-	struct tb_cfg_header header;
-	struct tb_cfg_address addr;
-} __packed;
-
-/* TB_CFG_PKG_WRITE, response for TB_CFG_PKG_READ */
-struct cfg_write_pkg {
-	struct tb_cfg_header header;
-	struct tb_cfg_address addr;
-	u32 data[64]; /* maximum size, tb_cfg_address.length has 6 bits */
-} __packed;
-
-/* TB_CFG_PKG_ERROR */
-struct cfg_error_pkg {
-	struct tb_cfg_header header;
-	enum tb_cfg_error error:4;
-	u32 zero1:4;
-	u32 port:6;
-	u32 zero2:2; /* Both should be zero, still they are different fields. */
-	u32 zero3:16;
-} __packed;
-
-/* TB_CFG_PKG_EVENT */
-struct cfg_event_pkg {
-	struct tb_cfg_header header;
-	u32 port:6;
-	u32 zero:25;
-	bool unplug:1;
-} __packed;
-
-/* TB_CFG_PKG_RESET */
-struct cfg_reset_pkg {
-	struct tb_cfg_header header;
-} __packed;
-
-/* TB_CFG_PKG_PREPARE_TO_SLEEP */
-struct cfg_pts_pkg {
-	struct tb_cfg_header header;
-	u32 data;
-} __packed;
-
-
 /* utility functions */
 
 static u64 get_route(struct tb_cfg_header header)
drivers/thunderbolt/ctl.h +1 -15
index 83ae54947082..610980e3232f 100644
@@ -8,6 +8,7 @@
 #define _TB_CFG
 
 #include "nhi.h"
+#include "tb_msgs.h"
 
 /* control channel */
 struct tb_ctl;
@@ -23,21 +24,6 @@ void tb_ctl_free(struct tb_ctl *ctl);
 
 #define TB_CFG_DEFAULT_TIMEOUT 5000 /* msec */
 
-enum tb_cfg_space {
-	TB_CFG_HOPS = 0,
-	TB_CFG_PORT = 1,
-	TB_CFG_SWITCH = 2,
-	TB_CFG_COUNTERS = 3,
-};
-
-enum tb_cfg_error {
-	TB_CFG_ERROR_PORT_NOT_CONNECTED = 0,
-	TB_CFG_ERROR_INVALID_CONFIG_SPACE = 2,
-	TB_CFG_ERROR_NO_SUCH_PORT = 4,
-	TB_CFG_ERROR_ACK_PLUG_EVENT = 7, /* send as reply to TB_CFG_PKG_EVENT */
-	TB_CFG_ERROR_LOOP = 8,
-};
-
 struct tb_cfg_result {
 	u64 response_route;
 	u32 response_port; /*
drivers/thunderbolt/tb_msgs.h new file +108 -0

108 lines not on this page · raw message

Signature · 1 line
2.11.0
#16 lore raw

PATCH v4 15/27 thunderbolt: Expose get_route() to other files

In reply to Mika Westerberg

We are going to use it when we change the connection manager to handle events itself. Also rename it to follow naming convention used in functions exposed in ctl.h.

---
 drivers/thunderbolt/ctl.c | 19 +++++++------------
 drivers/thunderbolt/ctl.h |  4 ++++
 2 files changed, 11 insertions(+), 12 deletions(-)
drivers/thunderbolt/ctl.c +7 -12
index 24118c60b062..8352ee8662aa 100644
@@ -54,11 +54,6 @@ struct tb_ctl {
 
 /* utility functions */
 
-static u64 get_route(struct tb_cfg_header header)
-{
-	return (u64) header.route_hi << 32 | header.route_lo;
-}
-
 static struct tb_cfg_header make_header(u64 route)
 {
 	struct tb_cfg_header header = {
@@ -66,7 +61,7 @@ static struct tb_cfg_header make_header(u64 route)
 		.route_lo = route,
 	};
 	/* check for overflow, route_hi is not 32 bits! */
-	WARN_ON(get_route(header) != route);
+	WARN_ON(tb_cfg_get_route(&header) != route);
 	return header;
 }
 
@@ -91,9 +86,9 @@ static int check_header(struct ctl_pkg *pkg, u32 len, enum tb_cfg_pkg_type type,
 	if (WARN(header->unknown != 1 << 9,
 			"header->unknown is %#x\n", header->unknown))
 		return -EIO;
-	if (WARN(route != get_route(*header),
+	if (WARN(route != tb_cfg_get_route(header),
 			"wrong route (expected %llx, got %llx)",
-			route, get_route(*header)))
+			route, tb_cfg_get_route(header)))
 		return -EIO;
 	return 0;
 }
@@ -126,10 +121,10 @@ static struct tb_cfg_result decode_error(struct ctl_pkg *response)
 {
 	struct cfg_error_pkg *pkg = response->buffer;
 	struct tb_cfg_result res = { 0 };
-	res.response_route = get_route(pkg->header);
+	res.response_route = tb_cfg_get_route(&pkg->header);
 	res.response_port = 0;
 	res.err = check_header(response, sizeof(*pkg), TB_CFG_PKG_ERROR,
-			       get_route(pkg->header));
+			       tb_cfg_get_route(&pkg->header));
 	if (res.err)
 		return res;
 
@@ -153,7 +148,7 @@ static struct tb_cfg_result parse_header(struct ctl_pkg *pkg, u32 len,
 		return decode_error(pkg);
 
 	res.response_port = 0; /* will be updated later for cfg_read/write */
-	res.response_route = get_route(*header);
+	res.response_route = tb_cfg_get_route(header);
 	res.err = check_header(pkg, len, type, route);
 	return res;
 }
@@ -294,7 +289,7 @@ static void tb_ctl_handle_plug_event(struct tb_ctl *ctl,
 				     struct ctl_pkg *response)
 {
 	struct cfg_event_pkg *pkg = response->buffer;
-	u64 route = get_route(pkg->header);
+	u64 route = tb_cfg_get_route(&pkg->header);
 
 	if (check_header(response, sizeof(*pkg), TB_CFG_PKG_EVENT, route)) {
 		tb_ctl_warn(ctl, "malformed TB_CFG_PKG_EVENT\n");
drivers/thunderbolt/ctl.h +4 -0
index 610980e3232f..9812b1c86d4f 100644
@@ -38,6 +38,10 @@ struct tb_cfg_result {
 	enum tb_cfg_error tb_error; /* valid if err == 1 */
 };
 
+static inline u64 tb_cfg_get_route(const struct tb_cfg_header *header)
+{
+	return (u64) header->route_hi << 32 | header->route_lo;
+}
 
 int tb_cfg_error(struct tb_ctl *ctl, u64 route, u32 port,
 		 enum tb_cfg_error error);
Signature · 1 line
2.11.0
#17 lore raw

PATCH v4 16/27 thunderbolt: Expose make_header() to other files

In reply to Mika Westerberg

We will be using this function in files introduced in subsequent patches. While there the function is renamed to tb_cfg_make_header() following tb_cfg_get_route().

---
 drivers/thunderbolt/ctl.c | 19 ++++---------------
 drivers/thunderbolt/ctl.h | 11 +++++++++++
 2 files changed, 15 insertions(+), 15 deletions(-)
drivers/thunderbolt/ctl.c +4 -15
index 8352ee8662aa..c6633da582b8 100644
@@ -54,17 +54,6 @@ struct tb_ctl {
 
 /* utility functions */
 
-static struct tb_cfg_header make_header(u64 route)
-{
-	struct tb_cfg_header header = {
-		.route_hi = route >> 32,
-		.route_lo = route,
-	};
-	/* check for overflow, route_hi is not 32 bits! */
-	WARN_ON(tb_cfg_get_route(&header) != route);
-	return header;
-}
-
 static int check_header(struct ctl_pkg *pkg, u32 len, enum tb_cfg_pkg_type type,
 			u64 route)
 {
@@ -501,7 +490,7 @@ int tb_cfg_error(struct tb_ctl *ctl, u64 route, u32 port,
 		 enum tb_cfg_error error)
 {
 	struct cfg_error_pkg pkg = {
-		.header = make_header(route),
+		.header = tb_cfg_make_header(route),
 		.port = port,
 		.error = error,
 	};
@@ -520,7 +509,7 @@ struct tb_cfg_result tb_cfg_reset(struct tb_ctl *ctl, u64 route,
 				  int timeout_msec)
 {
 	int err;
-	struct cfg_reset_pkg request = { .header = make_header(route) };
+	struct cfg_reset_pkg request = { .header = tb_cfg_make_header(route) };
 	struct tb_cfg_header reply;
 
 	err = tb_ctl_tx(ctl, &request, sizeof(request), TB_CFG_PKG_RESET);
@@ -542,7 +531,7 @@ struct tb_cfg_result tb_cfg_read_raw(struct tb_ctl *ctl, void *buffer,
 {
 	struct tb_cfg_result res = { 0 };
 	struct cfg_read_pkg request = {
-		.header = make_header(route),
+		.header = tb_cfg_make_header(route),
 		.addr = {
 			.port = port,
 			.space = space,
@@ -579,7 +568,7 @@ struct tb_cfg_result tb_cfg_write_raw(struct tb_ctl *ctl, const void *buffer,
 {
 	struct tb_cfg_result res = { 0 };
 	struct cfg_write_pkg request = {
-		.header = make_header(route),
+		.header = tb_cfg_make_header(route),
 		.addr = {
 			.port = port,
 			.space = space,
drivers/thunderbolt/ctl.h +11 -0
index 9812b1c86d4f..914da86ec77d 100644
@@ -43,6 +43,17 @@ static inline u64 tb_cfg_get_route(const struct tb_cfg_header *header)
 	return (u64) header->route_hi << 32 | header->route_lo;
 }
 
+static inline struct tb_cfg_header tb_cfg_make_header(u64 route)
+{
+	struct tb_cfg_header header = {
+		.route_hi = route >> 32,
+		.route_lo = route,
+	};
+	/* check for overflow, route_hi is not 32 bits! */
+	WARN_ON(tb_cfg_get_route(&header) != route);
+	return header;
+}
+
 int tb_cfg_error(struct tb_ctl *ctl, u64 route, u32 port,
 		 enum tb_cfg_error error);
 struct tb_cfg_result tb_cfg_reset(struct tb_ctl *ctl, u64 route,
Signature · 1 line
2.11.0
#18 lore raw

PATCH v4 17/27 thunderbolt: Let the connection manager handle all notifications

In reply to Mika Westerberg

Currently the control channel (ctl.c) handles the one supported notification (PLUG_EVENT) and sends back ACK accordingly. However, we are going to add support for the internal connection manager (ICM) that needs to handle a different notifications. So instead of dealing everything in the control channel, we change the callback to take an arbitrary thunderbolt packet and convert the native connection manager to handle the event itself.

In addition we only push replies we know of to the response FIFO. Everything else is treated as notification (or request) and is expected to be dealt by the connection manager implementation.

---
 drivers/thunderbolt/ctl.c    | 86 ++++++++++++++++++++++++++++++--------------
 drivers/thunderbolt/ctl.h    |  5 +--
 drivers/thunderbolt/domain.c | 15 +++++++-
 drivers/thunderbolt/tb.c     | 30 ++++++++++++----
 drivers/thunderbolt/tb.h     |  5 +--
 5 files changed, 103 insertions(+), 38 deletions(-)
drivers/thunderbolt/ctl.c +60 -26
index c6633da582b8..5417ed244edc 100644
@@ -35,7 +35,7 @@ struct tb_ctl {
 	DECLARE_KFIFO(response_fifo, struct ctl_pkg*, 16);
 	struct completion response_ready;
 
-	hotplug_cb callback;
+	event_cb callback;
 	void *callback_data;
 };
 
@@ -52,6 +52,9 @@ struct tb_ctl {
 #define tb_ctl_info(ctl, format, arg...) \
 	dev_info(&(ctl)->nhi->pdev->dev, format, ## arg)
 
+#define tb_ctl_dbg(ctl, format, arg...) \
+	dev_dbg(&(ctl)->nhi->pdev->dev, format, ## arg)
+
 /* utility functions */
 
 static int check_header(struct ctl_pkg *pkg, u32 len, enum tb_cfg_pkg_type type,
@@ -272,24 +275,12 @@ static int tb_ctl_tx(struct tb_ctl *ctl, const void *data, size_t len,
 }
 
 /**
- * tb_ctl_handle_plug_event() - acknowledge a plug event, invoke ctl->callback
+ * tb_ctl_handle_event() - acknowledge a plug event, invoke ctl->callback
  */
-static void tb_ctl_handle_plug_event(struct tb_ctl *ctl,
-				     struct ctl_pkg *response)
+static void tb_ctl_handle_event(struct tb_ctl *ctl, enum tb_cfg_pkg_type type,
+				struct ctl_pkg *pkg, size_t size)
 {
-	struct cfg_event_pkg *pkg = response->buffer;
-	u64 route = tb_cfg_get_route(&pkg->header);
-
-	if (check_header(response, sizeof(*pkg), TB_CFG_PKG_EVENT, route)) {
-		tb_ctl_warn(ctl, "malformed TB_CFG_PKG_EVENT\n");
-		return;
-	}
-
-	if (tb_cfg_error(ctl, route, pkg->port, TB_CFG_ERROR_ACK_PLUG_EVENT))
-		tb_ctl_warn(ctl, "could not ack plug event on %llx:%x\n",
-			    route, pkg->port);
-	WARN(pkg->zero, "pkg->zero is %#x\n", pkg->zero);
-	ctl->callback(ctl->callback_data, route, pkg->port, pkg->unplug);
+	ctl->callback(ctl->callback_data, type, pkg->buffer, size);
 }
 
 static void tb_ctl_rx_submit(struct ctl_pkg *pkg)
@@ -302,10 +293,29 @@ static void tb_ctl_rx_submit(struct ctl_pkg *pkg)
 					     */
 }
 
+static int tb_async_error(const struct ctl_pkg *pkg)
+{
+	const struct cfg_error_pkg *error = (const struct cfg_error_pkg *)pkg;
+
+	if (pkg->frame.eof != TB_CFG_PKG_ERROR)
+		return false;
+
+	switch (error->error) {
+	case TB_CFG_ERROR_LINK_ERROR:
+	case TB_CFG_ERROR_HEC_ERROR_DETECTED:
+	case TB_CFG_ERROR_FLOW_CONTROL_ERROR:
+		return true;
+
+	default:
+		return false;
+	}
+}
+
 static void tb_ctl_rx_callback(struct tb_ring *ring, struct ring_frame *frame,
 			       bool canceled)
 {
 	struct ctl_pkg *pkg = container_of(frame, typeof(*pkg), frame);
+	__be32 crc32;
 
 	if (canceled)
 		return; /*
@@ -320,18 +330,42 @@ static void tb_ctl_rx_callback(struct tb_ring *ring, struct ring_frame *frame,
 	}
 
 	frame->size -= 4; /* remove checksum */
-	if (*(__be32 *) (pkg->buffer + frame->size)
-			!= tb_crc(pkg->buffer, frame->size)) {
-		tb_ctl_err(pkg->ctl,
-			   "RX: checksum mismatch, dropping packet\n");
-		goto rx;
-	}
+	crc32 = tb_crc(pkg->buffer, frame->size);
 	be32_to_cpu_array(pkg->buffer, pkg->buffer, frame->size / 4);
 
-	if (frame->eof == TB_CFG_PKG_EVENT) {
-		tb_ctl_handle_plug_event(pkg->ctl, pkg);
+	switch (frame->eof) {
+	case TB_CFG_PKG_READ:
+	case TB_CFG_PKG_WRITE:
+	case TB_CFG_PKG_ERROR:
+	case TB_CFG_PKG_OVERRIDE:
+	case TB_CFG_PKG_RESET:
+		if (*(__be32 *)(pkg->buffer + frame->size) != crc32) {
+			tb_ctl_err(pkg->ctl,
+				   "RX: checksum mismatch, dropping packet\n");
+			goto rx;
+		}
+		if (tb_async_error(pkg)) {
+			tb_ctl_handle_event(pkg->ctl, frame->eof,
+					    pkg, frame->size);
+			goto rx;
+		}
+		break;
+
+	case TB_CFG_PKG_EVENT:
+		if (*(__be32 *)(pkg->buffer + frame->size) != crc32) {
+			tb_ctl_err(pkg->ctl,
+				   "RX: checksum mismatch, dropping packet\n");
+			goto rx;
+		}
+		tb_ctl_handle_event(pkg->ctl, frame->eof, pkg, frame->size);
+		goto rx;
+
+	default:
+		tb_ctl_dbg(pkg->ctl, "RX: unknown package %#x, dropping\n",
+			   frame->eof);
 		goto rx;
 	}
+
 	if (!kfifo_put(&pkg->ctl->response_fifo, pkg)) {
 		tb_ctl_err(pkg->ctl, "RX: fifo is full\n");
 		goto rx;
@@ -379,7 +413,7 @@ static struct tb_cfg_result tb_ctl_rx(struct tb_ctl *ctl, void *buffer,
  *
  * Return: Returns a pointer on success or NULL on failure.
  */
-struct tb_ctl *tb_ctl_alloc(struct tb_nhi *nhi, hotplug_cb cb, void *cb_data)
+struct tb_ctl *tb_ctl_alloc(struct tb_nhi *nhi, event_cb cb, void *cb_data)
 {
 	int i;
 	struct tb_ctl *ctl = kzalloc(sizeof(*ctl), GFP_KERNEL);
drivers/thunderbolt/ctl.h +3 -2
index 914da86ec77d..2b23e030a85b 100644
@@ -13,9 +13,10 @@
 /* control channel */
 struct tb_ctl;
 
-typedef void (*hotplug_cb)(void *data, u64 route, u8 port, bool unplug);
+typedef void (*event_cb)(void *data, enum tb_cfg_pkg_type type,
+			 const void *buf, size_t size);
 
-struct tb_ctl *tb_ctl_alloc(struct tb_nhi *nhi, hotplug_cb cb, void *cb_data);
+struct tb_ctl *tb_ctl_alloc(struct tb_nhi *nhi, event_cb cb, void *cb_data);
 void tb_ctl_start(struct tb_ctl *ctl);
 void tb_ctl_stop(struct tb_ctl *ctl);
 void tb_ctl_free(struct tb_ctl *ctl);
drivers/thunderbolt/domain.c +14 -1
index 3302f4c59638..54bc15f9bf6b 100644
@@ -95,6 +95,19 @@ struct tb *tb_domain_alloc(struct tb_nhi *nhi, size_t privsize)
 	return NULL;
 }
 
+static void tb_domain_event_cb(void *data, enum tb_cfg_pkg_type type,
+			       const void *buf, size_t size)
+{
+	struct tb *tb = data;
+
+	if (!tb->cm_ops->handle_event) {
+		tb_warn(tb, "domain does not have event handler\n");
+		return;
+	}
+
+	tb->cm_ops->handle_event(tb, type, buf, size);
+}
+
 /**
  * tb_domain_add() - Add domain to the system
  * @tb: Domain to add
@@ -115,7 +128,7 @@ int tb_domain_add(struct tb *tb)
 
 	mutex_lock(&tb->lock);
 
-	tb->ctl = tb_ctl_alloc(tb->nhi, tb->cm_ops->hotplug, tb);
+	tb->ctl = tb_ctl_alloc(tb->nhi, tb_domain_event_cb, tb);
 	if (!tb->ctl) {
 		ret = -ENOMEM;
 		goto err_unlock;
drivers/thunderbolt/tb.c +23 -7
index 94ecac012428..ea9de49b5e10 100644
@@ -311,18 +311,34 @@ static void tb_handle_hotplug(struct work_struct *work)
  *
  * Delegates to tb_handle_hotplug.
  */
-static void tb_schedule_hotplug_handler(void *data, u64 route, u8 port,
-					bool unplug)
+static void tb_handle_event(struct tb *tb, enum tb_cfg_pkg_type type,
+			    const void *buf, size_t size)
 {
-	struct tb *tb = data;
-	struct tb_hotplug_event *ev = kmalloc(sizeof(*ev), GFP_KERNEL);
+	const struct cfg_event_pkg *pkg = buf;
+	struct tb_hotplug_event *ev;
+	u64 route;
+
+	if (type != TB_CFG_PKG_EVENT) {
+		tb_warn(tb, "unexpected event %#x, ignoring\n", type);
+		return;
+	}
+
+	route = tb_cfg_get_route(&pkg->header);
+
+	if (tb_cfg_error(tb->ctl, route, pkg->port,
+			 TB_CFG_ERROR_ACK_PLUG_EVENT)) {
+		tb_warn(tb, "could not ack plug event on %llx:%x\n", route,
+			pkg->port);
+	}
+
+	ev = kmalloc(sizeof(*ev), GFP_KERNEL);
 	if (!ev)
 		return;
 	INIT_WORK(&ev->work, tb_handle_hotplug);
 	ev->tb = tb;
 	ev->route = route;
-	ev->port = port;
-	ev->unplug = unplug;
+	ev->port = pkg->port;
+	ev->unplug = pkg->unplug;
 	queue_work(tb->wq, &ev->work);
 }
 
@@ -419,7 +435,7 @@ static const struct tb_cm_ops tb_cm_ops = {
 	.stop = tb_stop,
 	.suspend_noirq = tb_suspend_noirq,
 	.resume_noirq = tb_resume_noirq,
-	.hotplug = tb_schedule_hotplug_handler,
+	.handle_event = tb_handle_event,
 };
 
 struct tb *tb_probe(struct tb_nhi *nhi)
drivers/thunderbolt/tb.h +3 -2
index 6d4910ef2eb9..5bb9a5d60d2c 100644
@@ -118,14 +118,15 @@ struct tb_path {
  * @stop: Stops the domain
  * @suspend_noirq: Connection manager specific suspend_noirq
  * @resume_noirq: Connection manager specific resume_noirq
- * @hotplug: Handle hotplug event
+ * @handle_event: Handle thunderbolt event
  */
 struct tb_cm_ops {
 	int (*start)(struct tb *tb);
 	void (*stop)(struct tb *tb);
 	int (*suspend_noirq)(struct tb *tb);
 	int (*resume_noirq)(struct tb *tb);
-	hotplug_cb hotplug;
+	void (*handle_event)(struct tb *tb, enum tb_cfg_pkg_type,
+			     const void *buf, size_t size);
 };
 
 /**
Signature · 1 line
2.11.0
#19 lore raw

PATCH v4 18/27 thunderbolt: Rework control channel to be more reliable

In reply to Mika Westerberg

If a request times out the response might arrive right after the request is failed. This response is pushed to the kfifo and next request will read it instead. Since it most likely will not pass our validation checks in parse_header() the next request will fail as well, and response to that request will be pushed to the kfifo, ad infinitum.

We end up in a situation where all requests fail and no devices can be added anymore until the driver is unloaded and reloaded again.

To overcome this, rework the control channel so that we will have a queue of outstanding requests. Each request will be handled in turn and the response is validated against what is expected. Unexpected packets (for example responses for requests that have been timed out) are dropped. This model is copied from Greybus implementation with small changes here and there to get it cope with Thunderbolt control packets.

In addition the configuration packets support sequence number which the switch is supposed to copy from the request to response. We use this to drop responses that are already timed out. Taking advantage of the sequence number, we automatically retry configuration read/write 4 times before giving up.

Also timeout is not a programming error so there is no need to trigger a scary backtrace (WARN), instead we just log a warning. After all Thunderbolt devices are hot-pluggable by definition which means user can unplug a device any time and that is totally acceptable.

With this change there is no need to take the global domain lock when sending configuration packets anymore. This is useful when we add support for cross-domain (XDomain) communication later on.

---
 drivers/thunderbolt/ctl.c | 477 +++++++++++++++++++++++++++++++++++++++-------
 drivers/thunderbolt/ctl.h |  65 +++++++
 drivers/thunderbolt/tb.h  |   2 +-
 3 files changed, 473 insertions(+), 71 deletions(-)
drivers/thunderbolt/ctl.c +407 -70
index 5417ed244edc..27c30ff79a84 100644
@@ -5,22 +5,17 @@
  */
 
 #include <linux/crc32.h>
+#include <linux/delay.h>
 #include <linux/slab.h>
 #include <linux/pci.h>
 #include <linux/dmapool.h>
 #include <linux/workqueue.h>
-#include <linux/kfifo.h>
 
 #include "ctl.h"
 
 
-struct ctl_pkg {
-	struct tb_ctl *ctl;
-	void *buffer;
-	struct ring_frame frame;
-};
-
-#define TB_CTL_RX_PKG_COUNT 10
+#define TB_CTL_RX_PKG_COUNT	10
+#define TB_CTL_RETRIES		4
 
 /**
  * struct tb_cfg - thunderbolt control channel
@@ -32,8 +27,9 @@ struct tb_ctl {
 
 	struct dma_pool *frame_pool;
 	struct ctl_pkg *rx_packets[TB_CTL_RX_PKG_COUNT];
-	DECLARE_KFIFO(response_fifo, struct ctl_pkg*, 16);
-	struct completion response_ready;
+	struct mutex request_queue_lock;
+	struct list_head request_queue;
+	bool running;
 
 	event_cb callback;
 	void *callback_data;
@@ -55,10 +51,121 @@ struct tb_ctl {
 #define tb_ctl_dbg(ctl, format, arg...) \
 	dev_dbg(&(ctl)->nhi->pdev->dev, format, ## arg)
 
+static DECLARE_WAIT_QUEUE_HEAD(tb_cfg_request_cancel_queue);
+/* Serializes access to request kref_get/put */
+static DEFINE_MUTEX(tb_cfg_request_lock);
+
+/**
+ * tb_cfg_request_alloc() - Allocates a new config request
+ *
+ * This is refcounted object so when you are done with this, call
+ * tb_cfg_request_put() to it.
+ */
+struct tb_cfg_request *tb_cfg_request_alloc(void)
+{
+	struct tb_cfg_request *req;
+
+	req = kzalloc(sizeof(*req), GFP_KERNEL);
+	if (!req)
+		return NULL;
+
+	kref_init(&req->kref);
+
+	return req;
+}
+
+/**
+ * tb_cfg_request_get() - Increase refcount of a request
+ * @req: Request whose refcount is increased
+ */
+void tb_cfg_request_get(struct tb_cfg_request *req)
+{
+	mutex_lock(&tb_cfg_request_lock);
+	kref_get(&req->kref);
+	mutex_unlock(&tb_cfg_request_lock);
+}
+
+static void tb_cfg_request_destroy(struct kref *kref)
+{
+	struct tb_cfg_request *req = container_of(kref, typeof(*req), kref);
+
+	kfree(req);
+}
+
+/**
+ * tb_cfg_request_put() - Decrease refcount and possibly release the request
+ * @req: Request whose refcount is decreased
+ *
+ * Call this function when you are done with the request. When refcount
+ * goes to %0 the object is released.
+ */
+void tb_cfg_request_put(struct tb_cfg_request *req)
+{
+	mutex_lock(&tb_cfg_request_lock);
+	kref_put(&req->kref, tb_cfg_request_destroy);
+	mutex_unlock(&tb_cfg_request_lock);
+}
+
+static int tb_cfg_request_enqueue(struct tb_ctl *ctl,
+				  struct tb_cfg_request *req)
+{
+	WARN_ON(test_bit(TB_CFG_REQUEST_ACTIVE, &req->flags));
+	WARN_ON(req->ctl);
+
+	mutex_lock(&ctl->request_queue_lock);
+	if (!ctl->running) {
+		mutex_unlock(&ctl->request_queue_lock);
+		return -ENOTCONN;
+	}
+	req->ctl = ctl;
+	list_add_tail(&req->list, &ctl->request_queue);
+	set_bit(TB_CFG_REQUEST_ACTIVE, &req->flags);
+	mutex_unlock(&ctl->request_queue_lock);
+	return 0;
+}
+
+static void tb_cfg_request_dequeue(struct tb_cfg_request *req)
+{
+	struct tb_ctl *ctl = req->ctl;
+
+	mutex_lock(&ctl->request_queue_lock);
+	list_del(&req->list);
+	clear_bit(TB_CFG_REQUEST_ACTIVE, &req->flags);
+	if (test_bit(TB_CFG_REQUEST_CANCELED, &req->flags))
+		wake_up(&tb_cfg_request_cancel_queue);
+	mutex_unlock(&ctl->request_queue_lock);
+}
+
+static bool tb_cfg_request_is_active(struct tb_cfg_request *req)
+{
+	return test_bit(TB_CFG_REQUEST_ACTIVE, &req->flags);
+}
+
+static struct tb_cfg_request *
+tb_cfg_request_find(struct tb_ctl *ctl, struct ctl_pkg *pkg)
+{
+	struct tb_cfg_request *req;
+	bool found = false;
+
+	mutex_lock(&pkg->ctl->request_queue_lock);
+	list_for_each_entry(req, &pkg->ctl->request_queue, list) {
+		tb_cfg_request_get(req);
+		if (req->match(req, pkg)) {
+			found = true;
+			break;
+		}
+		tb_cfg_request_put(req);
+	}
+	mutex_unlock(&pkg->ctl->request_queue_lock);
+
+	return found ? req : NULL;
+}
+
 /* utility functions */
 
-static int check_header(struct ctl_pkg *pkg, u32 len, enum tb_cfg_pkg_type type,
-			u64 route)
+
+static int check_header(const struct ctl_pkg *pkg, u32 len,
+			enum tb_cfg_pkg_type type, u64 route)
 {
 	struct tb_cfg_header *header = pkg->buffer;
 
@@ -100,8 +207,6 @@ static int check_config_address(struct tb_cfg_address addr,
 	if (WARN(length != addr.length, "wrong space (expected %x, got %x\n)",
 			length, addr.length))
 		return -EIO;
-	if (WARN(addr.seq, "addr.seq is %#x\n", addr.seq))
-		return -EIO;
 	/*
 	 * We cannot check addr->port as it is set to the upstream port of the
 	 * sender.
@@ -109,7 +214,7 @@ static int check_config_address(struct tb_cfg_address addr,
 	return 0;
 }
 
-static struct tb_cfg_result decode_error(struct ctl_pkg *response)
+static struct tb_cfg_result decode_error(const struct ctl_pkg *response)
 {
 	struct cfg_error_pkg *pkg = response->buffer;
 	struct tb_cfg_result res = { 0 };
@@ -130,7 +235,7 @@ static struct tb_cfg_result decode_error(struct ctl_pkg *response)
 
 }
 
-static struct tb_cfg_result parse_header(struct ctl_pkg *pkg, u32 len,
+static struct tb_cfg_result parse_header(const struct ctl_pkg *pkg, u32 len,
 					 enum tb_cfg_pkg_type type, u64 route)
 {
 	struct tb_cfg_header *header = pkg->buffer;
@@ -198,7 +303,7 @@ static void be32_to_cpu_array(u32 *dst, __be32 *src, size_t len)
 		dst[i] = be32_to_cpu(src[i]);
 }
 
-static __be32 tb_crc(void *data, size_t len)
+static __be32 tb_crc(const void *data, size_t len)
 {
 	return cpu_to_be32(~__crc32c_le(~0, data, len));
 }
@@ -315,6 +420,7 @@ static void tb_ctl_rx_callback(struct tb_ring *ring, struct ring_frame *frame,
 			       bool canceled)
 {
 	struct ctl_pkg *pkg = container_of(frame, typeof(*pkg), frame);
+	struct tb_cfg_request *req;
 	__be32 crc32;
 
 	if (canceled)
@@ -361,48 +467,135 @@ static void tb_ctl_rx_callback(struct tb_ring *ring, struct ring_frame *frame,
 		goto rx;
 
 	default:
-		tb_ctl_dbg(pkg->ctl, "RX: unknown package %#x, dropping\n",
-			   frame->eof);
-		goto rx;
+		break;
 	}
 
-	if (!kfifo_put(&pkg->ctl->response_fifo, pkg)) {
-		tb_ctl_err(pkg->ctl, "RX: fifo is full\n");
-		goto rx;
+	/*
+	 * The received packet will be processed only if there is an
+	 * active request and that the packet is what is expected. This
+	 * prevents packets such as replies coming after timeout has
+	 * triggered from messing with the active requests.
+	 */
+	req = tb_cfg_request_find(pkg->ctl, pkg);
+	if (req) {
+		if (req->copy(req, pkg))
+			schedule_work(&req->work);
+		tb_cfg_request_put(req);
 	}
-	complete(&pkg->ctl->response_ready);
-	return;
+
 rx:
 	tb_ctl_rx_submit(pkg);
 }
 
+static void tb_cfg_request_work(struct work_struct *work)
+{
+	struct tb_cfg_request *req = container_of(work, typeof(*req), work);
+
+	if (!test_bit(TB_CFG_REQUEST_CANCELED, &req->flags))
+		req->callback(req->callback_data);
+
+	tb_cfg_request_dequeue(req);
+	tb_cfg_request_put(req);
+}
+
 /**
- * tb_ctl_rx() - receive a packet from the control channel
+ * tb_cfg_request() - Start control request not waiting for it to complete
+ * @ctl: Control channel to use
+ * @req: Request to start
+ * @callback: Callback called when the request is completed
+ * @callback_data: Data to be passed to @callback
+ *
+ * This queues @req on the given control channel without waiting for it
+ * to complete. When the request completes @callback is called.
  */
-static struct tb_cfg_result tb_ctl_rx(struct tb_ctl *ctl, void *buffer,
-				      size_t length, int timeout_msec,
-				      u64 route, enum tb_cfg_pkg_type type)
+int tb_cfg_request(struct tb_ctl *ctl, struct tb_cfg_request *req,
+		   void (*callback)(void *), void *callback_data)
 {
-	struct tb_cfg_result res;
-	struct ctl_pkg *pkg;
+	int ret;
 
-	if (!wait_for_completion_timeout(&ctl->response_ready,
-					 msecs_to_jiffies(timeout_msec))) {
-		tb_ctl_WARN(ctl, "RX: timeout\n");
-		return (struct tb_cfg_result) { .err = -ETIMEDOUT };
-	}
-	if (!kfifo_get(&ctl->response_fifo, &pkg)) {
-		tb_ctl_WARN(ctl, "empty kfifo\n");
-		return (struct tb_cfg_result) { .err = -EIO };
-	}
+	req->flags = 0;
+	req->callback = callback;
+	req->callback_data = callback_data;
+	INIT_WORK(&req->work, tb_cfg_request_work);
+	INIT_LIST_HEAD(&req->list);
 
-	res = parse_header(pkg, length, type, route);
-	if (!res.err)
-		memcpy(buffer, pkg->buffer, length);
-	tb_ctl_rx_submit(pkg);
-	return res;
+	tb_cfg_request_get(req);
+	ret = tb_cfg_request_enqueue(ctl, req);
+	if (ret)
+		goto err_put;
+
+	ret = tb_ctl_tx(ctl, req->request, req->request_size,
+			req->request_type);
+	if (ret)
+		goto err_dequeue;
+
+	if (!req->response)
+		schedule_work(&req->work);
+
+	return 0;
+
+err_dequeue:
+	tb_cfg_request_dequeue(req);
+err_put:
+	tb_cfg_request_put(req);
+
+	return ret;
+}
+
+/**
+ * tb_cfg_request_cancel() - Cancel a control request
+ * @req: Request to cancel
+ * @err: Error to assign to the request
+ *
+ * This function can be used to cancel ongoing request. It will wait
+ * until the request is not active anymore.
+ */
+void tb_cfg_request_cancel(struct tb_cfg_request *req, int err)
+{
+	set_bit(TB_CFG_REQUEST_CANCELED, &req->flags);
+	schedule_work(&req->work);
+	wait_event(tb_cfg_request_cancel_queue, !tb_cfg_request_is_active(req));
+	req->result.err = err;
 }
 
+static void tb_cfg_request_complete(void *data)
+{
+	complete(data);
+}
+
+/**
+ * tb_cfg_request_sync() - Start control request and wait until it completes
+ * @ctl: Control channel to use
+ * @req: Request to start
+ * @timeout_msec: Timeout how long to wait @req to complete
+ *
+ * Starts a control request and waits until it completes. If timeout
+ * triggers the request is canceled before function returns. Note the
+ * caller needs to make sure only one message for given switch is active
+ * at a time.
+ */
+struct tb_cfg_result tb_cfg_request_sync(struct tb_ctl *ctl,
+					 struct tb_cfg_request *req,
+					 int timeout_msec)
+{
+	unsigned long timeout = msecs_to_jiffies(timeout_msec);
+	struct tb_cfg_result res = { 0 };
+	DECLARE_COMPLETION_ONSTACK(done);
+	int ret;
+
+	ret = tb_cfg_request(ctl, req, tb_cfg_request_complete, &done);
+	if (ret) {
+		res.err = ret;
+		return res;
+	}
+
+	if (!wait_for_completion_timeout(&done, timeout))
+		tb_cfg_request_cancel(req, -ETIMEDOUT);
+
+	flush_work(&req->work);
+
+	return req->result;
+}
 
 /* public interface, alloc/start/stop/free */
 
@@ -423,8 +616,8 @@ struct tb_ctl *tb_ctl_alloc(struct tb_nhi *nhi, event_cb cb, void *cb_data)
 	ctl->callback = cb;
 	ctl->callback_data = cb_data;
 
-	init_completion(&ctl->response_ready);
-	INIT_KFIFO(ctl->response_fifo);
+	mutex_init(&ctl->request_queue_lock);
+	INIT_LIST_HEAD(&ctl->request_queue);
 	ctl->frame_pool = dma_pool_create("thunderbolt_ctl", &nhi->pdev->dev,
 					 TB_FRAME_SIZE, 4, 0);
 	if (!ctl->frame_pool)
@@ -492,6 +685,8 @@ void tb_ctl_start(struct tb_ctl *ctl)
 	ring_start(ctl->rx);
 	for (i = 0; i < TB_CTL_RX_PKG_COUNT; i++)
 		tb_ctl_rx_submit(ctl->rx_packets[i]);
+
+	ctl->running = true;
 }
 
 /**
@@ -504,12 +699,16 @@ void tb_ctl_start(struct tb_ctl *ctl)
  */
 void tb_ctl_stop(struct tb_ctl *ctl)
 {
+	mutex_lock(&ctl->request_queue_lock);
+	ctl->running = false;
+	mutex_unlock(&ctl->request_queue_lock);
+
 	ring_stop(ctl->rx);
 	ring_stop(ctl->tx);
 
-	if (!kfifo_is_empty(&ctl->response_fifo))
-		tb_ctl_WARN(ctl, "dangling response in response_fifo\n");
-	kfifo_reset(&ctl->response_fifo);
+	if (!list_empty(&ctl->request_queue))
+		tb_ctl_WARN(ctl, "dangling request in request_queue\n");
+	INIT_LIST_HEAD(&ctl->request_queue);
 	tb_ctl_info(ctl, "control channel stopped\n");
 }
 
@@ -532,6 +731,49 @@ int tb_cfg_error(struct tb_ctl *ctl, u64 route, u32 port,
 	return tb_ctl_tx(ctl, &pkg, sizeof(pkg), TB_CFG_PKG_ERROR);
 }
 
+static bool tb_cfg_match(const struct tb_cfg_request *req,
+			 const struct ctl_pkg *pkg)
+{
+	u64 route = tb_cfg_get_route(pkg->buffer) & ~BIT_ULL(63);
+
+	if (pkg->frame.eof == TB_CFG_PKG_ERROR)
+		return true;
+
+	if (pkg->frame.eof != req->response_type)
+		return false;
+	if (route != tb_cfg_get_route(req->request))
+		return false;
+	if (pkg->frame.size != req->response_size)
+		return false;
+
+	if (pkg->frame.eof == TB_CFG_PKG_READ ||
+	    pkg->frame.eof == TB_CFG_PKG_WRITE) {
+		const struct cfg_read_pkg *req_hdr = req->request;
+		const struct cfg_read_pkg *res_hdr = pkg->buffer;
+
+		if (req_hdr->addr.seq != res_hdr->addr.seq)
+			return false;
+	}
+
+	return true;
+}
+
+static bool tb_cfg_copy(struct tb_cfg_request *req, const struct ctl_pkg *pkg)
+{
+	struct tb_cfg_result res;
+
+	/* Now make sure it is in expected format */
+	res = parse_header(pkg, req->response_size, req->response_type,
+			   tb_cfg_get_route(req->request));
+	if (!res.err)
+		memcpy(req->response, pkg->buffer, req->response_size);
+
+	req->result = res;
+
+	/* Always complete when first response is received */
+	return true;
+}
+
 /**
  * tb_cfg_reset() - send a reset packet and wait for a response
  *
@@ -542,16 +784,31 @@ int tb_cfg_error(struct tb_ctl *ctl, u64 route, u32 port,
 struct tb_cfg_result tb_cfg_reset(struct tb_ctl *ctl, u64 route,
 				  int timeout_msec)
 {
-	int err;
 	struct cfg_reset_pkg request = { .header = tb_cfg_make_header(route) };
+	struct tb_cfg_result res = { 0 };
 	struct tb_cfg_header reply;
+	struct tb_cfg_request *req;
+
+	req = tb_cfg_request_alloc();
+	if (!req) {
+		res.err = -ENOMEM;
+		return res;
+	}
+
+	req->match = tb_cfg_match;
+	req->copy = tb_cfg_copy;
+	req->request = &request;
+	req->request_size = sizeof(request);
+	req->request_type = TB_CFG_PKG_RESET;
+	req->response = &reply;
+	req->response_size = sizeof(reply);
+	req->response_type = sizeof(TB_CFG_PKG_RESET);
+
+	res = tb_cfg_request_sync(ctl, req, timeout_msec);
 
-	err = tb_ctl_tx(ctl, &request, sizeof(request), TB_CFG_PKG_RESET);
-	if (err)
-		return (struct tb_cfg_result) { .err = err };
+	tb_cfg_request_put(req);
 
-	return tb_ctl_rx(ctl, &reply, sizeof(reply), timeout_msec, route,
-			 TB_CFG_PKG_RESET);
+	return res;
 }
 
 /**
@@ -574,13 +831,39 @@ struct tb_cfg_result tb_cfg_read_raw(struct tb_ctl *ctl, void *buffer,
 		},
 	};
 	struct cfg_write_pkg reply;
+	int retries = 0;
 
-	res.err = tb_ctl_tx(ctl, &request, sizeof(request), TB_CFG_PKG_READ);
-	if (res.err)
-		return res;
+	while (retries < TB_CTL_RETRIES) {
+		struct tb_cfg_request *req;
+
+		req = tb_cfg_request_alloc();
+		if (!req) {
+			res.err = -ENOMEM;
+			return res;
+		}
+
+		request.addr.seq = retries++;
+
+		req->match = tb_cfg_match;
+		req->copy = tb_cfg_copy;
+		req->request = &request;
+		req->request_size = sizeof(request);
+		req->request_type = TB_CFG_PKG_READ;
+		req->response = &reply;
+		req->response_size = 12 + 4 * length;
+		req->response_type = TB_CFG_PKG_READ;
+
+		res = tb_cfg_request_sync(ctl, req, timeout_msec);
+
+		tb_cfg_request_put(req);
+
+		if (res.err != -ETIMEDOUT)
+			break;
+
+		/* Wait a bit (arbitrary time) until we send a retry */
+		usleep_range(10, 100);
+	}
 
-	res = tb_ctl_rx(ctl, &reply, 12 + 4 * length, timeout_msec, route,
-			TB_CFG_PKG_READ);
 	if (res.err)
 		return res;
 
@@ -611,15 +894,41 @@ struct tb_cfg_result tb_cfg_write_raw(struct tb_ctl *ctl, const void *buffer,
 		},
 	};
 	struct cfg_read_pkg reply;
+	int retries = 0;
 
 	memcpy(&request.data, buffer, length * 4);
 
-	res.err = tb_ctl_tx(ctl, &request, 12 + 4 * length, TB_CFG_PKG_WRITE);
-	if (res.err)
-		return res;
+	while (retries < TB_CTL_RETRIES) {
+		struct tb_cfg_request *req;
+
+		req = tb_cfg_request_alloc();
+		if (!req) {
+			res.err = -ENOMEM;
+			return res;
+		}
+
+		request.addr.seq = retries++;
+
+		req->match = tb_cfg_match;
+		req->copy = tb_cfg_copy;
+		req->request = &request;
+		req->request_size = 12 + 4 * length;
+		req->request_type = TB_CFG_PKG_WRITE;
+		req->response = &reply;
+		req->response_size = sizeof(reply);
+		req->response_type = TB_CFG_PKG_WRITE;
+
+		res = tb_cfg_request_sync(ctl, req, timeout_msec);
+
+		tb_cfg_request_put(req);
+
+		if (res.err != -ETIMEDOUT)
+			break;
+
+		/* Wait a bit (arbitrary time) until we send a retry */
+		usleep_range(10, 100);
+	}
 
-	res = tb_ctl_rx(ctl, &reply, sizeof(reply), timeout_msec, route,
-			TB_CFG_PKG_WRITE);
 	if (res.err)
 		return res;
 
@@ -633,11 +942,25 @@ int tb_cfg_read(struct tb_ctl *ctl, void *buffer, u64 route, u32 port,
 {
 	struct tb_cfg_result res = tb_cfg_read_raw(ctl, buffer, route, port,
 			space, offset, length, TB_CFG_DEFAULT_TIMEOUT);
-	if (res.err == 1) {
+	switch (res.err) {
+	case 0:
+		/* Success */
+		break;
+
+	case 1:
+		/* Thunderbolt error, tb_error holds the actual number */
 		tb_cfg_print_error(ctl, &res);
 		return -EIO;
+
+	case -ETIMEDOUT:
+		tb_ctl_warn(ctl, "timeout reading config space %u from %#x\n",
+			    space, offset);
+		break;
+
+	default:
+		WARN(1, "tb_cfg_read: %d\n", res.err);
+		break;
 	}
-	WARN(res.err, "tb_cfg_read: %d\n", res.err);
 	return res.err;
 }
 
@@ -646,11 +969,25 @@ int tb_cfg_write(struct tb_ctl *ctl, const void *buffer, u64 route, u32 port,
 {
 	struct tb_cfg_result res = tb_cfg_write_raw(ctl, buffer, route, port,
 			space, offset, length, TB_CFG_DEFAULT_TIMEOUT);
-	if (res.err == 1) {
+	switch (res.err) {
+	case 0:
+		/* Success */
+		break;
+
+	case 1:
+		/* Thunderbolt error, tb_error holds the actual number */
 		tb_cfg_print_error(ctl, &res);
 		return -EIO;
+
+	case -ETIMEDOUT:
+		tb_ctl_warn(ctl, "timeout writing config space %u to %#x\n",
+			    space, offset);
+		break;
+
+	default:
+		WARN(1, "tb_cfg_write: %d\n", res.err);
+		break;
 	}
-	WARN(res.err, "tb_cfg_write: %d\n", res.err);
 	return res.err;
 }
 
drivers/thunderbolt/ctl.h +65 -0

77 lines not on this page · raw message

drivers/thunderbolt/tb.h +1 -1
index 5bb9a5d60d2c..98a405384596 100644
@@ -132,7 +132,7 @@ struct tb_cm_ops {
 /**
  * struct tb - main thunderbolt bus structure
  * @dev: Domain device
- * @lock: Big lock. Must be held when accessing cfg or any struct
+ * @lock: Big lock. Must be held when accessing any struct
  *	  tb_switch / struct tb_port.
  * @nhi: Pointer to the NHI structure
  * @ctl: Control channel for this domain
Signature · 1 line
2.11.0
#20 lore raw

PATCH v4 19/27 thunderbolt: Add new Thunderbolt PCI IDs

In reply to Mika Westerberg

Add Intel Win Ridge (Thunderbolt 2) and Alpine Ridge (Thunderbolt 3) controller PCI IDs to the list of supported devices.

This code is based on the work done by Amir Levy and Michael Jamet.

---
 drivers/thunderbolt/nhi.c    | 11 +++++++++++
 drivers/thunderbolt/nhi.h    | 17 +++++++++++++++++
 drivers/thunderbolt/switch.c | 19 ++++++++++++++-----
 3 files changed, 42 insertions(+), 5 deletions(-)
drivers/thunderbolt/nhi.c +11 -0
index c1113a3c4128..fa4c2745dba2 100644
@@ -787,6 +787,17 @@ static struct pci_device_id nhi_ids[] = {
 		.device = PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_NHI,
 		.subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID,
 	},
+
+	/* Thunderbolt 3 */
+	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_2C_NHI) },
+	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_4C_NHI) },
+	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_USBONLY_NHI) },
+	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_LP_NHI) },
+	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_LP_USBONLY_NHI) },
+	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_C_2C_NHI) },
+	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_C_4C_NHI) },
+	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_C_USBONLY_NHI) },
+
 	{ 0,}
 };
 
drivers/thunderbolt/nhi.h +17 -0
index 630f44140530..8bd9b4e5a0b1 100644
@@ -143,4 +143,21 @@ static inline int ring_tx(struct tb_ring *ring, struct ring_frame *frame)
 	return __ring_enqueue(ring, frame);
 }
 
+/*
+ * PCI IDs used in this driver from Win Ridge forward. There is no
+ * need for the PCI quirk anymore as we will use ICM also on Apple
+ * hardware.
+ */
+#define PCI_DEVICE_ID_INTEL_WIN_RIDGE_2C_NHI            0x157d
+#define PCI_DEVICE_ID_INTEL_WIN_RIDGE_2C_BRIDGE         0x157e
+#define PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_LP_NHI		0x15bf
+#define PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_LP_BRIDGE	0x15c0
+#define PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_C_4C_NHI	0x15d2
+#define PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_C_4C_BRIDGE	0x15d3
+#define PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_C_2C_NHI	0x15d9
+#define PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_C_2C_BRIDGE	0x15da
+#define PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_LP_USBONLY_NHI	0x15dc
+#define PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_USBONLY_NHI	0x15dd
+#define PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_C_USBONLY_NHI	0x15de
+
 #endif
drivers/thunderbolt/switch.c +14 -5
index 11f16a141686..1497518aceff 100644
@@ -491,13 +491,22 @@ int tb_switch_configure(struct tb_switch *sw)
 		tb_sw_warn(sw, "unknown switch vendor id %#x\n",
 			   sw->config.vendor_id);
 
-	if (sw->config.device_id != PCI_DEVICE_ID_INTEL_LIGHT_RIDGE &&
-	    sw->config.device_id != PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C &&
-	    sw->config.device_id != PCI_DEVICE_ID_INTEL_PORT_RIDGE &&
-	    sw->config.device_id != PCI_DEVICE_ID_INTEL_FALCON_RIDGE_2C_BRIDGE &&
-	    sw->config.device_id != PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_BRIDGE)
+	switch (sw->config.device_id) {
+	case PCI_DEVICE_ID_INTEL_LIGHT_RIDGE:
+	case PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C:
+	case PCI_DEVICE_ID_INTEL_PORT_RIDGE:
+	case PCI_DEVICE_ID_INTEL_FALCON_RIDGE_2C_BRIDGE:
+	case PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_BRIDGE:
+	case PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_2C_BRIDGE:
+	case PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_4C_BRIDGE:
+	case PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_C_2C_BRIDGE:
+	case PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_C_4C_BRIDGE:
+		break;
+
+	default:
 		tb_sw_warn(sw, "unsupported switch device id %#x\n",
 			   sw->config.device_id);
+	}
 
 	sw->config.enabled = 1;
 
Signature · 1 line
2.11.0
#21 lore raw

PATCH v4 20/27 thunderbolt: Add support for NHI mailbox

In reply to Mika Westerberg

The host controller includes two sets of registers that are used to communicate with the firmware. Add functions that can be used to access these registers.

This code is based on the work done by Amir Levy and Michael Jamet.

---
 drivers/thunderbolt/nhi.c      | 58 ++++++++++++++++++++++++++++++++++++++++++
 drivers/thunderbolt/nhi.h      | 16 ++++++++++++
 drivers/thunderbolt/nhi_regs.h | 11 ++++++++
 3 files changed, 85 insertions(+)
drivers/thunderbolt/nhi.c +58 -0
index fa4c2745dba2..c358c074f925 100644
@@ -14,6 +14,7 @@
 #include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/dmi.h>
+#include <linux/delay.h>
 
 #include "nhi.h"
 #include "nhi_regs.h"
@@ -28,6 +29,8 @@
 #define MSIX_MIN_VECS		6
 #define MSIX_MAX_VECS		16
 
+#define NHI_MAILBOX_TIMEOUT	500 /* ms */
+
 static int ring_interrupt_index(struct tb_ring *ring)
 {
 	int bit = ring->hop;
@@ -525,6 +528,61 @@ void ring_free(struct tb_ring *ring)
 	kfree(ring);
 }
 
+/**
+ * nhi_mailbox_cmd() - Send a command through NHI mailbox
+ * @nhi: Pointer to the NHI structure
+ * @cmd: Command to send
+ * @data: Data to be send with the command
+ *
+ * Sends mailbox command to the firmware running on NHI. Returns %0 in
+ * case of success and negative errno in case of failure.
+ */
+int nhi_mailbox_cmd(struct tb_nhi *nhi, enum nhi_mailbox_cmd cmd, u32 data)
+{
+	ktime_t timeout;
+	u32 val;
+
+	iowrite32(data, nhi->iobase + REG_INMAIL_DATA);
+
+	val = ioread32(nhi->iobase + REG_INMAIL_CMD);
+	val &= ~(REG_INMAIL_CMD_MASK | REG_INMAIL_ERROR);
+	val |= REG_INMAIL_OP_REQUEST | cmd;
+	iowrite32(val, nhi->iobase + REG_INMAIL_CMD);
+
+	timeout = ktime_add_ms(ktime_get(), NHI_MAILBOX_TIMEOUT);
+	do {
+		val = ioread32(nhi->iobase + REG_INMAIL_CMD);
+		if (!(val & REG_INMAIL_OP_REQUEST))
+			break;
+		usleep_range(10, 20);
+	} while (ktime_before(ktime_get(), timeout));
+
+	if (val & REG_INMAIL_OP_REQUEST)
+		return -ETIMEDOUT;
+	if (val & REG_INMAIL_ERROR)
+		return -EIO;
+
+	return 0;
+}
+
+/**
+ * nhi_mailbox_mode() - Return current firmware operation mode
+ * @nhi: Pointer to the NHI structure
+ *
+ * The function reads current firmware operation mode using NHI mailbox
+ * registers and returns it to the caller.
+ */
+enum nhi_fw_mode nhi_mailbox_mode(struct tb_nhi *nhi)
+{
+	u32 val;
+
+	val = ioread32(nhi->iobase + REG_OUTMAIL_CMD);
+	val &= REG_OUTMAIL_CMD_OPMODE_MASK;
+	val >>= REG_OUTMAIL_CMD_OPMODE_SHIFT;
+
+	return (enum nhi_fw_mode)val;
+}
+
 static void nhi_interrupt_work(struct work_struct *work)
 {
 	struct tb_nhi *nhi = container_of(work, typeof(*nhi), interrupt_work);
drivers/thunderbolt/nhi.h +16 -0
index 8bd9b4e5a0b1..446ff6dac91d 100644
@@ -143,6 +143,22 @@ static inline int ring_tx(struct tb_ring *ring, struct ring_frame *frame)
 	return __ring_enqueue(ring, frame);
 }
 
+enum nhi_fw_mode {
+	NHI_FW_SAFE_MODE,
+	NHI_FW_AUTH_MODE,
+	NHI_FW_EP_MODE,
+	NHI_FW_CM_MODE,
+};
+
+enum nhi_mailbox_cmd {
+	NHI_MAILBOX_SAVE_DEVS = 0x05,
+	NHI_MAILBOX_DRV_UNLOADS = 0x07,
+	NHI_MAILBOX_ALLOW_ALL_DEVS = 0x23,
+};
+
+int nhi_mailbox_cmd(struct tb_nhi *nhi, enum nhi_mailbox_cmd cmd, u32 data);
+enum nhi_fw_mode nhi_mailbox_mode(struct tb_nhi *nhi);
+
 /*
  * PCI IDs used in this driver from Win Ridge forward. There is no
  * need for the PCI quirk anymore as we will use ICM also on Apple
drivers/thunderbolt/nhi_regs.h +11 -0
index 48b98d3c7e6a..322fe1fa3a3c 100644
@@ -107,4 +107,15 @@ struct ring_desc {
 #define REG_DMA_MISC			0x39864
 #define REG_DMA_MISC_INT_AUTO_CLEAR     BIT(2)
 
+#define REG_INMAIL_DATA			0x39900
+
+#define REG_INMAIL_CMD			0x39904
+#define REG_INMAIL_CMD_MASK		GENMASK(7, 0)
+#define REG_INMAIL_ERROR		BIT(30)
+#define REG_INMAIL_OP_REQUEST		BIT(31)
+
+#define REG_OUTMAIL_CMD			0x3990c
+#define REG_OUTMAIL_CMD_OPMODE_SHIFT	8
+#define REG_OUTMAIL_CMD_OPMODE_MASK	GENMASK(11, 8)
+
 #endif
Signature · 1 line
2.11.0
#22 lore raw

PATCH v4 21/27 thunderbolt: Store Thunderbolt generation in the switch structure

In reply to Mika Westerberg

In some cases it is useful to know what is the Thunderbolt generation the switch supports. This introduces a new field to struct switch that stores the generation of the switch based on the device ID. Unknown switches (there should be none) are assumed to be first generation to be on the safe side.

---
 drivers/thunderbolt/switch.c | 55 ++++++++++++++++++++++++++++++--------------
 drivers/thunderbolt/tb.h     |  2 ++
 2 files changed, 40 insertions(+), 17 deletions(-)
drivers/thunderbolt/switch.c +38 -17
index 1497518aceff..6384061100b0 100644
@@ -390,6 +390,42 @@ struct device_type tb_switch_type = {
 	.release = tb_switch_release,
 };
 
+static int tb_switch_get_generation(struct tb_switch *sw)
+{
+	switch (sw->config.device_id) {
+	case PCI_DEVICE_ID_INTEL_LIGHT_RIDGE:
+	case PCI_DEVICE_ID_INTEL_EAGLE_RIDGE:
+	case PCI_DEVICE_ID_INTEL_LIGHT_PEAK:
+	case PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_2C:
+	case PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C:
+	case PCI_DEVICE_ID_INTEL_PORT_RIDGE:
+	case PCI_DEVICE_ID_INTEL_REDWOOD_RIDGE_2C_BRIDGE:
+	case PCI_DEVICE_ID_INTEL_REDWOOD_RIDGE_4C_BRIDGE:
+		return 1;
+
+	case PCI_DEVICE_ID_INTEL_WIN_RIDGE_2C_BRIDGE:
+	case PCI_DEVICE_ID_INTEL_FALCON_RIDGE_2C_BRIDGE:
+	case PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_BRIDGE:
+		return 2;
+
+	case PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_LP_BRIDGE:
+	case PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_2C_BRIDGE:
+	case PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_4C_BRIDGE:
+	case PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_C_2C_BRIDGE:
+	case PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_C_4C_BRIDGE:
+		return 3;
+
+	default:
+		/*
+		 * For unknown switches assume generation to be 1 to be
+		 * on the safe side.
+		 */
+		tb_sw_warn(sw, "unsupported switch device id %#x\n",
+			   sw->config.device_id);
+		return 1;
+	}
+}
+
 /**
  * tb_switch_alloc() - allocate a switch
  * @tb: Pointer to the owning domain
@@ -443,6 +479,8 @@ struct tb_switch *tb_switch_alloc(struct tb *tb, struct device *parent,
 		sw->ports[i].port = i;
 	}
 
+	sw->generation = tb_switch_get_generation(sw);
+
 	cap = tb_switch_find_vse_cap(sw, TB_VSE_CAP_PLUG_EVENTS);
 	if (cap < 0) {
 		tb_sw_warn(sw, "cannot find TB_VSE_CAP_PLUG_EVENTS aborting\n");
@@ -491,23 +529,6 @@ int tb_switch_configure(struct tb_switch *sw)
 		tb_sw_warn(sw, "unknown switch vendor id %#x\n",
 			   sw->config.vendor_id);
 
-	switch (sw->config.device_id) {
-	case PCI_DEVICE_ID_INTEL_LIGHT_RIDGE:
-	case PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C:
-	case PCI_DEVICE_ID_INTEL_PORT_RIDGE:
-	case PCI_DEVICE_ID_INTEL_FALCON_RIDGE_2C_BRIDGE:
-	case PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_BRIDGE:
-	case PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_2C_BRIDGE:
-	case PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_4C_BRIDGE:
-	case PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_C_2C_BRIDGE:
-	case PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_C_4C_BRIDGE:
-		break;
-
-	default:
-		tb_sw_warn(sw, "unsupported switch device id %#x\n",
-			   sw->config.device_id);
-	}
-
 	sw->config.enabled = 1;
 
 	/* upload configuration */
drivers/thunderbolt/tb.h +2 -0
index 98a405384596..39d24dff82c5 100644
@@ -25,6 +25,7 @@
  * @device: Device ID of the switch
  * @vendor_name: Name of the vendor (or %NULL if not known)
  * @device_name: Name of the device (or %NULL if not known)
+ * @generation: Switch Thunderbolt generation
  * @cap_plug_events: Offset to the plug events capability (%0 if not found)
  * @is_unplugged: The switch is going away
  * @drom: DROM of the switch (%NULL if not found)
@@ -40,6 +41,7 @@ struct tb_switch {
 	u16 device;
 	const char *vendor_name;
 	const char *device_name;
+	unsigned int generation;
 	int cap_plug_events;
 	bool is_unplugged;
 	u8 *drom;
Signature · 1 line
2.11.0
#23 lore raw

PATCH v4 22/27 thunderbolt: Add support for DMA configuration based mailbox

In reply to Mika Westerberg

The DMA (NHI) port of a switch provides access to the NVM of the host controller (and devices starting from Intel Alpine Ridge). The NVM contains also more complete DROM for the root switch including vendor and device identification strings.

This will look for the DMA port capability for each switch and if found populates sw->dma_port. We then teach tb_drom_read() to read the DROM information from NVM if available for the root switch.

The DMA port capability also supports upgrading the NVM for both host controller and devices which will be added in subsequent patches.

This code is based on the work done by Amir Levy and Michael Jamet.

---
 drivers/thunderbolt/Makefile   |   2 +-
 drivers/thunderbolt/dma_port.c | 524 +++++++++++++++++++++++++++++++++++++++++
 drivers/thunderbolt/dma_port.h |  34 +++
 drivers/thunderbolt/eeprom.c   |  51 +++-
 drivers/thunderbolt/switch.c   |  30 +++
 drivers/thunderbolt/tb.h       |   5 +
 6 files changed, 644 insertions(+), 2 deletions(-)
 create mode 100644 drivers/thunderbolt/dma_port.c
 create mode 100644 drivers/thunderbolt/dma_port.h
drivers/thunderbolt/Makefile +1 -1
index e276a9a62261..9828e862dd35 100644
@@ -1,3 +1,3 @@
 obj-${CONFIG_THUNDERBOLT} := thunderbolt.o
 thunderbolt-objs := nhi.o ctl.o tb.o switch.o cap.o path.o tunnel_pci.o eeprom.o
-thunderbolt-objs += domain.o
+thunderbolt-objs += domain.o dma_port.o
drivers/thunderbolt/dma_port.c new file +524 -0

524 lines not on this page · raw message

drivers/thunderbolt/dma_port.h new file +34 -0
new file mode 100644
index 000000000000..c4a69e0fbff7
@@ -0,0 +1,34 @@
+/*
+ * Thunderbolt DMA configuration based mailbox support
+ *
+ * Copyright (C) 2017, Intel Corporation
+ * Authors: Michael Jamet <[email protected]>
+ *          Mika Westerberg <[email protected]>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef DMA_PORT_H_
+#define DMA_PORT_H_
+
+#include "tb.h"
+
+struct tb_switch;
+struct tb_dma_port;
+
+#define DMA_PORT_CSS_ADDRESS		0x3fffff
+#define DMA_PORT_CSS_MAX_SIZE		SZ_128
+
+struct tb_dma_port *dma_port_alloc(struct tb_switch *sw);
+void dma_port_free(struct tb_dma_port *dma);
+int dma_port_flash_read(struct tb_dma_port *dma, unsigned int address,
+			void *buf, size_t size);
+int dma_port_flash_update_auth(struct tb_dma_port *dma);
+int dma_port_flash_update_auth_status(struct tb_dma_port *dma, u32 *status);
+int dma_port_flash_write(struct tb_dma_port *dma, unsigned int address,
+			 const void *buf, size_t size);
+int dma_port_power_cycle(struct tb_dma_port *dma);
+
+#endif
drivers/thunderbolt/eeprom.c +50 -1

69 lines not on this page · raw message

drivers/thunderbolt/switch.c +30 -0
index 6384061100b0..4b47e0999cda 100644
@@ -377,6 +377,8 @@ static void tb_switch_release(struct device *dev)
 {
 	struct tb_switch *sw = tb_to_switch(dev);
 
+	dma_port_free(sw->dma_port);
+
 	kfree(sw->uuid);
 	kfree(sw->device_name);
 	kfree(sw->vendor_name);
@@ -570,6 +572,25 @@ static void tb_switch_set_uuid(struct tb_switch *sw)
 	sw->uuid = kmemdup(uuid, sizeof(uuid), GFP_KERNEL);
 }
 
+static void tb_switch_add_dma_port(struct tb_switch *sw)
+{
+	switch (sw->generation) {
+	case 3:
+		break;
+
+	case 2:
+		/* Only root switch can be upgraded */
+		if (tb_route(sw))
+			return;
+		break;
+
+	default:
+		return;
+	}
+
+	sw->dma_port = dma_port_alloc(sw);
+}
+
 /**
  * tb_switch_add() - Add a switch to the domain
  * @sw: Switch to add
@@ -586,6 +607,15 @@ int tb_switch_add(struct tb_switch *sw)
 {
 	int i, ret;
 
+	/*
+	 * Initialize DMA control port now before we read DROM. Recent
+	 * host controllers have more complete DROM on NVM that includes
+	 * vendor and model identification strings which we then expose
+	 * to the userspace. NVM can be accessed through DMA
+	 * configuration based mailbox.
+	 */
+	tb_switch_add_dma_port(sw);
+
 	/* read drom */
 	ret = tb_drom_read(sw);
 	if (ret) {
drivers/thunderbolt/tb.h +5 -0
index 39d24dff82c5..31521c531715 100644
@@ -12,12 +12,16 @@
 
 #include "tb_regs.h"
 #include "ctl.h"
+#include "dma_port.h"
 
 /**
  * struct tb_switch - a thunderbolt switch
  * @dev: Device for the switch
  * @config: Switch configuration
  * @ports: Ports in this switch
+ * @dma_port: If the switch has port supporting DMA configuration based
+ *	      mailbox this will hold the pointer to that (%NULL
+ *	      otherwise).
  * @tb: Pointer to the domain the switch belongs to
  * @uid: Unique ID of the switch
  * @uuid: UUID of the switch (or %NULL if not supported)
@@ -34,6 +38,7 @@ struct tb_switch {
 	struct device dev;
 	struct tb_regs_switch_header config;
 	struct tb_port *ports;
+	struct tb_dma_port *dma_port;
 	struct tb *tb;
 	u64 uid;
 	uuid_be *uuid;
Signature · 1 line
2.11.0
#24 lore raw

PATCH v4 23/27 thunderbolt: Do not touch the hardware if the NHI is gone on resume

In reply to Mika Westerberg

On PCs the NHI host controller is only present when there is a device connected. When the last device is disconnected the host controller will dissappear shortly (within 10s). Now if that happens when we are suspended we should not try to touch the hardware anymore, so add a flag for this and check it before we re-enable rings.

---
 drivers/thunderbolt/nhi.c | 12 ++++++++++++
 drivers/thunderbolt/nhi.h |  3 +++
 2 files changed, 15 insertions(+)
drivers/thunderbolt/nhi.c +12 -0
index c358c074f925..14311535661d 100644
@@ -403,6 +403,8 @@ void ring_start(struct tb_ring *ring)
 {
 	mutex_lock(&ring->nhi->lock);
 	mutex_lock(&ring->lock);
+	if (ring->nhi->going_away)
+		goto err;
 	if (ring->running) {
 		dev_WARN(&ring->nhi->pdev->dev, "ring already started\n");
 		goto err;
@@ -449,6 +451,8 @@ void ring_stop(struct tb_ring *ring)
 	mutex_lock(&ring->lock);
 	dev_info(&ring->nhi->pdev->dev, "stopping %s %d\n",
 		 RING_TYPE(ring), ring->hop);
+	if (ring->nhi->going_away)
+		goto err;
 	if (!ring->running) {
 		dev_WARN(&ring->nhi->pdev->dev, "%s %d already stopped\n",
 			 RING_TYPE(ring), ring->hop);
@@ -653,6 +657,14 @@ static int nhi_resume_noirq(struct device *dev)
 	struct pci_dev *pdev = to_pci_dev(dev);
 	struct tb *tb = pci_get_drvdata(pdev);
 
+	/*
+	 * Check that the device is still there. It may be that the user
+	 * unplugged last device which causes the host controller to go
+	 * away on PCs.
+	 */
+	if (!pci_device_is_present(pdev))
+		tb->nhi->going_away = true;
+
 	return tb_domain_resume_noirq(tb);
 }
 
drivers/thunderbolt/nhi.h +3 -0
index 446ff6dac91d..953864ae0ab3 100644
@@ -20,6 +20,8 @@
  * @tx_rings: All Tx rings available on this host controller
  * @rx_rings: All Rx rings available on this host controller
  * @msix_ida: Used to allocate MSI-X vectors for rings
+ * @going_away: The host controller device is about to disappear so when
+ *		this flag is set, avoid touching the hardware anymore.
  * @interrupt_work: Work scheduled to handle ring interrupt when no
  *		    MSI-X is used.
  * @hop_count: Number of rings (end point hops) supported by NHI.
@@ -31,6 +33,7 @@ struct tb_nhi {
 	struct tb_ring **tx_rings;
 	struct tb_ring **rx_rings;
 	struct ida msix_ida;
+	bool going_away;
 	struct work_struct interrupt_work;
 	u32 hop_count;
 };
Signature · 1 line
2.11.0
#25 lore raw

PATCH v4 24/27 thunderbolt: Add support for Internal Connection Manager (ICM)

In reply to Mika Westerberg

Starting from Intel Falcon Ridge the internal connection manager running on the Thunderbolt host controller has been supporting 4 security levels. One reason for this is to prevent DMA attacks and only allow connecting devices the user trusts.

The internal connection manager (ICM) is the preferred way of connecting Thunderbolt devices over software only implementation typically used on Macs. The driver communicates with ICM using special Thunderbolt ring 0 (control channel) messages. In order to handle these messages we add support for the ICM messages to the control channel.

The security levels are as follows:

none - No security, all tunnels are created automatically user - User needs to approve the device before tunnels are created secure - User need to approve the device before tunnels are created.
The device is sent a challenge on future connects to be able to verify it is actually the approved device.
dponly - Only Display Port and USB tunnels can be created and those
are created automatically.

The security levels are typically configurable from the system BIOS and by default it is set to "user" on many systems.

In this patch each Thunderbolt device will have either one or two new sysfs attributes: authorized and key. The latter appears for devices that support secure connect.

In order to identify the device the user can read identication information, including UUID and name of the device from sysfs and based on that make a decision to authorize the device. The device is authorized by simply writing 1 to the "authorized" sysfs attribute. This is following the USB bus device authorization mechanism. The secure connect requires an additional challenge step (writing 2 to the "authorized" attribute) in future connects when the key has already been stored to the NVM of the device.

Non-ICM systems (before Alpine Ridge) continue to use the existing functionality and the security level is set to none. For systems with Alpine Ridge, even on Apple hardware, we will use ICM.

This code is based on the work done by Amir Levy and Michael Jamet.

---
 Documentation/ABI/testing/sysfs-bus-thunderbolt |   48 +
 drivers/thunderbolt/Kconfig                     |   12 +-
 drivers/thunderbolt/Makefile                    |    2 +-
 drivers/thunderbolt/ctl.c                       |    2 +
 drivers/thunderbolt/domain.c                    |  195 +++++
 drivers/thunderbolt/icm.c                       | 1058 +++++++++++++++++++++++
 drivers/thunderbolt/nhi.c                       |   33 +-
 drivers/thunderbolt/nhi_regs.h                  |    7 +
 drivers/thunderbolt/switch.c                    |  222 +++++
 drivers/thunderbolt/tb.c                        |    7 +
 drivers/thunderbolt/tb.h                        |   79 ++
 drivers/thunderbolt/tb_msgs.h                   |  152 ++++
 12 files changed, 1805 insertions(+), 12 deletions(-)
 create mode 100644 drivers/thunderbolt/icm.c
Documentation/ABI/testing/sysfs-bus-thunderbolt +48 -0
index 29a516f53d2c..05b7f9a6431f 100644
@@ -1,3 +1,51 @@
+What: /sys/bus/thunderbolt/devices/.../domainX/security
+Date:		Sep 2017
+KernelVersion:	4.13
+Contact:	[email protected]
+Description:	This attribute holds current Thunderbolt security level
+		set by the system BIOS. Possible values are:
+
+		none: All devices are automatically authorized
+		user: Devices are only authorized based on writing
+		      appropriate value to the authorized attribute
+		secure: Require devices that support secure connect at
+			minimum. User needs to authorize each device.
+		dponly: Automatically tunnel Display port (and USB). No
+			PCIe tunnels are created.
+
+What: /sys/bus/thunderbolt/devices/.../authorized
+Date:		Sep 2017
+KernelVersion:	4.13
+Contact:	[email protected]
+Description:	This attribute is used to authorize Thunderbolt devices
+		after they have been connected. If the device is not
+		authorized, no devices such as PCIe and Display port are
+		available to the system.
+
+		Contents of this attribute will be 0 when the device is not
+		yet authorized.
+
+		Possible values are supported:
+		1: The device will be authorized and connected
+
+		When key attribute contains 32 byte hex string the possible
+		values are:
+		1: The 32 byte hex string is added to the device NVM and
+		   the device is authorized.
+		2: Send a challenge based on the 32 byte hex string. If the
+		   challenge response from device is valid, the device is
+		   authorized. In case of failure errno will be ENOKEY if
+		   the device did not contain a key at all, and
+		   EKEYREJECTED if the challenge response did not match.
+
+What: /sys/bus/thunderbolt/devices/.../key
+Date:		Sep 2017
+KernelVersion:	4.13
+Contact:	[email protected]
+Description:	When a devices supports Thunderbolt secure connect it will
+		have this attribute. Writing 32 byte hex string changes
+		authorization to use the secure connection method instead.
+
 What:		/sys/bus/thunderbolt/devices/.../device
 Date:		Sep 2017
 KernelVersion:	4.13
drivers/thunderbolt/Kconfig +6 -6
index d35db16aa43f..a9cc724985ad 100644
@@ -1,15 +1,15 @@
 menuconfig THUNDERBOLT
-	tristate "Thunderbolt support for Apple devices"
+	tristate "Thunderbolt support"
 	depends on PCI
 	depends on X86 || COMPILE_TEST
 	select APPLE_PROPERTIES if EFI_STUB && X86
 	select CRC32
+	select CRYPTO
+	select CRYPTO_HASH
 	help
-	  Cactus Ridge Thunderbolt Controller driver
-	  This driver is required if you want to hotplug Thunderbolt devices on
-	  Apple hardware.
-
-	  Device chaining is currently not supported.
+	  Thunderbolt Controller driver. This driver is required if you
+	  want to hotplug Thunderbolt devices on Apple hardware or on PCs
+	  with Intel Falcon Ridge or newer.
 
 	  To compile this driver a module, choose M here. The module will be
 	  called thunderbolt.
drivers/thunderbolt/Makefile +1 -1
index 9828e862dd35..4900febc6c8a 100644
@@ -1,3 +1,3 @@
 obj-${CONFIG_THUNDERBOLT} := thunderbolt.o
 thunderbolt-objs := nhi.o ctl.o tb.o switch.o cap.o path.o tunnel_pci.o eeprom.o
-thunderbolt-objs += domain.o dma_port.o
+thunderbolt-objs += domain.o dma_port.o icm.o
drivers/thunderbolt/ctl.c +2 -0
index 27c30ff79a84..69c0232a22f8 100644
@@ -463,6 +463,8 @@ static void tb_ctl_rx_callback(struct tb_ring *ring, struct ring_frame *frame,
 				   "RX: checksum mismatch, dropping packet\n");
 			goto rx;
 		}
+		/* Fall through */
+	case TB_CFG_PKG_ICM_EVENT:
 		tb_ctl_handle_event(pkg->ctl, frame->eof, pkg, frame->size);
 		goto rx;
 
drivers/thunderbolt/domain.c +195 -0

224 lines not on this page · raw message

drivers/thunderbolt/icm.c new file +1058 -0

1,058 lines not on this page · raw message

drivers/thunderbolt/nhi.c +28 -5
index 14311535661d..05af126a2435 100644
@@ -13,7 +13,6 @@
 #include <linux/pci.h>
 #include <linux/interrupt.h>
 #include <linux/module.h>
-#include <linux/dmi.h>
 #include <linux/delay.h>
 
 #include "nhi.h"
@@ -668,6 +667,22 @@ static int nhi_resume_noirq(struct device *dev)
 	return tb_domain_resume_noirq(tb);
 }
 
+static int nhi_suspend(struct device *dev)
+{
+	struct pci_dev *pdev = to_pci_dev(dev);
+	struct tb *tb = pci_get_drvdata(pdev);
+
+	return tb_domain_suspend(tb);
+}
+
+static void nhi_complete(struct device *dev)
+{
+	struct pci_dev *pdev = to_pci_dev(dev);
+	struct tb *tb = pci_get_drvdata(pdev);
+
+	tb_domain_complete(tb);
+}
+
 static void nhi_shutdown(struct tb_nhi *nhi)
 {
 	int i;
@@ -784,10 +799,16 @@ static int nhi_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	/* magic value - clock related? */
 	iowrite32(3906250 / 10000, nhi->iobase + 0x38c00);
 
-	dev_info(&nhi->pdev->dev, "NHI initialized, starting thunderbolt\n");
-	tb = tb_probe(nhi);
+	tb = icm_probe(nhi);
 	if (!tb)
+		tb = tb_probe(nhi);
+	if (!tb) {
+		dev_err(&nhi->pdev->dev,
+			"failed to determine connection manager, aborting\n");
 		return -ENODEV;
+	}
+
+	dev_info(&nhi->pdev->dev, "NHI initialized, starting thunderbolt\n");
 
 	res = tb_domain_add(tb);
 	if (res) {
@@ -826,6 +847,10 @@ static const struct dev_pm_ops nhi_pm_ops = {
 					    * pci-tunnels stay alive.
 					    */
 	.restore_noirq = nhi_resume_noirq,
+	.suspend = nhi_suspend,
+	.freeze = nhi_suspend,
+	.poweroff = nhi_suspend,
+	.complete = nhi_complete,
 };
 
 static struct pci_device_id nhi_ids[] = {
@@ -886,8 +911,6 @@ static int __init nhi_init(void)
 {
 	int ret;
 
-	if (!dmi_match(DMI_BOARD_VENDOR, "Apple Inc."))
-		return -ENOSYS;
 	ret = tb_domain_init();
 	if (ret)
 		return ret;
drivers/thunderbolt/nhi_regs.h +7 -0
index 322fe1fa3a3c..09ed574e92ff 100644
@@ -118,4 +118,11 @@ struct ring_desc {
 #define REG_OUTMAIL_CMD_OPMODE_SHIFT	8
 #define REG_OUTMAIL_CMD_OPMODE_MASK	GENMASK(11, 8)
 
+#define REG_FW_STS			0x39944
+#define REG_FW_STS_NVM_AUTH_DONE	BIT(31)
+#define REG_FW_STS_CIO_RESET_REQ	BIT(30)
+#define REG_FW_STS_ICM_EN_CPU		BIT(2)
+#define REG_FW_STS_ICM_EN_INVERT	BIT(1)
+#define REG_FW_STS_ICM_EN		BIT(0)
+
 #endif
drivers/thunderbolt/switch.c +222 -0

270 lines not on this page · raw message

drivers/thunderbolt/tb.c +7 -0
index ea9de49b5e10..ad2304bad592 100644
@@ -7,6 +7,7 @@
 #include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/delay.h>
+#include <linux/dmi.h>
 
 #include "tb.h"
 #include "tb_regs.h"
@@ -71,6 +72,8 @@ static void tb_scan_port(struct tb_port *port)
 		return;
 	}
 
+	sw->authorized = true;
+
 	if (tb_switch_add(sw)) {
 		tb_switch_put(sw);
 		return;
@@ -443,10 +446,14 @@ struct tb *tb_probe(struct tb_nhi *nhi)
 	struct tb_cm *tcm;
 	struct tb *tb;
 
+	if (!dmi_match(DMI_BOARD_VENDOR, "Apple Inc."))
+		return NULL;
+
 	tb = tb_domain_alloc(nhi, sizeof(*tcm));
 	if (!tb)
 		return NULL;
 
+	tb->security_level = TB_SECURITY_NONE;
 	tb->cm_ops = &tb_cm_ops;
 
 	tcm = tb_priv(tb);
drivers/thunderbolt/tb.h +79 -0

152 lines not on this page · raw message

drivers/thunderbolt/tb_msgs.h +152 -0

168 lines not on this page · raw message

Signature · 1 line
2.11.0
#26 lore raw

PATCH v4 25/27 thunderbolt: Add support for host and device NVM firmware upgrade

In reply to Mika Westerberg

Starting from Intel Falcon Ridge the NVM firmware can be upgraded by using DMA configuration based mailbox commands. If we detect that the host or device (device support starts from Intel Alpine Ridge) has the DMA configuration based mailbox we expose NVM information to the userspace as two separate Linux NVMem devices: nvm_active and nvm_non_active. The former is read-only portion of the active NVM which firmware upgrade tools can be use to find out suitable NVM image if the device identification strings are not enough.

The latter is write-only portion where the new NVM image is to be written by the userspace. It is up to the userspace to find out right NVM image (the kernel does very minimal validation). The ICM firmware itself authenticates the new NVM firmware and fails the operation if it is not what is expected.

We also expose two new sysfs files per each switch: nvm_version and nvm_authenticate which can be used to read the active NVM version and start the upgrade process.

We also introduce safe mode which is the mode a switch goes when it does not have properly authenticated firmware. In this mode the switch only accepts a couple of commands including flashing a new NVM firmware image and triggering power cycle.

This code is based on the work done by Amir Levy and Michael Jamet.

---
 Documentation/ABI/testing/sysfs-bus-thunderbolt |  26 +
 drivers/thunderbolt/Kconfig                     |   1 +
 drivers/thunderbolt/domain.c                    |  18 +
 drivers/thunderbolt/icm.c                       |  33 +-
 drivers/thunderbolt/nhi.h                       |   1 +
 drivers/thunderbolt/switch.c                    | 603 +++++++++++++++++++++++-
 drivers/thunderbolt/tb.c                        |   7 +
 drivers/thunderbolt/tb.h                        |  40 +-
 8 files changed, 706 insertions(+), 23 deletions(-)
Documentation/ABI/testing/sysfs-bus-thunderbolt +26 -0
index 05b7f9a6431f..2a98149943ea 100644
@@ -82,3 +82,29 @@ Description:	This attribute contains unique_id string of this device.
 		This is either read from hardware registers (UUID on
 		newer hardware) or based on UID from the device DROM.
 		Can be used to uniquely identify particular device.
+
+What:		/sys/bus/thunderbolt/devices/.../nvm_version
+Date:		Sep 2017
+KernelVersion:	4.13
+Contact:	[email protected]
+Description:	If the device has upgradeable firmware the version
+		number is available here. Format: %x.%x, major.minor.
+		If the device is in safe mode reading the file returns
+		-ENODATA instead as the NVM version is not available.
+
+What:		/sys/bus/thunderbolt/devices/.../nvm_authenticate
+Date:		Sep 2017
+KernelVersion:	4.13
+Contact:	[email protected]
+Description:	When new NVM image is written to the non-active NVM
+		area (through non_activeX NVMem device), the
+		authentication procedure is started by writing 1 to
+		this file. If everything goes well, the device is
+		restarted with the new NVM firmware. If the image
+		verification fails an error code is returned instead.
+
+		When read holds status of the last authentication
+		operation if an error occurred during the process. This
+		is directly the status value from the DMA configuration
+		based mailbox before the device is power cycled. Writing
+		0 here clears the status.
drivers/thunderbolt/Kconfig +1 -0
index a9cc724985ad..f4869c38c7e4 100644
@@ -6,6 +6,7 @@ menuconfig THUNDERBOLT
 	select CRC32
 	select CRYPTO
 	select CRYPTO_HASH
+	select NVMEM
 	help
 	  Thunderbolt Controller driver. This driver is required if you
 	  want to hotplug Thunderbolt devices on Apple hardware or on PCs
drivers/thunderbolt/domain.c +18 -0
index f71b63e90016..9f2dcd48974d 100644
@@ -426,6 +426,23 @@ int tb_domain_challenge_switch_key(struct tb *tb, struct tb_switch *sw)
 	return ret;
 }
 
+/**
+ * tb_domain_disconnect_pcie_paths() - Disconnect all PCIe paths
+ * @tb: Domain whose PCIe paths to disconnect
+ *
+ * This needs to be called in preparation for NVM upgrade of the host
+ * controller. Makes sure all PCIe paths are disconnected.
+ *
+ * Return %0 on success and negative errno in case of error.
+ */
+int tb_domain_disconnect_pcie_paths(struct tb *tb)
+{
+	if (!tb->cm_ops->disconnect_pcie_paths)
+		return -EPERM;
+
+	return tb->cm_ops->disconnect_pcie_paths(tb);
+}
+
 int tb_domain_init(void)
 {
 	return bus_register(&tb_bus_type);
@@ -435,4 +452,5 @@ void tb_domain_exit(void)
 {
 	bus_unregister(&tb_bus_type);
 	ida_destroy(&tb_domain_ida);
+	tb_switch_exit();
 }
drivers/thunderbolt/icm.c +32 -1
index 0ffa4ec249ac..8ee340290219 100644
@@ -54,6 +54,7 @@
  *		   where ICM needs to be started manually
  * @vnd_cap: Vendor defined capability where PCIe2CIO mailbox resides
  *	     (only set when @upstream_port is not %NULL)
+ * @safe_mode: ICM is in safe mode
  * @is_supported: Checks if we can support ICM on this controller
  * @get_mode: Read and return the ICM firmware mode (optional)
  * @get_route: Find a route string for given switch
@@ -65,6 +66,7 @@ struct icm {
 	struct delayed_work rescan_work;
 	struct pci_dev *upstream_port;
 	int vnd_cap;
+	bool safe_mode;
 	bool (*is_supported)(struct tb *tb);
 	int (*get_mode)(struct tb *tb);
 	int (*get_route)(struct tb *tb, u8 link, u8 depth, u64 *route);
@@ -852,6 +854,10 @@ static int icm_firmware_init(struct tb *tb)
 		ret = icm->get_mode(tb);
 
 		switch (ret) {
+		case NHI_FW_SAFE_MODE:
+			icm->safe_mode = true;
+			break;
+
 		case NHI_FW_CM_MODE:
 			/* Ask ICM to accept all Thunderbolt devices */
 			nhi_mailbox_cmd(nhi, NHI_MAILBOX_ALLOW_ALL_DEVS, 0);
@@ -879,12 +885,20 @@ static int icm_firmware_init(struct tb *tb)
 
 static int icm_driver_ready(struct tb *tb)
 {
+	struct icm *icm = tb_priv(tb);
 	int ret;
 
 	ret = icm_firmware_init(tb);
 	if (ret)
 		return ret;
 
+	if (icm->safe_mode) {
+		tb_info(tb, "Thunderbolt host controller is in safe mode.\n");
+		tb_info(tb, "You need to update NVM firmware of the controller before it can be used.\n");
+		tb_info(tb, "For latest updates check https://thunderbolttechnology.net/updates.\n");
+		return 0;
+	}
+
 	return __icm_driver_ready(tb, &tb->security_level);
 }
 
@@ -975,12 +989,23 @@ static void icm_complete(struct tb *tb)
 
 static int icm_start(struct tb *tb)
 {
+	struct icm *icm = tb_priv(tb);
 	int ret;
 
-	tb->root_switch = tb_switch_alloc(tb, &tb->dev, 0);
+	if (icm->safe_mode)
+		tb->root_switch = tb_switch_alloc_safe_mode(tb, &tb->dev, 0);
+	else
+		tb->root_switch = tb_switch_alloc(tb, &tb->dev, 0);
 	if (!tb->root_switch)
 		return -ENODEV;
 
+	/*
+	 * NVM upgrade has not been tested on Apple systems and they
+	 * don't provide images publicly either. To be on the safe side
+	 * prevent root switch NVM upgrade on Macs for now.
+	 */
+	tb->root_switch->no_nvm_upgrade = is_apple();
+
 	ret = tb_switch_add(tb->root_switch);
 	if (ret)
 		tb_switch_put(tb->root_switch);
@@ -998,6 +1023,11 @@ static void icm_stop(struct tb *tb)
 	nhi_mailbox_cmd(tb->nhi, NHI_MAILBOX_DRV_UNLOADS, 0);
 }
 
+static int icm_disconnect_pcie_paths(struct tb *tb)
+{
+	return nhi_mailbox_cmd(tb->nhi, NHI_MAILBOX_DISCONNECT_PCIE_PATHS, 0);
+}
+
 /* Falcon Ridge and Alpine Ridge */
 static const struct tb_cm_ops icm_fr_ops = {
 	.driver_ready = icm_driver_ready,
@@ -1009,6 +1039,7 @@ static const struct tb_cm_ops icm_fr_ops = {
 	.approve_switch = icm_fr_approve_switch,
 	.add_switch_key = icm_fr_add_switch_key,
 	.challenge_switch_key = icm_fr_challenge_switch_key,
+	.disconnect_pcie_paths = icm_disconnect_pcie_paths,
 };
 
 struct tb *icm_probe(struct tb_nhi *nhi)
drivers/thunderbolt/nhi.h +1 -0
index 953864ae0ab3..5b5bb2c436be 100644
@@ -155,6 +155,7 @@ enum nhi_fw_mode {
 
 enum nhi_mailbox_cmd {
 	NHI_MAILBOX_SAVE_DEVS = 0x05,
+	NHI_MAILBOX_DISCONNECT_PCIE_PATHS = 0x06,
 	NHI_MAILBOX_DRV_UNLOADS = 0x07,
 	NHI_MAILBOX_ALLOW_ALL_DEVS = 0x23,
 };
drivers/thunderbolt/switch.c +582 -21

682 lines not on this page · raw message

drivers/thunderbolt/tb.c +7 -0
index ad2304bad592..1b02ca0b6129 100644
@@ -369,6 +369,13 @@ static int tb_start(struct tb *tb)
 	if (!tb->root_switch)
 		return -ENOMEM;
 
+	/*
+	 * ICM firmware upgrade needs running firmware and in native
+	 * mode that is not available so disable firmware upgrade of the
+	 * root switch.
+	 */
+	tb->root_switch->no_nvm_upgrade = true;
+
 	ret = tb_switch_configure(tb->root_switch);
 	if (ret) {
 		tb_switch_put(tb->root_switch);
drivers/thunderbolt/tb.h +39 -1
index a998b3a251d5..3d9f64676e58 100644
@@ -7,6 +7,7 @@
 #ifndef TB_H_
 #define TB_H_
 
+#include <linux/nvmem-provider.h>
 #include <linux/pci.h>
 #include <linux/uuid.h>
 
@@ -15,6 +16,30 @@
 #include "dma_port.h"
 
 /**
+ * struct tb_switch_nvm - Structure holding switch NVM information
+ * @major: Major version number of the active NVM portion
+ * @minor: Minor version number of the active NVM portion
+ * @id: Identifier used with both NVM portions
+ * @active: Active portion NVMem device
+ * @non_active: Non-active portion NVMem device
+ * @buf: Buffer where the NVM image is stored before it is written to
+ *	 the actual NVM flash device
+ * @buf_data_size: Number of bytes actually consumed by the new NVM
+ *		   image
+ * @authenticating: The switch is authenticating the new NVM
+ */
+struct tb_switch_nvm {
+	u8 major;
+	u8 minor;
+	int id;
+	struct nvmem_device *active;
+	struct nvmem_device *non_active;
+	void *buf;
+	size_t buf_data_size;
+	bool authenticating;
+};
+
+/**
  * enum tb_security_level - Thunderbolt security level
  * @TB_SECURITY_NONE: No security, legacy mode
  * @TB_SECURITY_USER: User approval required at minimum
@@ -39,7 +64,8 @@ enum tb_security_level {
  * @ports: Ports in this switch
  * @dma_port: If the switch has port supporting DMA configuration based
  *	      mailbox this will hold the pointer to that (%NULL
- *	      otherwise).
+ *	      otherwise). If set it also means the switch has
+ *	      upgradeable NVM.
  * @tb: Pointer to the domain the switch belongs to
  * @uid: Unique ID of the switch
  * @uuid: UUID of the switch (or %NULL if not supported)
@@ -51,6 +77,9 @@ enum tb_security_level {
  * @cap_plug_events: Offset to the plug events capability (%0 if not found)
  * @is_unplugged: The switch is going away
  * @drom: DROM of the switch (%NULL if not found)
+ * @nvm: Pointer to the NVM if the switch has one (%NULL otherwise)
+ * @no_nvm_upgrade: Prevent NVM upgrade of this switch
+ * @safe_mode: The switch is in safe-mode
  * @authorized: Whether the switch is authorized by user or policy
  * @work: Work used to automatically authorize a switch
  * @security_level: Switch supported security level
@@ -81,6 +110,9 @@ struct tb_switch {
 	int cap_plug_events;
 	bool is_unplugged;
 	u8 *drom;
+	struct tb_switch_nvm *nvm;
+	bool no_nvm_upgrade;
+	bool safe_mode;
 	unsigned int authorized;
 	struct work_struct work;
 	enum tb_security_level security_level;
@@ -172,6 +204,7 @@ struct tb_path {
  * @approve_switch: Approve switch
  * @add_switch_key: Add key to switch
  * @challenge_switch_key: Challenge switch using key
+ * @disconnect_pcie_paths: Disconnects PCIe paths before NVM update
  */
 struct tb_cm_ops {
 	int (*driver_ready)(struct tb *tb);
@@ -187,6 +220,7 @@ struct tb_cm_ops {
 	int (*add_switch_key)(struct tb *tb, struct tb_switch *sw);
 	int (*challenge_switch_key)(struct tb *tb, struct tb_switch *sw,
 				    const u8 *challenge, u8 *response);
+	int (*disconnect_pcie_paths)(struct tb *tb);
 };
 
 /**
@@ -340,6 +374,7 @@ extern struct device_type tb_switch_type;
 
 int tb_domain_init(void);
 void tb_domain_exit(void);
+void tb_switch_exit(void);
 
 struct tb *tb_domain_alloc(struct tb_nhi *nhi, size_t privsize);
 int tb_domain_add(struct tb *tb);
@@ -351,6 +386,7 @@ void tb_domain_complete(struct tb *tb);
 int tb_domain_approve_switch(struct tb *tb, struct tb_switch *sw);
 int tb_domain_approve_switch_key(struct tb *tb, struct tb_switch *sw);
 int tb_domain_challenge_switch_key(struct tb *tb, struct tb_switch *sw);
+int tb_domain_disconnect_pcie_paths(struct tb *tb);
 
 static inline void tb_domain_put(struct tb *tb)
 {
@@ -359,6 +395,8 @@ static inline void tb_domain_put(struct tb *tb)
 
 struct tb_switch *tb_switch_alloc(struct tb *tb, struct device *parent,
 				  u64 route);
+struct tb_switch *tb_switch_alloc_safe_mode(struct tb *tb,
+			struct device *parent, u64 route);
 int tb_switch_configure(struct tb_switch *sw);
 int tb_switch_add(struct tb_switch *sw);
 void tb_switch_remove(struct tb_switch *sw);
Signature · 1 line
2.11.0
#27 lore raw

PATCH v4 26/27 thunderbolt: Add documentation how Thunderbolt bus can be used

In reply to Mika Westerberg

Since there are no such tool yet that handles all the low-level details of connecting devices and upgrading their firmware, add a small document that shows how the Thunderbolt bus can be used directly from command line.

---
 Documentation/admin-guide/index.rst       |   1 +
 Documentation/admin-guide/thunderbolt.rst | 199 ++++++++++++++++++++++++++++++
 2 files changed, 200 insertions(+)
 create mode 100644 Documentation/admin-guide/thunderbolt.rst
Documentation/admin-guide/index.rst +1 -0
index 8c60a8a32a1a..6d99a7ce6e21 100644
@@ -61,6 +61,7 @@ configure specific aspects of kernel behavior to your liking.
    java
    ras
    pm/index
+   thunderbolt
 
 .. only::  subproject and html
 
Documentation/admin-guide/thunderbolt.rst new file +199 -0

199 lines not on this page · raw message

Signature · 1 line
2.11.0
#28 lore raw

PATCH v4 27/27 MAINTAINERS: Add maintainers for Thunderbolt driver

In reply to Mika Westerberg

We will be helping Andreas to maintain the Thunderbolt driver.

---
 MAINTAINERS | 3 +++
 1 file changed, 3 insertions(+)
MAINTAINERS +3 -0
index 7a28acd7f525..c29756cf0a76 100644
@@ -11328,6 +11328,9 @@ F:	Documentation/tee.txt
 
 THUNDERBOLT DRIVER
 M:	Andreas Noever <[email protected]>
+M:	Michael Jamet <[email protected]>
+M:	Mika Westerberg <[email protected]>
+M:	Yehezkel Bernat <[email protected]>
 S:	Maintained
 F:	drivers/thunderbolt/
 
Signature · 1 line
2.11.0
#29 lore raw
In reply to Mika Westerberg
Quoted 6 lines · Mika Westerberg

Hi,

This is fourth version of the patch series adding support for Thunderbolt security levels and NVM firmware upgrade. PCs running Intel Falcon Ridge or newer need these in order to connect devices if the security level is set to "user(SL1) or secure(SL2)" from BIOS.

All now queued up, nice work!

greg k-h

#30 lore raw
Quoted 9 lines · Greg Kroah-Hartman
Quoted 6 lines · Mika Westerberg

Hi,

This is fourth version of the patch series adding support for Thunderbolt security levels and NVM firmware upgrade. PCs running Intel Falcon Ridge or newer need these in order to connect devices if the security level is set to "user(SL1) or secure(SL2)" from BIOS.

All now queued up, nice work!

Thanks!

#31 lore raw
In reply to Mika Westerberg

Hi!

Quoted 2 lines

This is fourth version of the patch series adding support for Thunderbolt security levels and NVM firmware upgrade.

While prototyping the user-space bits for GNOME, I stumbled upon an oops on the Lenovo T470s (see below) when attaching a Dell TB16 thunderbolt 3 dock. As a result /sys/bus/thunderbolt/devices has only domain0 in it but not the dock itself. Everything works fine on a Dell XPS 13 9630. The oops happens with linux-next and when I backport the patches to 4.11.11.
Happy to provide any more information and test future patches.

Cheers,
Christian

--- 8< ---
lspci output:

pcilib: Cannot open /sys/bus/pci/devices/0000:03:00.0/config
lspci: Unable to read the standard configuration space header of device 0000:03:00.0
00:00.0 Host bridge: Intel Corporation Device 5904 (rev 02)
00:02.0 VGA compatible controller: Intel Corporation Device 5916 (rev 02)
00:14.0 USB controller: Intel Corporation Sunrise Point-LP USB 3.0 xHCI Controller (rev 21) 00:14.2 Signal processing controller: Intel Corporation Sunrise Point-LP Thermal subsystem (rev 21) 00:16.0 Communication controller: Intel Corporation Sunrise Point-LP CSME HECI #1 (rev 21) 00:16.3 Serial controller: Intel Corporation Device 9d3d (rev 21)
00:1c.0 PCI bridge: Intel Corporation Device 9d10 (rev f1)
00:1c.2 PCI bridge: Intel Corporation Device 9d12 (rev f1)
00:1d.0 PCI bridge: Intel Corporation Sunrise Point-LP PCI Express Root Port #9 (rev f1) 00:1f.0 ISA bridge: Intel Corporation Device 9d4e (rev 21)
00:1f.2 Memory controller: Intel Corporation Sunrise Point-LP PMC (rev 21)
00:1f.3 Audio device: Intel Corporation Device 9d71 (rev 21)
00:1f.4 SMBus: Intel Corporation Sunrise Point-LP SMBus (rev 21)
00:1f.6 Ethernet controller: Intel Corporation Ethernet Connection (4) I219-LM (rev 21) 01:00.0 PCI bridge: Intel Corporation JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016] (rev ff) 02:00.0 PCI bridge: Intel Corporation JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016] (rev ff) 02:01.0 PCI bridge: Intel Corporation JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016] (rev ff) 02:02.0 PCI bridge: Intel Corporation JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016] (rev ff) 3a:00.0 Network controller: Intel Corporation Wireless 8265 / 8275 (rev 78)
3c:00.0 Non-Volatile memory controller: Toshiba America Info Systems Device 0115 (rev 01)

--- >8 ---
Ops:

[   69.886978] thunderbolt 0000:03:00.0: current switch config:
[   69.886983] thunderbolt 0000:03:00.0:  Switch: 8086:15c0 (Revision: 1, TB Version: 2)
[   69.886986] thunderbolt 0000:03:00.0:   Max Port Number: 5
[   69.886987] thunderbolt 0000:03:00.0:   Config:
[   69.886991] thunderbolt 0000:03:00.0:    Upstream Port Number: 3 Depth: 0 Route String: 0x0 Enabled: 1, PlugEventsDelay: 254ms
[   69.886994] thunderbolt 0000:03:00.0:    unknown1: 0x0 unknown4: 0x0
[   69.920748] BUG: unable to handle kernel NULL pointer dereference at 00000000000002ec
[   69.920834] IP: tb_drom_read+0x383/0x890 [thunderbolt]
[   69.920873] PGD 0 
[   69.920874] P4D 0 
[   69.920925] Oops: 0000 [#1] SMP
[   69.920952] Modules linked in: thunderbolt(+) fuse rfcomm ccm xt_CHECKSUM ipt_MASQUERADE nf_nat_masquerade_ipv4 tun nf_conntrack_netbios_ns nf_conntrack_broadcast xt_CT ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute bridge stp llc ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack libcrc32c iptable_mangle iptable_raw iptable_security ebtable_filter ebtables ip6table_filter ip6_tables cmac bnep sunrpc arc4 wmi_bmof iTCO_wdt iwlmvm iTCO_vendor_support snd_soc_skl mei_wdt snd_soc_skl_ipc snd_soc_sst_ipc snd_soc_sst_dsp snd_hda_ext_core tpm_crb snd_soc_sst_match intel_rapl x86_pkg_temp_thermal intel_powerclamp mac80211 coretemp
[   69.921479]  kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hda_codec_hdmi intel_cstate intel_uncore intel_rapl_perf snd_soc_core iwlwifi snd_hda_codec_realtek snd_hda_codec_generic snd_compress snd_pcm_dmaengine ac97_bus snd_hda_intel snd_hda_codec snd_hda_core cfg80211 snd_hwdep snd_seq pcspkr uvcvideo hci_uart joydev snd_seq_device snd_pcm videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_core btusb videodev btrtl btbcm snd_timer i2c_i801 btqca btintel media bluetooth qcserial mei_me usb_wwan mei shpchp thinkpad_acpi intel_pch_thermal snd wmi tpm_tis soundcore tpm_tis_core pinctrl_sunrisepoint intel_lpss_acpi tpm ecdh_generic intel_lpss pinctrl_intel rfkill acpi_pad cdc_mbim cdc_wdm cdc_ncm usbnet mii uas usb_storage i915 i2c_algo_bit drm_kms_helper drm e1000e crc32c_intel
[   69.922013]  ptp serio_raw nvme nvme_core pps_core video i2c_hid
[   69.922062] CPU: 3 PID: 12248 Comm: systemd-udevd Not tainted 4.13.0-rc1-next-20170719 #1
[   69.922116] Hardware name: LENOVO 20HF000YGE/20HF000YGE, BIOS N1WET32W (1.11 ) 05/23/2017
[   69.922170] task: ffff8a293e4bcd80 task.stack: ffffa698027a8000
[   69.922218] RIP: 0010:tb_drom_read+0x383/0x890 [thunderbolt]
[   69.922256] RSP: 0018:ffffa698027ab990 EFLAGS: 00010246
[   69.922292] RAX: 0000000000000000 RBX: ffff8a2940af7800 RCX: 0000000000000000
[   69.922339] RDX: ffff8a2940ebb400 RSI: 0000000000000000 RDI: ffffa698027ab9a0
[   69.922385] RBP: ffffa698027ab9d0 R08: 0000000000000001 R09: 0000000000000002
[   69.922432] R10: ffff8a2940ebb5b0 R11: 0000000000000000 R12: ffff8a293bfa968c
[   69.922478] R13: 000000000000002c R14: 0000000000000056 R15: 0000000000000056
[   69.922526] FS:  00007f0a945a38c0(0000) GS:ffff8a2961580000(0000) knlGS:0000000000000000
[   69.922579] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   69.922617] CR2: 00000000000002ec CR3: 000000043e785000 CR4: 00000000003606e0
[   69.922665] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   69.922712] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   69.922760] Call Trace:
[   69.922789]  tb_switch_add+0x9d/0x730 [thunderbolt]
[   69.922846]  ? tb_switch_alloc+0x3cd/0x4d0 [thunderbolt]
[   69.922893]  icm_start+0x5a/0xa0 [thunderbolt]
[   69.922934]  tb_domain_add+0xc3/0xf0 [thunderbolt]
[   69.922976]  nhi_probe+0x19e/0x310 [thunderbolt]
[   69.923017]  local_pci_probe+0x42/0xa0
[   69.923048]  pci_device_probe+0x18d/0x1a0
[   69.923082]  driver_probe_device+0x2ff/0x450
[   69.923116]  __driver_attach+0xa4/0xe0
[   69.923146]  ? driver_probe_device+0x450/0x450
[   69.923184]  bus_for_each_dev+0x6e/0xb0
[   69.923215]  driver_attach+0x1e/0x20
[   69.923246]  bus_add_driver+0x1d0/0x270
[   69.923277]  ? 0xffffffffc0bbb000
[   69.923304]  driver_register+0x60/0xe0
[   69.923334]  ? 0xffffffffc0bbb000
[   69.923372]  __pci_register_driver+0x4c/0x50
[   69.923411]  nhi_init+0x28/0x1000 [thunderbolt]
[   69.923449]  do_one_initcall+0x50/0x190
[   69.923481]  ? __vunmap+0x81/0xb0
[   69.923511]  ? _cond_resched+0x1a/0x50
[   69.923544]  ? kmem_cache_alloc_trace+0x15f/0x1c0
[   69.923581]  ? do_init_module+0x27/0x1e9
[   69.923613]  do_init_module+0x5f/0x1e9
[   69.923643]  load_module+0x24e7/0x2a60
[   69.923677]  ? vfs_read+0x115/0x130
[   69.923707]  SYSC_finit_module+0xfc/0x120
[   69.923738]  ? SYSC_finit_module+0xfc/0x120
[   69.923773]  SyS_finit_module+0xe/0x10
[   69.923805]  do_syscall_64+0x67/0x170
[   69.923850]  entry_SYSCALL64_slow_path+0x25/0x25
[   69.923882] RIP: 0033:0x7f0a93214529
[   69.923908] RSP: 002b:00007fffddc70308 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[   69.923959] RAX: ffffffffffffffda RBX: 000000c52e0e6450 RCX: 00007f0a93214529
[   69.924005] RDX: 0000000000000000 RSI: 00007f0a93d509c5 RDI: 0000000000000007
[   69.924052] RBP: 00007f0a93d509c5 R08: 0000000000000000 R09: 00007fffddc70420
[   69.926454] R10: 0000000000000007 R11: 0000000000000246 R12: 0000000000000000
[   69.928766] R13: 000000c52e0e5590 R14: 0000000000020000 R15: 000000c52df83f4a
[   69.931055] Code: 8d 0c c9 83 e0 01 84 c0 4c 8d 14 ca 41 88 42 35 75 85 49 8b 42 20 41 0f b6 4a 34 41 b9 02 00 00 00 41 b8 01 00 00 00 4c 89 55 c0 <8b> 90 ec 02 00 00 8b b0 e8 02 00 00 48 8b 80 08 03 00 00 81 e2 
[   69.933380] RIP: tb_drom_read+0x383/0x890 [thunderbolt] RSP: ffffa698027ab990
[   69.935708] CR2: 00000000000002ec
[   69.950221] ---[ end trace a3f247a8fe7705ab ]---

--- 8< ---

Signature · 3 lines
Dr. Christian J. Kellner
Red Hat Desktop Hardware Enablement
[email protected]
#32 lore raw
Quoted 20 lines

-----Original Message-----
From: Christian Kellner [mailto:[email protected]]
Sent: Thursday, July 20, 2017 11:12 AM
To: Mika Westerberg <[email protected]>
Cc: Andreas Noever <[email protected]>; Greg Kroah-Hartman <[email protected]>; Michael Jamet <[email protected]>; Yehezkel Bernat <[email protected]>; Lukas Wunner <[email protected]>; Amir Levy <[email protected]>; Andy Lutomirski <[email protected]>; Limonciello, Mario <[email protected]>; Dominguez, Jared <[email protected]>; Andy Shevchenko <[email protected]>; [email protected]; Peter FP1 Zhang <[email protected]>
Subject: Re: [PATCH v4 00/27] Thunderbolt security levels and NVM firmware upgrade

Hi!

Quoted 2 lines

This is fourth version of the patch series adding support for Thunderbolt security levels and NVM firmware upgrade.

Quoted 8 lines

While prototyping the user-space bits for GNOME, I stumbled upon an oops on the Lenovo T470s (see below) when attaching a Dell TB16 thunderbolt 3 dock. As a result /sys/bus/thunderbolt/devices has only domain0 in it but not the dock itself. Everything works fine on a Dell XPS 13 9630. The oops happens with linux-next and when I backport the patches to 4.11.11.
Happy to provide any more information and test future patches.

Christian,

Did you by chance boot with the dock "plugged in"? Or was this the result of plugging in after boot?

There is a known issue that Mika is tracking regarding some problems with Thunderbolt devices plugged in at boot. It causes a few things to explode down the line too (which I suspect is what happened).

Thanks,

Quoted 168 lines

Cheers,
Christian

--- 8< ---
lspci output:

pcilib: Cannot open /sys/bus/pci/devices/0000:03:00.0/config
lspci: Unable to read the standard configuration space header of device 0000:03:00.0
00:00.0 Host bridge: Intel Corporation Device 5904 (rev 02)
00:02.0 VGA compatible controller: Intel Corporation Device 5916 (rev 02) 00:14.0 USB controller: Intel Corporation Sunrise Point-LP USB 3.0 xHCI Controller (rev 21)
00:14.2 Signal processing controller: Intel Corporation Sunrise Point-LP Thermal subsystem (rev 21)
00:16.0 Communication controller: Intel Corporation Sunrise Point-LP CSME HECI #1 (rev 21)
00:16.3 Serial controller: Intel Corporation Device 9d3d (rev 21) 00:1c.0 PCI bridge: Intel Corporation Device 9d10 (rev f1)
00:1c.2 PCI bridge: Intel Corporation Device 9d12 (rev f1)
00:1d.0 PCI bridge: Intel Corporation Sunrise Point-LP PCI Express Root Port #9 (rev f1)
00:1f.0 ISA bridge: Intel Corporation Device 9d4e (rev 21)
00:1f.2 Memory controller: Intel Corporation Sunrise Point-LP PMC (rev 21) 00:1f.3 Audio device: Intel Corporation Device 9d71 (rev 21)
00:1f.4 SMBus: Intel Corporation Sunrise Point-LP SMBus (rev 21) 00:1f.6 Ethernet controller: Intel Corporation Ethernet Connection (4) I219-LM (rev
21)
01:00.0 PCI bridge: Intel Corporation JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016] (rev ff)
02:00.0 PCI bridge: Intel Corporation JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016] (rev ff)
02:01.0 PCI bridge: Intel Corporation JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016] (rev ff)
02:02.0 PCI bridge: Intel Corporation JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016] (rev ff)
3a:00.0 Network controller: Intel Corporation Wireless 8265 / 8275 (rev 78) 3c:00.0 Non-Volatile memory controller: Toshiba America Info Systems Device 0115 (rev 01)

--- >8 ---
Ops:

[   69.886978] thunderbolt 0000:03:00.0: current switch config:
[   69.886983] thunderbolt 0000:03:00.0:  Switch: 8086:15c0 (Revision: 1, TB
Version: 2)
[   69.886986] thunderbolt 0000:03:00.0:   Max Port Number: 5
[   69.886987] thunderbolt 0000:03:00.0:   Config:
[   69.886991] thunderbolt 0000:03:00.0:    Upstream Port Number: 3 Depth: 0
Route String: 0x0 Enabled: 1, PlugEventsDelay: 254ms
[   69.886994] thunderbolt 0000:03:00.0:    unknown1: 0x0 unknown4: 0x0
[   69.920748] BUG: unable to handle kernel NULL pointer dereference at
00000000000002ec
[   69.920834] IP: tb_drom_read+0x383/0x890 [thunderbolt]
[   69.920873] PGD 0
[   69.920874] P4D 0
[   69.920925] Oops: 0000 [#1] SMP
[   69.920952] Modules linked in: thunderbolt(+) fuse rfcomm ccm xt_CHECKSUM

ipt_MASQUERADE nf_nat_masquerade_ipv4 tun nf_conntrack_netbios_ns nf_conntrack_broadcast xt_CT ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute bridge stp llc ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack libcrc32c iptable_mangle iptable_raw iptable_security ebtable_filter ebtables ip6table_filter ip6_tables cmac bnep sunrpc arc4 wmi_bmof iTCO_wdt iwlmvm iTCO_vendor_support snd_soc_skl mei_wdt snd_soc_skl_ipc snd_soc_sst_ipc snd_soc_sst_dsp snd_hda_ext_core tpm_crb snd_soc_sst_match intel_rapl x86_pkg_temp_thermal intel_powerclamp mac80211 coretemp

[   69.921479]  kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel

snd_hda_codec_hdmi intel_cstate intel_uncore intel_rapl_perf snd_soc_core iwlwifi snd_hda_codec_realtek snd_hda_codec_generic snd_compress snd_pcm_dmaengine ac97_bus snd_hda_intel snd_hda_codec snd_hda_core cfg80211 snd_hwdep snd_seq pcspkr uvcvideo hci_uart joydev snd_seq_device snd_pcm videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_core btusb videodev btrtl btbcm snd_timer i2c_i801 btqca btintel media bluetooth qcserial mei_me usb_wwan mei shpchp thinkpad_acpi intel_pch_thermal snd wmi tpm_tis soundcore tpm_tis_core pinctrl_sunrisepoint intel_lpss_acpi tpm ecdh_generic intel_lpss pinctrl_intel rfkill acpi_pad cdc_mbim cdc_wdm cdc_ncm usbnet mii uas usb_storage i915 i2c_algo_bit drm_kms_helper drm e1000e crc32c_intel

[   69.922013]  ptp serio_raw nvme nvme_core pps_core video i2c_hid
[   69.922062] CPU: 3 PID: 12248 Comm: systemd-udevd Not tainted 4.13.0-rc1-
next-20170719 #1
[   69.922116] Hardware name: LENOVO 20HF000YGE/20HF000YGE, BIOS
N1WET32W (1.11 ) 05/23/2017
[   69.922170] task: ffff8a293e4bcd80 task.stack: ffffa698027a8000
[   69.922218] RIP: 0010:tb_drom_read+0x383/0x890 [thunderbolt]
[   69.922256] RSP: 0018:ffffa698027ab990 EFLAGS: 00010246
[   69.922292] RAX: 0000000000000000 RBX: ffff8a2940af7800 RCX:
0000000000000000
[   69.922339] RDX: ffff8a2940ebb400 RSI: 0000000000000000 RDI:
ffffa698027ab9a0
[   69.922385] RBP: ffffa698027ab9d0 R08: 0000000000000001 R09:
0000000000000002
[   69.922432] R10: ffff8a2940ebb5b0 R11: 0000000000000000 R12:
ffff8a293bfa968c
[   69.922478] R13: 000000000000002c R14: 0000000000000056 R15:
0000000000000056
[   69.922526] FS:  00007f0a945a38c0(0000) GS:ffff8a2961580000(0000)
knlGS:0000000000000000
[   69.922579] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   69.922617] CR2: 00000000000002ec CR3: 000000043e785000 CR4:
00000000003606e0
[   69.922665] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[   69.922712] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400
[   69.922760] Call Trace:
[   69.922789]  tb_switch_add+0x9d/0x730 [thunderbolt]
[   69.922846]  ? tb_switch_alloc+0x3cd/0x4d0 [thunderbolt]
[   69.922893]  icm_start+0x5a/0xa0 [thunderbolt]
[   69.922934]  tb_domain_add+0xc3/0xf0 [thunderbolt]
[   69.922976]  nhi_probe+0x19e/0x310 [thunderbolt]
[   69.923017]  local_pci_probe+0x42/0xa0
[   69.923048]  pci_device_probe+0x18d/0x1a0
[   69.923082]  driver_probe_device+0x2ff/0x450
[   69.923116]  __driver_attach+0xa4/0xe0
[   69.923146]  ? driver_probe_device+0x450/0x450
[   69.923184]  bus_for_each_dev+0x6e/0xb0
[   69.923215]  driver_attach+0x1e/0x20
[   69.923246]  bus_add_driver+0x1d0/0x270
[   69.923277]  ? 0xffffffffc0bbb000
[   69.923304]  driver_register+0x60/0xe0
[   69.923334]  ? 0xffffffffc0bbb000
[   69.923372]  __pci_register_driver+0x4c/0x50
[   69.923411]  nhi_init+0x28/0x1000 [thunderbolt]
[   69.923449]  do_one_initcall+0x50/0x190
[   69.923481]  ? __vunmap+0x81/0xb0
[   69.923511]  ? _cond_resched+0x1a/0x50
[   69.923544]  ? kmem_cache_alloc_trace+0x15f/0x1c0
[   69.923581]  ? do_init_module+0x27/0x1e9
[   69.923613]  do_init_module+0x5f/0x1e9
[   69.923643]  load_module+0x24e7/0x2a60
[   69.923677]  ? vfs_read+0x115/0x130
[   69.923707]  SYSC_finit_module+0xfc/0x120
[   69.923738]  ? SYSC_finit_module+0xfc/0x120
[   69.923773]  SyS_finit_module+0xe/0x10
[   69.923805]  do_syscall_64+0x67/0x170
[   69.923850]  entry_SYSCALL64_slow_path+0x25/0x25
[   69.923882] RIP: 0033:0x7f0a93214529
[   69.923908] RSP: 002b:00007fffddc70308 EFLAGS: 00000246 ORIG_RAX:
0000000000000139
[   69.923959] RAX: ffffffffffffffda RBX: 000000c52e0e6450 RCX:
00007f0a93214529
[   69.924005] RDX: 0000000000000000 RSI: 00007f0a93d509c5 RDI:
0000000000000007
[   69.924052] RBP: 00007f0a93d509c5 R08: 0000000000000000 R09:
00007fffddc70420
[   69.926454] R10: 0000000000000007 R11: 0000000000000246 R12:
0000000000000000
[   69.928766] R13: 000000c52e0e5590 R14: 0000000000020000 R15:
000000c52df83f4a
[   69.931055] Code: 8d 0c c9 83 e0 01 84 c0 4c 8d 14 ca 41 88 42 35 75 85 49 8b 42
20 41 0f b6 4a 34 41 b9 02 00 00 00 41 b8 01 00 00 00 4c 89 55 c0 <8b> 90 ec 02 00
00 8b b0 e8 02 00 00 48 8b 80 08 03 00 00 81 e2
[   69.933380] RIP: tb_drom_read+0x383/0x890 [thunderbolt] RSP:
ffffa698027ab990
[   69.935708] CR2: 00000000000002ec
[   69.950221] ---[ end trace a3f247a8fe7705ab ]---

--- 8< ---

--
Dr. Christian J. Kellner
Red Hat Desktop Hardware Enablement
[email protected]

#33 lore raw

Hi,

Quoted 2 lines

Did you by chance boot with the dock "plugged in"? Or was this the result of plugging in after boot?

Dock was plugged in after boot. I included another dmesg output, where I marked the time point that I plugged the device in.

Quoted 3 lines

There is a known issue that Mika is tracking regarding some problems with Thunderbolt devices plugged in at boot. It causes a few things to explode down the line too (which I suspect is what happened).

Good to know.

Cheers,
Christian

--- 8< ---

[...]

[   13.302868] IPv6: ADDRCONF(NETDEV_CHANGE): wlp58s0: link becomes ready
[   13.401493] wlp58s0: Limiting TX power to 23 (23 - 0) dBm as advertised by 6c:70:9f:e6:d0:0b
[   15.033372] Bluetooth: RFCOMM TTY layer initialized
[   15.033377] Bluetooth: RFCOMM socket layer initialized
[   15.033421] Bluetooth: RFCOMM ver 1.11
[   15.576238] fuse init (API version 7.26)
[   16.206665] rfkill: input handler disabled
--- DEVICE PLUGGED IN HERE ---
[   53.696945] thinkpad_acpi: EC reports that Thermal Table has changed
[   68.432897] thinkpad_acpi: EC reports that Thermal Table has changed
[   68.559713] pci 0000:01:00.0: [8086:15c0] type 01 class 0x060400
[   68.559829] pci 0000:01:00.0: supports D1 D2
[   68.559830] pci 0000:01:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[   68.560001] pci 0000:02:00.0: [8086:15c0] type 01 class 0x060400
[   68.560118] pci 0000:02:00.0: supports D1 D2
[   68.560119] pci 0000:02:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[   68.560195] pci 0000:02:01.0: [8086:15c0] type 01 class 0x060400
[   68.560311] pci 0000:02:01.0: supports D1 D2
[   68.560312] pci 0000:02:01.0: PME# supported from D0 D1 D2 D3hot D3cold
[   68.560388] pci 0000:02:02.0: [8086:15c0] type 01 class 0x060400
[   68.560505] pci 0000:02:02.0: supports D1 D2
[   68.560505] pci 0000:02:02.0: PME# supported from D0 D1 D2 D3hot D3cold
[   68.560605] pci 0000:01:00.0: PCI bridge to [bus 02-39]
[   68.560613] pci 0000:01:00.0:   bridge window [mem 0xd4000000-0xea0fffff]
[   68.560618] pci 0000:01:00.0:   bridge window [mem 0xb0000000-0xd1ffffff 64bit pref]
[   68.560674] pci 0000:03:00.0: [8086:15bf] type 00 class 0x088000
[   68.560710] pci 0000:03:00.0: reg 0x10: [mem 0xea000000-0xea03ffff]
[   68.560721] pci 0000:03:00.0: reg 0x14: [mem 0xea040000-0xea040fff]
[   68.560859] pci 0000:03:00.0: supports D1 D2
[   68.560859] pci 0000:03:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[   68.560980] pci 0000:02:00.0: PCI bridge to [bus 03]
[   68.560988] pci 0000:02:00.0:   bridge window [mem 0xea000000-0xea0fffff]
[   68.561059] pci 0000:04:00.0: [8086:1578] type 01 class 0x060400
[   68.561305] pci 0000:04:00.0: supports D1 D2
[   68.561306] pci 0000:04:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[   68.563738] pci 0000:02:01.0: PCI bridge to [bus 04-38]
[   68.563747] pci 0000:02:01.0:   bridge window [mem 0xd4000000-0xe9efffff]
[   68.563752] pci 0000:02:01.0:   bridge window [mem 0xb0000000-0xd1ffffff 64bit pref]
[   68.563861] pci 0000:05:01.0: [8086:1578] type 01 class 0x060400
[   68.564105] pci 0000:05:01.0: supports D1 D2
[   68.564106] pci 0000:05:01.0: PME# supported from D0 D1 D2 D3hot D3cold
[   68.564263] pci 0000:05:04.0: [8086:1578] type 01 class 0x060400
[   68.564511] pci 0000:05:04.0: supports D1 D2
[   68.564512] pci 0000:05:04.0: PME# supported from D0 D1 D2 D3hot D3cold
[   68.564668] pci 0000:04:00.0: PCI bridge to [bus 05-38]
[   68.564682] pci 0000:04:00.0:   bridge window [mem 0xd4000000-0xe9efffff]
[   68.564701] pci 0000:04:00.0:   bridge window [mem 0xb0000000-0xd1ffffff 64bit pref]
[   68.564769] pci 0000:05:01.0: PCI bridge to [bus 06]
[   68.564862] pci 0000:05:04.0: PCI bridge to [bus 07-38]
[   68.564877] pci 0000:05:04.0:   bridge window [mem 0xd4000000-0xe9efffff]
[   68.564886] pci 0000:05:04.0:   bridge window [mem 0xb0000000-0xd1ffffff 64bit pref]
[   68.564979] pci 0000:02:02.0: PCI bridge to [bus 39]
[   68.564986] pci 0000:02:02.0:   bridge window [mem 0xe9f00000-0xe9ffffff]
[   68.565011] pci_bus 0000:02: Allocating resources
[   68.565072] pci 0000:05:04.0: bridge window [io  0x1000-0x0fff] to [bus 07-38] add_size 1000
[   68.565087] pci 0000:04:00.0: bridge window [io  0x1000-0x0fff] to [bus 05-38] add_size 1000
[   68.565094] pci 0000:02:01.0: bridge window [io  0x1000-0x0fff] to [bus 04-38] add_size 1000
[   68.565101] pci 0000:02:02.0: bridge window [io  0x1000-0x0fff] to [bus 39] add_size 1000
[   68.565104] pci 0000:02:02.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 39] add_size 200000 add_align 100000
[   68.565112] pci 0000:01:00.0: bridge window [io  0x1000-0x0fff] to [bus 02-39] add_size 2000
[   68.565114] pci 0000:01:00.0: BAR 13: no space for [io  size 0x2000]
[   68.565115] pci 0000:01:00.0: BAR 13: failed to assign [io  size 0x2000]
[   68.565116] pci 0000:01:00.0: BAR 13: no space for [io  size 0x2000]
[   68.565116] pci 0000:01:00.0: BAR 13: failed to assign [io  size 0x2000]
[   68.565119] pci 0000:02:02.0: BAR 15: no space for [mem size 0x00200000 64bit pref]
[   68.565120] pci 0000:02:02.0: BAR 15: failed to assign [mem size 0x00200000 64bit pref]
[   68.565120] pci 0000:02:01.0: BAR 13: no space for [io  size 0x1000]
[   68.565121] pci 0000:02:01.0: BAR 13: failed to assign [io  size 0x1000]
[   68.565122] pci 0000:02:02.0: BAR 13: no space for [io  size 0x1000]
[   68.565122] pci 0000:02:02.0: BAR 13: failed to assign [io  size 0x1000]
[   68.565124] pci 0000:02:02.0: BAR 15: no space for [mem size 0x00200000 64bit pref]
[   68.565125] pci 0000:02:02.0: BAR 15: failed to assign [mem size 0x00200000 64bit pref]
[   68.565125] pci 0000:02:02.0: BAR 13: no space for [io  size 0x1000]
[   68.565126] pci 0000:02:02.0: BAR 13: failed to assign [io  size 0x1000]
[   68.565127] pci 0000:02:01.0: BAR 13: no space for [io  size 0x1000]
[   68.565128] pci 0000:02:01.0: BAR 13: failed to assign [io  size 0x1000]
[   68.565129] pci 0000:02:00.0: PCI bridge to [bus 03]
[   68.565133] pci 0000:02:00.0:   bridge window [mem 0xea000000-0xea0fffff]
[   68.565140] pci 0000:04:00.0: BAR 13: no space for [io  size 0x1000]
[   68.565141] pci 0000:04:00.0: BAR 13: failed to assign [io  size 0x1000]
[   68.565142] pci 0000:04:00.0: BAR 13: no space for [io  size 0x1000]
[   68.565143] pci 0000:04:00.0: BAR 13: failed to assign [io  size 0x1000]
[   68.565143] pci 0000:05:04.0: BAR 13: no space for [io  size 0x1000]
[   68.565144] pci 0000:05:04.0: BAR 13: failed to assign [io  size 0x1000]
[   68.565145] pci 0000:05:04.0: BAR 13: no space for [io  size 0x1000]
[   68.565145] pci 0000:05:04.0: BAR 13: failed to assign [io  size 0x1000]
[   68.565146] pci 0000:05:01.0: PCI bridge to [bus 06]
[   68.565168] pci 0000:05:04.0: PCI bridge to [bus 07-38]
[   68.565176] pci 0000:05:04.0:   bridge window [mem 0xd4000000-0xe9efffff]
[   68.565182] pci 0000:05:04.0:   bridge window [mem 0xb0000000-0xd1ffffff 64bit pref]
[   68.565192] pci 0000:04:00.0: PCI bridge to [bus 05-38]
[   68.565201] pci 0000:04:00.0:   bridge window [mem 0xd4000000-0xe9efffff]
[   68.565206] pci 0000:04:00.0:   bridge window [mem 0xb0000000-0xd1ffffff 64bit pref]
[   68.565216] pci 0000:02:01.0: PCI bridge to [bus 04-38]
[   68.565220] pci 0000:02:01.0:   bridge window [mem 0xd4000000-0xe9efffff]
[   68.565223] pci 0000:02:01.0:   bridge window [mem 0xb0000000-0xd1ffffff 64bit pref]
[   68.565228] pci 0000:02:02.0: PCI bridge to [bus 39]
[   68.565232] pci 0000:02:02.0:   bridge window [mem 0xe9f00000-0xe9ffffff]
[   68.565239] pci 0000:01:00.0: PCI bridge to [bus 02-39]
[   68.565244] pci 0000:01:00.0:   bridge window [mem 0xd4000000-0xea0fffff]
[   68.565246] pci 0000:01:00.0:   bridge window [mem 0xb0000000-0xd1ffffff 64bit pref]
[   68.584816] thunderbolt 0000:03:00.0: NHI initialized, starting thunderbolt
[   68.584817] thunderbolt 0000:03:00.0: allocating TX ring 0 of size 10
[   68.584826] thunderbolt 0000:03:00.0: allocating RX ring 0 of size 10
[   68.584832] thunderbolt 0000:03:00.0: control channel created
[   68.584832] thunderbolt 0000:03:00.0: control channel starting...
[   68.584833] thunderbolt 0000:03:00.0: starting TX ring 0
[   68.584838] thunderbolt 0000:03:00.0: enabling interrupt at register 0x38200 bit 0 (0x0 -> 0x1)
[   68.584839] thunderbolt 0000:03:00.0: starting RX ring 0
[   68.584845] thunderbolt 0000:03:00.0: enabling interrupt at register 0x38200 bit 12 (0x1 -> 0x1001)
[   73.790039] pci 0000:07:00.0: [8086:1578] type 01 class 0x060400
[   73.790413] pci 0000:07:00.0: supports D1 D2
[   73.790414] pci 0000:07:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[   73.790876] pci 0000:08:01.0: [8086:1578] type 01 class 0x060400
[   73.791260] pci 0000:08:01.0: supports D1 D2
[   73.791261] pci 0000:08:01.0: PME# supported from D0 D1 D2 D3hot D3cold
[   73.791463] pci 0000:08:04.0: [8086:1578] type 01 class 0x060400
[   73.791844] pci 0000:08:04.0: supports D1 D2
[   73.791845] pci 0000:08:04.0: PME# supported from D0 D1 D2 D3hot D3cold
[   73.792091] pci 0000:07:00.0: PCI bridge to [bus 08-38]
[   73.792115] pci 0000:07:00.0:   bridge window [mem 0xd4000000-0xe9efffff]
[   73.792130] pci 0000:07:00.0:   bridge window [mem 0xb0000000-0xd1ffffff 64bit pref]
[   73.792290] pci 0000:09:00.0: [1b21:1142] type 00 class 0x0c0330
[   73.792390] pci 0000:09:00.0: reg 0x10: [mem 0xd4000000-0xd4007fff 64bit]
[   73.792778] pci 0000:09:00.0: PME# supported from D3cold
[   73.793096] pci 0000:08:01.0: PCI bridge to [bus 09]
[   73.793119] pci 0000:08:01.0:   bridge window [mem 0xd4000000-0xd40fffff]
[   73.793251] pci 0000:08:04.0: PCI bridge to [bus 0a-38]
[   73.793274] pci 0000:08:04.0:   bridge window [mem 0xd4100000-0xe9efffff]
[   73.793290] pci 0000:08:04.0:   bridge window [mem 0xb0000000-0xd1ffffff 64bit pref]
[   73.793408] pci_bus 0000:02: Allocating resources
[   73.793533] pci 0000:08:04.0: bridge window [io  0x1000-0x0fff] to [bus 0a-38] add_size 1000
[   73.793557] pci 0000:07:00.0: bridge window [io  0x1000-0x0fff] to [bus 08-38] add_size 1000
[   73.793572] pcieport 0000:05:04.0: bridge window [io  0x1000-0x0fff] to [bus 07-38] add_size 1000
[   73.793588] pcieport 0000:04:00.0: bridge window [io  0x1000-0x0fff] to [bus 05-38] add_size 1000
[   73.793596] pcieport 0000:02:01.0: bridge window [io  0x1000-0x0fff] to [bus 04-38] add_size 1000
[   73.793604] pcieport 0000:02:02.0: bridge window [io  0x1000-0x0fff] to [bus 39] add_size 1000
[   73.793606] pcieport 0000:02:02.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 39] add_size 200000 add_align 100000
[   73.793613] pcieport 0000:01:00.0: bridge window [io  0x1000-0x0fff] to [bus 02-39] add_size 2000
[   73.793616] pcieport 0000:01:00.0: BAR 13: no space for [io  size 0x2000]
[   73.793617] pcieport 0000:01:00.0: BAR 13: failed to assign [io  size 0x2000]
[   73.793619] pcieport 0000:01:00.0: BAR 13: no space for [io  size 0x2000]
[   73.793620] pcieport 0000:01:00.0: BAR 13: failed to assign [io  size 0x2000]
[   73.793623] pcieport 0000:02:02.0: BAR 15: no space for [mem size 0x00200000 64bit pref]
[   73.793624] pcieport 0000:02:02.0: BAR 15: failed to assign [mem size 0x00200000 64bit pref]
[   73.793625] pcieport 0000:02:01.0: BAR 13: no space for [io  size 0x1000]
[   73.793626] pcieport 0000:02:01.0: BAR 13: failed to assign [io  size 0x1000]
[   73.793627] pcieport 0000:02:02.0: BAR 13: no space for [io  size 0x1000]
[   73.793628] pcieport 0000:02:02.0: BAR 13: failed to assign [io  size 0x1000]
[   73.793630] pcieport 0000:02:02.0: BAR 15: no space for [mem size 0x00200000 64bit pref]
[   73.793631] pcieport 0000:02:02.0: BAR 15: failed to assign [mem size 0x00200000 64bit pref]
[   73.793632] pcieport 0000:02:02.0: BAR 13: no space for [io  size 0x1000]
[   73.793633] pcieport 0000:02:02.0: BAR 13: failed to assign [io  size 0x1000]
[   73.793633] pcieport 0000:02:01.0: BAR 13: no space for [io  size 0x1000]
[   73.793634] pcieport 0000:02:01.0: BAR 13: failed to assign [io  size 0x1000]
[   73.793636] pcieport 0000:04:00.0: BAR 13: no space for [io  size 0x1000]
[   73.793637] pcieport 0000:04:00.0: BAR 13: failed to assign [io  size 0x1000]
[   73.793638] pcieport 0000:04:00.0: BAR 13: no space for [io  size 0x1000]
[   73.793639] pcieport 0000:04:00.0: BAR 13: failed to assign [io  size 0x1000]
[   73.793640] pcieport 0000:05:04.0: BAR 13: no space for [io  size 0x1000]
[   73.793641] pcieport 0000:05:04.0: BAR 13: failed to assign [io  size 0x1000]
[   73.793642] pcieport 0000:05:04.0: BAR 13: no space for [io  size 0x1000]
[   73.793643] pcieport 0000:05:04.0: BAR 13: failed to assign [io  size 0x1000]
[   73.793644] pci 0000:07:00.0: BAR 13: no space for [io  size 0x1000]
[   73.793645] pci 0000:07:00.0: BAR 13: failed to assign [io  size 0x1000]
[   73.793647] pci 0000:07:00.0: BAR 13: no space for [io  size 0x1000]
[   73.793647] pci 0000:07:00.0: BAR 13: failed to assign [io  size 0x1000]
[   73.793649] pci 0000:08:04.0: BAR 13: no space for [io  size 0x1000]
[   73.793650] pci 0000:08:04.0: BAR 13: failed to assign [io  size 0x1000]
[   73.793651] pci 0000:08:04.0: BAR 13: no space for [io  size 0x1000]
[   73.793652] pci 0000:08:04.0: BAR 13: failed to assign [io  size 0x1000]
[   73.793653] pci 0000:08:01.0: PCI bridge to [bus 09]
[   73.793669] pci 0000:08:01.0:   bridge window [mem 0xd4000000-0xd40fffff]
[   73.793692] pci 0000:08:04.0: PCI bridge to [bus 0a-38]
[   73.793704] pci 0000:08:04.0:   bridge window [mem 0xd4100000-0xe9efffff]
[   73.793713] pci 0000:08:04.0:   bridge window [mem 0xb0000000-0xd1ffffff 64bit pref]
[   73.793728] pci 0000:07:00.0: PCI bridge to [bus 08-38]
[   73.793740] pci 0000:07:00.0:   bridge window [mem 0xd4000000-0xe9efffff]
[   73.793748] pci 0000:07:00.0:   bridge window [mem 0xb0000000-0xd1ffffff 64bit pref]
[   73.796162] xhci_hcd 0000:09:00.0: xHCI Host Controller
[   73.796585] xhci_hcd 0000:09:00.0: new USB bus registered, assigned bus number 3
[   73.862879] xhci_hcd 0000:09:00.0: hcc params 0x0200e081 hci version 0x100 quirks 0x00000410
[   73.863145] usb usb3: New USB device found, idVendor=1d6b, idProduct=0002
[   73.863146] usb usb3: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[   73.863146] usb usb3: Product: xHCI Host Controller
[   73.863147] usb usb3: Manufacturer: Linux 4.13.0-rc1-next-20170719 xhci-hcd
[   73.863148] usb usb3: SerialNumber: 0000:09:00.0
[   73.863427] hub 3-0:1.0: USB hub found
[   73.863440] hub 3-0:1.0: 2 ports detected
[   73.863522] xhci_hcd 0000:09:00.0: xHCI Host Controller
[   73.868230] xhci_hcd 0000:09:00.0: new USB bus registered, assigned bus number 4
[   73.869047] usb usb4: We don't know the algorithms for LPM for this host, disabling LPM.
[   73.869077] usb usb4: New USB device found, idVendor=1d6b, idProduct=0003
[   73.869079] usb usb4: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[   73.869081] usb usb4: Product: xHCI Host Controller
[   73.869081] usb usb4: Manufacturer: Linux 4.13.0-rc1-next-20170719 xhci-hcd
[   73.869082] usb usb4: SerialNumber: 0000:09:00.0
[   73.871464] hub 4-0:1.0: USB hub found
[   73.871527] hub 4-0:1.0: 2 ports detected
[   74.229725] usb 3-1: new high-speed USB device number 2 using xhci_hcd
[   74.423625] usb 3-1: New USB device found, idVendor=0424, idProduct=2137
[   74.423631] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[   74.423635] usb 3-1: Product: USB2137B
[   74.423638] usb 3-1: Manufacturer: SMSC
[   74.443536] hub 3-1:1.0: USB hub found
[   74.443620] hub 3-1:1.0: 7 ports detected
[   74.537017] usb 4-1: new SuperSpeed USB device number 2 using xhci_hcd
[   74.553183] usb 4-1: New USB device found, idVendor=0424, idProduct=5537
[   74.553186] usb 4-1: New USB device strings: Mfr=2, Product=3, SerialNumber=0
[   74.553188] usb 4-1: Product: USB5537B
[   74.553189] usb 4-1: Manufacturer: SMSC
[   74.573098] hub 4-1:1.0: USB hub found
[   74.573700] hub 4-1:1.0: 7 ports detected
[   74.765719] usb 3-1.5: new high-speed USB device number 3 using xhci_hcd
[   74.948261] usb 3-1.5: New USB device found, idVendor=0bda, idProduct=4014
[   74.948266] usb 3-1.5: New USB device strings: Mfr=3, Product=1, SerialNumber=2
[   74.948269] usb 3-1.5: Product: USB Audio
[   74.948272] usb 3-1.5: Manufacturer: Generic
[   74.948274] usb 3-1.5: SerialNumber: 200901010001
[   75.014095] usb 4-1.2: new SuperSpeed USB device number 3 using xhci_hcd
[   75.031783] usb 4-1.2: New USB device found, idVendor=0bda, idProduct=8153
[   75.031784] usb 4-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=6
[   75.031785] usb 4-1.2: Product: USB 10/100/1000 LAN
[   75.031785] usb 4-1.2: Manufacturer: Realtek
[   75.031786] usb 4-1.2: SerialNumber: 000001000000
[   75.782301] usbcore: registered new interface driver r8152
[   75.798094] usbcore: registered new interface driver cdc_ether
[   76.102592] usb 4-1.2: reset SuperSpeed USB device number 3 using xhci_hcd
[   76.116181] thunderbolt 0000:03:00.0: current switch config:
[   76.116187] thunderbolt 0000:03:00.0:  Switch: 8086:15c0 (Revision: 1, TB Version: 2)
[   76.116190] thunderbolt 0000:03:00.0:   Max Port Number: 5
[   76.116191] thunderbolt 0000:03:00.0:   Config:
[   76.116196] thunderbolt 0000:03:00.0:    Upstream Port Number: 3 Depth: 0 Route String: 0x0 Enabled: 1, PlugEventsDelay: 254ms
[   76.116198] thunderbolt 0000:03:00.0:    unknown1: 0x0 unknown4: 0x0
[   76.134639] BUG: unable to handle kernel NULL pointer dereference at 00000000000002ec
[   76.134743] IP: tb_drom_read+0x383/0x890 [thunderbolt]
[   76.134788] PGD 0
[   76.134789] P4D 0
[   76.134845] Oops: 0000 [#1] SMP
[   76.134873] Modules linked in: cdc_ether r8152 snd_usb_audio(+) snd_usbmidi_lib snd_rawmidi thunderbolt(+) fuse rfcomm ccm xt_CHECKSUM ipt_MASQUERADE nf_nat_masquerade_ipv4 tun nf_conntrack_netbios_ns nf_conntrack_broadcast xt_CT ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute bridge stp llc ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack libcrc32c iptable_mangle iptable_raw iptable_security ebtable_filter ebtables ip6table_filter ip6_tables cmac bnep sunrpc arc4 iwlmvm snd_soc_skl intel_rapl x86_pkg_temp_thermal intel_powerclamp snd_soc_skl_ipc mac80211 snd_soc_sst_ipc snd_soc_sst_dsp coretemp snd_hda_ext_core wmi_bmof
[   76.135458]  iTCO_wdt iTCO_vendor_support mei_wdt snd_hda_codec_hdmi kvm tpm_crb snd_soc_sst_match irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hda_codec_realtek intel_cstate snd_hda_codec_generic intel_uncore iwlwifi intel_rapl_perf snd_soc_core snd_compress snd_pcm_dmaengine ac97_bus snd_hda_intel snd_hda_codec snd_hda_core cfg80211 snd_hwdep snd_seq joydev uvcvideo pcspkr snd_seq_device snd_pcm hci_uart videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_core videodev btusb i2c_i801 snd_timer btrtl btqca btbcm btintel thinkpad_acpi mei_me qcserial bluetooth media usb_wwan mei shpchp intel_pch_thermal snd wmi soundcore ecdh_generic tpm_tis pinctrl_sunrisepoint tpm_tis_core rfkill pinctrl_intel intel_lpss_acpi intel_lpss tpm acpi_pad cdc_mbim cdc_wdm cdc_ncm usbnet mii
[   76.136045]  uas usb_storage i915 i2c_algo_bit drm_kms_helper drm e1000e crc32c_intel nvme ptp serio_raw pps_core nvme_core video i2c_hid
[   76.136160] CPU: 0 PID: 5044 Comm: systemd-udevd Not tainted 4.13.0-rc1-next-20170719 #1
[   76.136225] Hardware name: LENOVO 20HF000YGE/20HF000YGE, BIOS N1WET32W (1.11 ) 05/23/2017
[   76.136290] task: ffff8da48433cd80 task.stack: ffffb64f48104000
[   76.136361] RIP: 0010:tb_drom_read+0x383/0x890 [thunderbolt]
[   76.136404] RSP: 0018:ffffb64f48107990 EFLAGS: 00010246
[   76.136444] RAX: 0000000000000000 RBX: ffff8da3f390d400 RCX: 0000000000000000
[   76.136495] RDX: ffff8da4849d2600 RSI: 0000000000000000 RDI: ffffb64f481079a0
[   76.136546] RBP: ffffb64f481079d0 R08: 0000000000000001 R09: 0000000000000002
[   76.136597] R10: ffff8da4849d27b0 R11: 0000000000000000 R12: ffff8da48c444ecc
[   76.136648] R13: 000000000000002c R14: 0000000000000056 R15: 0000000000000056
[   76.136700] FS:  00007f6155a4d8c0(0000) GS:ffff8da4a1400000(0000) knlGS:0000000000000000
[   76.136758] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   76.136800] CR2: 00000000000002ec CR3: 000000044dddf000 CR4: 00000000003606f0
[   76.136852] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   76.136904] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   76.136956] Call Trace:
[   76.136988]  tb_switch_add+0x9d/0x730 [thunderbolt]
[   76.137031]  ? tb_switch_alloc+0x3cd/0x4d0 [thunderbolt]
[   76.137078]  icm_start+0x5a/0xa0 [thunderbolt]
[   76.137118]  tb_domain_add+0xc3/0xf0 [thunderbolt]
[   76.137161]  nhi_probe+0x19e/0x310 [thunderbolt]
[   76.137202]  local_pci_probe+0x42/0xa0
[   76.137233]  pci_device_probe+0x18d/0x1a0
[   76.137268]  driver_probe_device+0x2ff/0x450
[   76.137302]  __driver_attach+0xa4/0xe0
[   76.137333]  ? driver_probe_device+0x450/0x450
[   76.137369]  bus_for_each_dev+0x6e/0xb0
[   76.137400]  driver_attach+0x1e/0x20
[   76.137431]  bus_add_driver+0x1d0/0x270
[   76.137461]  ? 0xffffffffc0c1c000
[   76.137496]  driver_register+0x60/0xe0
[   76.137540]  ? 0xffffffffc0c1c000
[   76.137584]  __pci_register_driver+0x4c/0x50
[   76.137638]  nhi_init+0x28/0x1000 [thunderbolt]
[   76.137677]  do_one_initcall+0x50/0x190
[   76.137709]  ? __vunmap+0x81/0xb0
[   76.137739]  ? _cond_resched+0x1a/0x50
[   76.137772]  ? kmem_cache_alloc_trace+0x15f/0x1c0
[   76.137810]  ? do_init_module+0x27/0x1e9
[   76.137841]  do_init_module+0x5f/0x1e9
[   76.137872]  load_module+0x24e7/0x2a60
[   76.137906]  ? vfs_read+0x115/0x130
[   76.137937]  SYSC_finit_module+0xfc/0x120
[   76.137968]  ? SYSC_finit_module+0xfc/0x120
[   76.138003]  SyS_finit_module+0xe/0x10
[   76.138047]  do_syscall_64+0x67/0x170
[   76.138078]  entry_SYSCALL64_slow_path+0x25/0x25
[   76.138113] RIP: 0033:0x7f61546be529
[   76.138142] RSP: 002b:00007ffe4ec72f28 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[   76.138197] RAX: ffffffffffffffda RBX: 00000092f6a08b60 RCX: 00007f61546be529
[   76.138249] RDX: 0000000000000000 RSI: 00007f61551fa9c5 RDI: 0000000000000007
[   76.138300] RBP: 00007f61551fa9c5 R08: 0000000000000000 R09: 00007ffe4ec73040
[   76.140994] R10: 0000000000000007 R11: 0000000000000246 R12: 0000000000000000
[   76.143583] R13: 00000092f6a04580 R14: 0000000000020000 R15: 00000092f4e60f4a
[   76.146145] Code: 8d 0c c9 83 e0 01 84 c0 4c 8d 14 ca 41 88 42 35 75 85 49 8b 42 20 41 0f b6 4a 34 41 b9 02 00 00 00 41 b8 01 00 00 00 4c 89 55 c0 <8b> 90 ec 02 00 00 8b b0 e8 02 00 00 48 8b 80 08 03 00 00 81 e2
[   76.148716] RIP: tb_drom_read+0x383/0x890 [thunderbolt] RSP: ffffb64f48107990
[   76.151254] CR2: 00000000000002ec
[   76.166697] usbcore: registered new interface driver snd-usb-audio
[   76.167182] ---[ end trace 8d5cd480d046bff9 ]---
[   76.215165] r8152 4-1.2:1.0 eth0: v1.09.9
[   76.358446] r8152 4-1.2:1.0 enp9s0u1u2: renamed from eth0
[   76.390687] IPv6: ADDRCONF(NETDEV_UP): enp9s0u1u2: link is not ready
[   76.412379] IPv6: ADDRCONF(NETDEV_UP): enp9s0u1u2: link is not ready
[   79.762371] r8152 4-1.2:1.0 enp9s0u1u2: carrier on
[   79.762409] IPv6: ADDRCONF(NETDEV_CHANGE): enp9s0u1u2: link becomes ready
#34 lore raw
In reply to Christian Kellner

Hi,

Quoted 45 lines · Christian Kellner

Hi!

Quoted 2 lines

This is fourth version of the patch series adding support for Thunderbolt security levels and NVM firmware upgrade.

While prototyping the user-space bits for GNOME, I stumbled upon an oops on the Lenovo T470s (see below) when attaching a Dell TB16 thunderbolt 3 dock. As a result /sys/bus/thunderbolt/devices has only domain0 in it but not the dock itself. Everything works fine on a Dell XPS 13 9630. The oops happens with linux-next and when I backport the patches to 4.11.11.
Happy to provide any more information and test future patches.

Cheers,
Christian

--- 8< ---
lspci output:

pcilib: Cannot open /sys/bus/pci/devices/0000:03:00.0/config
lspci: Unable to read the standard configuration space header of device 0000:03:00.0
00:00.0 Host bridge: Intel Corporation Device 5904 (rev 02)
00:02.0 VGA compatible controller: Intel Corporation Device 5916 (rev 02)
00:14.0 USB controller: Intel Corporation Sunrise Point-LP USB 3.0 xHCI Controller (rev 21) 00:14.2 Signal processing controller: Intel Corporation Sunrise Point-LP Thermal subsystem (rev 21) 00:16.0 Communication controller: Intel Corporation Sunrise Point-LP CSME HECI #1 (rev 21) 00:16.3 Serial controller: Intel Corporation Device 9d3d (rev 21)
00:1c.0 PCI bridge: Intel Corporation Device 9d10 (rev f1)
00:1c.2 PCI bridge: Intel Corporation Device 9d12 (rev f1)
00:1d.0 PCI bridge: Intel Corporation Sunrise Point-LP PCI Express Root Port #9 (rev f1) 00:1f.0 ISA bridge: Intel Corporation Device 9d4e (rev 21)
00:1f.2 Memory controller: Intel Corporation Sunrise Point-LP PMC (rev 21)
00:1f.3 Audio device: Intel Corporation Device 9d71 (rev 21)
00:1f.4 SMBus: Intel Corporation Sunrise Point-LP SMBus (rev 21)
00:1f.6 Ethernet controller: Intel Corporation Ethernet Connection (4) I219-LM (rev 21) 01:00.0 PCI bridge: Intel Corporation JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016] (rev ff) 02:00.0 PCI bridge: Intel Corporation JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016] (rev ff) 02:01.0 PCI bridge: Intel Corporation JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016] (rev ff) 02:02.0 PCI bridge: Intel Corporation JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016] (rev ff) 3a:00.0 Network controller: Intel Corporation Wireless 8265 / 8275 (rev 78)
3c:00.0 Non-Volatile memory controller: Toshiba America Info Systems Device 0115 (rev 01)

--- >8 ---
Ops:

Quoted 8 lines
[   69.886978] thunderbolt 0000:03:00.0: current switch config:
[   69.886983] thunderbolt 0000:03:00.0:  Switch: 8086:15c0 (Revision: 1, TB Version: 2)
[   69.886986] thunderbolt 0000:03:00.0:   Max Port Number: 5
[   69.886987] thunderbolt 0000:03:00.0:   Config:
[   69.886991] thunderbolt 0000:03:00.0:    Upstream Port Number: 3 Depth: 0 Route String: 0x0 Enabled: 1, PlugEventsDelay: 254ms
[   69.886994] thunderbolt 0000:03:00.0:    unknown1: 0x0 unknown4: 0x0
[   69.920748] BUG: unable to handle kernel NULL pointer dereference at 00000000000002ec
[   69.920834] IP: tb_drom_read+0x383/0x890 [thunderbolt]

I've seen this once on Alpine Ridge LP (which you have here) where the DROM contents of the older NVM image listed too many ports. Can you try if the below patch helps?

drivers/thunderbolt/eeprom.c +6 -0
index 996c6e2..bdf7f80 100644
@@ -333,6 +333,12 @@ static int tb_drom_parse_entry_port(struct tb_switch *sw,
 	int res;
 	enum tb_port_type type;
 
+	if (header->index > sw->config.max_port_number) {
+		tb_sw_warn(sw, "DROM has too many entries %u (expected %u)\n",
+			   header->index, sw->config.max_port_number);
+		return 0;
+	}
+
 	port = &sw->ports[header->index];
 	port->disabled = header->port_disabled;
 	if (port->disabled)
#35 lore raw

Hi Mika,

Quoted 3 lines

I've seen this once on Alpine Ridge LP (which you have here) where the DROM contents of the older NVM image listed too many ports. Can you try if the below patch helps?

You were right. Patch works fine, and I indeed see the expected warnings in the logs:

[  102.739663] thunderbolt 0000:03:00.0: 0: DROM has too many entries 6 (expected 5)
[  102.739665] thunderbolt 0000:03:00.0: 0: DROM has too many entries 7 (expected 5)
[  102.739667] thunderbolt 0000:03:00.0: 0: DROM has too many entries 8 (expected 5)
[  102.739668] thunderbolt 0000:03:00.0: 0: DROM has too many entries 9 (expected 5)
[  102.739669] thunderbolt 0000:03:00.0: 0: DROM has too many entries 10 (expected 5)
[  102.739670] thunderbolt 0000:03:00.0: 0: DROM has too many entries 11 (expected 5)

Thanks a lot,
Christian

Quoted 17 lines
drivers/thunderbolt/eeprom.c +6 -0
index 996c6e2..bdf7f80 100644
@@ -333,6 +333,12 @@ static int tb_drom_parse_entry_port(struct 
 tb_switch *sw,
 	int res;
 	enum tb_port_type type;
 
+	if (header->index > sw->config.max_port_number) {
+		tb_sw_warn(sw, "DROM has too many entries %u (expected %u)\n",
+			   header->index, sw->config.max_port_number);
+		return 0;
+	}
+
 	port = &sw->ports[header->index];
 	port->disabled = header->port_disabled;
Quoted 1 line

if (port->disabled)

#36 lore raw
Quoted 20 lines · Christian Kellner

Hi Mika,

Quoted 3 lines

I've seen this once on Alpine Ridge LP (which you have here) where the DROM contents of the older NVM image listed too many ports. Can you try if the below patch helps?

You were right. Patch works fine, and I indeed see the expected warnings in the logs:

[  102.739663] thunderbolt 0000:03:00.0: 0: DROM has too many entries 6
(expected 5)
[  102.739665] thunderbolt 0000:03:00.0: 0: DROM has too many entries 7
(expected 5)
[  102.739667] thunderbolt 0000:03:00.0: 0: DROM has too many entries 8
(expected 5)
[  102.739668] thunderbolt 0000:03:00.0: 0: DROM has too many entries 9
(expected 5)
[  102.739669] thunderbolt 0000:03:00.0: 0: DROM has too many entries 10
(expected 5)
[  102.739670] thunderbolt 0000:03:00.0: 0: DROM has too many entries 11
Quoted 1 line

(expected 5)

Thanks for confirming! I will send a proper patch (with slight changes) later today.