kernel.git/drivers/thunderbolt/icm.c, branch linux-5.9.y

thunderbolt: Fix use-after-free in remove_unplugged_switch()

2020-12-11T12:22:08Z

commit 600c0849cf86b75d86352f59745226273290986a upstream. Paulian reported a crash that happens when a dock is unplugged during hibernation: [78436.228217] thunderbolt 0-1: device disconnected [78436.228365] BUG: kernel NULL pointer dereference, address: 00000000000001e0 ... [78436.228397] RIP: 0010:icm_free_unplugged_children+0x109/0x1a0 ... [78436.228432] Call Trace: [78436.228439] icm_rescan_work+0x24/0x30 [78436.228444] process_one_work+0x1a3/0x3a0 [78436.228449] worker_thread+0x30/0x370 [78436.228454] ? process_one_work+0x3a0/0x3a0 [78436.228457] kthread+0x13d/0x160 [78436.228461] ? kthread_park+0x90/0x90 [78436.228465] ret_from_fork+0x1f/0x30 This happens because remove_unplugged_switch() calls tb_switch_remove() that releases the memory pointed by sw so the following lines reference to a memory that might be released already. Fix this by saving pointer to the parent device before calling tb_switch_remove(). Reported-by: Paulian Bogdan Marinca Fixes: 4f7c2e0d8765 ("thunderbolt: Make sure device runtime resume completes before taking domain lock") Cc: stable@vger.kernel.org Signed-off-by: Mika Westerberg Reviewed-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman

thunderbolt: Add support for Intel Tiger Lake

2020-04-23T06:57:59Z

Tiger Lake integrated Thunderbolt/USB4 controller is quite close to Intel Ice Lake. By default it is still using firmware based connection manager so we can use most of the Ice Lake flows in Tiger Lake as well. We check if the firmware connection manager is running and in that case use it, otherwise use the software based connection manager. Signed-off-by: Mika Westerberg Acked-by: Yehezkel Bernat

thunderbolt: icm: Replace zero-length array with flexible-array member

2020-02-14T12:08:49Z

The current codebase makes use of the zero-length array language extension to the C90 standard, but the preferred mechanism to declare variable-length types such as these ones is a flexible array member[1][2], introduced in C99: struct foo { int stuff; struct boo array[]; }; By making use of the mechanism above, we will get a compiler warning in case the flexible array does not occur last in the structure, which will help us prevent some kind of undefined behavior bugs from being inadvertenly introduced[3] to the codebase from now on. This issue was found with the help of Coccinelle. [1] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html [2] https://github.com/KSPP/linux/issues/21 [3] commit 76497732932f ("cxgb3/l2t: Fix undefined behaviour") Signed-off-by: Gustavo A. R. Silva Signed-off-by: Mika Westerberg

thunderbolt: Do not start firmware unless asked by the user

2019-11-02T09:13:31Z

Since now we can do pretty much the same thing in the software connection manager than the firmware would do, there is no point starting it by default. Instead we can just continue using the software connection manager. Make it possible for user to switch between the two by adding a module pararameter (start_icm) which is by default false. Having this ability to enable the firmware may be useful at least when debugging possible issues with the software connection manager implementation. Signed-off-by: Mika Westerberg

thunderbolt: Add support for lane bonding

2019-11-02T09:13:31Z

Lane bonding allows aggregating two 10/20 Gb/s (depending on the generation) lanes into a single 20/40 Gb/s bonded link. This allows sharing the full bandwidth more efficiently. In order to establish lane bonding we need to check that lane bonding is possible through link controller and that both ends of the link actually supports 2x widths. This also means that all the paths should be established through the primary port so update tb_path_alloc() to handle this as well. Lane bonding is supported starting from Falcon Ridge (2nd generation) controllers. We also expose the current speed and number of lanes under each device except the host router following similar attribute naming than USB bus. Expose speed and number of lanes for both directions to allow possibility of asymmetric link in the future. Signed-off-by: Mika Westerberg

thunderbolt: Refactor add_switch() into two functions

2019-11-01T11:32:00Z

Currently add_switch() takes a huge amount of parameters that makes it hard to maintain. Instead of passing all those parameters we can split the function into two parts (alloc and add) and fill the additional switch fields directly in the functions calling those. While there remove redundant error logging in case kmemdup() fails. No functional changes. Signed-off-by: Mika Westerberg

thunderbolt: Add helper macro to iterate over switch ports

2019-11-01T11:32:00Z

There are quite many places in the driver where we iterate over each port in the switch. To make it bit more convenient, add a macro that can be used to iterate over each port and convert existing call sites to use it. This is based on code by Lukas Wunner. No functional changes. Signed-off-by: Mika Westerberg

thunderbolt: Add support for Intel Ice Lake

2019-08-26T09:15:06Z

The Thunderbolt controller is integrated into the Ice Lake CPU itself and requires special flows to power it on and off using force power bit in NHI VSEC registers. Runtime PM (RTD3) and Sx flows also differ from the discrete solutions. Now the firmware notifies the driver whether RTD3 entry or exit are possible. The driver is responsible of sending Go2Sx command through link controller mailbox when system enters Sx states (suspend-to-mem/disk). Rest of the ICM firwmare flows follow Titan Ridge. Signed-off-by: Raanan Avargil Signed-off-by: Mika Westerberg Reviewed-by: Yehezkel Bernat Tested-by: Mario Limonciello

thunderbolt: Move NVM upgrade support flag to struct icm

2019-08-26T09:14:32Z

This is depends on the controller and on the platform/CPU we are running. Move it to struct icm so we can set it per controller. Signed-off-by: Mika Westerberg Reviewed-by: Yehezkel Bernat Tested-by: Mario Limonciello

thunderbolt: Implement CIO reset correctly for Titan Ridge

2019-06-14T11:25:43Z

When starting ICM firmware on Apple systems we need to perform CIO reset as part of the flow. However, it turns out that the reset register has changed to another location in Titan Ridge. Fix this by introducing ->cio_reset() callback with corresponding implementations for Alpine and Titan Ridge. Fixes: c4630d6ae6e3 ("thunderbolt: Start firmware on Titan Ridge Apple systems") Reported-by: Peter Bowen Signed-off-by: Mika Westerberg