]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - drivers/thunderbolt/tb.c
thunderbolt: tb: fix use after free in tb_activate_pcie_devices
[mirror_ubuntu-bionic-kernel.git] / drivers / thunderbolt / tb.c
CommitLineData
d6cc51cd
AN
1/*
2 * Thunderbolt Cactus Ridge driver - bus logic (NHI independent)
3 *
4 * Copyright (c) 2014 Andreas Noever <andreas.noever@gmail.com>
5 */
6
7#include <linux/slab.h>
8#include <linux/errno.h>
9#include <linux/delay.h>
630b3aff 10#include <linux/platform_data/x86/apple.h>
d6cc51cd
AN
11
12#include "tb.h"
7adf6097 13#include "tb_regs.h"
3364f0c1 14#include "tunnel_pci.h"
d6cc51cd 15
9d3cce0b
MW
16/**
17 * struct tb_cm - Simple Thunderbolt connection manager
18 * @tunnel_list: List of active tunnels
19 * @hotplug_active: tb_handle_hotplug will stop progressing plug
20 * events and exit if this is not set (it needs to
21 * acquire the lock one more time). Used to drain wq
22 * after cfg has been paused.
23 */
24struct tb_cm {
25 struct list_head tunnel_list;
26 bool hotplug_active;
27};
9da672a4
AN
28
29/* enumeration & hot plug handling */
30
31
32static void tb_scan_port(struct tb_port *port);
33
34/**
35 * tb_scan_switch() - scan for and initialize downstream switches
36 */
37static void tb_scan_switch(struct tb_switch *sw)
38{
39 int i;
40 for (i = 1; i <= sw->config.max_port_number; i++)
41 tb_scan_port(&sw->ports[i]);
42}
43
44/**
45 * tb_scan_port() - check for and initialize switches below port
46 */
47static void tb_scan_port(struct tb_port *port)
48{
49 struct tb_switch *sw;
50 if (tb_is_upstream_port(port))
51 return;
52 if (port->config.type != TB_TYPE_PORT)
53 return;
343fcb8c
AN
54 if (port->dual_link_port && port->link_nr)
55 return; /*
56 * Downstream switch is reachable through two ports.
57 * Only scan on the primary port (link_nr == 0).
58 */
9da672a4
AN
59 if (tb_wait_for_port(port, false) <= 0)
60 return;
61 if (port->remote) {
62 tb_port_WARN(port, "port already has a remote!\n");
63 return;
64 }
bfe778ac
MW
65 sw = tb_switch_alloc(port->sw->tb, &port->sw->dev,
66 tb_downstream_route(port));
9da672a4
AN
67 if (!sw)
68 return;
bfe778ac
MW
69
70 if (tb_switch_configure(sw)) {
71 tb_switch_put(sw);
72 return;
73 }
74
f67cf491
MW
75 sw->authorized = true;
76
bfe778ac
MW
77 if (tb_switch_add(sw)) {
78 tb_switch_put(sw);
79 return;
80 }
81
9da672a4
AN
82 port->remote = tb_upstream_port(sw);
83 tb_upstream_port(sw)->remote = port;
84 tb_scan_switch(sw);
85}
86
3364f0c1
AN
87/**
88 * tb_free_invalid_tunnels() - destroy tunnels of devices that have gone away
89 */
90static void tb_free_invalid_tunnels(struct tb *tb)
91{
9d3cce0b 92 struct tb_cm *tcm = tb_priv(tb);
3364f0c1
AN
93 struct tb_pci_tunnel *tunnel;
94 struct tb_pci_tunnel *n;
9d3cce0b
MW
95
96 list_for_each_entry_safe(tunnel, n, &tcm->tunnel_list, list) {
3364f0c1
AN
97 if (tb_pci_is_invalid(tunnel)) {
98 tb_pci_deactivate(tunnel);
9d3cce0b 99 list_del(&tunnel->list);
3364f0c1
AN
100 tb_pci_free(tunnel);
101 }
102 }
103}
104
23dd5bb4
AN
105/**
106 * tb_free_unplugged_children() - traverse hierarchy and free unplugged switches
107 */
108static void tb_free_unplugged_children(struct tb_switch *sw)
109{
110 int i;
111 for (i = 1; i <= sw->config.max_port_number; i++) {
112 struct tb_port *port = &sw->ports[i];
113 if (tb_is_upstream_port(port))
114 continue;
115 if (!port->remote)
116 continue;
117 if (port->remote->sw->is_unplugged) {
bfe778ac 118 tb_switch_remove(port->remote->sw);
23dd5bb4
AN
119 port->remote = NULL;
120 } else {
121 tb_free_unplugged_children(port->remote->sw);
122 }
123 }
124}
125
126
3364f0c1
AN
127/**
128 * find_pci_up_port() - return the first PCIe up port on @sw or NULL
129 */
130static struct tb_port *tb_find_pci_up_port(struct tb_switch *sw)
131{
132 int i;
133 for (i = 1; i <= sw->config.max_port_number; i++)
134 if (sw->ports[i].config.type == TB_TYPE_PCIE_UP)
135 return &sw->ports[i];
136 return NULL;
137}
138
139/**
140 * find_unused_down_port() - return the first inactive PCIe down port on @sw
141 */
142static struct tb_port *tb_find_unused_down_port(struct tb_switch *sw)
143{
144 int i;
145 int cap;
146 int res;
147 int data;
148 for (i = 1; i <= sw->config.max_port_number; i++) {
149 if (tb_is_upstream_port(&sw->ports[i]))
150 continue;
151 if (sw->ports[i].config.type != TB_TYPE_PCIE_DOWN)
152 continue;
da2da04b
MW
153 cap = tb_port_find_cap(&sw->ports[i], TB_PORT_CAP_ADAP);
154 if (cap < 0)
3364f0c1
AN
155 continue;
156 res = tb_port_read(&sw->ports[i], &data, TB_CFG_PORT, cap, 1);
157 if (res < 0)
158 continue;
159 if (data & 0x80000000)
160 continue;
161 return &sw->ports[i];
162 }
163 return NULL;
164}
165
166/**
167 * tb_activate_pcie_devices() - scan for and activate PCIe devices
168 *
169 * This method is somewhat ad hoc. For now it only supports one device
170 * per port and only devices at depth 1.
171 */
172static void tb_activate_pcie_devices(struct tb *tb)
173{
174 int i;
175 int cap;
176 u32 data;
177 struct tb_switch *sw;
178 struct tb_port *up_port;
179 struct tb_port *down_port;
180 struct tb_pci_tunnel *tunnel;
9d3cce0b
MW
181 struct tb_cm *tcm = tb_priv(tb);
182
3364f0c1
AN
183 /* scan for pcie devices at depth 1*/
184 for (i = 1; i <= tb->root_switch->config.max_port_number; i++) {
185 if (tb_is_upstream_port(&tb->root_switch->ports[i]))
186 continue;
187 if (tb->root_switch->ports[i].config.type != TB_TYPE_PORT)
188 continue;
189 if (!tb->root_switch->ports[i].remote)
190 continue;
191 sw = tb->root_switch->ports[i].remote->sw;
192 up_port = tb_find_pci_up_port(sw);
193 if (!up_port) {
194 tb_sw_info(sw, "no PCIe devices found, aborting\n");
195 continue;
196 }
197
198 /* check whether port is already activated */
da2da04b
MW
199 cap = tb_port_find_cap(up_port, TB_PORT_CAP_ADAP);
200 if (cap < 0)
3364f0c1
AN
201 continue;
202 if (tb_port_read(up_port, &data, TB_CFG_PORT, cap, 1))
203 continue;
204 if (data & 0x80000000) {
205 tb_port_info(up_port,
206 "PCIe port already activated, aborting\n");
207 continue;
208 }
209
210 down_port = tb_find_unused_down_port(tb->root_switch);
211 if (!down_port) {
212 tb_port_info(up_port,
213 "All PCIe down ports are occupied, aborting\n");
214 continue;
215 }
216 tunnel = tb_pci_alloc(tb, up_port, down_port);
217 if (!tunnel) {
218 tb_port_info(up_port,
219 "PCIe tunnel allocation failed, aborting\n");
220 continue;
221 }
222
223 if (tb_pci_activate(tunnel)) {
224 tb_port_info(up_port,
225 "PCIe tunnel activation failed, aborting\n");
226 tb_pci_free(tunnel);
a2e37343 227 continue;
3364f0c1
AN
228 }
229
9d3cce0b 230 list_add(&tunnel->list, &tcm->tunnel_list);
3364f0c1
AN
231 }
232}
9da672a4 233
d6cc51cd
AN
234/* hotplug handling */
235
236struct tb_hotplug_event {
237 struct work_struct work;
238 struct tb *tb;
239 u64 route;
240 u8 port;
241 bool unplug;
242};
243
244/**
245 * tb_handle_hotplug() - handle hotplug event
246 *
247 * Executes on tb->wq.
248 */
249static void tb_handle_hotplug(struct work_struct *work)
250{
251 struct tb_hotplug_event *ev = container_of(work, typeof(*ev), work);
252 struct tb *tb = ev->tb;
9d3cce0b 253 struct tb_cm *tcm = tb_priv(tb);
053596d9
AN
254 struct tb_switch *sw;
255 struct tb_port *port;
d6cc51cd 256 mutex_lock(&tb->lock);
9d3cce0b 257 if (!tcm->hotplug_active)
d6cc51cd
AN
258 goto out; /* during init, suspend or shutdown */
259
053596d9
AN
260 sw = get_switch_at_route(tb->root_switch, ev->route);
261 if (!sw) {
262 tb_warn(tb,
263 "hotplug event from non existent switch %llx:%x (unplug: %d)\n",
264 ev->route, ev->port, ev->unplug);
265 goto out;
266 }
267 if (ev->port > sw->config.max_port_number) {
268 tb_warn(tb,
269 "hotplug event from non existent port %llx:%x (unplug: %d)\n",
270 ev->route, ev->port, ev->unplug);
271 goto out;
272 }
273 port = &sw->ports[ev->port];
274 if (tb_is_upstream_port(port)) {
275 tb_warn(tb,
276 "hotplug event for upstream port %llx:%x (unplug: %d)\n",
277 ev->route, ev->port, ev->unplug);
278 goto out;
279 }
280 if (ev->unplug) {
281 if (port->remote) {
282 tb_port_info(port, "unplugged\n");
aae20bb6 283 tb_sw_set_unplugged(port->remote->sw);
3364f0c1 284 tb_free_invalid_tunnels(tb);
bfe778ac 285 tb_switch_remove(port->remote->sw);
053596d9
AN
286 port->remote = NULL;
287 } else {
288 tb_port_info(port,
289 "got unplug event for disconnected port, ignoring\n");
290 }
291 } else if (port->remote) {
292 tb_port_info(port,
293 "got plug event for connected port, ignoring\n");
294 } else {
295 tb_port_info(port, "hotplug: scanning\n");
296 tb_scan_port(port);
297 if (!port->remote) {
298 tb_port_info(port, "hotplug: no switch found\n");
299 } else if (port->remote->sw->config.depth > 1) {
300 tb_sw_warn(port->remote->sw,
301 "hotplug: chaining not supported\n");
3364f0c1
AN
302 } else {
303 tb_sw_info(port->remote->sw,
304 "hotplug: activating pcie devices\n");
305 tb_activate_pcie_devices(tb);
053596d9
AN
306 }
307 }
d6cc51cd
AN
308out:
309 mutex_unlock(&tb->lock);
310 kfree(ev);
311}
312
313/**
314 * tb_schedule_hotplug_handler() - callback function for the control channel
315 *
316 * Delegates to tb_handle_hotplug.
317 */
81a54b5e
MW
318static void tb_handle_event(struct tb *tb, enum tb_cfg_pkg_type type,
319 const void *buf, size_t size)
d6cc51cd 320{
81a54b5e
MW
321 const struct cfg_event_pkg *pkg = buf;
322 struct tb_hotplug_event *ev;
323 u64 route;
324
325 if (type != TB_CFG_PKG_EVENT) {
326 tb_warn(tb, "unexpected event %#x, ignoring\n", type);
327 return;
328 }
329
330 route = tb_cfg_get_route(&pkg->header);
331
332 if (tb_cfg_error(tb->ctl, route, pkg->port,
333 TB_CFG_ERROR_ACK_PLUG_EVENT)) {
334 tb_warn(tb, "could not ack plug event on %llx:%x\n", route,
335 pkg->port);
336 }
337
338 ev = kmalloc(sizeof(*ev), GFP_KERNEL);
d6cc51cd
AN
339 if (!ev)
340 return;
341 INIT_WORK(&ev->work, tb_handle_hotplug);
342 ev->tb = tb;
343 ev->route = route;
81a54b5e
MW
344 ev->port = pkg->port;
345 ev->unplug = pkg->unplug;
d6cc51cd
AN
346 queue_work(tb->wq, &ev->work);
347}
348
9d3cce0b 349static void tb_stop(struct tb *tb)
d6cc51cd 350{
9d3cce0b 351 struct tb_cm *tcm = tb_priv(tb);
3364f0c1
AN
352 struct tb_pci_tunnel *tunnel;
353 struct tb_pci_tunnel *n;
354
3364f0c1 355 /* tunnels are only present after everything has been initialized */
9d3cce0b 356 list_for_each_entry_safe(tunnel, n, &tcm->tunnel_list, list) {
3364f0c1
AN
357 tb_pci_deactivate(tunnel);
358 tb_pci_free(tunnel);
359 }
bfe778ac 360 tb_switch_remove(tb->root_switch);
9d3cce0b 361 tcm->hotplug_active = false; /* signal tb_handle_hotplug to quit */
d6cc51cd
AN
362}
363
9d3cce0b 364static int tb_start(struct tb *tb)
d6cc51cd 365{
9d3cce0b 366 struct tb_cm *tcm = tb_priv(tb);
bfe778ac 367 int ret;
d6cc51cd 368
bfe778ac 369 tb->root_switch = tb_switch_alloc(tb, &tb->dev, 0);
a25c8b2f 370 if (!tb->root_switch)
9d3cce0b 371 return -ENOMEM;
a25c8b2f 372
e6b245cc
MW
373 /*
374 * ICM firmware upgrade needs running firmware and in native
375 * mode that is not available so disable firmware upgrade of the
376 * root switch.
377 */
378 tb->root_switch->no_nvm_upgrade = true;
379
bfe778ac
MW
380 ret = tb_switch_configure(tb->root_switch);
381 if (ret) {
382 tb_switch_put(tb->root_switch);
383 return ret;
384 }
385
386 /* Announce the switch to the world */
387 ret = tb_switch_add(tb->root_switch);
388 if (ret) {
389 tb_switch_put(tb->root_switch);
390 return ret;
391 }
392
9da672a4
AN
393 /* Full scan to discover devices added before the driver was loaded. */
394 tb_scan_switch(tb->root_switch);
3364f0c1 395 tb_activate_pcie_devices(tb);
9da672a4 396
d6cc51cd 397 /* Allow tb_handle_hotplug to progress events */
9d3cce0b
MW
398 tcm->hotplug_active = true;
399 return 0;
d6cc51cd
AN
400}
401
9d3cce0b 402static int tb_suspend_noirq(struct tb *tb)
23dd5bb4 403{
9d3cce0b
MW
404 struct tb_cm *tcm = tb_priv(tb);
405
23dd5bb4 406 tb_info(tb, "suspending...\n");
23dd5bb4 407 tb_switch_suspend(tb->root_switch);
9d3cce0b 408 tcm->hotplug_active = false; /* signal tb_handle_hotplug to quit */
23dd5bb4 409 tb_info(tb, "suspend finished\n");
9d3cce0b
MW
410
411 return 0;
23dd5bb4
AN
412}
413
9d3cce0b 414static int tb_resume_noirq(struct tb *tb)
23dd5bb4 415{
9d3cce0b 416 struct tb_cm *tcm = tb_priv(tb);
23dd5bb4 417 struct tb_pci_tunnel *tunnel, *n;
9d3cce0b 418
23dd5bb4 419 tb_info(tb, "resuming...\n");
23dd5bb4
AN
420
421 /* remove any pci devices the firmware might have setup */
422 tb_switch_reset(tb, 0);
423
424 tb_switch_resume(tb->root_switch);
425 tb_free_invalid_tunnels(tb);
426 tb_free_unplugged_children(tb->root_switch);
9d3cce0b 427 list_for_each_entry_safe(tunnel, n, &tcm->tunnel_list, list)
23dd5bb4 428 tb_pci_restart(tunnel);
9d3cce0b 429 if (!list_empty(&tcm->tunnel_list)) {
23dd5bb4
AN
430 /*
431 * the pcie links need some time to get going.
432 * 100ms works for me...
433 */
434 tb_info(tb, "tunnels restarted, sleeping for 100ms\n");
435 msleep(100);
436 }
437 /* Allow tb_handle_hotplug to progress events */
9d3cce0b 438 tcm->hotplug_active = true;
23dd5bb4 439 tb_info(tb, "resume finished\n");
9d3cce0b
MW
440
441 return 0;
442}
443
444static const struct tb_cm_ops tb_cm_ops = {
445 .start = tb_start,
446 .stop = tb_stop,
447 .suspend_noirq = tb_suspend_noirq,
448 .resume_noirq = tb_resume_noirq,
81a54b5e 449 .handle_event = tb_handle_event,
9d3cce0b
MW
450};
451
452struct tb *tb_probe(struct tb_nhi *nhi)
453{
454 struct tb_cm *tcm;
455 struct tb *tb;
456
630b3aff 457 if (!x86_apple_machine)
f67cf491
MW
458 return NULL;
459
9d3cce0b
MW
460 tb = tb_domain_alloc(nhi, sizeof(*tcm));
461 if (!tb)
462 return NULL;
463
f67cf491 464 tb->security_level = TB_SECURITY_NONE;
9d3cce0b
MW
465 tb->cm_ops = &tb_cm_ops;
466
467 tcm = tb_priv(tb);
468 INIT_LIST_HEAD(&tcm->tunnel_list);
469
470 return tb;
23dd5bb4 471}