Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1693080 > unrolled thread

Re: [PATCH v4 00/27] Thunderbolt security levels and NVM firmware upgrade

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [PATCH v4 00/27] Thunderbolt security levels and NVM firmware  upgrade Christian Kellner <ckellner@redhat.com> - 2017-07-20 18:20 +0200
    Re: [PATCH v4 00/27] Thunderbolt security levels and NVM firmware  upgrade Mika Westerberg <mika.westerberg@linux.intel.com> - 2017-07-24 09:00 +0200
      Re: [PATCH v4 00/27] Thunderbolt security levels and NVM firmware  upgrade Christian Kellner <ckellner@redhat.com> - 2017-07-25 11:20 +0200
        Re: [PATCH v4 00/27] Thunderbolt security levels and NVM firmware  upgrade Mika Westerberg <mika.westerberg@linux.intel.com> - 2017-07-25 11:30 +0200

#1693080 — Re: [PATCH v4 00/27] Thunderbolt security levels and NVM firmware upgrade

Hi!

> This is fourth version of the patch series adding support for Thunderbolt
> security levels and NVM firmware upgrade.

While prototyping the user-space bits for GNOME, I stumbled upon an
oops on the Lenovo T470s (see below) when attaching a Dell TB16
thunderbolt 3 dock. As a result /sys/bus/thunderbolt/devices has only
domain0 in it but not the dock itself. Everything works fine on a Dell
XPS 13 9630. The oops happens with linux-next and when I backport the
patches to 4.11.11.
Happy to provide any more information and test future patches.

Cheers,
Christian

--- 8< ---
lspci output:

pcilib: Cannot open /sys/bus/pci/devices/0000:03:00.0/config
lspci: Unable to read the standard configuration space header of device 0000:03:00.0
00:00.0 Host bridge: Intel Corporation Device 5904 (rev 02)
00:02.0 VGA compatible controller: Intel Corporation Device 5916 (rev 02)
00:14.0 USB controller: Intel Corporation Sunrise Point-LP USB 3.0 xHCI Controller (rev 21)
00:14.2 Signal processing controller: Intel Corporation Sunrise Point-LP Thermal subsystem (rev 21)
00:16.0 Communication controller: Intel Corporation Sunrise Point-LP CSME HECI #1 (rev 21)
00:16.3 Serial controller: Intel Corporation Device 9d3d (rev 21)
00:1c.0 PCI bridge: Intel Corporation Device 9d10 (rev f1)
00:1c.2 PCI bridge: Intel Corporation Device 9d12 (rev f1)
00:1d.0 PCI bridge: Intel Corporation Sunrise Point-LP PCI Express Root Port #9 (rev f1)
00:1f.0 ISA bridge: Intel Corporation Device 9d4e (rev 21)
00:1f.2 Memory controller: Intel Corporation Sunrise Point-LP PMC (rev 21)
00:1f.3 Audio device: Intel Corporation Device 9d71 (rev 21)
00:1f.4 SMBus: Intel Corporation Sunrise Point-LP SMBus (rev 21)
00:1f.6 Ethernet controller: Intel Corporation Ethernet Connection (4) I219-LM (rev 21)
01:00.0 PCI bridge: Intel Corporation JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016] (rev ff)
02:00.0 PCI bridge: Intel Corporation JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016] (rev ff)
02:01.0 PCI bridge: Intel Corporation JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016] (rev ff)
02:02.0 PCI bridge: Intel Corporation JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016] (rev ff)
3a:00.0 Network controller: Intel Corporation Wireless 8265 / 8275 (rev 78)
3c:00.0 Non-Volatile memory controller: Toshiba America Info Systems Device 0115 (rev 01)

--- >8 ---
Ops:

[   69.886978] thunderbolt 0000:03:00.0: current switch config:
[   69.886983] thunderbolt 0000:03:00.0:  Switch: 8086:15c0 (Revision: 1, TB Version: 2)
[   69.886986] thunderbolt 0000:03:00.0:   Max Port Number: 5
[   69.886987] thunderbolt 0000:03:00.0:   Config:
[   69.886991] thunderbolt 0000:03:00.0:    Upstream Port Number: 3 Depth: 0 Route String: 0x0 Enabled: 1, PlugEventsDelay: 254ms
[   69.886994] thunderbolt 0000:03:00.0:    unknown1: 0x0 unknown4: 0x0
[   69.920748] BUG: unable to handle kernel NULL pointer dereference at 00000000000002ec
[   69.920834] IP: tb_drom_read+0x383/0x890 [thunderbolt]
[   69.920873] PGD 0 
[   69.920874] P4D 0 

[   69.920925] Oops: 0000 [#1] SMP
[   69.920952] Modules linked in: thunderbolt(+) fuse rfcomm ccm xt_CHECKSUM ipt_MASQUERADE nf_nat_masquerade_ipv4 tun nf_conntrack_netbios_ns nf_conntrack_broadcast xt_CT ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute bridge stp llc ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack libcrc32c iptable_mangle iptable_raw iptable_security ebtable_filter ebtables ip6table_filter ip6_tables cmac bnep sunrpc arc4 wmi_bmof iTCO_wdt iwlmvm iTCO_vendor_support snd_soc_skl mei_wdt snd_soc_skl_ipc snd_soc_sst_ipc snd_soc_sst_dsp snd_hda_ext_core tpm_crb snd_soc_sst_match intel_rapl x86_pkg_temp_thermal intel_powerclamp mac80211 coretemp
[   69.921479]  kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hda_codec_hdmi intel_cstate intel_uncore intel_rapl_perf snd_soc_core iwlwifi snd_hda_codec_realtek snd_hda_codec_generic snd_compress snd_pcm_dmaengine ac97_bus snd_hda_intel snd_hda_codec snd_hda_core cfg80211 snd_hwdep snd_seq pcspkr uvcvideo hci_uart joydev snd_seq_device snd_pcm videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_core btusb videodev btrtl btbcm snd_timer i2c_i801 btqca btintel media bluetooth qcserial mei_me usb_wwan mei shpchp thinkpad_acpi intel_pch_thermal snd wmi tpm_tis soundcore tpm_tis_core pinctrl_sunrisepoint intel_lpss_acpi tpm ecdh_generic intel_lpss pinctrl_intel rfkill acpi_pad cdc_mbim cdc_wdm cdc_ncm usbnet mii uas usb_storage i915 i2c_algo_bit drm_kms_helper drm e1000e crc32c_intel
[   69.922013]  ptp serio_raw nvme nvme_core pps_core video i2c_hid
[   69.922062] CPU: 3 PID: 12248 Comm: systemd-udevd Not tainted 4.13.0-rc1-next-20170719 #1
[   69.922116] Hardware name: LENOVO 20HF000YGE/20HF000YGE, BIOS N1WET32W (1.11 ) 05/23/2017
[   69.922170] task: ffff8a293e4bcd80 task.stack: ffffa698027a8000
[   69.922218] RIP: 0010:tb_drom_read+0x383/0x890 [thunderbolt]
[   69.922256] RSP: 0018:ffffa698027ab990 EFLAGS: 00010246
[   69.922292] RAX: 0000000000000000 RBX: ffff8a2940af7800 RCX: 0000000000000000
[   69.922339] RDX: ffff8a2940ebb400 RSI: 0000000000000000 RDI: ffffa698027ab9a0
[   69.922385] RBP: ffffa698027ab9d0 R08: 0000000000000001 R09: 0000000000000002
[   69.922432] R10: ffff8a2940ebb5b0 R11: 0000000000000000 R12: ffff8a293bfa968c
[   69.922478] R13: 000000000000002c R14: 0000000000000056 R15: 0000000000000056
[   69.922526] FS:  00007f0a945a38c0(0000) GS:ffff8a2961580000(0000) knlGS:0000000000000000
[   69.922579] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   69.922617] CR2: 00000000000002ec CR3: 000000043e785000 CR4: 00000000003606e0
[   69.922665] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   69.922712] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   69.922760] Call Trace:
[   69.922789]  tb_switch_add+0x9d/0x730 [thunderbolt]
[   69.922846]  ? tb_switch_alloc+0x3cd/0x4d0 [thunderbolt]
[   69.922893]  icm_start+0x5a/0xa0 [thunderbolt]
[   69.922934]  tb_domain_add+0xc3/0xf0 [thunderbolt]
[   69.922976]  nhi_probe+0x19e/0x310 [thunderbolt]
[   69.923017]  local_pci_probe+0x42/0xa0
[   69.923048]  pci_device_probe+0x18d/0x1a0
[   69.923082]  driver_probe_device+0x2ff/0x450
[   69.923116]  __driver_attach+0xa4/0xe0
[   69.923146]  ? driver_probe_device+0x450/0x450
[   69.923184]  bus_for_each_dev+0x6e/0xb0
[   69.923215]  driver_attach+0x1e/0x20
[   69.923246]  bus_add_driver+0x1d0/0x270
[   69.923277]  ? 0xffffffffc0bbb000
[   69.923304]  driver_register+0x60/0xe0
[   69.923334]  ? 0xffffffffc0bbb000
[   69.923372]  __pci_register_driver+0x4c/0x50
[   69.923411]  nhi_init+0x28/0x1000 [thunderbolt]
[   69.923449]  do_one_initcall+0x50/0x190
[   69.923481]  ? __vunmap+0x81/0xb0
[   69.923511]  ? _cond_resched+0x1a/0x50
[   69.923544]  ? kmem_cache_alloc_trace+0x15f/0x1c0
[   69.923581]  ? do_init_module+0x27/0x1e9
[   69.923613]  do_init_module+0x5f/0x1e9
[   69.923643]  load_module+0x24e7/0x2a60
[   69.923677]  ? vfs_read+0x115/0x130
[   69.923707]  SYSC_finit_module+0xfc/0x120
[   69.923738]  ? SYSC_finit_module+0xfc/0x120
[   69.923773]  SyS_finit_module+0xe/0x10
[   69.923805]  do_syscall_64+0x67/0x170
[   69.923850]  entry_SYSCALL64_slow_path+0x25/0x25
[   69.923882] RIP: 0033:0x7f0a93214529
[   69.923908] RSP: 002b:00007fffddc70308 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[   69.923959] RAX: ffffffffffffffda RBX: 000000c52e0e6450 RCX: 00007f0a93214529
[   69.924005] RDX: 0000000000000000 RSI: 00007f0a93d509c5 RDI: 0000000000000007
[   69.924052] RBP: 00007f0a93d509c5 R08: 0000000000000000 R09: 00007fffddc70420
[   69.926454] R10: 0000000000000007 R11: 0000000000000246 R12: 0000000000000000
[   69.928766] R13: 000000c52e0e5590 R14: 0000000000020000 R15: 000000c52df83f4a
[   69.931055] Code: 8d 0c c9 83 e0 01 84 c0 4c 8d 14 ca 41 88 42 35 75 85 49 8b 42 20 41 0f b6 4a 34 41 b9 02 00 00 00 41 b8 01 00 00 00 4c 89 55 c0 <8b> 90 ec 02 00 00 8b b0 e8 02 00 00 48 8b 80 08 03 00 00 81 e2 
[   69.933380] RIP: tb_drom_read+0x383/0x890 [thunderbolt] RSP: ffffa698027ab990
[   69.935708] CR2: 00000000000002ec
[   69.950221] ---[ end trace a3f247a8fe7705ab ]---

--- 8< ---

-- 
Dr. Christian J. Kellner
Red Hat Desktop Hardware Enablement
ckellner@redhat.com

[toc] | [next] | [standalone]

#1694482

Hi,

On Thu, Jul 20, 2017 at 06:11:49PM +0200, Christian Kellner wrote:
> Hi!
> 
> > This is fourth version of the patch series adding support for Thunderbolt
> > security levels and NVM firmware upgrade.
> 
> While prototyping the user-space bits for GNOME, I stumbled upon an
> oops on the Lenovo T470s (see below) when attaching a Dell TB16
> thunderbolt 3 dock. As a result /sys/bus/thunderbolt/devices has only
> domain0 in it but not the dock itself. Everything works fine on a Dell
> XPS 13 9630. The oops happens with linux-next and when I backport the
> patches to 4.11.11.
> Happy to provide any more information and test future patches.
> 
> Cheers,
> Christian
> 
> --- 8< ---
> lspci output:
> 
> pcilib: Cannot open /sys/bus/pci/devices/0000:03:00.0/config
> lspci: Unable to read the standard configuration space header of device 0000:03:00.0
> 00:00.0 Host bridge: Intel Corporation Device 5904 (rev 02)
> 00:02.0 VGA compatible controller: Intel Corporation Device 5916 (rev 02)
> 00:14.0 USB controller: Intel Corporation Sunrise Point-LP USB 3.0 xHCI Controller (rev 21)
> 00:14.2 Signal processing controller: Intel Corporation Sunrise Point-LP Thermal subsystem (rev 21)
> 00:16.0 Communication controller: Intel Corporation Sunrise Point-LP CSME HECI #1 (rev 21)
> 00:16.3 Serial controller: Intel Corporation Device 9d3d (rev 21)
> 00:1c.0 PCI bridge: Intel Corporation Device 9d10 (rev f1)
> 00:1c.2 PCI bridge: Intel Corporation Device 9d12 (rev f1)
> 00:1d.0 PCI bridge: Intel Corporation Sunrise Point-LP PCI Express Root Port #9 (rev f1)
> 00:1f.0 ISA bridge: Intel Corporation Device 9d4e (rev 21)
> 00:1f.2 Memory controller: Intel Corporation Sunrise Point-LP PMC (rev 21)
> 00:1f.3 Audio device: Intel Corporation Device 9d71 (rev 21)
> 00:1f.4 SMBus: Intel Corporation Sunrise Point-LP SMBus (rev 21)
> 00:1f.6 Ethernet controller: Intel Corporation Ethernet Connection (4) I219-LM (rev 21)
> 01:00.0 PCI bridge: Intel Corporation JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016] (rev ff)
> 02:00.0 PCI bridge: Intel Corporation JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016] (rev ff)
> 02:01.0 PCI bridge: Intel Corporation JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016] (rev ff)
> 02:02.0 PCI bridge: Intel Corporation JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016] (rev ff)
> 3a:00.0 Network controller: Intel Corporation Wireless 8265 / 8275 (rev 78)
> 3c:00.0 Non-Volatile memory controller: Toshiba America Info Systems Device 0115 (rev 01)
> 
> --- >8 ---
> Ops:
> 
> [   69.886978] thunderbolt 0000:03:00.0: current switch config:
> [   69.886983] thunderbolt 0000:03:00.0:  Switch: 8086:15c0 (Revision: 1, TB Version: 2)
> [   69.886986] thunderbolt 0000:03:00.0:   Max Port Number: 5
> [   69.886987] thunderbolt 0000:03:00.0:   Config:
> [   69.886991] thunderbolt 0000:03:00.0:    Upstream Port Number: 3 Depth: 0 Route String: 0x0 Enabled: 1, PlugEventsDelay: 254ms
> [   69.886994] thunderbolt 0000:03:00.0:    unknown1: 0x0 unknown4: 0x0
> [   69.920748] BUG: unable to handle kernel NULL pointer dereference at 00000000000002ec
> [   69.920834] IP: tb_drom_read+0x383/0x890 [thunderbolt]

I've seen this once on Alpine Ridge LP (which you have here) where the
DROM contents of the older NVM image listed too many ports. Can you try
if the below patch helps?

diff --git a/drivers/thunderbolt/eeprom.c b/drivers/thunderbolt/eeprom.c
index 996c6e2..bdf7f80 100644
--- a/drivers/thunderbolt/eeprom.c
+++ b/drivers/thunderbolt/eeprom.c
@@ -333,6 +333,12 @@ static int tb_drom_parse_entry_port(struct tb_switch *sw,
 	int res;
 	enum tb_port_type type;
 
+	if (header->index > sw->config.max_port_number) {
+		tb_sw_warn(sw, "DROM has too many entries %u (expected %u)\n",
+			   header->index, sw->config.max_port_number);
+		return 0;
+	}
+
 	port = &sw->ports[header->index];
 	port->disabled = header->port_disabled;
 	if (port->disabled)

[toc] | [prev] | [next] | [standalone]

#1695530

Hi Mika,


> I've seen this once on Alpine Ridge LP (which you have here) where the
> DROM contents of the older NVM image listed too many ports. Can you 
> try
> if the below patch helps?
You were right. Patch works fine, and I indeed see the expected 
warnings in
the logs:

[  102.739663] thunderbolt 0000:03:00.0: 0: DROM has too many entries 6 
(expected 5)
[  102.739665] thunderbolt 0000:03:00.0: 0: DROM has too many entries 7 
(expected 5)
[  102.739667] thunderbolt 0000:03:00.0: 0: DROM has too many entries 8 
(expected 5)
[  102.739668] thunderbolt 0000:03:00.0: 0: DROM has too many entries 9 
(expected 5)
[  102.739669] thunderbolt 0000:03:00.0: 0: DROM has too many entries 
10 (expected 5)
[  102.739670] thunderbolt 0000:03:00.0: 0: DROM has too many entries 
11 (expected 5)

Thanks a lot,
Christian

> diff --git a/drivers/thunderbolt/eeprom.c 
> b/drivers/thunderbolt/eeprom.c
> index 996c6e2..bdf7f80 100644
> --- a/drivers/thunderbolt/eeprom.c
> +++ b/drivers/thunderbolt/eeprom.c
> @@ -333,6 +333,12 @@ static int tb_drom_parse_entry_port(struct 
> tb_switch *sw,
>  	int res;
>  	enum tb_port_type type;
> 
> +	if (header->index > sw->config.max_port_number) {
> +		tb_sw_warn(sw, "DROM has too many entries %u (expected %u)\n",
> +			   header->index, sw->config.max_port_number);
> +		return 0;
> +	}
> +
>  	port = &sw->ports[header->index];
>  	port->disabled = header->port_disabled;
>  	if (port->disabled)

Tested-by: Christian Kellner <christian@kellner.me>

[toc] | [prev] | [next] | [standalone]

#1695540

On Tue, Jul 25, 2017 at 11:11:05AM +0200, Christian Kellner wrote:
> Hi Mika,
> 
> 
> > I've seen this once on Alpine Ridge LP (which you have here) where the
> > DROM contents of the older NVM image listed too many ports. Can you try
> > if the below patch helps?
> You were right. Patch works fine, and I indeed see the expected warnings in
> the logs:
> 
> [  102.739663] thunderbolt 0000:03:00.0: 0: DROM has too many entries 6
> (expected 5)
> [  102.739665] thunderbolt 0000:03:00.0: 0: DROM has too many entries 7
> (expected 5)
> [  102.739667] thunderbolt 0000:03:00.0: 0: DROM has too many entries 8
> (expected 5)
> [  102.739668] thunderbolt 0000:03:00.0: 0: DROM has too many entries 9
> (expected 5)
> [  102.739669] thunderbolt 0000:03:00.0: 0: DROM has too many entries 10
> (expected 5)
> [  102.739670] thunderbolt 0000:03:00.0: 0: DROM has too many entries 11
> (expected 5)

Thanks for confirming! I will send a proper patch (with slight changes)
later today.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web