kernel/git/stable/linux.git/drivers/thunderbolt/eeprom.c, branch linux-7.2.y

thunderbolt: Bound the DROM dual link port number before indexing sw->ports

2026-07-27T09:58:54+00:00

tb_drom_parse_entry_port() validates the device-supplied header->index against sw->config.max_port_number before indexing sw->ports[], but the sibling field entry->dual_link_port_nr -- a 6-bit value also read from the DROM -- indexes the same array with no such check. A malicious or malformed Thunderbolt device can set dual_link_port_nr beyond the allocated sw->ports[] (max_port_number + 1 entries), producing an out-of-bounds tb_port pointer that is stored and later dereferenced. Reject a port entry whose dual_link_port_nr exceeds max_port_number, the same bound already applied to header->index. Fixes: cd22e73bdf5e ("thunderbolt: Read port configuration from eeprom.") Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas Signed-off-by: Mika Westerberg

thunderbolt: Move pci_device out of tb_nhi

2026-05-21T12:29:05+00:00

Not all USB4/TB implementations are based on a PCIe-attached controller. In order to make way for these, start off with moving the pci_device reference out of the main tb_nhi structure. Encapsulate the existing struct in a new tb_nhi_pci, that shall also house all properties that relate to the parent bus. Similarly, any other type of controller will be expected to contain tb_nhi as a member. Signed-off-by: Konrad Dybcio Signed-off-by: Mika Westerberg

thunderbolt: Fix typo in tb_eeprom_ctl_read documentation

2025-10-20T06:17:36+00:00

Fix presumed copy-paste typo of tb_eeprom_ctl_read documentation referring to tb_eeprom_ctl_write. Signed-off-by: Dominik Karol Piątkowski Signed-off-by: Mika Westerberg

thunderbolt: Update eeprom.c function documentation

2025-09-17T05:32:59+00:00

Make eeprom.c function documentation compliant with current kernel-doc standards. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg

lib/crc32: standardize on crc32c() name for Castagnoli CRC32

2025-02-09T04:06:30+00:00

For historical reasons, the Castagnoli CRC32 is available under 3 names: crc32c(), crc32c_le(), and __crc32c_le(). Most callers use crc32c(). The more verbose versions are not really warranted; there is no "_be" version that the "_le" version needs to be differentiated from, and the leading underscores are pointless. Therefore, let's standardize on just crc32c(). Remove the other two names, and update callers accordingly. Specifically, the new crc32c() comes from what was previously __crc32c_le(), so compared to the old crc32c() it now takes a size_t length rather than unsigned int, and it's now in linux/crc32.h instead of just linux/crc32c.h (which includes linux/crc32.h). Later patches will also rename __crc32c_le_combine(), crc32c_le_base(), and crc32c_le_arch(). Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250208024911.14936-5-ebiggers@kernel.org Signed-off-by: Eric Biggers

thunderbolt: Expose router DROM through debugfs

2025-01-05T08:35:03+00:00

Router DROM contains information that might be usable for development and debugging purposes. For example when new entries are added to the USB4 spec it is useful to be able to look for them without need to change the kernel. For this reason expose the DROM through debugfs. Signed-off-by: Mika Westerberg

thunderbolt: Ignore data CRC mismatch for USB4 routers

2023-06-16T06:53:27+00:00

This is also something not always updated after the DROM contents itself so issue warning but continue parsing it as we do for pre-USB4 DROMs too. Signed-off-by: Mika Westerberg

thunderbolt: Refactor DROM reading

2023-03-14T14:15:45+00:00

The NVM reading code has a series of gotos that potentially introduce unexpected behaviors with retries if something unexpected has failed to parse. Refactor the code to remove the gotos and drop the retry logic. Signed-off-by: Mario Limonciello [mw: renamed root switch to host router, split device handling too] Signed-off-by: Mika Westerberg

thunderbolt: use `tb_eeprom_get_drom_offset` to discover DROM offset

2023-03-14T13:54:49+00:00

The static function `tb_eeprom_get_drom_offset` has more safety guards for the DROM offset fetching. Use this instead of just `tb_sw_read` No intended functional changes. Signed-off-by: Mario Limonciello Signed-off-by: Mika Westerberg

thunderbolt: Rename EEPROM handling bits to match USB4 spec

2022-03-04T14:10:36+00:00

The structure `tb_eeprom_ctl` is used to show the bits accessed when reading/writing EEPROM. As this structure is specified in the USB4 spec as `VSC_CS_4` update the names and use of members to match the specification. This should not change anything functionally. Signed-off-by: Mario Limonciello Signed-off-by: Mika Westerberg