linux.git/drivers/ntb, branch v6.6.132

NTB: ntb_transport: Fix too small buffer for debugfs_name

2026-03-04T12:21:20+00:00

[ Upstream commit 6a4b50585d74fe45d3ade1e3e86ba8aae79761a5 ]

The buffer used for "qp%d" was only 4 bytes, which truncates names like
"qp10" to "qp1" and causes multiple queues to share the same directory.

Enlarge the buffer and use sizeof() to avoid truncation.

Fixes: fce8a7bb5b4b ("PCI-Express Non-Transparent Bridge Support")
Cc:  # v3.9+
Reviewed-by: Frank Li 
Reviewed-by: Dave Jiang 
Signed-off-by: Koichiro Den 
Signed-off-by: Jon Mason 
Signed-off-by: Sasha Levin

ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut

2026-03-04T12:20:58+00:00

[ Upstream commit 186615f8855a0be4ee7d3fcd09a8ecc10e783b08 ]

Number of MW LUTs depends on NTB configuration and can be set to zero,
in such scenario rounddown_pow_of_two will cause undefined behaviour and
should not be performed.
This patch ensures that rounddown_pow_of_two is called on valid value.

Signed-off-by: Maciej Grochowski 
Signed-off-by: Jon Mason 
Signed-off-by: Sasha Levin

ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access

2026-03-04T12:20:58+00:00

[ Upstream commit c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface ]

Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS,
This patch protects against invalid index out of bounds access to mw_sizes
When invalid access print message to user that configuration is not valid.

Signed-off-by: Maciej Grochowski 
Signed-off-by: Jon Mason 
Signed-off-by: Sasha Levin

NTB: epf: Allow arbitrary BAR mapping

2025-11-24T09:29:48+00:00

[ Upstream commit 5ad865862a0fd349163243e1834ed98ba9b81905 ]

The NTB epf host driver assumes the BAR number associated with a memory
window is just incremented from the BAR number associated with MW1. This
seems to have been enough so far but this is not really how the endpoint
side work and the two could easily become mis-aligned.

ntb_epf_mw_to_bar() even assumes that the BAR number is the memory window
index + 2, which means the function only returns a proper result if BAR_2
is associated with MW1.

Instead, fully describe and allow arbitrary NTB BAR mapping.

Signed-off-by: Jerome Brunet 
Signed-off-by: Jon Mason 
Signed-off-by: Sasha Levin

ntb_hw_amd: Add NTB PCI ID for new gen CPU

2025-05-02T05:50:56+00:00

[ Upstream commit bf8a7ce7e4c7267a6f5f2b2023cfc459b330b25e ]

Add NTB support for new generation of processor.

Signed-off-by: Basavaraj Natikar 
Signed-off-by: Jon Mason 
Signed-off-by: Sasha Levin

ntb: reduce stack usage in idt_scan_mws

2025-05-02T05:50:56+00:00

[ Upstream commit aff12700b8dd7422bfe2277696e192af4df9de8f ]

idt_scan_mws() puts a large fixed-size array on the stack and copies
it into a smaller dynamically allocated array at the end. On 32-bit
targets, the fixed size can easily exceed the warning limit for
possible stack overflow:

drivers/ntb/hw/idt/ntb_hw_idt.c:1041:27: error: stack frame size (1032) exceeds limit (1024) in 'idt_scan_mws' [-Werror,-Wframe-larger-than]

Change it to instead just always use dynamic allocation for the
array from the start. It's too big for the stack, but not actually
all that much for a permanent allocation.

Reported-by: kernel test robot 
Closes: https://lore.kernel.org/all/202205111109.PiKTruEj-lkp@intel.com/
Signed-off-by: Arnd Bergmann 
Reviewed-by: Dave Jiang 
Reviewed-by: Damien Le Moal 
Signed-off-by: Jon Mason 
Signed-off-by: Sasha Levin

ntb: use 64-bit arithmetic for the MSI doorbell mask

2025-04-25T08:45:35+00:00

commit fd5625fc86922f36bedee5846fefd647b7e72751 upstream.

msi_db_mask is of type 'u64', still the standard 'int' arithmetic is
performed to compute its value.

While most of the ntb_hw drivers actually don't utilize the higher 32
bits of the doorbell mask now, this may be the case for Switchtec - see
switchtec_ntb_init_db().

Found by Linux Verification Center (linuxtesting.org) with SVACE static
analysis tool.

Fixes: 2b0569b3b7e6 ("NTB: Add MSI interrupt support to ntb_transport")
Cc: stable@vger.kernel.org
Signed-off-by: Fedor Pchelkin 
Reviewed-by: Dave Jiang 
Signed-off-by: Jon Mason 
Signed-off-by: Greg Kroah-Hartman

ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk()

2025-04-10T12:37:42+00:00

commit 4279e72cab31dd3eb8c89591eb9d2affa90ab6aa upstream.

The function call “dmaengine_unmap_put(unmap)” was used in an if branch.
The same call was immediately triggered by a subsequent goto statement.
Thus avoid such a call repetition.

This issue was detected by using the Coccinelle software.

Fixes: 5648e56d03fa ("NTB: ntb_perf: Add full multi-port NTB API support")
Cc: stable@vger.kernel.org
Signed-off-by: Markus Elfring 
Signed-off-by: Jon Mason 
Signed-off-by: Greg Kroah-Hartman

ntb: intel: Fix using link status DB's

2025-04-10T12:37:39+00:00

[ Upstream commit 8144e9c8f30fb23bb736a5d24d5c9d46965563c4 ]

Make sure we are not using DB's which were remapped for link status.

Fixes: f6e51c354b60 ("ntb: intel: split out the gen3 code")
Signed-off-by: Nikita Shubin 
Reviewed-by: Dave Jiang 
Signed-off-by: Jon Mason 
Signed-off-by: Sasha Levin

ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans

2025-04-10T12:37:39+00:00

[ Upstream commit de203da734fae00e75be50220ba5391e7beecdf9 ]

There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and
size. This would make xlate_pos negative.

[   23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000
[   23.734158] ================================================================================
[   23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntb_hw_switchtec.c:293:7
[   23.734418] shift exponent -1 is negative

Ensuring xlate_pos is a positive or zero before BIT.

Fixes: 1e2fd202f859 ("ntb_hw_switchtec: Check for alignment of the buffer in mw_set_trans()")
Signed-off-by: Yajun Deng 
Reviewed-by: Logan Gunthorpe 
Signed-off-by: Jon Mason 
Signed-off-by: Sasha Levin