linux-stable.git/drivers/ntb, branch v6.18.38

NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR

2026-07-04T11:44:17+00:00

commit d876153680e3d721d385e554def919bce3d18c74 upstream.

When BAR_PEER_SPAD and BAR_CONFIG share one PCI BAR, the module teardown
path ends up calling pci_iounmap() on the same iomem with some offset,
which is unnecessary and triggers a kernel warning like the following:

  Trying to vunmap() nonexistent vm area (0000000069a5ffe8)
  WARNING: mm/vmalloc.c:3470 at vunmap+0x58/0x68, CPU#5: modprobe/2937
  [...]
  Call trace:
   vunmap+0x58/0x68 (P)
   iounmap+0x34/0x48
   pci_iounmap+0x2c/0x40
   ntb_epf_pci_remove+0x44/0x80 [ntb_hw_epf]
   pci_device_remove+0x48/0xf8
   device_remove+0x50/0x88
   device_release_driver_internal+0x1c8/0x228
   driver_detach+0x50/0xb0
   bus_remove_driver+0x74/0x100
   driver_unregister+0x34/0x68
   pci_unregister_driver+0x34/0xa0
   ntb_epf_pci_driver_exit+0x14/0xfe0 [ntb_hw_epf]
  [...]

Fix it by unmapping only when PEER_SPAD and CONFIG use difference bars.

Cc: stable@vger.kernel.org
Fixes: e75d5ae8ab88 ("NTB: epf: Allow more flexibility in the memory BAR map method")
Reviewed-by: Frank Li 
Signed-off-by: Koichiro Den 
Reviewed-by: Dave Jiang 
Signed-off-by: Jon Mason 
Signed-off-by: Greg Kroah-Hartman

x86-64: rename misleadingly named '__copy_user_nocache()' function

2026-04-22T11:22:31+00:00

commit d187a86de793f84766ea40b9ade7ac60aabbb4fe upstream.

This function was a masterclass in bad naming, for various historical
reasons.

It claimed to be a non-cached user copy.  It is literally _neither_ of
those things.  It's a specialty memory copy routine that uses
non-temporal stores for the destination (but not the source), and that
does exception handling for both source and destination accesses.

Also note that while it works for unaligned targets, any unaligned parts
(whether at beginning or end) will not use non-temporal stores, since
only words and quadwords can be non-temporal on x86.

The exception handling means that it _can_ be used for user space
accesses, but not on its own - it needs all the normal "start user space
access" logic around it.

But typically the user space access would be the source, not the
non-temporal destination.  That was the original intention of this,
where the destination was some fragile persistent memory target that
needed non-temporal stores in order to catch machine check exceptions
synchronously and deal with them gracefully.

Thus that non-descriptive name: one use case was to copy from user space
into a non-cached kernel buffer.  However, the existing users are a mix
of that intended use-case, and a couple of random drivers that just did
this as a performance tweak.

Some of those random drivers then actively misused the user copying
version (with STAC/CLAC and all) to do kernel copies without ever even
caring about the exception handling, _just_ for the non-temporal
destination.

Rename it as a first small step to actually make it halfway sane, and
change the prototype to be more normal: it doesn't take a user pointer
unless the caller has done the proper conversion, and the argument size
is the full size_t (it still won't actually copy more than 4GB in one
go, but there's also no reason to silently truncate the size argument in
the caller).

Finally, use this now sanely named function in the NTB code, which
mis-used a user copy version (with STAC/CLAC and all) of this interface
despite it not actually being a user copy at all.

Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

NTB: ntb_transport: Fix too small buffer for debugfs_name

2026-03-04T12:21:35+00:00

[ Upstream commit 6a4b50585d74fe45d3ade1e3e86ba8aae79761a5 ]

The buffer used for "qp%d" was only 4 bytes, which truncates names like
"qp10" to "qp1" and causes multiple queues to share the same directory.

Enlarge the buffer and use sizeof() to avoid truncation.

Fixes: fce8a7bb5b4b ("PCI-Express Non-Transparent Bridge Support")
Cc:  # v3.9+
Reviewed-by: Frank Li 
Reviewed-by: Dave Jiang 
Signed-off-by: Koichiro Den 
Signed-off-by: Jon Mason 
Signed-off-by: Sasha Levin

ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut

2026-03-04T12:20:43+00:00

[ Upstream commit 186615f8855a0be4ee7d3fcd09a8ecc10e783b08 ]

Number of MW LUTs depends on NTB configuration and can be set to zero,
in such scenario rounddown_pow_of_two will cause undefined behaviour and
should not be performed.
This patch ensures that rounddown_pow_of_two is called on valid value.

Signed-off-by: Maciej Grochowski 
Signed-off-by: Jon Mason 
Signed-off-by: Sasha Levin

ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access

2026-03-04T12:20:43+00:00

[ Upstream commit c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface ]

Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS,
This patch protects against invalid index out of bounds access to mw_sizes
When invalid access print message to user that configuration is not valid.

Signed-off-by: Maciej Grochowski 
Signed-off-by: Jon Mason 
Signed-off-by: Sasha Levin

ntb: transport: Fix uninitialized mutex

2026-01-30T09:32:17+00:00

[ Upstream commit 2ccb5e8dbcd2dedf13e0270165ac48bd79b7f673 ]

When the mutex 'link_event_lock' was introduced, it was never
initialized and it triggers kernel warnings when used with locking
debug turned on. Add initialization for the mutex.

Fixes: 3db835dd8f9a ("ntb: Add mutex to make link_event_callback executed linearly.")
Cc: fuyuanli 
Signed-off-by: Dave Jiang 
Signed-off-by: Jon Mason 
Signed-off-by: Sasha Levin

NTB: epf: Add Renesas rcar support

2025-09-22T13:35:21+00:00

Add virtual non-transparent bridge support for Renesas rcar platform

Reviewed-by: Frank Li 
Signed-off-by: Jerome Brunet 
Signed-off-by: Jon Mason

NTB: epf: Allow arbitrary BAR mapping

2025-09-22T13:35:21+00:00

The NTB epf host driver assumes the BAR number associated with a memory
window is just incremented from the BAR number associated with MW1. This
seems to have been enough so far but this is not really how the endpoint
side work and the two could easily become mis-aligned.

ntb_epf_mw_to_bar() even assumes that the BAR number is the memory window
index + 2, which means the function only returns a proper result if BAR_2
is associated with MW1.

Instead, fully describe and allow arbitrary NTB BAR mapping.

Signed-off-by: Jerome Brunet 
Signed-off-by: Jon Mason

ntb: Add mutex to make link_event_callback executed linearly.

2025-09-22T13:35:21+00:00

Since the CPU selected by schedule_work is uncertain, multiple link_event
callbacks may be executed at same time. For example, after peer's link is
up, it is down quickly before local link_work completed. If link_cleanup
is added to the workqueue of another CPU, then link_work and link_cleanup
may be executed at the same time. So add a mutex to prevent them from being
executed concurrently.

Signed-off-by: fuyuanli 
Reviewed-by: Logan Gunthorpe 
Reviewed-by: Dave Jiang 
Signed-off-by: Jon Mason

ntb_hw_amd: Update amd_ntb_get_link_status to support latest generation secondary topology

2025-09-22T13:35:20+00:00

In the NTB secondary topology configuration of the latest generation,
the device behaves like an endpoint. Hence, add endpoint support and
update amd_ntb_get_link_status to accommodate endpoint devices.

Co-developed-by: Sanath S 
Signed-off-by: Sanath S 
Signed-off-by: Basavaraj Natikar 
Reviewed-by: Dave Jiang 
Signed-off-by: Jon Mason