kernel/linux.git/drivers/ntb/hw/mscc, branch v7.1

ntb: ntb_hw_switchtec: Increase MAX_MWS limit to 256

2026-02-20T22:31:55+00:00

Microchip NTB switchtec devices supports up to 512 LUT's across all NT partitions. This patch enable symmetric NTB configuration to utilize all 512 memory windows across 2 peers partitions. Signed-off-by: Maciej Grochowski Signed-off-by: Jon Mason

ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access

2026-02-20T22:31:55+00:00

Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS, This patch protects against invalid index out of bounds access to mw_sizes When invalid access print message to user that configuration is not valid. Signed-off-by: Maciej Grochowski Signed-off-by: Jon Mason

ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut

2026-02-20T22:31:55+00:00

Number of MW LUTs depends on NTB configuration and can be set to zero, in such scenario rounddown_pow_of_two will cause undefined behaviour and should not be performed. This patch ensures that rounddown_pow_of_two is called on valid value. Signed-off-by: Maciej Grochowski Signed-off-by: Jon Mason

ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans

2025-03-18T14:22:47+00:00

There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative. [ 23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000 [ 23.734158] ================================================================================ [ 23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntb_hw_switchtec.c:293:7 [ 23.734418] shift exponent -1 is negative Ensuring xlate_pos is a positive or zero before BIT. Fixes: 1e2fd202f859 ("ntb_hw_switchtec: Check for alignment of the buffer in mw_set_trans()") Signed-off-by: Yajun Deng Reviewed-by: Logan Gunthorpe Signed-off-by: Jon Mason

ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition

2024-09-20T14:50:38+00:00

In the switchtec_ntb_add function, it can call switchtec_ntb_init_sndev function, then &sndev->check_link_status_work is bound with check_link_status_work. switchtec_ntb_link_notification may be called to start the work. If we remove the module which will call switchtec_ntb_remove to make cleanup, it will free sndev through kfree(sndev), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | check_link_status_work switchtec_ntb_remove | kfree(sndev); | | if (sndev->link_force_down) | // use sndev Fix it by ensuring that the work is canceled before proceeding with the cleanup in switchtec_ntb_remove. Signed-off-by: Kaixin Wang Reviewed-by: Logan Gunthorpe Signed-off-by: Jon Mason

PCI: switchtec: Make switchtec_class constant

2024-06-10T20:03:30+00:00

Now that the driver core allows for struct class to be in read-only memory, we should make all 'class' structures declared at build time placing them into read-only memory, instead of having to be dynamically allocated at runtime. Link: https://lore.kernel.org/r/2024061053-online-unwound-b173@gregkh Signed-off-by: Greg Kroah-Hartman Signed-off-by: Bjorn Helgaas Reviewed-by: Dave Jiang Reviewed-By: Logan Gunthorpe Cc: Kurt Schwemmer Cc: Jon Mason Cc: Allen Hubbe

driver core: class: remove struct class_interface * from callbacks

2023-04-03T19:42:52+00:00

The add_dev and remove_dev callbacks in struct class_interface currently pass in a pointer back to the class_interface structure that is calling them, but none of the callback implementations actually use this pointer as it is pointless (the structure is known, the driver passed it in in the first place if it is really needed again.) So clean this up and just remove the pointer from the callbacks and fix up all callback functions. Cc: Jean Delvare Cc: Guenter Roeck Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Kurt Schwemmer Cc: Jon Mason Cc: Dave Jiang Cc: Allen Hubbe Cc: Dominik Brodowski Cc: Matt Porter Cc: Alexandre Bounine Cc: "James E.J. Bottomley" Cc: "Martin K. Petersen" Cc: Doug Gilbert Cc: John Stultz Cc: Thomas Gleixner Cc: Stephen Boyd Cc: Hans de Goede Cc: Andrew Morton Cc: Wang Weiyang Cc: Yang Yingliang Cc: Jakob Koschel Cc: Cai Xinchen Acked-by: Rafael J. Wysocki Acked-by: Logan Gunthorpe Link: https://lore.kernel.org/r/2023040250-pushover-platter-509c@gregkh Signed-off-by: Greg Kroah-Hartman

ntb_hw_switchtec: Fix a minor issue in config_req_id_table()

2022-01-11T20:38:59+00:00

The req_id_table_size field is 16-bit wide, use ioread16() to read the value. Signed-off-by: Kelvin Cao Signed-off-by: Jon Mason

ntb_hw_switchtec: Remove code for disabling ID protection

2022-01-11T20:38:59+00:00

ID protection is a firmware setting for NT window access control. With it enabled, only the posted requests with requester IDs in the requester ID table will be allowed to access the NT windows. Otherwise all posted requests are allowed. Normally user will configure it statically via the Switchtec config file, and it will take effect when the firmware boots up. The driver can also toggle the ID protection setting dynamically, which will overwrite the static setting in the Switchtec config file as a side effect. Currently, the driver disables the ID protection. However, it's not necessary to disable the ID protection at the driver level as the driver has already configured the proper requester IDs in the requester ID table to allow the corresponding posted requests to hit the NT windows. Remove the code that disables the ID protection to make the static setting prevail. Note: ID protection is not applicable to non-posted requests. Signed-off-by: Kelvin Cao Signed-off-by: Jon Mason

ntb_hw_switchtec: Update the way of getting VEP instance ID

2022-01-11T20:38:59+00:00

Gen4 firmware adds DMA VEP and NVMe VEP support in VEP (virtual EP) instance ID register in addtion to management EP. Update the way of getting management VEP instance ID. Signed-off-by: Kelvin Cao Signed-off-by: Jon Mason