linux-toradex.git/drivers/ntb, branch v7.0-rc5

Merge tag 'kmalloc_obj-treewide-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

2026-02-21T19:02:58+00:00

Pull kmalloc_obj conversion from Kees Cook:
 "This does the tree-wide conversion to kmalloc_obj() and friends using
  coccinelle, with a subsequent small manual cleanup of whitespace
  alignment that coccinelle does not handle.

  This uncovered a clang bug in __builtin_counted_by_ref(), so the
  conversion is preceded by disabling that for current versions of
  clang.  The imminent clang 22.1 release has the fix.

  I've done allmodconfig build tests for x86_64, arm64, i386, and arm. I
  did defconfig builds for alpha, m68k, mips, parisc, powerpc, riscv,
  s390, sparc, sh, arc, csky, xtensa, hexagon, and openrisc"

* tag 'kmalloc_obj-treewide-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  kmalloc_obj: Clean up after treewide replacements
  treewide: Replace kmalloc with kmalloc_obj for non-scalar types
  compiler_types: Disable __builtin_counted_by_ref for Clang

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from
scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to
avoid scalar types (which need careful case-by-case checking), and
instead replace kmalloc-family calls that allocate struct or union
object instances:

Single allocations:	kmalloc(sizeof(TYPE), ...)
are replaced with:	kmalloc_obj(TYPE, ...)

Array allocations:	kmalloc_array(COUNT, sizeof(TYPE), ...)
are replaced with:	kmalloc_objs(TYPE, COUNT, ...)

Flex array allocations:	kmalloc(struct_size(PTR, FAM, COUNT), ...)
are replaced with:	kmalloc_flex(*PTR, FAM, COUNT, ...)

(where TYPE may also be *VAR)

The resulting allocations no longer return "void *", instead returning
"TYPE *".

Signed-off-by: Kees Cook

NTB: ntb_transport: Use seq_file for QP stats debugfs

2026-02-20T22:31:55+00:00

The ./qp*/stats debugfs file for each NTB transport QP is currently
implemented with a hand-crafted kmalloc() buffer and a series of
scnprintf() calls. This is a pre-seq_file style pattern and makes future
extensions easy to truncate.

Convert the stats file to use the seq_file helpers via
DEFINE_SHOW_ATTRIBUTE(), which simplifies the code and lets the seq_file
core handle buffering and partial reads.

Reviewed-by: Frank Li 
Reviewed-by: Dave Jiang 
Signed-off-by: Koichiro Den 
Signed-off-by: Jon Mason

NTB: ntb_transport: Fix too small buffer for debugfs_name

2026-02-20T22:31:55+00:00

The buffer used for "qp%d" was only 4 bytes, which truncates names like
"qp10" to "qp1" and causes multiple queues to share the same directory.

Enlarge the buffer and use sizeof() to avoid truncation.

Fixes: fce8a7bb5b4b ("PCI-Express Non-Transparent Bridge Support")
Cc:  # v3.9+
Reviewed-by: Frank Li 
Reviewed-by: Dave Jiang 
Signed-off-by: Koichiro Den 
Signed-off-by: Jon Mason

ntb/ntb_tool: correct sscanf format for u64 and size_t in tool_peer_mw_trans_write

2026-02-20T22:31:55+00:00

The sscanf() call in tool_peer_mw_trans_write() uses "%lli:%zi" to parse
user input into 'u64 addr' and 'size_t wsize'. This is incorrect:

 - "%lli" expects a signed long long *, but 'addr' is u64 (unsigned).
   Input like "0x8000000000000000" is misinterpreted as negative,
   leading to corrupted address values.

 - "%zi" expects a signed ssize_t *, but 'wsize' is size_t (unsigned).
   Input of "-1" is successfully parsed and stored as SIZE_MAX
   (e.g., 0xFFFFFFFFFFFFFFFF), which may cause buffer overflows
   or infinite loops in subsequent memory operations.

Fix by using format specifiers that match the actual variable types:
 - "%llu" for u64 (supports hex/decimal, standard for kernel u64 parsing)
 - "%zu" for size_t (standard and safe; rejects negative input)

Signed-off-by: yangqixiao 
Reviewed-by: Dave Jiang 
Signed-off-by: Jon Mason

ntb: intel: Add Intel Gen6 NTB support for DiamondRapids

2026-02-20T22:31:55+00:00

Add DiamondRapids NTB support by adding the DID and adjust the changed
PPD0 offset.

Signed-off-by: Dave Jiang 
Signed-off-by: Jon Mason

NTB/msi: Remove unused functions

2026-02-20T22:31:55+00:00

ntbm_msi_free_irq() and ntb_msi_peer_addr() were both added in 2019's
commit 26b3a37b9284 ("NTB: Introduce MSI library")
but have remained unused.

Remove them, and the ntbm_msi_callback_match() helper that
was used by ntbm_msi_free_irq().

Signed-off-by: Dr. David Alan Gilbert 
Signed-off-by: Jon Mason

ntb: ntb_hw_switchtec: Increase MAX_MWS limit to 256

2026-02-20T22:31:55+00:00

Microchip NTB switchtec devices supports up to 512 LUT's across all
NT partitions. This patch enable symmetric NTB configuration to utilize
all 512 memory windows across 2 peers partitions.

Signed-off-by: Maciej Grochowski 
Signed-off-by: Jon Mason

ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access

2026-02-20T22:31:55+00:00

Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS,
This patch protects against invalid index out of bounds access to mw_sizes
When invalid access print message to user that configuration is not valid.

Signed-off-by: Maciej Grochowski 
Signed-off-by: Jon Mason

ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut

2026-02-20T22:31:55+00:00

Number of MW LUTs depends on NTB configuration and can be set to zero,
in such scenario rounddown_pow_of_two will cause undefined behaviour and
should not be performed.
This patch ensures that rounddown_pow_of_two is called on valid value.

Signed-off-by: Maciej Grochowski 
Signed-off-by: Jon Mason