[PATCH v5 0/2] PCI: endpoint: pci-epf-vntb: Honor MSI-X selection

[PATCH v5 0/2] PCI: endpoint: pci-epf-vntb: Honor MSI-X selection

[Koichiro Den]

Hi,

This small patch set fixes vNTB ignoring the host's MSI-X selection. On
endpoint controllers that expose an MSI-X capability, such as RK3588,
ntb_hw_epf can select MSI-X, but pci-epf-vntb still configures and
raises MSI. When MSI-X is selected, doorbell interrupts are not
delivered, and the host may report IOMMU faults if it's enabled.

The fix allocates space for the MSI-X Table and PBA in a BAR, using an
EPF-owned layout. This brings vNTB in line with other EPF
implementations, such as pci-epf-test and nvmet-pci-epf.

This series is based on pci/endpoint plus:
https://lore.kernel.org/r/20261014071448.2473208-1-den@valinux.co.jp/
Although the changes are logically independent, this avoids conflicts
when applying the two patches after it.

Side note: I initially planned to have vNTB make use of the pre-mapped
	   MSI-X Table/PBA regions when available [1]. That work is on
	   hold because of an unresolved issue on RK3588 [2]: host
	   writes to the Message Address field (the 1st eight bytes) of
	   table entry #0 did not seem to reach the internal Table RAM.

[1] In the earlier series, I called this a "hardware-owned" layout to
    distinguish it from an "EPF-owned" layout. In hindsight,
    "hardware-owned" might sound a bit awkward.
[2] https://lore.kernel.org/r/sor2mm4jzgeprhn3fjw4jmcaowwkhhuus6exi4k5kum6frqvug@gatkk7r4qyxd/

Best regards,
Koichiro Den
---
Changes since v4:
  - Split out the local epf cleanup into a prep patch. (Frank)
    Now that there are two patches, I've resurrected the cover letter.
  - Minimize the diff by not updating the MSI labels in the
    interrupt-numbering comment. (Frank)

v4: https://lore.kernel.org/r/20261014053256.2378817-1-den@valinux.co.jp/
v3: https://lore.kernel.org/r/20260919172021.1055451-1-den@valinux.co.jp/

The earlier series also tried to use the fixed MSI-X Table/PBA regions,
but ran into the RK3588 issue mentioned above:
(v2: https://lore.kernel.org/r/20260830151948.3547577-1-den@valinux.co.jp/)
(v1: https://lore.kernel.org/r/20260827182012.1984960-1-den@valinux.co.jp/)


Koichiro Den (2):
  PCI: endpoint: pci-epf-vntb: Use a local epf pointer in interrupt
    setup
  PCI: endpoint: pci-epf-vntb: Honor MSI-X selection

 drivers/pci/endpoint/functions/pci-epf-vntb.c | 58 +++++++++++++++----
 1 file changed, 46 insertions(+), 12 deletions(-)


base-commit: 5cdbd6d3a3a147fa9975e35f2602cbec9a72a932
prerequisite-patch-id: 77967f15b7e75c72ca5f9b236d16c2866e3c6e1c
-- 
2.54.0

[PATCH v5 1/2] PCI: endpoint: pci-epf-vntb: Use a local epf pointer in interrupt setup

[Koichiro Den]

Use a local epf pointer in epf_ntb_configure_interrupt() to shorten the
repeated ntb->epf accesses.

No functional changes.

Signed-off-by: Koichiro Den <den@valinux.co.jp>
---
Changes since v4:
  - New patch. (Frank)

 drivers/pci/endpoint/functions/pci-epf-vntb.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c
index a11f9260ee86..d74402ea10bf 100644
--- a/drivers/pci/endpoint/functions/pci-epf-vntb.c
+++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c
@@ -545,12 +545,14 @@ static int epf_ntb_config_spad_bar_alloc(struct epf_ntb *ntb)
 static int epf_ntb_configure_interrupt(struct epf_ntb *ntb)
 {
 	const struct pci_epc_features *epc_features;
+	struct pci_epf *epf = ntb->epf;
 	struct device *dev;
 	int ret;
 
-	dev = &ntb->epf->dev;
+	dev = &epf->dev;
 
-	epc_features = pci_epc_get_features(ntb->epf->epc, ntb->epf->func_no, ntb->epf->vfunc_no);
+	epc_features = pci_epc_get_features(epf->epc, epf->func_no,
+					    epf->vfunc_no);
 
 	if (!(epc_features->msix_capable || epc_features->msi_capable)) {
 		dev_err(dev, "MSI or MSI-X is required for doorbell\n");
@@ -564,10 +566,7 @@ static int epf_ntb_configure_interrupt(struct epf_ntb *ntb)
 	}
 
 	if (epc_features->msi_capable) {
-		ret = pci_epc_set_msi(ntb->epf->epc,
-				      ntb->epf->func_no,
-				      ntb->epf->vfunc_no,
-				      16);
+		ret = pci_epc_set_msi(epf->epc, epf->func_no, epf->vfunc_no, 16);
 		if (ret) {
 			dev_err(dev, "MSI configuration failed\n");
 			return ret;
-- 
2.54.0

Re: [PATCH v5 1/2] PCI: endpoint: pci-epf-vntb: Use a local epf pointer in interrupt setup

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] pci-epf-vntb: missing NULL check for epc_features causes dereference crash
--

commit 696d7d5432aa89730866d2e53e0d664d75343cd2
Author: Koichiro Den <den@valinux.co.jp>

PCI: endpoint: pci-epf-vntb: Use a local epf pointer in interrupt setup

This commit introduces a local epf pointer to simplify device access and
shorten repeated pointer dereferences in epf_ntb_configure_interrupt.

> diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c
> index a11f9260ee860..d74402ea10bf6 100644
> --- a/drivers/pci/endpoint/functions/pci-epf-vntb.c
> +++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c
> @@ -545,12 +545,14 @@ static int epf_ntb_config_spad_bar_alloc(struct epf_ntb *ntb)
>  static int epf_ntb_configure_interrupt(struct epf_ntb *ntb)
>  {
>  	const struct pci_epc_features *epc_features;
> +	struct pci_epf *epf = ntb->epf;
>  	struct device *dev;
>  	int ret;
>  
> -	dev = &ntb->epf->dev;
> +	dev = &epf->dev;
>  
> -	epc_features = pci_epc_get_features(ntb->epf->epc, ntb->epf->func_no, ntb->epf->vfunc_no);
> +	epc_features = pci_epc_get_features(epf->epc, epf->func_no,
> +					    epf->vfunc_no);
>  
>  	if (!(epc_features->msix_capable || epc_features->msi_capable)) {

[Severity: High]
Could this regression result in a NULL pointer dereference crash?

Looking at pci_epc_get_features() in pci-epc-core.c, it returns NULL for
invalid configurations or if the driver is missing get_features operations:

pci_epc_get_features() {
        if (!pci_epc_function_is_valid(epc, func_no, vfunc_no))
                return NULL;

        if (!epc->ops->get_features)
                return NULL;
        ...
}

If a user configures the endpoint with an invalid function number via
configfs, pci_epc_get_features() will return NULL. Because the returned
epc_features pointer is unconditionally dereferenced in the if statement
above, would it be safer to add a NULL check before inspecting the
structure?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015014402.2976188-1-den@valinux.co.jp?part=1

Re: [PATCH v5 1/2] PCI: endpoint: pci-epf-vntb: Use a local epf pointer in interrupt setup

[Frank Li]

On Thu, Oct 15, 2026 at 10:44:01AM +0900, Koichiro Den wrote:
> Use a local epf pointer in epf_ntb_configure_interrupt() to shorten the
> repeated ntb->epf accesses.
>
> No functional changes.
>
> Signed-off-by: Koichiro Den <den@valinux.co.jp>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

> Changes since v4:
>   - New patch. (Frank)
>
>  drivers/pci/endpoint/functions/pci-epf-vntb.c | 11 +++++------
>  1 file changed, 5 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c
> index a11f9260ee86..d74402ea10bf 100644
> --- a/drivers/pci/endpoint/functions/pci-epf-vntb.c
> +++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c
> @@ -545,12 +545,14 @@ static int epf_ntb_config_spad_bar_alloc(struct epf_ntb *ntb)
>  static int epf_ntb_configure_interrupt(struct epf_ntb *ntb)
>  {
>  	const struct pci_epc_features *epc_features;
> +	struct pci_epf *epf = ntb->epf;
>  	struct device *dev;
>  	int ret;
>
> -	dev = &ntb->epf->dev;
> +	dev = &epf->dev;
>
> -	epc_features = pci_epc_get_features(ntb->epf->epc, ntb->epf->func_no, ntb->epf->vfunc_no);
> +	epc_features = pci_epc_get_features(epf->epc, epf->func_no,
> +					    epf->vfunc_no);
>
>  	if (!(epc_features->msix_capable || epc_features->msi_capable)) {
>  		dev_err(dev, "MSI or MSI-X is required for doorbell\n");
> @@ -564,10 +566,7 @@ static int epf_ntb_configure_interrupt(struct epf_ntb *ntb)
>  	}
>
>  	if (epc_features->msi_capable) {
> -		ret = pci_epc_set_msi(ntb->epf->epc,
> -				      ntb->epf->func_no,
> -				      ntb->epf->vfunc_no,
> -				      16);
> +		ret = pci_epc_set_msi(epf->epc, epf->func_no, epf->vfunc_no, 16);
>  		if (ret) {
>  			dev_err(dev, "MSI configuration failed\n");
>  			return ret;
> --
> 2.54.0
>

[PATCH v5 2/2] PCI: endpoint: pci-epf-vntb: Honor MSI-X selection

[Koichiro Den]

ntb_hw_epf tries MSI-X first and falls back to MSI. It reports the
result in COMMAND_CONFIGURE_DOORBELL. pci-epf-vntb ignores MSIX_ENABLE,
configures only MSI, and always raises peer interrupts with PCI_IRQ_MSI.
When MSI-X is selected, the host does not program MSI, so raising it can
issue a write to an invalid address. This was observed as IOMMU faults
on the RC, with no doorbell interrupts delivered.

Configure MSI-X when supported and use the selected type for peer
doorbells and link events. Allocate the MSI-X Table and PBA in the config
BAR and configure db_count entries. Use this EPF-owned layout even if the
EPC has fixed, hardware-owned Table/PBA regions, as pci-epf-test and
nvmet-pci-epf already do.

Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP")
Signed-off-by: Koichiro Den <den@valinux.co.jp>
---
Changes since v4:
  - Split out the local epf cleanup into a prep patch. (Frank)
  - Keep the MSI labels in the interrupt-numbering comment. (Frank)
  - Rebase on the link-state fix and honor MSI-X for link events too.
  - Link to v4: https://lore.kernel.org/r/20261014053256.2378817-1-den@valinux.co.jp/

 drivers/pci/endpoint/functions/pci-epf-vntb.c | 47 ++++++++++++++++---
 1 file changed, 41 insertions(+), 6 deletions(-)

diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c
index d74402ea10bf..f4eede5330c6 100644
--- a/drivers/pci/endpoint/functions/pci-epf-vntb.c
+++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c
@@ -152,6 +152,7 @@ struct epf_ntb {
 	struct mutex link_lock;
 	bool host_linkup;
 	bool vhost_linkup;
+	bool peer_msix;
 
 	/*
 	 * True when doorbells are interrupt-driven (MSI or embedded), false
@@ -159,6 +160,7 @@ struct epf_ntb {
 	 */
 	bool msi_doorbell;
 	u32 spad_size;
+	u32 msix_table_offset;
 
 	enum pci_barno epf_ntb_bar[VNTB_BAR_NUM];
 
@@ -202,13 +204,16 @@ static void epf_ntb_update_link(struct epf_ntb *ntb)
 
 static int epf_ntb_notify_link(struct ntb_dev *ndev)
 {
-	struct pci_epf *epf = ntb_ndev(ndev)->epf;
+	struct epf_ntb *ntb = ntb_ndev(ndev);
+	struct pci_epf *epf = ntb->epf;
+	unsigned int irq_type;
 	int ret;
 
 	ntb_link_event(ndev);
 
+	irq_type = ntb->peer_msix ? PCI_IRQ_MSIX : PCI_IRQ_MSI;
 	ret = pci_epc_raise_irq(epf->epc, epf->func_no, epf->vfunc_no,
-				PCI_IRQ_MSI, EPF_IRQ_LINK + 1);
+				irq_type, EPF_IRQ_LINK + 1);
 	if (ret)
 		dev_err(&epf->dev, "Failed to raise link event IRQ: %d\n", ret);
 
@@ -310,6 +315,7 @@ static void epf_ntb_teardown_mw(struct epf_ntb *ntb, u32 mw)
  */
 static void epf_ntb_cmd_handler(struct work_struct *work)
 {
+	const struct pci_epc_features *epc_features;
 	struct epf_ntb_ctrl *ctrl;
 	u32 command, argument;
 	struct epf_ntb *ntb;
@@ -342,6 +348,15 @@ static void epf_ntb_cmd_handler(struct work_struct *work)
 
 	switch (command) {
 	case COMMAND_CONFIGURE_DOORBELL:
+		epc_features = pci_epc_get_features(ntb->epf->epc,
+						    ntb->epf->func_no,
+						    ntb->epf->vfunc_no);
+		if (((argument & MSIX_ENABLE) && !epc_features->msix_capable) ||
+		    (!(argument & MSIX_ENABLE) && !epc_features->msi_capable)) {
+			ctrl->command_status = COMMAND_STATUS_ERROR;
+			break;
+		}
+		ntb->peer_msix = argument & MSIX_ENABLE;
 		ctrl->command_status = COMMAND_STATUS_OK;
 		break;
 	case COMMAND_TEARDOWN_DOORBELL:
@@ -483,8 +498,9 @@ static void epf_ntb_config_spad_bar_free(struct epf_ntb *ntb)
  * @ntb: NTB device that facilitates communication between HOST and VHOST
  *
  * Allocate the Local Memory mentioned in the above diagram. The size of
- * CONFIG REGION is sizeof(struct epf_ntb_ctrl) and size of SCRATCHPAD REGION
- * is obtained from "spad-count" configfs entry.
+ * CONFIG REGION is sizeof(struct epf_ntb_ctrl), plus space for the MSI-X
+ * Table and PBA if supported. The size of SCRATCHPAD REGION is obtained
+ * from "spad-count" configfs entry.
  *
  * Returns: Zero for success, or an error code in case of failure
  */
@@ -505,6 +521,12 @@ static int epf_ntb_config_spad_bar_alloc(struct epf_ntb *ntb)
 	spad_count = ntb->spad_count;
 
 	ctrl_size = ALIGN(sizeof(struct epf_ntb_ctrl), sizeof(u32));
+	if (epc_features->msix_capable) {
+		ntb->msix_table_offset = ALIGN(ctrl_size, 8);
+		ctrl_size = ntb->msix_table_offset +
+			    ntb->db_count * PCI_MSIX_ENTRY_SIZE +
+			    BITS_TO_U64(ntb->db_count) * sizeof(u64);
+	}
 	spad_size = 2 * spad_count * sizeof(u32);
 
 	base = pci_epf_alloc_space(epf, ctrl_size + spad_size,
@@ -573,6 +595,17 @@ static int epf_ntb_configure_interrupt(struct epf_ntb *ntb)
 		}
 	}
 
+	if (epc_features->msix_capable) {
+		ret = pci_epc_set_msix(epf->epc, epf->func_no, epf->vfunc_no,
+				       ntb->db_count,
+				       ntb->epf_ntb_bar[BAR_CONFIG],
+				       ntb->msix_table_offset);
+		if (ret) {
+			dev_err(dev, "MSI-X configuration failed\n");
+			return ret;
+		}
+	}
+
 	return 0;
 }
 
@@ -1577,6 +1610,7 @@ static void vntb_epf_peer_db_work(struct work_struct *work)
 	struct epf_ntb *ntb = container_of(work, struct epf_ntb, peer_db_work);
 	struct pci_epf *epf = ntb->epf;
 	unsigned int budget = VNTB_PEER_DB_WORK_BUDGET;
+	unsigned int irq_type;
 	u8 func_no, vfunc_no;
 	unsigned int db_bit;
 	u32 interrupt_num;
@@ -1588,6 +1622,7 @@ static void vntb_epf_peer_db_work(struct work_struct *work)
 
 	func_no = epf->func_no;
 	vfunc_no = epf->vfunc_no;
+	irq_type = ntb->peer_msix ? PCI_IRQ_MSIX : PCI_IRQ_MSI;
 
 	/*
 	 * Drain doorbells from peer_db_pending in snapshots (atomic64_xchg()).
@@ -1601,7 +1636,7 @@ static void vntb_epf_peer_db_work(struct work_struct *work)
 
 		while (db_bits) {
 			/*
-			 * pci_epc_raise_irq() for MSI expects a 1-based
+			 * pci_epc_raise_irq() for MSI/MSI-X expects a 1-based
 			 * interrupt number. The first usable doorbell starts
 			 * at EPF_IRQ_DB_START in the legacy slot layout.
 			 *
@@ -1621,7 +1656,7 @@ static void vntb_epf_peer_db_work(struct work_struct *work)
 			db_bits &= ~BIT_ULL(db_bit);
 
 			ret = pci_epc_raise_irq(epf->epc, func_no, vfunc_no,
-						PCI_IRQ_MSI, interrupt_num);
+						irq_type, interrupt_num);
 			if (ret)
 				dev_err(&epf->dev,
 					"Failed to raise IRQ for interrupt_num %u: %d\n",
-- 
2.54.0

Re: [PATCH v5 2/2] PCI: endpoint: pci-epf-vntb: Honor MSI-X selection

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] pci-epf-vntb: data race on ntb->peer_msix flag
--

commit 945f55e9b443fc0a2bffb3612525c0dc80894dd6
Author: Koichiro Den <den@valinux.co.jp>

PCI: endpoint: pci-epf-vntb: Honor MSI-X selection

ntb_hw_epf tries MSI-X first and falls back to MSI. It reports the
result in COMMAND_CONFIGURE_DOORBELL. pci-epf-vntb ignores MSIX_ENABLE,
configures only MSI, and always raises peer interrupts with PCI_IRQ_MSI.
When MSI-X is selected, the host does not program MSI, so raising it can
issue a write to an invalid address. This was observed as IOMMU faults
on the RC, with no doorbell interrupts delivered.

> diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c
> index d74402ea10bf6..f4eede5330c6c 100644
> --- a/drivers/pci/endpoint/functions/pci-epf-vntb.c
> +++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c

[ ... ]

> @@ -202,13 +204,16 @@ static void epf_ntb_update_link(struct epf_ntb *ntb)
>  
>  static int epf_ntb_notify_link(struct ntb_dev *ndev)
>  {
> -	struct pci_epf *epf = ntb_ndev(ndev)->epf;
> +	struct epf_ntb *ntb = ntb_ndev(ndev);
> +	struct pci_epf *epf = ntb->epf;
> +	unsigned int irq_type;
>  	int ret;
>  
>  	ntb_link_event(ndev);
>  
> +	irq_type = ntb->peer_msix ? PCI_IRQ_MSIX : PCI_IRQ_MSI;

[Severity: Low]
Could this lockless read of ntb->peer_msix race with concurrent writers?

During a host reboot scenario where the host crash leaves ntb->host_linkup
true, the host's COMMAND_CONFIGURE_DOORBELL can write to ntb->peer_msix in
epf_ntb_cmd_handler() at the same time this function reads it, without
READ_ONCE() or locks.

>  	ret = pci_epc_raise_irq(epf->epc, epf->func_no, epf->vfunc_no,
> -				PCI_IRQ_MSI, EPF_IRQ_LINK + 1);
> +				irq_type, EPF_IRQ_LINK + 1);
>  	if (ret)
>  		dev_err(&epf->dev, "Failed to raise link event IRQ: %d\n", ret);

[ ... ]

> @@ -342,6 +348,15 @@ static void epf_ntb_cmd_handler(struct work_struct *work)
>  
>  	switch (command) {
>  	case COMMAND_CONFIGURE_DOORBELL:
> +		epc_features = pci_epc_get_features(ntb->epf->epc,
> +						    ntb->epf->func_no,
> +						    ntb->epf->vfunc_no);
> +		if (((argument & MSIX_ENABLE) && !epc_features->msix_capable) ||
> +		    (!(argument & MSIX_ENABLE) && !epc_features->msi_capable)) {
> +			ctrl->command_status = COMMAND_STATUS_ERROR;
> +			break;
> +		}
> +		ntb->peer_msix = argument & MSIX_ENABLE;

[Severity: Low]
Could this write to ntb->peer_msix race with concurrent readers?

If the host reboots without sending a link-down command, local endpoint
clients might still issue doorbell writes. In that case,
vntb_epf_peer_db_work() can execute concurrently with this work item (since
kpcintb_workqueue uses WQ_PERCPU), reading ntb->peer_msix while this
function updates it.

Does this need WRITE_ONCE() or proper locking to prevent a data race?

>  		ctrl->command_status = COMMAND_STATUS_OK;
>  		break;
>  	case COMMAND_TEARDOWN_DOORBELL:

[ ... ]

> @@ -1588,6 +1622,7 @@ static void vntb_epf_peer_db_work(struct work_struct *work)
>  
>  	func_no = epf->func_no;
>  	vfunc_no = epf->vfunc_no;
> +	irq_type = ntb->peer_msix ? PCI_IRQ_MSIX : PCI_IRQ_MSI;

[Severity: Low]
Is it safe to read ntb->peer_msix here without READ_ONCE()?

Since kpcintb_workqueue uses WQ_PERCPU, work items on different CPUs can
run concurrently. As described above, if a host reboots without bringing
the link down, this worker thread might read ntb->peer_msix at the same
time epf_ntb_cmd_handler() updates it.

>  
>  	/*
>  	 * Drain doorbells from peer_db_pending in snapshots (atomic64_xchg()).

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015014402.2976188-1-den@valinux.co.jp?part=2

Re: [PATCH v5 2/2] PCI: endpoint: pci-epf-vntb: Honor MSI-X selection

[Frank Li]

On Thu, Oct 15, 2026 at 10:44:02AM +0900, Koichiro Den wrote:
> ntb_hw_epf tries MSI-X first and falls back to MSI. It reports the
> result in COMMAND_CONFIGURE_DOORBELL. pci-epf-vntb ignores MSIX_ENABLE,
> configures only MSI, and always raises peer interrupts with PCI_IRQ_MSI.
> When MSI-X is selected, the host does not program MSI, so raising it can
> issue a write to an invalid address. This was observed as IOMMU faults
> on the RC, with no doorbell interrupts delivered.
>
> Configure MSI-X when supported and use the selected type for peer
> doorbells and link events. Allocate the MSI-X Table and PBA in the config
> BAR and configure db_count entries. Use this EPF-owned layout even if the
> EPC has fixed, hardware-owned Table/PBA regions, as pci-epf-test and
> nvmet-pci-epf already do.
>
> Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP")
> Signed-off-by: Koichiro Den <den@valinux.co.jp>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

> Changes since v4:
>   - Split out the local epf cleanup into a prep patch. (Frank)
>   - Keep the MSI labels in the interrupt-numbering comment. (Frank)
>   - Rebase on the link-state fix and honor MSI-X for link events too.
>   - Link to v4: https://lore.kernel.org/r/20261014053256.2378817-1-den@valinux.co.jp/
>
>  drivers/pci/endpoint/functions/pci-epf-vntb.c | 47 ++++++++++++++++---
>  1 file changed, 41 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c
> index d74402ea10bf..f4eede5330c6 100644
> --- a/drivers/pci/endpoint/functions/pci-epf-vntb.c
> +++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c
> @@ -152,6 +152,7 @@ struct epf_ntb {
>  	struct mutex link_lock;
>  	bool host_linkup;
>  	bool vhost_linkup;
> +	bool peer_msix;
>
>  	/*
>  	 * True when doorbells are interrupt-driven (MSI or embedded), false
> @@ -159,6 +160,7 @@ struct epf_ntb {
>  	 */
>  	bool msi_doorbell;
>  	u32 spad_size;
> +	u32 msix_table_offset;
>
>  	enum pci_barno epf_ntb_bar[VNTB_BAR_NUM];
>
> @@ -202,13 +204,16 @@ static void epf_ntb_update_link(struct epf_ntb *ntb)
>
>  static int epf_ntb_notify_link(struct ntb_dev *ndev)
>  {
> -	struct pci_epf *epf = ntb_ndev(ndev)->epf;
> +	struct epf_ntb *ntb = ntb_ndev(ndev);
> +	struct pci_epf *epf = ntb->epf;
> +	unsigned int irq_type;
>  	int ret;
>
>  	ntb_link_event(ndev);
>
> +	irq_type = ntb->peer_msix ? PCI_IRQ_MSIX : PCI_IRQ_MSI;
>  	ret = pci_epc_raise_irq(epf->epc, epf->func_no, epf->vfunc_no,
> -				PCI_IRQ_MSI, EPF_IRQ_LINK + 1);
> +				irq_type, EPF_IRQ_LINK + 1);
>  	if (ret)
>  		dev_err(&epf->dev, "Failed to raise link event IRQ: %d\n", ret);
>
> @@ -310,6 +315,7 @@ static void epf_ntb_teardown_mw(struct epf_ntb *ntb, u32 mw)
>   */
>  static void epf_ntb_cmd_handler(struct work_struct *work)
>  {
> +	const struct pci_epc_features *epc_features;
>  	struct epf_ntb_ctrl *ctrl;
>  	u32 command, argument;
>  	struct epf_ntb *ntb;
> @@ -342,6 +348,15 @@ static void epf_ntb_cmd_handler(struct work_struct *work)
>
>  	switch (command) {
>  	case COMMAND_CONFIGURE_DOORBELL:
> +		epc_features = pci_epc_get_features(ntb->epf->epc,
> +						    ntb->epf->func_no,
> +						    ntb->epf->vfunc_no);
> +		if (((argument & MSIX_ENABLE) && !epc_features->msix_capable) ||
> +		    (!(argument & MSIX_ENABLE) && !epc_features->msi_capable)) {
> +			ctrl->command_status = COMMAND_STATUS_ERROR;
> +			break;
> +		}
> +		ntb->peer_msix = argument & MSIX_ENABLE;
>  		ctrl->command_status = COMMAND_STATUS_OK;
>  		break;
>  	case COMMAND_TEARDOWN_DOORBELL:
> @@ -483,8 +498,9 @@ static void epf_ntb_config_spad_bar_free(struct epf_ntb *ntb)
>   * @ntb: NTB device that facilitates communication between HOST and VHOST
>   *
>   * Allocate the Local Memory mentioned in the above diagram. The size of
> - * CONFIG REGION is sizeof(struct epf_ntb_ctrl) and size of SCRATCHPAD REGION
> - * is obtained from "spad-count" configfs entry.
> + * CONFIG REGION is sizeof(struct epf_ntb_ctrl), plus space for the MSI-X
> + * Table and PBA if supported. The size of SCRATCHPAD REGION is obtained
> + * from "spad-count" configfs entry.
>   *
>   * Returns: Zero for success, or an error code in case of failure
>   */
> @@ -505,6 +521,12 @@ static int epf_ntb_config_spad_bar_alloc(struct epf_ntb *ntb)
>  	spad_count = ntb->spad_count;
>
>  	ctrl_size = ALIGN(sizeof(struct epf_ntb_ctrl), sizeof(u32));
> +	if (epc_features->msix_capable) {
> +		ntb->msix_table_offset = ALIGN(ctrl_size, 8);
> +		ctrl_size = ntb->msix_table_offset +
> +			    ntb->db_count * PCI_MSIX_ENTRY_SIZE +
> +			    BITS_TO_U64(ntb->db_count) * sizeof(u64);
> +	}
>  	spad_size = 2 * spad_count * sizeof(u32);
>
>  	base = pci_epf_alloc_space(epf, ctrl_size + spad_size,
> @@ -573,6 +595,17 @@ static int epf_ntb_configure_interrupt(struct epf_ntb *ntb)
>  		}
>  	}
>
> +	if (epc_features->msix_capable) {
> +		ret = pci_epc_set_msix(epf->epc, epf->func_no, epf->vfunc_no,
> +				       ntb->db_count,
> +				       ntb->epf_ntb_bar[BAR_CONFIG],
> +				       ntb->msix_table_offset);
> +		if (ret) {
> +			dev_err(dev, "MSI-X configuration failed\n");
> +			return ret;
> +		}
> +	}
> +
>  	return 0;
>  }
>
> @@ -1577,6 +1610,7 @@ static void vntb_epf_peer_db_work(struct work_struct *work)
>  	struct epf_ntb *ntb = container_of(work, struct epf_ntb, peer_db_work);
>  	struct pci_epf *epf = ntb->epf;
>  	unsigned int budget = VNTB_PEER_DB_WORK_BUDGET;
> +	unsigned int irq_type;
>  	u8 func_no, vfunc_no;
>  	unsigned int db_bit;
>  	u32 interrupt_num;
> @@ -1588,6 +1622,7 @@ static void vntb_epf_peer_db_work(struct work_struct *work)
>
>  	func_no = epf->func_no;
>  	vfunc_no = epf->vfunc_no;
> +	irq_type = ntb->peer_msix ? PCI_IRQ_MSIX : PCI_IRQ_MSI;
>
>  	/*
>  	 * Drain doorbells from peer_db_pending in snapshots (atomic64_xchg()).
> @@ -1601,7 +1636,7 @@ static void vntb_epf_peer_db_work(struct work_struct *work)
>
>  		while (db_bits) {
>  			/*
> -			 * pci_epc_raise_irq() for MSI expects a 1-based
> +			 * pci_epc_raise_irq() for MSI/MSI-X expects a 1-based
>  			 * interrupt number. The first usable doorbell starts
>  			 * at EPF_IRQ_DB_START in the legacy slot layout.
>  			 *
> @@ -1621,7 +1656,7 @@ static void vntb_epf_peer_db_work(struct work_struct *work)
>  			db_bits &= ~BIT_ULL(db_bit);
>
>  			ret = pci_epc_raise_irq(epf->epc, func_no, vfunc_no,
> -						PCI_IRQ_MSI, interrupt_num);
> +						irq_type, interrupt_num);
>  			if (ret)
>  				dev_err(&epf->dev,
>  					"Failed to raise IRQ for interrupt_num %u: %d\n",
> --
> 2.54.0
>