PCI updates from v6.18:
     "Enumeration:
    
       - Add PCI_FIND_NEXT_CAP() and PCI_FIND_NEXT_EXT_CAP() macros that
         take config space accessor functions.
    
         Implement pci_find_capability(), pci_find_ext_capability(), and
         dwc, dwc endpoint, and cadence capability search interfaces with
         them (Hans Zhang)
    
       - Leave parent unit address 0 in 'interrupt-map' so that when we
         build devicetree nodes to describe PCI functions that contain
         multiple peripherals, we can build this property even when
         interrupt controllers lack 'reg' properties (Lorenzo Pieralisi)
    
       - Add a Xeon 6 quirk to disable Extended Tags and limit Max Read
         Request Size to 128B to avoid a performance issue (Ilpo Järvinen)
    
       - Add sysfs 'serial_number' file to expose the Device Serial Number
         (Matthew Wood)
    
       - Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
    
      Resource management:
    
       - Align m68k pcibios_enable_device() with other arches (Ilpo
         Järvinen)
    
       - Remove sparc pcibios_enable_device() implementations that don't do
         anything beyond what pci_enable_resources() does (Ilpo Järvinen)
    
       - Remove mips pcibios_enable_resources() and use
         pci_enable_resources() instead (Ilpo Järvinen)
    
       - Clean up bridge window sizing and assignment (Ilpo Järvinen),
         including:
    
           - Leave non-claimed bridge windows disabled
    
           - Enable bridges even if a window wasn't assigned because not all
             windows are required by downstream devices
    
           - Preserve bridge window type when releasing the resource, since
             the type is needed for reassignment
    
           - Consolidate selection of bridge windows into two new
             interfaces, pbus_select_window() and
             pbus_select_window_for_type(), so this is done consistently
    
           - Compute bridge window start and end earlier to avoid logging
             stale information
    
      MSI:
    
       - Add quirk to disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol
         Vives)
    
      Error handling:
    
       - Align AER with EEH by allowing drivers to request a Bus Reset on
         Non-Fatal Errors (in addition to the reset on Fatal Errors that we
         already do) (Lukas Wunner)
    
       - If error recovery fails, emit FAILED_RECOVERY uevents for the
         devices, not for the bridge leading to them.
    
         This makes them correspond to BEGIN_RECOVERY uevents (Lukas Wunner)
    
       - Align AER with EEH by calling err_handler.error_detected()
         callbacks to notify drivers if error recovery fails (Lukas Wunner)
    
       - Align AER with EEH by restoring device error_state to
         pci_channel_io_normal before the err_handler.slot_reset() callback.
    
         This is earlier than before the err_handler.resume() callback
         (Lukas Wunner)
    
       - Emit a BEGIN_RECOVERY uevent when driver's
         err_handler.error_detected() requests a reset, as well as when it
         says recovery is complete or can be done without a reset (Niklas
         Schnelle)
    
       - Align s390 with AER and EEH by emitting uevents during error
         recovery (Niklas Schnelle)
    
       - Align EEH with AER and s390 by emitting BEGIN_RECOVERY,
         SUCCESSFUL_RECOVERY, or FAILED_RECOVERY uevents depending on the
         result of err_handler.error_detected() (Niklas Schnelle)
    
       - Fix a NULL pointer dereference in aer_ratelimit() when ACPI GHES
         error information identifies a device without an AER Capability
         (Breno Leitao)
    
       - Update error decoding and TLP Log printing for new errors in
         current PCIe base spec (Lukas Wunner)
    
       - Update error recovery documentation to match the current code
         and use consistent nomenclature (Lukas Wunner)
    
      ASPM:
    
         This is a risky change that may uncover hardware or configuration
         defects at boot-time rather than when users enable ASPM via sysfs
         later. Booting with "pcie_aspm=off" prevents this enabling
         (Manivannan Sadhasivam)
    
       - Remove the qcom code that enabled ASPM (Manivannan Sadhasivam)
    
      Virtualization:
    
       - Add rescan/remove locking when enabling/disabling SR-IOV, which
         avoids list corruption on s390, where disabling SR-IOV also
         generates hotplug events (Niklas Schnelle)
    
      Peer-to-peer DMA:
    
       - Free struct p2p_pgmap, not a member within it, in the
         pci_p2pdma_add_resource() error path (Sungho Kim)
    
      Endpoint framework:
    
       - Document sysfs interface for BAR assignment of vNTB endpoint
         functions (Jerome Brunet)
    
       - Fix array underflow in endpoint BAR test case (Dan Carpenter)
    
       - Skip endpoint IRQ test if the IRQ is out of range to avoid false
         errors (Christian Bruel)
    
       - Fix endpoint test case for controllers with fixed-size BARs smaller
         than requested by the test (Marek Vasut)
    
       - Restore inbound translation when disabling doorbell so the endpoint
         doorbell test case can be run more than once (Niklas Cassel)
    
       - Avoid a NULL pointer dereference when releasing DMA channels in
         endpoint DMA test case (Shin'ichiro Kawasaki)
    
       - Convert tegra194 interrupt number to MSI vector to fix endpoint
         Kselftest MSI_TEST test case (Niklas Cassel)
    
       - Reset tegra194 BARs when running in endpoint mode so the BAR tests
         don't overwrite the ATU settings in BAR4 (Niklas Cassel)
    
       - Handle errors in tegra194 BPMP transactions so we don't mistakenly
         skip future PERST# assertion (Vidya Sagar)
    
      Freescale i.MX6 PCIe controller driver:
    
       - Enable the 3.3V Vaux supply if available so devices can request
         wakeup with either Beacon or WAKE# (Richard Zhu)
    
      MediaTek PCIe Gen3 controller driver:
    
       - Add optional sys clock ready time setting to avoid sys_clk_rdy
         signal glitching in MT6991 and MT8196 (AngeloGioacchino Del Regno)
    
       - Add DT binding and driver support for MT6991 and MT8196
         (AngeloGioacchino Del Regno)
    
      NVIDIA Tegra PCIe controller driver:
    
       - When asserting PERST#, disable the controller instead of mistakenly
         disabling the PLL twice (Nagarjuna Kristam)
    
       - Convert struct tegra_msi mask_lock to raw spinlock to avoid a lock
         nesting error (Marek Vasut)
    
      Qualcomm PCIe controller driver:
    
       - Select PCI Power Control Slot driver so slot voltage rails can be
         turned on/off if described in Root Port devicetree node (Qiang Yu)
    
       - Parse only PCI bridge child nodes in devicetree, skipping unrelated
         nodes such as OPP (Operating Performance Points), which caused
         probe failures (Krishna Chaitanya Chundru)
    
       - Add 8.0 GT/s and 32.0 GT/s equalization settings (Ziyue Zhang)
    
       - Consolidate Root Port 'phy' and 'reset' properties in struct
         qcom_pcie_port, regardless of whether we got them from the Root
         Port node or the host bridge node (Manivannan Sadhasivam)
    
       - Fetch and map the ELBI register space in the DWC core rather than
         in each driver individually (Krishna Chaitanya Chundru)
    
       - Enable ECAM mechanism in DWC core by setting up iATU with 'CFG
         Shift Feature' and use this in the qcom driver (Krishna Chaitanya
         Chundru)
    
       - Add SM8750 compatible to qcom,pcie-sm8550.yaml (Krishna Chaitanya
         Chundru)
    
       - Update qcom,pcie-x1e80100.yaml to allow fifth PCIe host on Qualcomm
         Glymur, which is compatible with X1E80100 but doesn't have the
         cnoc_sf_axi clock (Qiang Yu)
    
      Renesas R-Car PCIe controller driver:
    
       - Fix a typo that prevented correct PHY initialization (Marek Vasut)
    
       - Add a missing 1ms delay after PWR reset assertion as required by
         the V4H manual (Marek Vasut)
    
       - Assure reset has completed before DBI access to avoid SError (Marek
         Vasut)
    
       - Fix inverted PHY initialization check, which sometimes led to
         timeouts and failure to start the controller (Marek Vasut)
    
       - Pass the correct IRQ domain to generic_handle_domain_irq() to fix a
         regression when converting to msi_create_parent_irq_domain()
         (Claudiu Beznea)
       - Drop the spinlock protecting the PMSR register - it's no longer
         required since pci_lock already serializes accesses (Marek Vasut)
    
       - Convert struct rcar_msi mask_lock to raw spinlock to avoid a lock
         nesting error (Marek Vasut)
    
      SOPHGO PCIe controller driver:
    
       - Check for existence of struct cdns_pcie.ops before using it to
         allow Cadence drivers that don't need to supply ops (Chen Wang)
    
       - Add DT binding and driver for the SOPHGO SG2042 PCIe controller
         (Chen Wang)
        
      Synopsys DesignWare PCIe controller driver:
    
       - Add support for x16 in devicetree 'num-lanes' property (Konrad
         Dybcio)
    
       - Verify that if DT specifies a single IRQ for all eDMA channels, it
         is named 'dma' (Niklas Cassel)
    
      TI J721E PCIe driver:
    
       - Add MODULE_DEVICE_TABLE() so driver can be autoloaded (Siddharth
         Vadapalli)
    
       - Power controller off before configuring the glue layer so the
         controller latches the correct values on power-on (Siddharth
         Vadapalli)
    
      TI Keystone PCIe controller driver:
    
       - Use devm_request_irq() so 'ks-pcie-error-irq' is freed when driver
         exits with error (Siddharth Vadapalli)
    
       - Add Peripheral Virtualization Unit (PVU), which restricts DMA from
         PCIe devices to specific regions of host memory, to the ti,am65
         binding (Jan Kiszka)
    
      Xilinx NWL PCIe controller driver:
    
       - Clear bootloader E_ECAM_CONTROL before merging in the new driver
         value to avoid writing invalid values (Jani Nurminen)"


JIRA: https://issues.redhat.com/browse/RHEL-139968
Omitted-fix: 43d324eeb08c ("PCI: dwc: Fix missing iATU setup when ECAM is enabled")
Omitted-fix: 6a00c043af07 ("MIPS: Loongson2ef: Register PCI controller in early stage")
Omitted-fix: 32ec46510352 ("MIPS: Loongson2ef: Use pcibios_align_resource() to block io range")
Omitted-fix: fc2bc2623e3a ("Revert "PCI: qcom: Prepare for the DWC ECAM enablement"")

Signed-off-by: Myron Stowe <[email protected]>

commit fc6f36eaaedcf4b81af6fe1a568f018ffd530660
Author: Aaron Ma <[email protected]>
Date:   Wed Jan 21 15:51:06 2026 +0800

    ice: Fix PTP NULL pointer dereference during VSI rebuild
    
    Fix race condition where PTP periodic work runs while VSI is being
    rebuilt, accessing NULL vsi->rx_rings.
    
    The sequence was:
    1. ice_ptp_prepare_for_reset() cancels PTP work
    2. ice_ptp_rebuild() immediately queues PTP work
    3. VSI rebuild happens AFTER ice_ptp_rebuild()
    4. PTP work runs and accesses NULL vsi->rx_rings
    
    Fix: Keep PTP work cancelled during rebuild, only queue it after
    VSI rebuild completes in ice_rebuild().
    
    Added ice_ptp_queue_work() helper function to encapsulate the logic
    for queuing PTP work, ensuring it's only queued when PTP is supported
    and the state is ICE_PTP_READY.
    
    Error log:
    [  121.392544] ice 0000:60:00.1: PTP reset successful
    [  121.392692] BUG: kernel NULL pointer dereference, address: 0000000000000000
    [  121.392712] #PF: supervisor read access in kernel mode
    [  121.392720] #PF: error_code(0x0000) - not-present page
    [  121.392727] PGD 0
    [  121.392734] Oops: Oops: 0000 [#1] SMP NOPTI
    [  121.392746] CPU: 8 UID: 0 PID: 1005 Comm: ice-ptp-0000:60 Tainted: G S                  6.19.0-rc6+ #4 PREEMPT(voluntary)
    [  121.392761] Tainted: [S]=CPU_OUT_OF_SPEC
    [  121.392773] RIP: 0010:ice_ptp_update_cached_phctime+0xbf/0x150 [ice]
    [  121.393042] Call Trace:
    [  121.393047]  <TASK>
    [  121.393055]  ice_ptp_periodic_work+0x69/0x180 [ice]
    [  121.393202]  kthread_worker_fn+0xa2/0x260
    [  121.393216]  ? __pfx_ice_ptp_periodic_work+0x10/0x10 [ice]
    [  121.393359]  ? __pfx_kthread_worker_fn+0x10/0x10
    [  121.393371]  kthread+0x10d/0x230
    [  121.393382]  ? __pfx_kthread+0x10/0x10
    [  121.393393]  ret_from_fork+0x273/0x2b0
    [  121.393407]  ? __pfx_kthread+0x10/0x10
    [  121.393417]  ret_from_fork_asm+0x1a/0x30
    [  121.393432]  </TASK>
    
    Fixes: 803bef817807d ("ice: factor out ice_ptp_rebuild_owner()")
    Signed-off-by: Aaron Ma <[email protected]>
    Tested-by: Sunitha Mekala <[email protected]> (A Contingent worker at Intel)
    Signed-off-by: Tony Nguyen <[email protected]>

commit fc6f36eaaedcf4b81af6fe1a568f018ffd530660
Author: Aaron Ma <[email protected]>
Date:   Wed Jan 21 15:51:06 2026 +0800

    ice: Fix PTP NULL pointer dereference during VSI rebuild
    
    Fix race condition where PTP periodic work runs while VSI is being
    rebuilt, accessing NULL vsi->rx_rings.
    
    The sequence was:
    1. ice_ptp_prepare_for_reset() cancels PTP work
    2. ice_ptp_rebuild() immediately queues PTP work
    3. VSI rebuild happens AFTER ice_ptp_rebuild()
    4. PTP work runs and accesses NULL vsi->rx_rings
    
    Fix: Keep PTP work cancelled during rebuild, only queue it after
    VSI rebuild completes in ice_rebuild().
    
    Added ice_ptp_queue_work() helper function to encapsulate the logic
    for queuing PTP work, ensuring it's only queued when PTP is supported
    and the state is ICE_PTP_READY.
    
    Error log:
    [  121.392544] ice 0000:60:00.1: PTP reset successful
    [  121.392692] BUG: kernel NULL pointer dereference, address: 0000000000000000
    [  121.392712] #PF: supervisor read access in kernel mode
    [  121.392720] #PF: error_code(0x0000) - not-present page
    [  121.392727] PGD 0
    [  121.392734] Oops: Oops: 0000 [#1] SMP NOPTI
    [  121.392746] CPU: 8 UID: 0 PID: 1005 Comm: ice-ptp-0000:60 Tainted: G S                  6.19.0-rc6+ #4 PREEMPT(voluntary)
    [  121.392761] Tainted: [S]=CPU_OUT_OF_SPEC
    [  121.392773] RIP: 0010:ice_ptp_update_cached_phctime+0xbf/0x150 [ice]
    [  121.393042] Call Trace:
    [  121.393047]  <TASK>
    [  121.393055]  ice_ptp_periodic_work+0x69/0x180 [ice]
    [  121.393202]  kthread_worker_fn+0xa2/0x260
    [  121.393216]  ? __pfx_ice_ptp_periodic_work+0x10/0x10 [ice]
    [  121.393359]  ? __pfx_kthread_worker_fn+0x10/0x10
    [  121.393371]  kthread+0x10d/0x230
    [  121.393382]  ? __pfx_kthread+0x10/0x10
    [  121.393393]  ret_from_fork+0x273/0x2b0
    [  121.393407]  ? __pfx_kthread+0x10/0x10
    [  121.393417]  ret_from_fork_asm+0x1a/0x30
    [  121.393432]  </TASK>
    
    Fixes: 803bef817807d ("ice: factor out ice_ptp_rebuild_owner()")
    Signed-off-by: Aaron Ma <[email protected]>
    Tested-by: Sunitha Mekala <[email protected]> (A Contingent worker at Intel)
    Signed-off-by: Tony Nguyen <[email protected]>