[PATCH 00/11] Add NVIDIA LSTP USB adapter drivers

[PATCH 00/11] Add NVIDIA LSTP USB adapter drivers

[Adrian Ambrozewicz]

This series adds drivers for the NVIDIA LSTP USB adapter: a USB core
driver and GPIO, LED, I2C, SPI, UART and BMC-side IPMI function drivers,
with their device tree bindings, an ACPI description document and the
sysfs ABI.

What LSTP is
------------

LSTP (Low-Speed Transport Protocol or Low-Speed Tunnelling Protocol) is
a vendor-specific USB interface (class 0xff, subclass 0x3f) that
multiplexes several low-speed "channels" over one pair of bulk
endpoints. It is implemented by NVIDIA's SMA, an MCU (0955:cf11), and
by other vendors' parts: two hub/bridge chips have it built in
(0424:4940, 174c:2214). Boards use it to
reach SPI flash, I2C sensors, GPIOs and LEDs, a UART and a host-to-BMC
IPMI path, on both BMCs and host systems.

The channel types are SPI host, I2C host, GPIO (with interrupts and LED
pins), UART, IPMI and MMIO. Channel 0 is the control channel: at probe
the driver reads the channel table from it, which gives each channel's
ID, type and configuration. The set of channels is decided by the
firmware, so the same VID:PID carries different channels on different
boards. No firmware description is needed for the channels to work.

Series layout
-------------

   1  dt-bindings: gpio: Add NVIDIA LSTP GPIO
   2  dt-bindings: i2c: Add NVIDIA LSTP I2C
   3  dt-bindings: spi: Add NVIDIA LSTP SPI
   4  dt-bindings: usb: Add NVIDIA LSTP USB adapter
   5  usb: misc: Add NVIDIA LSTP USB adapter driver
   6  gpio: Add NVIDIA LSTP GPIO driver
   7  leds: Add NVIDIA LSTP LED driver
   8  i2c: Add NVIDIA LSTP I2C driver
   9  spi: Add NVIDIA LSTP SPI driver
  10  tty: Add NVIDIA LSTP UART driver
  11  ipmi: Add NVIDIA LSTP IPMI BMC driver

Patch 4 $refs the schemas from patches 1-3, so it comes last among the
bindings; it also defines the serial@N and ipmi@N channel nodes inline.
The MAINTAINERS entry starts in patch 1 and gains each later patch's
files. Patch 5 carries:
- the core in drivers/usb/misc/;
- include/linux/usb/lstp.h for the function drivers;
- the sysfs ABI file;
- Documentation/driver-api/usb/lstp.rst;
- Documentation/firmware-guide/acpi/lstp.rst.

Patches 6 and 8-11 each depend only on patch 5; patch 7 (LEDs) also
needs patch 6, whose GPIO driver hands the LED pins to it.

Why the auxiliary bus, and why not MFD
--------------------------------------

The core binds the USB interface and owns everything shared:
- URBs and packet framing;
- request/response matching and the IRQ-style event path;
- channel 0 discovery.

Each channel the device reports is then created as an auxiliary device,
lstp.<type>.<id>, and the function drivers in their subsystems bind
those. They reach the device only through functions the core exports in
the "LSTP" symbol namespace, such as lstp_request() and lstp_send().

The closest model in tree is LJCA (drivers/usb/misc/usb-ljca.c), and
the series follows it. LJCA is a USB adapter that muxes GPIO, I2C and
SPI over its bulk endpoints. At probe it asks the device which
functions it has, creates one auxiliary device per reported function,
and exports a transfer and an event interface to the function drivers.
LSTP does the same with more channel types, with channel IDs assigned
by the device firmware, and with device tree as well as ACPI.

A channel has no registers, no MMIO and no interrupt lines of its own;
it is a logical function of one protocol stream, and its driver needs
nothing but the core's API. That is the use the auxiliary bus
documentation describes (Documentation/driver-api/auxiliary_bus.rst):
no dependency on a physical bus, device, register accesses or regmap.
It names MFD as the wrong fit for that case, because MFD relies on the
function devices being physical devices: an MFD cell is a platform
device, and its resources are ranges of the parent's memory and
interrupts (struct mfd_cell). Firmware matching does not decide between
the two, since MFD cells can also match DT nodes and ACPI _ADR children.

The same documentation says auxiliary devices "are not physical devices
that are controlled by DT/ACPI". An LSTP channel is not enumerated from
firmware either: it exists because the device reported it. Firmware
only describes it and what is attached to it. Before
auxiliary_device_add(), the core resolves each channel's node and sets
it with device_set_node():
- device tree: a child of the interface node the USB core attached;
- ACPI: a Device() under the interface's Device(), which is a child of
  the port companion (Documentation/firmware-guide/acpi/lstp.rst);
- neither: the channel has no firmware node and works as reported.
A channel matches on its address (reg, or _ADR on ACPI) plus
compatible. The I2C, SPI and GPIO cores then enumerate children and
resolve references as for any other controller.

The UART: a plain tty_driver (patch 10)
---------------------------------------

The firmware owns the UART line: baud rate, framing, parity and flow
control are provisioned on the device and only read at probe. The host
cannot read or set modem control lines; it can send a fixed-length
break, and a carrier loss reported by the device hangs the tty up unless
CLOCAL is set. Most of serial_core's uart_ops would be stubs, and
usb-serial does not fit because it binds the whole USB interface, where
the UART is one function among several. So patch 10 registers a plain
tty_driver (TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV) with one
tty_port per channel, the structure cdc-acm uses for a UART behind USB.

set_termios keeps the hardware fields at the firmware's values, so stty
reports the real line settings. The nodes are /dev/ttyLSTP<n>, parented
on the channel's auxiliary device. Jiri, Ilpo: if you would rather see
this on serial_core despite the empty uart_ops, please say so on
patch 10.

The IPMI channel: BMC side, with a message number (patch 11)
------------------------------------------------------------

On a BMC, the IPMI channel carries the host's IPMI requests to BMC
userspace and the responses back, like ssif_bmc does for SSIF; it is
not an SSIF transport and has no host-side (ipmi_si) part. Each channel
is a character device, /dev/ipmi-lstp<n>.

By default, each message on that node carries a one-byte message number
between the length and the payload, and a response must echo the number
of the request it answers. The number exists only on the node, not in
the LSTP protocol, and no other BMC-side IPMI driver has it. It names
the request a response is for: when the host has sent a newer request,
a late response to the older one is dropped, even if userspace has
already read the newer request. Without the number, a response answers
the request read last. With CONFIG_USB_LSTP_IPMI_MSG_NUM=n the node uses
ssif_bmc's struct ipmi_ssif_msg layout instead, so userspace written for
ssif_bmc works unchanged. Corey: is the message-number layout
acceptable as an LSTP-specific extension, or would you prefer it as an
option of the generic BMC message format (and ssif_bmc)?

Responses carry no tag
----------------------

The protocol has no request tag: the first response after a request is
its answer. Two places in the series depend on that:
- The core (patch 5) drops a response that arrives when no request is
  waiting, or after the waiting request already has its answer, and
  counts it in the channel's rx_late statistic. A surplus response (a
  reply to a request that timed out, one left from before a rebind, or
  a device answering twice) therefore cannot overwrite a response the
  waiter is still reading.
- The GPIO driver (patch 6) reads every pin's interrupt configuration
  at probe. A late reply can answer the next request and shift every
  later pin's state by one, so a single read is not retried on its
  own: after a timeout, all pins are read again, in alternating order,
  until two consecutive passes without a timeout agree. That is at most
  five passes, ending within 10 s of the first timeout, or the probe
  fails as it would without the re-read. The bound is there because
  the probe runs in the context that added the device, often the hub's
  worker.

The DT nodes for IPMI and UART channels
---------------------------------------

The USB binding (patch 4) defines serial@N and ipmi@N channel nodes with
only compatible, reg and status. They exist for status = "disabled",
which stops a channel the firmware reports from being created on a
board where it must not be exposed. Without a node, a channel is still
created. The binding shape, including one vendor property
(nvidia,retries on the I2C channel), is discussed in a separate mail to
the DT maintainers sent with this series:
https://lore.kernel.org/r/20261012-lstp-dt-rfc-v1-aambrozewicz@nvidia.com

What is not in this series
--------------------------

- The MMIO channel stays out of tree: raw register access, with no
  binding and no kernel consumer.
- No auto-created spidev. The out-of-tree driver has a module parameter
  that creates a spidev on every chip select of an undescribed SPI
  channel; it is not part of this series. With CONFIG_SPI_DYNAMIC,
  userspace does that through the controller's new_device attribute:

    echo "spidev <cs>" > /sys/class/spi_master/spi<B>/new_device

  (Documentation/ABI/testing/sysfs-class-spi-master)
- No separate IPMI POST-code node and no debug fault injection; both
  stay in the out-of-tree package.

Testing
-------

The drivers were tested on arm64 and x86_64 with four kinds of device:
- real endpoints, the SMA and other vendors' implementations, driven by
  the hardware test suite of the out-of-tree package on Raspberry Pi
  hosts;
- a real SMA passed through over USB to QEMU guests running
  v7.3-rc5 with this series;
- an emulated endpoint, a raw-gadget program on dummy_hcd, playing
  scripted protocol scenarios;
- the same emulator mutating its replies at random.

The test plan covers:
- every channel type end to end: SPI flash identification, write and
  read-back verification and throughput through spidev; I2C transfers;
  GPIO values, interrupts, line names and hogs; LED default states,
  brightness and hardware patterns; UART and IPMI traffic; concurrent
  traffic on all channels;
- firmware descriptions: ACPI SSDTs and device tree overlays in many
  variants, including incomplete, mismatched and outdated ones;
- lifetime: channel driver, USB interface and module unbind, rebind and
  removal, USB disconnect and reset, with nodes open and consumers
  attached, under load, and with nodes opened as soon as they appear;
- protocol faults: late, duplicate, missing and malformed replies, and
  a disconnect in the middle of a transfer;
- allocation failures injected across the interface bind and unbind,
  the function driver probes, open, read and module load.

The kernels used KASAN with kmemleak, KCSAN and KMSAN; lockdep with
PROVE_RCU, DEBUG_OBJECTS, DEBUG_LIST, DEBUG_KOBJECT_RELEASE,
DEBUG_ATOMIC_SLEEP and UBSAN; and failslab, fail_page_alloc and
fail-nth for fault injection. None of them reported a problem in these
drivers. The only reports involving them came from gpiolib when a GPIO
chip is removed with lines still requested; the fixes are posted
separately:
https://lore.kernel.org/r/20261012-gpiolib-chip-removal-v1-0-aambrozewicz@nvidia.com

Per patch, on the posted base: each patch builds (allmodconfig, W=1,
LSTP objects) on x86_64 with gcc and clang and on arm64 and arm with
gcc; sparse; kernel-doc; checkpatch --strict (clean apart from two
MACRO_ARG_REUSE checks in patch 5); dt_binding_check on each binding;
make htmldocs adds no warnings.

The out-of-tree package these drivers come from is at
https://github.com/NVIDIA/lstp_module; the version these patches match
is the public-next-v1 tag:
https://github.com/NVIDIA/lstp_module/tree/public-next-v1
It stays as the backport for kernels without this series.

Base: usb-next at bbf6b99a57b2 ("usb: typec: ucsi_ccg: Add retry
mechanism in ccg_read").

Adrian Ambrozewicz (11):
  dt-bindings: gpio: Add NVIDIA LSTP GPIO
  dt-bindings: i2c: Add NVIDIA LSTP I2C
  dt-bindings: spi: Add NVIDIA LSTP SPI
  dt-bindings: usb: Add NVIDIA LSTP USB adapter
  usb: misc: Add NVIDIA LSTP USB adapter driver
  gpio: Add NVIDIA LSTP GPIO driver
  leds: Add NVIDIA LSTP LED driver
  i2c: Add NVIDIA LSTP I2C driver
  spi: Add NVIDIA LSTP SPI driver
  tty: Add NVIDIA LSTP UART driver
  ipmi: Add NVIDIA LSTP IPMI BMC driver

 .../ABI/testing/sysfs-bus-usb-devices-lstp    |  331 ++
 .../bindings/gpio/nvidia,lstp-gpio.yaml       |  276 ++
 .../bindings/i2c/nvidia,lstp-i2c.yaml         |   71 +
 .../bindings/spi/nvidia,lstp-spi.yaml         |   68 +
 .../devicetree/bindings/usb/nvidia,lstp.yaml  |  280 ++
 Documentation/driver-api/usb/index.rst        |    1 +
 Documentation/driver-api/usb/lstp.rst         |  276 ++
 Documentation/firmware-guide/acpi/index.rst   |    1 +
 Documentation/firmware-guide/acpi/lstp.rst    |  419 +++
 MAINTAINERS                                   |   21 +
 drivers/char/ipmi/Kconfig                     |   32 +
 drivers/char/ipmi/Makefile                    |    1 +
 drivers/char/ipmi/ipmi-lstp.c                 |  464 +++
 drivers/gpio/Kconfig                          |   14 +
 drivers/gpio/Makefile                         |    1 +
 drivers/gpio/gpio-lstp.c                      | 1194 +++++++
 drivers/i2c/busses/Kconfig                    |   13 +
 drivers/i2c/busses/Makefile                   |    1 +
 drivers/i2c/busses/i2c-lstp.c                 |  573 ++++
 drivers/leds/Kconfig                          |   14 +
 drivers/leds/Makefile                         |    1 +
 drivers/leds/leds-lstp.c                      |  404 +++
 drivers/spi/Kconfig                           |   13 +
 drivers/spi/Makefile                          |    1 +
 drivers/spi/spi-lstp.c                        |  316 ++
 drivers/tty/Kconfig                           |   13 +
 drivers/tty/Makefile                          |    1 +
 drivers/tty/lstp_tty.c                        |  829 +++++
 drivers/usb/misc/Kconfig                      |   15 +
 drivers/usb/misc/Makefile                     |    1 +
 drivers/usb/misc/lstp.c                       | 2983 +++++++++++++++++
 include/linux/usb/lstp.h                      |  219 ++
 32 files changed, 8847 insertions(+)
 create mode 100644 Documentation/ABI/testing/sysfs-bus-usb-devices-lstp
 create mode 100644 Documentation/devicetree/bindings/gpio/nvidia,lstp-gpio.yaml
 create mode 100644 Documentation/devicetree/bindings/i2c/nvidia,lstp-i2c.yaml
 create mode 100644 Documentation/devicetree/bindings/spi/nvidia,lstp-spi.yaml
 create mode 100644 Documentation/devicetree/bindings/usb/nvidia,lstp.yaml
 create mode 100644 Documentation/driver-api/usb/lstp.rst
 create mode 100644 Documentation/firmware-guide/acpi/lstp.rst
 create mode 100644 drivers/char/ipmi/ipmi-lstp.c
 create mode 100644 drivers/gpio/gpio-lstp.c
 create mode 100644 drivers/i2c/busses/i2c-lstp.c
 create mode 100644 drivers/leds/leds-lstp.c
 create mode 100644 drivers/spi/spi-lstp.c
 create mode 100644 drivers/tty/lstp_tty.c
 create mode 100644 drivers/usb/misc/lstp.c
 create mode 100644 include/linux/usb/lstp.h


base-commit: bbf6b99a57b2479bf51c3c8ad0946f4b8c33ed69
-- 
2.43.0

[PATCH 03/11] dt-bindings: spi: Add NVIDIA LSTP SPI

[Adrian Ambrozewicz]

Add the binding for an SPI controller channel of an NVIDIA LSTP USB
adapter. Peripherals on the bus are child nodes, as for any SPI
controller. The firmware reports the number of chip selects and the bus
speed; only chip selects 0 and 1 can be addressed.

Signed-off-by: Adrian Ambrozewicz <aambrozewicz@nvidia.com>
---
 .../bindings/spi/nvidia,lstp-spi.yaml         | 68 +++++++++++++++++++
 MAINTAINERS                                   |  1 +
 2 files changed, 69 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/spi/nvidia,lstp-spi.yaml

diff --git a/Documentation/devicetree/bindings/spi/nvidia,lstp-spi.yaml b/Documentation/devicetree/bindings/spi/nvidia,lstp-spi.yaml
new file mode 100644
index 000000000000..5a96faab9106
--- /dev/null
+++ b/Documentation/devicetree/bindings/spi/nvidia,lstp-spi.yaml
@@ -0,0 +1,68 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/spi/nvidia,lstp-spi.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: NVIDIA LSTP SPI Channel
+
+maintainers:
+  - Adrian Ambrozewicz <aambrozewicz@nvidia.com>
+  - Donald Shannon <donalds@nvidia.com>
+
+description: |
+  SPI controller channel on an NVIDIA LSTP USB device.
+
+  Peripherals on the bus are described as child nodes.  The number of
+  chip selects and the bus speed are reported by the device firmware;
+  only chip selects 0 and 1 can be addressed.
+
+allOf:
+  - $ref: /schemas/spi/spi-controller.yaml#
+
+properties:
+  compatible:
+    const: nvidia,lstp-spi
+
+  reg:
+    description: Channel ID reported by the device firmware.
+    maxItems: 1
+
+patternProperties:
+  "@[0-9a-f]+$":
+    type: object
+
+    properties:
+      reg:
+        description: Chip select.
+        maximum: 1
+
+      spi-max-frequency:
+        description: Must not exceed the speed reported by the device firmware.
+
+required:
+  - compatible
+  - reg
+
+unevaluatedProperties: false
+
+examples:
+  - |
+    interface {
+        #address-cells = <1>;
+        #size-cells = <0>;
+
+        spi@1 {
+            compatible = "nvidia,lstp-spi";
+            reg = <1>;
+            #address-cells = <1>;
+            #size-cells = <0>;
+
+            flash@0 {
+                compatible = "jedec,spi-nor";
+                reg = <0>;
+                spi-max-frequency = <18750000>;
+            };
+        };
+    };
diff --git a/MAINTAINERS b/MAINTAINERS
index d8092f6d91b2..a45adf95d36d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -19572,6 +19572,7 @@ L:	linux-usb@vger.kernel.org
 S:	Supported
 F:	Documentation/devicetree/bindings/gpio/nvidia,lstp-gpio.yaml
 F:	Documentation/devicetree/bindings/i2c/nvidia,lstp-i2c.yaml
+F:	Documentation/devicetree/bindings/spi/nvidia,lstp-spi.yaml
 
 NVIDIA VRS RTC DRIVER
 M:	Shubhi Garg <shgarg@nvidia.com>
-- 
2.43.0

Re: [PATCH 03/11] dt-bindings: spi: Add NVIDIA LSTP SPI

[Krzysztof Kozlowski]

On 12/10/2026 19:36, Adrian Ambrozewicz wrote:
> Add the binding for an SPI controller channel of an NVIDIA LSTP USB
> adapter. Peripherals on the bus are child nodes, as for any SPI
> controller. The firmware reports the number of chip selects and the bus
> speed; only chip selects 0 and 1 can be addressed.
> 
> Signed-off-by: Adrian Ambrozewicz <aambrozewicz@nvidia.com>
> ---
>  .../bindings/spi/nvidia,lstp-spi.yaml         | 68 +++++++++++++++++++
>  MAINTAINERS                                   |  1 +
>  2 files changed, 69 insertions(+)
>  create mode 100644 Documentation/devicetree/bindings/spi/nvidia,lstp-spi.yaml
> 
> diff --git a/Documentation/devicetree/bindings/spi/nvidia,lstp-spi.yaml b/Documentation/devicetree/bindings/spi/nvidia,lstp-spi.yaml
> new file mode 100644
> index 000000000000..5a96faab9106
> --- /dev/null
> +++ b/Documentation/devicetree/bindings/spi/nvidia,lstp-spi.yaml
> @@ -0,0 +1,68 @@
> +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
> +# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.

All comments apply here as well.

Best regards,
Krzysztof

[PATCH 09/11] spi: Add NVIDIA LSTP SPI driver

[Adrian Ambrozewicz]

Add a driver for the SPI controller channels of NVIDIA LSTP USB
adapters. Each channel is registered as an SPI host controller; devices
behind it can be described by device tree or ACPI, or created from
userspace through the controller's new_device attribute. The firmware
reports the chip selects and the bus speed.

Signed-off-by: Adrian Ambrozewicz <aambrozewicz@nvidia.com>
---
 MAINTAINERS            |   1 +
 drivers/spi/Kconfig    |  13 ++
 drivers/spi/Makefile   |   1 +
 drivers/spi/spi-lstp.c | 316 +++++++++++++++++++++++++++++++++++++++++
 4 files changed, 331 insertions(+)
 create mode 100644 drivers/spi/spi-lstp.c

diff --git a/MAINTAINERS b/MAINTAINERS
index 082c4b3a0eb6..081e3f32c840 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -19580,6 +19580,7 @@ F:	Documentation/firmware-guide/acpi/lstp.rst
 F:	drivers/gpio/gpio-lstp.c
 F:	drivers/i2c/busses/i2c-lstp.c
 F:	drivers/leds/leds-lstp.c
+F:	drivers/spi/spi-lstp.c
 F:	drivers/usb/misc/lstp.c
 F:	include/linux/usb/lstp.h
 
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index a0f37e2df716..e76abaac825c 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -694,6 +694,19 @@ config SPI_LJCA
 	  This driver can also be built as a module. If so, the module
 	  will be called spi-ljca.
 
+config SPI_LSTP
+	tristate "NVIDIA LSTP SPI support"
+	depends on USB_LSTP
+	default USB_LSTP
+	help
+	  Say Y or M here to support the SPI channels of NVIDIA LSTP USB
+	  adapters. Each channel is registered as an SPI host controller,
+	  and the devices behind it can be described by device tree, ACPI
+	  or created through spidev.
+
+	  This driver can also be built as a module. If so, the module
+	  will be called spi-lstp.
+
 config SPI_MA35D1_QSPI
 	tristate "Nuvoton MA35D1 QSPI controller"
 	depends on ARCH_MA35 || COMPILE_TEST
diff --git a/drivers/spi/Makefile b/drivers/spi/Makefile
index a18814fbde93..c0b1ea6491dd 100644
--- a/drivers/spi/Makefile
+++ b/drivers/spi/Makefile
@@ -86,6 +86,7 @@ obj-$(CONFIG_SPI_LOONGSON_CORE)		+= spi-loongson-core.o
 obj-$(CONFIG_SPI_LOONGSON_PCI)		+= spi-loongson-pci.o
 obj-$(CONFIG_SPI_LOONGSON_PLATFORM)	+= spi-loongson-plat.o
 obj-$(CONFIG_SPI_LP8841_RTC)		+= spi-lp8841-rtc.o
+obj-$(CONFIG_SPI_LSTP)			+= spi-lstp.o
 obj-$(CONFIG_SPI_MA35D1_QSPI)		+= spi-ma35d1-qspi.o
 obj-$(CONFIG_SPI_MESON_SPICC)		+= spi-meson-spicc.o
 obj-$(CONFIG_SPI_MESON_SPIFC)		+= spi-meson-spifc.o
diff --git a/drivers/spi/spi-lstp.c b/drivers/spi/spi-lstp.c
new file mode 100644
index 000000000000..7aa908e6c398
--- /dev/null
+++ b/drivers/spi/spi-lstp.c
@@ -0,0 +1,316 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * SPI driver for LSTP USB interface.
+ *
+ * Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES.  All rights reserved.
+ */
+
+#include <linux/spi/spi.h>
+#include <linux/acpi.h>
+#include <linux/err.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/property.h>
+
+#include <linux/usb/lstp.h>
+
+enum lstp_spi_cmd {
+	LSTP_SPI_CMD_READ = 0x01,
+	LSTP_SPI_CMD_WRITE = 0x02,
+	LSTP_SPI_CMD_WRITE_READ = 0x03,
+	LSTP_SPI_CMD_POSTED_WRITE = 0x04
+};
+
+/* clang-format off */
+enum lstp_spi_cmd_cs_toggle {
+	LSTP_SPI_CMD_CS_ASSERT = 0x20,
+	LSTP_SPI_CMD_CS_DEASSERT = 0x10
+};
+
+enum lstp_spi_cmd_cs_sel {
+	LSTP_SPI_CMD_CS0 = 0x00,
+	LSTP_SPI_CMD_CS1 = 0x40
+};
+
+static const u8 lstp_spi_cs_map[] = {
+	LSTP_SPI_CMD_CS0,
+	LSTP_SPI_CMD_CS1
+}; /* clang-format on */
+
+struct lstp_spi_read_req {
+	__le32 len;
+} __packed;
+
+struct lstp_spi_config {
+	u8 num_devices;
+	__le32 speed_hz;
+} __packed;
+
+struct lstp_spi_priv {
+	struct spi_controller *ctrl;
+	u32 current_speed_hz;
+};
+
+/* A transfer without data still sends a zero-length WRITE when @cs_flags moves CS. */
+static int lstp_spi_do_transfer(struct lstp_channel *ch, struct spi_transfer *xfer, u8 cs_bits,
+				u8 cs_flags)
+{
+	struct lstp_spi_priv *priv = ch->priv;
+
+	if (xfer->word_delay.value)
+		dev_warn_once(ch->dev, "%s: ch_%d: word_delay not supported, ignoring\n", __func__,
+			      ch->ch_id);
+
+	xfer->error = SPI_TRANS_FAIL_NO_START;
+	xfer->effective_speed_hz = priv->current_speed_hz;
+
+	if (xfer->len && !xfer->tx_buf && !xfer->rx_buf) {
+		dev_err_ratelimited(ch->dev, "%s: ch_%d: Transfer of %u bytes has no buffer\n",
+				    __func__, ch->ch_id, xfer->len);
+		return -EINVAL;
+	}
+	if (xfer->tx_buf && xfer->len > ch->max_tx_payload) {
+		dev_err_ratelimited(ch->dev,
+				    "%s: ch_%d: TX transfer length %u exceeds capacity %zu\n",
+				    __func__, ch->ch_id, xfer->len, ch->max_tx_payload);
+		return -EINVAL;
+	}
+	if (xfer->rx_buf && xfer->len > ch->max_rx_payload) {
+		dev_err_ratelimited(ch->dev,
+				    "%s: ch_%d: RX transfer length %u exceeds capacity %zu\n",
+				    __func__, ch->ch_id, xfer->len, ch->max_rx_payload);
+		return -EINVAL;
+	}
+
+	int ret;
+
+	if (xfer->tx_buf && xfer->rx_buf) {
+		u8 cmd = LSTP_SPI_CMD_WRITE_READ | cs_bits | cs_flags;
+
+		ret = lstp_request(ch, cmd, xfer->tx_buf, xfer->len, xfer->rx_buf, xfer->len, NULL,
+				   NULL);
+	} else if (xfer->tx_buf) {
+		u8 cmd = LSTP_SPI_CMD_WRITE | cs_bits | cs_flags;
+
+		ret = lstp_request(ch, cmd, xfer->tx_buf, xfer->len, NULL, 0, NULL, NULL);
+	} else if (xfer->rx_buf) {
+		struct lstp_spi_read_req req = { .len = cpu_to_le32(xfer->len) };
+		u8 cmd = LSTP_SPI_CMD_READ | cs_bits | cs_flags;
+
+		ret = lstp_request(ch, cmd, &req, sizeof(req), xfer->rx_buf, xfer->len, NULL, NULL);
+	} else if (cs_flags) {
+		u8 cmd = LSTP_SPI_CMD_WRITE | cs_bits | cs_flags;
+
+		ret = lstp_request(ch, cmd, NULL, 0, NULL, 0, NULL, NULL);
+	} else {
+		/* No data and no CS change; only the caller's delay is left to do. */
+		ret = 0;
+	}
+
+	if (ret) {
+		if (ret != -ENODEV)
+			dev_err_ratelimited(ch->dev, "%s: ch_%d: Transfer failed (%pe)\n", __func__,
+					    ch->ch_id, ERR_PTR(ret));
+		xfer->error = SPI_TRANS_FAIL_IO;
+		return ret;
+	}
+
+	xfer->error = 0;
+	return 0;
+}
+
+/*
+ * CS edges ride in each transfer's command byte rather than in a set_cs callback, which would
+ * cost a USB round trip per edge.
+ */
+static int lstp_spi_transfer_one_message(struct spi_controller *ctrl, struct spi_message *mesg)
+{
+	struct lstp_channel *ch = spi_controller_get_devdata(ctrl);
+	struct spi_transfer *xfer;
+	u8 chip_select = spi_get_chipselect(mesg->spi, 0);
+	int ret = 0;
+	bool cs_active = false;
+
+	if (chip_select >= ctrl->num_chipselect) {
+		dev_err_ratelimited(ch->dev, "%s: ch_%d: Invalid chip select %u (max %u)\n",
+				    __func__, ch->ch_id, chip_select, ctrl->num_chipselect - 1);
+		ret = -EINVAL;
+		goto finalize;
+	}
+
+	u8 cs_bits = lstp_spi_cs_map[chip_select];
+
+	list_for_each_entry(xfer, &mesg->transfers, transfer_list) {
+		u8 cs_flags = 0;
+		bool is_last = list_is_last(&xfer->transfer_list, &mesg->transfers);
+		bool no_data = !xfer->tx_buf && !xfer->rx_buf;
+
+		if (!cs_active) {
+			cs_flags |= LSTP_SPI_CMD_CS_ASSERT;
+			cs_active = true;
+		}
+
+		if ((is_last && !xfer->cs_change) || (!is_last && xfer->cs_change)) {
+			cs_flags |= LSTP_SPI_CMD_CS_DEASSERT;
+			cs_active = false;
+		}
+
+		/* A data transfer fuses delay and CS edge into one command; CS-only waits first. */
+		if (no_data)
+			spi_transfer_delay_exec(xfer);
+
+		ret = lstp_spi_do_transfer(ch, xfer, cs_bits, cs_flags);
+		if (ret)
+			break;
+
+		mesg->actual_length += xfer->len;
+
+		if (!is_last && xfer->cs_change)
+			spi_transfer_cs_change_delay_exec(mesg, xfer);
+
+		if (!no_data)
+			spi_transfer_delay_exec(xfer);
+	}
+
+finalize:
+	mesg->status = ret;
+	spi_finalize_current_message(ctrl);
+	return ret;
+}
+
+/* spi_setup() path: firmware owns CS, so cs_setup/cs_hold/cs_inactive are only warned about. */
+static int lstp_spi_set_cs_timing(struct spi_device *spi)
+{
+	struct lstp_channel *ch = spi_controller_get_devdata(spi->controller);
+
+	if (spi->cs_setup.value || spi->cs_hold.value || spi->cs_inactive.value)
+		dev_warn_ratelimited(ch->dev,
+				     "%s: ch_%d: CS timing delays not supported, ignoring\n",
+				     __func__, ch->ch_id);
+	return 0;
+}
+
+static size_t lstp_spi_max_xfer_size(struct spi_device *spi)
+{
+	struct lstp_channel *ch = spi_controller_get_devdata(spi->controller);
+
+	return min(ch->max_tx_payload, ch->max_rx_payload);
+}
+
+/*
+ * Device tree lists peripherals as children of the channel node, so an empty node is an
+ * incomplete description. ACPI resolves SpiSerialBus() resources from anywhere in the namespace,
+ * and the SPI core enumerates nothing from a software node.
+ */
+static void lstp_spi_enumerate(struct lstp_channel *ch, struct spi_controller *ctrl)
+{
+	if (is_of_node(ch->fwnode)) {
+		unsigned int child_count = 0;
+		struct fwnode_handle *child;
+
+		fwnode_for_each_available_child_node(ch->fwnode, child)
+			child_count++;
+
+		if (child_count == 0) {
+			dev_warn(ch->dev,
+				 "%s: ch_%d: Firmware node present but defines no SPI devices\n",
+				 __func__, ch->ch_id);
+		} else {
+			dev_info(ch->dev, "%s: ch_%d: Firmware node present with %u SPI devices\n",
+				 __func__, ch->ch_id, child_count);
+		}
+	} else if (is_acpi_node(ch->fwnode)) {
+		dev_info(ch->dev,
+			 "%s: ch_%d: ACPI describes this channel; its peripherals resolve from the namespace\n",
+			 __func__, ch->ch_id);
+	} else if (ch->fwnode) {
+		dev_warn(ch->dev,
+			 "%s: ch_%d: Software node describes this channel, so no SPI devices are enumerated for it\n",
+			 __func__, ch->ch_id);
+	}
+}
+
+static int lstp_spi_probe(struct auxiliary_device *auxdev, const struct auxiliary_device_id *id)
+{
+	struct lstp_channel *ch = lstp_channel_from_auxdev(auxdev);
+	const struct lstp_channel_init_info *info = dev_get_platdata(&auxdev->dev);
+
+	if (!info)
+		return -ENODEV;
+
+	if (info->config_len < sizeof(struct lstp_spi_config)) {
+		dev_err(ch->dev, "%s: ch_%d: SPI config too short: %zu < %zu\n", __func__,
+			ch->ch_id, info->config_len, sizeof(struct lstp_spi_config));
+		return -EINVAL;
+	}
+
+	const struct lstp_spi_config *config = info->config;
+	struct lstp_spi_priv *priv = devm_kzalloc(ch->dev, sizeof(*priv), GFP_KERNEL);
+
+	if (!priv)
+		return -ENOMEM;
+
+	struct spi_controller *ctrl = devm_spi_alloc_host(ch->dev, 0);
+
+	if (!ctrl)
+		return -ENOMEM;
+
+	u8 num_devices = config->num_devices;
+	u32 speed_hz = le32_to_cpu(config->speed_hz);
+
+	if (num_devices == 0 || num_devices > ARRAY_SIZE(lstp_spi_cs_map)) {
+		dev_err(ch->dev, "%s: ch_%d: Invalid num_devices %u (max %zu)\n", __func__,
+			ch->ch_id, num_devices, ARRAY_SIZE(lstp_spi_cs_map));
+		return -EINVAL;
+	}
+
+	if (speed_hz == 0) {
+		dev_err(ch->dev, "%s: ch_%d: Device returned SPI speed of %u Hz\n", __func__,
+			ch->ch_id, speed_hz);
+		return -EINVAL;
+	}
+
+	spi_controller_set_devdata(ctrl, ch);
+	ctrl->bus_num = -1;
+	ctrl->num_chipselect = num_devices;
+	ctrl->transfer_one_message = lstp_spi_transfer_one_message;
+	ctrl->max_transfer_size = lstp_spi_max_xfer_size;
+	ctrl->set_cs_timing = lstp_spi_set_cs_timing;
+
+	device_set_node(&ctrl->dev, ch->fwnode);
+
+	priv->ctrl = ctrl;
+	priv->current_speed_hz = speed_hz;
+	/* Registration probes peripherals, which may transfer at once; transfers read @ch->priv. */
+	ch->priv = priv;
+
+	int ret = devm_spi_register_controller(ch->dev, ctrl);
+
+	if (ret) {
+		dev_err(ch->dev, "%s: ch_%d: Could not register SPI controller (%pe)\n", __func__,
+			ch->ch_id, ERR_PTR(ret));
+		return ret;
+	}
+
+	lstp_spi_enumerate(ch, ctrl);
+
+	dev_info(ch->dev, "%s: ch_%d: Started as %s (devices=%u, speed=%u Hz)\n", __func__,
+		 ch->ch_id, ch->display_name, ctrl->num_chipselect, priv->current_speed_hz);
+	return 0;
+}
+
+static const struct auxiliary_device_id lstp_spi_id_table[] = { { .name = "lstp.spi" }, {} };
+MODULE_DEVICE_TABLE(auxiliary, lstp_spi_id_table);
+
+static struct lstp_auxiliary_driver lstp_spi_drv = {
+	.adrv = {
+		.name = "spi",
+		.probe = lstp_spi_probe,
+		.id_table = lstp_spi_id_table,
+	},
+};
+module_lstp_auxiliary_driver(lstp_spi_drv);
+
+MODULE_IMPORT_NS("LSTP");
+MODULE_DESCRIPTION("LSTP SPI driver");
+MODULE_LICENSE("GPL");
-- 
2.43.0

Re: [PATCH 00/11] Add NVIDIA LSTP USB adapter drivers

[Greg Kroah-Hartman]

On Mon, Oct 12, 2026 at 08:35:58PM +0300, Adrian Ambrozewicz wrote:
> This series adds drivers for the NVIDIA LSTP USB adapter: a USB core
> driver and GPIO, LED, I2C, SPI, UART and BMC-side IPMI function drivers,
> with their device tree bindings, an ACPI description document and the
> sysfs ABI.

Why would a USB device have anything to do with device tree?

> What LSTP is
> ------------
> 
> LSTP (Low-Speed Transport Protocol or Low-Speed Tunnelling Protocol) is
> a vendor-specific USB interface (class 0xff, subclass 0x3f) that
> multiplexes several low-speed "channels" over one pair of bulk
> endpoints. It is implemented by NVIDIA's SMA, an MCU (0955:cf11), and
> by other vendors' parts: two hub/bridge chips have it built in
> (0424:4940, 174c:2214). Boards use it to
> reach SPI flash, I2C sensors, GPIOs and LEDs, a UART and a host-to-BMC
> IPMI path, on both BMCs and host systems.

Cute, but that's a total abuse of the USB standard.  Why wasn't this
implemented by the proper "each channel is a USB interface" model
instead?  Have the firmware engineers there not read the USB spec?

> The channel types are SPI host, I2C host, GPIO (with interrupts and LED
> pins), UART, IPMI and MMIO. Channel 0 is the control channel: at probe
> the driver reads the channel table from it, which gives each channel's
> ID, type and configuration. The set of channels is decided by the
> firmware, so the same VID:PID carries different channels on different
> boards. No firmware description is needed for the channels to work.

Again cute, but that's not how USB devices are supposed to work, why
would we want to do this at all?

> Series layout
> -------------
> 
>    1  dt-bindings: gpio: Add NVIDIA LSTP GPIO
>    2  dt-bindings: i2c: Add NVIDIA LSTP I2C
>    3  dt-bindings: spi: Add NVIDIA LSTP SPI
>    4  dt-bindings: usb: Add NVIDIA LSTP USB adapter

USB devices do not have DT bindings.  It's a dynamic bus, with
self-describing devices, don't make the mistake of thinking this is
giong to work.

>    5  usb: misc: Add NVIDIA LSTP USB adapter driver
>    6  gpio: Add NVIDIA LSTP GPIO driver
>    7  leds: Add NVIDIA LSTP LED driver
>    8  i2c: Add NVIDIA LSTP I2C driver
>    9  spi: Add NVIDIA LSTP SPI driver
>   10  tty: Add NVIDIA LSTP UART driver
>   11  ipmi: Add NVIDIA LSTP IPMI BMC driver

So you have a custom "bus" for a single USB device/interface?  Ick,
again, why?  Please do this the "proper" way in your firmware and do
this one-device-per-usb-interface like the rest of the world does
please.

Doing it that way will not cost any more hardware pins at all, it's all
handled in firmware, and as you all have complete control over the
firmware, you can fix this up now to do things properly.

> Patch 4 $refs the schemas from patches 1-3, so it comes last among the
> bindings; it also defines the serial@N and ipmi@N channel nodes inline.
> The MAINTAINERS entry starts in patch 1 and gains each later patch's
> files. Patch 5 carries:
> - the core in drivers/usb/misc/;
> - include/linux/usb/lstp.h for the function drivers;
> - the sysfs ABI file;
> - Documentation/driver-api/usb/lstp.rst;
> - Documentation/firmware-guide/acpi/lstp.rst.
> 
> Patches 6 and 8-11 each depend only on patch 5; patch 7 (LEDs) also
> needs patch 6, whose GPIO driver hands the LED pins to it.
> 
> Why the auxiliary bus, and why not MFD
> --------------------------------------

Neither is ok for USB devices, that's not an argument either way.

Please go talk to some people with USB spec experience on how to make a
multi-function device correctly.  This way sure does not look like it at
all.

thanks,

greg k-h

Re: [PATCH 00/11] Add NVIDIA LSTP USB adapter drivers

[Greg Kroah-Hartman]

On Mon, Oct 12, 2026 at 08:35:58PM +0300, Adrian Ambrozewicz wrote:
> This series adds drivers for the NVIDIA LSTP USB adapter: a USB core
> driver and GPIO, LED, I2C, SPI, UART and BMC-side IPMI function drivers,
> with their device tree bindings, an ACPI description document and the
> sysfs ABI.
> 
> What LSTP is
> ------------
> 
> LSTP (Low-Speed Transport Protocol or Low-Speed Tunnelling Protocol) is
> a vendor-specific USB interface (class 0xff, subclass 0x3f) that
> multiplexes several low-speed "channels" over one pair of bulk
> endpoints. It is implemented by NVIDIA's SMA, an MCU (0955:cf11), and
> by other vendors' parts: two hub/bridge chips have it built in
> (0424:4940, 174c:2214). Boards use it to
> reach SPI flash, I2C sensors, GPIOs and LEDs, a UART and a host-to-BMC
> IPMI path, on both BMCs and host systems.

Also, if you really want to do this in a dynamic way, use greybus, as
that is EXPLICITLY what it was designed for, and is patent-free (i.e.
unencumbered, and we already support it in the kernel.)  Please don't
reinvent the wheel/spec just because no one did any prior-art
research...

thanks,

greg k-h