Several tb_domain* helpers return -EPERM when the corresponding cm_ops
callback is NULL. A NULL callback indicates the operation is not
supported by the connection manager, not a permission denial.

Switch these sites to return -ENOTSUPP when the cm_ops callback is
absent: disapprove_switch, approve_switch, approve_switch_key,
challenge_switch_key, and disconnect_pcie_paths.

Fixes: e6b245ccd524 ("thunderbolt: Add support for host and device NVM firmware upgrade")
Fixes: f67cf491175a ("thunderbolt: Add support for Internal Connection Manager (ICM)")
Fixes: 3da88be24997 ("thunderbolt: Add support for de-authorizing devices")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
---
 drivers/thunderbolt/domain.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/thunderbolt/domain.c b/drivers/thunderbolt/domain.c
index 83defc915d33..2e88a821ef08 100644
--- a/drivers/thunderbolt/domain.c
+++ b/drivers/thunderbolt/domain.c
@@ -635,7 +635,7 @@ int tb_domain_runtime_resume(struct tb *tb)
 int tb_domain_disapprove_switch(struct tb *tb, struct tb_switch *sw)
 {
 	if (!tb->cm_ops->disapprove_switch)
-		return -EPERM;
+		return -ENOTSUPP;
 
 	return tb->cm_ops->disapprove_switch(tb, sw);
 }
@@ -656,7 +656,7 @@ int tb_domain_approve_switch(struct tb *tb, struct tb_switch *sw)
 	struct tb_switch *parent_sw;
 
 	if (!tb->cm_ops->approve_switch)
-		return -EPERM;
+		return -ENOTSUPP;
 
 	/* The parent switch must be authorized before this one */
 	parent_sw = tb_to_switch(sw->dev.parent);
@@ -683,7 +683,7 @@ int tb_domain_approve_switch_key(struct tb *tb, struct tb_switch *sw)
 	int ret;
 
 	if (!tb->cm_ops->approve_switch || !tb->cm_ops->add_switch_key)
-		return -EPERM;
+		return -ENOTSUPP;
 
 	/* The parent switch must be authorized before this one */
 	parent_sw = tb_to_switch(sw->dev.parent);
@@ -718,7 +718,7 @@ int tb_domain_challenge_switch_key(struct tb *tb, struct tb_switch *sw)
 	int ret;
 
 	if (!tb->cm_ops->approve_switch || !tb->cm_ops->challenge_switch_key)
-		return -EPERM;
+		return -ENOTSUPP;
 
 	/* The parent switch must be authorized before this one */
 	parent_sw = tb_to_switch(sw->dev.parent);
@@ -753,7 +753,7 @@ int tb_domain_challenge_switch_key(struct tb *tb, struct tb_switch *sw)
 int tb_domain_disconnect_pcie_paths(struct tb *tb)
 {
 	if (!tb->cm_ops->disconnect_pcie_paths)
-		return -EPERM;
+		return -ENOTSUPP;
 
 	return tb->cm_ops->disconnect_pcie_paths(tb);
 }
-- 
2.25.1

Hi,

On Thu, Dec 04, 2025 at 05:32:24PM +0800, Haotian Zhang wrote:
> Several tb_domain* helpers return -EPERM when the corresponding cm_ops
> callback is NULL. A NULL callback indicates the operation is not
> supported by the connection manager, not a permission denial.

These specifically return -EPERM on purpose because these are used when
PCIe tunnel is established and torn down. If the connection manager
implementation does not provide them it means you don't have permission to
deal with the PCIe tunnels.