--- /dev/null
+From stable+bounces-172400-greg=kroah.com@vger.kernel.org Fri Aug 22 16:07:07 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 09:59:41 -0400
+Subject: arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support
+To: stable@vger.kernel.org
+Cc: Judith Mendez <jm@ti.com>, Vignesh Raghavendra <vigneshr@ti.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250822135941.1245318-1-sashal@kernel.org>
+
+From: Judith Mendez <jm@ti.com>
+
+[ Upstream commit 265f70af805f33a0dfc90f50cc0f116f702c3811 ]
+
+For eMMC, High Speed DDR mode is not supported [0], so remove
+mmc-ddr-1_8v flag which adds the capability.
+
+[0] https://www.ti.com/lit/gpn/am625
+
+Fixes: c37c58fdeb8a ("arm64: dts: ti: k3-am62: Add more peripheral nodes")
+Cc: stable@vger.kernel.org
+Signed-off-by: Judith Mendez <jm@ti.com>
+Link: https://lore.kernel.org/r/20250707191250.3953990-1-jm@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+[ adapted context ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/ti/k3-am62-main.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi
+@@ -531,7 +531,6 @@
+ clock-names = "clk_ahb", "clk_xin";
+ assigned-clocks = <&k3_clks 57 6>;
+ assigned-clock-parents = <&k3_clks 57 8>;
+- mmc-ddr-1_8v;
+ mmc-hs200-1_8v;
+ ti,trm-icp = <0x2>;
+ bus-width = <8>;
--- /dev/null
+From stable+bounces-172426-greg=kroah.com@vger.kernel.org Fri Aug 22 16:27:59 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 10:19:40 -0400
+Subject: ext4: preserve SB_I_VERSION on remount
+To: stable@vger.kernel.org
+Cc: Baokun Li <libaokun1@huawei.com>, stable@kernel.org, Jan Kara <jack@suse.cz>, Theodore Ts'o <tytso@mit.edu>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250822141940.1257026-1-sashal@kernel.org>
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit f2326fd14a224e4cccbab89e14c52279ff79b7ec ]
+
+IMA testing revealed that after an ext4 remount, file accesses triggered
+full measurements even without modifications, instead of skipping as
+expected when i_version is unchanged.
+
+Debugging showed `SB_I_VERSION` was cleared in reconfigure_super() during
+remount due to commit 1ff20307393e ("ext4: unconditionally enable the
+i_version counter") removing the fix from commit 960e0ab63b2e ("ext4: fix
+i_version handling on remount").
+
+To rectify this, `SB_I_VERSION` is always set for `fc->sb_flags` in
+ext4_init_fs_context(), instead of `sb->s_flags` in __ext4_fill_super(),
+ensuring it persists across all mounts.
+
+Cc: stable@kernel.org
+Fixes: 1ff20307393e ("ext4: unconditionally enable the i_version counter")
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://patch.msgid.link/20250703073903.6952-2-libaokun@huaweicloud.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+[ Adjust context ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/super.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2028,6 +2028,9 @@ int ext4_init_fs_context(struct fs_conte
+ fc->fs_private = ctx;
+ fc->ops = &ext4_context_ops;
+
++ /* i_version is always enabled now */
++ fc->sb_flags |= SB_I_VERSION;
++
+ return 0;
+ }
+
+@@ -5305,9 +5308,6 @@ static int __ext4_fill_super(struct fs_c
+ sb->s_flags = (sb->s_flags & ~SB_POSIXACL) |
+ (test_opt(sb, POSIX_ACL) ? SB_POSIXACL : 0);
+
+- /* i_version is always enabled now */
+- sb->s_flags |= SB_I_VERSION;
+-
+ err = ext4_check_feature_compatibility(sb, es, silent);
+ if (err)
+ goto failed_mount;
--- /dev/null
+From stable+bounces-172513-greg=kroah.com@vger.kernel.org Fri Aug 22 22:27:27 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 16:27:13 -0400
+Subject: PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features
+To: stable@vger.kernel.org
+Cc: Richard Zhu <hongxing.zhu@nxp.com>, Bjorn Helgaas <bhelgaas@google.com>, Frank Li <Frank.Li@nxp.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250822202713.1483619-1-sashal@kernel.org>
+
+From: Richard Zhu <hongxing.zhu@nxp.com>
+
+[ Upstream commit 399444a87acdea5d21c218bc8e9b621fea1cd218 ]
+
+For IMX8MM_EP and IMX8MP_EP, add fixed 256-byte BAR 4 and reserved BAR 5
+in imx8m_pcie_epc_features.
+
+Fixes: 75c2f26da03f ("PCI: imx6: Add i.MX PCIe EP mode support")
+Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
+[bhelgaas: add details in subject]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20250708091003.2582846-3-hongxing.zhu@nxp.com
+[ Adapted BAR configuration to use reserved_bar bitmap and bar_fixed_size ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/controller/dwc/pci-imx6.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/controller/dwc/pci-imx6.c
++++ b/drivers/pci/controller/dwc/pci-imx6.c
+@@ -1043,7 +1043,10 @@ static const struct pci_epc_features imx
+ .linkup_notifier = false,
+ .msi_capable = true,
+ .msix_capable = false,
+- .reserved_bar = 1 << BAR_1 | 1 << BAR_3,
++ .reserved_bar = 1 << BAR_1 | 1 << BAR_3 | 1 << BAR_5,
++ .bar_fixed_size = {
++ [BAR_4] = SZ_256,
++ },
+ .align = SZ_64K,
+ };
+
--- /dev/null
+From stable+bounces-172517-greg=kroah.com@vger.kernel.org Fri Aug 22 22:41:04 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 16:40:52 -0400
+Subject: PCI: imx6: Delay link start until configfs 'start' written
+To: stable@vger.kernel.org
+Cc: Richard Zhu <hongxing.zhu@nxp.com>, Manivannan Sadhasivam <mani@kernel.org>, Bjorn Helgaas <bhelgaas@google.com>, Frank Li <Frank.Li@nxp.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250822204052.1519937-1-sashal@kernel.org>
+
+From: Richard Zhu <hongxing.zhu@nxp.com>
+
+[ Upstream commit 2e6ea70690ddd1ffa422423fd0d4523e4dfe4b62 ]
+
+According to Documentation/PCI/endpoint/pci-endpoint-cfs.rst, the Endpoint
+controller (EPC) should only start the link when userspace writes '1' to
+the '/sys/kernel/config/pci_ep/controllers/<EPC>/start' attribute, which
+ultimately results in calling imx_pcie_start_link() via
+pci_epc_start_store().
+
+To align with the documented behavior, do not start the link automatically
+when adding the EP controller.
+
+Fixes: 75c2f26da03f ("PCI: imx6: Add i.MX PCIe EP mode support")
+Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
+[mani: reworded commit subject and description]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+[bhelgaas: commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20250709033722.2924372-3-hongxing.zhu@nxp.com
+[ imx_pcie_ltssm_enable() => imx6_pcie_ltssm_enable() ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/controller/dwc/pci-imx6.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/pci/controller/dwc/pci-imx6.c
++++ b/drivers/pci/controller/dwc/pci-imx6.c
+@@ -1098,8 +1098,6 @@ static int imx6_add_pcie_ep(struct imx6_
+ dev_err(dev, "failed to initialize endpoint\n");
+ return ret;
+ }
+- /* Start LTSSM. */
+- imx6_pcie_ltssm_enable(dev);
+
+ return 0;
+ }
--- /dev/null
+From stable+bounces-172519-greg=kroah.com@vger.kernel.org Fri Aug 22 22:41:13 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 16:40:59 -0400
+Subject: PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining
+To: stable@vger.kernel.org
+Cc: Geraldo Nascimento <geraldogabriel@gmail.com>, Manivannan Sadhasivam <mani@kernel.org>, Bjorn Helgaas <bhelgaas@google.com>, Robin Murphy <robin.murphy@arm.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250822204059.1520239-2-sashal@kernel.org>
+
+From: Geraldo Nascimento <geraldogabriel@gmail.com>
+
+[ Upstream commit 114b06ee108cabc82b995fbac6672230a9776936 ]
+
+Rockchip controllers can support up to 5.0 GT/s link speed. But the driver
+doesn't set the Target Link Speed currently. This may cause failure in
+retraining the link to 5.0 GT/s if supported by the endpoint. So set the
+Target Link Speed to 5.0 GT/s in the Link Control and Status Register 2.
+
+Fixes: e77f847df54c ("PCI: rockchip: Add Rockchip PCIe controller support")
+Signed-off-by: Geraldo Nascimento <geraldogabriel@gmail.com>
+[mani: fixed whitespace warning, commit message rewording, added fixes tag]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Robin Murphy <robin.murphy@arm.com>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/0afa6bc47b7f50e2e81b0b47d51c66feb0fb565f.1751322015.git.geraldogabriel@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/controller/pcie-rockchip-host.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/pci/controller/pcie-rockchip-host.c
++++ b/drivers/pci/controller/pcie-rockchip-host.c
+@@ -339,6 +339,10 @@ static int rockchip_pcie_host_init_port(
+ * Enable retrain for gen2. This should be configured only after
+ * gen1 finished.
+ */
++ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL2);
++ status &= ~PCI_EXP_LNKCTL2_TLS;
++ status |= PCI_EXP_LNKCTL2_TLS_5_0GT;
++ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL2);
+ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL);
+ status |= PCI_EXP_LNKCTL_RL;
+ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL);
--- /dev/null
+From stable+bounces-172518-greg=kroah.com@vger.kernel.org Fri Aug 22 22:41:09 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 16:40:58 -0400
+Subject: PCI: rockchip: Use standard PCIe definitions
+To: stable@vger.kernel.org
+Cc: Geraldo Nascimento <geraldogabriel@gmail.com>, Bjorn Helgaas <bhelgaas@google.com>, Manivannan Sadhasivam <mani@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250822204059.1520239-1-sashal@kernel.org>
+
+From: Geraldo Nascimento <geraldogabriel@gmail.com>
+
+[ Upstream commit cbbfe9f683f0f9b6a1da2eaa53b995a4b5961086 ]
+
+Current code uses custom-defined register offsets and bitfields for the
+standard PCIe registers. This creates duplication as the PCI header already
+defines them. So, switch to using the standard PCIe definitions and drop
+the custom ones.
+
+Suggested-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Geraldo Nascimento <geraldogabriel@gmail.com>
+[mani: commit message rewording]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+[bhelgaas: include bitfield.h]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/e81700ef4b49f584bc8834bfb07b6d8995fc1f42.1751322015.git.geraldogabriel@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/controller/pcie-rockchip-host.c | 45 ++++++++++++++--------------
+ drivers/pci/controller/pcie-rockchip.h | 11 ------
+ 2 files changed, 24 insertions(+), 32 deletions(-)
+
+--- a/drivers/pci/controller/pcie-rockchip-host.c
++++ b/drivers/pci/controller/pcie-rockchip-host.c
+@@ -11,6 +11,7 @@
+ * ARM PCI Host generic driver.
+ */
+
++#include <linux/bitfield.h>
+ #include <linux/bitrev.h>
+ #include <linux/clk.h>
+ #include <linux/delay.h>
+@@ -40,18 +41,18 @@ static void rockchip_pcie_enable_bw_int(
+ {
+ u32 status;
+
+- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_LCS);
++ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL);
+ status |= (PCI_EXP_LNKCTL_LBMIE | PCI_EXP_LNKCTL_LABIE);
+- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_LCS);
++ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL);
+ }
+
+ static void rockchip_pcie_clr_bw_int(struct rockchip_pcie *rockchip)
+ {
+ u32 status;
+
+- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_LCS);
++ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL);
+ status |= (PCI_EXP_LNKSTA_LBMS | PCI_EXP_LNKSTA_LABS) << 16;
+- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_LCS);
++ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL);
+ }
+
+ static void rockchip_pcie_update_txcredit_mui(struct rockchip_pcie *rockchip)
+@@ -269,7 +270,7 @@ static void rockchip_pcie_set_power_limi
+ scale = 3; /* 0.001x */
+ curr = curr / 1000; /* convert to mA */
+ power = (curr * 3300) / 1000; /* milliwatt */
+- while (power > PCIE_RC_CONFIG_DCR_CSPL_LIMIT) {
++ while (power > FIELD_MAX(PCI_EXP_DEVCAP_PWR_VAL)) {
+ if (!scale) {
+ dev_warn(rockchip->dev, "invalid power supply\n");
+ return;
+@@ -278,10 +279,10 @@ static void rockchip_pcie_set_power_limi
+ power = power / 10;
+ }
+
+- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_DCR);
+- status |= (power << PCIE_RC_CONFIG_DCR_CSPL_SHIFT) |
+- (scale << PCIE_RC_CONFIG_DCR_CPLS_SHIFT);
+- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_DCR);
++ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_DEVCAP);
++ status |= FIELD_PREP(PCI_EXP_DEVCAP_PWR_VAL, power);
++ status |= FIELD_PREP(PCI_EXP_DEVCAP_PWR_SCL, scale);
++ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_DEVCAP);
+ }
+
+ /**
+@@ -309,14 +310,14 @@ static int rockchip_pcie_host_init_port(
+ rockchip_pcie_set_power_limit(rockchip);
+
+ /* Set RC's clock architecture as common clock */
+- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_LCS);
++ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL);
+ status |= PCI_EXP_LNKSTA_SLC << 16;
+- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_LCS);
++ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL);
+
+ /* Set RC's RCB to 128 */
+- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_LCS);
++ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL);
+ status |= PCI_EXP_LNKCTL_RCB;
+- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_LCS);
++ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL);
+
+ /* Enable Gen1 training */
+ rockchip_pcie_write(rockchip, PCIE_CLIENT_LINK_TRAIN_ENABLE,
+@@ -338,9 +339,9 @@ static int rockchip_pcie_host_init_port(
+ * Enable retrain for gen2. This should be configured only after
+ * gen1 finished.
+ */
+- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_LCS);
++ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL);
+ status |= PCI_EXP_LNKCTL_RL;
+- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_LCS);
++ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL);
+
+ err = readl_poll_timeout(rockchip->apb_base + PCIE_CORE_CTRL,
+ status, PCIE_LINK_IS_GEN2(status), 20,
+@@ -377,15 +378,15 @@ static int rockchip_pcie_host_init_port(
+
+ /* Clear L0s from RC's link cap */
+ if (of_property_read_bool(dev->of_node, "aspm-no-l0s")) {
+- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_LINK_CAP);
+- status &= ~PCIE_RC_CONFIG_LINK_CAP_L0S;
+- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_LINK_CAP);
++ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCAP);
++ status &= ~PCI_EXP_LNKCAP_ASPM_L0S;
++ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCAP);
+ }
+
+- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_DCSR);
+- status &= ~PCIE_RC_CONFIG_DCSR_MPS_MASK;
+- status |= PCIE_RC_CONFIG_DCSR_MPS_256;
+- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_DCSR);
++ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_DEVCTL);
++ status &= ~PCI_EXP_DEVCTL_PAYLOAD;
++ status |= PCI_EXP_DEVCTL_PAYLOAD_256B;
++ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_DEVCTL);
+
+ return 0;
+ err_power_off_phy:
+--- a/drivers/pci/controller/pcie-rockchip.h
++++ b/drivers/pci/controller/pcie-rockchip.h
+@@ -144,16 +144,7 @@
+ #define PCIE_EP_CONFIG_BASE 0xa00000
+ #define PCIE_EP_CONFIG_DID_VID (PCIE_EP_CONFIG_BASE + 0x00)
+ #define PCIE_RC_CONFIG_RID_CCR (PCIE_RC_CONFIG_BASE + 0x08)
+-#define PCIE_RC_CONFIG_DCR (PCIE_RC_CONFIG_BASE + 0xc4)
+-#define PCIE_RC_CONFIG_DCR_CSPL_SHIFT 18
+-#define PCIE_RC_CONFIG_DCR_CSPL_LIMIT 0xff
+-#define PCIE_RC_CONFIG_DCR_CPLS_SHIFT 26
+-#define PCIE_RC_CONFIG_DCSR (PCIE_RC_CONFIG_BASE + 0xc8)
+-#define PCIE_RC_CONFIG_DCSR_MPS_MASK GENMASK(7, 5)
+-#define PCIE_RC_CONFIG_DCSR_MPS_256 (0x1 << 5)
+-#define PCIE_RC_CONFIG_LINK_CAP (PCIE_RC_CONFIG_BASE + 0xcc)
+-#define PCIE_RC_CONFIG_LINK_CAP_L0S BIT(10)
+-#define PCIE_RC_CONFIG_LCS (PCIE_RC_CONFIG_BASE + 0xd0)
++#define PCIE_RC_CONFIG_CR (PCIE_RC_CONFIG_BASE + 0xc0)
+ #define PCIE_RC_CONFIG_L1_SUBSTATE_CTRL2 (PCIE_RC_CONFIG_BASE + 0x90c)
+ #define PCIE_RC_CONFIG_THP_CAP (PCIE_RC_CONFIG_BASE + 0x274)
+ #define PCIE_RC_CONFIG_THP_CAP_NEXT_MASK GENMASK(31, 20)
--- /dev/null
+From stable+bounces-172452-greg=kroah.com@vger.kernel.org Fri Aug 22 17:13:57 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 10:59:41 -0400
+Subject: scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers
+To: stable@vger.kernel.org
+Cc: Ranjan Kumar <ranjan.kumar@broadcom.com>, "Martin K. Petersen" <martin.petersen@oracle.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250822145943.1276044-1-sashal@kernel.org>
+
+From: Ranjan Kumar <ranjan.kumar@broadcom.com>
+
+[ Upstream commit 6853885b21cb1d7157cc14c9d30cc17141565bae ]
+
+The volatile qualifier is redundant for __iomem pointers.
+
+Cleaned up usage in mpi3mr_writeq() and sysif_regs pointer as per
+Upstream compliance.
+
+Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
+Link: https://lore.kernel.org/r/20250627194539.48851-3-ranjan.kumar@broadcom.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: c91e140c82eb ("scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/mpi3mr/mpi3mr.h | 2 +-
+ drivers/scsi/mpi3mr/mpi3mr_fw.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/scsi/mpi3mr/mpi3mr.h
++++ b/drivers/scsi/mpi3mr/mpi3mr.h
+@@ -1055,7 +1055,7 @@ struct mpi3mr_ioc {
+ char name[MPI3MR_NAME_LENGTH];
+ char driver_name[MPI3MR_NAME_LENGTH];
+
+- volatile struct mpi3_sysif_registers __iomem *sysif_regs;
++ struct mpi3_sysif_registers __iomem *sysif_regs;
+ resource_size_t sysif_regs_phys;
+ int bars;
+ u64 dma_mask;
+--- a/drivers/scsi/mpi3mr/mpi3mr_fw.c
++++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c
+@@ -23,12 +23,12 @@ module_param(poll_queues, int, 0444);
+ MODULE_PARM_DESC(poll_queues, "Number of queues for io_uring poll mode. (Range 1 - 126)");
+
+ #if defined(writeq) && defined(CONFIG_64BIT)
+-static inline void mpi3mr_writeq(__u64 b, volatile void __iomem *addr)
++static inline void mpi3mr_writeq(__u64 b, void __iomem *addr)
+ {
+ writeq(b, addr);
+ }
+ #else
+-static inline void mpi3mr_writeq(__u64 b, volatile void __iomem *addr)
++static inline void mpi3mr_writeq(__u64 b, void __iomem *addr)
+ {
+ __u64 data_out = b;
+
--- /dev/null
+From stable+bounces-172453-greg=kroah.com@vger.kernel.org Fri Aug 22 17:03:58 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 10:59:42 -0400
+Subject: scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems
+To: stable@vger.kernel.org
+Cc: Ranjan Kumar <ranjan.kumar@broadcom.com>, "Martin K. Petersen" <martin.petersen@oracle.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250822145943.1276044-2-sashal@kernel.org>
+
+From: Ranjan Kumar <ranjan.kumar@broadcom.com>
+
+[ Upstream commit c91e140c82eb58724c435f623702e51cc7896646 ]
+
+On 32-bit systems, 64-bit BAR writes to admin queue registers are
+performed as two 32-bit writes. Without locking, this can cause partial
+writes when accessed concurrently.
+
+Updated per-queue spinlocks is used to serialize these writes and prevent
+race conditions.
+
+Fixes: 824a156633df ("scsi: mpi3mr: Base driver code")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
+Link: https://lore.kernel.org/r/20250627194539.48851-4-ranjan.kumar@broadcom.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/mpi3mr/mpi3mr.h | 4 ++++
+ drivers/scsi/mpi3mr/mpi3mr_fw.c | 15 +++++++++++----
+ drivers/scsi/mpi3mr/mpi3mr_os.c | 2 ++
+ 3 files changed, 17 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/mpi3mr/mpi3mr.h
++++ b/drivers/scsi/mpi3mr/mpi3mr.h
+@@ -1025,6 +1025,8 @@ struct scmd_priv {
+ * @logdata_buf: Circular buffer to store log data entries
+ * @logdata_buf_idx: Index of entry in buffer to store
+ * @logdata_entry_sz: log data entry size
++ * @adm_req_q_bar_writeq_lock: Admin request queue lock
++ * @adm_reply_q_bar_writeq_lock: Admin reply queue lock
+ * @pend_large_data_sz: Counter to track pending large data
+ * @io_throttle_data_length: I/O size to track in 512b blocks
+ * @io_throttle_high: I/O size to start throttle in 512b blocks
+@@ -1207,6 +1209,8 @@ struct mpi3mr_ioc {
+ u8 *logdata_buf;
+ u16 logdata_buf_idx;
+ u16 logdata_entry_sz;
++ spinlock_t adm_req_q_bar_writeq_lock;
++ spinlock_t adm_reply_q_bar_writeq_lock;
+
+ atomic_t pend_large_data_sz;
+ u32 io_throttle_data_length;
+--- a/drivers/scsi/mpi3mr/mpi3mr_fw.c
++++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c
+@@ -23,17 +23,22 @@ module_param(poll_queues, int, 0444);
+ MODULE_PARM_DESC(poll_queues, "Number of queues for io_uring poll mode. (Range 1 - 126)");
+
+ #if defined(writeq) && defined(CONFIG_64BIT)
+-static inline void mpi3mr_writeq(__u64 b, void __iomem *addr)
++static inline void mpi3mr_writeq(__u64 b, void __iomem *addr,
++ spinlock_t *write_queue_lock)
+ {
+ writeq(b, addr);
+ }
+ #else
+-static inline void mpi3mr_writeq(__u64 b, void __iomem *addr)
++static inline void mpi3mr_writeq(__u64 b, void __iomem *addr,
++ spinlock_t *write_queue_lock)
+ {
+ __u64 data_out = b;
++ unsigned long flags;
+
++ spin_lock_irqsave(write_queue_lock, flags);
+ writel((u32)(data_out), addr);
+ writel((u32)(data_out >> 32), (addr + 4));
++ spin_unlock_irqrestore(write_queue_lock, flags);
+ }
+ #endif
+
+@@ -2666,9 +2671,11 @@ static int mpi3mr_setup_admin_qpair(stru
+ (mrioc->num_admin_req);
+ writel(num_admin_entries, &mrioc->sysif_regs->admin_queue_num_entries);
+ mpi3mr_writeq(mrioc->admin_req_dma,
+- &mrioc->sysif_regs->admin_request_queue_address);
++ &mrioc->sysif_regs->admin_request_queue_address,
++ &mrioc->adm_req_q_bar_writeq_lock);
+ mpi3mr_writeq(mrioc->admin_reply_dma,
+- &mrioc->sysif_regs->admin_reply_queue_address);
++ &mrioc->sysif_regs->admin_reply_queue_address,
++ &mrioc->adm_reply_q_bar_writeq_lock);
+ writel(mrioc->admin_req_pi, &mrioc->sysif_regs->admin_request_queue_pi);
+ writel(mrioc->admin_reply_ci, &mrioc->sysif_regs->admin_reply_queue_ci);
+ return retval;
+--- a/drivers/scsi/mpi3mr/mpi3mr_os.c
++++ b/drivers/scsi/mpi3mr/mpi3mr_os.c
+@@ -5102,6 +5102,8 @@ mpi3mr_probe(struct pci_dev *pdev, const
+ spin_lock_init(&mrioc->tgtdev_lock);
+ spin_lock_init(&mrioc->watchdog_lock);
+ spin_lock_init(&mrioc->chain_buf_lock);
++ spin_lock_init(&mrioc->adm_req_q_bar_writeq_lock);
++ spin_lock_init(&mrioc->adm_reply_q_bar_writeq_lock);
+ spin_lock_init(&mrioc->sas_node_lock);
+
+ INIT_LIST_HEAD(&mrioc->fwevt_list);
--- /dev/null
+From stable+bounces-172470-greg=kroah.com@vger.kernel.org Fri Aug 22 19:00:37 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 13:00:28 -0400
+Subject: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
+To: stable@vger.kernel.org
+Cc: "André Draszik" <andre.draszik@linaro.org>, "Bart Van Assche" <bvanassche@acm.org>, "Peter Griffin" <peter.griffin@linaro.org>, "Martin K. Petersen" <martin.petersen@oracle.com>, "Sasha Levin" <sashal@kernel.org>
+Message-ID: <20250822170028.1318459-1-sashal@kernel.org>
+
+From: André Draszik <andre.draszik@linaro.org>
+
+[ Upstream commit 01aad16c2257ab8ff33b152b972c9f2e1af47912 ]
+
+On Google gs101, the number of UTP transfer request slots (nutrs) is 32,
+and in this case the driver ends up programming the UTRL_NEXUS_TYPE
+incorrectly as 0.
+
+This is because the left hand side of the shift is 1, which is of type
+int, i.e. 31 bits wide. Shifting by more than that width results in
+undefined behaviour.
+
+Fix this by switching to the BIT() macro, which applies correct type
+casting as required. This ensures the correct value is written to
+UTRL_NEXUS_TYPE (0xffffffff on gs101), and it also fixes a UBSAN shift
+warning:
+
+ UBSAN: shift-out-of-bounds in drivers/ufs/host/ufs-exynos.c:1113:21
+ shift exponent 32 is too large for 32-bit type 'int'
+
+For consistency, apply the same change to the nutmrs / UTMRL_NEXUS_TYPE
+write.
+
+Fixes: 55f4b1f73631 ("scsi: ufs: ufs-exynos: Add UFS host support for Exynos SoCs")
+Cc: stable@vger.kernel.org
+Signed-off-by: André Draszik <andre.draszik@linaro.org>
+Link: https://lore.kernel.org/r/20250707-ufs-exynos-shift-v1-1-1418e161ae40@linaro.org
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Peter Griffin <peter.griffin@linaro.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+[ Adapted context ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ufs/host/ufs-exynos.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/ufs/host/ufs-exynos.c
++++ b/drivers/ufs/host/ufs-exynos.c
+@@ -1028,8 +1028,8 @@ static int exynos_ufs_post_link(struct u
+ hci_writel(ufs, 0xa, HCI_DATA_REORDER);
+ hci_writel(ufs, PRDT_SET_SIZE(12), HCI_TXPRDT_ENTRY_SIZE);
+ hci_writel(ufs, PRDT_SET_SIZE(12), HCI_RXPRDT_ENTRY_SIZE);
+- hci_writel(ufs, (1 << hba->nutrs) - 1, HCI_UTRL_NEXUS_TYPE);
+- hci_writel(ufs, (1 << hba->nutmrs) - 1, HCI_UTMRL_NEXUS_TYPE);
++ hci_writel(ufs, BIT(hba->nutrs) - 1, HCI_UTRL_NEXUS_TYPE);
++ hci_writel(ufs, BIT(hba->nutmrs) - 1, HCI_UTMRL_NEXUS_TYPE);
+ hci_writel(ufs, 0xf, HCI_AXIDMA_RWDATA_BURST_LEN);
+
+ if (ufs->opts & EXYNOS_UFS_OPT_SKIP_CONNECTION_ESTAB)
drm-amd-display-find-first-crtc-and-its-line-time-in-dce110_fill_display_configs.patch
drm-amd-display-fill-display-clock-and-vblank-time-in-dce110_fill_display_configs.patch
soc-qcom-mdt_loader-fix-error-return-values-in-mdt_header_valid.patch
+pci-rockchip-use-standard-pcie-definitions.patch
+pci-rockchip-set-target-link-speed-to-5.0-gt-s-before-retraining.patch
+pci-imx6-delay-link-start-until-configfs-start-written.patch
+pci-imx6-add-imx8mm_ep-and-imx8mp_ep-fixed-256-byte-bar-4-in-epc_features.patch
+scsi-ufs-exynos-fix-programming-of-hci_utrl_nexus_type.patch
+scsi-mpi3mr-drop-unnecessary-volatile-from-__iomem-pointers.patch
+scsi-mpi3mr-serialize-admin-queue-bar-writes-on-32-bit-systems.patch
+ext4-preserve-sb_i_version-on-remount.patch
+arm64-dts-ti-k3-am62-main-remove-emmc-high-speed-ddr-support.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
