Pull tty / serial driver updates from Greg KH:
 "Here is the "big" set of tty and serial driver updates for 7.4-rc1.

  It's not really all that big, it's been kind of quiet in this area of
  the tree this development cycle in relation to other parts of the
  tree. But still, included in here are:

   - 8250 port updates and fixes

   - 8250 driver cleanups by Jiri

   - deletion of the obsolete moxa driver (making this pull request
     remove more lines than added!)

   - different serial driver updates for dma and other reported issues

  All of these have been in linux-next with no reported problems"

* tag 'tty-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (91 commits)
  tty: hvc: dcc: Detect JTAG connection only on CPU core 0
  serial: earlycon: Use isdigit() in earlycon_init()
  serial: core: Use isdigit() in uart_parse_options()
  dt-bindings: serial: snps-dw-apb-uart: Add Synaptics sl2610 uart
  serial: amba-pl011: drive the bus during break in RS485 mode
  serial: mcf: update author email address
  serial: pmac_zilog: report received breaks
  serial: pmac_zilog: push received data to the port that received it
  serial: amba-pl011: keep transmitter enabled when disabling RS485
  serial: ma35d1: Do not force-enable an unselected console
  serial: amba-pl011: honour delay_rts_before_send for every write
  Revert "serial: 8250_port: Drop duplicate NULL check"
  serial: 8250: make port operations work on struct uart_8250_port
  serial: 8250_omap: set priv->line before enabling the IRQ
  serial: 8250_lpss: do not touch uninitialized line in ehl_serial_exit()
  serial: 8250_exar: store the GPIO platform device in struct exar8250
  serial: 8250_exar: remove useless void * casts
  serial: 8250: drop err label from serial8250_register_8250_port()
  serial: core: fix TIOCSSERIAL and TIOCSERCONFIG on uninitialised ports
  serial: max310x: don't transmit while an RS485 reconfigure is pending
  ...

Pull networking updates from Paolo Abeni:
 "This includes a significant number of low-priority fixes - especially
  in the NIC drivers area - that we deferred from the last few RCs in
  the previous cycle, which can't be easily outlined in the synopsis
  below.

  Core & protocols:

   - Continue the work on removing rtnl_lock dependencies:
      - per-netns ARP and ND neighbour tables, with the default settings
        now configurable per netns (inheritance from init_net is
        controlled by the new net.core.neigh_inherit_init_net sysctl)
      - RCU-protected configuration and rtnl_lock-less fill_info() for
        hsr, netkit, sit, vlan and vxlan devices
      - per-netns device unregistration for ip tunnel and gre devices
      - use the netdev instance lock instead of rtnl_lock when reading
        speed and duplex via sysfs
      - batch the flushing of uncached routes at device unregistration
        time, relieving rtnl_lock contention on netns dismantle.

   - Add hardware pacing offload support, admin-controlled via a new
     rtnetlink attribute, with sch_fq integration (implemented in idpf).

   - Re-segment BIG TCP GSO packets into GSO packets fitting the egress
     device limits instead of plain MSS-sized segments, improving
     throughput for mixed BIG TCP / non-BIG TCP paths by up to 70%.

   - Generate RSS keys that spread flows over all the RX queues; the
     previous random keys could leave some queues unused.

   - Optimize the bridge VLAN forwarding paths: cache the port-VLAN in
     fdb entries and consider only VLAN members when flooding, for ~10%
     more Mpps in the fdb forwarding path.

   - A few TCP/IP performance improvements aimed at efficient cache
     usage and reducing contention.

   - Add the TCP ROCCET congestion control, a CUBIC variant aimed at
     avoiding bufferbloat in cellular networks.

   - Continue the conversion of getsockopt callbacks to sockopt_t.

   - Add an ethtool command to list the front-facing ports of an
     interface, including SFP cages and modules, using the phy_port
     representation.

   - Enable BIG TCP support for bareudp tunnels.

   - Remove the IPV6_ADDRFORM socket option and disallow buggy TCP state
     transitions (listen() + shutdown() + connect() and connect() +
     connect(AF_UNSPEC) + listen()).

   - Remove most BUG_ON()s from core packet processing, replacing them
     with error paths.

  Wireless:

   - Latency improvements, including lockless station get/dump and
     beacon updates, plus RTNL reduction and locking cleanups.

   - Infrastructure for non-station TX/RX with MLO.

   - NAN (Wi-Fi Aware) Instant Communication support and other NAN
     improvements.

   - Control frame Integrity Protocol (CIP) and protected TWT support.

   - Improvements for AP regulatory checks.

  Netfilter:

   - Disable br_netfilter in user namespaces and schedule it for removal
     in 2027.

   - Restrict the raw table in nft_compat to the specific family, hook
     and priority.

   - Prepare the flowtable for mixed IPv4-over-IPv6 tunneling (and vice
     versa).

   - Use GFP_KERNEL_ACCOUNT for most netfilter allocations, for better
     integration with memcg.

   - Allow discovering conntrack zone filtering support in ctnetlink
     dumps, and fix nfnetlink_hook handling of large dumps.

  Deletions:

   - Move the LLC type 2 sockets out of tree. There are no known users
     and the code attracts a never-ending stream of LLM-driven fixes.

  Device drivers:

   - New drivers:
      - Meta Platforms NIC (mpnic), the second-generation NIC from Meta
      - initial skeleton of the Nebula-matrix NICs driver (nbl)
      - X-Powers AC200/AC300 Fast Ethernet PHYs

   - Ethernet high-speed NICs:
      - Intel:
         - i40e: XDP metadata support for RX hash and VLAN tag
         - ice: expose the E825 TSPLL state via the DPLL subsystem
      - nVidia/Mellanox:
         - move the data direct infrastructure from IB to core, in
           preparation for netdev support.
         - reduce the memory used per offloaded TC rule
      - Meta (fbnic):
         - support large io_uring zero-copy RX buffers
      - Microsoft vNIC (mana):
         - add BQL support

   - Ethernet NICs consumer, and embedded:
      - Airoha:
         - LRO offload support
      - Cadence (macb):
         - context swapping for ringparam and MTU changes, avoiding
           buffer loss under memory pressure
      - Mucse (rnpgbe):
         - TX/RX and link status support
      - NXP (enetc):
         - SR-IOV improvements and VF support for ENETC v4
      - Qualcomm (ppe):
         - IPQ5424 support
      - Realtek PCI (r8169):
         - phylink support
         - RSS support for RTL8127
      - Renesas (ravb):
         - gPTP support for R-Car Gen4
      - Synopsys (stmmac):
         - XDP multi-buffer support on the TX side
         - tc mqprio hw queue priority offload
         - support for RK3568 SGMII, Allwinner H616 EMAC1, UltraRISC
           DP1000 and Qualcomm sa8255p

   - Ethernet switches:
      - Mediatek (mt7530):
         - fast age and change conduit support
      - Microchip (ksz):
         - support for KSZ8995XA/KS8995XA
      - Microchip (lan966x):
         - PCIe FDMA support, ~20x throughput increase in PCIe endpoint
      - Microchip (sparx5):
         - Time Aware Shaper (taprio) offload
      - Motorcomm (yt921x):
         - LED and SerDes PCS support
      - Realtek (rtl8365mb):
         - EEE support

   - Ethernet PHYs:
      - Broadcom:
         - enable jumbo frames on BCM54xx
      - Realtek:
         - support for RTL8261CE_CG and RTL8261D_VM
         - MDIO support for RTL838x and RTL839x

   - WiFi drivers:
      - Broadcom (brcmfmac):
         - FT/OKC roaming offload
      - Intel (iwlwifi):
         - UHR sniffer support
         - support for newer UEFI/BIOS tables
      - MediaTek (mt76):
         - mt7925 NAN improvements
         - offchannel/scan improvements and MLO fixes
      - Morse Micro (mm81x):
         - monitor mode support
      - Qualcomm (ath12k):
         - IPQ5332 platform infrastructure
      - Realtek (rtw88):
         - RTL8723BS support
         - SDIO TX performance improvements
      - Realtek (rtw89):
         - P2P_DEVICE support
         - BT-coex updates for RTL8922D

   - Bluetooth:
      - move H:4 reassembly into the Bluetooth core
      - add generic support for vendor packets
      - MGMT: add security level changed event

   - Bluetooth drivers:
      - btusb: support Bulk Serialization Mode
      - Intel: support Draco and Titan Lake, allow unsigned firmware
      - Mediatek: MT7928 support
      - Qualcomm: QCC2072 support
      - Broadcom: Synaptics 4384 support"

* tag 'net-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (2126 commits)
  Bluetooth: btusb: disable by default Qualcomm multi-subsystem
  tipc: fix broadcast sender hang on last acker departure
  tipc: fix use-after-free of broadcast reception link at node release
  r8169: clear TX LPI on RTL8168h at link up after phylink conversion
  tun: Require CAP_NET_ADMIN to attach to an ownerless device
  net/sched/sch_cake: drop dead nla_nest_end() error check
  net/sched/sch_cake: widen buffer_used to u64
  net/sched/sch_cake: reduce parent backlog when clearing a tin
  net/sched/sch_cake: serialize reconfiguration with the datapath
  tg3: Add Datto SIRIS 5 1U Server to restart AER quirk table
  net/mlx5e: Stop asserting for RTNL when closing channels
  net: shrink the payload-only part of skb dataref to one bit
  net: wwan: iosm: validate msg_head before indexing msg_ring
  net: bgmac: rate limit RX error messages
  selftests: net: veth: test XDP_TX to a peer with GRO enabled
  veth: schedule the peer's NAPI after XDP_TX when only GRO is enabled
  pppoe: delete session hash entries by pointer match
  net: lan969x: don't disable hardirqs in fdma tx clear
  net: sparx5/lan969x: do not clobber the PSFP cycle timer update period
  net: lan969x: fix DSM calendar for empty taxis
  ...

Cross-merge networking fixes after downstream PR (net-7.3-rc8).

No conflicts. Adjacent changes:

drivers/net/ethernet/microchip/lan865x/lan865x.c
  2a3f6d2a9ac3 ("microchip: lan865x: move setting of netops to fix crash")
  15358c2c3dca ("net: ethernet: oa_tc6: return ERR_PTR from oa_tc6_init()")

Signed-off-by: Jakub Kicinski <kuba@kernel.org>

sdio_uart is an SDIO function driver, not part of the MMC/SDIO core.
Keeping it in drivers/mmc/core/ is misplaced: it registers to the SDIO
bus (sdio_register_driver) and only uses the public SDIO API from
include/linux/mmc/, with no dependency on any mmc core internals.

Other SDIO function drivers live under their respective functional
subsystem, e.g. the SDIO WiFi drivers are under drivers/net/wireless/.
sdio_uart should likewise be placed under its functional subsystem, tty,
just like the PCIe and I2C/SPI transport drivers (men_z135_uart,
sc16is7xx, max310x) that live under drivers/tty/serial/.

Historically almost all changes to this driver were tty API changes
(e.g. tty_operations adjustments, alloc_tty_driver removal), yet
scripts/get_maintainer.pl never listed the TTY maintainers while the
file lived under drivers/mmc/core/. Moving it under drivers/tty/serial/
makes get_maintainer.pl report the proper TTY/serial maintainers and
reviewers, which benefits future maintenance of this driver.

No functional change. The CONFIG_SDIO_UART symbol is intentionally kept
unchanged to avoid breaking existing configs; the dependency is updated
to 'TTY && MMC' accordingly.

Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Link: https://patch.msgid.link/1791626517-18161-1-git-send-email-shawn.lin@rock-chips.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

dw_mmc-rockchip's execute_tuning() scans the tuning window phase by phase
through mmc_send_tuning(), which applied the whole-sequence 150 ms
bound as the data timeout of every single CMD19/CMD21.  With HS200
eMMC the TMOUT register saturates at ~112 ms for the requested
150 ms, so every phase that misses the window stalls that long, and
multi-second boot slowdowns have been reported[1].

Use 5 ms per tuning command via mmc_send_tuning_timeout() instead:
~1.3x the spec-implied per-execution device budget (150 ms / 40 =
3.75 ms, excluding host overhead), 30x below the 150 ms ceiling, and
the reporter verified that tuning keeps passing with it.  A wrong
sampling phase normally fails fast with a CRC error anyway, so the
timeout only catches devices which never return the tuning block at
all.  This also bounds the cost of runtime re-tuning.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=221781 [1]
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>

Add mmc_send_tuning_timeout() which takes the data timeout in
milliseconds, and turn mmc_send_tuning() into a thin wrapper keeping
the current 150 ms, so there is no behaviour change for the existing
callers.  This lets drivers pass a tighter timeout for software
tuning, e.g. hosts which scan the tuning window phase by phase.

Suggested-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>

In CMDQ mode an I/O error in one task (data_crc_err, data_end_bit_err,
etc.) makes the controller raise a halt request. While the halt request
is pending, the controller rejects doorbell writes with a slave response
error, which hangs the CPU (or raises SError on ARM) on Rockchip
platforms.

A software workaround[1] clears CQHCI_CTL right before ringing the
doorbell to narrow down the window, but a race remains: an I/O error can
still happen in another slot between the CQHCI_CTL write and the
doorbell kick, so the hang is not fully solved.

To fix this once and for all, newer silicon introduces
SW_ERR_HALR_REQ_DISABLE (CQHCI_CTL[1]) which stops the controller from
raising a halt request on I/O errors. Set the bit when the CQE is
enabled, which is the last CQHCI_CTL write before any doorbell write.

Older SoCs keep this bit reserved, so writing it is a no-op and nothing
changes in the wild, thus no fixes tag is needed.

[1] https://github.com/rockchip-linux/kernel/commit/4b7ea0500a1a5c186807b737fecfc6bb4d4e06f8
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>

Convert open-coded if/else with set_bit/clear_bit and their
non-atomic __set_bit/__clear_bit variants to the assign_bit/__assign_bit
API.

Done with Coccinelle semantic patch and manual fixups.

Signed-off-by: Peng Fan <peng.fan@nxp.com>
Acked-by: Aubin Constans <aubin.constans@microchip.com>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>

pcim_iomap_regions() and pcim_iomap_table() have been deprecated.
Replace them with pcim_iomap_region(), which requests and maps a single
BAR and returns the mapping directly.

pcim_iomap_region() returns an IOMEM_ERR_PTR() on failure, so check the
result with IS_ERR() and propagate the error with ERR_CAST().

Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>

After spmmc_controller_init() resets the controller, all timing
fields are zero.  The hs_en path initialises the write timing
delays (wr_cmd_dly, wr_dat_dly) but leaves the read side at zero.

In DDR52 mode, rd_crc_dly=0 causes the first write to fail with
CRC_TOKEN_CHECK_ERROR, triggering the auto-tuning retry loop and
causing a multi-second delay on the first cold-boot write.

Set rd_crc_dly=1 when enabling DDR mode to avoid this.

Tested on a LTPP3G2, booting via eMMC in DDR52 mode,
on linux-next-20260915.

Signed-off-by: Andrew Gaylard <ag@ffroot.co.za>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>