--- /dev/null
+From stable+bounces-192080-greg=kroah.com@vger.kernel.org Mon Nov 3 04:03:01 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Nov 2025 14:02:51 -0500
+Subject: cpuidle: governors: menu: Rearrange main loop in menu_select()
+To: stable@vger.kernel.org
+Cc: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>, Christian Loehle <christian.loehle@arm.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20251102190252.3557318-1-sashal@kernel.org>
+
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 17224c1d2574d29668c4879e1fbf36d6f68cd22b ]
+
+Reduce the indentation level in the main loop of menu_select() by
+rearranging some checks and assignments in it.
+
+No intentional functional impact.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Christian Loehle <christian.loehle@arm.com>
+Link: https://patch.msgid.link/2389215.ElGaqSPkdT@rafael.j.wysocki
+Stable-dep-of: db86f55bf81a ("cpuidle: governors: menu: Select polling state in some more cases")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpuidle/governors/menu.c | 70 ++++++++++++++++++++-------------------
+ 1 file changed, 36 insertions(+), 34 deletions(-)
+
+--- a/drivers/cpuidle/governors/menu.c
++++ b/drivers/cpuidle/governors/menu.c
+@@ -348,45 +348,47 @@ static int menu_select(struct cpuidle_dr
+ if (s->exit_latency_ns > latency_req)
+ break;
+
+- if (s->target_residency_ns > predicted_ns) {
+- /*
+- * Use a physical idle state, not busy polling, unless
+- * a timer is going to trigger soon enough.
+- */
+- if ((drv->states[idx].flags & CPUIDLE_FLAG_POLLING) &&
+- s->target_residency_ns <= data->next_timer_ns) {
+- predicted_ns = s->target_residency_ns;
+- idx = i;
+- break;
+- }
+- if (predicted_ns < TICK_NSEC)
+- break;
+-
+- if (!tick_nohz_tick_stopped()) {
+- /*
+- * If the state selected so far is shallow,
+- * waking up early won't hurt, so retain the
+- * tick in that case and let the governor run
+- * again in the next iteration of the loop.
+- */
+- predicted_ns = drv->states[idx].target_residency_ns;
+- break;
+- }
++ if (s->target_residency_ns <= predicted_ns) {
++ idx = i;
++ continue;
++ }
++
++ /*
++ * Use a physical idle state, not busy polling, unless a timer
++ * is going to trigger soon enough.
++ */
++ if ((drv->states[idx].flags & CPUIDLE_FLAG_POLLING) &&
++ s->target_residency_ns <= data->next_timer_ns) {
++ predicted_ns = s->target_residency_ns;
++ idx = i;
++ break;
++ }
+
++ if (predicted_ns < TICK_NSEC)
++ break;
++
++ if (!tick_nohz_tick_stopped()) {
+ /*
+- * If the state selected so far is shallow and this
+- * state's target residency matches the time till the
+- * closest timer event, select this one to avoid getting
+- * stuck in the shallow one for too long.
++ * If the state selected so far is shallow, waking up
++ * early won't hurt, so retain the tick in that case and
++ * let the governor run again in the next iteration of
++ * the idle loop.
+ */
+- if (drv->states[idx].target_residency_ns < TICK_NSEC &&
+- s->target_residency_ns <= delta_tick)
+- idx = i;
+-
+- return idx;
++ predicted_ns = drv->states[idx].target_residency_ns;
++ break;
+ }
+
+- idx = i;
++ /*
++ * If the state selected so far is shallow and this state's
++ * target residency matches the time till the closest timer
++ * event, select this one to avoid getting stuck in the shallow
++ * one for too long.
++ */
++ if (drv->states[idx].target_residency_ns < TICK_NSEC &&
++ s->target_residency_ns <= delta_tick)
++ idx = i;
++
++ return idx;
+ }
+
+ if (idx == -1)
--- /dev/null
+From stable+bounces-192081-greg=kroah.com@vger.kernel.org Mon Nov 3 04:03:03 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Nov 2025 14:02:52 -0500
+Subject: cpuidle: governors: menu: Select polling state in some more cases
+To: stable@vger.kernel.org
+Cc: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>, Doug Smythies <dsmythies@telus.net>, Christian Loehle <christian.loehle@arm.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20251102190252.3557318-2-sashal@kernel.org>
+
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+
+[ Upstream commit db86f55bf81a3a297be05ee8775ae9a8c6e3a599 ]
+
+A throughput regression of 11% introduced by commit 779b1a1cb13a ("cpuidle:
+governors: menu: Avoid selecting states with too much latency") has been
+reported and it is related to the case when the menu governor checks if
+selecting a proper idle state instead of a polling one makes sense.
+
+In particular, it is questionable to do so if the exit latency of the
+idle state in question exceeds the predicted idle duration, so add a
+check for that, which is sufficient to make the reported regression go
+away, and update the related code comment accordingly.
+
+Fixes: 779b1a1cb13a ("cpuidle: governors: menu: Avoid selecting states with too much latency")
+Closes: https://lore.kernel.org/linux-pm/004501dc43c9$ec8aa930$c59ffb90$@telus.net/
+Reported-by: Doug Smythies <dsmythies@telus.net>
+Tested-by: Doug Smythies <dsmythies@telus.net>
+Cc: All applicable <stable@vger.kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Christian Loehle <christian.loehle@arm.com>
+Link: https://patch.msgid.link/12786727.O9o76ZdvQC@rafael.j.wysocki
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpuidle/governors/menu.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/cpuidle/governors/menu.c
++++ b/drivers/cpuidle/governors/menu.c
+@@ -355,10 +355,13 @@ static int menu_select(struct cpuidle_dr
+
+ /*
+ * Use a physical idle state, not busy polling, unless a timer
+- * is going to trigger soon enough.
++ * is going to trigger soon enough or the exit latency of the
++ * idle state in question is greater than the predicted idle
++ * duration.
+ */
+ if ((drv->states[idx].flags & CPUIDLE_FLAG_POLLING) &&
+- s->target_residency_ns <= data->next_timer_ns) {
++ s->target_residency_ns <= data->next_timer_ns &&
++ s->exit_latency_ns <= predicted_ns) {
+ predicted_ns = s->target_residency_ns;
+ idx = i;
+ break;
--- /dev/null
+From stable+bounces-192105-greg=kroah.com@vger.kernel.org Mon Nov 3 09:06:08 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Nov 2025 19:02:15 -0500
+Subject: mptcp: fix MSG_PEEK stream corruption
+To: stable@vger.kernel.org
+Cc: Paolo Abeni <pabeni@redhat.com>, Geliang Tang <geliang@kernel.org>, Mat Martineau <martineau@kernel.org>, "Matthieu Baerts (NGI0)" <matttbe@kernel.org>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20251103000215.3689294-1-sashal@kernel.org>
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit 8e04ce45a8db7a080220e86e249198fa676b83dc ]
+
+If a MSG_PEEK | MSG_WAITALL read operation consumes all the bytes in the
+receive queue and recvmsg() need to waits for more data - i.e. it's a
+blocking one - upon arrival of the next packet the MPTCP protocol will
+start again copying the oldest data present in the receive queue,
+corrupting the data stream.
+
+Address the issue explicitly tracking the peeked sequence number,
+restarting from the last peeked byte.
+
+Fixes: ca4fb892579f ("mptcp: add MSG_PEEK support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Tested-by: Geliang Tang <geliang@kernel.org>
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20251028-net-mptcp-send-timeout-v1-2-38ffff5a9ec8@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+[ Adjust context ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/protocol.c | 36 +++++++++++++++++++++++++-----------
+ 1 file changed, 25 insertions(+), 11 deletions(-)
+
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -1940,19 +1940,35 @@ static void mptcp_rcv_space_adjust(struc
+
+ static int __mptcp_recvmsg_mskq(struct mptcp_sock *msk,
+ struct msghdr *msg,
+- size_t len, int flags,
++ size_t len, int flags, int copied_total,
+ struct scm_timestamping_internal *tss,
+ int *cmsg_flags)
+ {
+ struct sk_buff *skb, *tmp;
++ int total_data_len = 0;
+ int copied = 0;
+
+ skb_queue_walk_safe(&msk->receive_queue, skb, tmp) {
+- u32 offset = MPTCP_SKB_CB(skb)->offset;
++ u32 delta, offset = MPTCP_SKB_CB(skb)->offset;
+ u32 data_len = skb->len - offset;
+- u32 count = min_t(size_t, len - copied, data_len);
++ u32 count;
+ int err;
+
++ if (flags & MSG_PEEK) {
++ /* skip already peeked skbs */
++ if (total_data_len + data_len <= copied_total) {
++ total_data_len += data_len;
++ continue;
++ }
++
++ /* skip the already peeked data in the current skb */
++ delta = copied_total - total_data_len;
++ offset += delta;
++ data_len -= delta;
++ }
++
++ count = min_t(size_t, len - copied, data_len);
++
+ if (!(flags & MSG_TRUNC)) {
+ err = skb_copy_datagram_msg(skb, offset, msg, count);
+ if (unlikely(err < 0)) {
+@@ -1969,22 +1985,19 @@ static int __mptcp_recvmsg_mskq(struct m
+
+ copied += count;
+
+- if (count < data_len) {
+- if (!(flags & MSG_PEEK)) {
++ if (!(flags & MSG_PEEK)) {
++ msk->bytes_consumed += count;
++ if (count < data_len) {
+ MPTCP_SKB_CB(skb)->offset += count;
+ MPTCP_SKB_CB(skb)->map_seq += count;
+- msk->bytes_consumed += count;
++ break;
+ }
+- break;
+- }
+
+- if (!(flags & MSG_PEEK)) {
+ /* we will bulk release the skb memory later */
+ skb->destructor = NULL;
+ WRITE_ONCE(msk->rmem_released, msk->rmem_released + skb->truesize);
+ __skb_unlink(skb, &msk->receive_queue);
+ __kfree_skb(skb);
+- msk->bytes_consumed += count;
+ }
+
+ if (copied >= len)
+@@ -2208,7 +2221,8 @@ static int mptcp_recvmsg(struct sock *sk
+ while (copied < len) {
+ int err, bytes_read;
+
+- bytes_read = __mptcp_recvmsg_mskq(msk, msg, len - copied, flags, &tss, &cmsg_flags);
++ bytes_read = __mptcp_recvmsg_mskq(msk, msg, len - copied, flags,
++ copied, &tss, &cmsg_flags);
+ if (unlikely(bytes_read < 0)) {
+ if (!copied)
+ copied = bytes_read;
--- /dev/null
+From stable+bounces-192077-greg=kroah.com@vger.kernel.org Mon Nov 3 03:59:19 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Nov 2025 13:59:09 -0500
+Subject: net: phy: dp83867: Disable EEE support as not implemented
+To: stable@vger.kernel.org
+Cc: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>, Andrew Lunn <andrew@lunn.ch>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20251102185909.3552411-1-sashal@kernel.org>
+
+From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
+
+[ Upstream commit 84a905290cb4c3d9a71a9e3b2f2e02e031e7512f ]
+
+While the DP83867 PHYs report EEE capability through their feature
+registers, the actual hardware does not support EEE (see Links).
+When the connected MAC enables EEE, it causes link instability and
+communication failures.
+
+The issue is reproducible with a iMX8MP and relevant stmmac ethernet port.
+Since the introduction of phylink-managed EEE support in the stmmac driver,
+EEE is now enabled by default, leading to issues on systems using the
+DP83867 PHY.
+
+Call phy_disable_eee during phy initialization to prevent EEE from being
+enabled on DP83867 PHYs.
+
+Link: https://e2e.ti.com/support/interface-group/interface/f/interface-forum/1445244/dp83867ir-dp83867-disable-eee-lpi
+Link: https://e2e.ti.com/support/interface-group/interface/f/interface-forum/658638/dp83867ir-eee-energy-efficient-ethernet
+Fixes: 2a10154abcb7 ("net: phy: dp83867: Add TI dp83867 phy")
+Cc: stable@vger.kernel.org
+Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20251023144857.529566-1-ghidoliemanuele@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+[ inlined phy_disable_eee() functionality ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/dp83867.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/net/phy/dp83867.c
++++ b/drivers/net/phy/dp83867.c
+@@ -774,6 +774,14 @@ static int dp83867_config_init(struct ph
+ return ret;
+ }
+
++ /* Although the DP83867 reports EEE capability through the
++ * MDIO_PCS_EEE_ABLE and MDIO_AN_EEE_ADV registers, the feature
++ * is not actually implemented in hardware.
++ */
++ linkmode_zero(phydev->supported_eee);
++ linkmode_zero(phydev->advertising_eee);
++ phydev->eee_enabled = false;
++
+ if (phy_interface_is_rgmii(phydev) ||
+ phydev->interface == PHY_INTERFACE_MODE_SGMII) {
+ val = phy_read(phydev, MII_DP83867_PHYCTRL);
--- /dev/null
+From stable+bounces-192100-greg=kroah.com@vger.kernel.org Mon Nov 3 08:29:26 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Nov 2025 18:29:20 -0500
+Subject: s390/pci: Restore IRQ unconditionally for the zPCI device
+To: stable@vger.kernel.org
+Cc: Farhan Ali <alifm@linux.ibm.com>, stable@vger.kernnel.org, Niklas Schnelle <schnelle@linux.ibm.com>, Matthew Rosato <mjrosato@linux.ibm.com>, Heiko Carstens <hca@linux.ibm.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20251102232920.3654814-1-sashal@kernel.org>
+
+From: Farhan Ali <alifm@linux.ibm.com>
+
+[ Upstream commit b45873c3f09153d1ad9b3a7bf9e5c0b0387fd2ea ]
+
+Commit c1e18c17bda6 ("s390/pci: add zpci_set_irq()/zpci_clear_irq()"),
+introduced the zpci_set_irq() and zpci_clear_irq(), to be used while
+resetting a zPCI device.
+
+Commit da995d538d3a ("s390/pci: implement reset_slot for hotplug
+slot"), mentions zpci_clear_irq() being called in the path for
+zpci_hot_reset_device(). But that is not the case anymore and these
+functions are not called outside of this file. Instead
+zpci_hot_reset_device() relies on zpci_disable_device() also clearing
+the IRQs, but misses to reset the zdev->irqs_registered flag.
+
+However after a CLP disable/enable reset, the device's IRQ are
+unregistered, but the flag zdev->irq_registered does not get cleared. It
+creates an inconsistent state and so arch_restore_msi_irqs() doesn't
+correctly restore the device's IRQ. This becomes a problem when a PCI
+driver tries to restore the state of the device through
+pci_restore_state(). Restore IRQ unconditionally for the device and remove
+the irq_registered flag as its redundant.
+
+Fixes: c1e18c17bda6 ("s390/pci: add zpci_set_irq()/zpci_clear_irq()")
+Cc: stable@vger.kernnel.org
+Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
+Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+[ adjusted bitfield context ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/include/asm/pci.h | 1 -
+ arch/s390/pci/pci_irq.c | 9 +--------
+ 2 files changed, 1 insertion(+), 9 deletions(-)
+
+--- a/arch/s390/include/asm/pci.h
++++ b/arch/s390/include/asm/pci.h
+@@ -138,7 +138,6 @@ struct zpci_dev {
+ u8 has_resources : 1;
+ u8 is_physfn : 1;
+ u8 util_str_avail : 1;
+- u8 irqs_registered : 1;
+ u8 reserved : 2;
+ unsigned int devfn; /* DEVFN part of the RID*/
+
+--- a/arch/s390/pci/pci_irq.c
++++ b/arch/s390/pci/pci_irq.c
+@@ -107,9 +107,6 @@ static int zpci_set_irq(struct zpci_dev
+ else
+ rc = zpci_set_airq(zdev);
+
+- if (!rc)
+- zdev->irqs_registered = 1;
+-
+ return rc;
+ }
+
+@@ -123,9 +120,6 @@ static int zpci_clear_irq(struct zpci_de
+ else
+ rc = zpci_clear_airq(zdev);
+
+- if (!rc)
+- zdev->irqs_registered = 0;
+-
+ return rc;
+ }
+
+@@ -427,8 +421,7 @@ bool arch_restore_msi_irqs(struct pci_de
+ {
+ struct zpci_dev *zdev = to_zpci(pdev);
+
+- if (!zdev->irqs_registered)
+- zpci_set_irq(zdev);
++ zpci_set_irq(zdev);
+ return true;
+ }
+
block-make-req_op_zone_open-a-write-operation.patch
regmap-slimbus-fix-bus_context-pointer-in-regmap-init-calls.patch
drm-mediatek-fix-device-use-after-free-on-unbind.patch
+mptcp-fix-msg_peek-stream-corruption.patch
+s390-pci-restore-irq-unconditionally-for-the-zpci-device.patch
+cpuidle-governors-menu-rearrange-main-loop-in-menu_select.patch
+cpuidle-governors-menu-select-polling-state-in-some-more-cases.patch
+net-phy-dp83867-disable-eee-support-as-not-implemented.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
