From: Greg Kroah-Hartman Date: Mon, 3 Nov 2025 01:27:21 +0000 (+0900) Subject: 6.6-stable patches X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fa3a7fa34e37f659b00937e044846ab0ab9f661b;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: cpuidle-governors-menu-rearrange-main-loop-in-menu_select.patch cpuidle-governors-menu-select-polling-state-in-some-more-cases.patch mptcp-fix-msg_peek-stream-corruption.patch net-phy-dp83867-disable-eee-support-as-not-implemented.patch s390-pci-restore-irq-unconditionally-for-the-zpci-device.patch --- diff --git a/queue-6.6/cpuidle-governors-menu-rearrange-main-loop-in-menu_select.patch b/queue-6.6/cpuidle-governors-menu-rearrange-main-loop-in-menu_select.patch new file mode 100644 index 0000000000..2b710b82e0 --- /dev/null +++ b/queue-6.6/cpuidle-governors-menu-rearrange-main-loop-in-menu_select.patch @@ -0,0 +1,111 @@ +From stable+bounces-192080-greg=kroah.com@vger.kernel.org Mon Nov 3 04:03:01 2025 +From: Sasha Levin +Date: Sun, 2 Nov 2025 14:02:51 -0500 +Subject: cpuidle: governors: menu: Rearrange main loop in menu_select() +To: stable@vger.kernel.org +Cc: "Rafael J. Wysocki" , Christian Loehle , Sasha Levin +Message-ID: <20251102190252.3557318-1-sashal@kernel.org> + +From: "Rafael J. Wysocki" + +[ Upstream commit 17224c1d2574d29668c4879e1fbf36d6f68cd22b ] + +Reduce the indentation level in the main loop of menu_select() by +rearranging some checks and assignments in it. + +No intentional functional impact. + +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Christian Loehle +Link: https://patch.msgid.link/2389215.ElGaqSPkdT@rafael.j.wysocki +Stable-dep-of: db86f55bf81a ("cpuidle: governors: menu: Select polling state in some more cases") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpuidle/governors/menu.c | 70 ++++++++++++++++++++------------------- + 1 file changed, 36 insertions(+), 34 deletions(-) + +--- a/drivers/cpuidle/governors/menu.c ++++ b/drivers/cpuidle/governors/menu.c +@@ -348,45 +348,47 @@ static int menu_select(struct cpuidle_dr + if (s->exit_latency_ns > latency_req) + break; + +- if (s->target_residency_ns > predicted_ns) { +- /* +- * Use a physical idle state, not busy polling, unless +- * a timer is going to trigger soon enough. +- */ +- if ((drv->states[idx].flags & CPUIDLE_FLAG_POLLING) && +- s->target_residency_ns <= data->next_timer_ns) { +- predicted_ns = s->target_residency_ns; +- idx = i; +- break; +- } +- if (predicted_ns < TICK_NSEC) +- break; +- +- if (!tick_nohz_tick_stopped()) { +- /* +- * If the state selected so far is shallow, +- * waking up early won't hurt, so retain the +- * tick in that case and let the governor run +- * again in the next iteration of the loop. +- */ +- predicted_ns = drv->states[idx].target_residency_ns; +- break; +- } ++ if (s->target_residency_ns <= predicted_ns) { ++ idx = i; ++ continue; ++ } ++ ++ /* ++ * Use a physical idle state, not busy polling, unless a timer ++ * is going to trigger soon enough. ++ */ ++ if ((drv->states[idx].flags & CPUIDLE_FLAG_POLLING) && ++ s->target_residency_ns <= data->next_timer_ns) { ++ predicted_ns = s->target_residency_ns; ++ idx = i; ++ break; ++ } + ++ if (predicted_ns < TICK_NSEC) ++ break; ++ ++ if (!tick_nohz_tick_stopped()) { + /* +- * If the state selected so far is shallow and this +- * state's target residency matches the time till the +- * closest timer event, select this one to avoid getting +- * stuck in the shallow one for too long. ++ * If the state selected so far is shallow, waking up ++ * early won't hurt, so retain the tick in that case and ++ * let the governor run again in the next iteration of ++ * the idle loop. + */ +- if (drv->states[idx].target_residency_ns < TICK_NSEC && +- s->target_residency_ns <= delta_tick) +- idx = i; +- +- return idx; ++ predicted_ns = drv->states[idx].target_residency_ns; ++ break; + } + +- idx = i; ++ /* ++ * If the state selected so far is shallow and this state's ++ * target residency matches the time till the closest timer ++ * event, select this one to avoid getting stuck in the shallow ++ * one for too long. ++ */ ++ if (drv->states[idx].target_residency_ns < TICK_NSEC && ++ s->target_residency_ns <= delta_tick) ++ idx = i; ++ ++ return idx; + } + + if (idx == -1) diff --git a/queue-6.6/cpuidle-governors-menu-select-polling-state-in-some-more-cases.patch b/queue-6.6/cpuidle-governors-menu-select-polling-state-in-some-more-cases.patch new file mode 100644 index 0000000000..417caceef8 --- /dev/null +++ b/queue-6.6/cpuidle-governors-menu-select-polling-state-in-some-more-cases.patch @@ -0,0 +1,54 @@ +From stable+bounces-192081-greg=kroah.com@vger.kernel.org Mon Nov 3 04:03:03 2025 +From: Sasha Levin +Date: Sun, 2 Nov 2025 14:02:52 -0500 +Subject: cpuidle: governors: menu: Select polling state in some more cases +To: stable@vger.kernel.org +Cc: "Rafael J. Wysocki" , Doug Smythies , Christian Loehle , Sasha Levin +Message-ID: <20251102190252.3557318-2-sashal@kernel.org> + +From: "Rafael J. Wysocki" + +[ Upstream commit db86f55bf81a3a297be05ee8775ae9a8c6e3a599 ] + +A throughput regression of 11% introduced by commit 779b1a1cb13a ("cpuidle: +governors: menu: Avoid selecting states with too much latency") has been +reported and it is related to the case when the menu governor checks if +selecting a proper idle state instead of a polling one makes sense. + +In particular, it is questionable to do so if the exit latency of the +idle state in question exceeds the predicted idle duration, so add a +check for that, which is sufficient to make the reported regression go +away, and update the related code comment accordingly. + +Fixes: 779b1a1cb13a ("cpuidle: governors: menu: Avoid selecting states with too much latency") +Closes: https://lore.kernel.org/linux-pm/004501dc43c9$ec8aa930$c59ffb90$@telus.net/ +Reported-by: Doug Smythies +Tested-by: Doug Smythies +Cc: All applicable +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Christian Loehle +Link: https://patch.msgid.link/12786727.O9o76ZdvQC@rafael.j.wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpuidle/governors/menu.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/cpuidle/governors/menu.c ++++ b/drivers/cpuidle/governors/menu.c +@@ -355,10 +355,13 @@ static int menu_select(struct cpuidle_dr + + /* + * Use a physical idle state, not busy polling, unless a timer +- * is going to trigger soon enough. ++ * is going to trigger soon enough or the exit latency of the ++ * idle state in question is greater than the predicted idle ++ * duration. + */ + if ((drv->states[idx].flags & CPUIDLE_FLAG_POLLING) && +- s->target_residency_ns <= data->next_timer_ns) { ++ s->target_residency_ns <= data->next_timer_ns && ++ s->exit_latency_ns <= predicted_ns) { + predicted_ns = s->target_residency_ns; + idx = i; + break; diff --git a/queue-6.6/mptcp-fix-msg_peek-stream-corruption.patch b/queue-6.6/mptcp-fix-msg_peek-stream-corruption.patch new file mode 100644 index 0000000000..7db48b68d9 --- /dev/null +++ b/queue-6.6/mptcp-fix-msg_peek-stream-corruption.patch @@ -0,0 +1,115 @@ +From stable+bounces-192105-greg=kroah.com@vger.kernel.org Mon Nov 3 09:06:08 2025 +From: Sasha Levin +Date: Sun, 2 Nov 2025 19:02:15 -0500 +Subject: mptcp: fix MSG_PEEK stream corruption +To: stable@vger.kernel.org +Cc: Paolo Abeni , Geliang Tang , Mat Martineau , "Matthieu Baerts (NGI0)" , Jakub Kicinski , Sasha Levin +Message-ID: <20251103000215.3689294-1-sashal@kernel.org> + +From: Paolo Abeni + +[ Upstream commit 8e04ce45a8db7a080220e86e249198fa676b83dc ] + +If a MSG_PEEK | MSG_WAITALL read operation consumes all the bytes in the +receive queue and recvmsg() need to waits for more data - i.e. it's a +blocking one - upon arrival of the next packet the MPTCP protocol will +start again copying the oldest data present in the receive queue, +corrupting the data stream. + +Address the issue explicitly tracking the peeked sequence number, +restarting from the last peeked byte. + +Fixes: ca4fb892579f ("mptcp: add MSG_PEEK support") +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Abeni +Reviewed-by: Geliang Tang +Tested-by: Geliang Tang +Reviewed-by: Mat Martineau +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20251028-net-mptcp-send-timeout-v1-2-38ffff5a9ec8@kernel.org +Signed-off-by: Jakub Kicinski +[ Adjust context ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/protocol.c | 36 +++++++++++++++++++++++++----------- + 1 file changed, 25 insertions(+), 11 deletions(-) + +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -1940,19 +1940,35 @@ static void mptcp_rcv_space_adjust(struc + + static int __mptcp_recvmsg_mskq(struct mptcp_sock *msk, + struct msghdr *msg, +- size_t len, int flags, ++ size_t len, int flags, int copied_total, + struct scm_timestamping_internal *tss, + int *cmsg_flags) + { + struct sk_buff *skb, *tmp; ++ int total_data_len = 0; + int copied = 0; + + skb_queue_walk_safe(&msk->receive_queue, skb, tmp) { +- u32 offset = MPTCP_SKB_CB(skb)->offset; ++ u32 delta, offset = MPTCP_SKB_CB(skb)->offset; + u32 data_len = skb->len - offset; +- u32 count = min_t(size_t, len - copied, data_len); ++ u32 count; + int err; + ++ if (flags & MSG_PEEK) { ++ /* skip already peeked skbs */ ++ if (total_data_len + data_len <= copied_total) { ++ total_data_len += data_len; ++ continue; ++ } ++ ++ /* skip the already peeked data in the current skb */ ++ delta = copied_total - total_data_len; ++ offset += delta; ++ data_len -= delta; ++ } ++ ++ count = min_t(size_t, len - copied, data_len); ++ + if (!(flags & MSG_TRUNC)) { + err = skb_copy_datagram_msg(skb, offset, msg, count); + if (unlikely(err < 0)) { +@@ -1969,22 +1985,19 @@ static int __mptcp_recvmsg_mskq(struct m + + copied += count; + +- if (count < data_len) { +- if (!(flags & MSG_PEEK)) { ++ if (!(flags & MSG_PEEK)) { ++ msk->bytes_consumed += count; ++ if (count < data_len) { + MPTCP_SKB_CB(skb)->offset += count; + MPTCP_SKB_CB(skb)->map_seq += count; +- msk->bytes_consumed += count; ++ break; + } +- break; +- } + +- if (!(flags & MSG_PEEK)) { + /* we will bulk release the skb memory later */ + skb->destructor = NULL; + WRITE_ONCE(msk->rmem_released, msk->rmem_released + skb->truesize); + __skb_unlink(skb, &msk->receive_queue); + __kfree_skb(skb); +- msk->bytes_consumed += count; + } + + if (copied >= len) +@@ -2208,7 +2221,8 @@ static int mptcp_recvmsg(struct sock *sk + while (copied < len) { + int err, bytes_read; + +- bytes_read = __mptcp_recvmsg_mskq(msk, msg, len - copied, flags, &tss, &cmsg_flags); ++ bytes_read = __mptcp_recvmsg_mskq(msk, msg, len - copied, flags, ++ copied, &tss, &cmsg_flags); + if (unlikely(bytes_read < 0)) { + if (!copied) + copied = bytes_read; diff --git a/queue-6.6/net-phy-dp83867-disable-eee-support-as-not-implemented.patch b/queue-6.6/net-phy-dp83867-disable-eee-support-as-not-implemented.patch new file mode 100644 index 0000000000..ae4d468d4c --- /dev/null +++ b/queue-6.6/net-phy-dp83867-disable-eee-support-as-not-implemented.patch @@ -0,0 +1,57 @@ +From stable+bounces-192077-greg=kroah.com@vger.kernel.org Mon Nov 3 03:59:19 2025 +From: Sasha Levin +Date: Sun, 2 Nov 2025 13:59:09 -0500 +Subject: net: phy: dp83867: Disable EEE support as not implemented +To: stable@vger.kernel.org +Cc: Emanuele Ghidoli , Andrew Lunn , Jakub Kicinski , Sasha Levin +Message-ID: <20251102185909.3552411-1-sashal@kernel.org> + +From: Emanuele Ghidoli + +[ Upstream commit 84a905290cb4c3d9a71a9e3b2f2e02e031e7512f ] + +While the DP83867 PHYs report EEE capability through their feature +registers, the actual hardware does not support EEE (see Links). +When the connected MAC enables EEE, it causes link instability and +communication failures. + +The issue is reproducible with a iMX8MP and relevant stmmac ethernet port. +Since the introduction of phylink-managed EEE support in the stmmac driver, +EEE is now enabled by default, leading to issues on systems using the +DP83867 PHY. + +Call phy_disable_eee during phy initialization to prevent EEE from being +enabled on DP83867 PHYs. + +Link: https://e2e.ti.com/support/interface-group/interface/f/interface-forum/1445244/dp83867ir-dp83867-disable-eee-lpi +Link: https://e2e.ti.com/support/interface-group/interface/f/interface-forum/658638/dp83867ir-eee-energy-efficient-ethernet +Fixes: 2a10154abcb7 ("net: phy: dp83867: Add TI dp83867 phy") +Cc: stable@vger.kernel.org +Signed-off-by: Emanuele Ghidoli +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20251023144857.529566-1-ghidoliemanuele@gmail.com +Signed-off-by: Jakub Kicinski +[ inlined phy_disable_eee() functionality ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/dp83867.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/net/phy/dp83867.c ++++ b/drivers/net/phy/dp83867.c +@@ -774,6 +774,14 @@ static int dp83867_config_init(struct ph + return ret; + } + ++ /* Although the DP83867 reports EEE capability through the ++ * MDIO_PCS_EEE_ABLE and MDIO_AN_EEE_ADV registers, the feature ++ * is not actually implemented in hardware. ++ */ ++ linkmode_zero(phydev->supported_eee); ++ linkmode_zero(phydev->advertising_eee); ++ phydev->eee_enabled = false; ++ + if (phy_interface_is_rgmii(phydev) || + phydev->interface == PHY_INTERFACE_MODE_SGMII) { + val = phy_read(phydev, MII_DP83867_PHYCTRL); diff --git a/queue-6.6/s390-pci-restore-irq-unconditionally-for-the-zpci-device.patch b/queue-6.6/s390-pci-restore-irq-unconditionally-for-the-zpci-device.patch new file mode 100644 index 0000000000..e936bf03b2 --- /dev/null +++ b/queue-6.6/s390-pci-restore-irq-unconditionally-for-the-zpci-device.patch @@ -0,0 +1,87 @@ +From stable+bounces-192100-greg=kroah.com@vger.kernel.org Mon Nov 3 08:29:26 2025 +From: Sasha Levin +Date: Sun, 2 Nov 2025 18:29:20 -0500 +Subject: s390/pci: Restore IRQ unconditionally for the zPCI device +To: stable@vger.kernel.org +Cc: Farhan Ali , stable@vger.kernnel.org, Niklas Schnelle , Matthew Rosato , Heiko Carstens , Sasha Levin +Message-ID: <20251102232920.3654814-1-sashal@kernel.org> + +From: Farhan Ali + +[ Upstream commit b45873c3f09153d1ad9b3a7bf9e5c0b0387fd2ea ] + +Commit c1e18c17bda6 ("s390/pci: add zpci_set_irq()/zpci_clear_irq()"), +introduced the zpci_set_irq() and zpci_clear_irq(), to be used while +resetting a zPCI device. + +Commit da995d538d3a ("s390/pci: implement reset_slot for hotplug +slot"), mentions zpci_clear_irq() being called in the path for +zpci_hot_reset_device(). But that is not the case anymore and these +functions are not called outside of this file. Instead +zpci_hot_reset_device() relies on zpci_disable_device() also clearing +the IRQs, but misses to reset the zdev->irqs_registered flag. + +However after a CLP disable/enable reset, the device's IRQ are +unregistered, but the flag zdev->irq_registered does not get cleared. It +creates an inconsistent state and so arch_restore_msi_irqs() doesn't +correctly restore the device's IRQ. This becomes a problem when a PCI +driver tries to restore the state of the device through +pci_restore_state(). Restore IRQ unconditionally for the device and remove +the irq_registered flag as its redundant. + +Fixes: c1e18c17bda6 ("s390/pci: add zpci_set_irq()/zpci_clear_irq()") +Cc: stable@vger.kernnel.org +Reviewed-by: Niklas Schnelle +Reviewed-by: Matthew Rosato +Signed-off-by: Farhan Ali +Signed-off-by: Heiko Carstens +[ adjusted bitfield context ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/include/asm/pci.h | 1 - + arch/s390/pci/pci_irq.c | 9 +-------- + 2 files changed, 1 insertion(+), 9 deletions(-) + +--- a/arch/s390/include/asm/pci.h ++++ b/arch/s390/include/asm/pci.h +@@ -138,7 +138,6 @@ struct zpci_dev { + u8 has_resources : 1; + u8 is_physfn : 1; + u8 util_str_avail : 1; +- u8 irqs_registered : 1; + u8 reserved : 2; + unsigned int devfn; /* DEVFN part of the RID*/ + +--- a/arch/s390/pci/pci_irq.c ++++ b/arch/s390/pci/pci_irq.c +@@ -107,9 +107,6 @@ static int zpci_set_irq(struct zpci_dev + else + rc = zpci_set_airq(zdev); + +- if (!rc) +- zdev->irqs_registered = 1; +- + return rc; + } + +@@ -123,9 +120,6 @@ static int zpci_clear_irq(struct zpci_de + else + rc = zpci_clear_airq(zdev); + +- if (!rc) +- zdev->irqs_registered = 0; +- + return rc; + } + +@@ -427,8 +421,7 @@ bool arch_restore_msi_irqs(struct pci_de + { + struct zpci_dev *zdev = to_zpci(pdev); + +- if (!zdev->irqs_registered) +- zpci_set_irq(zdev); ++ zpci_set_irq(zdev); + return true; + } + diff --git a/queue-6.6/series b/queue-6.6/series index f75e46fc57..330abcf8d2 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -43,3 +43,8 @@ block-fix-op_is_zone_mgmt-to-handle-req_op_zone_reset_all.patch block-make-req_op_zone_open-a-write-operation.patch regmap-slimbus-fix-bus_context-pointer-in-regmap-init-calls.patch drm-mediatek-fix-device-use-after-free-on-unbind.patch +mptcp-fix-msg_peek-stream-corruption.patch +s390-pci-restore-irq-unconditionally-for-the-zpci-device.patch +cpuidle-governors-menu-rearrange-main-loop-in-menu_select.patch +cpuidle-governors-menu-select-polling-state-in-some-more-cases.patch +net-phy-dp83867-disable-eee-support-as-not-implemented.patch