From: Sasha Levin Date: Mon, 10 Aug 2026 23:57:18 +0000 (-0400) Subject: Fixes for all trees X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=025f640ccb5a9c81605c96000d0e059ced9182ff;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-6.12/drm-amd-display-add-av-mute-wait-frames-to-dce110_se.patch b/queue-6.12/drm-amd-display-add-av-mute-wait-frames-to-dce110_se.patch new file mode 100644 index 0000000000..9163867e26 --- /dev/null +++ b/queue-6.12/drm-amd-display-add-av-mute-wait-frames-to-dce110_se.patch @@ -0,0 +1,65 @@ +From 18696d904dcae80ab4fb39c9af11001a1919fe2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jul 2026 22:23:34 +0800 +Subject: drm/amd/display: Add AV mute wait frames to dce110_set_avmute + +From: Ray Wu + +[ Upstream commit 443290d70b01e9c35830c300e3247c06581b594c ] + +Port the three-frame wait logic from dcn30_set_avmute to +dce110_set_avmute so that older DCN versions (1.0, 2.0) also +wait for GCP packets to be sent out before proceeding. + +This ensures HDMI sinks properly process the mute state, +preventing garbled display after link re-establishment. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5167 +Reviewed-by: Wayne Lin +Signed-off-by: Ray Wu +Signed-off-by: Fangzhi Zuo +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 414da24137ace80d8c59fefd43ba3ec9f5f854ba) +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 21 ++++++++++++++++++- + 1 file changed, 20 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +index 551638d9ff613..a4f092eb0857b 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +@@ -1256,8 +1256,27 @@ void dce110_blank_stream(struct pipe_ctx *pipe_ctx) + + void dce110_set_avmute(struct pipe_ctx *pipe_ctx, bool enable) + { +- if (pipe_ctx != NULL && pipe_ctx->stream_res.stream_enc != NULL) ++ if (pipe_ctx == NULL || pipe_ctx->stream_res.stream_enc == NULL) ++ return; ++ ++ if (dc_is_hdmi_signal(pipe_ctx->stream->signal)) { + pipe_ctx->stream_res.stream_enc->funcs->set_avmute(pipe_ctx->stream_res.stream_enc, enable); ++ ++ /* Wait for three frames to make sure AV mute is sent out. ++ * Some HDMI sinks need additional GCP packets to properly ++ * process the mute state, especially after link re-establishment ++ * with HDMI 2.0 scrambling enabled. ++ */ ++ if (enable && pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) { ++ int i; ++ ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); ++ for (i = 0; i < 3; i++) { ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK); ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); ++ } ++ } ++ } + } + + static enum audio_dto_source translate_to_dto_source(enum controller_id crtc_id) +-- +2.53.0 + diff --git a/queue-6.12/drm-amd-display-check-for-tg-ops-in-dce110_set_avmut.patch b/queue-6.12/drm-amd-display-check-for-tg-ops-in-dce110_set_avmut.patch new file mode 100644 index 0000000000..073f5ce232 --- /dev/null +++ b/queue-6.12/drm-amd-display-check-for-tg-ops-in-dce110_set_avmut.patch @@ -0,0 +1,50 @@ +From cfbf561b4bec4ac0335c273fa6e1275cb6f8d231 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Aug 2026 09:47:17 +0800 +Subject: drm/amd/display: Check for tg ops in dce110_set_avmute +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ray Wu + +[ Upstream commit 3141e3d61469bba2624a91c5e2407f110b33b29e ] + +Some older DCE timing generators do not implement is_tg_enabled in +their ops table. Calling it unconditionally when waiting for AV mute +frames causes a NULL pointer dereference on Southern Islands dGPUs +when turning the display off over HDMI. + +Check that tg and the required ops exist before waiting for frames. + +Fixes: 414da24137ac ("drm/amd/display: Add AV mute wait frames to dce110_set_avmute") +Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5557 +Tested-by: Viktor Jägersküpper +Signed-off-by: Ray Wu +Signed-off-by: Alex Deucher +(cherry picked from commit 2686a0c0aaa07bec2e24131835cf27b5fd4935a5) +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +index a4f092eb0857b..dcc78244dd7c3 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +@@ -1267,7 +1267,10 @@ void dce110_set_avmute(struct pipe_ctx *pipe_ctx, bool enable) + * process the mute state, especially after link re-establishment + * with HDMI 2.0 scrambling enabled. + */ +- if (enable && pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) { ++ if (enable && pipe_ctx->stream_res.tg && ++ pipe_ctx->stream_res.tg->funcs->is_tg_enabled && ++ pipe_ctx->stream_res.tg->funcs->wait_for_state && ++ pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) { + int i; + + pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); +-- +2.53.0 + diff --git a/queue-6.12/selftests-bpf-fail-unbound-udp-on-sockmap-update.patch b/queue-6.12/selftests-bpf-fail-unbound-udp-on-sockmap-update.patch new file mode 100644 index 0000000000..6420ace2bd --- /dev/null +++ b/queue-6.12/selftests-bpf-fail-unbound-udp-on-sockmap-update.patch @@ -0,0 +1,59 @@ +From 8565065b6242bcb9994465253a66a1642066f37a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Aug 2026 09:41:11 -0300 +Subject: selftests/bpf: Fail unbound UDP on sockmap update +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michal Luczaj + +[ Upstream commit 203b06932777b9ad5085319389dea566f5c2ca63 ] + +sockmap now rejects unbound UDP sockets. Adjust test_maps. While at it, +check socket()'s return value. + +This effectively reverts commit c39aa2159974 ("bpf, selftests: Fix +test_maps now that sockmap supports UDP"). + +Signed-off-by: Michal Luczaj +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Jakub Sitnicki +Link: https://lore.kernel.org/bpf/20260707-sockmap-lookup-udp-leak-v4-4-f878346f27ab@rbox.co +Signed-off-by: Kumar Kartikeya Dwivedi +Signed-off-by: Ricardo B. Marlière (SUSE) +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_maps.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c +index 905d5981ace1b..6f080cc7eb96d 100644 +--- a/tools/testing/selftests/bpf/test_maps.c ++++ b/tools/testing/selftests/bpf/test_maps.c +@@ -752,16 +752,15 @@ static void test_sockmap(unsigned int tasks, void *data) + goto out_sockmap; + } + +- /* Test update with unsupported UDP socket */ ++ /* Test update with unsupported unbound UDP socket */ + udp = socket(AF_INET, SOCK_DGRAM, 0); +- i = 0; +- err = bpf_map_update_elem(fd, &i, &udp, BPF_ANY); +- if (err) { +- printf("Failed socket update SOCK_DGRAM '%i:%i'\n", +- i, udp); ++ CHECK(udp < 0, "socket(AF_INET, SOCK_DGRAM)", "errno:%d\n", errno); ++ err = bpf_map_update_elem(fd, &(int){0}, &udp, BPF_ANY); ++ close(udp); ++ if (!err) { ++ printf("Unexpectedly succeeded unbound UDP update '0:%i'\n", udp); + goto out_sockmap; + } +- close(udp); + + /* Test update without programs */ + for (i = 0; i < 6; i++) { +-- +2.53.0 + diff --git a/queue-6.12/series b/queue-6.12/series index d51a045887..1c5d48325b 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -1 +1,4 @@ mount-honour-sb_nouser-in-the-new-mount-api.patch +selftests-bpf-fail-unbound-udp-on-sockmap-update.patch +drm-amd-display-add-av-mute-wait-frames-to-dce110_se.patch +drm-amd-display-check-for-tg-ops-in-dce110_set_avmut.patch diff --git a/queue-6.18/drm-amd-display-add-av-mute-wait-frames-to-dce110_se.patch b/queue-6.18/drm-amd-display-add-av-mute-wait-frames-to-dce110_se.patch new file mode 100644 index 0000000000..7511f4c8a1 --- /dev/null +++ b/queue-6.18/drm-amd-display-add-av-mute-wait-frames-to-dce110_se.patch @@ -0,0 +1,65 @@ +From ae07e397635c225c3f8deb7bd7defcfcfaa20f33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jul 2026 22:23:34 +0800 +Subject: drm/amd/display: Add AV mute wait frames to dce110_set_avmute + +From: Ray Wu + +[ Upstream commit 443290d70b01e9c35830c300e3247c06581b594c ] + +Port the three-frame wait logic from dcn30_set_avmute to +dce110_set_avmute so that older DCN versions (1.0, 2.0) also +wait for GCP packets to be sent out before proceeding. + +This ensures HDMI sinks properly process the mute state, +preventing garbled display after link re-establishment. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5167 +Reviewed-by: Wayne Lin +Signed-off-by: Ray Wu +Signed-off-by: Fangzhi Zuo +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 414da24137ace80d8c59fefd43ba3ec9f5f854ba) +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 21 ++++++++++++++++++- + 1 file changed, 20 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +index 8f86177de48dc..13ae93b945a33 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +@@ -1266,8 +1266,27 @@ void dce110_blank_stream(struct pipe_ctx *pipe_ctx) + + void dce110_set_avmute(struct pipe_ctx *pipe_ctx, bool enable) + { +- if (pipe_ctx != NULL && pipe_ctx->stream_res.stream_enc != NULL) ++ if (pipe_ctx == NULL || pipe_ctx->stream_res.stream_enc == NULL) ++ return; ++ ++ if (dc_is_hdmi_signal(pipe_ctx->stream->signal)) { + pipe_ctx->stream_res.stream_enc->funcs->set_avmute(pipe_ctx->stream_res.stream_enc, enable); ++ ++ /* Wait for three frames to make sure AV mute is sent out. ++ * Some HDMI sinks need additional GCP packets to properly ++ * process the mute state, especially after link re-establishment ++ * with HDMI 2.0 scrambling enabled. ++ */ ++ if (enable && pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) { ++ int i; ++ ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); ++ for (i = 0; i < 3; i++) { ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK); ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); ++ } ++ } ++ } + } + + enum audio_dto_source translate_to_dto_source(enum controller_id crtc_id) +-- +2.53.0 + diff --git a/queue-6.18/drm-amd-display-check-for-tg-ops-in-dce110_set_avmut.patch b/queue-6.18/drm-amd-display-check-for-tg-ops-in-dce110_set_avmut.patch new file mode 100644 index 0000000000..e9e9d2ba8b --- /dev/null +++ b/queue-6.18/drm-amd-display-check-for-tg-ops-in-dce110_set_avmut.patch @@ -0,0 +1,50 @@ +From e3fac42870588d55cdcb432fab7b0789f4a1e117 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Aug 2026 09:47:17 +0800 +Subject: drm/amd/display: Check for tg ops in dce110_set_avmute +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ray Wu + +[ Upstream commit 3141e3d61469bba2624a91c5e2407f110b33b29e ] + +Some older DCE timing generators do not implement is_tg_enabled in +their ops table. Calling it unconditionally when waiting for AV mute +frames causes a NULL pointer dereference on Southern Islands dGPUs +when turning the display off over HDMI. + +Check that tg and the required ops exist before waiting for frames. + +Fixes: 414da24137ac ("drm/amd/display: Add AV mute wait frames to dce110_set_avmute") +Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5557 +Tested-by: Viktor Jägersküpper +Signed-off-by: Ray Wu +Signed-off-by: Alex Deucher +(cherry picked from commit 2686a0c0aaa07bec2e24131835cf27b5fd4935a5) +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +index 13ae93b945a33..fe02dc4e97e4a 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +@@ -1277,7 +1277,10 @@ void dce110_set_avmute(struct pipe_ctx *pipe_ctx, bool enable) + * process the mute state, especially after link re-establishment + * with HDMI 2.0 scrambling enabled. + */ +- if (enable && pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) { ++ if (enable && pipe_ctx->stream_res.tg && ++ pipe_ctx->stream_res.tg->funcs->is_tg_enabled && ++ pipe_ctx->stream_res.tg->funcs->wait_for_state && ++ pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) { + int i; + + pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); +-- +2.53.0 + diff --git a/queue-6.18/sched-fair-revert-6d71a9c61604-sched-fair-fix-eevdf-.patch b/queue-6.18/sched-fair-revert-6d71a9c61604-sched-fair-fix-eevdf-.patch new file mode 100644 index 0000000000..3ef4df6603 --- /dev/null +++ b/queue-6.18/sched-fair-revert-6d71a9c61604-sched-fair-fix-eevdf-.patch @@ -0,0 +1,258 @@ +From 6d68e023eae3fdf2fb59ec3df4c89f5297d0d7a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Apr 2026 21:10:53 +0000 +Subject: sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity + placement bug causing scheduling lag") + +From: Peter Zijlstra + +[ Upstream commit 101f3498b4bdfef97152a444847948de1543f692 ] + +Zicheng Qu reported that, because avg_vruntime() always includes +cfs_rq->curr, when ->on_rq, place_entity() doesn't work right. + +Specifically, the lag scaling in place_entity() relies on +avg_vruntime() being the state *before* placement of the new entity. +However in this case avg_vruntime() will actually already include the +entity, which breaks things. + +Also, Zicheng Qu argues that avg_vruntime should be invariant under +reweight. IOW commit 6d71a9c61604 ("sched/fair: Fix EEVDF entity +placement bug causing scheduling lag") was wrong! + +The issue reported in 6d71a9c61604 could possibly be explained by +rounding artifacts -- notably the extreme weight '2' is outside of the +range of avg_vruntime/sum_w_vruntime, since that uses +scale_load_down(). By scaling vruntime by the real weight, but +accounting it in vruntime with a factor 1024 more, the average moves +significantly. However, that is now cured. + +Tested by reverting 66951e4860d3 ("sched/fair: Fix update_cfs_group() +vs DELAY_DEQUEUE") and tracing vruntime and vlag figures again. + +Reported-by: Zicheng Qu +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Vincent Guittot +Tested-by: K Prateek Nayak +Tested-by: Shubhang Kaushik +Link: https://patch.msgid.link/20260219080625.066102672%40infradead.org +(cherry picked from commit 101f3498b4bdfef97152a444847948de1543f692) +[jstultz: Resolved minor collision in the revert against 6.18-stable] +Signed-off-by: John Stultz +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 148 +++++++++++++++++++++++++++++++++++++------- + 1 file changed, 124 insertions(+), 24 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index ac5f08cd01a83..aed035aaece1d 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -764,17 +764,22 @@ static inline u64 cfs_rq_max_slice(struct cfs_rq *cfs_rq); + * + * -r_max < lag < max(r_max, q) + */ +-static void update_entity_lag(struct cfs_rq *cfs_rq, struct sched_entity *se) ++static s64 entity_lag(struct cfs_rq *cfs_rq, struct sched_entity *se, u64 avruntime) + { + u64 max_slice = cfs_rq_max_slice(cfs_rq) + TICK_NSEC; + s64 vlag, limit; + +- WARN_ON_ONCE(!se->on_rq); +- +- vlag = avg_vruntime(cfs_rq) - se->vruntime; ++ vlag = avruntime - se->vruntime; + limit = calc_delta_fair(max_slice, se); + +- se->vlag = clamp(vlag, -limit, limit); ++ return clamp(vlag, -limit, limit); ++} ++ ++static void update_entity_lag(struct cfs_rq *cfs_rq, struct sched_entity *se) ++{ ++ WARN_ON_ONCE(!se->on_rq); ++ ++ se->vlag = entity_lag(cfs_rq, se, avg_vruntime(cfs_rq)); + } + + /* +@@ -3838,23 +3843,125 @@ dequeue_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) + cfs_rq->avg.load_avg * PELT_MIN_DIVIDER); + } + +-static void place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags); ++static void ++rescale_entity(struct sched_entity *se, unsigned long weight, bool rel_vprot) ++{ ++ unsigned long old_weight = se->load.weight; ++ ++ /* ++ * VRUNTIME ++ * -------- ++ * ++ * COROLLARY #1: The virtual runtime of the entity needs to be ++ * adjusted if re-weight at !0-lag point. ++ * ++ * Proof: For contradiction assume this is not true, so we can ++ * re-weight without changing vruntime at !0-lag point. ++ * ++ * Weight VRuntime Avg-VRuntime ++ * before w v V ++ * after w' v' V' ++ * ++ * Since lag needs to be preserved through re-weight: ++ * ++ * lag = (V - v)*w = (V'- v')*w', where v = v' ++ * ==> V' = (V - v)*w/w' + v (1) ++ * ++ * Let W be the total weight of the entities before reweight, ++ * since V' is the new weighted average of entities: ++ * ++ * V' = (WV + w'v - wv) / (W + w' - w) (2) ++ * ++ * by using (1) & (2) we obtain: ++ * ++ * (WV + w'v - wv) / (W + w' - w) = (V - v)*w/w' + v ++ * ==> (WV-Wv+Wv+w'v-wv)/(W+w'-w) = (V - v)*w/w' + v ++ * ==> (WV - Wv)/(W + w' - w) + v = (V - v)*w/w' + v ++ * ==> (V - v)*W/(W + w' - w) = (V - v)*w/w' (3) ++ * ++ * Since we are doing at !0-lag point which means V != v, we ++ * can simplify (3): ++ * ++ * ==> W / (W + w' - w) = w / w' ++ * ==> Ww' = Ww + ww' - ww ++ * ==> W * (w' - w) = w * (w' - w) ++ * ==> W = w (re-weight indicates w' != w) ++ * ++ * So the cfs_rq contains only one entity, hence vruntime of ++ * the entity @v should always equal to the cfs_rq's weighted ++ * average vruntime @V, which means we will always re-weight ++ * at 0-lag point, thus breach assumption. Proof completed. ++ * ++ * ++ * COROLLARY #2: Re-weight does NOT affect weighted average ++ * vruntime of all the entities. ++ * ++ * Proof: According to corollary #1, Eq. (1) should be: ++ * ++ * (V - v)*w = (V' - v')*w' ++ * ==> v' = V' - (V - v)*w/w' (4) ++ * ++ * According to the weighted average formula, we have: ++ * ++ * V' = (WV - wv + w'v') / (W - w + w') ++ * = (WV - wv + w'(V' - (V - v)w/w')) / (W - w + w') ++ * = (WV - wv + w'V' - Vw + wv) / (W - w + w') ++ * = (WV + w'V' - Vw) / (W - w + w') ++ * ++ * ==> V'*(W - w + w') = WV + w'V' - Vw ++ * ==> V' * (W - w) = (W - w) * V (5) ++ * ++ * If the entity is the only one in the cfs_rq, then reweight ++ * always occurs at 0-lag point, so V won't change. Or else ++ * there are other entities, hence W != w, then Eq. (5) turns ++ * into V' = V. So V won't change in either case, proof done. ++ * ++ * ++ * So according to corollary #1 & #2, the effect of re-weight ++ * on vruntime should be: ++ * ++ * v' = V' - (V - v) * w / w' (4) ++ * = V - (V - v) * w / w' ++ * = V - vl * w / w' ++ * = V - vl' ++ */ ++ se->vlag = div64_long(se->vlag * old_weight, weight); ++ ++ /* ++ * DEADLINE ++ * -------- ++ * ++ * When the weight changes, the virtual time slope changes and ++ * we should adjust the relative virtual deadline accordingly. ++ * ++ * d' = v' + (d - v)*w/w' ++ * = V' - (V - v)*w/w' + (d - v)*w/w' ++ * = V - (V - v)*w/w' + (d - v)*w/w' ++ * = V + (d - V)*w/w' ++ */ ++ if (se->rel_deadline) ++ se->deadline = div64_long(se->deadline * old_weight, weight); ++ ++ if (rel_vprot) ++ se->vprot = div64_long(se->vprot * old_weight, weight); ++} + + static void reweight_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, + unsigned long weight) + { + bool curr = cfs_rq->curr == se; + bool rel_vprot = false; +- u64 vprot; ++ u64 avruntime = 0; + + if (se->on_rq) { + /* commit outstanding execution time */ + update_curr(cfs_rq); +- update_entity_lag(cfs_rq, se); +- se->deadline -= se->vruntime; ++ avruntime = avg_vruntime(cfs_rq); ++ se->vlag = entity_lag(cfs_rq, se, avruntime); ++ se->deadline -= avruntime; + se->rel_deadline = 1; + if (curr && protect_slice(se)) { +- vprot = se->vprot - se->vruntime; ++ se->vprot -= avruntime; + rel_vprot = true; + } + +@@ -3865,30 +3972,23 @@ static void reweight_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, + } + dequeue_load_avg(cfs_rq, se); + +- /* +- * Because we keep se->vlag = V - v_i, while: lag_i = w_i*(V - v_i), +- * we need to scale se->vlag when w_i changes. +- */ +- se->vlag = div_s64(se->vlag * se->load.weight, weight); +- if (se->rel_deadline) +- se->deadline = div_s64(se->deadline * se->load.weight, weight); +- +- if (rel_vprot) +- vprot = div_s64(vprot * se->load.weight, weight); ++ rescale_entity(se, weight, rel_vprot); + + update_load_set(&se->load, weight); + + do { + u32 divider = get_pelt_divider(&se->avg); +- + se->avg.load_avg = div_u64(se_weight(se) * se->avg.load_sum, divider); + } while (0); + + enqueue_load_avg(cfs_rq, se); + if (se->on_rq) { +- place_entity(cfs_rq, se, 0); + if (rel_vprot) +- se->vprot = se->vruntime + vprot; ++ se->vprot += avruntime; ++ se->deadline += avruntime; ++ se->rel_deadline = 0; ++ se->vruntime = avruntime - se->vlag; ++ + update_load_add(&cfs_rq->load, se->load.weight); + if (!curr) + __enqueue_entity(cfs_rq, se); +@@ -5288,7 +5388,7 @@ place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags) + + se->vruntime = vruntime - lag; + +- if (se->rel_deadline) { ++ if (sched_feat(PLACE_REL_DEADLINE) && se->rel_deadline) { + se->deadline += se->vruntime; + se->rel_deadline = 0; + return; +-- +2.53.0 + diff --git a/queue-6.18/selftests-bpf-fail-unbound-udp-on-sockmap-update.patch b/queue-6.18/selftests-bpf-fail-unbound-udp-on-sockmap-update.patch new file mode 100644 index 0000000000..2d73e4520f --- /dev/null +++ b/queue-6.18/selftests-bpf-fail-unbound-udp-on-sockmap-update.patch @@ -0,0 +1,59 @@ +From dd2a31312368368ed38664a232c4e197e12c3a8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Aug 2026 09:41:11 -0300 +Subject: selftests/bpf: Fail unbound UDP on sockmap update +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michal Luczaj + +[ Upstream commit 203b06932777b9ad5085319389dea566f5c2ca63 ] + +sockmap now rejects unbound UDP sockets. Adjust test_maps. While at it, +check socket()'s return value. + +This effectively reverts commit c39aa2159974 ("bpf, selftests: Fix +test_maps now that sockmap supports UDP"). + +Signed-off-by: Michal Luczaj +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Jakub Sitnicki +Link: https://lore.kernel.org/bpf/20260707-sockmap-lookup-udp-leak-v4-4-f878346f27ab@rbox.co +Signed-off-by: Kumar Kartikeya Dwivedi +Signed-off-by: Ricardo B. Marlière (SUSE) +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_maps.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c +index 3fae9ce46ca9b..cea33b94d06f8 100644 +--- a/tools/testing/selftests/bpf/test_maps.c ++++ b/tools/testing/selftests/bpf/test_maps.c +@@ -748,16 +748,15 @@ static void test_sockmap(unsigned int tasks, void *data) + goto out_sockmap; + } + +- /* Test update with unsupported UDP socket */ ++ /* Test update with unsupported unbound UDP socket */ + udp = socket(AF_INET, SOCK_DGRAM, 0); +- i = 0; +- err = bpf_map_update_elem(fd, &i, &udp, BPF_ANY); +- if (err) { +- printf("Failed socket update SOCK_DGRAM '%i:%i'\n", +- i, udp); ++ CHECK(udp < 0, "socket(AF_INET, SOCK_DGRAM)", "errno:%d\n", errno); ++ err = bpf_map_update_elem(fd, &(int){0}, &udp, BPF_ANY); ++ close(udp); ++ if (!err) { ++ printf("Unexpectedly succeeded unbound UDP update '0:%i'\n", udp); + goto out_sockmap; + } +- close(udp); + + /* Test update without programs */ + for (i = 0; i < 6; i++) { +-- +2.53.0 + diff --git a/queue-6.18/series b/queue-6.18/series index b231884439..bca57c8862 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -1,2 +1,6 @@ kvm-s390-pci-fix-resource-leak-on-irq-registration-f.patch mount-honour-sb_nouser-in-the-new-mount-api.patch +sched-fair-revert-6d71a9c61604-sched-fair-fix-eevdf-.patch +selftests-bpf-fail-unbound-udp-on-sockmap-update.patch +drm-amd-display-add-av-mute-wait-frames-to-dce110_se.patch +drm-amd-display-check-for-tg-ops-in-dce110_set_avmut.patch diff --git a/queue-6.6/selftests-bpf-fail-unbound-udp-on-sockmap-update.patch b/queue-6.6/selftests-bpf-fail-unbound-udp-on-sockmap-update.patch new file mode 100644 index 0000000000..8490e9cbc4 --- /dev/null +++ b/queue-6.6/selftests-bpf-fail-unbound-udp-on-sockmap-update.patch @@ -0,0 +1,59 @@ +From 23bd0d4f46ae8135b052a6d887aa627a9727c534 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Aug 2026 09:41:11 -0300 +Subject: selftests/bpf: Fail unbound UDP on sockmap update +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michal Luczaj + +[ Upstream commit 203b06932777b9ad5085319389dea566f5c2ca63 ] + +sockmap now rejects unbound UDP sockets. Adjust test_maps. While at it, +check socket()'s return value. + +This effectively reverts commit c39aa2159974 ("bpf, selftests: Fix +test_maps now that sockmap supports UDP"). + +Signed-off-by: Michal Luczaj +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Jakub Sitnicki +Link: https://lore.kernel.org/bpf/20260707-sockmap-lookup-udp-leak-v4-4-f878346f27ab@rbox.co +Signed-off-by: Kumar Kartikeya Dwivedi +Signed-off-by: Ricardo B. Marlière (SUSE) +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_maps.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c +index e0dd101c9f2bd..f2a27143edc34 100644 +--- a/tools/testing/selftests/bpf/test_maps.c ++++ b/tools/testing/selftests/bpf/test_maps.c +@@ -752,16 +752,15 @@ static void test_sockmap(unsigned int tasks, void *data) + goto out_sockmap; + } + +- /* Test update with unsupported UDP socket */ ++ /* Test update with unsupported unbound UDP socket */ + udp = socket(AF_INET, SOCK_DGRAM, 0); +- i = 0; +- err = bpf_map_update_elem(fd, &i, &udp, BPF_ANY); +- if (err) { +- printf("Failed socket update SOCK_DGRAM '%i:%i'\n", +- i, udp); ++ CHECK(udp < 0, "socket(AF_INET, SOCK_DGRAM)", "errno:%d\n", errno); ++ err = bpf_map_update_elem(fd, &(int){0}, &udp, BPF_ANY); ++ close(udp); ++ if (!err) { ++ printf("Unexpectedly succeeded unbound UDP update '0:%i'\n", udp); + goto out_sockmap; + } +- close(udp); + + /* Test update without programs */ + for (i = 0; i < 6; i++) { +-- +2.53.0 + diff --git a/queue-6.6/series b/queue-6.6/series index d51a045887..bf7fbe4bf4 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -1 +1,2 @@ mount-honour-sb_nouser-in-the-new-mount-api.patch +selftests-bpf-fail-unbound-udp-on-sockmap-update.patch diff --git a/queue-7.1/drm-amd-display-add-av-mute-wait-frames-to-dce110_se.patch b/queue-7.1/drm-amd-display-add-av-mute-wait-frames-to-dce110_se.patch new file mode 100644 index 0000000000..9ef18d0f2c --- /dev/null +++ b/queue-7.1/drm-amd-display-add-av-mute-wait-frames-to-dce110_se.patch @@ -0,0 +1,65 @@ +From 1b51524ae4a7b0ead79dc38c9f2115dc539f64fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jul 2026 22:23:34 +0800 +Subject: drm/amd/display: Add AV mute wait frames to dce110_set_avmute + +From: Ray Wu + +[ Upstream commit 443290d70b01e9c35830c300e3247c06581b594c ] + +Port the three-frame wait logic from dcn30_set_avmute to +dce110_set_avmute so that older DCN versions (1.0, 2.0) also +wait for GCP packets to be sent out before proceeding. + +This ensures HDMI sinks properly process the mute state, +preventing garbled display after link re-establishment. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5167 +Reviewed-by: Wayne Lin +Signed-off-by: Ray Wu +Signed-off-by: Fangzhi Zuo +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 414da24137ace80d8c59fefd43ba3ec9f5f854ba) +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 21 ++++++++++++++++++- + 1 file changed, 20 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +index f0abbb7c2cb24..d2a27aca6cd76 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +@@ -1320,8 +1320,27 @@ void dce110_blank_stream(struct pipe_ctx *pipe_ctx) + + void dce110_set_avmute(struct pipe_ctx *pipe_ctx, bool enable) + { +- if (pipe_ctx != NULL && pipe_ctx->stream_res.stream_enc != NULL) ++ if (pipe_ctx == NULL || pipe_ctx->stream_res.stream_enc == NULL) ++ return; ++ ++ if (dc_is_hdmi_signal(pipe_ctx->stream->signal)) { + pipe_ctx->stream_res.stream_enc->funcs->set_avmute(pipe_ctx->stream_res.stream_enc, enable); ++ ++ /* Wait for three frames to make sure AV mute is sent out. ++ * Some HDMI sinks need additional GCP packets to properly ++ * process the mute state, especially after link re-establishment ++ * with HDMI 2.0 scrambling enabled. ++ */ ++ if (enable && pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) { ++ int i; ++ ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); ++ for (i = 0; i < 3; i++) { ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK); ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); ++ } ++ } ++ } + } + + enum audio_dto_source translate_to_dto_source(enum controller_id crtc_id) +-- +2.53.0 + diff --git a/queue-7.1/drm-amd-display-check-for-tg-ops-in-dce110_set_avmut.patch b/queue-7.1/drm-amd-display-check-for-tg-ops-in-dce110_set_avmut.patch new file mode 100644 index 0000000000..b6ada5b524 --- /dev/null +++ b/queue-7.1/drm-amd-display-check-for-tg-ops-in-dce110_set_avmut.patch @@ -0,0 +1,50 @@ +From 57fc0811228fa9c744167a361a43f772a72cdb27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Aug 2026 09:47:17 +0800 +Subject: drm/amd/display: Check for tg ops in dce110_set_avmute +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ray Wu + +[ Upstream commit 3141e3d61469bba2624a91c5e2407f110b33b29e ] + +Some older DCE timing generators do not implement is_tg_enabled in +their ops table. Calling it unconditionally when waiting for AV mute +frames causes a NULL pointer dereference on Southern Islands dGPUs +when turning the display off over HDMI. + +Check that tg and the required ops exist before waiting for frames. + +Fixes: 414da24137ac ("drm/amd/display: Add AV mute wait frames to dce110_set_avmute") +Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5557 +Tested-by: Viktor Jägersküpper +Signed-off-by: Ray Wu +Signed-off-by: Alex Deucher +(cherry picked from commit 2686a0c0aaa07bec2e24131835cf27b5fd4935a5) +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +index d2a27aca6cd76..3b26229eff2b6 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +@@ -1331,7 +1331,10 @@ void dce110_set_avmute(struct pipe_ctx *pipe_ctx, bool enable) + * process the mute state, especially after link re-establishment + * with HDMI 2.0 scrambling enabled. + */ +- if (enable && pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) { ++ if (enable && pipe_ctx->stream_res.tg && ++ pipe_ctx->stream_res.tg->funcs->is_tg_enabled && ++ pipe_ctx->stream_res.tg->funcs->wait_for_state && ++ pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) { + int i; + + pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); +-- +2.53.0 + diff --git a/queue-7.1/gpio-pca953x-fix-pca953x_irq_bus_sync_unlock-regmap-.patch b/queue-7.1/gpio-pca953x-fix-pca953x_irq_bus_sync_unlock-regmap-.patch new file mode 100644 index 0000000000..cf6263cd3a --- /dev/null +++ b/queue-7.1/gpio-pca953x-fix-pca953x_irq_bus_sync_unlock-regmap-.patch @@ -0,0 +1,89 @@ +From c589ba7924f5c00a67368efd81a3c071adcbb24c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2026 12:51:44 +1200 +Subject: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock + +From: Mark Tomlinson + +[ Upstream commit 9dc325327babe7f159e84cbe9380a45342da0585 ] + +Locking is disabled in the regmap config as this driver uses its own +lock. This means that all calls to regmap functions (read or write) must +hold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do +this, and it was therefore possible that multiple threads could cause an +incorrect register to be read/written. + +A previous patch partly fixed this, but only protected the write to the +interrupt mask register, and not the read from the direction register. + +Fixes: bfc6444b57dc ("gpio: pca953x: fix pca953x_irq_bus_sync_unlock race") +Cc: stable@vger.kernel.org +Signed-off-by: Mark Tomlinson +Link: https://patch.msgid.link/20260709045116.2304246-1-mark.tomlinson@alliedtelesis.co.nz +Signed-off-by: Bartosz Golaszewski +(cherry picked from commit 9dc325327babe7f159e84cbe9380a45342da0585) +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-pca953x.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c +index 69c5bd9aaee7c..cb282b35fb58d 100644 +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -605,20 +605,28 @@ static int pca953x_read_regs(struct pca953x_chip *chip, int reg, unsigned long * + return 0; + } + +-static int pca953x_gpio_direction_input(struct gpio_chip *gc, unsigned off) ++static int pca953x_gpio_direction_input_unlocked(struct gpio_chip *gc, ++ unsigned int off) + { + struct pca953x_chip *chip = gpiochip_get_data(gc); + u8 dirreg = chip->recalc_addr(chip, chip->regs->direction, off); + u8 bit = pca953x_get_bit_mask(chip, off); + +- guard(mutex)(&chip->i2c_lock); +- + if (PCA_CHIP_TYPE(chip->driver_data) == TCA6418_TYPE) + return regmap_update_bits(chip->regmap, dirreg, bit, 0); + + return regmap_update_bits(chip->regmap, dirreg, bit, bit); + } + ++static int pca953x_gpio_direction_input(struct gpio_chip *gc, unsigned int off) ++{ ++ struct pca953x_chip *chip = gpiochip_get_data(gc); ++ ++ guard(mutex)(&chip->i2c_lock); ++ ++ return pca953x_gpio_direction_input_unlocked(gc, off); ++} ++ + static int pca953x_gpio_direction_output(struct gpio_chip *gc, + unsigned off, int val) + { +@@ -856,9 +864,10 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d) + DECLARE_BITMAP(reg_direction, MAX_LINE); + int level; + ++ guard(mutex)(&chip->i2c_lock); ++ + if (chip->driver_data & PCA_PCAL) { + DECLARE_BITMAP(latched_inputs, MAX_LINE); +- guard(mutex)(&chip->i2c_lock); + + /* Enable latch on edge-triggered interrupt-enabled inputs */ + bitmap_or(latched_inputs, chip->irq_trig_fall, chip->irq_trig_raise, gc->ngpio); +@@ -882,7 +891,7 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d) + + /* Look for any newly setup interrupt */ + for_each_set_bit(level, irq_mask, gc->ngpio) +- pca953x_gpio_direction_input(&chip->gpio_chip, level); ++ pca953x_gpio_direction_input_unlocked(&chip->gpio_chip, level); + + mutex_unlock(&chip->irq_lock); + } +-- +2.53.0 + diff --git a/queue-7.1/selftests-bpf-add-tests-for-sleepable-tracepoint-pro.patch b/queue-7.1/selftests-bpf-add-tests-for-sleepable-tracepoint-pro.patch new file mode 100644 index 0000000000..4c2971f552 --- /dev/null +++ b/queue-7.1/selftests-bpf-add-tests-for-sleepable-tracepoint-pro.patch @@ -0,0 +1,77 @@ +From 3e20903c64673df4b6e5c7e64746c116553f8e25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Aug 2026 09:42:11 -0300 +Subject: selftests/bpf: Add tests for sleepable tracepoint programs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mykyta Yatsenko + +[ Upstream commit 8a20655749c625dcc4debdfdeeaa0cf8bb85c203 ] + +Cover all three sleepable tracepoint types (tp_btf.s, raw_tp.s, tp.s) +and sys_exit (via bpf_task_pt_regs) with functional tests using +bpf_copy_from_user() on getcwd. Verify alias and bare SEC variants, +bpf_prog_test_run_raw_tp() with BPF_F_TEST_RUN_ON_CPU rejection, +attach-time rejection on non-faultable tracepoints, and load-time +rejection for sleepable tp_btf on non-faultable tracepoints. + +[ rbm: Removed hunks from (new) files: + tools/testing/selftests/bpf/prog_tests/sleepable_tracepoints.c + tools/testing/selftests/bpf/progs/test_sleepable_tracepoints.c + tools/testing/selftests/bpf/progs/test_sleepable_tracepoints_fail.c + These rely on libbpf's ".s" tracepoint section handlers + (0cd420a6f40c7) and on kernel-side sleepable tracepoint runtime + support (439ebd5b5708, 12628ffaf98b, 57918341dd19), none of which + are backported here; kept only the verifier/sleepable.c hunk, which + is correct and needed on its own. ] + +Signed-off-by: Mykyta Yatsenko +Acked-by: Kumar Kartikeya Dwivedi +Link: https://lore.kernel.org/bpf/20260422-sleepable_tracepoints-v13-6-99005dff21ef@meta.com +Signed-off-by: Kumar Kartikeya Dwivedi +Signed-off-by: Ricardo B. Marlière (SUSE) +Signed-off-by: Sasha Levin +--- + .../testing/selftests/bpf/verifier/sleepable.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/bpf/verifier/sleepable.c b/tools/testing/selftests/bpf/verifier/sleepable.c +index c2b7f5ebf168c..6dabc55229455 100644 +--- a/tools/testing/selftests/bpf/verifier/sleepable.c ++++ b/tools/testing/selftests/bpf/verifier/sleepable.c +@@ -76,7 +76,20 @@ + .runs = -1, + }, + { +- "sleepable raw tracepoint reject", ++ "sleepable raw tracepoint accept", ++ .insns = { ++ BPF_MOV64_IMM(BPF_REG_0, 0), ++ BPF_EXIT_INSN(), ++ }, ++ .prog_type = BPF_PROG_TYPE_TRACING, ++ .expected_attach_type = BPF_TRACE_RAW_TP, ++ .kfunc = "sys_enter", ++ .result = ACCEPT, ++ .flags = BPF_F_SLEEPABLE, ++ .runs = -1, ++}, ++{ ++ "sleepable raw tracepoint reject non-faultable", + .insns = { + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), +@@ -85,7 +98,7 @@ + .expected_attach_type = BPF_TRACE_RAW_TP, + .kfunc = "sched_switch", + .result = REJECT, +- .errstr = "Only fentry/fexit/fsession/fmod_ret, lsm, iter, uprobe, and struct_ops programs can be sleepable", ++ .errstr = "Sleepable program cannot attach to non-faultable tracepoint", + .flags = BPF_F_SLEEPABLE, + .runs = -1, + }, +-- +2.53.0 + diff --git a/queue-7.1/selftests-bpf-fail-unbound-udp-on-sockmap-update.patch b/queue-7.1/selftests-bpf-fail-unbound-udp-on-sockmap-update.patch new file mode 100644 index 0000000000..840e98ced0 --- /dev/null +++ b/queue-7.1/selftests-bpf-fail-unbound-udp-on-sockmap-update.patch @@ -0,0 +1,59 @@ +From 257aa48ccad5edfe837604a41ef43a613f41dd91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Aug 2026 09:41:11 -0300 +Subject: selftests/bpf: Fail unbound UDP on sockmap update +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michal Luczaj + +[ Upstream commit 203b06932777b9ad5085319389dea566f5c2ca63 ] + +sockmap now rejects unbound UDP sockets. Adjust test_maps. While at it, +check socket()'s return value. + +This effectively reverts commit c39aa2159974 ("bpf, selftests: Fix +test_maps now that sockmap supports UDP"). + +Signed-off-by: Michal Luczaj +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Jakub Sitnicki +Link: https://lore.kernel.org/bpf/20260707-sockmap-lookup-udp-leak-v4-4-f878346f27ab@rbox.co +Signed-off-by: Kumar Kartikeya Dwivedi +Signed-off-by: Ricardo B. Marlière (SUSE) +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_maps.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c +index ccc5acd55ff9d..d194b44ff8be8 100644 +--- a/tools/testing/selftests/bpf/test_maps.c ++++ b/tools/testing/selftests/bpf/test_maps.c +@@ -748,16 +748,15 @@ static void test_sockmap(unsigned int tasks, void *data) + goto out_sockmap; + } + +- /* Test update with unsupported UDP socket */ ++ /* Test update with unsupported unbound UDP socket */ + udp = socket(AF_INET, SOCK_DGRAM, 0); +- i = 0; +- err = bpf_map_update_elem(fd, &i, &udp, BPF_ANY); +- if (err) { +- printf("Failed socket update SOCK_DGRAM '%i:%i'\n", +- i, udp); ++ CHECK(udp < 0, "socket(AF_INET, SOCK_DGRAM)", "errno:%d\n", errno); ++ err = bpf_map_update_elem(fd, &(int){0}, &udp, BPF_ANY); ++ close(udp); ++ if (!err) { ++ printf("Unexpectedly succeeded unbound UDP update '0:%i'\n", udp); + goto out_sockmap; + } +- close(udp); + + /* Test update without programs */ + for (i = 0; i < 6; i++) { +-- +2.53.0 + diff --git a/queue-7.1/series b/queue-7.1/series index d51a045887..e69ca3316b 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -1 +1,6 @@ mount-honour-sb_nouser-in-the-new-mount-api.patch +selftests-bpf-fail-unbound-udp-on-sockmap-update.patch +selftests-bpf-add-tests-for-sleepable-tracepoint-pro.patch +gpio-pca953x-fix-pca953x_irq_bus_sync_unlock-regmap-.patch +drm-amd-display-add-av-mute-wait-frames-to-dce110_se.patch +drm-amd-display-check-for-tg-ops-in-dce110_set_avmut.patch