- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/8] Add support for vTLBID
by Jinqian Yang 14 Oct '26

14 Oct '26

This series adds KVM/arm64 support for the ARM TLB invalidation domain (TLBID) extension. With TLBID a guest can scope its TLB invalidation broadcasts to a virtual domain (vDomain). User space discovers the feature through the new KVM_CAP_ARM_TLBIDOMAIN capability. The number of supported vDomains is queried with the new VM ioctl KVM_ARM_GET_VDOMAIN_NUM, and the per-vCPU ioctl KVM_ARM_VCPU_SET_VDOMAIN tells KVM which vDomains each vCPU belongs to, via a vDomain bitmap. KVM maintains a per-VM mapping from vDomains to the physical CPUs that run their member vCPUs, and reprogrammes the VTLBID(n)_EL2 registers on every vCPU load, so that a guest TLBI tagged with a vDomain ID only reaches the physical CPUs currently running that vDomain's vCPUs. Because DVMBM and TLBID are mutually exclusive, DVMBM is force-disabled once TLBID is enabled for a VM. On the guest side, TLBIDIDR_EL1 is emulated with virtual domain counts clamped to the hardware limits, the ID_AA64MMFR4_EL1.TLBID field is exposed only when the feature is active for the VM, and guest accesses to TLBIDIDR_EL1 are trapped and handled by KVM. The feature is gated behind CONFIG_KVM_ARM_VTLBID \and additionally requires hardware TLBID support at run time. Tracepoints are added for the vCPU load path so that the vDomain-to-pCPU mapping can be observed. Jinqian Yang (8): KVM: arm64: Introduce TLBID virtualization infrastructure KVM: arm64: Add VTLBID sysregs and update VTLBID(n) on vCPU load KVM: arm64: Wire up TLBID vDomain configuration ioctls KVM: arm64: Ensure DVMBM is disabled when TLBID is enabled KVM: arm64: Emulate TLBIDIDR_EL1 with virtual domain counts KVM: arm64: Conditionally expose ID_AA64MMFR4_EL1.TLBID to guest KVM: arm64: Enable TLBIDIDR_EL1 access trap in guest KVM: arm64: Add tracepoints for TLBID vDomain load events Documentation/virt/kvm/api.rst | 58 +++ arch/arm64/include/asm/kvm_host.h | 53 +++ arch/arm64/include/uapi/asm/kvm.h | 2 + arch/arm64/kvm/Kconfig | 12 + arch/arm64/kvm/arm.c | 530 ++++++++++++++++++++++++++- arch/arm64/kvm/hisilicon/hisi_virt.c | 9 + arch/arm64/kvm/sys_regs.c | 76 +++- arch/arm64/kvm/sys_regs.h | 6 + arch/arm64/kvm/trace_arm.h | 47 +++ arch/arm64/tools/sysreg | 23 +- include/uapi/linux/kvm.h | 14 + 11 files changed, 826 insertions(+), 4 deletions(-) -- 2.33.0

2 9

[PATCH OLK-6.6] Add NI_RANDOM
by Luo Gengkun 14 Oct '26

14 Oct '26

Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- ...ed-fair-Proportional-newidle-balance.patch | 208 ++++++++++++++++++ ...complex-proportional-newidle-balance.patch | 133 +++++++++++ 2 files changed, 341 insertions(+) create mode 100644 NI/0001-sched-fair-Proportional-newidle-balance.patch create mode 100644 NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch diff --git a/NI/0001-sched-fair-Proportional-newidle-balance.patch b/NI/0001-sched-fair-Proportional-newidle-balance.patch new file mode 100644 index 000000000000..09ab81d809ff --- /dev/null +++ b/NI/0001-sched-fair-Proportional-newidle-balance.patch @@ -0,0 +1,208 @@ +From ccfc9b017997ffc44398363c85721a67c56533df Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra <peterz(a)infradead.org> +Date: Fri, 7 Nov 2025 17:01:31 +0100 +Subject: [PATCH OLK-6.6 1/2] sched/fair: Proportional newidle balance + +Add a randomized algorithm that runs newidle balancing proportional to +its success rate. + +This improves schbench significantly: + + 6.18-rc4: 2.22 Mrps/s + 6.18-rc4+revert: 2.04 Mrps/s + 6.18-rc4+revert+random: 2.18 Mrps/S + +Conversely, per Adam Li this affects SpecJBB slightly, reducing it by 1%: + + 6.17: -6% + 6.17+revert: 0% + 6.17+revert+random: -1% + +Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> +Reviewed-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> +Tested-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> +Tested-by: Chris Mason <clm(a)meta.com> +Link: https://lkml.kernel.org/r/6825c50d-7fa7-45d8-9b81-c6e7e25738e2@meta.com +Link: https://patch.msgid.link/20251107161739.770122091@infradead.org +Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> +--- + include/linux/sched/topology.h | 3 +++ + kernel/sched/core.c | 3 +++ + kernel/sched/fair.c | 43 ++++++++++++++++++++++++++++++---- + kernel/sched/features.h | 5 ++++ + kernel/sched/sched.h | 7 ++++++ + kernel/sched/topology.c | 6 +++++ + 6 files changed, 63 insertions(+), 4 deletions(-) + +diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h +index f0caa9e1a3c2..ab45a04061fb 100644 +--- a/include/linux/sched/topology.h ++++ b/include/linux/sched/topology.h +@@ -131,6 +131,9 @@ struct sched_domain { + unsigned int nr_balance_failed; /* initialise to 0 */ + + /* idle_balance() stats */ ++ unsigned int newidle_call; ++ unsigned int newidle_success; ++ unsigned int newidle_ratio; + u64 max_newidle_lb_cost; + unsigned long last_decay_max_lb_cost; + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 981652b0d14c..5b486736bd5d 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -46,6 +46,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(sched_util_est_se_tp); + EXPORT_TRACEPOINT_SYMBOL_GPL(sched_update_nr_running_tp); + + DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); ++DEFINE_PER_CPU(struct rnd_state, sched_rnd_state); + + #ifdef CONFIG_SCHED_DEBUG + /* +@@ -9335,6 +9336,8 @@ void __init sched_init_smp(void) + { + sched_init_numa(); + ++ prandom_init_once(&sched_rnd_state); ++ + /* + * There's no userspace yet to cause hotplug operations; hence all the + * CPU masks are stable and all blatant races in the below code cannot +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index fb01890861eb..31a1f7734332 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -11840,8 +11840,23 @@ void update_max_interval(void) + max_load_balance_interval = HZ*num_online_cpus()/10; + } + +-static inline bool update_newidle_cost(struct sched_domain *sd, u64 cost) ++static inline void update_newidle_stats(struct sched_domain *sd, unsigned int success) + { ++ sd->newidle_call++; ++ sd->newidle_success += success; ++ ++ if (sd->newidle_call >= 1024) { ++ sd->newidle_ratio = sd->newidle_success; ++ sd->newidle_call /= 2; ++ sd->newidle_success /= 2; ++ } ++} ++ ++static inline bool update_newidle_cost(struct sched_domain *sd, u64 cost, unsigned int success) ++{ ++ if (cost) ++ update_newidle_stats(sd, success); ++ + if (cost > sd->max_newidle_lb_cost) { + /* + * Track max cost of a domain to make sure to not delay the +@@ -11889,7 +11904,7 @@ static void rebalance_domains(struct rq *rq, enum cpu_idle_type idle) + * Decay the newidle max times here because this is a regular + * visit to all the domains. + */ +- need_decay = update_newidle_cost(sd, 0); ++ need_decay = update_newidle_cost(sd, 0, 0); + max_cost += sd->max_newidle_lb_cost; + + /* +@@ -12527,6 +12542,22 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) + break; + + if (sd->flags & SD_BALANCE_NEWIDLE) { ++ unsigned int weight = 1; ++ ++ if (sched_feat(NI_RANDOM)) { ++ /* ++ * Throw a 1k sided dice; and only run ++ * newidle_balance according to the success ++ * rate. ++ */ ++ u32 d1k = sched_rng() % 1024; ++ weight = 1 + sd->newidle_ratio; ++ if (d1k > weight) { ++ update_newidle_stats(sd, 0); ++ continue; ++ } ++ weight = (1024 + weight/2) / weight; ++ } + + pulled_task = load_balance(this_cpu, this_rq, + sd, CPU_NEWLY_IDLE, +@@ -12534,10 +12565,14 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) + + t1 = sched_clock_cpu(this_cpu); + domain_cost = t1 - t0; +- update_newidle_cost(sd, domain_cost); +- + curr_cost += domain_cost; + t0 = t1; ++ ++ /* ++ * Track max cost of a domain to make sure to not delay the ++ * next wakeup on the CPU. ++ */ ++ update_newidle_cost(sd, domain_cost, weight * !!pulled_task); + } + + /* +diff --git a/kernel/sched/features.h b/kernel/sched/features.h +index 578cd5ed2b93..0198f4e97d24 100644 +--- a/kernel/sched/features.h ++++ b/kernel/sched/features.h +@@ -117,3 +117,8 @@ SCHED_FEAT(STEAL, false) + SCHED_FEAT(SIS_NODE, false) + SCHED_FEAT(TEST_STEAL_PLUS, false) + SCHED_FEAT(TEST_STEAL_PLUS_IDLE, false) ++ ++/* ++ * Do newidle balancing proportional to its success rate using randomization. ++ */ ++SCHED_FEAT(NI_RANDOM, true) +\ No newline at end of file +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index 8940656dac3d..1f5ea2538515 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -4,6 +4,7 @@ + */ + #include <linux/sched.h> + ++#include <linux/prandom.h> + #include <linux/sched/autogroup.h> + #include <linux/sched/clock.h> + #include <linux/sched/coredump.h> +@@ -1196,6 +1197,12 @@ static inline bool is_migration_disabled(struct task_struct *p) + } + + DECLARE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); ++DECLARE_PER_CPU(struct rnd_state, sched_rnd_state); ++ ++static inline u32 sched_rng(void) ++{ ++ return prandom_u32_state(this_cpu_ptr(&sched_rnd_state)); ++} + + #define cpu_rq(cpu) (&per_cpu(runqueues, (cpu))) + #define this_rq() this_cpu_ptr(&runqueues) +diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c +index 6576bf380086..cb82bbc4fb41 100644 +--- a/kernel/sched/topology.c ++++ b/kernel/sched/topology.c +@@ -1822,6 +1822,12 @@ sd_init(struct sched_domain_topology_level *tl, + + .last_balance = jiffies, + .balance_interval = sd_weight, ++ ++ /* 50% success rate */ ++ .newidle_call = 512, ++ .newidle_success = 256, ++ .newidle_ratio = 512, ++ + .max_newidle_lb_cost = 0, + .last_decay_max_lb_cost = jiffies, + .child = child, +-- +2.34.1 + diff --git a/NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch b/NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch new file mode 100644 index 000000000000..4ab477726400 --- /dev/null +++ b/NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch @@ -0,0 +1,133 @@ +From 069a09a4f06e2a05e933dc58bbeb8c66fcd75572 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra <peterz(a)infradead.org> +Date: Tue, 27 Jan 2026 16:17:48 +0100 +Subject: [PATCH OLK-6.6 2/2] sched/fair: More complex proportional newidle + balance + +It turns out that a few workloads (easyWave, fio) have a fairly low +success rate on newidle balance, but still benefit greatly from having +it anyway. + +Luckliky these workloads have a faily low newidle rate, so the cost if +doing the newidle is relatively low, even if unsuccessfull. + +Add a simple rate based part to the newidle ratio compute, such that +low rate newidle will still have a high newidle ratio. + +This cures the easyWave and fio workloads while not affecting the +schbench numbers either (which have a very high newidle rate). + +Reported-by: Mario Roy <marioeroy(a)gmail.com> +Reported-by: "Mohamed Abuelfotoh, Hazem" <abuehaze(a)amazon.com> +Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> +Tested-by: Mario Roy <marioeroy(a)gmail.com> +Tested-by: "Mohamed Abuelfotoh, Hazem" <abuehaze(a)amazon.com> +Link: https://patch.msgid.link/20260127151748.GA1079264@noisy.programming.kicks-a… +Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> +--- + include/linux/sched/topology.h | 1 + + kernel/sched/fair.c | 27 +++++++++++++++++++++++++-- + kernel/sched/features.h | 3 ++- + kernel/sched/topology.c | 3 +++ + 4 files changed, 31 insertions(+), 3 deletions(-) + +diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h +index ab45a04061fb..d66e6c6c2cdf 100644 +--- a/include/linux/sched/topology.h ++++ b/include/linux/sched/topology.h +@@ -134,6 +134,7 @@ struct sched_domain { + unsigned int newidle_call; + unsigned int newidle_success; + unsigned int newidle_ratio; ++ u64 newidle_stamp; + u64 max_newidle_lb_cost; + unsigned long last_decay_max_lb_cost; + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 31a1f7734332..ec40e79802bd 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -11846,7 +11846,30 @@ static inline void update_newidle_stats(struct sched_domain *sd, unsigned int su + sd->newidle_success += success; + + if (sd->newidle_call >= 1024) { +- sd->newidle_ratio = sd->newidle_success; ++ u64 now = sched_clock(); ++ s64 delta = now - sd->newidle_stamp; ++ sd->newidle_stamp = now; ++ int ratio = 0; ++ ++ if (delta < 0) ++ delta = 0; ++ ++ if (sched_feat(NI_RATE)) { ++ /* ++ * ratio delta freq ++ * ++ * 1024 - 4 s - 128 Hz ++ * 512 - 2 s - 256 Hz ++ * 256 - 1 s - 512 Hz ++ * 128 - .5 s - 1024 Hz ++ * 64 - .25 s - 2048 Hz ++ */ ++ ratio = delta >> 22; ++ } ++ ++ ratio += sd->newidle_success; ++ ++ sd->newidle_ratio = min(1024, ratio); + sd->newidle_call /= 2; + sd->newidle_success /= 2; + } +@@ -12544,7 +12567,7 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) + if (sd->flags & SD_BALANCE_NEWIDLE) { + unsigned int weight = 1; + +- if (sched_feat(NI_RANDOM)) { ++ if (sched_feat(NI_RANDOM) && sd->newidle_ratio < 1024) { + /* + * Throw a 1k sided dice; and only run + * newidle_balance according to the success +diff --git a/kernel/sched/features.h b/kernel/sched/features.h +index 0198f4e97d24..9a8b6f41f4cb 100644 +--- a/kernel/sched/features.h ++++ b/kernel/sched/features.h +@@ -121,4 +121,5 @@ SCHED_FEAT(TEST_STEAL_PLUS_IDLE, false) + /* + * Do newidle balancing proportional to its success rate using randomization. + */ +-SCHED_FEAT(NI_RANDOM, true) +\ No newline at end of file ++SCHED_FEAT(NI_RANDOM, true) ++SCHED_FEAT(NI_RATE, true) +diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c +index cb82bbc4fb41..ac198e940978 100644 +--- a/kernel/sched/topology.c ++++ b/kernel/sched/topology.c +@@ -4,6 +4,7 @@ + */ + #include "sched.h" + #include "sparsemask.h" ++#include <linux/sched/clock.h> + + DEFINE_MUTEX(sched_domains_mutex); + +@@ -1783,6 +1784,7 @@ sd_init(struct sched_domain_topology_level *tl, + struct sched_domain *sd = *per_cpu_ptr(sdd->sd, cpu); + int sd_id, sd_weight, sd_flags = 0; + struct cpumask *sd_span; ++ u64 now = sched_clock(); + + #ifdef CONFIG_NUMA + /* +@@ -1827,6 +1829,7 @@ sd_init(struct sched_domain_topology_level *tl, + .newidle_call = 512, + .newidle_success = 256, + .newidle_ratio = 512, ++ .newidle_stamp = now, + + .max_newidle_lb_cost = 0, + .last_decay_max_lb_cost = jiffies, +-- +2.34.1 + -- 2.34.1

2 1

[PATCH OLK-6.6] Add NI_RANDOM
by Luo Gengkun 14 Oct '26

14 Oct '26

Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- NI/0000-cover-letter.patch | 21 ++ ...ed-fair-Proportional-newidle-balance.patch | 208 ++++++++++++++++++ ...complex-proportional-newidle-balance.patch | 133 +++++++++++ 3 files changed, 362 insertions(+) create mode 100644 NI/0000-cover-letter.patch create mode 100644 NI/0001-sched-fair-Proportional-newidle-balance.patch create mode 100644 NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch diff --git a/NI/0000-cover-letter.patch b/NI/0000-cover-letter.patch new file mode 100644 index 000000000000..b66e2ead869c --- /dev/null +++ b/NI/0000-cover-letter.patch @@ -0,0 +1,21 @@ +From 069a09a4f06e2a05e933dc58bbeb8c66fcd75572 Mon Sep 17 00:00:00 2001 +From: Luo Gengkun <luogengkun2(a)huawei.com> +Date: Wed, 14 Oct 2026 01:35:24 +0000 +Subject: [PATCH OLK-6.6 0/2] Backport NI_RANDOM for 5.15 + + +Peter Zijlstra (2): + sched/fair: Proportional newidle balance + sched/fair: More complex proportional newidle balance + + include/linux/sched/topology.h | 4 +++ + kernel/sched/core.c | 3 ++ + kernel/sched/fair.c | 66 +++++++++++++++++++++++++++++++--- + kernel/sched/features.h | 6 ++++ + kernel/sched/sched.h | 7 ++++ + kernel/sched/topology.c | 9 +++++ + 6 files changed, 91 insertions(+), 4 deletions(-) + +-- +2.34.1 + diff --git a/NI/0001-sched-fair-Proportional-newidle-balance.patch b/NI/0001-sched-fair-Proportional-newidle-balance.patch new file mode 100644 index 000000000000..09ab81d809ff --- /dev/null +++ b/NI/0001-sched-fair-Proportional-newidle-balance.patch @@ -0,0 +1,208 @@ +From ccfc9b017997ffc44398363c85721a67c56533df Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra <peterz(a)infradead.org> +Date: Fri, 7 Nov 2025 17:01:31 +0100 +Subject: [PATCH OLK-6.6 1/2] sched/fair: Proportional newidle balance + +Add a randomized algorithm that runs newidle balancing proportional to +its success rate. + +This improves schbench significantly: + + 6.18-rc4: 2.22 Mrps/s + 6.18-rc4+revert: 2.04 Mrps/s + 6.18-rc4+revert+random: 2.18 Mrps/S + +Conversely, per Adam Li this affects SpecJBB slightly, reducing it by 1%: + + 6.17: -6% + 6.17+revert: 0% + 6.17+revert+random: -1% + +Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> +Reviewed-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> +Tested-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> +Tested-by: Chris Mason <clm(a)meta.com> +Link: https://lkml.kernel.org/r/6825c50d-7fa7-45d8-9b81-c6e7e25738e2@meta.com +Link: https://patch.msgid.link/20251107161739.770122091@infradead.org +Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> +--- + include/linux/sched/topology.h | 3 +++ + kernel/sched/core.c | 3 +++ + kernel/sched/fair.c | 43 ++++++++++++++++++++++++++++++---- + kernel/sched/features.h | 5 ++++ + kernel/sched/sched.h | 7 ++++++ + kernel/sched/topology.c | 6 +++++ + 6 files changed, 63 insertions(+), 4 deletions(-) + +diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h +index f0caa9e1a3c2..ab45a04061fb 100644 +--- a/include/linux/sched/topology.h ++++ b/include/linux/sched/topology.h +@@ -131,6 +131,9 @@ struct sched_domain { + unsigned int nr_balance_failed; /* initialise to 0 */ + + /* idle_balance() stats */ ++ unsigned int newidle_call; ++ unsigned int newidle_success; ++ unsigned int newidle_ratio; + u64 max_newidle_lb_cost; + unsigned long last_decay_max_lb_cost; + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 981652b0d14c..5b486736bd5d 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -46,6 +46,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(sched_util_est_se_tp); + EXPORT_TRACEPOINT_SYMBOL_GPL(sched_update_nr_running_tp); + + DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); ++DEFINE_PER_CPU(struct rnd_state, sched_rnd_state); + + #ifdef CONFIG_SCHED_DEBUG + /* +@@ -9335,6 +9336,8 @@ void __init sched_init_smp(void) + { + sched_init_numa(); + ++ prandom_init_once(&sched_rnd_state); ++ + /* + * There's no userspace yet to cause hotplug operations; hence all the + * CPU masks are stable and all blatant races in the below code cannot +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index fb01890861eb..31a1f7734332 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -11840,8 +11840,23 @@ void update_max_interval(void) + max_load_balance_interval = HZ*num_online_cpus()/10; + } + +-static inline bool update_newidle_cost(struct sched_domain *sd, u64 cost) ++static inline void update_newidle_stats(struct sched_domain *sd, unsigned int success) + { ++ sd->newidle_call++; ++ sd->newidle_success += success; ++ ++ if (sd->newidle_call >= 1024) { ++ sd->newidle_ratio = sd->newidle_success; ++ sd->newidle_call /= 2; ++ sd->newidle_success /= 2; ++ } ++} ++ ++static inline bool update_newidle_cost(struct sched_domain *sd, u64 cost, unsigned int success) ++{ ++ if (cost) ++ update_newidle_stats(sd, success); ++ + if (cost > sd->max_newidle_lb_cost) { + /* + * Track max cost of a domain to make sure to not delay the +@@ -11889,7 +11904,7 @@ static void rebalance_domains(struct rq *rq, enum cpu_idle_type idle) + * Decay the newidle max times here because this is a regular + * visit to all the domains. + */ +- need_decay = update_newidle_cost(sd, 0); ++ need_decay = update_newidle_cost(sd, 0, 0); + max_cost += sd->max_newidle_lb_cost; + + /* +@@ -12527,6 +12542,22 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) + break; + + if (sd->flags & SD_BALANCE_NEWIDLE) { ++ unsigned int weight = 1; ++ ++ if (sched_feat(NI_RANDOM)) { ++ /* ++ * Throw a 1k sided dice; and only run ++ * newidle_balance according to the success ++ * rate. ++ */ ++ u32 d1k = sched_rng() % 1024; ++ weight = 1 + sd->newidle_ratio; ++ if (d1k > weight) { ++ update_newidle_stats(sd, 0); ++ continue; ++ } ++ weight = (1024 + weight/2) / weight; ++ } + + pulled_task = load_balance(this_cpu, this_rq, + sd, CPU_NEWLY_IDLE, +@@ -12534,10 +12565,14 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) + + t1 = sched_clock_cpu(this_cpu); + domain_cost = t1 - t0; +- update_newidle_cost(sd, domain_cost); +- + curr_cost += domain_cost; + t0 = t1; ++ ++ /* ++ * Track max cost of a domain to make sure to not delay the ++ * next wakeup on the CPU. ++ */ ++ update_newidle_cost(sd, domain_cost, weight * !!pulled_task); + } + + /* +diff --git a/kernel/sched/features.h b/kernel/sched/features.h +index 578cd5ed2b93..0198f4e97d24 100644 +--- a/kernel/sched/features.h ++++ b/kernel/sched/features.h +@@ -117,3 +117,8 @@ SCHED_FEAT(STEAL, false) + SCHED_FEAT(SIS_NODE, false) + SCHED_FEAT(TEST_STEAL_PLUS, false) + SCHED_FEAT(TEST_STEAL_PLUS_IDLE, false) ++ ++/* ++ * Do newidle balancing proportional to its success rate using randomization. ++ */ ++SCHED_FEAT(NI_RANDOM, true) +\ No newline at end of file +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index 8940656dac3d..1f5ea2538515 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -4,6 +4,7 @@ + */ + #include <linux/sched.h> + ++#include <linux/prandom.h> + #include <linux/sched/autogroup.h> + #include <linux/sched/clock.h> + #include <linux/sched/coredump.h> +@@ -1196,6 +1197,12 @@ static inline bool is_migration_disabled(struct task_struct *p) + } + + DECLARE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); ++DECLARE_PER_CPU(struct rnd_state, sched_rnd_state); ++ ++static inline u32 sched_rng(void) ++{ ++ return prandom_u32_state(this_cpu_ptr(&sched_rnd_state)); ++} + + #define cpu_rq(cpu) (&per_cpu(runqueues, (cpu))) + #define this_rq() this_cpu_ptr(&runqueues) +diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c +index 6576bf380086..cb82bbc4fb41 100644 +--- a/kernel/sched/topology.c ++++ b/kernel/sched/topology.c +@@ -1822,6 +1822,12 @@ sd_init(struct sched_domain_topology_level *tl, + + .last_balance = jiffies, + .balance_interval = sd_weight, ++ ++ /* 50% success rate */ ++ .newidle_call = 512, ++ .newidle_success = 256, ++ .newidle_ratio = 512, ++ + .max_newidle_lb_cost = 0, + .last_decay_max_lb_cost = jiffies, + .child = child, +-- +2.34.1 + diff --git a/NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch b/NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch new file mode 100644 index 000000000000..4ab477726400 --- /dev/null +++ b/NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch @@ -0,0 +1,133 @@ +From 069a09a4f06e2a05e933dc58bbeb8c66fcd75572 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra <peterz(a)infradead.org> +Date: Tue, 27 Jan 2026 16:17:48 +0100 +Subject: [PATCH OLK-6.6 2/2] sched/fair: More complex proportional newidle + balance + +It turns out that a few workloads (easyWave, fio) have a fairly low +success rate on newidle balance, but still benefit greatly from having +it anyway. + +Luckliky these workloads have a faily low newidle rate, so the cost if +doing the newidle is relatively low, even if unsuccessfull. + +Add a simple rate based part to the newidle ratio compute, such that +low rate newidle will still have a high newidle ratio. + +This cures the easyWave and fio workloads while not affecting the +schbench numbers either (which have a very high newidle rate). + +Reported-by: Mario Roy <marioeroy(a)gmail.com> +Reported-by: "Mohamed Abuelfotoh, Hazem" <abuehaze(a)amazon.com> +Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> +Tested-by: Mario Roy <marioeroy(a)gmail.com> +Tested-by: "Mohamed Abuelfotoh, Hazem" <abuehaze(a)amazon.com> +Link: https://patch.msgid.link/20260127151748.GA1079264@noisy.programming.kicks-a… +Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> +--- + include/linux/sched/topology.h | 1 + + kernel/sched/fair.c | 27 +++++++++++++++++++++++++-- + kernel/sched/features.h | 3 ++- + kernel/sched/topology.c | 3 +++ + 4 files changed, 31 insertions(+), 3 deletions(-) + +diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h +index ab45a04061fb..d66e6c6c2cdf 100644 +--- a/include/linux/sched/topology.h ++++ b/include/linux/sched/topology.h +@@ -134,6 +134,7 @@ struct sched_domain { + unsigned int newidle_call; + unsigned int newidle_success; + unsigned int newidle_ratio; ++ u64 newidle_stamp; + u64 max_newidle_lb_cost; + unsigned long last_decay_max_lb_cost; + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 31a1f7734332..ec40e79802bd 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -11846,7 +11846,30 @@ static inline void update_newidle_stats(struct sched_domain *sd, unsigned int su + sd->newidle_success += success; + + if (sd->newidle_call >= 1024) { +- sd->newidle_ratio = sd->newidle_success; ++ u64 now = sched_clock(); ++ s64 delta = now - sd->newidle_stamp; ++ sd->newidle_stamp = now; ++ int ratio = 0; ++ ++ if (delta < 0) ++ delta = 0; ++ ++ if (sched_feat(NI_RATE)) { ++ /* ++ * ratio delta freq ++ * ++ * 1024 - 4 s - 128 Hz ++ * 512 - 2 s - 256 Hz ++ * 256 - 1 s - 512 Hz ++ * 128 - .5 s - 1024 Hz ++ * 64 - .25 s - 2048 Hz ++ */ ++ ratio = delta >> 22; ++ } ++ ++ ratio += sd->newidle_success; ++ ++ sd->newidle_ratio = min(1024, ratio); + sd->newidle_call /= 2; + sd->newidle_success /= 2; + } +@@ -12544,7 +12567,7 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) + if (sd->flags & SD_BALANCE_NEWIDLE) { + unsigned int weight = 1; + +- if (sched_feat(NI_RANDOM)) { ++ if (sched_feat(NI_RANDOM) && sd->newidle_ratio < 1024) { + /* + * Throw a 1k sided dice; and only run + * newidle_balance according to the success +diff --git a/kernel/sched/features.h b/kernel/sched/features.h +index 0198f4e97d24..9a8b6f41f4cb 100644 +--- a/kernel/sched/features.h ++++ b/kernel/sched/features.h +@@ -121,4 +121,5 @@ SCHED_FEAT(TEST_STEAL_PLUS_IDLE, false) + /* + * Do newidle balancing proportional to its success rate using randomization. + */ +-SCHED_FEAT(NI_RANDOM, true) +\ No newline at end of file ++SCHED_FEAT(NI_RANDOM, true) ++SCHED_FEAT(NI_RATE, true) +diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c +index cb82bbc4fb41..ac198e940978 100644 +--- a/kernel/sched/topology.c ++++ b/kernel/sched/topology.c +@@ -4,6 +4,7 @@ + */ + #include "sched.h" + #include "sparsemask.h" ++#include <linux/sched/clock.h> + + DEFINE_MUTEX(sched_domains_mutex); + +@@ -1783,6 +1784,7 @@ sd_init(struct sched_domain_topology_level *tl, + struct sched_domain *sd = *per_cpu_ptr(sdd->sd, cpu); + int sd_id, sd_weight, sd_flags = 0; + struct cpumask *sd_span; ++ u64 now = sched_clock(); + + #ifdef CONFIG_NUMA + /* +@@ -1827,6 +1829,7 @@ sd_init(struct sched_domain_topology_level *tl, + .newidle_call = 512, + .newidle_success = 256, + .newidle_ratio = 512, ++ .newidle_stamp = now, + + .max_newidle_lb_cost = 0, + .last_decay_max_lb_cost = jiffies, +-- +2.34.1 + -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Backport NI_RANDOM for 5.15
by Luo Gengkun 14 Oct '26

14 Oct '26

Peter Zijlstra (2): sched/fair: Proportional newidle balance sched/fair: More complex proportional newidle balance include/linux/sched/topology.h | 4 +++ kernel/sched/core.c | 3 ++ kernel/sched/fair.c | 66 +++++++++++++++++++++++++++++++--- kernel/sched/features.h | 6 ++++ kernel/sched/sched.h | 7 ++++ kernel/sched/topology.c | 9 +++++ 6 files changed, 91 insertions(+), 4 deletions(-) -- 2.34.1

1 0

[PATCH OLK-6.6 0/1] KVM: arm64: Fix kernel panic due to uninitialized fpmr pointer
by Qinxin Xia 14 Oct '26

14 Oct '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8904 ---------------------------------------------------------------------- When the hardware implements FEAT_FPMR but CONFIG_ENABLE_KVM_FPMR is not set in the kernel config, starting a VM crashes the host with the following panic: | Unable to handle kernel paging request at virtual address d6d0b7173a7d8b80 | Mem abort info: | ESR = 0x0000000096000044 | EC = 0x25: DABT (current EL), IL = 32 bits | FSC = 0x04: level 0 translation fault | CM = 0, WnR = 1, TnD = 0, TagAccess = 0 | [d6d0b7173a7d8b80] address between user and kernel address ranges | pc : fpsimd_save+0xd0/0x160 | lr : fpsimd_save+0x38/0x160 | Call trace: | fpsimd_save+0xd0/0x160 | fpsimd_save_and_flush_cpu_state+0x34/0xa8 | kvm_arch_vcpu_put_fp+0xf0/0x250 | kvm_arch_vcpu_put+0x44/0xf0 | vcpu_put+0x20/0x50 | kvm_arch_vcpu_ioctl_run+0x70/0x630 | Kernel panic - not syncing: Oops: Fatal exception The root cause is an asymmetric gating of the FPMR context switch introduced when backporting upstream FPMR support: - The consumer side (fpsimd_save()) saves FPMR whenever the hardware capability is detected at runtime: if (system_supports_fpmr()) *(last->fpmr) = read_sysreg_s(SYS_FPMR); - The producer side (kvm_arch_vcpu_ctxsync_fp()) only assigns fp_state.fpmr under #ifdef CONFIG_ENABLE_KVM_FPMR, while the struct cpu_fp_state stack variable is left uninitialized. With the config disabled, fpsimd_bind_state_to_cpu() binds stack garbage into the per-CPU fpsimd_last_state.fpmr, and the first guest exit writes FPMR to this garbage pointer, causing the above level 0 translation fault. Qinxin Xia (1): KVM: arm64: Fix kernel panic due to uninitialized fpmr pointer arch/arm64/kernel/fpsimd.c | 2 +- arch/arm64/kvm/fpsimd.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) -- 2.33.0

2 2

[PATCH OLK-6.6 0/2] Backport NI_RANDOM for 5.15
by Luo Gengkun 14 Oct '26

14 Oct '26

Peter Zijlstra (2): sched/fair: Proportional newidle balance sched/fair: More complex proportional newidle balance include/linux/sched/topology.h | 4 +++ kernel/sched/core.c | 3 ++ kernel/sched/fair.c | 66 +++++++++++++++++++++++++++++++--- kernel/sched/features.h | 6 ++++ kernel/sched/sched.h | 7 ++++ kernel/sched/topology.c | 9 +++++ 6 files changed, 91 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 NI_RANDOM patchs 0/2] Introduce NI_RANDOM for 5.15
by Luo Gengkun 13 Oct '26

13 Oct '26

Peter Zijlstra (2): sched/fair: Proportional newidle balance sched/fair: More complex proportional newidle balance include/linux/sched/topology.h | 4 +++ kernel/sched/core.c | 3 ++ kernel/sched/fair.c | 66 +++++++++++++++++++++++++++++++--- kernel/sched/features.h | 6 ++++ kernel/sched/sched.h | 7 ++++ kernel/sched/topology.c | 9 +++++ 6 files changed, 91 insertions(+), 4 deletions(-) -- 2.34.1

1 2

[PATCH OLK-6.6 0/2] CVE-2026-100074
by Pu Lehui 13 Oct '26

13 Oct '26

Kumar Kartikeya Dwivedi (1): bpf: Mark bpf_refcount field as unique Mykyta Yatsenko (1): bpf: refactor special field-type detection kernel/bpf/btf.c | 59 ++++++++++++++++++++++++------------------------ 1 file changed, 29 insertions(+), 30 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] bpf: check_cond_jmp_op(): properly infer if register is null
by Pu Lehui 13 Oct '26

13 Oct '26

From: Eduard Zingerman <eddyz87(a)gmail.com> mainline inclusion from mainline-v7.3-rc2 commit d3ef6c097ba078e1f8c7239d76a0ce8b61e75095 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19697 CVE: CVE-2026-98134 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o PTR_MAYBE_NULL flag, but which allows a value to be NULL at runtime. Here is an example: // `a` is PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED // `a` is 0 at runtime. // `b` is PTR_TO_MAP_VALUE | PTR_MAYBE_NULL void *a = bpf_rdonly_cast(0, 0); int *b = bpf_map_lookup_elem(...); if (a == b) *b = 42; // verifier does not catch null pointer dereference This happens because of a special case in check_cond_jmp_op(), which attempts to strip PTR_MAYBE_NULL flags from pointer types, when processing comparisons like `rA == rB`, if either rA or rB can't be null. The non-null property is derived based on the absence of PTR_MAYBE_NULL flag on rA's or rB's type. But that is not sufficient for types like PTR_TO_MEM, as in the example. This patch replaces type_may_be_null() call with reg_not_null(), which contains an allowlist of types for which absence of PTR_MAYBE_NULL actually means that the value can't be NULL at runtime. At the moment, the list in the reg_not_null() omits two types for which PTR_MAYBE_NULL is applicable: PTR_TO_XDP_SOCK and PTR_TO_BUF. In order to remain backward compatible, and assuming that only comparison between pointers of the same type makes sense, this commit extends reg_not_null(). W/o such an extension e.g. verifier_jeq_infer_not_null/null_ptr_to_map_value fails. reg_not_null() can be extended further, but I deem that out of scope for the fix at hand. Explicit base_type(...) != PTR_TO_BTF_ID checks in the check_cond_jmp_op() can be removed with migration to reg_not_null(), but that is a behavioural change, as the special case would start matching for PTR_TO_BTF_ID that is also is_trusted_reg(). I omit the behavioural change from this commit. Fixes: befae75856ab ("bpf: propagate nullness information for reg to reg comparisons") Suggested-by: Nicholas Carlini <npc(a)anthropic.com> Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Link: https://lore.kernel.org/r/20260826-bug-029-bad-non-null-inference-v2-1-1367… Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/verifier.c [reg_not_null has no env arg] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index b796d985e420..55c470694a80 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -470,6 +470,8 @@ static bool reg_not_null(const struct bpf_reg_state *reg) type = base_type(type); return type == PTR_TO_SOCKET || type == PTR_TO_TCP_SOCK || + type == PTR_TO_XDP_SOCK || + type == PTR_TO_BUF || type == PTR_TO_MAP_VALUE || type == PTR_TO_MAP_KEY || type == PTR_TO_SOCK_COMMON || @@ -15170,7 +15172,6 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env, */ if (!is_jmp32 && BPF_SRC(insn->code) == BPF_X && __is_pointer_value(false, src_reg) && __is_pointer_value(false, dst_reg) && - type_may_be_null(src_reg->type) != type_may_be_null(dst_reg->type) && base_type(src_reg->type) != PTR_TO_BTF_ID && base_type(dst_reg->type) != PTR_TO_BTF_ID) { eq_branch_regs = NULL; @@ -15186,9 +15187,11 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env, break; } if (eq_branch_regs) { - if (type_may_be_null(src_reg->type)) + /* src == dst && dst != NULL => src != NULL */ + if (reg_not_null(dst_reg) && type_may_be_null(src_reg->type)) mark_ptr_not_null_reg(&eq_branch_regs[insn->src_reg]); - else + /* src == dst && src != NULL => dst != NULL */ + if (reg_not_null(src_reg) && type_may_be_null(dst_reg->type)) mark_ptr_not_null_reg(&eq_branch_regs[insn->dst_reg]); } } -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks
by Pu Lehui 13 Oct '26

13 Oct '26

From: Eduard Zingerman <eddyz87(a)gmail.com> mainline inclusion from mainline-v7.3-rc2 commit e3e4f66cc4b72333d0886ae2673c360248987889 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19752 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When processing calls to bpf_loop() verifier marks R1 (and R4) as precise. R1 tracks loop iterations number and because of the 'callback_depth < R1' mechanics in check_helper_call() must be marked precise. However, precision propagation for R1 was broken, when bpf_loop() call was verified on a second iteration. Consider the following verification trace: - main: bpf_loop(nr_loops, callback ...) - callback: BPF_EXIT - main: bpf_loop(nr_loops, callback ...) - ... While the first visit of the call to bpf_loop() propagated R1 precision as expected, the second call to mark_chain_precision() in the check_helper_call() set R1, but it was immediately reset when backtrack_insn() processed preceding BPF_EXIT in the loop deleted in this patch. Because of that, the second visit of the call to bpf_loop() injected checkpoint with R1 not marked as precise. Which could trick the verifier into accepting unsafe programs. See the next patch for an example of such program. Commit is structured in a way to minimize conflicts when 'bpf' would be eventually merged with 'bpf-next'. Fixes: ab5cfac139ab ("bpf: verify callbacks as if they are called unknown number of times") Reported-by: Nicholas Carlini <npc(a)anthropic.com> Suggested-by: Nicholas Carlini <npc(a)anthropic.com> Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Link: https://lore.kernel.org/r/20260831-bug-015-backtrack-cb-args-precise-v1-1-6… Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/verifier.c [ctx conflicts] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 37 +++++++++++++++++-------------------- 1 file changed, 17 insertions(+), 20 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index b796d985e420..98454d1d1358 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3997,37 +3997,34 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx, int subseq_idx, return -EFAULT; } } else if (opcode == BPF_EXIT) { - bool r0_precise; + bool from_subprog_call, r0_precise; + + /* BPF_EXIT in subprog or callback always returns + * right after the call instruction, so by checking + * whether the instruction at subseq_idx-1 is subprog + * call or not we can distinguish actual exit from + * *subprog* from exit from *callback*. In the former + * case, we need to propagate r0 precision, if + * necessary. In the former we never do that. + */ + from_subprog_call = subseq_idx - 1 >= 0 && + bpf_pseudo_call(&env->prog->insnsi[subseq_idx - 1]); + + r0_precise = from_subprog_call && bt_is_reg_set(bt, BPF_REG_0); /* Backtracking to a nested function call, 'idx' is a part of * the inner frame 'subseq_idx' is a part of the outer frame. * In case of a regular function call, instructions giving * precision to registers R1-R5 should have been found already. - * In case of a callback, it is ok to have R1-R5 marked for - * backtracking, as these registers are set by the function - * invoking callback. + * In case of a callback from bpf_loop(), R{1,4} in the calling + * frame would be set as precise and that is correct. */ - if (subseq_idx >= 0 && calls_callback(env, subseq_idx)) - for (i = BPF_REG_1; i <= BPF_REG_5; i++) - bt_clear_reg(bt, i); - if (bt_reg_mask(bt) & BPF_REGMASK_ARGS) { + if (from_subprog_call && (bt_reg_mask(bt) & BPF_REGMASK_ARGS)) { verbose(env, "BUG regs %x\n", bt_reg_mask(bt)); WARN_ONCE(1, "verifier backtracking bug"); return -EFAULT; } - /* BPF_EXIT in subprog or callback always returns - * right after the call instruction, so by checking - * whether the instruction at subseq_idx-1 is subprog - * call or not we can distinguish actual exit from - * *subprog* from exit from *callback*. In the former - * case, we need to propagate r0 precision, if - * necessary. In the former we never do that. - */ - r0_precise = subseq_idx - 1 >= 0 && - bpf_pseudo_call(&env->prog->insnsi[subseq_idx - 1]) && - bt_is_reg_set(bt, BPF_REG_0); - bt_clear_reg(bt, BPF_REG_0); if (bt_subprog_enter(bt)) return -EFAULT; -- 2.34.1

2 1