- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/3] Updates of HiSilicon Uncore L3C PMU
by Yushan Wang 26 Aug '25

26 Aug '25

From: Qizhi Zhang <zhangqizhi3(a)h-partners.com> Updates of HiSilicon Uncore L3C PMU --- Support new version of L3C PMU, which supports extended events space which can be controlled in up to 2 extra address spaces with separate overflow interrupts. The layout of the control/event registers are kept the same. The extended events with original ones together cover the monitoring job of all transactions on L3C. That's said, the driver supports finer granual statistics of L3 cache with separated and dedicated PMUs, and a new operand `ext` to give a hint of to which part should perf counting command be delivered. The extended events is specified with `ext=[1|2]` option for the driver to distinguish: perf stat -e hisi_sccl0_l3c0_0/event=<event_id>,ext=<ext>/ Currently only event option using config bit [7, 0]. There's still plenty unused space. Make ext using config [16, 17] and reserve bit [15, 8] for event option for future extension. With the capability of extra counters, number of counters for HiSilicon uncore PMU could reach up to 24, the usedmap is extended accordingly. The hw_perf_event::event_base is initialized to the base MMIO address of the event and will be used for later control, overflow handling and counts readout. We still make use of the Uncore PMU framework for handling the events and interrupt migration on CPU hotplug. The framework's cpuhp callback will handle the event migration and interrupt migration of orginial event, if PMU supports extended events then the interrupt of extended events is migrated to the same CPU choosed by the framework. A new HID of HISI0215 is used for this version of L3C PMU. Some necessary refactor is included, allowing the framework to cope with the new version of driver. Yicong Yang (1): drivers/perf: hisi: Add support for L3C PMU v3 Yushan Wang (2): Documentation: hisi-pmu: Fix of minor format error Documentation: hisi-pmu: Add introduction to HiSilicon Documentation/admin-guide/perf/hisi-pmu.rst | 44 ++- drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c | 357 +++++++++---------- drivers/perf/hisilicon/hisi_uncore_pmu.h | 2 +- 3 files changed, 214 insertions(+), 189 deletions(-) -- 2.33.0

2 4

[PATCH OLK-6.6] arm64: perf: Add support for HIP12 hw metric
by Yushan Wang 26 Aug '25

26 Aug '25

From: Yicong Yang <yangyicong(a)hisilicon.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ICFKG8 ---------------------------------------------------------------------- HIP12 provides hardware metric sampling with adjacent counters counter_2n and counter_2n+1. Overflow of counter_2n+1 will result in an interrupt while overflow of counter_2n will load initial value, which are stored in dedicated registers reload_counter_2n and reload_counter_2n+1, to both counters. With the ability above, software could only perform sampling during handling interrupt of counter_2n and configure different values of reload_counter_2n and reload_counter_2n+1, which realizes hardware metric sampling. For example, perf record -e '\ {armv8_pmuv3_0/cpu_cycles,period=1000000,hw_metric=1/, \ armv8_pmuv3_0/inst_retired,period=800000,hw_metric=1/}:u' \ -- <workload> Above command will only perform sampling when IPC < 800000 / 1000000, since the interrupt will only appear when cpu_cycles reaches 1000000 and inst_retired is less than 800000. Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Signed-off-by: Yushan Wang <wangyushan(a)hisilicon.com> Signed-off-by: Qizhi Zhang <zhangqizhi3(a)h-partners.com> --- arch/arm64/configs/openeuler_defconfig | 1 + drivers/perf/Kconfig | 7 + drivers/perf/arm_pmu.c | 9 ++ drivers/perf/arm_pmuv3.c | 207 ++++++++++++++++++++++++- 4 files changed, 222 insertions(+), 2 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index f25dd0bd7790..ee5d7760aaf5 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -6912,6 +6912,7 @@ CONFIG_ARM_PMU_ACPI=y CONFIG_ARM_SMMU_V3_PMU=m CONFIG_ARM_PMUV3=y CONFIG_ARM64_BRBE=y +CONFIG_HISILICON_HW_METRIC=y # CONFIG_ARM_DSU_PMU is not set CONFIG_QCOM_L2_PMU=y CONFIG_QCOM_L3_PMU=y diff --git a/drivers/perf/Kconfig b/drivers/perf/Kconfig index 7b7b15f9bb6f..f608c2e66235 100644 --- a/drivers/perf/Kconfig +++ b/drivers/perf/Kconfig @@ -246,4 +246,11 @@ config CXL_PMU If unsure say 'm'. +config HISILICON_HW_METRIC + bool "HiSilicon hardware metric sampling support" + depends on ARM64 + help + Support hardware metric that allows filter of sampling for specific + sampling period ratio. + endmenu diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c index 247b038ff4d9..9a97651b7afb 100644 --- a/drivers/perf/arm_pmu.c +++ b/drivers/perf/arm_pmu.c @@ -422,6 +422,15 @@ validate_group(struct perf_event *event) */ memset(&fake_pmu.used_mask, 0, sizeof(fake_pmu.used_mask)); + +#ifdef CONFIG_HISILICON_HW_METRIC + /* + * Make percpu_pmu null so that PMU might get a chance to know if + * get_event_idx is called for validation. + */ + fake_pmu.percpu_pmu = NULL; +#endif + if (!validate_event(event->pmu, &fake_pmu, leader)) return -EINVAL; diff --git a/drivers/perf/arm_pmuv3.c b/drivers/perf/arm_pmuv3.c index c51206684863..29a659d5a273 100644 --- a/drivers/perf/arm_pmuv3.c +++ b/drivers/perf/arm_pmuv3.c @@ -320,6 +320,12 @@ static const struct attribute_group armv8_pmuv3_events_attr_group = { #define ATTR_CFG_FLD_threshold_LO 5 #define ATTR_CFG_FLD_threshold_HI 16 +#ifdef CONFIG_HISILICON_HW_METRIC +#define ATTR_CFG_FLD_hw_metric_CFG config2 +#define ATTR_CFG_FLD_hw_metric_LO 0 +#define ATTR_CFG_FLD_hw_metric_HI 0 +#endif + GEN_PMU_FORMAT_ATTR(event); GEN_PMU_FORMAT_ATTR(long); GEN_PMU_FORMAT_ATTR(rdpmc); @@ -327,6 +333,10 @@ GEN_PMU_FORMAT_ATTR(threshold_count); GEN_PMU_FORMAT_ATTR(threshold_compare); GEN_PMU_FORMAT_ATTR(threshold); +#ifdef CONFIG_HISILICON_HW_METRIC +GEN_PMU_FORMAT_ATTR(hw_metric); +#endif + static int sysctl_perf_user_access __read_mostly; static bool armv8pmu_event_is_64bit(struct perf_event *event) @@ -358,6 +368,29 @@ static u8 armv8pmu_event_threshold_control(struct perf_event_attr *attr) return (th_compare << 1) | th_count; } +#ifdef CONFIG_HISILICON_HW_METRIC +static inline bool armv8pmu_event_is_hw_metric(struct perf_event *event) +{ + return ATTR_CFG_GET_FLD(&event->attr, hw_metric); +} + +static bool armpmu_support_hisi_hw_metric(void) +{ + static const struct midr_range hip12_cpus[] = { + MIDR_ALL_VERSIONS(MIDR_HISI_HIP12), + { } + }; + + /* + * Feature of hw metric requires access to EL1 registers to accomplish, + * which will cause kernel panic in virtual machine because of lack of + * authority. Thus, this feature is banned for virtual machines. + */ + return is_midr_in_range_list(read_cpuid_id(), hip12_cpus) && + is_kernel_in_hyp_mode(); +} +#endif + static struct attribute *armv8_pmuv3_format_attrs[] = { &format_attr_event.attr, &format_attr_long.attr, @@ -365,11 +398,29 @@ static struct attribute *armv8_pmuv3_format_attrs[] = { &format_attr_threshold.attr, &format_attr_threshold_compare.attr, &format_attr_threshold_count.attr, +#ifdef CONFIG_HISILICON_HW_METRIC + &format_attr_hw_metric.attr, +#endif NULL, }; +#ifdef CONFIG_HISILICON_HW_METRIC +static umode_t +armv8pmu_format_attr_is_visible(struct kobject *kobj, + struct attribute *attr, int unused) +{ + if (attr == &format_attr_hw_metric.attr && !armpmu_support_hisi_hw_metric()) + return 0; + + return attr->mode; +} +#endif + static const struct attribute_group armv8_pmuv3_format_attr_group = { .name = "format", +#ifdef CONFIG_HISILICON_HW_METRIC + .is_visible = armv8pmu_format_attr_is_visible, +#endif .attrs = armv8_pmuv3_format_attrs, }; @@ -603,6 +654,41 @@ static void armv8pmu_write_evcntr(int idx, u64 value) write_pmevcntrn(counter, value); } +#ifdef CONFIG_HISILICON_HW_METRIC +static inline void armv8pmu_write_reload_counter(struct perf_event *event, + u64 value) +{ + /* Need to be event->hw.idx - 1 since counter 0 is PMCCNTR_EL0 */ + int idx = event->hw.idx - 1; + +#define HW_METRIC_RELOAD_CNTR(n) sys_reg(3, 3, 15, 3, (2 + n)) +#define write_hw_metric_reload_cntr(_value, _n) \ + do { \ + switch (_n) { \ + case 0: \ + write_sysreg_s(_value, HW_METRIC_RELOAD_CNTR(0)); break; \ + case 1: \ + write_sysreg_s(_value, HW_METRIC_RELOAD_CNTR(1)); break; \ + case 2: \ + write_sysreg_s(_value, HW_METRIC_RELOAD_CNTR(2)); break; \ + case 3: \ + write_sysreg_s(_value, HW_METRIC_RELOAD_CNTR(3)); break; \ + case 4: \ + write_sysreg_s(_value, HW_METRIC_RELOAD_CNTR(4)); break; \ + case 5: \ + write_sysreg_s(_value, HW_METRIC_RELOAD_CNTR(5)); break; \ + default: \ + WARN(1, "Invalid hw_metric reload counter index\n"); \ + dev_err(event->pmu->dev, "event is 0x%lx index is %x\n",\ + event->hw.config_base, event->hw.idx); \ + } \ + } while (0) + write_hw_metric_reload_cntr(value, idx); +#undef write_hw_metric_reload_cntr +#undef HW_METRIC_RELOAD_CNTR +} +#endif + static void armv8pmu_write_hw_counter(struct perf_event *event, u64 value) { @@ -614,6 +700,11 @@ static void armv8pmu_write_hw_counter(struct perf_event *event, } else { armv8pmu_write_evcntr(idx, value); } + +#ifdef CONFIG_HISILICON_HW_METRIC + if (armv8pmu_event_is_hw_metric(event)) + armv8pmu_write_reload_counter(event, value); +#endif } static void armv8pmu_write_counter(struct perf_event *event, u64 value) @@ -688,6 +779,38 @@ static void armv8pmu_enable_counter(u32 mask) write_pmcntenset(mask); } +#ifdef CONFIG_HISILICON_HW_METRIC +static inline void armv8pmu_enable_hw_metric(struct perf_event *event, bool enable) +{ + int idx = event->hw.idx; + u64 reg; + + /* + * Configure the chicken bit on leader event enabling. + */ + if (event != event->group_leader) + return; + + /* Convert the idx since we only use general counters, counter 0 is + * used for PMCCNTR_EL0. + */ + idx -= 1; + +#define HISI_DTU_CTLR_EL1 sys_reg(3, 0, 15, 8, 4) +#define HISI_DTU_CTLR_EL1_CHK_GROUP0 BIT(15) + + reg = read_sysreg_s(HISI_DTU_CTLR_EL1); + if (enable) + reg |= HISI_DTU_CTLR_EL1_CHK_GROUP0 << (idx >> 1); + else + reg &= ~(HISI_DTU_CTLR_EL1_CHK_GROUP0 << (idx >> 1)); + + write_sysreg_s(reg, HISI_DTU_CTLR_EL1); + + reg = read_sysreg_s(HISI_DTU_CTLR_EL1); +} +#endif + static void armv8pmu_enable_event_counter(struct perf_event *event) { struct perf_event_attr *attr = &event->attr; @@ -696,8 +819,14 @@ static void armv8pmu_enable_event_counter(struct perf_event *event) kvm_set_pmu_events(mask, attr); /* We rely on the hypervisor switch code to enable guest counters */ - if (!kvm_pmu_counter_deferred(attr)) + if (!kvm_pmu_counter_deferred(attr)) { armv8pmu_enable_counter(mask); + +#ifdef CONFIG_HISILICON_HW_METRIC + if (armv8pmu_event_is_hw_metric(event)) + armv8pmu_enable_hw_metric(event, true); +#endif + } } static void armv8pmu_disable_counter(u32 mask) @@ -718,8 +847,14 @@ static void armv8pmu_disable_event_counter(struct perf_event *event) kvm_clr_pmu_events(mask); /* We rely on the hypervisor switch code to disable guest counters */ - if (!kvm_pmu_counter_deferred(attr)) + if (!kvm_pmu_counter_deferred(attr)) { armv8pmu_disable_counter(mask); + +#ifdef CONFIG_HISILICON_HW_METRIC + if (armv8pmu_event_is_hw_metric(event)) + armv8pmu_enable_hw_metric(event, false); +#endif + } } static void armv8pmu_enable_intens(u32 mask) @@ -1005,6 +1140,61 @@ static int armv8pmu_get_chain_idx(struct pmu_hw_events *cpuc, return -EAGAIN; } +#ifdef CONFIG_HISILICON_HW_METRIC +static int armv8pmu_check_hw_metric_event(struct pmu_hw_events *cpuc, + struct perf_event *event) +{ + struct perf_event *sibling, *leader = event->group_leader; + int hw_metric_cnt = 0; + + if (cpuc->percpu_pmu) { + for_each_sibling_event(sibling, leader) { + if (armv8pmu_event_is_hw_metric(sibling)) + hw_metric_cnt++; + } + + if (hw_metric_cnt != 1) + return -EINVAL; + } else { + if (event == leader) + return 0; + + if (!armv8pmu_event_is_hw_metric(leader)) + return -EINVAL; + + for_each_sibling_event(sibling, leader) { + if (armv8pmu_event_is_hw_metric(sibling)) + hw_metric_cnt++; + } + + if (hw_metric_cnt > 0) + return -EINVAL; + } + + return 0; +} + +static int armv8pmu_get_hw_metric_event_idx(struct pmu_hw_events *cpuc, + struct perf_event *event) +{ + struct arm_pmu *cpu_pmu = to_arm_pmu(event->pmu); + struct perf_event *leader = event->group_leader; + int leader_idx; + + if (armv8pmu_check_hw_metric_event(cpuc, event)) + return -EINVAL; + + if (event == leader || leader->hw.idx < 1) + return armv8pmu_get_chain_idx(cpuc, cpu_pmu); + + leader_idx = leader->hw.idx; + if (cpuc->events[leader_idx - 1]) + return -EAGAIN; + + return leader_idx - 1; +} +#endif + static int armv8pmu_get_event_idx(struct pmu_hw_events *cpuc, struct perf_event *event) { @@ -1012,6 +1202,14 @@ static int armv8pmu_get_event_idx(struct pmu_hw_events *cpuc, struct hw_perf_event *hwc = &event->hw; unsigned long evtype = hwc->config_base & ARMV8_PMU_EVTYPE_EVENT; +#ifdef CONFIG_HISILICON_HW_METRIC + if (armv8pmu_event_is_hw_metric(event)) + return armv8pmu_get_hw_metric_event_idx(cpuc, event); + else if (event != event->group_leader && + armv8pmu_event_is_hw_metric(event->group_leader)) + return -EINVAL; +#endif + /* Always prefer to place a cycle counter into the cycle counter. */ if ((evtype == ARMV8_PMUV3_PERFCTR_CPU_CYCLES) && !armv8pmu_event_get_threshold(&event->attr)) { @@ -1235,6 +1433,11 @@ static int __armv8_pmuv3_map_event(struct perf_event *event, if (armv8pmu_event_is_64bit(event)) event->hw.flags |= ARMPMU_EVT_64BIT; +#ifdef CONFIG_HISILICON_HW_METRIC + if (armv8pmu_event_is_hw_metric(event) && !armpmu_support_hisi_hw_metric()) + return -EOPNOTSUPP; +#endif + /* * User events must be allocated into a single counter, and so * must not be chained. -- 2.33.0

2 1

[PATCH OLK-6.6 0/1] kvm: hisi_virt: Fix the socket_id of broadcast bitmap for another socket
by Jinqian Yang 26 Aug '25

26 Aug '25

Zhou Wang (1): kvm: hisi_virt: Fix the socket_id of broadcast bitmap for another socket arch/arm64/kvm/hisilicon/hisi_virt.c | 12 +++++++++--- arch/arm64/kvm/hisilicon/hisi_virt.h | 5 +++++ 2 files changed, 14 insertions(+), 3 deletions(-) -- 2.33.0

2 2

[PATCH OLK-6.6 00/11] HiSock Redirect Framework
by Pu Lehui 26 Aug '25

26 Aug '25

Pu Lehui (10): bpf: Add CONFIG_HISOCK bpf: Add XDP_HISOCK_REDIRECT action bpf: Add BPF_PROG_TYPE_HISOCK prog type bpf: Add HISOCK_EGRESS hook on network egress path bpf: Add bpf_get_ingress_dst helper bpf: Add hisock_xdp_buff wrapper for xdp_buff bpf: Add bpf_set_ingress_dst helper bpf: Add bpf_change_skb_dev helper openeuler_defconfig: Enable CONFIG_HISOCK samples/bpf: Add HiSock Redirect sample Xu Kuohai (1): bpf: Add bpf_ext_memcpy extension helper for arm64 arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/insn.h | 4 + arch/arm64/lib/insn.c | 8 + arch/arm64/net/bpf_jit.h | 15 + arch/arm64/net/bpf_jit_comp.c | 266 ++++++++++++++++ arch/x86/configs/openeuler_defconfig | 1 + include/linux/bpf-cgroup-defs.h | 3 + include/linux/bpf-cgroup.h | 25 ++ include/linux/bpf_types.h | 4 + include/linux/filter.h | 3 + include/net/xdp.h | 5 + include/uapi/linux/bpf.h | 45 +++ kernel/bpf/cgroup.c | 43 +++ kernel/bpf/core.c | 7 + kernel/bpf/helpers.c | 27 ++ kernel/bpf/syscall.c | 19 ++ kernel/bpf/verifier.c | 27 ++ net/Kconfig | 10 + net/core/dev.c | 76 ++++- net/core/filter.c | 182 +++++++++++ net/ipv4/ip_output.c | 68 +++++ samples/bpf/.gitignore | 1 + samples/bpf/Makefile | 3 + samples/bpf/hisock/bpf.c | 247 +++++++++++++++ samples/bpf/hisock/hisock_cmd.c | 405 +++++++++++++++++++++++++ tools/include/uapi/linux/bpf.h | 45 +++ tools/lib/bpf/libbpf.c | 3 + 27 files changed, 1540 insertions(+), 3 deletions(-) create mode 100644 samples/bpf/hisock/bpf.c create mode 100644 samples/bpf/hisock/hisock_cmd.c -- 2.34.1

2 12

[PATCH OLK-5.10 0/2] CVE-2025-37834
by Jinjiang Tu 26 Aug '25

26 Aug '25

Jinjiang Tu (2): mm/vmscan: don't try to reclaim hwpoison folio mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list mm/vmscan.c | 10 ++++++++++ 1 file changed, 10 insertions(+) -- 2.43.0

2 3

[PATCH OLK-6.6] iBMA: Fix veth soft lockup by adding DMA-pre-readl sync
by linan666＠huaweicloud.com 26 Aug '25

26 Aug '25

From: Huangjunhua <huangjunhua14(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICUK85 CVE: NA ----------------------------------------- Fix soft lockup during large file transfers over veth interfaces in Taishan 500(Model 2280) environments by adding a readl operation prior to DMA initiation. This guarantees proper synchronization of Send Queue buffer descriptors, preventing descriptor corruption that caused system hangs. Fixes: 85502a982830 ("Huawei iBMA: Added support for Hi1712 Chip") Signed-off-by: Huangjunhua <huangjunhua14(a)huawei.com> --- drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c b/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c index 678262f7412c..94e63d3ee9dd 100644 --- a/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c +++ b/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c @@ -406,6 +406,12 @@ static s32 submit_dma_queue_sq(u32 dir, struct bspveth_dmal pdmalbase_v, u32 pf) BMA_LOG(DLOG_DEBUG, "submit dma queue sq, sq_tail change %d,\n", sq_tail); wmb(); /* memory barriers. */ + /* readl last u32 of sq buffer descriptor to confirm the sq buffer descriptor + * write to local sq + */ + (void)readl((void __iomem *)(p_dma_sq + sq_tail + sizeof(struct dma_ch_sq_s) + - sizeof(u32))); + (void)set_dma_queue_sq_tail(sq_tail); return 0; -- 2.33.0

2 1

[PATCH OLK-5.10 0/6] fix some CVEs
by Jinjiang Tu 26 Aug '25

26 Aug '25

Guixin Liu (1): scsi: ufs: bsg: Set bsg_queue to NULL after removal Haoxiang Li (1): rapidio: fix an API misues when rio_add_net() fails Ivan Stepchenko (1): drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table Marco Nelissen (1): filemap: avoid truncating 64-bit offset to 32 bits Sean Christopherson (1): KVM: x86: Reset IRTE to host control if *new* route isn't postable Yongzhi Liu (1): drm/amd/display: Fix memory leak arch/x86/kvm/svm/avic.c | 58 ++++++++------- arch/x86/kvm/vmx/posted_intr.c | 28 +++----- .../amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 72 ++++++++++++++----- .../drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 2 + drivers/rapidio/devices/rio_mport_cdev.c | 3 +- drivers/scsi/ufs/ufs_bsg.c | 1 + mm/filemap.c | 2 +- 7 files changed, 101 insertions(+), 65 deletions(-) -- 2.43.0

2 7

[PATCH OLK-5.10] mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
by Jinjiang Tu 26 Aug '25

26 Aug '25

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.16-rc1 commit 1013af4f585fccc4d3e5c5824d174de2257f7d6d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICIQAF CVE: CVE-2025-38085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in which unrelated VMAs can afterwards be installed. If this happens in the middle of a concurrent gup_fast(), gup_fast() could end up walking the page tables of another process. While I don't see any way in which that immediately leads to kernel memory corruption, it is really weird and unexpected. Fix it with an explicit broadcast IPI through tlb_remove_table_sync_one(), just like we do in khugepaged when removing page tables for a THP collapse. Link: https://lkml.kernel.org/r/20250528-hugetlb-fixes-splitrace-v2-2-1329349bad1… Link: https://lkml.kernel.org/r/20250527-hugetlb-fixes-splitrace-v1-2-f4136f5ec58… Fixes: 39dde65c9940 ("[PATCH] shared page table for hugetlb page") Signed-off-by: Jann Horn <jannh(a)google.com> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/hugetlb.c [Context conflicts.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/hugetlb.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index bed9f05ecaf1..32b7ee895315 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -6001,6 +6001,13 @@ int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, return 0; pud_clear(pud); + /* + * Once our caller drops the rmap lock, some other process might be + * using this page table as a normal, non-hugetlb page table. + * Wait for pending gup_fast() in other threads to finish before letting + * that happen. + */ + tlb_remove_table_sync_one(); put_page(virt_to_page(ptep)); mm_dec_nr_pmds(mm); /* -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] fix bug in hdbss
by Jinqian Yang 26 Aug '25

26 Aug '25

Jinqian Yang (2): KVM: arm64: do not support hdbss in nvhe KVM: arm64: fix memory leak in HDBSS arch/arm64/kvm/arm.c | 45 +++++++++++++++++++++++++++++--------------- 1 file changed, 30 insertions(+), 15 deletions(-) -- 2.33.0

2 3

[PATCH OLK-6.6 0/5]fix some CVE
by Tong Tiangen 26 Aug '25

26 Aug '25

Ma Wupeng (1): mm: memory-failure: update ttu flag inside unmap_poisoned_folio Michał Pecio (1): usb: xhci: Fix invalid pointer dereference in Etron workaround Neeraj Sanjay Kale (1): Bluetooth: btnxpuart: Fix kernel panic during FW release Ritesh Harjani (1): powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap Sergey Senozhatsky (1): thunderbolt: Do not double dequeue a configuration request arch/powerpc/platforms/powernv/memtrace.c | 8 ++++++-- drivers/bluetooth/btnxpuart.c | 6 ++++-- drivers/thunderbolt/ctl.c | 5 +++++ drivers/usb/host/xhci-ring.c | 2 +- mm/memory_hotplug.c | 2 +- 5 files changed, 17 insertions(+), 6 deletions(-) -- 2.25.1

2 6