- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/2] Fix TLBI broadcast optimization loss and incorrect dvmbm handling
by Tian Zheng 11 Mar '26

11 Mar '26

Fix 1 In the TLBI broadcast-optimization feature, the SYS_LSUDVM_CTRL_EL2 register controls whether the feature is enabled. When LPI low-power mode is enabled, this register is cleared as the pCPU powers down into LPI mode, causing the TLBI broadcast optimization to stop working. The fix saves and restores this control register in the callbacks for entering and exiting LPI mode. Fix 2 The current TLBI broadcast-optimization logic only supports normal VMs. If the feature is enabled globally, VMs that are not yet adapted for it, such as CCA will use an incorrect TLBI broadcast bitmap, which can cause a panic in CCA VMs. The fix moves the actual enable/disable of the dvmbm functionality into the vcpu load and vcpu put functions. Tian Zheng (2): KVM: arm64: Fix TLBI optimization broken in LPI mode KVM: arm64: Fix CCA guest panic when dvmbm is enabled arch/arm64/kvm/arm.c | 4 ++++ arch/arm64/kvm/hisilicon/hisi_virt.c | 28 ++++++++++++++++++++++------ arch/arm64/kvm/hisilicon/hisi_virt.h | 4 ++++ 3 files changed, 30 insertions(+), 6 deletions(-) -- 2.33.0

1 2

[PATCH OLK-6.6] platform/x86: classmate-laptop: Add missing NULL pointer checks
by Zeng Heng 11 Mar '26

11 Mar '26

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v6.19 commit fe747d7112283f47169e9c16e751179a9b38611e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13842 CVE: CVE-2026-23237 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In a few places in the Classmate laptop driver, code using the accel object may run before that object's address is stored in the driver data of the input device using it. For example, cmpc_accel_sensitivity_store_v4() is the "show" method of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(), before calling dev_set_drvdata() for inputdev->dev. If the sysfs attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev) call in in cmpc_accel_sensitivity_store_v4() returns NULL which leads to a NULL pointer dereference going forward. Moreover, sysfs attributes using the input device are added before initializing that device by cmpc_add_acpi_notify_device() and if one of them is accessed before running that function, a NULL pointer dereference will occur. For example, cmpc_accel_sensitivity_attr_v4 is added before calling cmpc_add_acpi_notify_device() and if it is read prematurely, the dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4() returns NULL which leads to a NULL pointer dereference going forward. Fix this by adding NULL pointer checks in all of the relevant places. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Link: https://patch.msgid.link/12825381.O9o76ZdvQC@rafael.j.wysocki Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Conflicts: drivers/platform/x86/classmate-laptop.c [Context conflicts.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/platform/x86/classmate-laptop.c | 32 +++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/drivers/platform/x86/classmate-laptop.c b/drivers/platform/x86/classmate-laptop.c index 2edaea2492df..053c8a86d5ec 100644 --- a/drivers/platform/x86/classmate-laptop.c +++ b/drivers/platform/x86/classmate-laptop.c @@ -208,7 +208,12 @@ static ssize_t cmpc_accel_sensitivity_show_v4(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; return sprintf(buf, "%d\n", accel->sensitivity); } @@ -225,7 +230,12 @@ static ssize_t cmpc_accel_sensitivity_store_v4(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; r = kstrtoul(buf, 0, &sensitivity); if (r) @@ -257,7 +267,12 @@ static ssize_t cmpc_accel_g_select_show_v4(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; return sprintf(buf, "%d\n", accel->g_select); } @@ -274,7 +289,12 @@ static ssize_t cmpc_accel_g_select_store_v4(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; r = kstrtoul(buf, 0, &g_select); if (r) @@ -303,6 +323,8 @@ static int cmpc_accel_open_v4(struct input_dev *input) acpi = to_acpi_device(input->dev.parent); accel = dev_get_drvdata(&input->dev); + if (!accel) + return -ENXIO; cmpc_accel_set_sensitivity_v4(acpi->handle, accel->sensitivity); cmpc_accel_set_g_select_v4(acpi->handle, accel->g_select); @@ -551,7 +573,12 @@ static ssize_t cmpc_accel_sensitivity_show(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; return sprintf(buf, "%d\n", accel->sensitivity); } @@ -568,7 +595,12 @@ static ssize_t cmpc_accel_sensitivity_store(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; r = kstrtoul(buf, 0, &sensitivity); if (r) -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] optimize lightweight load balancing
by Chen Jinghuang 11 Mar '26

11 Mar '26

*** BLURB HERE *** Chen Jinghuang (1): sched: Fix kabi breakage of struct sched_domain for newidle_stats Peter Zijlstra (Intel) (1): sched/fair: Proportional newidle balance include/linux/sched/topology.h | 7 ++++- kernel/sched/core.c | 3 +++ kernel/sched/fair.c | 48 +++++++++++++++++++++++++++++++--- kernel/sched/features.h | 5 ++++ kernel/sched/sched.h | 7 +++++ kernel/sched/topology.c | 6 +++++ 6 files changed, 71 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] optimize lightweight load balancing
by Chen Jinghuang 11 Mar '26

11 Mar '26

*** BLURB HERE *** Chen Jinghuang (1): sched: Fix kabi breakage of struct sched_domain for newidle_stats Peter Zijlstra (Intel) (1): sched/fair: Proportional newidle balance include/linux/sched/topology.h | 8 +++++- kernel/sched/core.c | 3 +++ kernel/sched/fair.c | 48 +++++++++++++++++++++++++++++++--- kernel/sched/features.h | 5 ++++ kernel/sched/sched.h | 7 +++++ kernel/sched/topology.c | 6 +++++ 6 files changed, 72 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[PATCH] arch/riscv: Add bitrev.h file to support rev8 and brev8
by Jinjie Ruan 11 Mar '26

11 Mar '26

The RISC-V Bit-manipulation Extension for Cryptography (Zbkb) provides the 'brev8' instruction, which reverses the bits within each byte. Combined with the 'rev8' instruction (from Zbb or Zbkb), which reverses the byte order of a register, we can efficiently implement 16-bit, 32-bit, and (on RV64) 64-bit bit reversal. This is significantly faster than the default software table-lookup implementation in lib/bitrev.c, as it replaces memory accesses and multiple arithmetic operations with just two or three hardware instructions. Select HAVE_ARCH_BITREVERSE and provide <asm/bitrev.h> to utilize these instructions when the Zbkb extension is available at runtime via the alternatives mechanism. Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/riscv/Kconfig | 1 + arch/riscv/include/asm/bitrev.h | 46 +++++++++++++++++++++++++++++++++ lib/bitrev.c | 3 --- 3 files changed, 47 insertions(+), 3 deletions(-) create mode 100644 arch/riscv/include/asm/bitrev.h diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig index 90c531e6abf5..e7a04b96c0c8 100644 --- a/arch/riscv/Kconfig +++ b/arch/riscv/Kconfig @@ -128,6 +128,7 @@ config RISCV select HAS_IOPORT if MMU select HAVE_ALIGNED_STRUCT_PAGE select HAVE_ARCH_AUDITSYSCALL + select HAVE_ARCH_BITREVERSE select HAVE_ARCH_HUGE_VMALLOC if HAVE_ARCH_HUGE_VMAP select HAVE_ARCH_HUGE_VMAP if MMU && 64BIT select HAVE_ARCH_JUMP_LABEL if !XIP_KERNEL diff --git a/arch/riscv/include/asm/bitrev.h b/arch/riscv/include/asm/bitrev.h new file mode 100644 index 000000000000..b1977600638a --- /dev/null +++ b/arch/riscv/include/asm/bitrev.h @@ -0,0 +1,46 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef __ASM_BITREV_H +#define __ASM_BITREV_H + +#include <linux/types.h> +#include <asm/cpufeature-macros.h> +#include <asm/hwcap.h> + +extern u8 const byte_rev_table[256]; +static __always_inline __attribute_const__ u32 __arch_bitrev32(u32 x) +{ + if (IS_ENABLED(CONFIG_RISCV_ISA_ZBKB) && + riscv_has_extension_likely(RISCV_ISA_EXT_ZBKB)) { + unsigned long result = x; + + asm volatile( + ".option push\n" + ".option arch,+zbkb\n" + "rev8 %0, %0\n" + "brev8 %0, %0\n" + ".option pop" + : "+r" (result) + ); + + if (__riscv_xlen == 64) + return (u32)(result >> 32); + + return (u32)result; + } + + return (u32)byte_rev_table[x & 0xff] << 24 | + (u32)byte_rev_table[(x >> 8) & 0xff] << 16 | + (u32)byte_rev_table[(x >> 16) & 0xff] << 8 | + (u32)byte_rev_table[x >> 24]; +} + +static __always_inline __attribute_const__ u16 __arch_bitrev16(u16 x) +{ + return __arch_bitrev32((u32)x) >> 16; +} + +static __always_inline __attribute_const__ u8 __arch_bitrev8(u8 x) +{ + return __arch_bitrev32((u32)x) >> 24; +} +#endif diff --git a/lib/bitrev.c b/lib/bitrev.c index 81b56e0a7f32..05088231f31f 100644 --- a/lib/bitrev.c +++ b/lib/bitrev.c @@ -1,5 +1,4 @@ // SPDX-License-Identifier: GPL-2.0-only -#ifndef CONFIG_HAVE_ARCH_BITREVERSE #include <linux/types.h> #include <linux/module.h> #include <linux/bitrev.h> @@ -43,5 +42,3 @@ const u8 byte_rev_table[256] = { 0x1f, 0x9f, 0x5f, 0xdf, 0x3f, 0xbf, 0x7f, 0xff, }; EXPORT_SYMBOL_GPL(byte_rev_table); - -#endif /* CONFIG_HAVE_ARCH_BITREVERSE */ -- 2.34.1

1 0

[PATCH openEuler-26.09 0/3] Fix device memory leaks in XSched
by Liu Kai 11 Mar '26

11 Mar '26

Fix device memory leaks in XSched Liu Kai (3): xsched/dmem: ensure XSched Context creation before device memory allocation xsched/dmem: add size field to xsched_dmem_pool for dmem region tracking xsched/dmem: ensure dmem region release on AI task completion to prevent memory leaks include/linux/xsched.h | 2 ++ include/uapi/linux/xcu_vstream.h | 2 +- kernel/xsched/dmem.c | 38 +++++++++++++++++++++++++++----- kernel/xsched/vstream.c | 22 +++++++++++++++--- 4 files changed, 55 insertions(+), 9 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/2] optimize lightweight load balancing
by Chen Jinghuang 11 Mar '26

11 Mar '26

*** BLURB HERE *** Chen Jinghuang (1): sched: Fix kabi breakage of struct sched_domain for newidle_stats Peter Zijlstra (Intel) (1): sched/fair: Proportional newidle balance include/linux/sched/topology.h | 4 +++ kernel/sched/core.c | 3 +++ kernel/sched/fair.c | 48 +++++++++++++++++++++++++++++++--- kernel/sched/features.h | 5 ++++ kernel/sched/sched.h | 7 +++++ kernel/sched/topology.c | 6 +++++ 6 files changed, 69 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] Fix TLBI broadcast optimization loss and incorrect dvmbm handling
by Tian Zheng 11 Mar '26

11 Mar '26

Fix 1 In the TLBI broadcast-optimization feature, the SYS_LSUDVM_CTRL_EL2 register controls whether the feature is enabled. When LPI low-power mode is enabled, this register is cleared as the pCPU powers down into LPI mode, causing the TLBI broadcast optimization to stop working. The fix saves and restores this control register in the callbacks for entering and exiting LPI mode. Fix 2 The current TLBI broadcast-optimization logic only supports normal VMs. If the feature is enabled globally, VMs that are not yet adapted for it, such as CCA will use an incorrect TLBI broadcast bitmap, which can cause a panic in CCA VMs. The fix moves the actual enable/disable of the dvmbm functionality into the vcpu load and vcpu put functions. Tian Zheng (2): KVM: arm64: Fix TLBI optimization broken in LPI mode KVM: arm64: Fix CCA guest panic when dvmbm is enabled arch/arm64/kvm/arm.c | 6 ++++++ arch/arm64/kvm/hisilicon/hisi_virt.c | 9 ++++----- arch/arm64/kvm/hisilicon/hisi_virt.h | 19 +++++++++++++++++++ 3 files changed, 29 insertions(+), 5 deletions(-) -- 2.33.0

1 2

[PATCH OLK-6.6 v4 0/4] Fix CVE-2025-21696.
by Ze Zuo 10 Mar '26

10 Mar '26

Fix CVE-2025-21696. Change since v3: -- internalize struct to reduce kABI exposure. David Hildenbrand (1): mm/mremap: fix WARN with uffd that has remap events disabled Lokesh Gidra (1): userfaultfd: move userfaultfd_ctx struct to header file Ryan Roberts (1): mm: clear uffd-wp PTE/PMD state on mremap() Ze Zuo (1): userfaultfd: fix kabi breakage due to struct userfaultfd_ctx fs/userfaultfd.c | 40 +---------------- include/linux/userfaultfd_k_ext.h | 62 ++++++++++++++++++++++++++ mm/huge_memory.c | 13 ++++++ mm/hugetlb.c | 15 ++++++- mm/mremap.c | 74 +++++++++++++++++++++++-------- 5 files changed, 145 insertions(+), 59 deletions(-) create mode 100644 include/linux/userfaultfd_k_ext.h -- 2.25.1

2 5

[PATCH OLK-6.6 0/2] optimize lightweight load balancing
by Chen Jinghuang 10 Mar '26

10 Mar '26

*** BLURB HERE *** Chen Jinghuang (1): sched: Fix kabi breakage of struct sched_domain for newidle_stats Peter Zijlstra (Intel) (1): sched/fair: Proportional newidle balance include/linux/sched/topology.h | 6 +++++ kernel/sched/core.c | 3 +++ kernel/sched/fair.c | 44 ++++++++++++++++++++++++++++++---- kernel/sched/features.h | 5 ++++ kernel/sched/sched.h | 7 ++++++ kernel/sched/topology.c | 6 +++++ 6 files changed, 67 insertions(+), 4 deletions(-) -- 2.34.1

2 3