From nobody Sun May 24 21:40:46 2026 Received: from dggsgout11.his.huawei.com (dggsgout11.his.huawei.com [45.249.212.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DA69D3242B8; Thu, 21 May 2026 08:25:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.51 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779351918; cv=none; b=F8gUnpbSxibXDqWIGGQWBVc2ZIl9CFkObkjDq1A9OALWy81Rr/crdX4HtoGcprYhT/gYuw3dX8ckmdbTycNYp3ak/+a4/roGB3skexHUM8poZIbKMLhOe/1uCDVqoYvrkBs77nQzGOkB/3ZX6zufC1xrcd0aPvNf9RHZO70lMdk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779351918; c=relaxed/simple; bh=gV/gEaVClM99C5DfaShh1lKoWbgsnGvlwitYJ+9aS8s=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=gHwhlQNaEAU2pFi1ZCrOBGBAFkSaKITfRMIB6XKsSfQA/rTLT99Kvi77oCWOPFoOVJfLRBzrQt8n+hUi/bNCXV1Rx6OF3WfI2wua0TTyjGSzQIrDCsysjkZUmJqx8cxymc8UMtgPpyQBtEehrPOQ+oXNoD/zWo985a4KDhOpyRM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com; spf=pass smtp.mailfrom=huaweicloud.com; arc=none smtp.client-ip=45.249.212.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huaweicloud.com Received: from mail.maildlp.com (unknown [172.19.163.170]) by dggsgout11.his.huawei.com (SkyGuard) with ESMTPS id 4gLhK06Fr4zYQtrb; Thu, 21 May 2026 16:24:20 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.128]) by mail.maildlp.com (Postfix) with ESMTP id A70544056B; Thu, 21 May 2026 16:25:06 +0800 (CST) Received: from huaweicloud.com (unknown [10.50.87.109]) by APP4 (Coremail) with SMTP id gCh0CgCnb1tUwQ5q4ilcDA--.28289S4; Thu, 21 May 2026 16:25:06 +0800 (CST) From: Zeng Heng To: will@kernel.org, catalin.marinas@arm.com, akpm@linux-foundation.org, npiggin@gmail.com, aneesh.kumar@kernel.org, peterz@infradead.org Cc: linux-kernel@vger.kernel.org, wangkefeng.wang@huawei.com, linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org, linux-arch@vger.kernel.org Subject: [PATCH] arm64: tlb: Flush walk cache when unsharing PMD tables Date: Thu, 21 May 2026 15:30:11 +0800 Message-ID: <20260521073011.4121277-1-zengheng@huaweicloud.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: gCh0CgCnb1tUwQ5q4ilcDA--.28289S4 X-Coremail-Antispam: 1UD129KBjvJXoW7ZrW3JF18KF1rCr45Jr45trb_yoW8Zr17pa sxCrnxKFZ5Wr1UAryUXr48Xry3Ca1DGr9F9ryUWF9YvF12yF1qgFWvyryrAFy8AFZ5tr4f W3Wj9ryUZF4jvaUanT9S1TB71UUUUUDqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUvFb4IE77IF4wAFF20E14v26r4j6ryUM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6r1F6r1fM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rwA2F7IY1VAKz4 vEj48ve4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_tr0E3s1l84ACjcxK6xIIjxv20xvEc7Cj xVAFwI0_Cr0_Gr1UM28EF7xvwVC2z280aVAFwI0_GcCE3s1l84ACjcxK6I8E87Iv6xkF7I 0E14v26rxl6s0DM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40E x7xfMcIj6xIIjxv20xvE14v26r1j6r18McIj6I8E87Iv67AKxVWUJVW8JwAm72CE4IkC6x 0Yz7v_Jr0_Gr1lF7xvr2IYc2Ij64vIr41lFIxGxcIEc7CjxVA2Y2ka0xkIwI1lc7CjxVAa w2AFwI0_GFv_Wryl42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x0Yz7v_Jr0_Gr1lx2IqxV Aqx4xG67AKxVWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r1q 6r43MIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcVC0I7IYx2IY6x kF7I0E14v26r4j6F4UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI42IY6I8E87Iv67AK xVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnIWIevJa73UjIFyTuYvj xUI5fHUUUUU X-CM-SenderInfo: p2hqwxhhqjqx5xdzvxpfor3voofrz/ Content-Type: text/plain; charset="utf-8" From: Zeng Heng When huge_pmd_unshare() is called to unshare a PMD table, the tlb_unshare_pmd_ptdesc() function sets tlb->unshared_tables=3Dtrue but the aarch64 tlb_flush() only checked tlb->freed_tables to determine whether to use TLBF_NONE (vae1is, invalidates walk cache) or TLBF_NOWALKCACHE (vale1is, leaf-only). This caused the stale PMD page table entry to remain in the walk cache after unshare, potentially leading to incorrect page table walks. Fix by including unshared_tables in the check, so that when unsharing tables, TLBF_NONE is used and the walk cache is properly invalidated. Here is the detailed distinction between vae1is and vale1is: | Instruction Combination | Actual Invalidation Scope = | | ------------------------ | ----------------------------------------------= ----| | `VAE1IS` + TTL=3D`0` | All entries at all levels (full invalidation= ) | | `VAE1IS` + TTL=3D`2` (L2) | Non-leaf at Level 0/1 + leaf at Level 2 = | | `VALE1IS` + TTL=3D`0` | Leaf entries at all levels (non-leaf not cle= ared) | | `VALE1IS` + TTL=3D`2` (L2) | Leaf entry at Level 2 only = | Signed-off-by: Zeng Heng --- arch/arm64/include/asm/tlb.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/arm64/include/asm/tlb.h b/arch/arm64/include/asm/tlb.h index 10869d7731b8..751bd57bc3ba 100644 --- a/arch/arm64/include/asm/tlb.h +++ b/arch/arm64/include/asm/tlb.h @@ -53,7 +53,8 @@ static inline int tlb_get_level(struct mmu_gather *tlb) static inline void tlb_flush(struct mmu_gather *tlb) { struct vm_area_struct vma =3D TLB_FLUSH_VMA(tlb->mm, 0); - tlbf_t flags =3D tlb->freed_tables ? TLBF_NONE : TLBF_NOWALKCACHE; + tlbf_t flags =3D (tlb->freed_tables || tlb->unshared_tables) ? + TLBF_NONE : TLBF_NOWALKCACHE; unsigned long stride =3D tlb_get_unmap_size(tlb); int tlb_level =3D tlb_get_level(tlb); =20 --=20 2.43.0