--- /dev/null
+From stable+bounces-263550-greg=kroah.com@vger.kernel.org Tue Jun 16 10:43:47 2026
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 16 Jun 2026 06:13:26 +0100
+Subject: arm64: cputype: Add C1-Premium definitions
+To: stable@vger.kernel.org
+Cc: catalin.marinas@arm.com, lee@kernel.org, mark.rutland@arm.com, sdonthineni@nvidia.com, will@kernel.org
+Message-ID: <20260616051329.111597-3-mark.rutland@arm.com>
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+commit d28413bfc5a255957241f1df5d7fd0c2cd74fe18 upstream.
+
+Add cputype definitions for C1-Premium. These will be used for errata
+detection in subsequent patches.
+
+These values can be found in the C1-Premium TRM:
+
+ https://developer.arm.com/documentation/109416/0100/
+
+... in section A.5.1 ("MIDR_EL1, Main ID Register").
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+[Mark: backport to v6.18.y]
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/include/asm/cputype.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/include/asm/cputype.h
++++ b/arch/arm64/include/asm/cputype.h
+@@ -100,6 +100,7 @@
+ #define ARM_CPU_PART_C1_ULTRA 0xD8C
+ #define ARM_CPU_PART_NEOVERSE_N3 0xD8E
+ #define ARM_CPU_PART_C1_PRO 0xD8B
++#define ARM_CPU_PART_C1_PREMIUM 0xD90
+
+ #define APM_CPU_PART_XGENE 0x000
+ #define APM_CPU_VAR_POTENZA 0x00
+@@ -193,6 +194,7 @@
+ #define MIDR_C1_ULTRA MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_ULTRA)
+ #define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3)
+ #define MIDR_C1_PRO MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PRO)
++#define MIDR_C1_PREMIUM MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PREMIUM)
+ #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX)
+ #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX)
+ #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX)
--- /dev/null
+From stable+bounces-263549-greg=kroah.com@vger.kernel.org Tue Jun 16 10:43:47 2026
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 16 Jun 2026 06:13:25 +0100
+Subject: arm64: cputype: Add C1-Ultra definitions
+To: stable@vger.kernel.org
+Cc: catalin.marinas@arm.com, lee@kernel.org, mark.rutland@arm.com, sdonthineni@nvidia.com, will@kernel.org
+Message-ID: <20260616051329.111597-2-mark.rutland@arm.com>
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+commit 60349e64a6c65f9f0aa118af711b3c7e137f07ff upstream.
+
+Add cputype definitions for C1-Ultra. These will be used for errata
+detection in subsequent patches.
+
+These values can be found in the C1-Ultra TRM:
+
+ https://developer.arm.com/documentation/108014/0100/
+
+... in section A.5.1 ("MIDR_EL1, Main ID Register").
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+[Mark: backport to v6.18.y]
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/include/asm/cputype.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/include/asm/cputype.h
++++ b/arch/arm64/include/asm/cputype.h
+@@ -97,6 +97,7 @@
+ #define ARM_CPU_PART_CORTEX_X925 0xD85
+ #define ARM_CPU_PART_CORTEX_A725 0xD87
+ #define ARM_CPU_PART_CORTEX_A720AE 0xD89
++#define ARM_CPU_PART_C1_ULTRA 0xD8C
+ #define ARM_CPU_PART_NEOVERSE_N3 0xD8E
+ #define ARM_CPU_PART_C1_PRO 0xD8B
+
+@@ -189,6 +190,7 @@
+ #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925)
+ #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725)
+ #define MIDR_CORTEX_A720AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720AE)
++#define MIDR_C1_ULTRA MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_ULTRA)
+ #define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3)
+ #define MIDR_C1_PRO MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PRO)
+ #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX)
--- /dev/null
+From stable+bounces-263553-greg=kroah.com@vger.kernel.org Tue Jun 16 10:45:06 2026
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 16 Jun 2026 06:13:29 +0100
+Subject: arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
+To: stable@vger.kernel.org
+Cc: catalin.marinas@arm.com, lee@kernel.org, mark.rutland@arm.com, sdonthineni@nvidia.com, will@kernel.org
+Message-ID: <20260616051329.111597-6-mark.rutland@arm.com>
+
+From: Will Deacon <will@kernel.org>
+
+commit 1940e70a8144bf75e6df26bf6f600862ea7f7ea1 upstream.
+
+Commit fb091ff39479 ("arm64: Subscribe Microsoft Azure Cobalt 100 to ARM
+Neoverse N2 errata") states that Microsoft Azure Cobalt 100 CPU "is a
+Microsoft implemented CPU based on r0p0 of the ARM Neoverse N2 CPU, and
+therefore suffers from all the same errata.".
+
+So enable the workaround for the latest broadcast TLB invalidation bug
+on these parts.
+
+Signed-off-by: Will Deacon <will@kernel.org>
+[Mark: backport to v6.18.y]
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/arch/arm64/silicon-errata.rst | 2 ++
+ arch/arm64/Kconfig | 1 +
+ arch/arm64/kernel/cpu_errata.c | 1 +
+ 3 files changed, 4 insertions(+)
+
+--- a/Documentation/arch/arm64/silicon-errata.rst
++++ b/Documentation/arch/arm64/silicon-errata.rst
+@@ -351,3 +351,5 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | Microsoft | Azure Cobalt 100| #3324339 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| Microsoft | Azure Cobalt 100| #4193789 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -1194,6 +1194,7 @@ config ARM64_ERRATUM_4118414
+ * ARM Neoverse-V2 erratum 4193787
+ * ARM Neoverse-V3 erratum 4193784
+ * ARM Neoverse-V3AE erratum 4193784
++ * Microsoft Azure Cobalt 100 4193789
+ * NVIDIA Olympus erratum T410-OLY-1029
+
+ On affected cores, some memory accesses might not be completed by
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -341,6 +341,7 @@ static const struct arm64_cpu_capabiliti
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE),
+ MIDR_ALL_VERSIONS(MIDR_NVIDIA_OLYMPUS),
++ MIDR_ALL_VERSIONS(MIDR_MICROSOFT_AZURE_COBALT_100),
+ {}
+ })),
+ },
--- /dev/null
+From stable+bounces-263552-greg=kroah.com@vger.kernel.org Tue Jun 16 10:45:04 2026
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 16 Jun 2026 06:13:28 +0100
+Subject: arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
+To: stable@vger.kernel.org
+Cc: catalin.marinas@arm.com, lee@kernel.org, mark.rutland@arm.com, sdonthineni@nvidia.com, will@kernel.org
+Message-ID: <20260616051329.111597-5-mark.rutland@arm.com>
+
+From: Shanker Donthineni <sdonthineni@nvidia.com>
+
+commit ec7216f92e4ebd485b1c6dc6aa3f6064b71a5768 upstream.
+
+NVIDIA Olympus cores are affected by the TLBI completion issue tracked as
+CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses
+ARM64_WORKAROUND_REPEAT_TLBI to issue an additional broadcast TLBI;DSB
+sequence and ensure affected memory write effects are globally observed.
+
+Add MIDR_NVIDIA_OLYMPUS to the repeat-TLBI match list so the same
+mitigation is enabled on affected Olympus systems. Also document the
+NVIDIA Olympus erratum in the arm64 silicon errata table and list it in
+the Kconfig help text.
+
+Signed-off-by: Shanker Donthineni <sdonthineni@nvidia.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+[Mark: backport to v6.18.y]
+Signed-off-by: Shanker Donthineni <sdonthineni@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/arch/arm64/silicon-errata.rst | 2 ++
+ arch/arm64/Kconfig | 3 ++-
+ arch/arm64/kernel/cpu_errata.c | 1 +
+ 3 files changed, 5 insertions(+), 1 deletion(-)
+
+--- a/Documentation/arch/arm64/silicon-errata.rst
++++ b/Documentation/arch/arm64/silicon-errata.rst
+@@ -288,6 +288,8 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | NVIDIA | Carmel Core | N/A | NVIDIA_CARMEL_CNP_ERRATUM |
+ +----------------+-----------------+-----------------+-----------------------------+
++| NVIDIA | Olympus core | T410-OLY-1029 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | NVIDIA | T241 GICv3/4.x | T241-FABRIC-4 | N/A |
+ +----------------+-----------------+-----------------+-----------------------------+
+ +----------------+-----------------+-----------------+-----------------------------+
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -1167,7 +1167,7 @@ config ARM64_ERRATUM_4193714
+ If unsure, say Y.
+
+ config ARM64_ERRATUM_4118414
+- bool "Cortex-*/Neoverse-*/C1-*: Completion of affected memory accesses might not be guaranteed by completion of a TLBI"
++ bool "Various: Completion of affected memory accesses might not be guaranteed by completion of a TLBI"
+ default y
+ select ARM64_WORKAROUND_REPEAT_TLBI
+ help
+@@ -1194,6 +1194,7 @@ config ARM64_ERRATUM_4118414
+ * ARM Neoverse-V2 erratum 4193787
+ * ARM Neoverse-V3 erratum 4193784
+ * ARM Neoverse-V3AE erratum 4193784
++ * NVIDIA Olympus erratum T410-OLY-1029
+
+ On affected cores, some memory accesses might not be completed by
+ broadcast TLB invalidation.
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -340,6 +340,7 @@ static const struct arm64_cpu_capabiliti
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE),
++ MIDR_ALL_VERSIONS(MIDR_NVIDIA_OLYMPUS),
+ {}
+ })),
+ },
--- /dev/null
+From stable+bounces-263551-greg=kroah.com@vger.kernel.org Tue Jun 16 10:43:51 2026
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 16 Jun 2026 06:13:27 +0100
+Subject: arm64: errata: Mitigate TLBI errata on various Arm CPUs
+To: stable@vger.kernel.org
+Cc: catalin.marinas@arm.com, lee@kernel.org, mark.rutland@arm.com, sdonthineni@nvidia.com, will@kernel.org
+Message-ID: <20260616051329.111597-4-mark.rutland@arm.com>
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+commit cfd391e74134db664feb499d43af286380b10ba8 upstream.
+
+A number of CPUs developed by Arm suffer from errata whereby a broadcast
+TLBI;DSB sequence may complete before the global observation of writes
+which are translated by an affected TLB entry.
+
+These errata ONLY affect the completion of memory accesses which have
+been translated by an invalidated TLB entry, and these errata DO NOT
+affect the actual invalidation of TLB entries. TLB entries are removed
+correctly.
+
+This issue has been assigned CVE ID CVE-2025-10263.
+
+To mitigate this issue, Arm recommends that software follows any
+affected TLBI;DSB sequence with an additional TLBI;DSB, which will
+ensure that all memory write effects affected by the first TLBI have
+been globally observed. The additional TLBI can use any operation that
+is broadcast to affected CPUs, and the additional DSB can use any option
+that is sufficient to complete the additional TLBI.
+
+The ARM64_WORKAROUND_REPEAT_TLBI workaround is sufficient to mitigate
+the issue. Enable this workaround for affected CPUs, and update the
+silicon errata documentation accordingly.
+
+Note that due to the manner in which Arm develops IP and tracks errata,
+some CPUs share a common erratum number.
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+[Mark: backport to v6.18.y]
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/arch/arm64/silicon-errata.rst | 42 ++++++++++++++++++++++++++++
+ arch/arm64/Kconfig | 36 ++++++++++++++++++++++++
+ arch/arm64/kernel/cpu_errata.c | 32 ++++++++++++++++++++-
+ 3 files changed, 108 insertions(+), 2 deletions(-)
+
+--- a/Documentation/arch/arm64/silicon-errata.rst
++++ b/Documentation/arch/arm64/silicon-errata.rst
+@@ -128,16 +128,28 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A76 | #3324349 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-A76 | #4193800 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-A76AE | #4193801 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A77 | #1491015 | N/A |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A77 | #1508412 | ARM64_ERRATUM_1508412 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A77 | #3324348 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-A77 | #4193798 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A78 | #3324344 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-A78 | #4193791 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-A78AE | #4193793 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A78C | #3324346,3324347| ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-A78C | #4193794 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A710 | #2119858 | ARM64_ERRATUM_2119858 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A710 | #2054223 | ARM64_ERRATUM_2054223 |
+@@ -146,6 +158,8 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A710 | #3324338 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-A710 | #4193788 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A715 | #2645198 | ARM64_ERRATUM_2645198 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A715 | #3456084 | ARM64_ERRATUM_3194386 |
+@@ -158,20 +172,32 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X1 | #3324344 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-X1 | #4193791 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X1C | #3324346 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-X1C | #4193792 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X2 | #2119858 | ARM64_ERRATUM_2119858 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X2 | #2224489 | ARM64_ERRATUM_2224489 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X2 | #3324338 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-X2 | #4193788 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X3 | #3324335 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-X3 | #4193786 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X4 | #3194386 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-X4 | #4118414 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X925 | #3324334 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-X925 | #4193781 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-N1 | #1188873,1418040| ARM64_ERRATUM_1418040 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-N1 | #1349291 | N/A |
+@@ -182,6 +208,8 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-N1 | #3324349 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Neoverse-N1 | #4193800 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-N2 | #2139208 | ARM64_ERRATUM_2139208 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-N2 | #2067961 | ARM64_ERRATUM_2067961 |
+@@ -190,20 +218,34 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-N2 | #3324339 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Neoverse-N2 | #4193789 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-N3 | #3456111 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-V1 | #1619801 | N/A |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-V1 | #3324341 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Neoverse-V1 | #4193790 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-V2 | #3324336 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Neoverse-V2 | #4193787 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-V3 | #3312417 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Neoverse-V3 | #4193784 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-V3AE | #3312417 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Neoverse-V3AE | #4193784 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
++| ARM | C1-Premium | #4193780 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | C1-Pro | #4193714 | ARM64_ERRATUM_4193714 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | C1-Ultra | #4193780 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | MMU-500 | #841119,826419 | ARM_SMMU_MMU_500_CPRE_ERRATA|
+ | | | #562869,1047329 | |
+ +----------------+-----------------+-----------------+-----------------------------+
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -1166,6 +1166,42 @@ config ARM64_ERRATUM_4193714
+
+ If unsure, say Y.
+
++config ARM64_ERRATUM_4118414
++ bool "Cortex-*/Neoverse-*/C1-*: Completion of affected memory accesses might not be guaranteed by completion of a TLBI"
++ default y
++ select ARM64_WORKAROUND_REPEAT_TLBI
++ help
++ This option adds a workaround for the following errata:
++
++ * ARM C1-Premium erratum 4193780
++ * ARM C1-Ultra erratum 4193780
++ * ARM Cortex-A76 erratum 4193800
++ * ARM Cortex-A76AE erratum 4193801
++ * ARM Cortex-A77 erratum 4193798
++ * ARM Cortex-A78 erratum 4193791
++ * ARM Cortex-A78AE erratum 4193793
++ * ARM Cortex-A78C erratum 4193794
++ * ARM Cortex-A710 erratum 4193788
++ * ARM Cortex-X1 erratum 4193791
++ * ARM Cortex-X1C erratum 4193792
++ * ARM Cortex-X2 erratum 4193788
++ * ARM Cortex-X3 erratum 4193786
++ * ARM Cortex-X4 erratum 4118414
++ * ARM Cortex-X925 erratum 4193781
++ * ARM Neoverse-N1 erratum 4193800
++ * ARM Neoverse-N2 erratum 4193789
++ * ARM Neoverse-V1 erratum 4193790
++ * ARM Neoverse-V2 erratum 4193787
++ * ARM Neoverse-V3 erratum 4193784
++ * ARM Neoverse-V3AE erratum 4193784
++
++ On affected cores, some memory accesses might not be completed by
++ broadcast TLB invalidation.
++
++ This issue is also known as CVE-2025-10263.
++
++ If unsure, say Y.
++
+ config CAVIUM_ERRATUM_22375
+ bool "Cavium erratum 22375, 24313"
+ default y
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -316,7 +316,35 @@ static const struct arm64_cpu_capabiliti
+ ERRATA_MIDR_RANGE(MIDR_CORTEX_A510, 0, 0, 1, 1),
+ },
+ #endif
+- {},
++#ifdef CONFIG_ARM64_ERRATUM_4118414
++ {
++ ERRATA_MIDR_RANGE_LIST(((const struct midr_range[]) {
++ MIDR_ALL_VERSIONS(MIDR_C1_PREMIUM),
++ MIDR_ALL_VERSIONS(MIDR_C1_ULTRA),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A76),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A76AE),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A77),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78AE),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A710),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X1),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X1C),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X2),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X3),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X4),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X925),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE),
++ {}
++ })),
++ },
++#endif
++ {}
+ };
+ #endif
+
+@@ -669,7 +697,7 @@ const struct arm64_cpu_capabilities arm6
+ #endif
+ #ifdef CONFIG_ARM64_WORKAROUND_REPEAT_TLBI
+ {
+- .desc = "Qualcomm erratum 1009, or ARM erratum 1286807, 2441009",
++ .desc = "Broken broadcast TLBI completion",
+ .capability = ARM64_WORKAROUND_REPEAT_TLBI,
+ .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
+ .matches = cpucap_multi_entry_cap_matches,
--- /dev/null
+From 836efd35c472d89c838d7b17ef339ddb3286ffc5 Mon Sep 17 00:00:00 2001
+From: Damien Le Moal <dlemoal@kernel.org>
+Date: Wed, 13 May 2026 20:11:29 +0900
+Subject: block: fix handling of dead zone write plugs
+
+From: Damien Le Moal <dlemoal@kernel.org>
+
+commit 836efd35c472d89c838d7b17ef339ddb3286ffc5 upstream.
+
+Shin'ichiro reported hard to reproduce unaligned write errors with zoned
+block devices. Under normal operation conditions (e.g. running XFS on an
+SMR disk), these errors are nearly impossible to trigger. But using a
+"slow" kernel with many debug options enables and some specific use
+cases (e.g. fio zbd test case 46), the errors can be reproduced fairly
+easily.
+
+The unaligned write errors come from mishandling a valid reference
+counting pattern of zone write plugs. Such pattern triggers for instance
+if a process A writes a zone (not necessarilly to the full state),
+another process B immediately resets the zone and immediately following
+the completion of the zone reset, starts issuing writes to the zone.
+With such pattern, in some cases, the zone write plugs worker thread of
+the device may still be holding a reference to the zone write plug of
+the zone taken when process A was writing to the zone. The following
+zone reset from process B marks the zone as dead but does not remove the
+zone write plug from the device hash table as a reference to the plug
+still exist. Once process B starts issuing new writes, the zone write
+plug is seen as dead and the writes from process B are immediately
+failed, despite this write pattern being perfectly legal.
+
+Fix this by allowing restoring a dead zone write plug to a live state if
+a write is issued to the zone when the zone is: marked as dead, empty
+and the write sector corresponds to the first sector of the zone (that
+is, the write is aligned to the zone write pointer). This is done with
+the new helper function disk_check_zone_wplug_dead(), which restores a
+dead zone write plug to a live state by clearing the BLK_ZONE_WPLUG_DEAD
+flag and restoring the initial reference to the zone write plug taken
+when the plug was added to the device hash table.
+
+Reported-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Fixes: b7d4ffb51037 ("block: fix zone write plug removal")
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Link: https://patch.msgid.link/20260513111129.108809-1-dlemoal@kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+[ context conflict due to different line offsets in blk-zoned.c ]
+Signed-off-by: Gyokhan Kochmarla <gyokhan@amazon.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-zoned.c | 32 +++++++++++++++++++++++++++-----
+ 1 file changed, 27 insertions(+), 5 deletions(-)
+
+--- a/block/blk-zoned.c
++++ b/block/blk-zoned.c
+@@ -505,6 +505,28 @@ static void disk_mark_zone_wplug_dead(st
+ }
+ }
+
++static inline bool disk_check_zone_wplug_dead(struct blk_zone_wplug *zwplug)
++{
++ if (!(zwplug->flags & BLK_ZONE_WPLUG_DEAD))
++ return false;
++
++ /*
++ * If a new write is received right after a zone reset completes and
++ * while the disk_zone_wplugs_worker() thread has not yet released the
++ * reference on the zone write plug after processing the last write to
++ * the zone, then the new write BIO will see the zone write plug marked
++ * as dead. This case is however a false positive and a perfectly valid
++ * pattern. In such case, restore the zone write plug to a live one.
++ */
++ if (!zwplug->wp_offset && bio_list_empty(&zwplug->bio_list)) {
++ zwplug->flags &= ~BLK_ZONE_WPLUG_DEAD;
++ refcount_inc(&zwplug->ref);
++ return false;
++ }
++
++ return true;
++}
++
+ static void blk_zone_wplug_bio_work(struct work_struct *work);
+
+ /*
+@@ -1027,12 +1049,12 @@ static bool blk_zone_wplug_handle_write(
+ }
+
+ /*
+- * If we got a zone write plug marked as dead, then the user is issuing
+- * writes to a full zone, or without synchronizing with zone reset or
+- * zone finish operations. In such case, fail the BIO to signal this
+- * invalid usage.
++ * Check if we got a zone write plug marked as dead. If yes, then the
++ * user is likely issuing writes to a full zone, or without
++ * synchronizing with zone reset or zone finish operations. In such
++ * case, fail the BIO to signal this invalid usage.
+ */
+- if (zwplug->flags & BLK_ZONE_WPLUG_DEAD) {
++ if (disk_check_zone_wplug_dead(zwplug)) {
+ spin_unlock_irqrestore(&zwplug->lock, flags);
+ disk_put_zone_wplug(zwplug);
+ bio_io_error(bio);
ipvs-skip-ipv6-extension-headers-for-csum-checks.patch
vsock-virtio-fix-potential-unbounded-skb-queue.patch
vsock-virtio-fix-skb-overhead-accounting-to-preserve-full-buf_alloc.patch
+arm64-cputype-add-c1-ultra-definitions.patch
+arm64-cputype-add-c1-premium-definitions.patch
+arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch
+arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch
+arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt-100-cpu.patch
+block-fix-handling-of-dead-zone-write-plugs.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
