--- /dev/null
+From stable+bounces-263571-greg=kroah.com@vger.kernel.org Tue Jun 16 10:49:11 2026
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 16 Jun 2026 06:18:19 +0100
+Subject: arm64: cputype: Add C1-Premium definitions
+To: stable@vger.kernel.org
+Cc: anshuman.khandual@arm.com, catalin.marinas@arm.com, gregkh@linuxfoundation.org, lee@kernel.org, mark.rutland@arm.com, maz@kernel.org, oupton@kernel.org, ryan.roberts@arm.com, sdonthineni@nvidia.com, will@kernel.org, yuzenghui@huawei.com
+Message-ID: <20260616051822.111870-7-mark.rutland@arm.com>
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+commit d28413bfc5a255957241f1df5d7fd0c2cd74fe18 upstream.
+
+Add cputype definitions for C1-Premium. These will be used for errata
+detection in subsequent patches.
+
+These values can be found in the C1-Premium TRM:
+
+ https://developer.arm.com/documentation/109416/0100/
+
+... in section A.5.1 ("MIDR_EL1, Main ID Register").
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+[Mark: backport to v6.6.y]
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/include/asm/cputype.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/include/asm/cputype.h
++++ b/arch/arm64/include/asm/cputype.h
+@@ -99,6 +99,7 @@
+ #define ARM_CPU_PART_CORTEX_A725 0xD87
+ #define ARM_CPU_PART_C1_ULTRA 0xD8C
+ #define ARM_CPU_PART_NEOVERSE_N3 0xD8E
++#define ARM_CPU_PART_C1_PREMIUM 0xD90
+
+ #define APM_CPU_PART_XGENE 0x000
+ #define APM_CPU_VAR_POTENZA 0x00
+@@ -189,6 +190,7 @@
+ #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725)
+ #define MIDR_C1_ULTRA MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_ULTRA)
+ #define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3)
++#define MIDR_C1_PREMIUM MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PREMIUM)
+ #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX)
+ #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX)
+ #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX)
--- /dev/null
+From stable+bounces-263570-greg=kroah.com@vger.kernel.org Tue Jun 16 10:49:06 2026
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 16 Jun 2026 06:18:18 +0100
+Subject: arm64: cputype: Add C1-Ultra definitions
+To: stable@vger.kernel.org
+Cc: anshuman.khandual@arm.com, catalin.marinas@arm.com, gregkh@linuxfoundation.org, lee@kernel.org, mark.rutland@arm.com, maz@kernel.org, oupton@kernel.org, ryan.roberts@arm.com, sdonthineni@nvidia.com, will@kernel.org, yuzenghui@huawei.com
+Message-ID: <20260616051822.111870-6-mark.rutland@arm.com>
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+commit 60349e64a6c65f9f0aa118af711b3c7e137f07ff upstream.
+
+Add cputype definitions for C1-Ultra. These will be used for errata
+detection in subsequent patches.
+
+These values can be found in the C1-Ultra TRM:
+
+ https://developer.arm.com/documentation/108014/0100/
+
+... in section A.5.1 ("MIDR_EL1, Main ID Register").
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+[Mark: backport to v6.6.y]
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/include/asm/cputype.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/include/asm/cputype.h
++++ b/arch/arm64/include/asm/cputype.h
+@@ -97,6 +97,7 @@
+ #define ARM_CPU_PART_NEOVERSE_V3 0xD84
+ #define ARM_CPU_PART_CORTEX_X925 0xD85
+ #define ARM_CPU_PART_CORTEX_A725 0xD87
++#define ARM_CPU_PART_C1_ULTRA 0xD8C
+ #define ARM_CPU_PART_NEOVERSE_N3 0xD8E
+
+ #define APM_CPU_PART_XGENE 0x000
+@@ -186,6 +187,7 @@
+ #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3)
+ #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925)
+ #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725)
++#define MIDR_C1_ULTRA MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_ULTRA)
+ #define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3)
+ #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX)
+ #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX)
--- /dev/null
+From stable+bounces-263569-greg=kroah.com@vger.kernel.org Tue Jun 16 10:48:47 2026
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 16 Jun 2026 06:18:17 +0100
+Subject: arm64: cputype: Add NVIDIA Olympus definitions
+To: stable@vger.kernel.org
+Cc: anshuman.khandual@arm.com, catalin.marinas@arm.com, gregkh@linuxfoundation.org, lee@kernel.org, mark.rutland@arm.com, maz@kernel.org, oupton@kernel.org, ryan.roberts@arm.com, sdonthineni@nvidia.com, will@kernel.org, yuzenghui@huawei.com
+Message-ID: <20260616051822.111870-5-mark.rutland@arm.com>
+
+From: Shanker Donthineni <sdonthineni@nvidia.com>
+
+commit e185c8a0d84236d14af61faff8147c953a878a77 upstream.
+
+Add cpu part and model macro definitions for NVIDIA Olympus core.
+
+Signed-off-by: Shanker Donthineni <sdonthineni@nvidia.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+[Mark: backport to v6.6.y]
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/include/asm/cputype.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/include/asm/cputype.h
++++ b/arch/arm64/include/asm/cputype.h
+@@ -129,6 +129,7 @@
+
+ #define NVIDIA_CPU_PART_DENVER 0x003
+ #define NVIDIA_CPU_PART_CARMEL 0x004
++#define NVIDIA_CPU_PART_OLYMPUS 0x010
+
+ #define FUJITSU_CPU_PART_A64FX 0x001
+
+@@ -209,6 +210,7 @@
+ #define MIDR_QCOM_KRYO_4XX_SILVER MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO_4XX_SILVER)
+ #define MIDR_NVIDIA_DENVER MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_DENVER)
+ #define MIDR_NVIDIA_CARMEL MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_CARMEL)
++#define MIDR_NVIDIA_OLYMPUS MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_OLYMPUS)
+ #define MIDR_FUJITSU_A64FX MIDR_CPU_MODEL(ARM_CPU_IMP_FUJITSU, FUJITSU_CPU_PART_A64FX)
+ #define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110)
+ #define MIDR_HISI_HIP09 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_HIP09)
--- /dev/null
+From stable+bounces-263574-greg=kroah.com@vger.kernel.org Tue Jun 16 10:49:09 2026
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 16 Jun 2026 06:18:22 +0100
+Subject: arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
+To: stable@vger.kernel.org
+Cc: anshuman.khandual@arm.com, catalin.marinas@arm.com, gregkh@linuxfoundation.org, lee@kernel.org, mark.rutland@arm.com, maz@kernel.org, oupton@kernel.org, ryan.roberts@arm.com, sdonthineni@nvidia.com, will@kernel.org, yuzenghui@huawei.com
+Message-ID: <20260616051822.111870-10-mark.rutland@arm.com>
+
+From: Will Deacon <will@kernel.org>
+
+commit 1940e70a8144bf75e6df26bf6f600862ea7f7ea1 upstream.
+
+Commit fb091ff39479 ("arm64: Subscribe Microsoft Azure Cobalt 100 to ARM
+Neoverse N2 errata") states that Microsoft Azure Cobalt 100 CPU "is a
+Microsoft implemented CPU based on r0p0 of the ARM Neoverse N2 CPU, and
+therefore suffers from all the same errata.".
+
+So enable the workaround for the latest broadcast TLB invalidation bug
+on these parts.
+
+Signed-off-by: Will Deacon <will@kernel.org>
+[Mark: backport to v6.6.y]
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/arch/arm64/silicon-errata.rst | 2 ++
+ arch/arm64/Kconfig | 1 +
+ arch/arm64/kernel/cpu_errata.c | 1 +
+ 3 files changed, 4 insertions(+)
+
+--- a/Documentation/arch/arm64/silicon-errata.rst
++++ b/Documentation/arch/arm64/silicon-errata.rst
+@@ -335,3 +335,5 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | Microsoft | Azure Cobalt 100| #3324339 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| Microsoft | Azure Cobalt 100| #4193789 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -1148,6 +1148,7 @@ config ARM64_ERRATUM_4118414
+ * ARM Neoverse-V2 erratum 4193787
+ * ARM Neoverse-V3 erratum 4193784
+ * ARM Neoverse-V3AE erratum 4193784
++ * Microsoft Azure Cobalt 100 4193789
+ * NVIDIA Olympus erratum T410-OLY-1029
+
+ On affected cores, some memory accesses might not be completed by
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -266,6 +266,7 @@ static const struct arm64_cpu_capabiliti
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE),
+ MIDR_ALL_VERSIONS(MIDR_NVIDIA_OLYMPUS),
++ MIDR_ALL_VERSIONS(MIDR_MICROSOFT_AZURE_COBALT_100),
+ {}
+ })),
+ },
--- /dev/null
+From stable+bounces-263573-greg=kroah.com@vger.kernel.org Tue Jun 16 10:48:58 2026
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 16 Jun 2026 06:18:21 +0100
+Subject: arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
+To: stable@vger.kernel.org
+Cc: anshuman.khandual@arm.com, catalin.marinas@arm.com, gregkh@linuxfoundation.org, lee@kernel.org, mark.rutland@arm.com, maz@kernel.org, oupton@kernel.org, ryan.roberts@arm.com, sdonthineni@nvidia.com, will@kernel.org, yuzenghui@huawei.com
+Message-ID: <20260616051822.111870-9-mark.rutland@arm.com>
+
+From: Shanker Donthineni <sdonthineni@nvidia.com>
+
+commit ec7216f92e4ebd485b1c6dc6aa3f6064b71a5768 upstream.
+
+NVIDIA Olympus cores are affected by the TLBI completion issue tracked as
+CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses
+ARM64_WORKAROUND_REPEAT_TLBI to issue an additional broadcast TLBI;DSB
+sequence and ensure affected memory write effects are globally observed.
+
+Add MIDR_NVIDIA_OLYMPUS to the repeat-TLBI match list so the same
+mitigation is enabled on affected Olympus systems. Also document the
+NVIDIA Olympus erratum in the arm64 silicon errata table and list it in
+the Kconfig help text.
+
+Signed-off-by: Shanker Donthineni <sdonthineni@nvidia.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+[Mark: backport to v6.6.y]
+Signed-off-by: Shanker Donthineni <sdonthineni@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/arch/arm64/silicon-errata.rst | 2 ++
+ arch/arm64/Kconfig | 3 ++-
+ arch/arm64/kernel/cpu_errata.c | 1 +
+ 3 files changed, 5 insertions(+), 1 deletion(-)
+
+--- a/Documentation/arch/arm64/silicon-errata.rst
++++ b/Documentation/arch/arm64/silicon-errata.rst
+@@ -274,6 +274,8 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | NVIDIA | Carmel Core | N/A | NVIDIA_CARMEL_CNP_ERRATUM |
+ +----------------+-----------------+-----------------+-----------------------------+
++| NVIDIA | Olympus core | T410-OLY-1029 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | NVIDIA | T241 GICv3/4.x | T241-FABRIC-4 | N/A |
+ +----------------+-----------------+-----------------+-----------------------------+
+ +----------------+-----------------+-----------------+-----------------------------+
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -1121,7 +1121,7 @@ config ARM64_ERRATUM_4193714
+ If unsure, say Y.
+
+ config ARM64_ERRATUM_4118414
+- bool "Cortex-*/Neoverse-*/C1-*: Completion of affected memory accesses might not be guaranteed by completion of a TLBI"
++ bool "Various: Completion of affected memory accesses might not be guaranteed by completion of a TLBI"
+ default y
+ select ARM64_WORKAROUND_REPEAT_TLBI
+ help
+@@ -1148,6 +1148,7 @@ config ARM64_ERRATUM_4118414
+ * ARM Neoverse-V2 erratum 4193787
+ * ARM Neoverse-V3 erratum 4193784
+ * ARM Neoverse-V3AE erratum 4193784
++ * NVIDIA Olympus erratum T410-OLY-1029
+
+ On affected cores, some memory accesses might not be completed by
+ broadcast TLB invalidation.
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -265,6 +265,7 @@ static const struct arm64_cpu_capabiliti
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE),
++ MIDR_ALL_VERSIONS(MIDR_NVIDIA_OLYMPUS),
+ {}
+ })),
+ },
--- /dev/null
+From stable+bounces-263572-greg=kroah.com@vger.kernel.org Tue Jun 16 10:49:13 2026
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 16 Jun 2026 06:18:20 +0100
+Subject: arm64: errata: Mitigate TLBI errata on various Arm CPUs
+To: stable@vger.kernel.org
+Cc: anshuman.khandual@arm.com, catalin.marinas@arm.com, gregkh@linuxfoundation.org, lee@kernel.org, mark.rutland@arm.com, maz@kernel.org, oupton@kernel.org, ryan.roberts@arm.com, sdonthineni@nvidia.com, will@kernel.org, yuzenghui@huawei.com
+Message-ID: <20260616051822.111870-8-mark.rutland@arm.com>
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+commit cfd391e74134db664feb499d43af286380b10ba8 upstream.
+
+A number of CPUs developed by Arm suffer from errata whereby a broadcast
+TLBI;DSB sequence may complete before the global observation of writes
+which are translated by an affected TLB entry.
+
+These errata ONLY affect the completion of memory accesses which have
+been translated by an invalidated TLB entry, and these errata DO NOT
+affect the actual invalidation of TLB entries. TLB entries are removed
+correctly.
+
+This issue has been assigned CVE ID CVE-2025-10263.
+
+To mitigate this issue, Arm recommends that software follows any
+affected TLBI;DSB sequence with an additional TLBI;DSB, which will
+ensure that all memory write effects affected by the first TLBI have
+been globally observed. The additional TLBI can use any operation that
+is broadcast to affected CPUs, and the additional DSB can use any option
+that is sufficient to complete the additional TLBI.
+
+The ARM64_WORKAROUND_REPEAT_TLBI workaround is sufficient to mitigate
+the issue. Enable this workaround for affected CPUs, and update the
+silicon errata documentation accordingly.
+
+Note that due to the manner in which Arm develops IP and tracks errata,
+some CPUs share a common erratum number.
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+[Mark: backport to v6.6.y]
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/arch/arm64/silicon-errata.rst | 44 +++++++++++++++++++++++++
+ arch/arm64/Kconfig | 48 ++++++++++++++++++++++++++++
+ arch/arm64/kernel/cpu_errata.c | 32 +++++++++++++++++-
+ 3 files changed, 122 insertions(+), 2 deletions(-)
+
+--- a/Documentation/arch/arm64/silicon-errata.rst
++++ b/Documentation/arch/arm64/silicon-errata.rst
+@@ -123,14 +123,26 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A76 | #3324349 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-A76 | #4193800 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-A76AE | #4193801 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A77 | #1508412 | ARM64_ERRATUM_1508412 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A77 | #3324348 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-A77 | #4193798 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A78 | #3324344 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-A78 | #4193791 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-A78AE | #4193793 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A78C | #3324346,3324347| ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-A78C | #4193794 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A710 | #2119858 | ARM64_ERRATUM_2119858 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A710 | #2054223 | ARM64_ERRATUM_2054223 |
+@@ -139,6 +151,8 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A710 | #3324338 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-A710 | #4193788 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A715 | #2645198 | ARM64_ERRATUM_2645198 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A715 | #3456084 | ARM64_ERRATUM_3194386 |
+@@ -149,20 +163,32 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X1 | #3324344 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-X1 | #4193791 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X1C | #3324346 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-X1C | #4193792 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X2 | #2119858 | ARM64_ERRATUM_2119858 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X2 | #2224489 | ARM64_ERRATUM_2224489 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X2 | #3324338 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-X2 | #4193788 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X3 | #3324335 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-X3 | #4193786 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X4 | #3194386 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-X4 | #4118414 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X925 | #3324334 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-X925 | #4193781 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-N1 | #1188873,1418040| ARM64_ERRATUM_1418040 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-N1 | #1349291 | N/A |
+@@ -171,6 +197,8 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-N1 | #3324349 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Neoverse-N1 | #4193800 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-N2 | #2139208 | ARM64_ERRATUM_2139208 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-N2 | #2067961 | ARM64_ERRATUM_2067961 |
+@@ -179,16 +207,32 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-N2 | #3324339 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Neoverse-N2 | #4193789 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-N3 | #3456111 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-V1 | #3324341 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Neoverse-V1 | #4193790 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-V2 | #3324336 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Neoverse-V2 | #4193787 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-V3 | #3312417 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Neoverse-V3 | #4193784 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-V3AE | #3312417 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Neoverse-V3AE | #4193784 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
++| ARM | C1-Premium | #4193780 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
++| ARM | C1-Pro | #4193714 | ARM64_ERRATUM_4193714 |
+++----------------+-----------------+-----------------+-----------------------------+
++| ARM | C1-Ultra | #4193780 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | MMU-500 | #841119,826419 | N/A |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | MMU-600 | #1076982,1209401| N/A |
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -1108,6 +1108,54 @@ config ARM64_ERRATUM_3194386
+
+ If unsure, say Y.
+
++config ARM64_ERRATUM_4193714
++ bool "C1-Pro: 4193714: SME DVMSync early acknowledgement"
++ depends on ARM64_SME
++ default y
++ help
++ Enable workaround for C1-Pro acknowledging the DVMSync before
++ the SME memory accesses are complete. This will cause TLB
++ maintenance for processes using SME to also issue an IPI to
++ the affected CPUs.
++
++ If unsure, say Y.
++
++config ARM64_ERRATUM_4118414
++ bool "Cortex-*/Neoverse-*/C1-*: Completion of affected memory accesses might not be guaranteed by completion of a TLBI"
++ default y
++ select ARM64_WORKAROUND_REPEAT_TLBI
++ help
++ This option adds a workaround for the following errata:
++
++ * ARM C1-Premium erratum 4193780
++ * ARM C1-Ultra erratum 4193780
++ * ARM Cortex-A76 erratum 4193800
++ * ARM Cortex-A76AE erratum 4193801
++ * ARM Cortex-A77 erratum 4193798
++ * ARM Cortex-A78 erratum 4193791
++ * ARM Cortex-A78AE erratum 4193793
++ * ARM Cortex-A78C erratum 4193794
++ * ARM Cortex-A710 erratum 4193788
++ * ARM Cortex-X1 erratum 4193791
++ * ARM Cortex-X1C erratum 4193792
++ * ARM Cortex-X2 erratum 4193788
++ * ARM Cortex-X3 erratum 4193786
++ * ARM Cortex-X4 erratum 4118414
++ * ARM Cortex-X925 erratum 4193781
++ * ARM Neoverse-N1 erratum 4193800
++ * ARM Neoverse-N2 erratum 4193789
++ * ARM Neoverse-V1 erratum 4193790
++ * ARM Neoverse-V2 erratum 4193787
++ * ARM Neoverse-V3 erratum 4193784
++ * ARM Neoverse-V3AE erratum 4193784
++
++ On affected cores, some memory accesses might not be completed by
++ broadcast TLB invalidation.
++
++ This issue is also known as CVE-2025-10263.
++
++ If unsure, say Y.
++
+ config CAVIUM_ERRATUM_22375
+ bool "Cavium erratum 22375, 24313"
+ default y
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -241,7 +241,35 @@ static const struct arm64_cpu_capabiliti
+ ERRATA_MIDR_RANGE(MIDR_CORTEX_A510, 0, 0, 1, 1),
+ },
+ #endif
+- {},
++#ifdef CONFIG_ARM64_ERRATUM_4118414
++ {
++ ERRATA_MIDR_RANGE_LIST(((const struct midr_range[]) {
++ MIDR_ALL_VERSIONS(MIDR_C1_PREMIUM),
++ MIDR_ALL_VERSIONS(MIDR_C1_ULTRA),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A76),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A76AE),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A77),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78AE),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A710),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X1),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X1C),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X2),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X3),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X4),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X925),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE),
++ {}
++ })),
++ },
++#endif
++ {}
+ };
+ #endif
+
+@@ -569,7 +597,7 @@ const struct arm64_cpu_capabilities arm6
+ #endif
+ #ifdef CONFIG_ARM64_WORKAROUND_REPEAT_TLBI
+ {
+- .desc = "Qualcomm erratum 1009, or ARM erratum 1286807, 2441009",
++ .desc = "Broken broadcast TLBI completion",
+ .capability = ARM64_WORKAROUND_REPEAT_TLBI,
+ .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
+ .matches = cpucap_multi_entry_cap_matches,
--- /dev/null
+From stable+bounces-263692-greg=kroah.com@vger.kernel.org Tue Jun 16 17:50:08 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jun 2026 08:19:09 -0400
+Subject: mptcp: add-addr: always drop other suboptions
+To: stable@vger.kernel.org
+Cc: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260616121909.3134590-2-sashal@kernel.org>
+
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+
+[ Upstream commit bd34fa0257261b76964df1c98f44b3cb4ee14620 ]
+
+When an ADD_ADDR needs to be sent, it could be prepared if there is
+enough remaining space and even if the packet is not a pure ACK. But it
+would be dropped soon after.
+
+Indeed, in mptcp_pm_add_addr_signal(), there is enough space to fit a
+DSS of 20 octets and an ADD_ADDR echo containing an IPv4 address on 8
+octets for example. In this case, the packet would be prepared, the
+MPTCP_ADD_ADDR_ECHO bit would be removed from pm->addr_signal, but the
+option would be silently dropped in mptcp_established_options_add_addr()
+not to override DSS info in the union from 'struct mptcp_out_options',
+and also because mptcp_write_options() will enforce mutually exclusion
+with DSS.
+
+Instead, don't even try to send an ADD_ADDR if it is not a pure ACK.
+Retry for each new packet until a pure-ACK is emitted. That's fine to do
+that, because each time an ADD_ADDR (echo) is scheduled, a pure ACK is
+queued.
+
+This also simplifies the code, and the skb checks can be done earlier,
+before the lock.
+
+Note: also, since commit 6d0060f600ad ("mptcp: Write MPTCP DSS headers
+to outgoing data packets"), opts->ahmac would not have been set to 0
+when other suboptions were not dropped, and when sending an ADD_ADDR
+echo. That would have resulted in sending an ADD_ADDR using garbage
+info, where there was not enough space, instead of an echo one without
+the ADD_ADDR HMAC.
+
+Fixes: 1bff1e43a30e ("mptcp: optimize out option generation")
+Cc: stable@vger.kernel.org
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-11-856831229976@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/options.c | 30 +++++++-----------------------
+ net/mptcp/pm.c | 15 ++++-----------
+ net/mptcp/protocol.h | 7 +++----
+ 3 files changed, 14 insertions(+), 38 deletions(-)
+
+--- a/net/mptcp/options.c
++++ b/net/mptcp/options.c
+@@ -662,7 +662,6 @@ static bool mptcp_established_options_ad
+ {
+ struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
+ struct mptcp_sock *msk = mptcp_sk(subflow->conn);
+- bool drop_other_suboptions = false;
+ unsigned int opt_size = *size;
+ struct mptcp_addr_info addr;
+ bool echo;
+@@ -673,36 +672,20 @@ static bool mptcp_established_options_ad
+ */
+ if (!mptcp_pm_should_add_signal(msk) ||
+ (opts->suboptions & (OPTION_MPTCP_MPJ_ACK | OPTION_MPTCP_MPC_ACK)) ||
+- !mptcp_pm_add_addr_signal(msk, skb, opt_size, remaining, &addr,
+- &echo, &drop_other_suboptions))
++ !skb || !skb_is_tcp_pure_ack(skb) ||
++ !mptcp_pm_add_addr_signal(msk, opt_size, remaining, &addr, &echo))
+ return false;
+
+- /*
+- * Later on, mptcp_write_options() will enforce mutually exclusion with
+- * DSS, bail out if such option is set and we can't drop it.
+- */
+- if (drop_other_suboptions)
+- remaining += opt_size;
+- else if (opts->suboptions & OPTION_MPTCP_DSS)
+- return false;
++ remaining += opt_size;
+
+ len = mptcp_add_addr_len(addr.family, echo, !!addr.port);
+ if (remaining < len)
+ return false;
+
+ *size = len;
+- if (drop_other_suboptions) {
+- pr_debug("drop other suboptions\n");
+- opts->suboptions = 0;
+-
+- /* note that e.g. DSS could have written into the memory
+- * aliased by ahmac, we must reset the field here
+- * to avoid appending the hmac even for ADD_ADDR echo
+- * options
+- */
+- opts->ahmac = 0;
+- *size -= opt_size;
+- }
++ pr_debug("drop other suboptions\n");
++ opts->suboptions = 0;
++ *size -= opt_size;
+ opts->addr = addr;
+ opts->suboptions |= OPTION_MPTCP_ADD_ADDR;
+ if (!echo) {
+@@ -712,6 +695,7 @@ static bool mptcp_established_options_ad
+ &opts->addr);
+ } else {
+ MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_ECHOADDTX);
++ opts->ahmac = 0;
+ }
+ pr_debug("addr_id=%d, ahmac=%llu, echo=%d, port=%d\n",
+ opts->addr.id, opts->ahmac, echo, ntohs(opts->addr.port));
+--- a/net/mptcp/pm.c
++++ b/net/mptcp/pm.c
+@@ -330,10 +330,9 @@ void mptcp_pm_mp_fail_received(struct so
+
+ /* path manager helpers */
+
+-bool mptcp_pm_add_addr_signal(struct mptcp_sock *msk, const struct sk_buff *skb,
+- unsigned int opt_size, unsigned int remaining,
+- struct mptcp_addr_info *addr, bool *echo,
+- bool *drop_other_suboptions)
++bool mptcp_pm_add_addr_signal(struct mptcp_sock *msk, unsigned int opt_size,
++ unsigned int remaining,
++ struct mptcp_addr_info *addr, bool *echo)
+ {
+ bool skip_add_addr = false;
+ int ret = false;
+@@ -351,10 +350,7 @@ bool mptcp_pm_add_addr_signal(struct mpt
+ * plain dup-ack from TCP perspective. The other MPTCP-relevant info,
+ * if any, will be carried by the 'original' TCP ack
+ */
+- if (skb && skb_is_tcp_pure_ack(skb)) {
+- remaining += opt_size;
+- *drop_other_suboptions = true;
+- }
++ remaining += opt_size;
+
+ *echo = mptcp_pm_should_add_signal_echo(msk);
+ if (*echo) {
+@@ -372,9 +368,6 @@ bool mptcp_pm_add_addr_signal(struct mpt
+ if (remaining < mptcp_add_addr_len(family, *echo, port)) {
+ struct net *net = sock_net((struct sock *)msk);
+
+- if (!*drop_other_suboptions)
+- goto out_unlock;
+-
+ if (*echo) {
+ MPTCP_INC_STATS(net, MPTCP_MIB_ECHOADDTXDROP);
+ } else {
+--- a/net/mptcp/protocol.h
++++ b/net/mptcp/protocol.h
+@@ -1042,10 +1042,9 @@ static inline int mptcp_rm_addr_len(cons
+ return TCPOLEN_MPTCP_RM_ADDR_BASE + roundup(rm_list->nr - 1, 4) + 1;
+ }
+
+-bool mptcp_pm_add_addr_signal(struct mptcp_sock *msk, const struct sk_buff *skb,
+- unsigned int opt_size, unsigned int remaining,
+- struct mptcp_addr_info *addr, bool *echo,
+- bool *drop_other_suboptions);
++bool mptcp_pm_add_addr_signal(struct mptcp_sock *msk, unsigned int opt_size,
++ unsigned int remaining,
++ struct mptcp_addr_info *addr, bool *echo);
+ bool mptcp_pm_rm_addr_signal(struct mptcp_sock *msk, unsigned int remaining,
+ struct mptcp_rm_list *rm_list);
+ int mptcp_pm_get_local_id(struct mptcp_sock *msk, struct sock_common *skc);
--- /dev/null
+From stable+bounces-263694-greg=kroah.com@vger.kernel.org Tue Jun 16 17:50:30 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jun 2026 08:19:27 -0400
+Subject: mptcp: fix missing wakeups in edge scenarios
+To: stable@vger.kernel.org
+Cc: Paolo Abeni <pabeni@redhat.com>, "Matthieu Baerts (NGI0)" <matttbe@kernel.org>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260616121927.3135722-1-sashal@kernel.org>
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit 9d8d28738f24b75616d6ca7a27cb4aed88520343 ]
+
+The mptcp_recvmsg() can fill MPTCP socket receive queue via
+mptcp_move_skbs(), but currently does not try to wakeup any listener,
+because the same process is going to check the receive queue soon.
+
+When multiple threads are reading from the same fd, the above can
+cause stall. Add the missing wakeup.
+
+Fixes: 6771bfd9ee24 ("mptcp: update mptcp ack sequence from work queue")
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-1-856831229976@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/protocol.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -2205,7 +2205,11 @@ static bool __mptcp_move_skbs(struct mpt
+ }
+ if (ret)
+ mptcp_check_data_fin((struct sock *)msk);
+- return !skb_queue_empty(&msk->receive_queue);
++
++ ret = !skb_queue_empty(&msk->receive_queue);
++ if (ret && mptcp_epollin_ready(sk))
++ sk->sk_data_ready(sk);
++ return ret;
+ }
+
+ static unsigned int mptcp_inq_hint(const struct sock *sk)
net-bonding-fix-use-after-free-in-bond_xmit_broadcast.patch
ipvs-skip-ipv6-extension-headers-for-csum-checks.patch
alsa-hda-hdmi-add-quirk-for-tuxedo-ibs14g6.patch
+arm64-cputype-add-nvidia-olympus-definitions.patch
+arm64-cputype-add-c1-ultra-definitions.patch
+arm64-cputype-add-c1-premium-definitions.patch
+arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch
+arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch
+arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt-100-cpu.patch
+mptcp-add-addr-always-drop-other-suboptions.patch
+mptcp-fix-missing-wakeups-in-edge-scenarios.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
