--- /dev/null
+From stable+bounces-263707-greg=kroah.com@vger.kernel.org Tue Jun 16 17:53:02 2026
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 16 Jun 2026 13:22:31 +0100
+Subject: arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
+To: stable@vger.kernel.org
+Cc: catalin.marinas@arm.com, gregkh@linuxfoundation.org, lee@kernel.org, mark.rutland@arm.com, sdonthineni@nvidia.com, will@kernel.org
+Message-ID: <20260616122231.237216-6-mark.rutland@arm.com>
+
+From: Will Deacon <will@kernel.org>
+
+commit 1940e70a8144bf75e6df26bf6f600862ea7f7ea1 upstream.
+
+Commit fb091ff39479 ("arm64: Subscribe Microsoft Azure Cobalt 100 to ARM
+Neoverse N2 errata") states that Microsoft Azure Cobalt 100 CPU "is a
+Microsoft implemented CPU based on r0p0 of the ARM Neoverse N2 CPU, and
+therefore suffers from all the same errata.".
+
+So enable the workaround for the latest broadcast TLB invalidation bug
+on these parts.
+
+Signed-off-by: Will Deacon <will@kernel.org>
+[Mark: backport to v7.0.y]
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/arch/arm64/silicon-errata.rst | 2 ++
+ arch/arm64/Kconfig | 1 +
+ arch/arm64/kernel/cpu_errata.c | 1 +
+ 3 files changed, 4 insertions(+)
+
+--- a/Documentation/arch/arm64/silicon-errata.rst
++++ b/Documentation/arch/arm64/silicon-errata.rst
+@@ -352,3 +352,5 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | Microsoft | Azure Cobalt 100| #3324339 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| Microsoft | Azure Cobalt 100| #4193789 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -1204,6 +1204,7 @@ config ARM64_ERRATUM_4118414
+ * ARM Neoverse-V2 erratum 4193787
+ * ARM Neoverse-V3 erratum 4193784
+ * ARM Neoverse-V3AE erratum 4193784
++ * Microsoft Azure Cobalt 100 4193789
+ * NVIDIA Olympus erratum T410-OLY-1029
+
+ On affected cores, some memory accesses might not be completed by
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -364,6 +364,7 @@ static const struct arm64_cpu_capabiliti
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE),
+ MIDR_ALL_VERSIONS(MIDR_NVIDIA_OLYMPUS),
++ MIDR_ALL_VERSIONS(MIDR_MICROSOFT_AZURE_COBALT_100),
+ {}
+ })),
+ },
--- /dev/null
+From stable+bounces-263706-greg=kroah.com@vger.kernel.org Tue Jun 16 17:52:48 2026
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 16 Jun 2026 13:22:30 +0100
+Subject: arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
+To: stable@vger.kernel.org
+Cc: catalin.marinas@arm.com, gregkh@linuxfoundation.org, lee@kernel.org, mark.rutland@arm.com, sdonthineni@nvidia.com, will@kernel.org
+Message-ID: <20260616122231.237216-5-mark.rutland@arm.com>
+
+From: Shanker Donthineni <sdonthineni@nvidia.com>
+
+commit ec7216f92e4ebd485b1c6dc6aa3f6064b71a5768 upstream.
+
+NVIDIA Olympus cores are affected by the TLBI completion issue tracked as
+CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses
+ARM64_WORKAROUND_REPEAT_TLBI to issue an additional broadcast TLBI;DSB
+sequence and ensure affected memory write effects are globally observed.
+
+Add MIDR_NVIDIA_OLYMPUS to the repeat-TLBI match list so the same
+mitigation is enabled on affected Olympus systems. Also document the
+NVIDIA Olympus erratum in the arm64 silicon errata table and list it in
+the Kconfig help text.
+
+Signed-off-by: Shanker Donthineni <sdonthineni@nvidia.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+[Mark: backport to v7.0.y]
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/arch/arm64/silicon-errata.rst | 2 ++
+ arch/arm64/Kconfig | 3 ++-
+ arch/arm64/kernel/cpu_errata.c | 1 +
+ 3 files changed, 5 insertions(+), 1 deletion(-)
+
+--- a/Documentation/arch/arm64/silicon-errata.rst
++++ b/Documentation/arch/arm64/silicon-errata.rst
+@@ -289,6 +289,8 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | NVIDIA | Carmel Core | N/A | NVIDIA_CARMEL_CNP_ERRATUM |
+ +----------------+-----------------+-----------------+-----------------------------+
++| NVIDIA | Olympus core | T410-OLY-1029 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | NVIDIA | T241 GICv3/4.x | T241-FABRIC-4 | N/A |
+ +----------------+-----------------+-----------------+-----------------------------+
+ +----------------+-----------------+-----------------+-----------------------------+
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -1177,7 +1177,7 @@ config ARM64_ERRATUM_4311569
+ If unsure, say Y.
+
+ config ARM64_ERRATUM_4118414
+- bool "Cortex-*/Neoverse-*/C1-*: Completion of affected memory accesses might not be guaranteed by completion of a TLBI"
++ bool "Various: Completion of affected memory accesses might not be guaranteed by completion of a TLBI"
+ default y
+ select ARM64_WORKAROUND_REPEAT_TLBI
+ help
+@@ -1204,6 +1204,7 @@ config ARM64_ERRATUM_4118414
+ * ARM Neoverse-V2 erratum 4193787
+ * ARM Neoverse-V3 erratum 4193784
+ * ARM Neoverse-V3AE erratum 4193784
++ * NVIDIA Olympus erratum T410-OLY-1029
+
+ On affected cores, some memory accesses might not be completed by
+ broadcast TLB invalidation.
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -363,6 +363,7 @@ static const struct arm64_cpu_capabiliti
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE),
++ MIDR_ALL_VERSIONS(MIDR_NVIDIA_OLYMPUS),
+ {}
+ })),
+ },
--- /dev/null
+From stable+bounces-263705-greg=kroah.com@vger.kernel.org Tue Jun 16 17:52:54 2026
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 16 Jun 2026 13:22:29 +0100
+Subject: arm64: errata: Mitigate TLBI errata on various Arm CPUs
+To: stable@vger.kernel.org
+Cc: catalin.marinas@arm.com, gregkh@linuxfoundation.org, lee@kernel.org, mark.rutland@arm.com, sdonthineni@nvidia.com, will@kernel.org
+Message-ID: <20260616122231.237216-4-mark.rutland@arm.com>
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+commit cfd391e74134db664feb499d43af286380b10ba8 upstream.
+
+A number of CPUs developed by Arm suffer from errata whereby a broadcast
+TLBI;DSB sequence may complete before the global observation of writes
+which are translated by an affected TLB entry.
+
+These errata ONLY affect the completion of memory accesses which have
+been translated by an invalidated TLB entry, and these errata DO NOT
+affect the actual invalidation of TLB entries. TLB entries are removed
+correctly.
+
+This issue has been assigned CVE ID CVE-2025-10263.
+
+To mitigate this issue, Arm recommends that software follows any
+affected TLBI;DSB sequence with an additional TLBI;DSB, which will
+ensure that all memory write effects affected by the first TLBI have
+been globally observed. The additional TLBI can use any operation that
+is broadcast to affected CPUs, and the additional DSB can use any option
+that is sufficient to complete the additional TLBI.
+
+The ARM64_WORKAROUND_REPEAT_TLBI workaround is sufficient to mitigate
+the issue. Enable this workaround for affected CPUs, and update the
+silicon errata documentation accordingly.
+
+Note that due to the manner in which Arm develops IP and tracks errata,
+some CPUs share a common erratum number.
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+[Mark: backport to v7.0.y]
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/arch/arm64/silicon-errata.rst | 44 ++++++++++++++++++++++++++++
+ arch/arm64/Kconfig | 36 ++++++++++++++++++++++
+ arch/arm64/kernel/cpu_errata.c | 32 +++++++++++++++++++-
+ 3 files changed, 110 insertions(+), 2 deletions(-)
+
+--- a/Documentation/arch/arm64/silicon-errata.rst
++++ b/Documentation/arch/arm64/silicon-errata.rst
+@@ -128,16 +128,28 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A76 | #3324349 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-A76 | #4193800 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-A76AE | #4193801 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A77 | #1491015 | N/A |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A77 | #1508412 | ARM64_ERRATUM_1508412 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A77 | #3324348 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-A77 | #4193798 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A78 | #3324344 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-A78 | #4193791 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-A78AE | #4193793 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A78C | #3324346,3324347| ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-A78C | #4193794 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A710 | #2119858 | ARM64_ERRATUM_2119858 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A710 | #2054223 | ARM64_ERRATUM_2054223 |
+@@ -146,6 +158,8 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A710 | #3324338 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-A710 | #4193788 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A715 | #2645198 | ARM64_ERRATUM_2645198 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-A715 | #3456084 | ARM64_ERRATUM_3194386 |
+@@ -158,20 +172,32 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X1 | #3324344 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-X1 | #4193791 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X1C | #3324346 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-X1C | #4193792 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X2 | #2119858 | ARM64_ERRATUM_2119858 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X2 | #2224489 | ARM64_ERRATUM_2224489 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X2 | #3324338 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-X2 | #4193788 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X3 | #3324335 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-X3 | #4193786 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X4 | #3194386 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-X4 | #4118414 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Cortex-X925 | #3324334 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Cortex-X925 | #4193781 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-N1 | #1188873,1418040| ARM64_ERRATUM_1418040 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-N1 | #1349291 | N/A |
+@@ -182,6 +208,8 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-N1 | #3324349 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Neoverse-N1 | #4193800 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-N2 | #2139208 | ARM64_ERRATUM_2139208 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-N2 | #2067961 | ARM64_ERRATUM_2067961 |
+@@ -190,18 +218,34 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-N2 | #3324339 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Neoverse-N2 | #4193789 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-N3 | #3456111 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-V1 | #1619801 | N/A |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-V1 | #3324341 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Neoverse-V1 | #4193790 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-V2 | #3324336 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Neoverse-V2 | #4193787 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-V3 | #3312417 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Neoverse-V3 | #4193784 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | Neoverse-V3AE | #3312417 | ARM64_ERRATUM_3194386 |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM | Neoverse-V3AE | #4193784 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
++| ARM | C1-Premium | #4193780 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
++| ARM | C1-Pro | #4193714 | ARM64_ERRATUM_4193714 |
+++----------------+-----------------+-----------------+-----------------------------+
++| ARM | C1-Ultra | #4193780 | ARM64_ERRATUM_4118414 |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM | MMU-500 | #841119,826419 | ARM_SMMU_MMU_500_CPRE_ERRATA|
+ | | | #562869,1047329 | |
+ +----------------+-----------------+-----------------+-----------------------------+
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -1176,6 +1176,42 @@ config ARM64_ERRATUM_4311569
+
+ If unsure, say Y.
+
++config ARM64_ERRATUM_4118414
++ bool "Cortex-*/Neoverse-*/C1-*: Completion of affected memory accesses might not be guaranteed by completion of a TLBI"
++ default y
++ select ARM64_WORKAROUND_REPEAT_TLBI
++ help
++ This option adds a workaround for the following errata:
++
++ * ARM C1-Premium erratum 4193780
++ * ARM C1-Ultra erratum 4193780
++ * ARM Cortex-A76 erratum 4193800
++ * ARM Cortex-A76AE erratum 4193801
++ * ARM Cortex-A77 erratum 4193798
++ * ARM Cortex-A78 erratum 4193791
++ * ARM Cortex-A78AE erratum 4193793
++ * ARM Cortex-A78C erratum 4193794
++ * ARM Cortex-A710 erratum 4193788
++ * ARM Cortex-X1 erratum 4193791
++ * ARM Cortex-X1C erratum 4193792
++ * ARM Cortex-X2 erratum 4193788
++ * ARM Cortex-X3 erratum 4193786
++ * ARM Cortex-X4 erratum 4118414
++ * ARM Cortex-X925 erratum 4193781
++ * ARM Neoverse-N1 erratum 4193800
++ * ARM Neoverse-N2 erratum 4193789
++ * ARM Neoverse-V1 erratum 4193790
++ * ARM Neoverse-V2 erratum 4193787
++ * ARM Neoverse-V3 erratum 4193784
++ * ARM Neoverse-V3AE erratum 4193784
++
++ On affected cores, some memory accesses might not be completed by
++ broadcast TLB invalidation.
++
++ This issue is also known as CVE-2025-10263.
++
++ If unsure, say Y.
++
+ config CAVIUM_ERRATUM_22375
+ bool "Cavium erratum 22375, 24313"
+ default y
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -339,7 +339,35 @@ static const struct arm64_cpu_capabiliti
+ ERRATA_MIDR_RANGE(MIDR_CORTEX_A510, 0, 0, 1, 1),
+ },
+ #endif
+- {},
++#ifdef CONFIG_ARM64_ERRATUM_4118414
++ {
++ ERRATA_MIDR_RANGE_LIST(((const struct midr_range[]) {
++ MIDR_ALL_VERSIONS(MIDR_C1_PREMIUM),
++ MIDR_ALL_VERSIONS(MIDR_C1_ULTRA),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A76),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A76AE),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A77),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78AE),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A710),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X1),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X1C),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X2),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X3),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X4),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X925),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE),
++ {}
++ })),
++ },
++#endif
++ {}
+ };
+ #endif
+
+@@ -675,7 +703,7 @@ const struct arm64_cpu_capabilities arm6
+ #endif
+ #ifdef CONFIG_ARM64_WORKAROUND_REPEAT_TLBI
+ {
+- .desc = "Qualcomm erratum 1009, or ARM erratum 1286807, 2441009",
++ .desc = "Broken broadcast TLBI completion",
+ .capability = ARM64_WORKAROUND_REPEAT_TLBI,
+ .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
+ .matches = cpucap_multi_entry_cap_matches,
projects / thirdparty / kernel / stable-queue.git / commitdiff
