From: Greg Kroah-Hartman Date: Tue, 16 Jun 2026 10:14:06 +0000 (+0530) Subject: 6.18-stable patches X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=053445e2ba497902c74e7f1dc60d7c274c62a8f6;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: arm64-cputype-add-c1-premium-definitions.patch arm64-cputype-add-c1-ultra-definitions.patch arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt-100-cpu.patch arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch block-fix-handling-of-dead-zone-write-plugs.patch --- diff --git a/queue-6.18/arm64-cputype-add-c1-premium-definitions.patch b/queue-6.18/arm64-cputype-add-c1-premium-definitions.patch new file mode 100644 index 0000000000..aec73e2e88 --- /dev/null +++ b/queue-6.18/arm64-cputype-add-c1-premium-definitions.patch @@ -0,0 +1,50 @@ +From stable+bounces-263550-greg=kroah.com@vger.kernel.org Tue Jun 16 10:43:47 2026 +From: Mark Rutland +Date: Tue, 16 Jun 2026 06:13:26 +0100 +Subject: arm64: cputype: Add C1-Premium definitions +To: stable@vger.kernel.org +Cc: catalin.marinas@arm.com, lee@kernel.org, mark.rutland@arm.com, sdonthineni@nvidia.com, will@kernel.org +Message-ID: <20260616051329.111597-3-mark.rutland@arm.com> + +From: Mark Rutland + +commit d28413bfc5a255957241f1df5d7fd0c2cd74fe18 upstream. + +Add cputype definitions for C1-Premium. These will be used for errata +detection in subsequent patches. + +These values can be found in the C1-Premium TRM: + + https://developer.arm.com/documentation/109416/0100/ + +... in section A.5.1 ("MIDR_EL1, Main ID Register"). + +Signed-off-by: Mark Rutland +Cc: Catalin Marinas +Cc: Will Deacon +Signed-off-by: Will Deacon +[Mark: backport to v6.18.y] +Signed-off-by: Mark Rutland +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/include/asm/cputype.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -100,6 +100,7 @@ + #define ARM_CPU_PART_C1_ULTRA 0xD8C + #define ARM_CPU_PART_NEOVERSE_N3 0xD8E + #define ARM_CPU_PART_C1_PRO 0xD8B ++#define ARM_CPU_PART_C1_PREMIUM 0xD90 + + #define APM_CPU_PART_XGENE 0x000 + #define APM_CPU_VAR_POTENZA 0x00 +@@ -193,6 +194,7 @@ + #define MIDR_C1_ULTRA MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_ULTRA) + #define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3) + #define MIDR_C1_PRO MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PRO) ++#define MIDR_C1_PREMIUM MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PREMIUM) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) diff --git a/queue-6.18/arm64-cputype-add-c1-ultra-definitions.patch b/queue-6.18/arm64-cputype-add-c1-ultra-definitions.patch new file mode 100644 index 0000000000..65779f0d4b --- /dev/null +++ b/queue-6.18/arm64-cputype-add-c1-ultra-definitions.patch @@ -0,0 +1,50 @@ +From stable+bounces-263549-greg=kroah.com@vger.kernel.org Tue Jun 16 10:43:47 2026 +From: Mark Rutland +Date: Tue, 16 Jun 2026 06:13:25 +0100 +Subject: arm64: cputype: Add C1-Ultra definitions +To: stable@vger.kernel.org +Cc: catalin.marinas@arm.com, lee@kernel.org, mark.rutland@arm.com, sdonthineni@nvidia.com, will@kernel.org +Message-ID: <20260616051329.111597-2-mark.rutland@arm.com> + +From: Mark Rutland + +commit 60349e64a6c65f9f0aa118af711b3c7e137f07ff upstream. + +Add cputype definitions for C1-Ultra. These will be used for errata +detection in subsequent patches. + +These values can be found in the C1-Ultra TRM: + + https://developer.arm.com/documentation/108014/0100/ + +... in section A.5.1 ("MIDR_EL1, Main ID Register"). + +Signed-off-by: Mark Rutland +Cc: Catalin Marinas +Cc: Will Deacon +Signed-off-by: Will Deacon +[Mark: backport to v6.18.y] +Signed-off-by: Mark Rutland +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/include/asm/cputype.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -97,6 +97,7 @@ + #define ARM_CPU_PART_CORTEX_X925 0xD85 + #define ARM_CPU_PART_CORTEX_A725 0xD87 + #define ARM_CPU_PART_CORTEX_A720AE 0xD89 ++#define ARM_CPU_PART_C1_ULTRA 0xD8C + #define ARM_CPU_PART_NEOVERSE_N3 0xD8E + #define ARM_CPU_PART_C1_PRO 0xD8B + +@@ -189,6 +190,7 @@ + #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) + #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) + #define MIDR_CORTEX_A720AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720AE) ++#define MIDR_C1_ULTRA MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_ULTRA) + #define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3) + #define MIDR_C1_PRO MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PRO) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) diff --git a/queue-6.18/arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt-100-cpu.patch b/queue-6.18/arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt-100-cpu.patch new file mode 100644 index 0000000000..9ae28c3d26 --- /dev/null +++ b/queue-6.18/arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt-100-cpu.patch @@ -0,0 +1,58 @@ +From stable+bounces-263553-greg=kroah.com@vger.kernel.org Tue Jun 16 10:45:06 2026 +From: Mark Rutland +Date: Tue, 16 Jun 2026 06:13:29 +0100 +Subject: arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU +To: stable@vger.kernel.org +Cc: catalin.marinas@arm.com, lee@kernel.org, mark.rutland@arm.com, sdonthineni@nvidia.com, will@kernel.org +Message-ID: <20260616051329.111597-6-mark.rutland@arm.com> + +From: Will Deacon + +commit 1940e70a8144bf75e6df26bf6f600862ea7f7ea1 upstream. + +Commit fb091ff39479 ("arm64: Subscribe Microsoft Azure Cobalt 100 to ARM +Neoverse N2 errata") states that Microsoft Azure Cobalt 100 CPU "is a +Microsoft implemented CPU based on r0p0 of the ARM Neoverse N2 CPU, and +therefore suffers from all the same errata.". + +So enable the workaround for the latest broadcast TLB invalidation bug +on these parts. + +Signed-off-by: Will Deacon +[Mark: backport to v6.18.y] +Signed-off-by: Mark Rutland +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/arch/arm64/silicon-errata.rst | 2 ++ + arch/arm64/Kconfig | 1 + + arch/arm64/kernel/cpu_errata.c | 1 + + 3 files changed, 4 insertions(+) + +--- a/Documentation/arch/arm64/silicon-errata.rst ++++ b/Documentation/arch/arm64/silicon-errata.rst +@@ -351,3 +351,5 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | Microsoft | Azure Cobalt 100| #3324339 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| Microsoft | Azure Cobalt 100| #4193789 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -1194,6 +1194,7 @@ config ARM64_ERRATUM_4118414 + * ARM Neoverse-V2 erratum 4193787 + * ARM Neoverse-V3 erratum 4193784 + * ARM Neoverse-V3AE erratum 4193784 ++ * Microsoft Azure Cobalt 100 4193789 + * NVIDIA Olympus erratum T410-OLY-1029 + + On affected cores, some memory accesses might not be completed by +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -341,6 +341,7 @@ static const struct arm64_cpu_capabiliti + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE), + MIDR_ALL_VERSIONS(MIDR_NVIDIA_OLYMPUS), ++ MIDR_ALL_VERSIONS(MIDR_MICROSOFT_AZURE_COBALT_100), + {} + })), + }, diff --git a/queue-6.18/arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch b/queue-6.18/arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch new file mode 100644 index 0000000000..c7e8dca3fd --- /dev/null +++ b/queue-6.18/arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch @@ -0,0 +1,77 @@ +From stable+bounces-263552-greg=kroah.com@vger.kernel.org Tue Jun 16 10:45:04 2026 +From: Mark Rutland +Date: Tue, 16 Jun 2026 06:13:28 +0100 +Subject: arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU +To: stable@vger.kernel.org +Cc: catalin.marinas@arm.com, lee@kernel.org, mark.rutland@arm.com, sdonthineni@nvidia.com, will@kernel.org +Message-ID: <20260616051329.111597-5-mark.rutland@arm.com> + +From: Shanker Donthineni + +commit ec7216f92e4ebd485b1c6dc6aa3f6064b71a5768 upstream. + +NVIDIA Olympus cores are affected by the TLBI completion issue tracked as +CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses +ARM64_WORKAROUND_REPEAT_TLBI to issue an additional broadcast TLBI;DSB +sequence and ensure affected memory write effects are globally observed. + +Add MIDR_NVIDIA_OLYMPUS to the repeat-TLBI match list so the same +mitigation is enabled on affected Olympus systems. Also document the +NVIDIA Olympus erratum in the arm64 silicon errata table and list it in +the Kconfig help text. + +Signed-off-by: Shanker Donthineni +Cc: Catalin Marinas +Cc: Will Deacon +Cc: Mark Rutland +Acked-by: Mark Rutland +Signed-off-by: Will Deacon +[Mark: backport to v6.18.y] +Signed-off-by: Shanker Donthineni +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/arch/arm64/silicon-errata.rst | 2 ++ + arch/arm64/Kconfig | 3 ++- + arch/arm64/kernel/cpu_errata.c | 1 + + 3 files changed, 5 insertions(+), 1 deletion(-) + +--- a/Documentation/arch/arm64/silicon-errata.rst ++++ b/Documentation/arch/arm64/silicon-errata.rst +@@ -288,6 +288,8 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | NVIDIA | Carmel Core | N/A | NVIDIA_CARMEL_CNP_ERRATUM | + +----------------+-----------------+-----------------+-----------------------------+ ++| NVIDIA | Olympus core | T410-OLY-1029 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | NVIDIA | T241 GICv3/4.x | T241-FABRIC-4 | N/A | + +----------------+-----------------+-----------------+-----------------------------+ + +----------------+-----------------+-----------------+-----------------------------+ +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -1167,7 +1167,7 @@ config ARM64_ERRATUM_4193714 + If unsure, say Y. + + config ARM64_ERRATUM_4118414 +- bool "Cortex-*/Neoverse-*/C1-*: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" ++ bool "Various: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" + default y + select ARM64_WORKAROUND_REPEAT_TLBI + help +@@ -1194,6 +1194,7 @@ config ARM64_ERRATUM_4118414 + * ARM Neoverse-V2 erratum 4193787 + * ARM Neoverse-V3 erratum 4193784 + * ARM Neoverse-V3AE erratum 4193784 ++ * NVIDIA Olympus erratum T410-OLY-1029 + + On affected cores, some memory accesses might not be completed by + broadcast TLB invalidation. +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -340,6 +340,7 @@ static const struct arm64_cpu_capabiliti + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE), ++ MIDR_ALL_VERSIONS(MIDR_NVIDIA_OLYMPUS), + {} + })), + }, diff --git a/queue-6.18/arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch b/queue-6.18/arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch new file mode 100644 index 0000000000..eadc592fcf --- /dev/null +++ b/queue-6.18/arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch @@ -0,0 +1,260 @@ +From stable+bounces-263551-greg=kroah.com@vger.kernel.org Tue Jun 16 10:43:51 2026 +From: Mark Rutland +Date: Tue, 16 Jun 2026 06:13:27 +0100 +Subject: arm64: errata: Mitigate TLBI errata on various Arm CPUs +To: stable@vger.kernel.org +Cc: catalin.marinas@arm.com, lee@kernel.org, mark.rutland@arm.com, sdonthineni@nvidia.com, will@kernel.org +Message-ID: <20260616051329.111597-4-mark.rutland@arm.com> + +From: Mark Rutland + +commit cfd391e74134db664feb499d43af286380b10ba8 upstream. + +A number of CPUs developed by Arm suffer from errata whereby a broadcast +TLBI;DSB sequence may complete before the global observation of writes +which are translated by an affected TLB entry. + +These errata ONLY affect the completion of memory accesses which have +been translated by an invalidated TLB entry, and these errata DO NOT +affect the actual invalidation of TLB entries. TLB entries are removed +correctly. + +This issue has been assigned CVE ID CVE-2025-10263. + +To mitigate this issue, Arm recommends that software follows any +affected TLBI;DSB sequence with an additional TLBI;DSB, which will +ensure that all memory write effects affected by the first TLBI have +been globally observed. The additional TLBI can use any operation that +is broadcast to affected CPUs, and the additional DSB can use any option +that is sufficient to complete the additional TLBI. + +The ARM64_WORKAROUND_REPEAT_TLBI workaround is sufficient to mitigate +the issue. Enable this workaround for affected CPUs, and update the +silicon errata documentation accordingly. + +Note that due to the manner in which Arm develops IP and tracks errata, +some CPUs share a common erratum number. + +Signed-off-by: Mark Rutland +Cc: Catalin Marinas +Cc: Will Deacon +Signed-off-by: Will Deacon +[Mark: backport to v6.18.y] +Signed-off-by: Mark Rutland +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/arch/arm64/silicon-errata.rst | 42 ++++++++++++++++++++++++++++ + arch/arm64/Kconfig | 36 ++++++++++++++++++++++++ + arch/arm64/kernel/cpu_errata.c | 32 ++++++++++++++++++++- + 3 files changed, 108 insertions(+), 2 deletions(-) + +--- a/Documentation/arch/arm64/silicon-errata.rst ++++ b/Documentation/arch/arm64/silicon-errata.rst +@@ -128,16 +128,28 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A76 | #3324349 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-A76 | #4193800 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-A76AE | #4193801 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A77 | #1491015 | N/A | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A77 | #1508412 | ARM64_ERRATUM_1508412 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A77 | #3324348 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-A77 | #4193798 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A78 | #3324344 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-A78 | #4193791 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-A78AE | #4193793 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A78C | #3324346,3324347| ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-A78C | #4193794 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A710 | #2119858 | ARM64_ERRATUM_2119858 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A710 | #2054223 | ARM64_ERRATUM_2054223 | +@@ -146,6 +158,8 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A710 | #3324338 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-A710 | #4193788 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A715 | #2645198 | ARM64_ERRATUM_2645198 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A715 | #3456084 | ARM64_ERRATUM_3194386 | +@@ -158,20 +172,32 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-X1 | #3324344 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-X1 | #4193791 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-X1C | #3324346 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-X1C | #4193792 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-X2 | #2119858 | ARM64_ERRATUM_2119858 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-X2 | #2224489 | ARM64_ERRATUM_2224489 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-X2 | #3324338 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-X2 | #4193788 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-X3 | #3324335 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-X3 | #4193786 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-X4 | #3194386 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-X4 | #4118414 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-X925 | #3324334 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-X925 | #4193781 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-N1 | #1188873,1418040| ARM64_ERRATUM_1418040 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-N1 | #1349291 | N/A | +@@ -182,6 +208,8 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-N1 | #3324349 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Neoverse-N1 | #4193800 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-N2 | #2139208 | ARM64_ERRATUM_2139208 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-N2 | #2067961 | ARM64_ERRATUM_2067961 | +@@ -190,20 +218,34 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-N2 | #3324339 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Neoverse-N2 | #4193789 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-N3 | #3456111 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-V1 | #1619801 | N/A | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-V1 | #3324341 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Neoverse-V1 | #4193790 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-V2 | #3324336 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Neoverse-V2 | #4193787 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-V3 | #3312417 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Neoverse-V3 | #4193784 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-V3AE | #3312417 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Neoverse-V3AE | #4193784 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ ++| ARM | C1-Premium | #4193780 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | C1-Pro | #4193714 | ARM64_ERRATUM_4193714 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | C1-Ultra | #4193780 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | MMU-500 | #841119,826419 | ARM_SMMU_MMU_500_CPRE_ERRATA| + | | | #562869,1047329 | | + +----------------+-----------------+-----------------+-----------------------------+ +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -1166,6 +1166,42 @@ config ARM64_ERRATUM_4193714 + + If unsure, say Y. + ++config ARM64_ERRATUM_4118414 ++ bool "Cortex-*/Neoverse-*/C1-*: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" ++ default y ++ select ARM64_WORKAROUND_REPEAT_TLBI ++ help ++ This option adds a workaround for the following errata: ++ ++ * ARM C1-Premium erratum 4193780 ++ * ARM C1-Ultra erratum 4193780 ++ * ARM Cortex-A76 erratum 4193800 ++ * ARM Cortex-A76AE erratum 4193801 ++ * ARM Cortex-A77 erratum 4193798 ++ * ARM Cortex-A78 erratum 4193791 ++ * ARM Cortex-A78AE erratum 4193793 ++ * ARM Cortex-A78C erratum 4193794 ++ * ARM Cortex-A710 erratum 4193788 ++ * ARM Cortex-X1 erratum 4193791 ++ * ARM Cortex-X1C erratum 4193792 ++ * ARM Cortex-X2 erratum 4193788 ++ * ARM Cortex-X3 erratum 4193786 ++ * ARM Cortex-X4 erratum 4118414 ++ * ARM Cortex-X925 erratum 4193781 ++ * ARM Neoverse-N1 erratum 4193800 ++ * ARM Neoverse-N2 erratum 4193789 ++ * ARM Neoverse-V1 erratum 4193790 ++ * ARM Neoverse-V2 erratum 4193787 ++ * ARM Neoverse-V3 erratum 4193784 ++ * ARM Neoverse-V3AE erratum 4193784 ++ ++ On affected cores, some memory accesses might not be completed by ++ broadcast TLB invalidation. ++ ++ This issue is also known as CVE-2025-10263. ++ ++ If unsure, say Y. ++ + config CAVIUM_ERRATUM_22375 + bool "Cavium erratum 22375, 24313" + default y +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -316,7 +316,35 @@ static const struct arm64_cpu_capabiliti + ERRATA_MIDR_RANGE(MIDR_CORTEX_A510, 0, 0, 1, 1), + }, + #endif +- {}, ++#ifdef CONFIG_ARM64_ERRATUM_4118414 ++ { ++ ERRATA_MIDR_RANGE_LIST(((const struct midr_range[]) { ++ MIDR_ALL_VERSIONS(MIDR_C1_PREMIUM), ++ MIDR_ALL_VERSIONS(MIDR_C1_ULTRA), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A76), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A76AE), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A77), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78AE), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X1), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X1C), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X2), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X3), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X4), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X925), ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2), ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3), ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE), ++ {} ++ })), ++ }, ++#endif ++ {} + }; + #endif + +@@ -669,7 +697,7 @@ const struct arm64_cpu_capabilities arm6 + #endif + #ifdef CONFIG_ARM64_WORKAROUND_REPEAT_TLBI + { +- .desc = "Qualcomm erratum 1009, or ARM erratum 1286807, 2441009", ++ .desc = "Broken broadcast TLBI completion", + .capability = ARM64_WORKAROUND_REPEAT_TLBI, + .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM, + .matches = cpucap_multi_entry_cap_matches, diff --git a/queue-6.18/block-fix-handling-of-dead-zone-write-plugs.patch b/queue-6.18/block-fix-handling-of-dead-zone-write-plugs.patch new file mode 100644 index 0000000000..1d728473b1 --- /dev/null +++ b/queue-6.18/block-fix-handling-of-dead-zone-write-plugs.patch @@ -0,0 +1,102 @@ +From 836efd35c472d89c838d7b17ef339ddb3286ffc5 Mon Sep 17 00:00:00 2001 +From: Damien Le Moal +Date: Wed, 13 May 2026 20:11:29 +0900 +Subject: block: fix handling of dead zone write plugs + +From: Damien Le Moal + +commit 836efd35c472d89c838d7b17ef339ddb3286ffc5 upstream. + +Shin'ichiro reported hard to reproduce unaligned write errors with zoned +block devices. Under normal operation conditions (e.g. running XFS on an +SMR disk), these errors are nearly impossible to trigger. But using a +"slow" kernel with many debug options enables and some specific use +cases (e.g. fio zbd test case 46), the errors can be reproduced fairly +easily. + +The unaligned write errors come from mishandling a valid reference +counting pattern of zone write plugs. Such pattern triggers for instance +if a process A writes a zone (not necessarilly to the full state), +another process B immediately resets the zone and immediately following +the completion of the zone reset, starts issuing writes to the zone. +With such pattern, in some cases, the zone write plugs worker thread of +the device may still be holding a reference to the zone write plug of +the zone taken when process A was writing to the zone. The following +zone reset from process B marks the zone as dead but does not remove the +zone write plug from the device hash table as a reference to the plug +still exist. Once process B starts issuing new writes, the zone write +plug is seen as dead and the writes from process B are immediately +failed, despite this write pattern being perfectly legal. + +Fix this by allowing restoring a dead zone write plug to a live state if +a write is issued to the zone when the zone is: marked as dead, empty +and the write sector corresponds to the first sector of the zone (that +is, the write is aligned to the zone write pointer). This is done with +the new helper function disk_check_zone_wplug_dead(), which restores a +dead zone write plug to a live state by clearing the BLK_ZONE_WPLUG_DEAD +flag and restoring the initial reference to the zone write plug taken +when the plug was added to the device hash table. + +Reported-by: Shin'ichiro Kawasaki +Fixes: b7d4ffb51037 ("block: fix zone write plug removal") +Signed-off-by: Damien Le Moal +Tested-by: Shin'ichiro Kawasaki +Link: https://patch.msgid.link/20260513111129.108809-1-dlemoal@kernel.org +Signed-off-by: Jens Axboe +[ context conflict due to different line offsets in blk-zoned.c ] +Signed-off-by: Gyokhan Kochmarla +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-zoned.c | 32 +++++++++++++++++++++++++++----- + 1 file changed, 27 insertions(+), 5 deletions(-) + +--- a/block/blk-zoned.c ++++ b/block/blk-zoned.c +@@ -505,6 +505,28 @@ static void disk_mark_zone_wplug_dead(st + } + } + ++static inline bool disk_check_zone_wplug_dead(struct blk_zone_wplug *zwplug) ++{ ++ if (!(zwplug->flags & BLK_ZONE_WPLUG_DEAD)) ++ return false; ++ ++ /* ++ * If a new write is received right after a zone reset completes and ++ * while the disk_zone_wplugs_worker() thread has not yet released the ++ * reference on the zone write plug after processing the last write to ++ * the zone, then the new write BIO will see the zone write plug marked ++ * as dead. This case is however a false positive and a perfectly valid ++ * pattern. In such case, restore the zone write plug to a live one. ++ */ ++ if (!zwplug->wp_offset && bio_list_empty(&zwplug->bio_list)) { ++ zwplug->flags &= ~BLK_ZONE_WPLUG_DEAD; ++ refcount_inc(&zwplug->ref); ++ return false; ++ } ++ ++ return true; ++} ++ + static void blk_zone_wplug_bio_work(struct work_struct *work); + + /* +@@ -1027,12 +1049,12 @@ static bool blk_zone_wplug_handle_write( + } + + /* +- * If we got a zone write plug marked as dead, then the user is issuing +- * writes to a full zone, or without synchronizing with zone reset or +- * zone finish operations. In such case, fail the BIO to signal this +- * invalid usage. ++ * Check if we got a zone write plug marked as dead. If yes, then the ++ * user is likely issuing writes to a full zone, or without ++ * synchronizing with zone reset or zone finish operations. In such ++ * case, fail the BIO to signal this invalid usage. + */ +- if (zwplug->flags & BLK_ZONE_WPLUG_DEAD) { ++ if (disk_check_zone_wplug_dead(zwplug)) { + spin_unlock_irqrestore(&zwplug->lock, flags); + disk_put_zone_wplug(zwplug); + bio_io_error(bio); diff --git a/queue-6.18/series b/queue-6.18/series index b0801a3c56..166b69dbe2 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -317,3 +317,9 @@ rdma-umem-fix-truncation-for-block-sizes-4g.patch ipvs-skip-ipv6-extension-headers-for-csum-checks.patch vsock-virtio-fix-potential-unbounded-skb-queue.patch vsock-virtio-fix-skb-overhead-accounting-to-preserve-full-buf_alloc.patch +arm64-cputype-add-c1-ultra-definitions.patch +arm64-cputype-add-c1-premium-definitions.patch +arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch +arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch +arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt-100-cpu.patch +block-fix-handling-of-dead-zone-write-plugs.patch