From: Greg Kroah-Hartman Date: Tue, 16 Jun 2026 13:17:39 +0000 (+0530) Subject: 6.6-stable patches X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9f45b422959d69fc21f80a3b8e88c0280a7048b4;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: arm64-cputype-add-c1-premium-definitions.patch arm64-cputype-add-c1-ultra-definitions.patch arm64-cputype-add-nvidia-olympus-definitions.patch arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt-100-cpu.patch arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch mptcp-add-addr-always-drop-other-suboptions.patch mptcp-fix-missing-wakeups-in-edge-scenarios.patch --- diff --git a/queue-6.6/arm64-cputype-add-c1-premium-definitions.patch b/queue-6.6/arm64-cputype-add-c1-premium-definitions.patch new file mode 100644 index 0000000000..74fd817dda --- /dev/null +++ b/queue-6.6/arm64-cputype-add-c1-premium-definitions.patch @@ -0,0 +1,50 @@ +From stable+bounces-263571-greg=kroah.com@vger.kernel.org Tue Jun 16 10:49:11 2026 +From: Mark Rutland +Date: Tue, 16 Jun 2026 06:18:19 +0100 +Subject: arm64: cputype: Add C1-Premium definitions +To: stable@vger.kernel.org +Cc: anshuman.khandual@arm.com, catalin.marinas@arm.com, gregkh@linuxfoundation.org, lee@kernel.org, mark.rutland@arm.com, maz@kernel.org, oupton@kernel.org, ryan.roberts@arm.com, sdonthineni@nvidia.com, will@kernel.org, yuzenghui@huawei.com +Message-ID: <20260616051822.111870-7-mark.rutland@arm.com> + +From: Mark Rutland + +commit d28413bfc5a255957241f1df5d7fd0c2cd74fe18 upstream. + +Add cputype definitions for C1-Premium. These will be used for errata +detection in subsequent patches. + +These values can be found in the C1-Premium TRM: + + https://developer.arm.com/documentation/109416/0100/ + +... in section A.5.1 ("MIDR_EL1, Main ID Register"). + +Signed-off-by: Mark Rutland +Cc: Catalin Marinas +Cc: Will Deacon +Signed-off-by: Will Deacon +[Mark: backport to v6.6.y] +Signed-off-by: Mark Rutland +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/include/asm/cputype.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -99,6 +99,7 @@ + #define ARM_CPU_PART_CORTEX_A725 0xD87 + #define ARM_CPU_PART_C1_ULTRA 0xD8C + #define ARM_CPU_PART_NEOVERSE_N3 0xD8E ++#define ARM_CPU_PART_C1_PREMIUM 0xD90 + + #define APM_CPU_PART_XGENE 0x000 + #define APM_CPU_VAR_POTENZA 0x00 +@@ -189,6 +190,7 @@ + #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) + #define MIDR_C1_ULTRA MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_ULTRA) + #define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3) ++#define MIDR_C1_PREMIUM MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PREMIUM) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) diff --git a/queue-6.6/arm64-cputype-add-c1-ultra-definitions.patch b/queue-6.6/arm64-cputype-add-c1-ultra-definitions.patch new file mode 100644 index 0000000000..9661a0c324 --- /dev/null +++ b/queue-6.6/arm64-cputype-add-c1-ultra-definitions.patch @@ -0,0 +1,50 @@ +From stable+bounces-263570-greg=kroah.com@vger.kernel.org Tue Jun 16 10:49:06 2026 +From: Mark Rutland +Date: Tue, 16 Jun 2026 06:18:18 +0100 +Subject: arm64: cputype: Add C1-Ultra definitions +To: stable@vger.kernel.org +Cc: anshuman.khandual@arm.com, catalin.marinas@arm.com, gregkh@linuxfoundation.org, lee@kernel.org, mark.rutland@arm.com, maz@kernel.org, oupton@kernel.org, ryan.roberts@arm.com, sdonthineni@nvidia.com, will@kernel.org, yuzenghui@huawei.com +Message-ID: <20260616051822.111870-6-mark.rutland@arm.com> + +From: Mark Rutland + +commit 60349e64a6c65f9f0aa118af711b3c7e137f07ff upstream. + +Add cputype definitions for C1-Ultra. These will be used for errata +detection in subsequent patches. + +These values can be found in the C1-Ultra TRM: + + https://developer.arm.com/documentation/108014/0100/ + +... in section A.5.1 ("MIDR_EL1, Main ID Register"). + +Signed-off-by: Mark Rutland +Cc: Catalin Marinas +Cc: Will Deacon +Signed-off-by: Will Deacon +[Mark: backport to v6.6.y] +Signed-off-by: Mark Rutland +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/include/asm/cputype.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -97,6 +97,7 @@ + #define ARM_CPU_PART_NEOVERSE_V3 0xD84 + #define ARM_CPU_PART_CORTEX_X925 0xD85 + #define ARM_CPU_PART_CORTEX_A725 0xD87 ++#define ARM_CPU_PART_C1_ULTRA 0xD8C + #define ARM_CPU_PART_NEOVERSE_N3 0xD8E + + #define APM_CPU_PART_XGENE 0x000 +@@ -186,6 +187,7 @@ + #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) + #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) + #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) ++#define MIDR_C1_ULTRA MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_ULTRA) + #define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) diff --git a/queue-6.6/arm64-cputype-add-nvidia-olympus-definitions.patch b/queue-6.6/arm64-cputype-add-nvidia-olympus-definitions.patch new file mode 100644 index 0000000000..5bdbe6e9bf --- /dev/null +++ b/queue-6.6/arm64-cputype-add-nvidia-olympus-definitions.patch @@ -0,0 +1,41 @@ +From stable+bounces-263569-greg=kroah.com@vger.kernel.org Tue Jun 16 10:48:47 2026 +From: Mark Rutland +Date: Tue, 16 Jun 2026 06:18:17 +0100 +Subject: arm64: cputype: Add NVIDIA Olympus definitions +To: stable@vger.kernel.org +Cc: anshuman.khandual@arm.com, catalin.marinas@arm.com, gregkh@linuxfoundation.org, lee@kernel.org, mark.rutland@arm.com, maz@kernel.org, oupton@kernel.org, ryan.roberts@arm.com, sdonthineni@nvidia.com, will@kernel.org, yuzenghui@huawei.com +Message-ID: <20260616051822.111870-5-mark.rutland@arm.com> + +From: Shanker Donthineni + +commit e185c8a0d84236d14af61faff8147c953a878a77 upstream. + +Add cpu part and model macro definitions for NVIDIA Olympus core. + +Signed-off-by: Shanker Donthineni +Signed-off-by: Will Deacon +[Mark: backport to v6.6.y] +Signed-off-by: Mark Rutland +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/include/asm/cputype.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -129,6 +129,7 @@ + + #define NVIDIA_CPU_PART_DENVER 0x003 + #define NVIDIA_CPU_PART_CARMEL 0x004 ++#define NVIDIA_CPU_PART_OLYMPUS 0x010 + + #define FUJITSU_CPU_PART_A64FX 0x001 + +@@ -209,6 +210,7 @@ + #define MIDR_QCOM_KRYO_4XX_SILVER MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO_4XX_SILVER) + #define MIDR_NVIDIA_DENVER MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_DENVER) + #define MIDR_NVIDIA_CARMEL MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_CARMEL) ++#define MIDR_NVIDIA_OLYMPUS MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_OLYMPUS) + #define MIDR_FUJITSU_A64FX MIDR_CPU_MODEL(ARM_CPU_IMP_FUJITSU, FUJITSU_CPU_PART_A64FX) + #define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110) + #define MIDR_HISI_HIP09 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_HIP09) diff --git a/queue-6.6/arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt-100-cpu.patch b/queue-6.6/arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt-100-cpu.patch new file mode 100644 index 0000000000..bf1917e19a --- /dev/null +++ b/queue-6.6/arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt-100-cpu.patch @@ -0,0 +1,58 @@ +From stable+bounces-263574-greg=kroah.com@vger.kernel.org Tue Jun 16 10:49:09 2026 +From: Mark Rutland +Date: Tue, 16 Jun 2026 06:18:22 +0100 +Subject: arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU +To: stable@vger.kernel.org +Cc: anshuman.khandual@arm.com, catalin.marinas@arm.com, gregkh@linuxfoundation.org, lee@kernel.org, mark.rutland@arm.com, maz@kernel.org, oupton@kernel.org, ryan.roberts@arm.com, sdonthineni@nvidia.com, will@kernel.org, yuzenghui@huawei.com +Message-ID: <20260616051822.111870-10-mark.rutland@arm.com> + +From: Will Deacon + +commit 1940e70a8144bf75e6df26bf6f600862ea7f7ea1 upstream. + +Commit fb091ff39479 ("arm64: Subscribe Microsoft Azure Cobalt 100 to ARM +Neoverse N2 errata") states that Microsoft Azure Cobalt 100 CPU "is a +Microsoft implemented CPU based on r0p0 of the ARM Neoverse N2 CPU, and +therefore suffers from all the same errata.". + +So enable the workaround for the latest broadcast TLB invalidation bug +on these parts. + +Signed-off-by: Will Deacon +[Mark: backport to v6.6.y] +Signed-off-by: Mark Rutland +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/arch/arm64/silicon-errata.rst | 2 ++ + arch/arm64/Kconfig | 1 + + arch/arm64/kernel/cpu_errata.c | 1 + + 3 files changed, 4 insertions(+) + +--- a/Documentation/arch/arm64/silicon-errata.rst ++++ b/Documentation/arch/arm64/silicon-errata.rst +@@ -335,3 +335,5 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | Microsoft | Azure Cobalt 100| #3324339 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| Microsoft | Azure Cobalt 100| #4193789 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -1148,6 +1148,7 @@ config ARM64_ERRATUM_4118414 + * ARM Neoverse-V2 erratum 4193787 + * ARM Neoverse-V3 erratum 4193784 + * ARM Neoverse-V3AE erratum 4193784 ++ * Microsoft Azure Cobalt 100 4193789 + * NVIDIA Olympus erratum T410-OLY-1029 + + On affected cores, some memory accesses might not be completed by +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -266,6 +266,7 @@ static const struct arm64_cpu_capabiliti + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE), + MIDR_ALL_VERSIONS(MIDR_NVIDIA_OLYMPUS), ++ MIDR_ALL_VERSIONS(MIDR_MICROSOFT_AZURE_COBALT_100), + {} + })), + }, diff --git a/queue-6.6/arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch b/queue-6.6/arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch new file mode 100644 index 0000000000..3ef9b0b5f7 --- /dev/null +++ b/queue-6.6/arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch @@ -0,0 +1,77 @@ +From stable+bounces-263573-greg=kroah.com@vger.kernel.org Tue Jun 16 10:48:58 2026 +From: Mark Rutland +Date: Tue, 16 Jun 2026 06:18:21 +0100 +Subject: arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU +To: stable@vger.kernel.org +Cc: anshuman.khandual@arm.com, catalin.marinas@arm.com, gregkh@linuxfoundation.org, lee@kernel.org, mark.rutland@arm.com, maz@kernel.org, oupton@kernel.org, ryan.roberts@arm.com, sdonthineni@nvidia.com, will@kernel.org, yuzenghui@huawei.com +Message-ID: <20260616051822.111870-9-mark.rutland@arm.com> + +From: Shanker Donthineni + +commit ec7216f92e4ebd485b1c6dc6aa3f6064b71a5768 upstream. + +NVIDIA Olympus cores are affected by the TLBI completion issue tracked as +CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses +ARM64_WORKAROUND_REPEAT_TLBI to issue an additional broadcast TLBI;DSB +sequence and ensure affected memory write effects are globally observed. + +Add MIDR_NVIDIA_OLYMPUS to the repeat-TLBI match list so the same +mitigation is enabled on affected Olympus systems. Also document the +NVIDIA Olympus erratum in the arm64 silicon errata table and list it in +the Kconfig help text. + +Signed-off-by: Shanker Donthineni +Cc: Catalin Marinas +Cc: Will Deacon +Cc: Mark Rutland +Acked-by: Mark Rutland +Signed-off-by: Will Deacon +[Mark: backport to v6.6.y] +Signed-off-by: Shanker Donthineni +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/arch/arm64/silicon-errata.rst | 2 ++ + arch/arm64/Kconfig | 3 ++- + arch/arm64/kernel/cpu_errata.c | 1 + + 3 files changed, 5 insertions(+), 1 deletion(-) + +--- a/Documentation/arch/arm64/silicon-errata.rst ++++ b/Documentation/arch/arm64/silicon-errata.rst +@@ -274,6 +274,8 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | NVIDIA | Carmel Core | N/A | NVIDIA_CARMEL_CNP_ERRATUM | + +----------------+-----------------+-----------------+-----------------------------+ ++| NVIDIA | Olympus core | T410-OLY-1029 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | NVIDIA | T241 GICv3/4.x | T241-FABRIC-4 | N/A | + +----------------+-----------------+-----------------+-----------------------------+ + +----------------+-----------------+-----------------+-----------------------------+ +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -1121,7 +1121,7 @@ config ARM64_ERRATUM_4193714 + If unsure, say Y. + + config ARM64_ERRATUM_4118414 +- bool "Cortex-*/Neoverse-*/C1-*: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" ++ bool "Various: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" + default y + select ARM64_WORKAROUND_REPEAT_TLBI + help +@@ -1148,6 +1148,7 @@ config ARM64_ERRATUM_4118414 + * ARM Neoverse-V2 erratum 4193787 + * ARM Neoverse-V3 erratum 4193784 + * ARM Neoverse-V3AE erratum 4193784 ++ * NVIDIA Olympus erratum T410-OLY-1029 + + On affected cores, some memory accesses might not be completed by + broadcast TLB invalidation. +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -265,6 +265,7 @@ static const struct arm64_cpu_capabiliti + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE), ++ MIDR_ALL_VERSIONS(MIDR_NVIDIA_OLYMPUS), + {} + })), + }, diff --git a/queue-6.6/arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch b/queue-6.6/arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch new file mode 100644 index 0000000000..d3a9d5c8bb --- /dev/null +++ b/queue-6.6/arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch @@ -0,0 +1,268 @@ +From stable+bounces-263572-greg=kroah.com@vger.kernel.org Tue Jun 16 10:49:13 2026 +From: Mark Rutland +Date: Tue, 16 Jun 2026 06:18:20 +0100 +Subject: arm64: errata: Mitigate TLBI errata on various Arm CPUs +To: stable@vger.kernel.org +Cc: anshuman.khandual@arm.com, catalin.marinas@arm.com, gregkh@linuxfoundation.org, lee@kernel.org, mark.rutland@arm.com, maz@kernel.org, oupton@kernel.org, ryan.roberts@arm.com, sdonthineni@nvidia.com, will@kernel.org, yuzenghui@huawei.com +Message-ID: <20260616051822.111870-8-mark.rutland@arm.com> + +From: Mark Rutland + +commit cfd391e74134db664feb499d43af286380b10ba8 upstream. + +A number of CPUs developed by Arm suffer from errata whereby a broadcast +TLBI;DSB sequence may complete before the global observation of writes +which are translated by an affected TLB entry. + +These errata ONLY affect the completion of memory accesses which have +been translated by an invalidated TLB entry, and these errata DO NOT +affect the actual invalidation of TLB entries. TLB entries are removed +correctly. + +This issue has been assigned CVE ID CVE-2025-10263. + +To mitigate this issue, Arm recommends that software follows any +affected TLBI;DSB sequence with an additional TLBI;DSB, which will +ensure that all memory write effects affected by the first TLBI have +been globally observed. The additional TLBI can use any operation that +is broadcast to affected CPUs, and the additional DSB can use any option +that is sufficient to complete the additional TLBI. + +The ARM64_WORKAROUND_REPEAT_TLBI workaround is sufficient to mitigate +the issue. Enable this workaround for affected CPUs, and update the +silicon errata documentation accordingly. + +Note that due to the manner in which Arm develops IP and tracks errata, +some CPUs share a common erratum number. + +Signed-off-by: Mark Rutland +Cc: Catalin Marinas +Cc: Will Deacon +Signed-off-by: Will Deacon +[Mark: backport to v6.6.y] +Signed-off-by: Mark Rutland +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/arch/arm64/silicon-errata.rst | 44 +++++++++++++++++++++++++ + arch/arm64/Kconfig | 48 ++++++++++++++++++++++++++++ + arch/arm64/kernel/cpu_errata.c | 32 +++++++++++++++++- + 3 files changed, 122 insertions(+), 2 deletions(-) + +--- a/Documentation/arch/arm64/silicon-errata.rst ++++ b/Documentation/arch/arm64/silicon-errata.rst +@@ -123,14 +123,26 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A76 | #3324349 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-A76 | #4193800 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-A76AE | #4193801 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A77 | #1508412 | ARM64_ERRATUM_1508412 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A77 | #3324348 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-A77 | #4193798 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A78 | #3324344 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-A78 | #4193791 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-A78AE | #4193793 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A78C | #3324346,3324347| ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-A78C | #4193794 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A710 | #2119858 | ARM64_ERRATUM_2119858 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A710 | #2054223 | ARM64_ERRATUM_2054223 | +@@ -139,6 +151,8 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A710 | #3324338 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-A710 | #4193788 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A715 | #2645198 | ARM64_ERRATUM_2645198 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A715 | #3456084 | ARM64_ERRATUM_3194386 | +@@ -149,20 +163,32 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-X1 | #3324344 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-X1 | #4193791 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-X1C | #3324346 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-X1C | #4193792 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-X2 | #2119858 | ARM64_ERRATUM_2119858 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-X2 | #2224489 | ARM64_ERRATUM_2224489 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-X2 | #3324338 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-X2 | #4193788 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-X3 | #3324335 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-X3 | #4193786 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-X4 | #3194386 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-X4 | #4118414 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-X925 | #3324334 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-X925 | #4193781 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-N1 | #1188873,1418040| ARM64_ERRATUM_1418040 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-N1 | #1349291 | N/A | +@@ -171,6 +197,8 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-N1 | #3324349 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Neoverse-N1 | #4193800 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-N2 | #2139208 | ARM64_ERRATUM_2139208 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-N2 | #2067961 | ARM64_ERRATUM_2067961 | +@@ -179,16 +207,32 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-N2 | #3324339 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Neoverse-N2 | #4193789 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-N3 | #3456111 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-V1 | #3324341 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Neoverse-V1 | #4193790 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-V2 | #3324336 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Neoverse-V2 | #4193787 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-V3 | #3312417 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Neoverse-V3 | #4193784 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-V3AE | #3312417 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Neoverse-V3AE | #4193784 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ ++| ARM | C1-Premium | #4193780 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ ++| ARM | C1-Pro | #4193714 | ARM64_ERRATUM_4193714 | +++----------------+-----------------+-----------------+-----------------------------+ ++| ARM | C1-Ultra | #4193780 | ARM64_ERRATUM_4118414 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | MMU-500 | #841119,826419 | N/A | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | MMU-600 | #1076982,1209401| N/A | +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -1108,6 +1108,54 @@ config ARM64_ERRATUM_3194386 + + If unsure, say Y. + ++config ARM64_ERRATUM_4193714 ++ bool "C1-Pro: 4193714: SME DVMSync early acknowledgement" ++ depends on ARM64_SME ++ default y ++ help ++ Enable workaround for C1-Pro acknowledging the DVMSync before ++ the SME memory accesses are complete. This will cause TLB ++ maintenance for processes using SME to also issue an IPI to ++ the affected CPUs. ++ ++ If unsure, say Y. ++ ++config ARM64_ERRATUM_4118414 ++ bool "Cortex-*/Neoverse-*/C1-*: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" ++ default y ++ select ARM64_WORKAROUND_REPEAT_TLBI ++ help ++ This option adds a workaround for the following errata: ++ ++ * ARM C1-Premium erratum 4193780 ++ * ARM C1-Ultra erratum 4193780 ++ * ARM Cortex-A76 erratum 4193800 ++ * ARM Cortex-A76AE erratum 4193801 ++ * ARM Cortex-A77 erratum 4193798 ++ * ARM Cortex-A78 erratum 4193791 ++ * ARM Cortex-A78AE erratum 4193793 ++ * ARM Cortex-A78C erratum 4193794 ++ * ARM Cortex-A710 erratum 4193788 ++ * ARM Cortex-X1 erratum 4193791 ++ * ARM Cortex-X1C erratum 4193792 ++ * ARM Cortex-X2 erratum 4193788 ++ * ARM Cortex-X3 erratum 4193786 ++ * ARM Cortex-X4 erratum 4118414 ++ * ARM Cortex-X925 erratum 4193781 ++ * ARM Neoverse-N1 erratum 4193800 ++ * ARM Neoverse-N2 erratum 4193789 ++ * ARM Neoverse-V1 erratum 4193790 ++ * ARM Neoverse-V2 erratum 4193787 ++ * ARM Neoverse-V3 erratum 4193784 ++ * ARM Neoverse-V3AE erratum 4193784 ++ ++ On affected cores, some memory accesses might not be completed by ++ broadcast TLB invalidation. ++ ++ This issue is also known as CVE-2025-10263. ++ ++ If unsure, say Y. ++ + config CAVIUM_ERRATUM_22375 + bool "Cavium erratum 22375, 24313" + default y +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -241,7 +241,35 @@ static const struct arm64_cpu_capabiliti + ERRATA_MIDR_RANGE(MIDR_CORTEX_A510, 0, 0, 1, 1), + }, + #endif +- {}, ++#ifdef CONFIG_ARM64_ERRATUM_4118414 ++ { ++ ERRATA_MIDR_RANGE_LIST(((const struct midr_range[]) { ++ MIDR_ALL_VERSIONS(MIDR_C1_PREMIUM), ++ MIDR_ALL_VERSIONS(MIDR_C1_ULTRA), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A76), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A76AE), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A77), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78AE), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X1), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X1C), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X2), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X3), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X4), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X925), ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2), ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3), ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE), ++ {} ++ })), ++ }, ++#endif ++ {} + }; + #endif + +@@ -569,7 +597,7 @@ const struct arm64_cpu_capabilities arm6 + #endif + #ifdef CONFIG_ARM64_WORKAROUND_REPEAT_TLBI + { +- .desc = "Qualcomm erratum 1009, or ARM erratum 1286807, 2441009", ++ .desc = "Broken broadcast TLBI completion", + .capability = ARM64_WORKAROUND_REPEAT_TLBI, + .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM, + .matches = cpucap_multi_entry_cap_matches, diff --git a/queue-6.6/mptcp-add-addr-always-drop-other-suboptions.patch b/queue-6.6/mptcp-add-addr-always-drop-other-suboptions.patch new file mode 100644 index 0000000000..17ffdfce57 --- /dev/null +++ b/queue-6.6/mptcp-add-addr-always-drop-other-suboptions.patch @@ -0,0 +1,168 @@ +From stable+bounces-263692-greg=kroah.com@vger.kernel.org Tue Jun 16 17:50:08 2026 +From: Sasha Levin +Date: Tue, 16 Jun 2026 08:19:09 -0400 +Subject: mptcp: add-addr: always drop other suboptions +To: stable@vger.kernel.org +Cc: "Matthieu Baerts (NGI0)" , Jakub Kicinski , Sasha Levin +Message-ID: <20260616121909.3134590-2-sashal@kernel.org> + +From: "Matthieu Baerts (NGI0)" + +[ Upstream commit bd34fa0257261b76964df1c98f44b3cb4ee14620 ] + +When an ADD_ADDR needs to be sent, it could be prepared if there is +enough remaining space and even if the packet is not a pure ACK. But it +would be dropped soon after. + +Indeed, in mptcp_pm_add_addr_signal(), there is enough space to fit a +DSS of 20 octets and an ADD_ADDR echo containing an IPv4 address on 8 +octets for example. In this case, the packet would be prepared, the +MPTCP_ADD_ADDR_ECHO bit would be removed from pm->addr_signal, but the +option would be silently dropped in mptcp_established_options_add_addr() +not to override DSS info in the union from 'struct mptcp_out_options', +and also because mptcp_write_options() will enforce mutually exclusion +with DSS. + +Instead, don't even try to send an ADD_ADDR if it is not a pure ACK. +Retry for each new packet until a pure-ACK is emitted. That's fine to do +that, because each time an ADD_ADDR (echo) is scheduled, a pure ACK is +queued. + +This also simplifies the code, and the skb checks can be done earlier, +before the lock. + +Note: also, since commit 6d0060f600ad ("mptcp: Write MPTCP DSS headers +to outgoing data packets"), opts->ahmac would not have been set to 0 +when other suboptions were not dropped, and when sending an ADD_ADDR +echo. That would have resulted in sending an ADD_ADDR using garbage +info, where there was not enough space, instead of an echo one without +the ADD_ADDR HMAC. + +Fixes: 1bff1e43a30e ("mptcp: optimize out option generation") +Cc: stable@vger.kernel.org +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-11-856831229976@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/options.c | 30 +++++++----------------------- + net/mptcp/pm.c | 15 ++++----------- + net/mptcp/protocol.h | 7 +++---- + 3 files changed, 14 insertions(+), 38 deletions(-) + +--- a/net/mptcp/options.c ++++ b/net/mptcp/options.c +@@ -662,7 +662,6 @@ static bool mptcp_established_options_ad + { + struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk); + struct mptcp_sock *msk = mptcp_sk(subflow->conn); +- bool drop_other_suboptions = false; + unsigned int opt_size = *size; + struct mptcp_addr_info addr; + bool echo; +@@ -673,36 +672,20 @@ static bool mptcp_established_options_ad + */ + if (!mptcp_pm_should_add_signal(msk) || + (opts->suboptions & (OPTION_MPTCP_MPJ_ACK | OPTION_MPTCP_MPC_ACK)) || +- !mptcp_pm_add_addr_signal(msk, skb, opt_size, remaining, &addr, +- &echo, &drop_other_suboptions)) ++ !skb || !skb_is_tcp_pure_ack(skb) || ++ !mptcp_pm_add_addr_signal(msk, opt_size, remaining, &addr, &echo)) + return false; + +- /* +- * Later on, mptcp_write_options() will enforce mutually exclusion with +- * DSS, bail out if such option is set and we can't drop it. +- */ +- if (drop_other_suboptions) +- remaining += opt_size; +- else if (opts->suboptions & OPTION_MPTCP_DSS) +- return false; ++ remaining += opt_size; + + len = mptcp_add_addr_len(addr.family, echo, !!addr.port); + if (remaining < len) + return false; + + *size = len; +- if (drop_other_suboptions) { +- pr_debug("drop other suboptions\n"); +- opts->suboptions = 0; +- +- /* note that e.g. DSS could have written into the memory +- * aliased by ahmac, we must reset the field here +- * to avoid appending the hmac even for ADD_ADDR echo +- * options +- */ +- opts->ahmac = 0; +- *size -= opt_size; +- } ++ pr_debug("drop other suboptions\n"); ++ opts->suboptions = 0; ++ *size -= opt_size; + opts->addr = addr; + opts->suboptions |= OPTION_MPTCP_ADD_ADDR; + if (!echo) { +@@ -712,6 +695,7 @@ static bool mptcp_established_options_ad + &opts->addr); + } else { + MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_ECHOADDTX); ++ opts->ahmac = 0; + } + pr_debug("addr_id=%d, ahmac=%llu, echo=%d, port=%d\n", + opts->addr.id, opts->ahmac, echo, ntohs(opts->addr.port)); +--- a/net/mptcp/pm.c ++++ b/net/mptcp/pm.c +@@ -330,10 +330,9 @@ void mptcp_pm_mp_fail_received(struct so + + /* path manager helpers */ + +-bool mptcp_pm_add_addr_signal(struct mptcp_sock *msk, const struct sk_buff *skb, +- unsigned int opt_size, unsigned int remaining, +- struct mptcp_addr_info *addr, bool *echo, +- bool *drop_other_suboptions) ++bool mptcp_pm_add_addr_signal(struct mptcp_sock *msk, unsigned int opt_size, ++ unsigned int remaining, ++ struct mptcp_addr_info *addr, bool *echo) + { + bool skip_add_addr = false; + int ret = false; +@@ -351,10 +350,7 @@ bool mptcp_pm_add_addr_signal(struct mpt + * plain dup-ack from TCP perspective. The other MPTCP-relevant info, + * if any, will be carried by the 'original' TCP ack + */ +- if (skb && skb_is_tcp_pure_ack(skb)) { +- remaining += opt_size; +- *drop_other_suboptions = true; +- } ++ remaining += opt_size; + + *echo = mptcp_pm_should_add_signal_echo(msk); + if (*echo) { +@@ -372,9 +368,6 @@ bool mptcp_pm_add_addr_signal(struct mpt + if (remaining < mptcp_add_addr_len(family, *echo, port)) { + struct net *net = sock_net((struct sock *)msk); + +- if (!*drop_other_suboptions) +- goto out_unlock; +- + if (*echo) { + MPTCP_INC_STATS(net, MPTCP_MIB_ECHOADDTXDROP); + } else { +--- a/net/mptcp/protocol.h ++++ b/net/mptcp/protocol.h +@@ -1042,10 +1042,9 @@ static inline int mptcp_rm_addr_len(cons + return TCPOLEN_MPTCP_RM_ADDR_BASE + roundup(rm_list->nr - 1, 4) + 1; + } + +-bool mptcp_pm_add_addr_signal(struct mptcp_sock *msk, const struct sk_buff *skb, +- unsigned int opt_size, unsigned int remaining, +- struct mptcp_addr_info *addr, bool *echo, +- bool *drop_other_suboptions); ++bool mptcp_pm_add_addr_signal(struct mptcp_sock *msk, unsigned int opt_size, ++ unsigned int remaining, ++ struct mptcp_addr_info *addr, bool *echo); + bool mptcp_pm_rm_addr_signal(struct mptcp_sock *msk, unsigned int remaining, + struct mptcp_rm_list *rm_list); + int mptcp_pm_get_local_id(struct mptcp_sock *msk, struct sock_common *skc); diff --git a/queue-6.6/mptcp-fix-missing-wakeups-in-edge-scenarios.patch b/queue-6.6/mptcp-fix-missing-wakeups-in-edge-scenarios.patch new file mode 100644 index 0000000000..30a4756b0c --- /dev/null +++ b/queue-6.6/mptcp-fix-missing-wakeups-in-edge-scenarios.patch @@ -0,0 +1,47 @@ +From stable+bounces-263694-greg=kroah.com@vger.kernel.org Tue Jun 16 17:50:30 2026 +From: Sasha Levin +Date: Tue, 16 Jun 2026 08:19:27 -0400 +Subject: mptcp: fix missing wakeups in edge scenarios +To: stable@vger.kernel.org +Cc: Paolo Abeni , "Matthieu Baerts (NGI0)" , Jakub Kicinski , Sasha Levin +Message-ID: <20260616121927.3135722-1-sashal@kernel.org> + +From: Paolo Abeni + +[ Upstream commit 9d8d28738f24b75616d6ca7a27cb4aed88520343 ] + +The mptcp_recvmsg() can fill MPTCP socket receive queue via +mptcp_move_skbs(), but currently does not try to wakeup any listener, +because the same process is going to check the receive queue soon. + +When multiple threads are reading from the same fd, the above can +cause stall. Add the missing wakeup. + +Fixes: 6771bfd9ee24 ("mptcp: update mptcp ack sequence from work queue") +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Abeni +Reviewed-by: Matthieu Baerts (NGI0) +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-1-856831229976@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/protocol.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -2205,7 +2205,11 @@ static bool __mptcp_move_skbs(struct mpt + } + if (ret) + mptcp_check_data_fin((struct sock *)msk); +- return !skb_queue_empty(&msk->receive_queue); ++ ++ ret = !skb_queue_empty(&msk->receive_queue); ++ if (ret && mptcp_epollin_ready(sk)) ++ sk->sk_data_ready(sk); ++ return ret; + } + + static unsigned int mptcp_inq_hint(const struct sock *sk) diff --git a/queue-6.6/series b/queue-6.6/series index ae72c5fc9e..719d8dc3fd 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -438,3 +438,11 @@ rdma-umem-fix-truncation-for-block-sizes-4g.patch net-bonding-fix-use-after-free-in-bond_xmit_broadcast.patch ipvs-skip-ipv6-extension-headers-for-csum-checks.patch alsa-hda-hdmi-add-quirk-for-tuxedo-ibs14g6.patch +arm64-cputype-add-nvidia-olympus-definitions.patch +arm64-cputype-add-c1-ultra-definitions.patch +arm64-cputype-add-c1-premium-definitions.patch +arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch +arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch +arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt-100-cpu.patch +mptcp-add-addr-always-drop-other-suboptions.patch +mptcp-fix-missing-wakeups-in-edge-scenarios.patch