Skip to content

Commit 582f2aa

Browse files
bmastbergenbmastbergen
committed
arm64: errata: Mitigate TLBI errata on various Arm CPUs
jira VULN-187519 cve CVE-2025-10263 commit-author Mark Rutland <mark.rutland@arm.com> commit - commit-source-sha cfd391e commit-source arm64 upstream-diff silicon-errata.rst at different path (Documentation/arm64/ vs Documentation/arch/arm64/) and required manual conflict resolution due to condensed table formatting and missing entries in our branch. Content is identical. On 4.18, arm64_repeat_tlbi_cpus[] is a flat struct midr_range array, not struct arm64_cpu_capabilities[]. Upstream uses a nested ERRATA_MIDR_RANGE_LIST() with inline array initialization, which sets .type, .matches, and .midr_range_list fields that do not exist on struct midr_range. Flattened to direct MIDR_ALL_VERSIONS() entries in the array. A number of CPUs developed by Arm suffer from errata whereby a broadcast TLBI;DSB sequence may complete before the global observation of writes which are translated by an affected TLB entry. These errata ONLY affect the completion of memory accesses which have been translated by an invalidated TLB entry, and these errata DO NOT affect the actual invalidation of TLB entries. TLB entries are removed correctly. This issue has been assigned CVE ID CVE-2025-10263. To mitigate this issue, Arm recommends that software follows any affected TLBI;DSB sequence with an additional TLBI;DSB, which will ensure that all memory write effects affected by the first TLBI have been globally observed. The additional TLBI can use any operation that is broadcast to affected CPUs, and the additional DSB can use any option that is sufficient to complete the additional TLBI. The ARM64_WORKAROUND_REPEAT_TLBI workaround is sufficient to mitigate the issue. Enable this workaround for affected CPUs, and update the silicon errata documentation accordingly. Note that due to the manner in which Arm develops IP and tracks errata, some CPUs share a common erratum number. Signed-off-by: Mark Rutland <mark.rutland@arm.com> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Will Deacon <will@kernel.org> Signed-off-by: Will Deacon <will@kernel.org> (cherry picked from commit cfd391e) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
1 parent b3f7c5d commit 582f2aa

3 files changed

Lines changed: 100 additions & 1 deletion

File tree

‎Documentation/arm64/silicon-errata.rst‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,8 +85,34 @@ stable kernels.
8585
+----------------+-----------------+-----------------+-----------------------------+
8686
| ARM | Cortex-A76 | #1463225 | ARM64_ERRATUM_1463225 |
8787
+----------------+-----------------+-----------------+-----------------------------+
88+
| ARM | Cortex-A76 | #4193800 | ARM64_ERRATUM_4118414 |
89+
+----------------+-----------------+-----------------+-----------------------------+
90+
| ARM | Cortex-A76AE | #4193801 | ARM64_ERRATUM_4118414 |
91+
+----------------+-----------------+-----------------+-----------------------------+
92+
| ARM | Cortex-A77 | #4193798 | ARM64_ERRATUM_4118414 |
93+
+----------------+-----------------+-----------------+-----------------------------+
94+
| ARM | Cortex-A78 | #4193791 | ARM64_ERRATUM_4118414 |
95+
+----------------+-----------------+-----------------+-----------------------------+
96+
| ARM | Cortex-A78AE | #4193793 | ARM64_ERRATUM_4118414 |
97+
+----------------+-----------------+-----------------+-----------------------------+
98+
| ARM | Cortex-A78C | #4193794 | ARM64_ERRATUM_4118414 |
99+
+----------------+-----------------+-----------------+-----------------------------+
100+
| ARM | Cortex-A710 | #4193788 | ARM64_ERRATUM_4118414 |
101+
+----------------+-----------------+-----------------+-----------------------------+
88102
| ARM | Cortex-A55 | #1530923 | ARM64_ERRATUM_1530923 |
89103
+----------------+-----------------+-----------------+-----------------------------+
104+
| ARM | Cortex-X1 | #4193791 | ARM64_ERRATUM_4118414 |
105+
+----------------+-----------------+-----------------+-----------------------------+
106+
| ARM | Cortex-X1C | #4193792 | ARM64_ERRATUM_4118414 |
107+
+----------------+-----------------+-----------------+-----------------------------+
108+
| ARM | Cortex-X2 | #4193788 | ARM64_ERRATUM_4118414 |
109+
+----------------+-----------------+-----------------+-----------------------------+
110+
| ARM | Cortex-X3 | #4193786 | ARM64_ERRATUM_4118414 |
111+
+----------------+-----------------+-----------------+-----------------------------+
112+
| ARM | Cortex-X4 | #4118414 | ARM64_ERRATUM_4118414 |
113+
+----------------+-----------------+-----------------+-----------------------------+
114+
| ARM | Cortex-X925 | #4193781 | ARM64_ERRATUM_4118414 |
115+
+----------------+-----------------+-----------------+-----------------------------+
90116
| ARM | Neoverse-N1 | #1349291 | N/A |
91117
+----------------+-----------------+-----------------+-----------------------------+
92118
| ARM | Neoverse-N1 | #1188873,1418040| ARM64_ERRATUM_1418040 |
@@ -95,6 +121,20 @@ stable kernels.
95121
+----------------+-----------------+-----------------+-----------------------------+
96122
| ARM | Neoverse-N1 | #1542419 | ARM64_ERRATUM_1542419 |
97123
+----------------+-----------------+-----------------+-----------------------------+
124+
| ARM | Neoverse-N1 | #4193800 | ARM64_ERRATUM_4118414 |
125+
+----------------+-----------------+-----------------+-----------------------------+
126+
| ARM | Neoverse-N2 | #4193789 | ARM64_ERRATUM_4118414 |
127+
+----------------+-----------------+-----------------+-----------------------------+
128+
| ARM | Neoverse-V1 | #4193790 | ARM64_ERRATUM_4118414 |
129+
+----------------+-----------------+-----------------+-----------------------------+
130+
| ARM | Neoverse-V3 | #4193784 | ARM64_ERRATUM_4118414 |
131+
+----------------+-----------------+-----------------+-----------------------------+
132+
| ARM | Neoverse-V3AE | #4193784 | ARM64_ERRATUM_4118414 |
133+
+----------------+-----------------+-----------------+-----------------------------+
134+
| ARM | C1-Premium | #4193780 | ARM64_ERRATUM_4118414 |
135+
+----------------+-----------------+-----------------+-----------------------------+
136+
| ARM | C1-Ultra | #4193780 | ARM64_ERRATUM_4118414 |
137+
+----------------+-----------------+-----------------+-----------------------------+
98138
| ARM | MMU-500 | #841119,826419 | N/A |
99139
+----------------+-----------------+-----------------+-----------------------------+
100140
+----------------+-----------------+-----------------+-----------------------------+

‎arch/arm64/Kconfig‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -622,6 +622,42 @@ config ARM64_ERRATUM_1542419
622622

623623
If unsure, say Y.
624624

625+
config ARM64_ERRATUM_4118414
626+
bool "Cortex-*/Neoverse-*/C1-*: Completion of affected memory accesses might not be guaranteed by completion of a TLBI"
627+
default y
628+
select ARM64_WORKAROUND_REPEAT_TLBI
629+
help
630+
This option adds a workaround for the following errata:
631+
632+
* ARM C1-Premium erratum 4193780
633+
* ARM C1-Ultra erratum 4193780
634+
* ARM Cortex-A76 erratum 4193800
635+
* ARM Cortex-A76AE erratum 4193801
636+
* ARM Cortex-A77 erratum 4193798
637+
* ARM Cortex-A78 erratum 4193791
638+
* ARM Cortex-A78AE erratum 4193793
639+
* ARM Cortex-A78C erratum 4193794
640+
* ARM Cortex-A710 erratum 4193788
641+
* ARM Cortex-X1 erratum 4193791
642+
* ARM Cortex-X1C erratum 4193792
643+
* ARM Cortex-X2 erratum 4193788
644+
* ARM Cortex-X3 erratum 4193786
645+
* ARM Cortex-X4 erratum 4118414
646+
* ARM Cortex-X925 erratum 4193781
647+
* ARM Neoverse-N1 erratum 4193800
648+
* ARM Neoverse-N2 erratum 4193789
649+
* ARM Neoverse-V1 erratum 4193790
650+
* ARM Neoverse-V2 erratum 4193787
651+
* ARM Neoverse-V3 erratum 4193784
652+
* ARM Neoverse-V3AE erratum 4193784
653+
654+
On affected cores, some memory accesses might not be completed by
655+
broadcast TLB invalidation.
656+
657+
This issue is also known as CVE-2025-10263.
658+
659+
If unsure, say Y.
660+
625661
config CAVIUM_ERRATUM_22375
626662
bool "Cavium erratum 22375, 24313"
627663
default y

‎arch/arm64/kernel/cpu_errata.c‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -662,6 +662,29 @@ static const struct midr_range arm64_repeat_tlbi_cpus[] = {
662662
#endif
663663
#ifdef CONFIG_ARM64_ERRATUM_1286807
664664
MIDR_RANGE(MIDR_CORTEX_A76, 0, 0, 3, 0),
665+
#endif
666+
#ifdef CONFIG_ARM64_ERRATUM_4118414
667+
MIDR_ALL_VERSIONS(MIDR_C1_PREMIUM),
668+
MIDR_ALL_VERSIONS(MIDR_C1_ULTRA),
669+
MIDR_ALL_VERSIONS(MIDR_CORTEX_A76),
670+
MIDR_ALL_VERSIONS(MIDR_CORTEX_A76AE),
671+
MIDR_ALL_VERSIONS(MIDR_CORTEX_A77),
672+
MIDR_ALL_VERSIONS(MIDR_CORTEX_A78),
673+
MIDR_ALL_VERSIONS(MIDR_CORTEX_A78AE),
674+
MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C),
675+
MIDR_ALL_VERSIONS(MIDR_CORTEX_A710),
676+
MIDR_ALL_VERSIONS(MIDR_CORTEX_X1),
677+
MIDR_ALL_VERSIONS(MIDR_CORTEX_X1C),
678+
MIDR_ALL_VERSIONS(MIDR_CORTEX_X2),
679+
MIDR_ALL_VERSIONS(MIDR_CORTEX_X3),
680+
MIDR_ALL_VERSIONS(MIDR_CORTEX_X4),
681+
MIDR_ALL_VERSIONS(MIDR_CORTEX_X925),
682+
MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1),
683+
MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
684+
MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
685+
MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2),
686+
MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3),
687+
MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE),
665688
#endif
666689
{},
667690
};
@@ -836,7 +859,7 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
836859
#endif
837860
#ifdef CONFIG_ARM64_WORKAROUND_REPEAT_TLBI
838861
{
839-
.desc = "Qualcomm erratum 1009, ARM erratum 1286807",
862+
.desc = "Broken broadcast TLBI completion",
840863
.capability = ARM64_WORKAROUND_REPEAT_TLBI,
841864
ERRATA_MIDR_RANGE_LIST(arm64_repeat_tlbi_cpus),
842865
},

0 commit comments

Comments
 (0)