[PATCH AUTOSEL 6.17-6.16] arm64: errata: Apply workarounds for Neoverse-V3AE

[Sasha Levin]

From: Mark Rutland <mark.rutland at arm.com>

[ Upstream commit 0c33aa1804d101c11ba1992504f17a42233f0e11 ]

Neoverse-V3AE is also affected by erratum #3312417, as described in its
Software Developer Errata Notice (SDEN) document:

  Neoverse V3AE (MP172) SDEN v9.0, erratum 3312417
  https://developer.arm.com/documentation/SDEN-2615521/9-0/

Enable the workaround for Neoverse-V3AE, and document this.

Signed-off-by: Mark Rutland <mark.rutland at arm.com>
Cc: James Morse <james.morse at arm.com>
Cc: Will Deacon <will at kernel.org>
Cc: Catalin Marinas <catalin.marinas at arm.com>
Signed-off-by: Ryan Roberts <ryan.roberts at arm.com>
Signed-off-by: Will Deacon <will at kernel.org>
Signed-off-by: Sasha Levin <sashal at kernel.org>
---

LLM Generated explanations, may be completely bogus:

Based on my comprehensive analysis, here is my determination:

## **Backport Status: YES**

### Detailed Analysis

#### 1. **Nature of the Fix**
This commit adds ARM Neoverse-V3AE to the existing workaround for
erratum 3194386/3312417, which addresses a **speculative execution
vulnerability** related to SSBS (Speculative Store Bypass Safe). The
erratum description states: "MSR SSBS, #0 instructions may not affect
subsequent speculative instructions, which may permit unexpected
speculative store bypassing." This is a security-related issue similar
to Spectre v4.

#### 2. **Code Changes Analysis**
The changes are **minimal and surgical**:
- **Documentation** (`silicon-errata.rst`): Adds 1 table entry
  documenting Neoverse-V3AE erratum 3312417
- **Kconfig** (`arch/arm64/Kconfig`): Adds 1 line to the list of
  affected CPUs in the ARM64_ERRATUM_3194386 help text
- **Errata code** (`cpu_errata.c`): Adds 1 line
  `MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE)` to the
  `erratum_spec_ssbs_list[]` array

This simply registers a new CPU variant to an existing, well-tested
workaround infrastructure.

#### 3. **Established Backporting Pattern**
The erratum 3194386 infrastructure has a **clear history of being
expanded and backported**:
- Base erratum introduced in v6.10 (commit 7187bb7d0b5c7)
- First expansion in v6.11 (commit 75b3c43eab594) - **backported to
  v6.10.x**
- Second expansion in v6.11 (commit adeec61a4723f) - **backported to
  v6.10.x**
- Third expansion in v6.12 (commit 081eb7932c2b2) - **backported to
  v6.11.x**

The backport commits show `Signed-off-by: Sasha Levin
<sashal at kernel.org>`, confirming stable team involvement. This
establishes that ARM errata workarounds for speculative execution are
**routinely backported**.

#### 4. **Risk Assessment: VERY LOW**
- **No architectural changes** - uses existing workaround mechanism
- **No new code paths** - just adds a CPU ID to a matching list
- **Zero impact if hardware not present** - the MIDR check only triggers
  on affected CPUs
- **Well-contained** - changes are confined to ARM64 errata subsystem
- **Already tested** - the workaround logic is proven on 20+ other ARM
  cores with the same erratum

#### 5. **Dependencies**
This commit depends on `3bbf004c4808e` ("arm64: cputype: Add
Neoverse-V3AE definitions") which adds the `MIDR_NEOVERSE_V3AE`
constant. Both commits are part of the same September 2025 patch series
and should be backported together as a pair.

#### 6. **User Impact**
- **Security**: Users with Neoverse-V3AE CPUs are vulnerable to
  speculative store bypass attacks without this fix
- **Hardware availability**: ARM has published SDEN v9.0 for
  Neoverse-V3AE (MP172), indicating this hardware exists or will exist
  in production systems
- **Protection**: The workaround places speculation barriers after SSBS
  changes to prevent information leakage

#### 7. **Stable Kernel Criteria Compliance**
✅ **Fixes important bug** - Security/speculative execution vulnerability
✅ **Small and contained** - 3 single-line additions
✅ **No new features** - Just hardware support
✅ **Minimal regression risk** - Uses proven infrastructure
✅ **Clear benefit** - Protects affected hardware

### Recommendation
**STRONGLY RECOMMEND BACKPORTING** this commit along with its dependency
(3bbf004c4808e) to all stable kernels that contain the base
ARM64_ERRATUM_3194386 infrastructure (v6.10+). This follows the
established pattern for ARM errata workarounds and provides essential
security protection for Neoverse-V3AE hardware.

 Documentation/arch/arm64/silicon-errata.rst | 2 ++
 arch/arm64/Kconfig                          | 1 +
 arch/arm64/kernel/cpu_errata.c              | 1 +
 3 files changed, 4 insertions(+)

diff --git a/Documentation/arch/arm64/silicon-errata.rst b/Documentation/arch/arm64/silicon-errata.rst
index b18ef4064bc04..a7ec57060f64f 100644
--- a/Documentation/arch/arm64/silicon-errata.rst
+++ b/Documentation/arch/arm64/silicon-errata.rst
@@ -200,6 +200,8 @@ stable kernels.
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Neoverse-V3     | #3312417        | ARM64_ERRATUM_3194386       |
 +----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Neoverse-V3AE   | #3312417        | ARM64_ERRATUM_3194386       |
++----------------+-----------------+-----------------+-----------------------------+
 | ARM            | MMU-500         | #841119,826419  | ARM_SMMU_MMU_500_CPRE_ERRATA|
 |                |                 | #562869,1047329 |                             |
 +----------------+-----------------+-----------------+-----------------------------+
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index e9bbfacc35a64..93f391e67af15 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1138,6 +1138,7 @@ config ARM64_ERRATUM_3194386
 	  * ARM Neoverse-V1 erratum 3324341
 	  * ARM Neoverse V2 erratum 3324336
 	  * ARM Neoverse-V3 erratum 3312417
+	  * ARM Neoverse-V3AE erratum 3312417
 
 	  On affected cores "MSR SSBS, #0" instructions may not affect
 	  subsequent speculative instructions, which may permit unexepected
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index 59d723c9ab8f5..21f86c160aab2 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -545,6 +545,7 @@ static const struct midr_range erratum_spec_ssbs_list[] = {
 	MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
 	MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2),
 	MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3),
+	MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE),
 	{}
 };
 #endif
-- 
2.51.0