From nobody Tue Jun 9 19:20:12 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gZdz12PpPz6gVjS for ; Tue, 09 Jun 2026 19:20:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gZdz05D36z3Qxb for ; Tue, 09 Jun 2026 19:20:12 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781032812; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=oQDiwBZQ2loEoJJtm8/Kvnt+7vrP8yI1S/TUhNZwRnk=; b=txnF9Gy3kpVa5jl5oscqIsiWi7YGunnR4RVFzsEJQ3aKE7Vi8YQ0fUjVbV2+nT/jCbXEXd 00osuhP5f3QkOjkPABbKZUyst2kyVYJrUzLtxSc6mqKSr/MzIHb4JmbzWW0FdQA7FaJBrk 47UZqBJP/vvqLfrUhYQ6q5bRS9kYZS0Csg8GnC8fHFEH39x4VSmsHzaNbtPIQNdvSel3QU CbtvPNP9LFzxU63SQphqxpmgf4z1Z1Cx5dj2kyo1ZE9mLuhbOixs0uYlNdcf1/uXA+2mCM Cfgd3l2+ULc/Ovdo9ElUc3Ap7j7ZpYweNuPAzSHGGYP/+vDwKL23y6YbQDVcyA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1781032812; a=rsa-sha256; cv=none; b=e3pvS/AOYf/Jk97ZR6jyu2Am13+uqqVa4DUQQqgSabg8mWBZD3uDwJyrt1l8v6nueHWgJj +P2MkqY0Da6fOtihZ2GeDeqF6iIZ4D0GQW19IK5VzDy1r0RMSr2Xf/I9N2hq/9/Z3ywV5E yeQC5lPi8ys20nWPg+d0weE3OV5xxN8TNwitBcIl07okbtsA79mJqrOmz4EdymJrcB7RTi uKPzeVMu5ct8vkX1JqRqLaYuWtECLtYlZypTplbmhWw7WbrG/msVhdML4ZJsk3E6QaEoPd 0J7321NZbUJ2kHfhTPRKOQ53D9u7VVt9tuhU/rhT/Ly5ZgMOHjQQLnJjAZSohw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781032812; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=oQDiwBZQ2loEoJJtm8/Kvnt+7vrP8yI1S/TUhNZwRnk=; b=PwS24o6pgCtvtI8yPMtlIYt61dStwo47iKjGvJfD2oMo9vKa/U5cAuNoxtW3j9gWNvdhCU pH9B4Ayl14kNBlriAvb89mvDUPcjsoWIsU/Kvpo1uGo0f7/3ZB08nBA1XLZn/ItNEPkd5v qw7u9W54mSoJp9vkBmCRabXhj24MXTNYJA9VAUDuwN7VHVo7LOJGo1oUeYn+uDD4nM5BAe 8BVCT3NTslG9pblQteUJYvxSngS5XriL3/67vRz6/Ogdz04f6vIZenf4g7ST7zYxgNrCBP Ibf16cQ2H6YdNAAD9yb+c20snhLFQ6DIsrW8IfKIbt6SLPrPoOWfMDfmU4Ge6A== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gZdz04QLkznGJ for ; Tue, 09 Jun 2026 19:20:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3e4c2 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 09 Jun 2026 19:20:12 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Andrew Turner From: Mark Johnston Subject: git: 81435fc0882c - releng/15.1 - arm64: Workaround the following errata List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: 81435fc0882c8c336f00d346bae04fdd3d5f65b5 Auto-Submitted: auto-generated Date: Tue, 09 Jun 2026 19:20:12 +0000 Message-Id: <6a28676c.3e4c2.3bc8334@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=81435fc0882c8c336f00d346bae04fdd3d5f65b5 commit 81435fc0882c8c336f00d346bae04fdd3d5f65b5 Author: Andrew Turner AuthorDate: 2026-05-28 09:25:30 +0000 Commit: Mark Johnston CommitDate: 2026-06-09 03:00:02 +0000 arm64: Workaround the following errata - ARM C1-Premium erratum 4193780 - ARM C1-Ultra erratum 4193780 - ARM Cortex-A76 erratum 4193800 - ARM Cortex-A76AE erratum 4193801 - ARM Cortex-A77 erratum 4193798 - ARM Cortex-A78 erratum 4193791 - ARM Cortex-A78AE erratum 4193793 - ARM Cortex-A78C erratum 4193794 - ARM Cortex-A710 erratum 4193788 - ARM Cortex-X1 erratum 4193791 - ARM Cortex-X1C erratum 4193792 - ARM Cortex-X2 erratum 4193788 - ARM Cortex-X3 erratum 4193786 - ARM Cortex-X4 erratum 4118414 - ARM Cortex-X925 erratum 4193781 - ARM Neoverse-N1 erratum 4193800 - ARM Neoverse-N2 erratum 4193789 - ARM Neoverse-V1 erratum 4193790 - ARM Neoverse-V2 erratum 4193787 - ARM Neoverse-V3 erratum 4193784 - ARM Neoverse-V3AE erratum 4193784 These are all variants on an erratum where TLBI+DSB instructions on one CPU may incorrectly complete early leading to stores to an updated address using an incorrect translation on another CPU. In all cases the workaround is to add a second TLBI+DSB. Approved by: re (cperciva) Approved by: so Security: FreeBSD-SA-26:31.arm64 Security: CVE-2025-10263 Sponsored by: Arm Ltd --- sys/arm64/arm64/pmap.c | 60 ++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 51 insertions(+), 9 deletions(-) diff --git a/sys/arm64/arm64/pmap.c b/sys/arm64/arm64/pmap.c index aa0b0e829f7a..12ab8750c77a 100644 --- a/sys/arm64/arm64/pmap.c +++ b/sys/arm64/arm64/pmap.c @@ -1743,20 +1743,62 @@ static cpu_feat_en pmap_multiple_tlbi_check(const struct cpu_feat *feat __unused, u_int midr) { /* - * Cortex-A55 erratum 2441007 (Cat B rare) + * ARM C1-Premium erratum 4193780 + * ARM C1-Ultra erratum 4193780 + * ARM Cortex-A76 erratum 4193800 + * ARM Cortex-A76AE erratum 4193801 + * ARM Cortex-A77 erratum 4193798 + * ARM Cortex-A78 erratum 4193791 + * ARM Cortex-A78AE erratum 4193793 + * ARM Cortex-A78C erratum 4193794 + * ARM Cortex-A710 erratum 4193788 + * ARM Cortex-X1 erratum 4193791 + * ARM Cortex-X1C erratum 4193792 + * ARM Cortex-X2 erratum 4193788 + * ARM Cortex-X3 erratum 4193786 + * ARM Cortex-X4 erratum 4118414 + * ARM Cortex-X925 erratum 4193781 + * ARM Neoverse-N1 erratum 4193800 + * ARM Neoverse-N2 erratum 4193789 + * ARM Neoverse-V1 erratum 4193790 + * ARM Neoverse-V2 erratum 4193787 + * ARM Neoverse-V3 erratum 4193784 + * ARM Neoverse-V3AE erratum 4193784 * Present in all revisions */ - if (CPU_IMPL(midr) == CPU_IMPL_ARM && - CPU_PART(midr) == CPU_PART_CORTEX_A55) - return (FEAT_DEFAULT_DISABLE); + if (CPU_IMPL(midr) == CPU_IMPL_ARM) { + switch(CPU_PART(midr)) { + case CPU_PART_C1_PREMIUM: + case CPU_PART_C1_ULTRA: + case CPU_PART_CORTEX_A76: + case CPU_PART_CORTEX_A76AE: + case CPU_PART_CORTEX_A77: + case CPU_PART_CORTEX_A78: + case CPU_PART_CORTEX_A78AE: + case CPU_PART_CORTEX_A78C: + case CPU_PART_CORTEX_A710: + case CPU_PART_CORTEX_X1: + case CPU_PART_CORTEX_X1C: + case CPU_PART_CORTEX_X2: + case CPU_PART_CORTEX_X3: + case CPU_PART_CORTEX_X4: + case CPU_PART_CORTEX_X925: + case CPU_PART_NEOVERSE_N1: + case CPU_PART_NEOVERSE_N2: + case CPU_PART_NEOVERSE_V1: + case CPU_PART_NEOVERSE_V2: + case CPU_PART_NEOVERSE_V3: + case CPU_PART_NEOVERSE_V3AE: + return (FEAT_DEFAULT_ENABLE); + } + } /* - * Cortex-A76 erratum 1286807 (Cat B rare) - * Present in r0p0 - r3p0 - * Fixed in r3p1 + * Cortex-A55 erratum 2441007 (Cat B rare) + * Present in all revisions */ - if (midr_check_var_part_range(midr, CPU_IMPL_ARM, CPU_PART_CORTEX_A76, - 0, 0, 3, 0)) + if (CPU_IMPL(midr) == CPU_IMPL_ARM && + CPU_PART(midr) == CPU_PART_CORTEX_A55) return (FEAT_DEFAULT_DISABLE); /*