[Midnightbsd-cvs] [MidnightBSD/src] a35d93: arm64: fix CPU errata TLB invalidation ordering (C...
Lucas Holt
noreply at github.com
Wed Jun 10 21:13:42 EDT 2026
Branch: refs/heads/master
Home: https://github.com/MidnightBSD/src
Commit: a35d93d9ac3311e0401f3fd7d6ec45e85f9c1d51
https://github.com/MidnightBSD/src/commit/a35d93d9ac3311e0401f3fd7d6ec45e85f9c1d51
Author: Lucas Holt <luke at foolishgames.com>
Date: 2026-06-10 (Wed, 10 Jun 2026)
Changed paths:
M sys/arm64/arm64/cpu_errata.c
M sys/arm64/arm64/pmap.c
M sys/arm64/include/cpu.h
Log Message:
-----------
arm64: fix CPU errata TLB invalidation ordering (CVE-2025-10263)
Several Arm CPU families have an erratum where stores may not be globally
observed before a TLBI+DSB sequence completes on another CPU. This can
allow software to write to a location after page table permissions are
changed to forbid writes, potentially enabling privilege escalation.
Affected CPUs: C1-Premium, C1-Ultra, Cortex-A76/A76AE/A77/A78/A78AE/A78C,
Cortex-A710, Cortex-X1/X1C/X2/X3/X4/X925, Neoverse-N1/N2/V1/V2/V3/V3AE.
Fix by issuing a second TLBI instruction after an intermediate DSB in
pmap_invalidate_page, pmap_invalidate_range, and pmap_invalidate_all
when the affected CPU is detected at boot.
Detection uses the existing cpu_quirks errata framework in cpu_errata.c.
Add missing CPU part number constants for newer Arm cores to cpu.h.
Security: CVE-2025-10263
Security: FreeBSD-SA-26:31.arm64
Co-Authored-By: Claude Sonnet 4.6 <noreply at anthropic.com>
Commit: a84d00fd3dfb8fefb083acb95769b32e6322b2f5
https://github.com/MidnightBSD/src/commit/a84d00fd3dfb8fefb083acb95769b32e6322b2f5
Author: Lucas Holt <luke at foolishgames.com>
Date: 2026-06-10 (Wed, 10 Jun 2026)
Changed paths:
R .gitattributes
M Changelog
M Makefile.in
M README
R README-Travis.md
M README.snapshots
M acx_nlnetlabs.m4
M ax_python_devel.m4
A compat/asctime_r.c
M config.guess
M config.sub
M configure
M configure.ac
R contrib/DNS-LDNS/Changes
R contrib/DNS-LDNS/LDNS.xs
R contrib/DNS-LDNS/LICENSE
R contrib/DNS-LDNS/MANIFEST
R contrib/DNS-LDNS/META.yml
R contrib/DNS-LDNS/Makefile.PL
R contrib/DNS-LDNS/README
R contrib/DNS-LDNS/constants.PL
R contrib/DNS-LDNS/dist.ini
R contrib/DNS-LDNS/lib/DNS/LDNS.pm
R contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecDataChain.pm
R contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecName.pm
R contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecRRSets.pm
R contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecRRs.pm
R contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecTrustTree.pm
R contrib/DNS-LDNS/lib/DNS/LDNS/DNSSecZone.pm
R contrib/DNS-LDNS/lib/DNS/LDNS/GC.pm
R contrib/DNS-LDNS/lib/DNS/LDNS/Key.pm
R contrib/DNS-LDNS/lib/DNS/LDNS/KeyList.pm
R contrib/DNS-LDNS/lib/DNS/LDNS/Packet.pm
R contrib/DNS-LDNS/lib/DNS/LDNS/RBNode.pm
R contrib/DNS-LDNS/lib/DNS/LDNS/RBTree.pm
R contrib/DNS-LDNS/lib/DNS/LDNS/RData.pm
R contrib/DNS-LDNS/lib/DNS/LDNS/RR.pm
R contrib/DNS-LDNS/lib/DNS/LDNS/RRList.pm
R contrib/DNS-LDNS/lib/DNS/LDNS/Resolver.pm
R contrib/DNS-LDNS/lib/DNS/LDNS/Zone.pm
R contrib/DNS-LDNS/ppport.h
R contrib/DNS-LDNS/t/DNS-LDNS.t
R contrib/DNS-LDNS/t/dnssec_datachain.t
R contrib/DNS-LDNS/t/dnssec_zone.t
R contrib/DNS-LDNS/t/key.t
R contrib/DNS-LDNS/t/rdata.t
R contrib/DNS-LDNS/t/resolver.t
R contrib/DNS-LDNS/t/rr.t
R contrib/DNS-LDNS/t/rrlist.t
R contrib/DNS-LDNS/t/testdata/key.private
R contrib/DNS-LDNS/t/testdata/myzone.org
R contrib/DNS-LDNS/t/testdata/resolv.conf
R contrib/DNS-LDNS/t/zone.t
R contrib/DNS-LDNS/typemap
R contrib/android/15-android.conf
R contrib/android/bootstrap_ldns.sh
R contrib/android/install_ndk.sh
R contrib/android/install_openssl.sh
R contrib/android/install_tools.sh
R contrib/android/setenv_android.sh
R contrib/ios/15-ios.conf
R contrib/ios/bootstrap_ldns.sh
R contrib/ios/install_openssl.sh
R contrib/ios/install_tools.sh
R contrib/ios/openssl.patch
R contrib/ios/setenv_ios.sh
M contrib/ldnsx/ldnsx.py
M contrib/python/ldns.i
M contrib/python/ldns_rdf.i
M dane.c
M dnssec.c
M dnssec_sign.c
M dnssec_zone.c
M doc/doxyparse.pl
M doc/ldns_manpages
M doc/man/man3/ldns_algorithm.3
M doc/man/man3/ldns_axfr_start.3
M doc/man/man3/ldns_b32_ntop_calculate_size.3
M doc/man/man3/ldns_bget_token.3
M doc/man/man3/ldns_bubblebabble.3
M doc/man/man3/ldns_buffer.3
M doc/man/man3/ldns_buffer2pkt_wire.3
M doc/man/man3/ldns_buffer_flip.3
M doc/man/man3/ldns_buffer_limit.3
M doc/man/man3/ldns_buffer_remaining_at.3
M doc/man/man3/ldns_buffer_write_at.3
M doc/man/man3/ldns_calc_keytag.3
M doc/man/man3/ldns_create_nsec.3
M doc/man/man3/ldns_dane_create_tlsa_rr.3
M doc/man/man3/ldns_dane_verify.3
M doc/man/man3/ldns_dname2canonical.3
M doc/man/man3/ldns_dname_cat_clone.3
M doc/man/man3/ldns_dname_compare.3
M doc/man/man3/ldns_dname_is_subdomain.3
M doc/man/man3/ldns_dname_left_chop.3
M doc/man/man3/ldns_dname_new.3
M doc/man/man3/ldns_dnssec_data_chain.3
M doc/man/man3/ldns_dnssec_data_chain_new.3
M doc/man/man3/ldns_dnssec_name_new.3
M doc/man/man3/ldns_dnssec_rrs_new.3
M doc/man/man3/ldns_dnssec_rrsets_new.3
M doc/man/man3/ldns_dnssec_trust_tree_new.3
M doc/man/man3/ldns_dnssec_verify_denial.3
M doc/man/man3/ldns_dnssec_zone.3
M doc/man/man3/ldns_dnssec_zone_find_rrset.3
M doc/man/man3/ldns_dnssec_zone_sign.3
M doc/man/man3/ldns_duration_type.3
M doc/man/man3/ldns_fget_token.3
M doc/man/man3/ldns_get_errorstr_by_id.3
M doc/man/man3/ldns_get_rr_class_by_name.3
M doc/man/man3/ldns_get_rr_list_addr_by_name.3
M doc/man/man3/ldns_get_rr_list_hosts_frm_file.3
M doc/man/man3/ldns_getaddrinfo.3
M doc/man/man3/ldns_init_random.3
M doc/man/man3/ldns_is_rrset.3
M doc/man/man3/ldns_key.3
M doc/man/man3/ldns_key2rr.3
M doc/man/man3/ldns_key_buf2dsa.3
M doc/man/man3/ldns_key_free.3
M doc/man/man3/ldns_key_list_key_count.3
M doc/man/man3/ldns_key_list_new.3
M doc/man/man3/ldns_key_list_push_key.3
M doc/man/man3/ldns_key_new.3
M doc/man/man3/ldns_key_print.3
M doc/man/man3/ldns_key_rr2ds.3
M doc/man/man3/ldns_key_set_algorithm.3
M doc/man/man3/ldns_native2rdf_int8.3
M doc/man/man3/ldns_octet.3
M doc/man/man3/ldns_pkt.3
M doc/man/man3/ldns_pkt2buffer_str.3
M doc/man/man3/ldns_pkt_edns.3
M doc/man/man3/ldns_pkt_id.3
M doc/man/man3/ldns_pkt_new.3
M doc/man/man3/ldns_pkt_set_flags.3
M doc/man/man3/ldns_pkt_tsig_verify.3
M doc/man/man3/ldns_pkt_verify.3
M doc/man/man3/ldns_rdf.3
M doc/man/man3/ldns_rdf2buffer_str_a.3
M doc/man/man3/ldns_rdf_address_reverse.3
M doc/man/man3/ldns_rdf_new.3
M doc/man/man3/ldns_rdf_set_size.3
M doc/man/man3/ldns_rdf_size.3
M doc/man/man3/ldns_rr.3
M doc/man/man3/ldns_rr2canonical.3
M doc/man/man3/ldns_rr2str.3
M doc/man/man3/ldns_rr2wire.3
M doc/man/man3/ldns_rr_compare.3
M doc/man/man3/ldns_rr_descriptor.3
M doc/man/man3/ldns_rr_dnskey_flags.3
M doc/man/man3/ldns_rr_label_count.3
M doc/man/man3/ldns_rr_list_cat.3
M doc/man/man3/ldns_rr_list_clone.3
M doc/man/man3/ldns_rr_list_new.3
M doc/man/man3/ldns_rr_list_rr_count.3
M doc/man/man3/ldns_rr_list_sort.3
M doc/man/man3/ldns_rr_mx_preference.3
M doc/man/man3/ldns_rr_new.3
M doc/man/man3/ldns_rr_ns_nsdname.3
M doc/man/man3/ldns_rr_push_rdf.3
M doc/man/man3/ldns_rr_rdf.3
M doc/man/man3/ldns_rr_rrsig_typecovered.3
M doc/man/man3/ldns_rr_set_owner.3
M doc/man/man3/ldns_rr_set_push_rr.3
M doc/man/man3/ldns_rr_uncompressed_size.3
M doc/man/man3/ldns_send.3
M doc/man/man3/ldns_sign_public.3
M doc/man/man3/ldns_sign_public_dsa.3
M doc/man/man3/ldns_str2period.3
M doc/man/man3/ldns_tcp_send_query.3
M doc/man/man3/ldns_update_pkt_new.3
M doc/man/man3/ldns_update_pkt_tsig_add.3
M doc/man/man3/ldns_update_set_zocount.3
M doc/man/man3/ldns_update_zocount.3
M doc/man/man3/ldns_verify.3
M doc/man/man3/ldns_verify_rrsig_dsa.3
M doc/man/man3/ldns_version.3
M doc/man/man3/ldns_wire2rr.3
M doc/man/man3/ldns_zone.3
M doc/man/man3/ldns_zone_push_rr.3
M doc/man/man3/ldns_zone_rr_count.3
M doc/man/man3/ldns_zone_rrs.3
M doc/man/man3/ldns_zone_set_rrs.3
M doc/man/man3/ldns_zone_sign.3
M doc/man/man3/ldns_zone_sort.3
M drill/drill.1.in
M drill/drill.c
M drill/root.c
M edns.c
M error.c
M examples/ldns-chaos.1
M examples/ldns-dane.1.in
M examples/ldns-dpa.1
M examples/ldns-gen-zone.1
M examples/ldns-key2ds.1
M examples/ldns-keyfetcher.1
M examples/ldns-keygen.1
M examples/ldns-keygen.c
M examples/ldns-mx.1
M examples/ldns-notify.1
M examples/ldns-notify.c
M examples/ldns-nsec3-hash.1
M examples/ldns-nsec3-hash.c
M examples/ldns-read-zone.1
M examples/ldns-resolver.1
M examples/ldns-revoke.1
M examples/ldns-rrsig.1
M examples/ldns-signzone.1
M examples/ldns-signzone.c
M examples/ldns-test-edns.1
M examples/ldns-testns.1
M examples/ldns-testns.c
M examples/ldns-testpkts.c
M examples/ldns-testpkts.h
M examples/ldns-update.1
M examples/ldns-verify-zone.1.in
M examples/ldns-version.1
M examples/ldns-walk.1
M examples/ldns-walk.c
M examples/ldns-zcat.1
M examples/ldns-zsplit.1
M examples/ldnsd.1
M host2str.c
M keys.c
M ldns/config.h.in
M ldns/edns.h
M ldns/error.h
M ldns/net.h.in
M ldns/parse.h
M ldns/radix.h
M ldns/rdata.h
M ldns/rr.h
R libdns.doxygen
M libdns.doxygen.in
M ltmain.sh
M m4/libtool.m4
M m4/ltoptions.m4
M m4/ltsugar.m4
M m4/ltversion.m4
M m4/lt~obsolete.m4
M makewin.sh
M net.c
M packaging/ldns-config.1
M packet.c
M parse.c
M resolver.c
M rr.c
M util.c
M wire2host.c
Log Message:
-----------
Vendor import of ldns 1.8.4
Commit: bb9bff28830a04eaa61d3711a2bd6e46303c9e9b
https://github.com/MidnightBSD/src/commit/bb9bff28830a04eaa61d3711a2bd6e46303c9e9b
Author: Lucas Holt <luke at foolishgames.com>
Date: 2026-06-10 (Wed, 10 Jun 2026)
Changed paths:
M UPDATING
Log Message:
-----------
UPDATING: note CVE-2025-10263 arm64 TLBI errata fix
Commit: afc7cbe1810181df29041c924d4ba1f8ab53b482
https://github.com/MidnightBSD/src/commit/afc7cbe1810181df29041c924d4ba1f8ab53b482
Author: Lucas Holt <luke at foolishgames.com>
Date: 2026-06-10 (Wed, 10 Jun 2026)
Changed paths:
R contrib/ldns/.gitattributes
M contrib/ldns/Changelog
M contrib/ldns/Makefile.in
M contrib/ldns/README
R contrib/ldns/README-Travis.md
M contrib/ldns/README.snapshots
M contrib/ldns/acx_nlnetlabs.m4
M contrib/ldns/ax_python_devel.m4
A contrib/ldns/compat/asctime_r.c
M contrib/ldns/config.guess
M contrib/ldns/config.sub
M contrib/ldns/configure
M contrib/ldns/configure.ac
M contrib/ldns/dane.c
M contrib/ldns/dnssec.c
M contrib/ldns/dnssec_sign.c
M contrib/ldns/dnssec_zone.c
M contrib/ldns/drill/drill.1.in
M contrib/ldns/drill/drill.c
M contrib/ldns/drill/root.c
M contrib/ldns/edns.c
M contrib/ldns/error.c
M contrib/ldns/host2str.c
M contrib/ldns/keys.c
M contrib/ldns/ldns/config.h.in
M contrib/ldns/ldns/edns.h
M contrib/ldns/ldns/error.h
M contrib/ldns/ldns/net.h.in
M contrib/ldns/ldns/parse.h
M contrib/ldns/ldns/radix.h
M contrib/ldns/ldns/rdata.h
M contrib/ldns/ldns/rr.h
M contrib/ldns/libdns.doxygen.in
M contrib/ldns/ltmain.sh
M contrib/ldns/m4/libtool.m4
M contrib/ldns/m4/ltoptions.m4
M contrib/ldns/m4/ltsugar.m4
M contrib/ldns/m4/ltversion.m4
M contrib/ldns/m4/lt~obsolete.m4
M contrib/ldns/makewin.sh
M contrib/ldns/net.c
M contrib/ldns/packaging/ldns-config.1
M contrib/ldns/packet.c
M contrib/ldns/rr.c
M contrib/ldns/util.c
Log Message:
-----------
Merge commit 'a84d00fd3dfb8fefb083acb95769b32e6322b2f5'
Commit: 715cc0ba02aaf795dd99febd4151feba1d4bb4e1
https://github.com/MidnightBSD/src/commit/715cc0ba02aaf795dd99febd4151feba1d4bb4e1
Author: Lucas Holt <luke at foolishgames.com>
Date: 2026-06-10 (Wed, 10 Jun 2026)
Changed paths:
A contrib/ldns/MIDNIGHTBSD-upgrade
Log Message:
-----------
ldns: add MIDNIGHTBSD-upgrade
Commit: da4a27f4584edd7e1bc0874e8b9894c63ede030e
https://github.com/MidnightBSD/src/commit/da4a27f4584edd7e1bc0874e8b9894c63ede030e
Author: Lucas Holt <luke at foolishgames.com>
Date: 2026-06-10 (Wed, 10 Jun 2026)
Changed paths:
M UPDATING
Log Message:
-----------
UPDATING: note ldns 1.8.4
Compare: https://github.com/MidnightBSD/src/compare/8b90ecc24202...da4a27f4584e
To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications
More information about the Midnightbsd-cvs
mailing list