Sun May 23 19:13:27 2021 UTC ()

Fix a bug in pmap_tlb_shootdown_all_user(), where it was not
stashing away the pointer to the pmap in the TLB context structure
like pmap_tlb_shootdown() was doing.  This would result in the
following failure scenario:

- Page fault handler calls pmap_enter() to map a page.  Mapping
  is the first one for that L2 PT L3 PT, meaning that an L2 PT
  and an L3 PT must be allocated.
- L2 PT allocation succeeds.
- L3 PT allocation fails under memory pressure.
- pmap_enter() goes to drop the reference on the L2 PT, which, because
  it was the first of its mappings, frees the L2 PT.  Becuse PALcode
  may have already tried to service a TLB miss though that L2 PT, we
  must issue an all-user-VA shootdown, and call pmap_tlb_shootdown_all_user()
  to do so.
- pmap_tlb_shootnow() is called and an assert fires because the TLB
  context structure does not point to a pmap.

This did not fail in the pmap_remove() scenario because the TLB context
would have already had at least one call to pmap_tlb_shootdown(), which
was initializing the pmap pointer properly.

PR port-alpha/56200


(thorpej)

diff -r1.276 -r1.277 src/sys/arch/alpha/alpha/pmap.c

--- src/sys/arch/alpha/alpha/pmap.c 2021/04/03 15:29:02	1.276
+++ src/sys/arch/alpha/alpha/pmap.c 2021/05/23 19:13:27	1.277

 @@ -1,14 +1,14 @@
-/* $NetBSD: pmap.c,v 1.276 2021/04/03 15:29:02 thorpej Exp $ */
+/* $NetBSD: pmap.c,v 1.277 2021/05/23 19:13:27 thorpej Exp $ */
 /*-
  * Copyright (c) 1998, 1999, 2000, 2001, 2007, 2008, 2020
  * 	The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility,
  * NASA Ames Research Center, by Andrew Doran and Mindaugas Rasiukevicius,
  * and by Chris G. Demetriou.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
 @@ -125,27 +125,27 @@
  *	this module may delay invalidate or reduced protection
  *	operations until such time as they are actually
  *	necessary.  This module is given full information as
  *	to which processors are currently using which maps,
  *	and to when physical maps must be made correct.
  */
 #include "opt_lockdebug.h"
 #include "opt_sysv.h"
 #include "opt_multiprocessor.h"
 #include <sys/cdefs.h>			/* RCS ID & Copyright macro defns */
-__KERNEL_RCSID(0, "$NetBSD: pmap.c,v 1.276 2021/04/03 15:29:02 thorpej Exp $");
+__KERNEL_RCSID(0, "$NetBSD: pmap.c,v 1.277 2021/05/23 19:13:27 thorpej Exp $");
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/proc.h>
 #include <sys/malloc.h>
 #include <sys/pool.h>
 #include <sys/buf.h>
 #include <sys/evcnt.h>
 #include <sys/atomic.h>
 #include <sys/cpu.h>
 #include <uvm/uvm.h>
 @@ -733,26 +733,29 @@ static void
 pmap_tlb_shootdown_all_user(pmap_t const pmap, pt_entry_t const pte_bits,
     struct pmap_tlb_context * const tlbctx)
+{
 	KASSERT(pmap != pmap_kernel());
 	TLB_COUNT(shootdown_all_user);
 	/* Note if an I-stream sync is also needed. */
 	if (pte_bits & PG_EXEC) {
 		TLB_COUNT(shootdown_all_user_imb);
 		TLB_CTX_SET_FLAG(tlbctx, TLB_CTX_F_IMB);
+	}
 	KASSERT(tlbctx->t_pmap == NULL || tlbctx->t_pmap == pmap);
 	tlbctx->t_pmap = pmap;
 	TLB_CTX_SET_ALLVA(tlbctx);
+}
 static void
 pmap_tlb_shootdown_pv(const pv_entry_t pv, pt_entry_t const pte_bits,
     struct pmap_tlb_context * const tlbctx)
+{
 	uintptr_t flags = TLB_CTX_F_PV;
 	TLB_COUNT(shootdown_pv);
 	if (tlbctx->t_pmap == NULL || tlbctx->t_pmap == pv->pv_pmap) {
 		if (tlbctx->t_pmap == NULL) {