From nobody Fri Jul 10 16:03:46 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gxc826Gbzz6lLQX for ; Fri, 10 Jul 2026 16:03:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gxc823BS5z3J24 for ; Fri, 10 Jul 2026 16:03:46 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783699426; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qFh701FElnvmneZ+HHRRoj2k5B/BNi0n3StLkqMNbKk=; b=vn2Ay4zc3Wg4KNAQJrmSrOmcw7p4scCXGyBTMnYVcG4YLmoenYOyp4ZNOci6/9m5ATExhH K7qZSTc0vtFGmPtrBkS5Kglo7VoN1NGy34f6Y/vP0OIH0/eI0zKtRiP3nvLTwE5WDIOGZh MVkR6HK1h3WZ5Dcua8bEAge/XrSewoVqDbqR0qf+iLdL7IfmHI88Z9bBlXYo8Xqx6UoJtl 9sJ79XgSwP6qEqSlJUry3F5q+Mk/L3JgVCpsn/bNcZj1RBcRctU14eWENlmOE/Sb0a2MGt Da1NS9iNb8MxPituGreJNSQRhdyRRV2xyMyU0n1XY5swb0ux69Wez+uYNOtYig== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1783699426; a=rsa-sha256; cv=none; b=MN2yh6HQ+fkeOjLXgfN1uWbJsCXgH8XNdCtQLtA/tPUTIGw8L6/3b7tiA8FDauRfNfQvSE QcQmBZEY4gq8DyIe/r8DN++uUqZfoXu6D/rB0lKC/bV568VGSTc+giMDIWT8YoiG0ywE9m s10+ORJM1ac/gfQRFX6AJLmgtbym5AuPEVu6Q1UIlgbF5SkfnA8Ey+nOlIgl1UjhlQqFbE CvYXAUmjVwN/OTD1rHFSbAtfXSbqQfXQebycWqmInaxxTp37i75dqquYBoFyXvQ77d8Zrv /R5bJ0tWuxcBpcxgn6sNksdBGaUySC47w7bA/gff0v9yCqNdj9qhf7zVUI9n7w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783699426; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qFh701FElnvmneZ+HHRRoj2k5B/BNi0n3StLkqMNbKk=; b=FI5mpIOaHHw5OZMwY0p0AI+M9KENPCN7QQqxzzkCw16HryxIBkxGaW4JlbZxBKeVl2uFP9 OhEbzsBlptygrPkTXzSPLxePTMRgAbNKGuYvjIxsdln2QYtXg07Ul8261WWL6YG8VbfURH 03A/f7XtTl05MNPDBE9PdywU8IHvfXOpd/gt+iVojptE47rlV2NFbDRTw6FSkySisAkG0V 4Q+KJFKqcX7rHrzGoY13Tmn7j4iC+qfmX4Uu3Z1RI8aI6GLoIUzYum46VVpAgX7Y1CFD2/ 3I4f4HWhcxYjiR5TRgNj3yk4AsSjkln8DcllOTy484RgzN15WOxpMIWgV+UPQA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gxc822FXkz11ly for ; Fri, 10 Jul 2026 16:03:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 38ab3 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 10 Jul 2026 16:03:46 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Bojan Novk=?utf-8?Q?ovi=C4=87?= Subject: git: 7a5ef20a977c - main - riscv/pmap.c: Handle spurious kernel page faults in critical sections List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bnovkov X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 7a5ef20a977c2d1ae5b94e6e6e927ac7a566ff10 Auto-Submitted: auto-generated Date: Fri, 10 Jul 2026 16:03:46 +0000 Message-Id: <6a5117e2.38ab3.772cfc8c@gitrepo.freebsd.org> The branch main has been updated by bnovkov: URL: https://cgit.FreeBSD.org/src/commit/?id=7a5ef20a977c2d1ae5b94e6e6e927ac7a566ff10 commit 7a5ef20a977c2d1ae5b94e6e6e927ac7a566ff10 Author: Bojan Novković AuthorDate: 2026-06-10 19:13:03 +0000 Commit: Bojan Novković CommitDate: 2026-07-10 15:56:57 +0000 riscv/pmap.c: Handle spurious kernel page faults in critical sections The Privileged ISA specification permits caching of invalid PTEs 12.2.1. Supervisor Memory-Management Fence Instruction), which may result in a spurious page fault. Such faults are handled by 'pmap_fault' which locks the kernel pmap before inspecting and possibly updating the offending L2 entry. Unfortunately, spurious faults may also occur when we're already holding the kernel_pmap lock or running in a critical section, where any attempt to grab the pmap lock will result in a kernel panic. Fix this avoidable panic by performing a lockless lookup to determine whether a valid kernel mapping exits and flushing appropriate TLB entry. Differential Revision: https://reviews.freebsd.org/D56925 Reviewed by: jrtc27, mhorne, markj --- sys/riscv/riscv/pmap.c | 46 +++++++++++++++++++++++++++++++++++----------- 1 file changed, 35 insertions(+), 11 deletions(-) diff --git a/sys/riscv/riscv/pmap.c b/sys/riscv/riscv/pmap.c index 35194ebd7c28..67123f9bfcc8 100644 --- a/sys/riscv/riscv/pmap.c +++ b/sys/riscv/riscv/pmap.c @@ -2911,28 +2911,52 @@ retryl3: PMAP_UNLOCK(pmap); } +static pt_entry_t * +pmap_fault_lookup(pmap_t pmap, vm_offset_t va) +{ + pd_entry_t *l2, l2e; + + l2 = pmap_l2(pmap, va); + if (l2 == NULL || ((l2e = pmap_load(l2)) & PTE_V) == 0) + return (NULL); + if ((l2e & PTE_RWX) == 0) + return (pmap_l2_to_l3(l2, va)); + return (l2); +} + int pmap_fault(pmap_t pmap, vm_offset_t va, vm_prot_t ftype) { - pd_entry_t *l2, l2e; pt_entry_t bits, *pte, oldpte; int rv; KASSERT(VIRT_IS_VALID(va), ("pmap_fault: invalid va %#lx", va)); + if (pmap == kernel_pmap) { + /* + * Locking the kernel pmap while processing spurious faults + * may lead to a panic since we might be running a critical section + * or already holding the kernel pmap lock. + * We deal with this by taking advantage of the fact that + * kernel PTPs are never freed and performing a lockless lookup + * to determine whether a valid mapping exits. + */ + pte = pmap_fault_lookup(pmap, va); + if (pte != NULL && (pmap_load(pte) & PTE_KERN) == PTE_KERN) { + sfence_vma_page(va); + return (1); + } + /* + * The entry is either not present or missing some bits. + * Fall back to the locked lookup below to handle the fault. + */ + } + rv = 0; PMAP_LOCK(pmap); - l2 = pmap_l2(pmap, va); - if (l2 == NULL || ((l2e = pmap_load(l2)) & PTE_V) == 0) + pte = pmap_fault_lookup(pmap, va); + if (pte == NULL || ((oldpte = pmap_load(pte)) & PTE_V) == 0) goto done; - if ((l2e & PTE_RWX) == 0) { - pte = pmap_l2_to_l3(l2, va); - if (((oldpte = pmap_load(pte)) & PTE_V) == 0) - goto done; - } else { - pte = l2; - oldpte = l2e; - } if ((pmap != kernel_pmap && (oldpte & PTE_U) == 0) || (ftype == VM_PROT_WRITE && (oldpte & PTE_W) == 0) ||