From nobody Tue Sep 01 19:05:23 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hZFg82J06z6rKb6 for ; Tue, 01 Sep 2026 19:05:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hZFg810Cmz3fW0 for ; Tue, 01 Sep 2026 19:05:24 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788289524; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=miHrc+ljLFXEMkNOSokaEN+o+xYqpMagWej+kb15s7U=; b=QJ7RFOadvJpKDh76CWFsS/h9PJByYGFbcXp7V4RALW7bLOKLPRbJSVf3G3yRHJbjTQ7/aT 4rEciItvl4VcFBX78P6EH1kC5FMAG7Bl7d8/vsos6PaQWW7U4FlNoTOLx7+ieiNJzEb5Gj fZgS9mlDePL8EL52LgwT9Wkfla43BAe7/FPLwHIDaHq5WjxM4dqfj6D+kLuomK6M6jYm/I pJv3uXKfGUZEBxubSsYzYg41901lICQ+w9ibxr1v4VRx4EAb9naaZ9jArOJ8rZrcZoFhfb GU+ifuPTPwZPLvrAOvZARDQz189aCI/AK6EjFZirVDA6c7aL0DIjckQYuu8tqA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1788289524; a=rsa-sha256; cv=none; b=xYIT1YIUdfcCgskbr9m0cbue/LSsUrLFh4CkhWPt5h+qlhlFIzMeowlYm3LshBJEAFkQDQ UFbp0h1zdPGi1SjuKenifc7t/0f9fY7LkgQ50TvrXuNoNlSDhmPrn6UVkI54eU61brgvlY rAiL/U6Zjsy0zFfvgfsCHq3C2163IRMRCZxr0us2CCOl7OtPEGtEp+te427Rs7kAhQ+Jt1 1EbEB+1hGEQYV7EQpg5duwnccWGOGmplXnS+RfXAH5kC/YnSGkWWglIUSZEIV39O7AcT8b WZBE8a56b0LbEL5FrmDxiJexKq6X/Y2sMelkqzxHskO7dVwXL5rxB/tIjj3nvw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788289524; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=miHrc+ljLFXEMkNOSokaEN+o+xYqpMagWej+kb15s7U=; b=WV6ox6HSTtuG21lpj9Kpm8bSWXjpZapf5xGbvxgBwUGPfOW2SXMni3LkwQkCvdC2QOmWKe MexcthCbnSeYgi7lVNI9AxwCngP6WWxhE/iSzZBy+mt4elPxKNtgbNjxK9AC17PiIwEakA AY1eB7o4Ut45ZCgLiTlgxu8W2wEGSME2u0FfJJ3R7YC3iPDofkTaNPuV6q1unMkuigJMpw ntR6r+nKMSj5caNSMQSkXQZc0fYsVKcRv7dmWDk9oKzxoBF5o6iBErUZuRfZk4pqzA/SSr 0rcqxedrqHbnR4C1gsG4a/ncMwJig0w9c6q47HGVHifb3sxznwF7dPyw8DpTZA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hZFg76QqWz19Hy for ; Tue, 01 Sep 2026 19:05:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 426fd by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 01 Sep 2026 19:05:23 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Piotr Kubaj Subject: git: 1574ca1955f5 - main - powerpc/radix: take the pmap lock in mmu_radix_sync_icache() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: pkubaj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 1574ca1955f55151c4c76b978c8a772ac3abfa9f Auto-Submitted: auto-generated Date: Tue, 01 Sep 2026 19:05:23 +0000 Message-Id: <6a9721f3.426fd.746eb9fd@gitrepo.freebsd.org> The branch main has been updated by pkubaj: URL: https://cgit.FreeBSD.org/src/commit/?id=1574ca1955f55151c4c76b978c8a772ac3abfa9f commit 1574ca1955f55151c4c76b978c8a772ac3abfa9f Author: Piotr Kubaj AuthorDate: 2026-09-01 06:52:06 +0000 Commit: Piotr Kubaj CommitDate: 2026-09-01 19:05:09 +0000 powerpc/radix: take the pmap lock in mmu_radix_sync_icache() mmu_radix_sync_icache() walked the page tables with an unlocked pmap_extract() and passed the result straight to PHYS_TO_DMAP(), checking only that it was non-zero. Nothing keeps the mapping - or the page table page holding it - alive across that window: if another thread of the same process tears a mapping down concurrently, the page table page can be freed and reused, so pmap_extract() reads arbitrary memory and returns a bogus physical address. __syncicache() then dereferences an unmapped direct map address and the kernel takes a data storage interrupt: fatal kernel trap: exception = 0x300 (data storage interrupt) virtual address = 0xc003317ca6022a00 dsisr = 0x40000000 srr0 = 0xc000000000f59460 (__syncicache) lr = 0xc000000000f23588 (mmu_radix_sync_icache) pid = 23878, comm = skyframe-evaluator- panic: data storage interrupt trap The faulting addresses decode to physical addresses far beyond installed memory (~140 TB and ~900 TB on a 256 GB machine), i.e. translations that never existed. The hash MMU implementation of the same method, moea64_sync_icache(), already holds PMAP_LOCK() across the loop; do the same here. mmu_radix_extract() does not acquire the pmap lock itself, so this introduces no recursion. JIT workloads reach this path constantly: ppc_instr_emulate() calls pmap_sync_icache() on the faulting address for the SIGILL "second chance" retry, so a multithreaded JVM executing freshly written code races against its own threads' mmap/munmap. Every panic observed here was in a JVM thread. Tested on POWER9 (radix MMU) with a bazel/JVM build loop that previously panicked the machine twice within ten minutes: afterwards 13 consecutive builds and more than 10 hours of uptime with no panic, on both 15.1-RELEASE and 16.0-CURRENT. MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D59311 Reviewed by: jhibbits, adrian --- sys/powerpc/aim/mmu_radix.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sys/powerpc/aim/mmu_radix.c b/sys/powerpc/aim/mmu_radix.c index 7df54408838e..0d958f0ebc5e 100644 --- a/sys/powerpc/aim/mmu_radix.c +++ b/sys/powerpc/aim/mmu_radix.c @@ -5978,6 +5978,7 @@ mmu_radix_sync_icache(pmap_t pm, vm_offset_t va, vm_size_t sz) if (__predict_false(pm == NULL)) pm = &curthread->td_proc->p_vmspace->vm_pmap; + PMAP_LOCK(pm); while (sz > 0) { pa = pmap_extract(pm, va); sync_sz = PAGE_SIZE - (va & PAGE_MASK); @@ -5989,6 +5990,7 @@ mmu_radix_sync_icache(pmap_t pm, vm_offset_t va, vm_size_t sz) va += sync_sz; sz -= sync_sz; } + PMAP_UNLOCK(pm); } static __inline void