From nobody Mon Sep 21 08:04:05 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hpG2s69nPz6tRFK for ; Mon, 21 Sep 2026 08:04:05 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hpG2s5Yfsz4jrd for ; Mon, 21 Sep 2026 08:04:05 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1789977845; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bRzp5UkAxzpiXn7IgihSQ/MJ6dvAFdcghTNe8D+Y4Ug=; b=iyBfkWC4fRXP8J7081ri2KiXLZENlvBf0GSLVii/Rob8zJqKMFKqVRpWl5TF1jVKVV5WqC Tall8YLch5rXbbh/6+nW/cNX5ULq+70mB64xq3uunt+xhsW+Vp3lZdX0hhBqFaFfqoZdyr E+fMh6mjNZRxEHzJq4UT8th7y5NPAat450b1yLfS2uHkEuSmIDHScyXgZhtWlOLAsTi+0A e81HFSvAtTFteyzUxXtBJJ8bv3Iqj5WKUMhb3VQ2e1fsNyWIOcc7el9o3+uRapzdI8ebuy 3dT4pZpsDVGrWneV06dCthPRY4E0aye/MjQlOD3tSvlihzAOEAYN6vJ951ERFA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1789977845; b=WgAZM/gJLIOgYyVzoQnKPPKiNpc76nE0NC+2sc71mI72qir2q+8tUIXZeXRFHwM2VgmEkw 4j21mmkwKONMwfBsYNh66S0QHtu731QQPD7ChSZE1TxD42R322Io9ZDQu01bgcG9K3Eepm QQ2wL2fXIAcvo1E8Pn2r3jMCATZFkVKRY26tYT2cNVvL8p4siWED3hAVwOOKREEUyTawXy iYtzroVhtzwnis6t2NNZb0VWfKd99XTjk26exFVCeAC+bF/Hbhbq8KCQrAB7UA053h8n9x 2gvf/GsZftvzWXXxkNbwGmunZAS38F7DqgDKzcOtEs9cHRiTy2YuG4fkGkU6eA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1789977845; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bRzp5UkAxzpiXn7IgihSQ/MJ6dvAFdcghTNe8D+Y4Ug=; b=IAAv+BZF6pn6b9XWx562ziV9a7yKJ1IIqRPGSjW+rCpnWJNP+NsDV04KRVHK/71HdKegfh Pj8hBKKZXo2dwNaEZU5i2a4kmDp/j5ZRKpZzAVEojRkuW/sZk6myt1r3dbqN+tT9hZw8Ne QkJn1WQIgqjuaN/GLKOf+Q0FfR9dM9XOlbhVmJ38Dek8jW8F34FGowsCRHRWSw+gcUqg1e 3vId0zjgOV25uGK1UonrUBMdLWFNA92kQksiC2YOKqSjwaqnE5ZwB5Zk2Q4EQLXBo1wEHF ounRISKKwjV4wWWj9cEm4L65QqWGZ6eAMxC9iVfj9iYC/A0GHBP3MBVTnxBKuw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hpG2s4fD0z1BMK for ; Mon, 21 Sep 2026 08:04:05 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 47d74 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 21 Sep 2026 08:04:05 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Piotr Kubaj Subject: git: ab2e484d0526 - stable/14 - powerpc/radix: take the pmap lock in mmu_radix_sync_icache() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: pkubaj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: ab2e484d052652b77e979d63d051b7685476c07d Auto-Submitted: auto-generated Date: Mon, 21 Sep 2026 08:04:05 +0000 Message-Id: <6ab0e4f5.47d74.175f014c@gitrepo.freebsd.org> The branch stable/14 has been updated by pkubaj: URL: https://cgit.FreeBSD.org/src/commit/?id=ab2e484d052652b77e979d63d051b7685476c07d commit ab2e484d052652b77e979d63d051b7685476c07d Author: Piotr Kubaj AuthorDate: 2026-09-01 06:52:06 +0000 Commit: Piotr Kubaj CommitDate: 2026-09-21 07:52:26 +0000 powerpc/radix: take the pmap lock in mmu_radix_sync_icache() mmu_radix_sync_icache() walked the page tables with an unlocked pmap_extract() and passed the result straight to PHYS_TO_DMAP(), checking only that it was non-zero. Nothing keeps the mapping - or the page table page holding it - alive across that window: if another thread of the same process tears a mapping down concurrently, the page table page can be freed and reused, so pmap_extract() reads arbitrary memory and returns a bogus physical address. __syncicache() then dereferences an unmapped direct map address and the kernel takes a data storage interrupt: fatal kernel trap: exception = 0x300 (data storage interrupt) virtual address = 0xc003317ca6022a00 dsisr = 0x40000000 srr0 = 0xc000000000f59460 (__syncicache) lr = 0xc000000000f23588 (mmu_radix_sync_icache) pid = 23878, comm = skyframe-evaluator- panic: data storage interrupt trap The faulting addresses decode to physical addresses far beyond installed memory (~140 TB and ~900 TB on a 256 GB machine), i.e. translations that never existed. The hash MMU implementation of the same method, moea64_sync_icache(), already holds PMAP_LOCK() across the loop; do the same here. mmu_radix_extract() does not acquire the pmap lock itself, so this introduces no recursion. JIT workloads reach this path constantly: ppc_instr_emulate() calls pmap_sync_icache() on the faulting address for the SIGILL "second chance" retry, so a multithreaded JVM executing freshly written code races against its own threads' mmap/munmap. Every panic observed here was in a JVM thread. Tested on POWER9 (radix MMU) with a bazel/JVM build loop that previously panicked the machine twice within ten minutes: afterwards 13 consecutive builds and more than 10 hours of uptime with no panic, on both 15.1-RELEASE and 16.0-CURRENT. MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D59311 Reviewed by: jhibbits, adrian (cherry picked from commit 1574ca1955f55151c4c76b978c8a772ac3abfa9f) --- sys/powerpc/aim/mmu_radix.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sys/powerpc/aim/mmu_radix.c b/sys/powerpc/aim/mmu_radix.c index 78c57badee55..089b4af6bd93 100644 --- a/sys/powerpc/aim/mmu_radix.c +++ b/sys/powerpc/aim/mmu_radix.c @@ -5936,6 +5936,7 @@ mmu_radix_sync_icache(pmap_t pm, vm_offset_t va, vm_size_t sz) if (__predict_false(pm == NULL)) pm = &curthread->td_proc->p_vmspace->vm_pmap; + PMAP_LOCK(pm); while (sz > 0) { pa = pmap_extract(pm, va); sync_sz = PAGE_SIZE - (va & PAGE_MASK); @@ -5947,6 +5948,7 @@ mmu_radix_sync_icache(pmap_t pm, vm_offset_t va, vm_size_t sz) va += sync_sz; sz -= sync_sz; } + PMAP_UNLOCK(pm); } static __inline void