KASSERT(l->l_md.md_gc_ptp == NULL)

[KAMADA Ken'ichi <kamada%nanohz.org@localhost>]

Hello,

Can someone with knowledge of x86 pmap can look at PR kern/49691?
<http://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=49691>

A zombie LWP has non-NULL l->l_md.md_gc_ptp on exit, and the kernel
panics by a KASSERT.  The attached patch works around the panic.

My question is whether an LWP is expected to have non-NULL md_gc_ptp
when becoming a zombie at all.  If it is, we can just free it in
lwp_exit (my patch do this).  If not, we need to determine the
underlying cause: why md_gc_ptp has not been released earlier.

Ken

Index: sys/arch/x86/include/pmap.h
===================================================================
RCS file: /cvsroot/src/sys/arch/x86/include/pmap.h,v
retrieving revision 1.55.4.1
diff -u -r1.55.4.1 pmap.h
--- sys/arch/x86/include/pmap.h	23 Apr 2015 07:31:16 -0000	1.55.4.1
+++ sys/arch/x86/include/pmap.h	23 Jun 2015 14:41:07 -0000
@@ -269,6 +269,8 @@
 		    pd_entry_t * const **);
 void		pmap_unmap_ptes(struct pmap *, struct pmap *);
 
+void		pmap_free_ptps(struct vm_page *);
+
 int		pmap_pdes_invalid(vaddr_t, pd_entry_t * const *, pd_entry_t *);
 
 u_int		x86_mmap_flags(paddr_t);
Index: sys/arch/x86/x86/pmap.c
===================================================================
RCS file: /cvsroot/src/sys/arch/x86/x86/pmap.c,v
retrieving revision 1.183.2.2
diff -u -r1.183.2.2 pmap.c
--- sys/arch/x86/x86/pmap.c	23 Apr 2015 07:31:16 -0000	1.183.2.2
+++ sys/arch/x86/x86/pmap.c	23 Jun 2015 14:41:08 -0000
@@ -2399,7 +2399,7 @@
  * pmap_free_ptps: put a list of ptps back to the freelist.
  */
 
-static void
+void
 pmap_free_ptps(struct vm_page *empty_ptps)
 {
 	struct vm_page *ptp;
Index: sys/arch/x86/x86/vm_machdep.c
===================================================================
RCS file: /cvsroot/src/sys/arch/x86/x86/vm_machdep.c,v
retrieving revision 1.25
diff -u -r1.25 vm_machdep.c
--- sys/arch/x86/x86/vm_machdep.c	11 Mar 2014 20:55:19 -0000	1.25
+++ sys/arch/x86/x86/vm_machdep.c	23 Jun 2015 14:41:09 -0000
@@ -241,6 +241,11 @@
 void
 cpu_lwp_free(struct lwp *l, int proc)
 {
+	struct vm_page *empty_ptps;
+
+	empty_ptps = l->l_md.md_gc_ptp;
+	l->l_md.md_gc_ptp = NULL;
+	pmap_free_ptps(empty_ptps);
 
 	/* If we were using the FPU, forget about it. */
 	fpusave_lwp(l, false);