Suppose that CPU n is not recorded in pm_active when mask is assigned, but later it activates the pmap. What would ensure that CPU n observes page table updates made before pmap_invalidate_page() call ?

Before the patch, when fence() was performed unconditionally, we could state that this fence would sync/w a fence necessary performed in the course of the context switch.

When pmap_activate() is called from the context switch code, critical_enter/exit only waste cpu cycles.

Why do you need l1 phys address in pcb ?

I know @kib suggested removing the L1 PA from the PCB, but what about storing it in the pmap to avoid calls to vtophys() during cpu_switch?

For that matter, you could just store the full %satp value to save a few more instructions so you would end up just doing 'load_satp(pmap->pm_satp)'.

Technically the privilege spec (1.10) says to invoke sfence.vma() prior to loading a new SATP value:

Note that writing satp does not imply any ordering constraints between page-table updates and subsequent address translations. If the new address space’s page tables have been modified, it may be necessary to execute an SFENCE.VMA instruction (see Section 4.2.1) prior to writing satp.

Though I think we are probably fine to invalidate afterward?

Also, I don't think we want the full 'pmap_invalidate_all' as that is going to maybe do an IPI. I think we just want to do a local invalidation solely on the current hart here via sfence_vma() which would match what the old code in assembly was doing. I think that is always true for all calls to this function as it isn't modifying the page tables, just modifying which page tables the current CPU is using.