When freeing PTP pages, we need to wait until TLB shootdown has been done until we put them on the freelist and risk them being reused.
When freeing PTP pages, we need to wait until TLB shootdown has been
done until we put them on the freelist and risk them being reused.

If the page is reused before being shot, there's a risk that it's still
in the PDE TLB and speculative execution might use data from it to
load TLBs. If the page isn't zeroed anymore we risk loading bogus
tlbs from it.

Inspired by a similar change in NetBSD.

toby@ ok, tested by many at the hackathon.

orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars