untrusted comment: verify with openbsd-68-base.pub
RWQZj25CSG5R2g9zYicLsPqttgR/D9AT3xvMoXLMjg+M0xwjaXI64knuaMJi985edBofoYOvlvl2b0Jrn8JLglfSssn6vyZAtgU=

OpenBSD 6.8 errata 023, June 8, 2021:

Recent Intel or any AMD machines could crash as the kernel did not
flush all TLBs that multi threaded processes require.

Apply by doing:
   signify -Vep /etc/signify/openbsd-68-base.pub -x 023_cpuswitch.patch.sig \
       -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
   KK=`sysctl -n kern.osversion | cut -d# -f1`
   cd /usr/src/sys/arch/`machine`/compile/$KK
   make obj
   make config
   make
   make install

Index: sys/arch/amd64/amd64/locore.S
===================================================================
RCS file: /cvs/src/sys/arch/amd64/amd64/locore.S,v
diff -u -p -r1.120 locore.S
--- sys/arch/amd64/amd64/locore.S       17 May 2020 13:48:30 -0000      1.120
+++ sys/arch/amd64/amd64/locore.S       2 Jun 2021 18:11:51 -0000
@@ -339,6 +339,7 @@ ENTRY(cpu_switchto)
       shrq    $32,%rdx

       /* If old proc exited, don't bother. */
+       xorl    %ecx,%ecx
       testq   %r13,%r13
       jz      switch_exited

@@ -346,18 +347,19 @@ ENTRY(cpu_switchto)
        * Save old context.
        *
        * Registers:
-        *   %rax, %rcx - scratch
+        *   %rax - scratch
        *   %r13 - old proc, then old pcb
+        *   %rcx - old pmap if not P_SYSTEM
        *   %r12 - new proc
        *   %r9d - cpuid
        */

+       /* remember the pmap if not P_SYSTEM */
+       testl   $P_SYSTEM,P_FLAG(%r13)
       movq    P_ADDR(%r13),%r13
-
-       /* clear the old pmap's bit for the cpu */
+       jnz     0f
       movq    PCB_PMAP(%r13),%rcx
-       lock
-       btrq    %r9,PM_CPUS(%rcx)
+0:

       /* Save stack pointers. */
       movq    %rsp,PCB_RSP(%r13)
@@ -413,14 +415,24 @@ restore_saved:
        * Restore saved context.
        *
        * Registers:
-        *   %rax, %rcx, %rdx - scratch
-        *   %r13 - new pcb
+        *   %rax, %rdx - scratch
+        *   %rcx - old pmap if not P_SYSTEM
        *   %r12 - new process
+        *   %r13 - new pcb
+        *   %rbx - new pmap if not P_SYSTEM
        */

+       movq    P_ADDR(%r12),%r13
+
+       /* remember the pmap if not P_SYSTEM */
+       xorl    %ebx,%ebx
+       testl   $P_SYSTEM,P_FLAG(%r12)
+       jnz     1f
+       movq    PCB_PMAP(%r13),%rbx
+1:
+
       /* No interrupts while loading new state. */
       cli
-       movq    P_ADDR(%r12),%r13

       /* Restore stack pointers. */
       movq    PCB_RSP(%r13),%rsp
@@ -435,8 +447,25 @@ restore_saved:
       movq    PCB_CR3(%r13),%rax      /* flags from cmpq unchanged */
       jz      .Lsame_cr3

+       /* set the new pmap's bit for the cpu */
+       testq   %rbx,%rbx
+       jz      .Lno_new_pmap
+       lock
+       btsq    %r9,PM_CPUS(%rbx)
+#ifdef DIAGNOSTIC
+       jc      _C_LABEL(switch_pmcpu_set)
+#endif
+.Lno_new_pmap:
+
       movq    %rax,%cr3                       /* %rax used below too */

+       /* clear the old pmap's bit for the cpu */
+       testq   %rcx,%rcx
+       jz      .Lno_old_pmap
+       lock
+       btrq    %r9,PM_CPUS(%rcx)
+.Lno_old_pmap:
+
.Lsame_cr3:
       /*
        * If we switched from a userland thread with a shallow call stack
@@ -448,14 +477,13 @@ restore_saved:
       RET_STACK_REFILL_WITH_RCX

       /* Don't bother with the rest if switching to a system process. */
-       testl   $P_SYSTEM,P_FLAG(%r12)
-       jnz     switch_restored
+       testq   %rbx,%rbx
+       jz      switch_restored

       /* record the bits needed for future U-->K transition */
       movq    PCB_KSTACK(%r13),%rdx
       subq    $FRAMESIZE,%rdx
       movq    %rdx,CPUVAR(KERN_RSP)
-       movq    PCB_PMAP(%r13),%rcx

       CODEPATCH_START
       /*
@@ -463,19 +491,12 @@ restore_saved:
        * then record them in cpu_info for easy access in syscall and
        * interrupt trampolines.
        */
-       movq    PM_PDIRPA_INTEL(%rcx),%rdx
+       movq    PM_PDIRPA_INTEL(%rbx),%rdx
       orq     cr3_reuse_pcid,%rax
       orq     cr3_pcid_proc_intel,%rdx
       movq    %rax,CPUVAR(KERN_CR3)
       movq    %rdx,CPUVAR(USER_CR3)
       CODEPATCH_END(CPTAG_MELTDOWN_NOP)
-
-       /* set the new pmap's bit for the cpu */
-       lock
-       btsq    %r9,PM_CPUS(%rcx)
-#ifdef DIAGNOSTIC
-       jc      _C_LABEL(switch_pmcpu_set)
-#endif

switch_restored:
       SET_CURPCB(%r13)