Re: [PATCH 1/1] x86/mm: fix incomplete page-table invalidation with TCE

[Lance Yang]

On 2026/10/5 23:22, Andrew Cooper wrote:
> On 05/10/2026 11:12 am, Lance Yang wrote:
> > On 2026/10/5 17:57, Andrew Cooper wrote:
> > > On 05/10/2026 9:32 am, Lance Yang wrote:
> > > > On 2026/10/5 16:19, Andrew Cooper wrote:
> > > > > On 05/10/2026 8:29 am, Lance Yang wrote:
> > > > > > > Did you repro any bug related to this? The functionality is perhaps
> > > > > > > underspecified in the AMD manual.
> > > > > >
> > > > > > TBH, I don't have a reproducer yet. Just LLM stumbled upon this while
> > > > > > I was investigating another memory corruption issue [1].
> > > > > >
> > > > > > [1]
> > > > > > https://lore.kernel.org/linux-mm/arY1Wq6R9OY20ans@xxxxxxxxxxxxxxxxx/#t
> > > > >
> > > > > What hardware are you running on?
> > > > >
> > > > > That looks like the Zen5 issue, for which you want either the latest
> > > > > microcode out of linux-firmware and/or
> > > > > https://lore.kernel.org/r/20261002211617.1001617-1-bp@xxxxxxxxxx
> > > > >
> > > > > TCE is a no-op in Zen1 and later, so unless you're on older
> > > > > hardware, it
> > > > > won't be that.
> > > >
> > > > Just to clarify ... these are two separate issues.
> > > >
> > > > I mentioned [1] only to explain how this came up while investigating
> > > > something else. I'm not claiming that TCE caused the corruption
> > > > reported
> > > > there :)
> > >
> > > Please can you answer the question.  Which CPU are you seeing this on?
> >
> > Which CPU? None so far. As I said, I don't have a reproducer. I'm trying
> > to make sense of what the manual says and what the code does ...
>
> I'm afraid that if you're trying to be helpful, you've had entirely the
> opposite effect.
>
> TLB handling is a complicated topic.  What you've done is present what
> is effectively a query about the AMD manual as if it were a bugfix for
> an critical-sounding issue.  You even sited a real bug-report for an
> actually-critical issue, despite it turning out to have nothing to do
> with your submission.
>
> The patch is buggy.  For starters, you should be checking is whether TCE
> is enabled, not whether it's available on the system.  This causes the
> more expensive option to use used even when TCE is turned off.
>
> But, AIUI INVLPG only flushes the whole structure cache because of a
> windows bug which caused it to crash on a 486.  AMD deliberately
> introduced TCE to remove this overhead for every OS which didn't want
> lumbering with a workaround for buggy windows.
>
> Linux currently believes that it's TLB invalidation algorithm is
> compatible with TCE, so at a bare minimum, you need to have some kind of
> discussion on why you believe this not to be true before claiming that
> it "might be unsafe because the manual says so".
>
>
> It's fine to ask a question, and even ask "so shouldn't the code look
> like this?" but such a patch needs a very clear RFC or QUESTION tag.

Thanks for explaining! Lesson learned. I should have made it clear
that this was a question about the manual ...

Let's drop the patch. I'll take another look.