On Thu, 4 May 2006, Zoltan Menyhart wrote: > Andi Kleen wrote: > > > > >We don't free the pages until the other CPUs have been flushed > > > >synchronously. > > > > > >Do you mean the TLB entries mapping the leaf pages? > > >If yes, then I agree with you about them. > > >Yet I speak about the directory pages. Let's take an example: > > > > x86 uses this for the directory pages too (well for PMD/PUD - PGD never > > goes away until final exit). > > The i386 branch: > > tlb_remove_page(): > // assuming !tlb_fast_mode(tlb) > tlb_flush_mmu(): > tlb_flush(): > flush_tlb_mm(): > __flush_tlb(); > free_pages_and_swap_cache(); > > __flush_tlb(): > "movl %%cr3, %0; > "movl %0, %%cr3; # flush TLB > > Do I understand correctly that it purges the local TLBs only? __flush_tlb() purges the local TLBs only; but when you found the i386 or x86_64 flush_tlb_mm() calling __flush_tlb() above, you were looking at the #ifndef CONFIG_SMP block of include/asm/tlbflush.h. Go over to arch/{i386,x86_64}/kernel/smp.c to see what CONFIG_SMP flush_tlb_mm does. > > Actually x86-64 didn't > > fully at some point and it resulted in a nasty to track down bug. > > But it was fixed then. I really went all over this with a very fine > > comb back then and I'm pretty sure it's correct now :) > > Can you please indicate how the page table walking of the other > CPUs is "aborted"? I cannot answer for other architectures: you need to ask the specialist list of each architecture for its answer (or hope that a specialist in each is already reading this thread on linux-mm). What's certain is that the issue is _supposed_ to be already covered safely on all arches, hence the care which has gone into include/asm-generic/tlb.h etc. But you may be right that some architectures get it wrong, I cannot tell. I've CC'ed Ken Chen and linux-ia64 (as Christoph intended to), since that's your first concern; but I'm reluctant to CC lots of different architecture lists together myself. Hugh > > > >After the flush the other CPUs don't walk pages anymore. > > Can you please point me where it is documented that the HW walkers > abort on a TLB flush / purge? > > Yet I did verify that it is not (always) the case for the RISC-s. > > E.g. arch/ia64/kernel/ivt.S: > > ENTRY(vhpt_miss) > ... > // r17 = pmd_offset(pud, addr) > // --> > (p7) ld8 r20=[r17] // get *pmd (may be 0) > > Assume we have reached the point indicated by "// -->": > we have got a valid address for the next level. > Assume "free_pgtables()" sets free these PMD / PTE pages. > The eventual TLB flushes do not do anything to the "ld8" > going to be executed. > > Can you explain please why you think that walking the > > rx = ... -> pgd[i] -> pud[j] -> pmd[k] -> pte[l] > > chain is safe in this condition, too? > > Another example in arch/ppc/kernel/head_44x.S: > > /* Data TLB Error Interrupt */ > START_EXCEPTION(DataTLBError) > ... > // r11 -> PGD or PTE page, r12 = index * sizeof(void *) > // --> > lwzx r11, r12, r11 /* Get pgd/pmd entry */ > > > >Can you explain please why they do not? > > > > Because the PGD/PMD/PUD has been rewritten and they won't be able > > to find the old pages anymore. > > As in the two examples above, the walkers have already picked up > references to the next levels, and these references were valid > at that moment. > > > They also don't have it in their > > TLBs because that has been flushed. > > Are you sure this is true for the RISC-s, too? > Even if an architecture does not play with TLB-s before really > finding a valid PTE? > > > >There is a possibility that walking has already been started, but it has > > >not been completed yet, when "free_pgtables()" runs. > > > > Yes, that is why we delay the freeing of the pages to prevent anything > > going wrong. > > Can you explain please why the already-started walks, which do not > care for the TLB flushes, can be safe? > > > What do you mean with "physical mode"? > > Not using any TLB entry (or any HW supported address translation stuff) > to translate the data addresses before they go out of the CPU. > > > >is insensitive to any TLB purges, therefore these purges do not make sure > > >that there is no other CPU just > > >in the middle of page table walking. > > > A TLB Flush stops all MMU activity - or rather waits for it to finish. > > This is what I am trying to say: not on all archtectures. > > Thanks, > > Zoltan - : send the line "unsubscribe linux-ia64" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
![]() |