On Thu, 2018-04-26 at 22:07 +0200, joro@xxxxxxxxxx wrote: > On Thu, Apr 26, 2018 at 05:49:58PM +0000, Kani, Toshi wrote: > > On Thu, 2018-04-26 at 19:23 +0200, joro@xxxxxxxxxx wrote: > > > So the PMD entry you clear can still be in a page-walk cache and this > > > needs to be flushed too before you can free the PTE page. Otherwise > > > page-walks might still go to the page you just freed. That is especially > > > bad when the page is already reallocated and filled with other data. > > > > I do not understand why we need to flush processor caches here. x86 > > processor caches are coherent with MESI. So, clearing an PMD entry > > modifies a cache entry on the processor associated with the address, > > which in turn invalidates all stale cache entries on other processors. > > A page walk cache is not about the processors data cache, its a cache > similar to the TLB to speed up page-walks by caching intermediate > results of previous page walks. Thanks for the clarification. After reading through SDM one more time, I agree that we need a TLB purge here. Here is my current understanding. - INVLPG purges both TLB and paging-structure caches. So, PMD cache was purged once. - However, processor may cache this PMD entry later in speculation since it has p-bit set. (This is where my misunderstanding was. Speculation is not allowed to access a target address, but it may still cache this PMD entry.) - A single INVLPG on each processor purges this PMD cache. It does not need a range purge (which was already done). Does it sound right to you? As for the BUG_ON issue, are you able to reproduce this issue? If so, would you be able to test the fix? Regards, -Toshi