Re: [PATCH 1/1] x86/mm: fix incomplete page-table invalidation with TCE

[Lance Yang <lance.yang@linux.dev>]

On 2026/10/5 23:22, Andrew Cooper wrote:
> On 05/10/2026 11:12 am, Lance Yang wrote:
>> On 2026/10/5 17:57, Andrew Cooper wrote:
>>> On 05/10/2026 9:32 am, Lance Yang wrote:
>>>> On 2026/10/5 16:19, Andrew Cooper wrote:
>>>>> On 05/10/2026 8:29 am, Lance Yang wrote:
>>>>>>>
>>>>>>> Did you repro any bug related to this? The functionality is perhaps
>>>>>>> underspecified in the AMD manual.
>>>>>>
>>>>>> TBH, I don't have a reproducer yet. Just LLM stumbled upon this while
>>>>>> I was investigating another memory corruption issue [1].
>>>>>>
>>>>>> [1]
>>>>>> https://lore.kernel.org/linux-mm/arY1Wq6R9OY20ans@pcnci.linuxbox.cz/#t
>>>>>>
>>>>>
>>>>> What hardware are you running on?
>>>>>
>>>>> That looks like the Zen5 issue, for which you want either the latest
>>>>> microcode out of linux-firmware and/or
>>>>> https://lore.kernel.org/r/20261002211617.1001617-1-bp@kernel.org
>>>>>
>>>>> TCE is a no-op in Zen1 and later, so unless you're on older
>>>>> hardware, it
>>>>> won't be that.
>>>>
>>>> Just to clarify ... these are two separate issues.
>>>>
>>>> I mentioned [1] only to explain how this came up while investigating
>>>> something else. I'm not claiming that TCE caused the corruption
>>>> reported
>>>> there :)
>>>
>>> Please can you answer the question.  Which CPU are you seeing this on?
>>>
>>
>> Which CPU? None so far. As I said, I don't have a reproducer. I'm trying
>> to make sense of what the manual says and what the code does ...
> 
> I'm afraid that if you're trying to be helpful, you've had entirely the
> opposite effect.
> 
> TLB handling is a complicated topic.  What you've done is present what
> is effectively a query about the AMD manual as if it were a bugfix for
> an critical-sounding issue.  You even sited a real bug-report for an
> actually-critical issue, despite it turning out to have nothing to do
> with your submission.
> 
> The patch is buggy.  For starters, you should be checking is whether TCE
> is enabled, not whether it's available on the system.  This causes the
> more expensive option to use used even when TCE is turned off.
> 
> But, AIUI INVLPG only flushes the whole structure cache because of a
> windows bug which caused it to crash on a 486.  AMD deliberately
> introduced TCE to remove this overhead for every OS which didn't want
> lumbering with a workaround for buggy windows.
> 
> Linux currently believes that it's TLB invalidation algorithm is
> compatible with TCE, so at a bare minimum, you need to have some kind of
> discussion on why you believe this not to be true before claiming that
> it "might be unsafe because the manual says so".
> 
> 
> It's fine to ask a question, and even ask "so shouldn't the code look
> like this?" but such a patch needs a very clear RFC or QUESTION tag.

Thanks for explaining! Lesson learned. I should have made it clear
that this was a question about the manual ...

Let's drop the patch. I'll take another look.