Re: PROBLEM: Probabilistic segfault on AMD hardware with INVLPGB

[Matt Fleming <matt@readmodwrite.com>]

Hi Rik and Henrik,

I've got a small C reproducer that triggers this within the first round
on Cloudflare's AMD Turin machines:

  https://gist.github.com/mfleming/ca26ad3f8d65a12d23d62fb176480fc1

Build:

  gcc -O2 -Wall -Wextra -pthread -static -o repro-invlpgb repro-invlpgb.c

Run:

  ./repro-invlpgb --batch --rounds 20 --jobs 32 -d 5 -w 8 -m 2 -s 512 -q

The mutator side holds a pthread rwlock write lock while doing
munmap() + mmap(MAP_FIXED) on the same VA and filling the range with
{cookie, slot, generation, offset} markers. Reader threads hold the read
lock while checking those markers.

The failure mode is usually a CORRUPTION line rather than a direct
SIGSEGV: a read from one virtual offset returns a valid marker for a
different offset. That looks consistent with a stale or wrong translation
after VA reuse.

Thanks,
Matt