Subject: i386 pmap bug
To: None <tech-kern@netbsd.org>
From: Stephan Uphoff <ups@stups.com>
List: tech-kern
Date: 01/31/2003 23:02:50
If a (user space) Page Table Page (PTP) is no longer used, because the last
valid Page Table Entry (PTE) has been removed, the associated page structure 
is put on the free page list before the associated TLB for the PTP 
(TLB that caches the PDE) is flushed.

Any modification of the freed page (interrupt, multiprocessor) might cause 
loading of invalid TLB entries that could:
	- cause immediate problems for multiprocessor systems.
	- stay in the TLB even after the call to pmap_tlb_shootnow().
          (and as such cause problems later).

This is not only a problem for multiprocessor systems as Intel states
in one of their "Pentium II Processor Application Notes":
	Memory Ordering On Dynamic Execution (Pentium Pro Family) Processors
 	2.7. Page Table Walking Accesses:
  	     [...]
  	  *  Page table walks can occur at any time, randomly
   	     [...]
		Page table walking to satisfy TLB (Translation Lookaside
		Buffer) misses can be performed speculatively and out-of-order;
 		page table walks are subject to speculative cacheability.
  	     [...]

The easiest way to fix this problem, would be to add extra calls 
to pmap_tlb_shootnow(), before each call of uvm_pagefree(ptp).
However, this is clearly not desirable for performance.

I am willing to work on a better solution if there is any interest.
(and if I am not stepping on someone's toes).

Is this the right mailing list or should this be on netbsd-port-i386 ?
I posted some (different) i386 specific pmap concerns/questions there
on Monday but have yet to receive a response.  

Stephan

    

---------------------
Stephan Uphoff 
ups@stups.com
9275 Martin Road
Roswell, GA 30076
770-518-4058