Possible bug in tlb shootdown patch (IA64)

[Jack Steiner <steiner@sgi.com>]

We hit a problem that looks like it is related to the tlb
shootdown patch. 

We are running on an IA64. The application does frequent
mmap/munmap operations. The initial symptom was that although the 
the application normally ran fine, it would fail intermittently 
when a "ps -efl" was run. The cause of the failure was stale
TLB entries from a prior mmap mapping.

The problem appears to be caused by the following sequence in
the tlb_remove_page/tlb_finish_mmu macros that are called as
part of do_munmap->zap_page_range->zap_pmd_range->zap_pte_range:


	- tlb_gather_mmu is called while "ps" is also looking
	  at the address space (ie., mm->mm_users >1)

	- tlb_remove_page is called. "address" is not the user virtual
	  being unmapped - it is a relative offset into a page table. 
	  This address gets stashed in the free_pte_ctx struct.

	- tlb_finish_mmu calls flush_tlb_range & passes the stashed 
	  address (ctx->start_addr) to flush_tlb_range. Since this
	  is not the user virtual address being unmapped, it causes 
	  the TLB shootdown to fail.

	
Does this make sense and is this a known problem. Perhap I am just running
with an old patch.


-- 
Thanks

Jack Steiner    (651-683-5302)        steiner@sgi.com

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux.eu.org/Linux-MM/