[Bug 293382] Dead lock and kernel crash around closefp_impl

From: <bugzilla-noreply_at_freebsd.org>
Date: Thu, 16 Apr 2026 18:03:27 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293382

--- Comment #84 from Kyle Evans <kevans@freebsd.org> ---
(In reply to Konstantin Belousov from comment #77)

The patch seemed to work here.  I took a look at AMD's description of the
INVLPGB_2M_CNT bit, and I find it a bit suspicious (but mainly because of
low-knowledge around the terminology here):

```
ECX[15:0] contains a count of the number of sequential pages to invalidate in
addition to the original
virtual address, starting from the virtual address specified in rAX. A count of
0 invalidates a single
page. ECX[31]=0 indicates to increment the virtual address at the 4K boundary.
ECX[31]=1 indicates
to increment the virtual address at the 2M boundary. The maximum count
supported is reported in
CPUID function 8000_0008h, EDX[15:0]. 

This instruction invalidates the TLB entry or entries, regardless of the page
size (4 Kbytes, 2 Mbytes, 4
Mbytes, or 1 Gbyte). 
```

in particular, the bit is described as "incrementing the virtual address at the
2M boundary", which would leave me wondering if the use is valid if we're not
strictly invalidating 2M pages (i.e., is it possible that we're currently just
invalidating the first page and then skipping over the rest of the PDE in some
cases).  I tested this patch to avoid its use in particular, and that also
seems fine (but maybe it could be smarter):
https://people.freebsd.org/~kevans/invlpgb.diff

-- 
You are receiving this mail because:
You are the assignee for the bug.