"The kernel page table maps the user and kernel address spaces in their entirety. It is identical to the per-process page table allocated in non-PTI ...

I would open the paragraph with this sentence.

I said 'high operational impact' there. It is explained below, at this point intent is only to note to reader that PTI changes a lot. What specifically is changed comparing for !PTI, is described later.

Typo: I mean PTI vs. non-PTI.

-> "the Meltdown bug ..."

Remove the stray space between PTI and the subsequent comma.

-> "... that the user space ..."

I would drop the "s" at the end of "kernel page tables".

I would take it for granted that TLB coherence must be maintained. Is the real point that you're trying to make here that these TLB invalidations can't be deferred, unlike the user page table ones mentioned below? If so, I think that this paragraph would be clearer if you swapped the order of the sentences, that is, talk about the user page table first.

"... when the CPU is in user mode. Consequently, some TLB invalidations ...

"The existence of a user mode page table ..."

"by a pm_ucr3 value that differs from ..., in which case pm_ucr3 contains

"... for the user mode page table's root.

"... which CPUs currently have the pmap active. A CPU's bit is set on ...

"... For the kernel page table, the pm_active field

"present in hardware" -> "in use by the hardware"

"..., the pmap sends ...

"... recorded as active in pm_active. Updates to and reads from pm_active are not synchronized, and so they may race with each other. Shootdown handlers ...

"... to. This feature provides a limited namespace ..."

(The text that follows uses "PCID" to refer to a "Process ID" so I want to stop using it to refer to the feature.)

"... 12 bits, supporting 4095 simultaneous IDs total.

"Allocation of a PCID to a pmap ...

"section 15.12, "Other TLB Consistency Algorithms", of Vahalia's book "Unix Internals".

"A PCID cannot ... whole lifetime of a pmap in ...

"when the CPU ...

"switch that activates ...

"On invalidation" -> "On TLB invalidation"

and

"is" -> "are"

"... that the previously allocated ..."

"Consequently, if a pmap is inactive on a CPU, then a TLB shootdown for that pmap and CPU can be initiated by an ordinary memory access to reset the target CPU's generation count within the pmap. The CPU initiating the TLB shootdown does not need to send an IPI to the target CPU.

For consistency, "user mode"

"A user PCID ...

"... bit, 11, to ...

"Userspace" -> "User space"
and
"usermode" -> "user mode"

"... clearing bit 63 of the loaded ..."

"usermode" -> "user mode"

Also, can you clarify whether this is a "total invalidation" for one pmap or all pmaps on that CPU.

-> "... in the user ..."

INVTLB?

-> "If the INVPCID ...

-> "from the kernel page table.

-> "... The kernel reserves ...

"usermode" -> "user mode"

-> "... A context switch allocates a new ...

-> "the recorded PCID is zero or the recorded generation does not match the CPU's

-> "..., effectively flushing the TLB ...

"usermode" -> "user mode"

-> "... for the user page table.

I would drop the last sentence of this paragraph, i.e., the sentence "For SMP, ...", and then merge this paragraph with the next one.

(The use of IPIs comes up below. Here, I think it is lower level than the rest of this new combined paragraph.)

This line is missing an "*".

"The kernel configuration option that has the greatest operational impact on TLB invalidation is PTI, which ...

PTI is the kernel configuration option that most affects

"CPUs. The most impactful hardware ...

"allocated" -> "used"

"... mode. In contrast, the user space part of the kernel page table is used for copyout(9), so TLB invalidations on this page table cannot be postponed."

"... by a pm_ucr3

For consistency, add another space after the period.

"... count, pm_gen, which is ...

"... valid. Effectively, zeroing any of these counters triggers a TLB shootdown ...

"of a new ...

Drop the first "the": "clearing bit 63 ...

"modes. If the requested invalidation is for a specific address or the total invalidation of a currently active pmap, then the TLB is flushed using INVLPG for a kernel page table, and ..."

I feel like there is a missing qualifying phrase at the end of INVPCID(INVPCID_CTXGLOB)/invltlb_glob().

I think that all of the entries of this form would be clearer if written as "remote user page, inactive pmap:" Otherwise, it reads like the page must be inactive.

Sorry, I cannot get sense of this comment.

I think that this was the start of a comment that I intended to delete because it was superseded by another comment.

"mainly" -> "first"

Can shorten to: "... from kernel to user mode."

-> "... be similarly postponed.

-> "... switch to the pmap, and ..."

Add comma, -> "..., e.g., ..."

Add comma, -> "i.e., ..."

-> "... TLB entries for ..."

Can we change "If ucr3_load_mask is set, then local ..." to "In which case, local ..."?

We rarely use the word "process" in this comment. Can we say, "user space", instead?

Here is a technical question as opposed to one about wording: Given the IPI:INVLPG why is pm_gen zeroed? Is this because of aforementioned pm_active race?

Are you planning to replace this?

Yes, due to a possibility to lost the race and have the target pmap no longer active.

I believe that the recent fix where pm_gen zeroing was misplaced and this caused observable issues proves the point.

Not in this change.

I plan to write about generation, emulation of A/D. Might be mention different format of EPT tables.

For SVM, something should be also noted.

Then, I would add a parenthetical comment on the next line: "(Both actions are required to handle the aforementioned pm_active races.)"

For consistency, "cpu" -> "CPU"