Hi David,
> Page table entries are made invalid by writing a zero into the the PTE
> slot in a page table. This creates a race condition with the TLB
> modify handlers when they are updating the PTE.
>
> CPU0 CPU1
>
> Test for _PAGE_PRESENT
> . set to not _PAGE_PRESENT (zero)
> Set to _PAGE_VALID
>
> So now the page not present value (zero) is suddenly valid and user
> space programs have access to physical page zero.
>
> We close the race by putting the test for _PAGE_PRESENT and setting of
> _PAGE_VALID into an atomic LL/SC section. This requires more
> registers than just K0 and K1 in the handlers, so we need to save some
> registers to a save area and then restore them when we are done.
Hmm, good catch, but doesn't your change pessimise the UP case? It looks
to me like you save & restore the scratch registers even though the race
does not apply to UP (you can't interrupt a TLB handler, not at this
stage).
Maciej
|