linux-mips
[Top] [All Lists]

Re: [PATCH] MIPS: Close races in TLB modify handlers.

To: David Daney <david.daney@cavium.com>
Subject: Re: [PATCH] MIPS: Close races in TLB modify handlers.
From: "Maciej W. Rozycki" <macro@linux-mips.org>
Date: Fri, 1 Jul 2011 00:34:09 +0100 (BST)
Cc: linux-mips@linux-mips.org, ralf@linux-mips.org
In-reply-to: <1309473062-11041-1-git-send-email-david.daney@cavium.com>
References: <1309473062-11041-1-git-send-email-david.daney@cavium.com>
Sender: linux-mips-bounce@linux-mips.org
User-agent: Alpine 2.00 (LFD 1167 2008-08-23)
Hi David,

> Page table entries are made invalid by writing a zero into the the PTE
> slot in a page table.  This creates a race condition with the TLB
> modify handlers when they are updating the PTE.
> 
> CPU0                              CPU1
> 
> Test for _PAGE_PRESENT
> .                                 set to not _PAGE_PRESENT (zero)
> Set to _PAGE_VALID
> 
> So now the page not present value (zero) is suddenly valid and user
> space programs have access to physical page zero.
> 
> We close the race by putting the test for _PAGE_PRESENT and setting of
> _PAGE_VALID into an atomic LL/SC section.  This requires more
> registers than just K0 and K1 in the handlers, so we need to save some
> registers to a save area and then restore them when we are done.

 Hmm, good catch, but doesn't your change pessimise the UP case?  It looks 
to me like you save & restore the scratch registers even though the race 
does not apply to UP (you can't interrupt a TLB handler, not at this 
stage).

  Maciej

<Prev in Thread] Current Thread [Next in Thread>