linux-mips
[Top] [All Lists]

Re: [PATCH] MIPS: Close races in TLB modify handlers.

To: "Maciej W. Rozycki" <macro@linux-mips.org>
Subject: Re: [PATCH] MIPS: Close races in TLB modify handlers.
From: David Daney <david.daney@cavium.com>
Date: Thu, 30 Jun 2011 16:58:04 -0700
Cc: linux-mips@linux-mips.org, ralf@linux-mips.org
In-reply-to: <alpine.LFD.2.00.1106302358550.29709@eddie.linux-mips.org>
References: <1309473062-11041-1-git-send-email-david.daney@cavium.com> <alpine.LFD.2.00.1106302358550.29709@eddie.linux-mips.org>
Sender: linux-mips-bounce@linux-mips.org
User-agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.15) Gecko/20101027 Fedora/3.0.10-1.fc12 Thunderbird/3.0.10
On 06/30/2011 04:34 PM, Maciej W. Rozycki wrote:
Hi David,

Page table entries are made invalid by writing a zero into the the PTE
slot in a page table.  This creates a race condition with the TLB
modify handlers when they are updating the PTE.

CPU0                              CPU1

Test for _PAGE_PRESENT
.                                 set to not _PAGE_PRESENT (zero)
Set to _PAGE_VALID

So now the page not present value (zero) is suddenly valid and user
space programs have access to physical page zero.

We close the race by putting the test for _PAGE_PRESENT and setting of
_PAGE_VALID into an atomic LL/SC section.  This requires more
registers than just K0 and K1 in the handlers, so we need to save some
registers to a save area and then restore them when we are done.

  Hmm, good catch, but doesn't your change pessimise the UP case?

It may, It is really just a first version of the patch. I am looking for feedback and testing.

It looks
to me like you save&  restore the scratch registers even though the race
does not apply to UP (you can't interrupt a TLB handler, not at this
stage).

That's right. I will look at trying to generate the old code sequences for non-SMP.

Thanks,
David Daney

<Prev in Thread] Current Thread [Next in Thread>