[Top] [All Lists]

Re: [PATCH] MIPS: Close races in TLB modify handlers.

To: David Daney <>
Subject: Re: [PATCH] MIPS: Close races in TLB modify handlers.
From: "Maciej W. Rozycki" <>
Date: Fri, 1 Jul 2011 00:34:09 +0100 (BST)
In-reply-to: <>
References: <>
User-agent: Alpine 2.00 (LFD 1167 2008-08-23)
Hi David,

> Page table entries are made invalid by writing a zero into the the PTE
> slot in a page table.  This creates a race condition with the TLB
> modify handlers when they are updating the PTE.
> CPU0                              CPU1
> Test for _PAGE_PRESENT
> .                                 set to not _PAGE_PRESENT (zero)
> Set to _PAGE_VALID
> So now the page not present value (zero) is suddenly valid and user
> space programs have access to physical page zero.
> We close the race by putting the test for _PAGE_PRESENT and setting of
> _PAGE_VALID into an atomic LL/SC section.  This requires more
> registers than just K0 and K1 in the handlers, so we need to save some
> registers to a save area and then restore them when we are done.

 Hmm, good catch, but doesn't your change pessimise the UP case?  It looks 
to me like you save & restore the scratch registers even though the race 
does not apply to UP (you can't interrupt a TLB handler, not at this 


<Prev in Thread] Current Thread [Next in Thread>