On Thu, Jun 30, 2011 at 04:58:04PM -0700, David Daney wrote:
> On 06/30/2011 04:34 PM, Maciej W. Rozycki wrote:
> >Hi David,
> >>Page table entries are made invalid by writing a zero into the the PTE
> >>slot in a page table. This creates a race condition with the TLB
> >>modify handlers when they are updating the PTE.
> >>CPU0 CPU1
> >>Test for _PAGE_PRESENT
> >>. set to not _PAGE_PRESENT (zero)
> >>Set to _PAGE_VALID
> >>So now the page not present value (zero) is suddenly valid and user
> >>space programs have access to physical page zero.
> >>We close the race by putting the test for _PAGE_PRESENT and setting of
> >>_PAGE_VALID into an atomic LL/SC section. This requires more
> >>registers than just K0 and K1 in the handlers, so we need to save some
> >>registers to a save area and then restore them when we are done.
> > Hmm, good catch, but doesn't your change pessimise the UP case?
> It may, It is really just a first version of the patch. I am
> looking for feedback and testing.
> >It looks
> >to me like you save& restore the scratch registers even though the race
> >does not apply to UP (you can't interrupt a TLB handler, not at this
> That's right. I will look at trying to generate the old code
> sequences for non-SMP.
We can replace all the CONFIG_SMPs in tlbex.c (existing and those added
by your patch) with num_possible_cpus > 1 which will improve readability
and give SMP kernels running on a single processor the uniprocessor TLB
But that's something for a followup patch; your patch is big enough as it
is, it's not as straight forward as it may sound and the 3.0 clock is