Re: [PATCH 2/2 v2] MIPS: Close races in TLB modify handlers.

[Ralf Baechle <ralf@linux-mips.org>]

On Tue, Jul 05, 2011 at 04:34:46PM -0700, David Daney wrote:

> Page table entries are made invalid by writing a zero into the the PTE
> slot in a page table.  This creates a race condition with the TLB
> modify handlers when they are updating the PTE.
> 
> CPU0                              CPU1
> 
> Test for _PAGE_PRESENT
> .                                 set to not _PAGE_PRESENT (zero)
> Set to _PAGE_VALID
> 
> So now the page not present value (zero) is suddenly valid and user
> space programs have access to physical page zero.
> 
> We close the race by putting the test for _PAGE_PRESENT and setting of
> _PAGE_VALID into an atomic LL/SC section.  This requires more
> registers than just K0 and K1 in the handlers, so we need to save some
> registers to a save area and then restore them when we are done.
> 
> The save area is an array of cacheline aligned structures that should
> not suffer cache line bouncing as they are CPU private.
> 
> Signed-off-by: David Daney <david.daney@cavium.com>

Looks good and nobody else has complained but backporting to <= 2.6.37 is
gonna be ugly.  I either have to resolve huge conflicts or alternatively
backport tons of other tlbex.c patches.  The latter is less risky and
time consuming and will provide additional benefit so I'll do it.  Just
be prepared for a storm on the linux-git list.

  Ralf