• David Daney's avatar
    MIPS: Close races in TLB modify handlers. · bf28607f
    David Daney authored
    Page table entries are made invalid by writing a zero into the the PTE
    slot in a page table.  This creates a race condition with the TLB
    modify handlers when they are updating the PTE.
    
    CPU0                              CPU1
    
    Test for _PAGE_PRESENT
    .                                 set to not _PAGE_PRESENT (zero)
    Set to _PAGE_VALID
    
    So now the page not present value (zero) is suddenly valid and user
    space programs have access to physical page zero.
    
    We close the race by putting the test for _PAGE_PRESENT and setting of
    _PAGE_VALID into an atomic LL/SC section.  This requires more registers
    than just K0 and K1 in the handlers, so we need to save some registers
    to a save area and then restore them when we are done.
    
    The save area is an array of cacheline aligned structures that should
    not suffer cache line bouncing as they are CPU private.
    
    [ralf@linux-mips.org: Fix !defined(CONFIG_MIPS_PGD_C0_CONTEXT) build error.]
    Signed-off-by: default avatarDavid Daney <david.daney@cavium.com>
    To: linux-mips@linux-mips.org
    Patchwork: https://patchwork.linux-mips.org/patch/2577/Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
    bf28607f
tlbex.c 56.9 KB