Hi David, > Page table entries are made invalid by writing a zero into the the PTE > slot in a page table. This creates a race condition with the TLB > modify handlers when they are updating the PTE. > > CPU0 CPU1 > > Test for _PAGE_PRESENT > . set to not _PAGE_PRESENT (zero) > Set to _PAGE_VALID > > So now the page not present value (zero) is suddenly valid and user > space programs have access to physical page zero. > > We close the race by putting the test for _PAGE_PRESENT and setting of > _PAGE_VALID into an atomic LL/SC section. This requires more > registers than just K0 and K1 in the handlers, so we need to save some > registers to a save area and then restore them when we are done. Hmm, good catch, but doesn't your change pessimise the UP case? It looks to me like you save & restore the scratch registers even though the race does not apply to UP (you can't interrupt a TLB handler, not at this stage). Maciej
