Re: Make 2.5.17 TLB even more friendlier

[Paul Mackerras <paulus@samba.org>]

It seems to me that there is a race in this code in zap_pte_range,
because there is a gap between when we read the pte and when we clear
it:

	for (offset=0; offset < size; ptep++, offset += PAGE_SIZE) {
		pte_t pte = *ptep;
		if (pte_none(pte))
			continue;
		if (pte_present(pte)) {
			unsigned long pfn = pte_pfn(pte);

			pte_clear(ptep);

Isn't it possible that another cpu could set the dirty bit in the pte
between the "pte = *ptep" and the "pte_clear(ptep)"?  In my case
another cpu could also set the "has hash-table entry" bit.

Shouldn't we do this as "pte = ptep_get_and_clear(ptep)", at least in
the case where we are unmapping stuff?

Paul.