Muli Ben-Yehuda's journal

Yesterday I wrote about “the story of a page
fault”, ending with “What I am not absolutely convinced about is
why the fault happens in the first place. The options are that it gets
a fault because the kernel is mapped, but the protection on the ptes
is such that only code running in ring 0 (i.e. the kernel) can access
them, or that the kernel is not mapped while we are running in user
space, and is only mapped in when we context switch to kernel
space. The former makes a lot more sense, but I haven’t yet hunted
down the code that does it.”

Well, I found it 🙂

in 2.6.7-rc3, arch/i386/mm/pgtable.c, pgd_ctor():

void pgd_ctor(void *pgd, kmem_cache_t *cache, unsigned long unused)
{
	unsigned long flags;

	if (PTRS_PER_PMD == 1)
		spin_lock_irqsave(&pgd_lock, flags);

	/* muli: copy into the user's pgd the portion of the swapper_pg_dir that maps the kernel */ 
	memcpy((pgd_t *)pgd + USER_PTRS_PER_PGD,
			swapper_pg_dir + USER_PTRS_PER_PGD,
			(PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t));

	if (PTRS_PER_PMD > 1)
		return;

	pgd_list_add(pgd);
	spin_unlock_irqrestore(&pgd_lock, flags);

	/* muli: set the rest to 0 */ 
	memset(pgd, 0, USER_PTRS_PER_PGD*sizeof(pgd_t));
}

The way I found it is to go through mingo’s 4:4 split patch,
which obviously needs to change this bit, since the kernel is no
longer mapped in each process’s address space.