On Fri, 2011-07-15 at 16:38 +0800, MailingLists wrote:

A page could be set to read only by the kernel (supervisor in the
powerpc
literature) on the e500, and that's what the kernel do. Set
SW(supervisor
write) bit in the TLB entry to grant write permission to the kernel on
a
page.

And further the SW bit is set according to the DIRTY flag of the PTE,
PTE.DIRTY is set in the do_page_fault(), the futex_lock_pi() disabled
page fault, the PTE.DIRTY never can be set, so do the SW bit,
unbreakable
COW occurred, infinite loop followed. 

That would be it ... the SW dirty and young tracking relies on faults to
fixup things in handle_pte_fault(). If the "disable page fault" thingy
happens before we get there, then we have a pretty nasty bug. Note that
this will hit more than just e500 (and in fact any architecture that
relies on SW to do dirty and young tracking).

Cheers,
Ben.