Hi Mark,
Thanks for your comments, but I'm afraid I still don't understand the
need for the flush_tlb_page, given that the page is currently swapped
out. Swapoff is essentially performing a swapin for all pages written
to the swapfile being closed, and I didn't see an equivalent
flush_tlb_page in the code used for a regular swapin. I'll look again
though ...
> You could use flush_tlb() to avoid the reference, but that still leaves
> two small problems;
> o The page table that contains the pte may have been released
> if the task who owns the VMA exits during a block in
> read_swap_page(). Referencing "*dir" is a no, no.
> o The patch (which I note is work in reference) may cause the
> rss to be incorrect. (Race on who reads the page in).
>
> My solution would be to use the mutex which is already in the mm_struct.
> Take it down() before reading the swap-page in unuse_pte(), and also use
> the mutex in exit_mmap(). (The VMAs are released before the page-tables,
> so you could assume everything is still allocated after waking up in
> unuse_pte()).
Unfortunately even taking down the mm_struct semaphore is a race, as the
task may exit and release the mm_struct while I wait on the semaphore
:-(
But that seems like a good approach, so I'll implement a mmget()/mmput()
to keep the mm safe, and then get the semaphore.
> That's a bit heavy handed, but should get rid of the problem of tasks
> exiting or merging their VMAs during the block (I haven't thought about
> this much, so there might be a catch....).
Well, swapoff isn't time critical, so I'll test the code there and then
see if it's useful for fixing some of the races in regular
swapin/swapout.
Regards,
Bill