Re: flush_tlb_page in unuse_pte

Linus Torvalds (torvalds@transmeta.com)
Wed, 27 Aug 1997 09:23:46 -0700 (PDT)


On Wed, 27 Aug 1997, Bill Hawes wrote:
> >
> > choose vma
> > pick page to swap out
> > rw_swap_page()
> > sleep
> > munmap(vma);
> >
> > flush_tlb_page(vma, page);
> > OOPS vma no longer exists!
>
> I had been wondering about what keeps swapping safe from such problems,
> because it sure looked like a race.

It's reasonably easy to fix, as the mm semaphore is already in place. The
only problem with the mm semaphore is that it isn't used enough (and it's
actually used in the wrong places).

I did patches that corrected the mm semaphore for everything but swapping
(all the mmap/munmap/brk stuff was properly protected even wrt SMP and
threads). The only problem with that patch was that I also tried to get
rid of the single kernel lock, and that in turn didn't work because the
filehandling part wasn't protected. I'll see if I find my patches.

The swapping thing is special because it doesn't act on "its own" mm, and
thus needs something like:

mm->count++;
down(&mm->sem);
...
up(&mm->sem);
exit_mm(mm);

to make it safe. That still has the problem with the case of "mm ==
current->mm", which is the only really nasty case. I don't have a good
solution for that, but there are a few options:
- "trydown()" would work, but has the problem that we might be avoiding
to swap out from a process that is potentially nasty.
- keep track of which thread (not mm) that owns the mm semaphore, and if
we're the mm holder then we don't need the count or semaphore stuff at
all because we're already holding the count and the semaphore somewhere
else..

Although I have to say that I like Ingo's suggestion of no-wait locks.
Then we could use spinlocks or rw-locks instead,

Linus