`Mapper::unmap` should be unsafe about x86_64 HOT 4 OPEN

Also if I read the Rustonmicon correctly they probably consider page faults as something that should be marked as unsafe.

• A reference cannot outlive its referent

https://doc.rust-lang.org/nomicon/references.html

from x86_64.

4. map the page again

This would require an unsafe operation in our current API.

from x86_64.

Maybe your right. That said I personally am not sure about the idea that page faults are not UB, but I guess it's not that big of a deal.

I just found #202 and I understand where you're coming from on this point. Would you be willing to accept a PR that adds some reasoning for this in the documentation for unmap. Looks like I'm not the only one who thinks that way.

from x86_64.

Page faults are often handled transparently by the operating system, e.g. when swapping out pages to disk. When the CPU tries to access the referenced value, the OS can handle the page fault by reading the original page back from disk and restoring the original mapping. So the referenced value still exists and is still alive, it's just is no longer in RAM.

Another example are pages that are marked as copy-on-write during fork. Once the CPU tries to modify a value (e.g. referenced by a &mut) a page fault occurs. The OS typically reacts by copying the page to a new physical frame so that it can safely modified.

Of course this all depends on the correct behavior of the OS. When it maps the wrong page on a page fault, it's definitely undefined behavior. We model this in our API by making the map_to method unsafe because that's the place where you need to ensure that no mutable aliasing etc occurs.

So I guess the question is: Is there a way to cause UB using unmap without using any other unsafe method such as map_to? Is it UB to abort a user program on such a page fault?

I'm happy to discuss this further and I'm not strongly opposed to make unmap unsafe if there is a good reason. We just try to only define methods as unsafe if absolutely needed because otherwise the whole crate would consist of unsafe methods.

from x86_64.