Re: Questions about copy-on-write

[Marcus Brinkmann]

At Wed, 27 Oct 2004 19:28:24 +0100,
Sam Mason <address@hidden> wrote:
> > everything fitting together) but all the documentation about pages
> disappearing out from under you, if you don't use the containers -
> as provided by physmem - has slowly changed my view of how L4 worked.

That was the discussion related to IPC, and we weren't very careful
about talking how the memory things work in every detail, so wonder it
must have been confusing.

> It seemed to be suggesting that tasks could revoke the *mappings*
> it had made with other tasks.  Basically I was a very confused
> little boy!

No, your impression is correct.  If you only grant limited access to a
container, in that case if you map pages from that container to write
to them directly (rather than making logical copies of existing pages
from other containers), then the mapping could indeed be removed from
under your feet, and more importantly, the container could
subsequently become inaccessible for you (your limited access right
would have been revoked).

To avoid this, either: (1) never map pages from a container you only
have limited access to, but instead use your own memory and make
copies from container to container, or (2) guard against the page
fault, so that if an unresolvable page fault arises while accessing
the memory, you don't get a fatal signal (generated by the pager!) but
instead you jump out of the critical routine with a longjmp.

But this is an issue peculiar to containers to which you only have
limited access to.  Or not.  Revocation could theoretically be allowed
for any container you own, but you wouldn't give unlimited access to a
container to some other task you don't trust, would you? :)
 
> I've had another read of the documentation and it's proving to
> be *very* hard going - sorry to the authors!  I'll see if I can
> rewrite it so it makes sense to me.  It's basically the paragraphs
> following the start of the "Containers" section up until the "The
> Container Interface" subsection.

Blame Neal :) He wrote it in a hurry at that time, so please be kind
to him.  I basically put the gun to him at that time, or otherwise we
wouldn't have any documentation about the memory management (or worse,
some notes written by me from a time where I was very confused about
it).

Thanks,
Marcus