On Sun, Sep 6, 2026 at 3:02 PM Gary Guo <[email protected]> wrote: > > On Tue Aug 25, 2026 at 2:20 PM BST, Alice Ryhl wrote: > > On Mon, Aug 24, 2026 at 01:17:56PM +0200, Andreas Hindborg wrote: > >> + // SAFETY: We just successfully allocated a page, so we now have > >> ownership of the newly > >> + // allocated page. We transfer that ownership to the new > >> `Owned<Page>` object. > >> + // Since `Page` is transparent, we can cast the pointer directly. > >> + Ok(unsafe { Owned::from_raw(page.cast()) }) > > > > This doesn't satisfy the safety requirements of Owned::from_raw() > > because the page may be used with vm_insert_page(), which increments its > > refcount and causes it to be shared the vma system, and this occurs > > before Page::release() is called. > > I suppose the existing vm_insert_page() abstraction we have is already > problematic, because it uses `&Page`? > > Maybe we want to change the API to use `ARef<Page>` so it already has to be > shared? Conceptually it takes a reference count from a `&Page`, which isn't > possible because `Page` is not `AlwaysRefCounted`, so it needs a `&ARef<Page>` > to be able to do that op.
Honestly, the problem is the safety requirements of Owned::from_raw(). Pages have a "special" main reference, and free_page() does more than put_page(). It even does something when the refcount does not hit zero. The correct behavior for Page is to allow the user to hold one Owned<Page> whose drop calls free_page(), *plus* any number of ARef<Page> references that invoke put_page() on drop. This way, the owned page controls the special drop codepath. Alice
