Mapper

[gnzlbg]

There are two methods in the Mapper trait that are unsafe. What would it take to make them safe ? Could we, e.g., error or panic if the frame is actually not unused ?

[phil-opp]

The map_to and identity_map are unsafe because the passed PhysFrame must be unused. There is no way to efficiently check whether a frame is used because we would need to traverse the whole page table hierarchie. While there are ways to make this lookup effective (e.g. an inverted page table), this isn't really something that the library can provide because it's too opinionated.

We could of course add an UnusedPhysFrame wrapper type that is unsafe to construct. Using this type, we could create safe variants of the map_to and identity_map methods. However, this would only shift the unsafety to a different place, so I'm not sure if that is what you want.

[gnzlbg]

Could we cache whether the frame is used/unused within the frame itself ?

[phil-opp]

There might not be any memory available for this information in the frame. For example, imagine that we want to map a frame as stack memory: The CPU will potentially use every byte in that frame.

[gnzlbg]

I meant in the PhysFrame type, as a field.

[phil-opp]

The problem is that PhysFrame has safe constructor methods, so nothing is preventing the programmer from constructing two PhysFrame instances that represent the same frame.

I think the UnusedPhysFrame type could make sense since the FrameAllocator already uses a similar approach (unsafe to implement, returned frames must be unused). By making the FrameAllocator return UnusedPhysFrames, most of the time no unsafe is needed for calling map_to etc.

[gnzlbg]

Sounds good!

[phil-opp]

I opened #89 with these changes.