On Mon, 2011-01-24 at 15:34 +0100, Oleg Nesterov wrote:

On 01/24, Peter Zijlstra wrote:

quoted

On Fri, 2011-01-21 at 16:33 +0100, Peter Zijlstra wrote:

quoted

Index: linux-2.6/mm/rmap.c
===================================================================

--- linux-2.6.orig/mm/rmap.c
+++ linux-2.6/mm/rmap.c

@@ -1559,9 +1559,20 @@ void __put_anon_vma(struct anon_vma *ano
 	 * Synchronize against page_lock_anon_vma() such that
 	 * we can safely hold the lock without the anon_vma getting
 	 * freed.
+	 *
+	 * Relies on the full mb implied by the atomic_dec_and_test() from
+	 * put_anon_vma() against the full mb implied by mutex_trylock() from
+	 * page_lock_anon_vma(). This orders:
+	 *
+	 * page_lock_anon_vma()		VS	put_anon_vma()
+	 *   mutex_trylock()			  atomic_dec_and_test()
+	 *   smp_mb()				  smp_mb()
+	 *   atomic_read()			  mutex_is_locked()

Bah!, I thought all mutex_trylock() implementations used an atomic op
with return value (which implies a mb), but it looks like (at least*)
PPC doesn't and only provides a LOCK barrier.

But, mutex_trylock() must imply the one-way barrier, otherwise it
is buggy, no?

If this atomic_read() can leak out of the critical section, then
I think mutex_trylock() should be fixed. Or I misunderstood the
problem completely...

It implies the LOCK barrier, the one way permeable thing, not a full mb.

But I'm not sure the LOCK is sufficient to make the above scenario work.

BTW, from https://lkml.org/lkml/2010/11/26/213

	+ * Similar to page_get_anon_vma() except it locks the anon_vma.
	...
	-	struct anon_vma *anon_vma = page_get_anon_vma(page);

looks like, page_get_anon_vma() becomes unused.

In my current tree there's two left in mm/migrate.c.


git://git.kernel.org/pub/scm/linux/kernel/git/peterz/linux-2.6-mmu_preempt.git

HEAD: 7e23542fae47ed3b811583cb925837e3aa7a3f0f