From: "Dr. David Alan Gilbert" <dave@treblig.org>
To: Kent Overstreet <kent.overstreet@linux.dev>
Cc: "Linus Torvalds" <torvalds@linux-foundation.org>,
"Philipp Stanner" <pstanner@redhat.com>,
"Boqun Feng" <boqun.feng@gmail.com>,
rust-for-linux@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-arch@vger.kernel.org, llvm@lists.linux.dev,
"Miguel Ojeda" <ojeda@kernel.org>,
"Alex Gaynor" <alex.gaynor@gmail.com>,
"Wedson Almeida Filho" <wedsonaf@gmail.com>,
"Gary Guo" <gary@garyguo.net>,
"Björn Roy Baron" <bjorn3_gh@protonmail.com>,
"Benno Lossin" <benno.lossin@proton.me>,
"Andreas Hindborg" <a.hindborg@samsung.com>,
"Alice Ryhl" <aliceryhl@google.com>,
"Alan Stern" <stern@rowland.harvard.edu>,
"Andrea Parri" <parri.andrea@gmail.com>,
"Will Deacon" <will@kernel.org>,
"Peter Zijlstra" <peterz@infradead.org>,
"Nicholas Piggin" <npiggin@gmail.com>,
"David Howells" <dhowells@redhat.com>,
"Jade Alglave" <j.alglave@ucl.ac.uk>,
"Luc Maranget" <luc.maranget@inria.fr>,
"Paul E. McKenney" <paulmck@kernel.org>,
"Akira Yokosawa" <akiyks@gmail.com>,
"Daniel Lustig" <dlustig@nvidia.com>,
"Joel Fernandes" <joel@joelfernandes.org>,
"Nathan Chancellor" <nathan@kernel.org>,
"Nick Desaulniers" <ndesaulniers@google.com>,
kent.overstreet@gmail.com,
"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
elver@google.com, "Mark Rutland" <mark.rutland@arm.com>,
"Thomas Gleixner" <tglx@linutronix.de>,
"Ingo Molnar" <mingo@redhat.com>,
"Borislav Petkov" <bp@alien8.de>,
"Dave Hansen" <dave.hansen@linux.intel.com>,
x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>,
"Catalin Marinas" <catalin.marinas@arm.com>,
linux-arm-kernel@lists.infradead.org,
linux-fsdevel@vger.kernel.org
Subject: Re: [WIP 0/3] Memory model and atomic API in Rust
Date: Tue, 26 Mar 2024 01:35:46 +0000 [thread overview]
Message-ID: <ZgImcq2vRcDZtF6z@gallifrey> (raw)
In-Reply-To: <vevxfv67ureybf7sjwfxzdvl4tt62khyn2gfzn7o74ke2m554s@xxddzz6nurbn>
* Kent Overstreet (kent.overstreet@linux.dev) wrote:
> On Tue, Mar 26, 2024 at 12:05:48AM +0000, Dr. David Alan Gilbert wrote:
> > * Linus Torvalds (torvalds@linux-foundation.org) wrote:
> >
> > <snip>
> >
> > > IOW, the whole access size problem that Boqun described is
> > > *inherently* tied to the fact that the C++ and Rust memory model is
> > > badly designed from the wrong principles.
> > >
> > > Instead of designing it as a "this is an atomic object that you can do
> > > these operations on", it should have been "this is an atomic access,
> > > and you can use this simple object model to have the compiler generate
> > > the accesses for you".
> >
> > Isn't one of the aims of the Rust/C++ idea that you can't forget to access
> > a shared piece of data atomically?
> >
> > If you want to have 'atomic accesses' explicitly, how do you tell the compiler
> > what you can use them on, and when it should stop you mixing them with
> > normal accesses on the same object?
>
> "can't forget to access data atomically" - that's only half of it. And
> atomic accesses loads/stores are not a thing under the hood, they're
> just loads and stores (possibly, but not necessarily, with memory
> barriers).
That's quite architecturally specific isn't it?
Or is this the distinction between accesses that are implicitly atomic
(i.e. naturally aligned word) and things that are locked/exclusive?
(either with a 'lock' on x86 or load-exclusive/store exclusive on some others)?
Which are we talking about here?
> The other half is at the _source_ level you don't want to treat accesses
> to volatiles/atomics like accesses to normal variables, you really want
> those to be explicit, and not look like normal variable accesses.
>
> std:atomic_int is way better than volatile in the sense that it's not a
> barely specified mess, but adding operator overloading was just
> gratuitious and unnecessary.
>
> This is a theme with C++ - they add a _ton_ of magic to make things
> concise and pretty, but you have to understand in intimate detail what
> all that magic is doing or you're totally fucked.
>
> std::atomic_int makes it such that just changing a single line of code
> in a single location in your program will change the semantics of your
> _entire_ program and the only obserable result will be that it's faster
> but a ticking time bomb because you just introduced a ton of races.
>
> With Rust - I honestly haven't looked at whether they added operator
> overlaoding for their atomics, but it's _much_ less of a concern because
> changing the type to the non-atomic version means your program won't
> compile if it's now racy.
OK, so that's essentially the opposite worry of what I was saying; I was
worrying about people forgetting to use an atomic access to a shared
variable; I think you're worrying about people forgetting to mark
a variable shared and since the accesses are the same nothing shouts?
Dave
--
-----Open up your eyes, open up your mind, open up your code -------
/ Dr. David Alan Gilbert | Running GNU/Linux | Happy \
\ dave @ treblig.org | | In Hex /
\ _________________________|_____ http://www.treblig.org |_______/
next prev parent reply other threads:[~2024-03-26 1:35 UTC|newest]
Thread overview: 76+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-22 23:38 [WIP 0/3] Memory model and atomic API in Rust Boqun Feng
2024-03-22 23:38 ` [WIP 1/3] rust: Introduce atomic module Boqun Feng
2024-03-22 23:52 ` Andrew Lunn
2024-03-23 0:03 ` Boqun Feng
2024-03-23 19:13 ` Miguel Ojeda
2024-03-23 19:30 ` Boqun Feng
2024-03-23 9:58 ` Alice Ryhl
2024-03-23 14:10 ` Andrew Lunn
2024-03-23 19:09 ` Miguel Ojeda
2024-03-26 5:56 ` Trevor Gross
2024-03-22 23:38 ` [WIP 2/3] rust: atomic: Add ARM64 fetch_add_relaxed() Boqun Feng
2024-03-22 23:38 ` [WIP 3/3] rust: atomic: Add fetch_sub_release() Boqun Feng
2024-03-22 23:57 ` [WIP 0/3] Memory model and atomic API in Rust Kent Overstreet
2024-03-23 0:12 ` Linus Torvalds
2024-03-23 0:21 ` Kent Overstreet
2024-03-23 0:36 ` Linus Torvalds
2024-03-23 2:07 ` Kent Overstreet
2024-03-23 2:26 ` Boqun Feng
2024-03-23 2:33 ` Kent Overstreet
2024-03-23 2:57 ` Boqun Feng
2024-03-23 3:10 ` Kent Overstreet
2024-03-23 3:51 ` Boqun Feng
2024-03-23 4:16 ` Kent Overstreet
2024-03-25 13:56 ` Philipp Stanner
2024-03-25 17:44 ` Linus Torvalds
2024-03-25 18:59 ` Kent Overstreet
2024-03-25 19:44 ` Linus Torvalds
2024-03-25 21:14 ` Kent Overstreet
2024-03-25 21:37 ` Boqun Feng
2024-03-25 22:09 ` Kent Overstreet
2024-03-25 22:38 ` Boqun Feng
2024-03-25 23:02 ` Kent Overstreet
2024-03-25 23:41 ` Boqun Feng
2024-03-26 0:05 ` Dr. David Alan Gilbert
2024-03-26 0:36 ` Kent Overstreet
2024-03-26 1:35 ` Dr. David Alan Gilbert [this message]
2024-03-26 3:28 ` Kent Overstreet
2024-03-26 2:51 ` Boqun Feng
2024-03-26 3:49 ` Linus Torvalds
2024-03-26 14:35 ` Dr. David Alan Gilbert
2024-03-27 16:16 ` comex
2024-03-27 18:50 ` Kent Overstreet
2024-03-27 19:07 ` Linus Torvalds
2024-03-27 19:41 ` Kent Overstreet
2024-03-27 20:45 ` Linus Torvalds
2024-03-27 21:41 ` Kent Overstreet
2024-03-27 22:57 ` Linus Torvalds
2024-03-27 23:35 ` Kent Overstreet
2024-03-27 21:21 ` Boqun Feng
2024-03-27 21:49 ` Kent Overstreet
2024-03-27 22:26 ` Boqun Feng
2024-03-27 21:56 ` comex
2024-03-27 22:02 ` comex
2024-04-05 17:13 ` Philipp Stanner
2024-04-08 16:02 ` Matthew Wilcox
2024-04-08 16:55 ` Paul E. McKenney
2024-04-08 17:03 ` Matthew Wilcox
2024-04-08 18:47 ` Paul E. McKenney
2024-04-09 0:58 ` Kent Overstreet
2024-04-09 4:47 ` Paul E. McKenney
2024-04-08 17:01 ` Linus Torvalds
2024-04-08 18:14 ` Al Viro
2024-04-08 20:05 ` Linus Torvalds
2024-03-23 21:40 ` comex
2024-03-24 15:22 ` Alan Stern
2024-03-24 17:37 ` comex
2024-03-23 0:15 ` Boqun Feng
2024-03-23 0:49 ` Boqun Feng
2024-03-23 1:42 ` Kent Overstreet
2024-03-23 14:29 ` Andrew Lunn
2024-03-23 14:41 ` Boqun Feng
2024-03-23 14:55 ` Boqun Feng
2024-03-25 10:44 ` Mark Rutland
2024-03-25 20:59 ` Boqun Feng
2024-04-09 10:50 ` Peter Zijlstra
2024-04-16 18:12 ` Boqun Feng
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZgImcq2vRcDZtF6z@gallifrey \
--to=dave@treblig.org \
--cc=a.hindborg@samsung.com \
--cc=akiyks@gmail.com \
--cc=alex.gaynor@gmail.com \
--cc=aliceryhl@google.com \
--cc=benno.lossin@proton.me \
--cc=bjorn3_gh@protonmail.com \
--cc=boqun.feng@gmail.com \
--cc=bp@alien8.de \
--cc=catalin.marinas@arm.com \
--cc=dave.hansen@linux.intel.com \
--cc=dhowells@redhat.com \
--cc=dlustig@nvidia.com \
--cc=elver@google.com \
--cc=gary@garyguo.net \
--cc=gregkh@linuxfoundation.org \
--cc=hpa@zytor.com \
--cc=j.alglave@ucl.ac.uk \
--cc=joel@joelfernandes.org \
--cc=kent.overstreet@gmail.com \
--cc=kent.overstreet@linux.dev \
--cc=linux-arch@vger.kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=llvm@lists.linux.dev \
--cc=luc.maranget@inria.fr \
--cc=mark.rutland@arm.com \
--cc=mingo@redhat.com \
--cc=nathan@kernel.org \
--cc=ndesaulniers@google.com \
--cc=npiggin@gmail.com \
--cc=ojeda@kernel.org \
--cc=parri.andrea@gmail.com \
--cc=paulmck@kernel.org \
--cc=peterz@infradead.org \
--cc=pstanner@redhat.com \
--cc=rust-for-linux@vger.kernel.org \
--cc=stern@rowland.harvard.edu \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
--cc=wedsonaf@gmail.com \
--cc=will@kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).