Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Content-Type: text/plain;
        charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.400.51.1.1\))
Subject: Re: [PATCH 1/2] docs: rcu: Add cautionary note on plain-accesses to
 requirements
From:   Alan Huang <mmpgouride@gmail.com>
In-Reply-To: <20230803032408.2514989-1-joel@joelfernandes.org>
Date:   Thu, 3 Aug 2023 20:08:42 +0800
Cc:     linux-kernel@vger.kernel.org, rcu@vger.kernel.org,
        Will Deacon <will@kernel.org>,
        "Paul E. McKenney" <paulmck@kernel.org>,
        Frederic Weisbecker <frederic@kernel.org>,
        Neeraj Upadhyay <quic_neeraju@quicinc.com>,
        Josh Triplett <josh@joshtriplett.org>,
        Boqun Feng <boqun.feng@gmail.com>,
        Steven Rostedt <rostedt@goodmis.org>,
        Mathieu Desnoyers <mathieu.desnoyers@efficios.com>,
        Lai Jiangshan <jiangshanlai@gmail.com>,
        Zqiang <qiang.zhang1211@gmail.com>,
        Jonathan Corbet <corbet@lwn.net>
Content-Transfer-Encoding: quoted-printable
Message-Id: <A272EB21-28F9-4FFE-A3BB-6689807CC3ED@gmail.com>
References: <20230803032408.2514989-1-joel@joelfernandes.org>
To:     "Joel Fernandes (Google)" <joel@joelfernandes.org>
Precedence: bulk


> 2023=E5=B9=B48=E6=9C=883=E6=97=A5 11:24=EF=BC=8CJoel Fernandes =
(Google) <joel@joelfernandes.org> =E5=86=99=E9=81=93=EF=BC=9A
>=20
> Add a detailed note to explain the potential side effects of
> plain-accessing the gp pointer using a plain load, without using the
> rcu_dereference() macros; which might trip neighboring code that does
> use rcu_dereference().
>=20
> I haven't verified this with a compiler, but this is what I gather =
from
> the below link using Will's experience with READ_ONCE().
>=20
> Link: =
https://lore.kernel.org/all/20230728124412.GA21303@willie-the-truck/
> Cc: Will Deacon <will@kernel.org>
> Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org>
> ---
> .../RCU/Design/Requirements/Requirements.rst  | 32 +++++++++++++++++++
> 1 file changed, 32 insertions(+)
>=20
> diff --git a/Documentation/RCU/Design/Requirements/Requirements.rst =
b/Documentation/RCU/Design/Requirements/Requirements.rst
> index f3b605285a87..e0b896d3fb9b 100644
> --- a/Documentation/RCU/Design/Requirements/Requirements.rst
> +++ b/Documentation/RCU/Design/Requirements/Requirements.rst
> @@ -376,6 +376,38 @@ mechanism, most commonly locking or reference =
counting
> .. |high-quality implementation of C11 memory_order_consume [PDF]| =
replace:: high-quality implementation of C11 ``memory_order_consume`` =
[PDF]
> .. _high-quality implementation of C11 memory_order_consume [PDF]: =
http://www.rdrop.com/users/paulmck/RCU/consume.2015.07.13a.pdf
>=20
> +Note that, there can be strange side effects (due to compiler =
optimizations) if
> +``gp`` is ever accessed using a plain load (i.e. without =
``READ_ONCE()`` or
> +``rcu_dereference()``) potentially hurting any succeeding
> +``rcu_dereference()``. For example, consider the code:
> +
> +   ::
> +
> +       1 bool do_something_gp(void)
> +       2 {
> +       3   void *tmp;
> +       4   rcu_read_lock();
> +       5   tmp =3D gp; // Plain-load of GP.
> +       6   printk("Point gp =3D %p\n", tmp);
> +       7
> +       8   p =3D rcu_dereference(gp);
> +       9   if (p) {
> +      10     do_something(p->a, p->b);
> +      11     rcu_read_unlock();
> +      12     return true;
> +      13   }
> +      14   rcu_read_unlock();
> +      15   return false;
> +      16 }
> +
> +The behavior of plain accesses involved in a data race is =
non-deterministic in
> +the face of compiler optimizations. Since accesses to the ``gp`` =
pointer is
> +by-design a data race, the compiler could trip this code by caching =
the value
> +of ``gp`` into a register in line 5, and then using the value of the =
register
> +to satisfy the load in line 10. Thus it is important to never mix

Will=E2=80=99s example is:

	 // Assume *ptr is initially 0 and somebody else writes it to 1
	 // concurrently

	 foo =3D *ptr;
	 bar =3D READ_ONCE(*ptr);
	 baz =3D *ptr;

Then the compiler is within its right to reorder it to:

	foo =3D *ptr;
 	baz =3D *ptr;
 	bar =3D READ_ONCE(*ptr);

So, the result foo =3D=3D baz =3D=3D 0 but bar =3D=3D 1 is perfectly =
legal.

But the example here is different, the compiler can not use the value =
loaded from line 5
unless the compiler can deduce that the tmp is equals to p in which case =
the address dependency
doesn=E2=80=99t exist anymore.

What am I missing here?

> +plain accesses of a memory location with rcu_dereference() of the =
same memory
> +location, in code involved in a data race.
> +
> In short, updaters use rcu_assign_pointer() and readers use
> rcu_dereference(), and these two RCU API elements work together to
> ensure that readers have a consistent view of newly added data =
elements.
> --=20
> 2.41.0.585.gd2178a4bd4-goog
>=20