From: Nick Desaulniers <ndesaulniers@google.com>
To: "Paul E. McKenney" <paulmck@kernel.org>,
Dave Martin <Dave.Martin@arm.com>,
Peter Zijlstra <peterz@infradead.org>,
Will Deacon <will@kernel.org>,
Sami Tolvanen <samitolvanen@google.com>,
Marco Elver <elver@google.com>
Cc: Mark Rutland <mark.rutland@arm.com>,
LKML <linux-kernel@vger.kernel.org>,
Kees Cook <keescook@chromium.org>, Arnd Bergmann <arnd@arndb.de>,
"Michael S. Tsirkin" <mst@redhat.com>,
Catalin Marinas <catalin.marinas@arm.com>,
Jason Wang <jasowang@redhat.com>,
Josh Triplett <josh@joshtriplett.org>,
Steven Rostedt <rostedt@goodmis.org>,
virtualization@lists.linux-foundation.org,
Alan Stern <stern@rowland.harvard.edu>,
linux-alpha@vger.kernel.org,
Ivan Kokshaysky <ink@jurassic.park.msu.ru>,
Matt Turner <mattst88@gmail.com>,
kernel-team <kernel-team@android.com>,
Boqun Feng <boqun.feng@gmail.com>,
Linux ARM <linux-arm-kernel@lists.infradead.org>,
Richard Henderson <rth@twiddle.net>
Subject: Re: [PATCH 18/18] arm64: lto: Strengthen READ_ONCE() to acquire when CLANG_LTO=y
Date: Tue, 7 Jul 2020 16:01:28 -0700 [thread overview]
Message-ID: <CAKwvOdkW__H21m8vqqk1-n6-KK67HBk=YbA+MkUS7igxfjV1iw@mail.gmail.com> (raw)
In-Reply-To: <20200707225122.GJ9247@paulmck-ThinkPad-P72>
I'm trying to put together a Micro Conference for Linux Plumbers
conference focused on "make LLVM slightly less shitty." Do you all
plan on attending the conference? Would it be worthwhile to hold a
session focused on discussing this (LTO and memory models) be
worthwhile?
On Tue, Jul 7, 2020 at 3:51 PM Paul E. McKenney <paulmck@kernel.org> wrote:
>
> On Tue, Jul 07, 2020 at 11:29:15AM +0100, Dave Martin wrote:
> > On Mon, Jul 06, 2020 at 10:36:28AM -0700, Paul E. McKenney wrote:
> > > On Mon, Jul 06, 2020 at 06:05:57PM +0100, Dave Martin wrote:
>
> [ . . . ]
>
> > > > The underlying problem here seems to be that the necessary ordering
> > > > rule is not part of what passes for the C memory model prior to C11.
> > > > If we want to control the data flow, don't we have to wrap the entire
> > > > dereference in a macro?
> > >
> > > Yes, exactly. Because we are relying on things that are not guaranteed
> > > by the C memory model, we need to pay attention to the implementations.
> > > As I have said elsewhere, the price of control dependencies is eternal
> > > vigilance.
> > >
> > > And this also applies, to a lesser extent, to address and data
> > > dependencies, which are also not well supported by the C standard.
> > >
> > > There is one important case in which the C memory model -does- support
> > > control dependencies, and that is when the dependent write is a normal
> > > C-language write that is not involved in a data race. In that case,
> > > if the compiler broke the control dependency, it might have introduced
> > > a data race, which it is forbidden to do. However, this rule can also
> > > be broken when the compiler knows too much, as it might be able to prove
> > > that breaking the dependency won't introduce a data race. In that case,
> > > according to the standard, it is free to break the dependency.
> >
> > Which only matters because the C abstract machine may not match reality.
> >
> > LTO has no bearing on the abstract machine though.
> >
> > If specific compiler options etc. can be added to inhibit the
> > problematic optimisations, that would be ideal. I guess that can't
> > happen overnight though.
>
> Sadly, I must agree.
>
> > > > > > > We likely won't realise if/when this goes wrong, other than impossible to
> > > > > > > debug, subtle breakage that crops up seemingly randomly. Ideally, we'd be
> > > > > > > able to detect this sort of thing happening at build time, and perhaps
> > > > > > > even prevent it with compiler options or annotations, but none of that is
> > > > > > > close to being available and I'm keen to progress the LTO patches in the
> > > > > > > meantime because they are a requirement for CFI.
> > > > > >
> > > > > > My concern was not so much why LTO makes things dangerous, as why !LTO
> > > > > > makes things safe...
> > > > >
> > > > > Because ignorant compilers are safe compilers! ;-)
> > > >
> > > > AFAICT ignorance is no gurantee of ordering in general -- the compiler
> > > > is free to speculatively invent knowledge any place that the language
> > > > spec allows it to. !LTO doesn't stop this happening.
> > >
> > > Agreed, according to the standard, the compiler has great freedom.
> > >
> > > We have two choices: (1) Restrict ourselves to live within the confines of
> > > the standard or (2) Pay continued close attention to the implementation.
> > > We have made different choices at different times, but for many ordering
> > > situations we have gone with door #2.
> > >
> > > Me, I have been working to get the standard to better support our
> > > use case. This is at best slow going. But don't take my word for it,
> > > ask Will.
> >
> > I can believe it. They want to enable optimisations rather than prevent
> > them...
>
> Right in one! ;-)
>
> > > > Hopefully some of the knowledge I invented in my reply is valid...
> > >
> > > It is. It is just that there are multiple valid strategies, and the
> > > Linux kernel is currently taking a mixed-strategy approach.
> >
> > Ack. The hope that there is a correct way to fix everything dies
> > hard ;)
>
> Either that, or one slowly degrades ones definition of "correct". :-/
>
> > Life was cosier before I started trying to reason about language specs.
>
> Same here!
>
> Thanx, Paul
--
Thanks,
~Nick Desaulniers
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2020-07-07 23:04 UTC|newest]
Thread overview: 58+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-30 17:37 [PATCH 00/18] Allow architectures to override __READ_ONCE() Will Deacon
2020-06-30 17:37 ` [PATCH 01/18] tools: bpf: Use local copy of headers including uapi/linux/filter.h Will Deacon
2020-07-01 16:38 ` Alexei Starovoitov
2020-06-30 17:37 ` [PATCH 02/18] compiler.h: Split {READ, WRITE}_ONCE definitions out into rwonce.h Will Deacon
2020-06-30 19:11 ` Arnd Bergmann
2020-07-01 10:16 ` [PATCH 02/18] compiler.h: Split {READ,WRITE}_ONCE " Will Deacon
2020-07-01 11:33 ` [PATCH 02/18] compiler.h: Split {READ, WRITE}_ONCE " Arnd Bergmann
2020-06-30 17:37 ` [PATCH 03/18] asm/rwonce: Allow __READ_ONCE to be overridden by the architecture Will Deacon
2020-06-30 17:37 ` [PATCH 04/18] alpha: Override READ_ONCE() with barriered implementation Will Deacon
2020-07-02 9:32 ` Mark Rutland
2020-07-02 9:48 ` Will Deacon
2020-07-02 10:08 ` Arnd Bergmann
2020-07-02 11:18 ` Will Deacon
2020-07-02 11:39 ` Arnd Bergmann
2020-07-02 14:43 ` Joel Fernandes
2020-07-02 14:55 ` Will Deacon
2020-07-02 15:07 ` Joel Fernandes
2020-06-30 17:37 ` [PATCH 05/18] asm/rwonce: Remove smp_read_barrier_depends() invocation Will Deacon
2020-06-30 17:37 ` [PATCH 06/18] vhost: Remove redundant use of read_barrier_depends() barrier Will Deacon
2020-06-30 17:37 ` [PATCH 07/18] alpha: Replace smp_read_barrier_depends() usage with smp_[r]mb() Will Deacon
2020-06-30 17:37 ` [PATCH 08/18] locking/barriers: Remove definitions for [smp_]read_barrier_depends() Will Deacon
2020-06-30 17:37 ` [PATCH 09/18] Documentation/barriers: Remove references to [smp_]read_barrier_depends() Will Deacon
2020-06-30 17:37 ` [PATCH 10/18] Documentation/barriers/kokr: " Will Deacon
2020-06-30 17:37 ` [PATCH 11/18] tools/memory-model: Remove smp_read_barrier_depends() from informal doc Will Deacon
2020-06-30 17:37 ` [PATCH 12/18] include/linux: Remove smp_read_barrier_depends() from comments Will Deacon
2020-06-30 17:37 ` [PATCH 13/18] checkpatch: Remove checks relating to [smp_]read_barrier_depends() Will Deacon
2020-06-30 17:37 ` [PATCH 14/18] arm64: Reduce the number of header files pulled into vmlinux.lds.S Will Deacon
2020-06-30 17:37 ` [PATCH 15/18] arm64: alternatives: Split up alternative.h Will Deacon
2020-06-30 17:37 ` [PATCH 16/18] arm64: cpufeatures: Add capability for LDAPR instruction Will Deacon
2020-06-30 17:37 ` [PATCH 17/18] arm64: alternatives: Remove READ_ONCE() usage during patch operation Will Deacon
2020-06-30 17:37 ` [PATCH 18/18] arm64: lto: Strengthen READ_ONCE() to acquire when CLANG_LTO=y Will Deacon
2020-06-30 19:25 ` Arnd Bergmann
2020-07-01 10:19 ` Will Deacon
2020-07-01 10:59 ` Arnd Bergmann
2020-06-30 19:47 ` Marco Elver
2020-06-30 20:20 ` Peter Zijlstra
2020-06-30 22:57 ` Sami Tolvanen
2020-07-01 10:25 ` Will Deacon
2020-07-01 10:24 ` Will Deacon
2020-07-01 17:07 ` Dave P Martin
2020-07-02 7:23 ` Will Deacon
2020-07-06 16:00 ` Dave Martin
2020-07-06 16:34 ` Paul E. McKenney
2020-07-06 17:05 ` Dave Martin
2020-07-06 17:36 ` Paul E. McKenney
2020-07-07 10:29 ` Dave Martin
2020-07-07 22:51 ` Paul E. McKenney
2020-07-07 23:01 ` Nick Desaulniers [this message]
2020-07-08 7:15 ` Marco Elver
2020-07-08 9:16 ` Peter Zijlstra
2020-07-08 18:20 ` Paul E. McKenney
2020-07-06 18:35 ` Will Deacon
2020-07-06 19:23 ` Marco Elver
2020-07-06 19:42 ` Paul E. McKenney
2020-07-06 16:08 ` Dave Martin
2020-07-06 18:35 ` Will Deacon
2020-07-07 10:10 ` Dave Martin
2020-07-01 7:38 ` [PATCH 00/18] Allow architectures to override __READ_ONCE() Josh Triplett
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAKwvOdkW__H21m8vqqk1-n6-KK67HBk=YbA+MkUS7igxfjV1iw@mail.gmail.com' \
--to=ndesaulniers@google.com \
--cc=Dave.Martin@arm.com \
--cc=arnd@arndb.de \
--cc=boqun.feng@gmail.com \
--cc=catalin.marinas@arm.com \
--cc=elver@google.com \
--cc=ink@jurassic.park.msu.ru \
--cc=jasowang@redhat.com \
--cc=josh@joshtriplett.org \
--cc=keescook@chromium.org \
--cc=kernel-team@android.com \
--cc=linux-alpha@vger.kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=mattst88@gmail.com \
--cc=mst@redhat.com \
--cc=paulmck@kernel.org \
--cc=peterz@infradead.org \
--cc=rostedt@goodmis.org \
--cc=rth@twiddle.net \
--cc=samitolvanen@google.com \
--cc=stern@rowland.harvard.edu \
--cc=virtualization@lists.linux-foundation.org \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).