From: comex <comexk@gmail.com>
To: Linus Torvalds <torvalds@linux-foundation.org>
Cc: "Dr. David Alan Gilbert" <dave@treblig.org>,
"Kent Overstreet" <kent.overstreet@linux.dev>,
"Philipp Stanner" <pstanner@redhat.com>,
"Boqun Feng" <boqun.feng@gmail.com>,
rust-for-linux <rust-for-linux@vger.kernel.org>,
linux-kernel@vger.kernel.org, linux-arch@vger.kernel.org,
llvm@lists.linux.dev, "Miguel Ojeda" <ojeda@kernel.org>,
"Alex Gaynor" <alex.gaynor@gmail.com>,
"Wedson Almeida Filho" <wedsonaf@gmail.com>,
"Gary Guo" <gary@garyguo.net>,
"Björn Roy Baron" <bjorn3_gh@protonmail.com>,
"Benno Lossin" <benno.lossin@proton.me>,
"Andreas Hindborg" <a.hindborg@samsung.com>,
"Alice Ryhl" <aliceryhl@google.com>,
"Alan Stern" <stern@rowland.harvard.edu>,
"Andrea Parri" <parri.andrea@gmail.com>,
"Will Deacon" <will@kernel.org>,
"Peter Zijlstra" <peterz@infradead.org>,
"Nicholas Piggin" <npiggin@gmail.com>,
"David Howells" <dhowells@redhat.com>,
"Jade Alglave" <j.alglave@ucl.ac.uk>,
"Luc Maranget" <luc.maranget@inria.fr>,
"Paul E. McKenney" <paulmck@kernel.org>,
"Akira Yokosawa" <akiyks@gmail.com>,
"Daniel Lustig" <dlustig@nvidia.com>,
"Joel Fernandes" <joel@joelfernandes.org>,
"Nathan Chancellor" <nathan@kernel.org>,
"Nick Desaulniers" <ndesaulniers@google.com>,
kent.overstreet@gmail.com,
"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
"Marco Elver" <elver@google.com>,
"Mark Rutland" <mark.rutland@arm.com>,
"Thomas Gleixner" <tglx@linutronix.de>,
"Ingo Molnar" <mingo@redhat.com>,
"Borislav Petkov" <bp@alien8.de>,
"Dave Hansen" <dave.hansen@linux.intel.com>,
x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>,
"Catalin Marinas" <catalin.marinas@arm.com>,
linux-arm-kernel@lists.infradead.org,
linux-fsdevel@vger.kernel.org
Subject: Re: [WIP 0/3] Memory model and atomic API in Rust
Date: Wed, 27 Mar 2024 09:16:09 -0700 [thread overview]
Message-ID: <160DB953-1588-418E-A490-381009CD8DE0@gmail.com> (raw)
In-Reply-To: <CAHk-=wjwxKD9CxYsf5x+K5fJbJa_JYZh1eKB4PT5cZJq1+foGw@mail.gmail.com>
On Mar 25, 2024, at 8:49 PM, Linus Torvalds <torvalds@linux-foundation.org> wrote:
> But you should _start_ the design of your language memory model around
> the unsafe "raw atomic access operations" model.
>
> Then you can use those strictly more powerful operations, and you
> create an object model *around* it.
To some extent Rust does this already, unlike C++.
C++ allows atomics to be implemented using locks. Partly for this reason,
`std::atomic<T>` is documented as not necessarily having the same
representation as `T` [1]. C++ also has strict aliasing, so even if those types
do have the same representation, you still can't cast `T *` to
`std::atomic<T> *`.
But Rust atomics are lower-level. First, they are guaranteed lock-free [2].
Second, they are documented as having "the same in-memory representation as the
underlying" type [3]. (They also usually have the same alignment, except on
x86 where u64 is only 4-byte aligned but AtomicU64 of course needs to be 8-byte
aligned.) Meanwhile, Rust intentionally lacks strict aliasing.
Combined, this means it's perfectly legal in Rust to cast e.g. `&mut u32` to
`&AtomicU32` and perform atomic accesses on it. Or the same with u64/AtomicU64
if you know the pointer is validly aligned. This is by design; the Atomic
types' methods are considered the official way to perform atomic operations on
arbitrary memory, making it unnecessary to also stabilize 'lower-level'
intrinsics.
That said, there *are* currently some holes in Rust's atomics model, based on
the fact that it's mostly inherited from C++. From the documentation:
> Since C++ does not support mixing atomic and non-atomic accesses, or
> non-synchronized different-sized accesses to the same data, Rust does not
> support those operations either. Note that both of those restrictions only
> apply if the accesses are non-synchronized.
https://doc.rust-lang.org/std/sync/atomic/index.html
There are some open issues around this:
- "How can we allow read-read races between atomic and non-atomic accesses?"
https://github.com/rust-lang/unsafe-code-guidelines/issues/483
> [..] I do think we should allow such code. However, then we have to change
> the way we document our atomics [..]
- "What about: mixed-size atomic accesses"
https://github.com/rust-lang/unsafe-code-guidelines/issues/345"
> Apparently the x86 manual says you "should" not do this [..] It is unclear
> what "should" means (or what anything else here really means, operationally
> speaking...)
[1] https://eel.is/c++draft/atomics#types.generic.general-3
[2] https://doc.rust-lang.org/std/sync/atomic/index.html#portability
[3] https://doc.rust-lang.org/nightly/std/sync/atomic/struct.AtomicU64.html
next prev parent reply other threads:[~2024-03-27 16:16 UTC|newest]
Thread overview: 76+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-22 23:38 [WIP 0/3] Memory model and atomic API in Rust Boqun Feng
2024-03-22 23:38 ` [WIP 1/3] rust: Introduce atomic module Boqun Feng
2024-03-22 23:52 ` Andrew Lunn
2024-03-23 0:03 ` Boqun Feng
2024-03-23 19:13 ` Miguel Ojeda
2024-03-23 19:30 ` Boqun Feng
2024-03-23 9:58 ` Alice Ryhl
2024-03-23 14:10 ` Andrew Lunn
2024-03-23 19:09 ` Miguel Ojeda
2024-03-26 5:56 ` Trevor Gross
2024-03-22 23:38 ` [WIP 2/3] rust: atomic: Add ARM64 fetch_add_relaxed() Boqun Feng
2024-03-22 23:38 ` [WIP 3/3] rust: atomic: Add fetch_sub_release() Boqun Feng
2024-03-22 23:57 ` [WIP 0/3] Memory model and atomic API in Rust Kent Overstreet
2024-03-23 0:12 ` Linus Torvalds
2024-03-23 0:21 ` Kent Overstreet
2024-03-23 0:36 ` Linus Torvalds
2024-03-23 2:07 ` Kent Overstreet
2024-03-23 2:26 ` Boqun Feng
2024-03-23 2:33 ` Kent Overstreet
2024-03-23 2:57 ` Boqun Feng
2024-03-23 3:10 ` Kent Overstreet
2024-03-23 3:51 ` Boqun Feng
2024-03-23 4:16 ` Kent Overstreet
2024-03-25 13:56 ` Philipp Stanner
2024-03-25 17:44 ` Linus Torvalds
2024-03-25 18:59 ` Kent Overstreet
2024-03-25 19:44 ` Linus Torvalds
2024-03-25 21:14 ` Kent Overstreet
2024-03-25 21:37 ` Boqun Feng
2024-03-25 22:09 ` Kent Overstreet
2024-03-25 22:38 ` Boqun Feng
2024-03-25 23:02 ` Kent Overstreet
2024-03-25 23:41 ` Boqun Feng
2024-03-26 0:05 ` Dr. David Alan Gilbert
2024-03-26 0:36 ` Kent Overstreet
2024-03-26 1:35 ` Dr. David Alan Gilbert
2024-03-26 3:28 ` Kent Overstreet
2024-03-26 2:51 ` Boqun Feng
2024-03-26 3:49 ` Linus Torvalds
2024-03-26 14:35 ` Dr. David Alan Gilbert
2024-03-27 16:16 ` comex [this message]
2024-03-27 18:50 ` Kent Overstreet
2024-03-27 19:07 ` Linus Torvalds
2024-03-27 19:41 ` Kent Overstreet
2024-03-27 20:45 ` Linus Torvalds
2024-03-27 21:41 ` Kent Overstreet
2024-03-27 22:57 ` Linus Torvalds
2024-03-27 23:35 ` Kent Overstreet
2024-03-27 21:21 ` Boqun Feng
2024-03-27 21:49 ` Kent Overstreet
2024-03-27 22:26 ` Boqun Feng
2024-03-27 21:56 ` comex
2024-03-27 22:02 ` comex
2024-04-05 17:13 ` Philipp Stanner
2024-04-08 16:02 ` Matthew Wilcox
2024-04-08 16:55 ` Paul E. McKenney
2024-04-08 17:03 ` Matthew Wilcox
2024-04-08 18:47 ` Paul E. McKenney
2024-04-09 0:58 ` Kent Overstreet
2024-04-09 4:47 ` Paul E. McKenney
2024-04-08 17:01 ` Linus Torvalds
2024-04-08 18:14 ` Al Viro
2024-04-08 20:05 ` Linus Torvalds
2024-03-23 21:40 ` comex
2024-03-24 15:22 ` Alan Stern
2024-03-24 17:37 ` comex
2024-03-23 0:15 ` Boqun Feng
2024-03-23 0:49 ` Boqun Feng
2024-03-23 1:42 ` Kent Overstreet
2024-03-23 14:29 ` Andrew Lunn
2024-03-23 14:41 ` Boqun Feng
2024-03-23 14:55 ` Boqun Feng
2024-03-25 10:44 ` Mark Rutland
2024-03-25 20:59 ` Boqun Feng
2024-04-09 10:50 ` Peter Zijlstra
2024-04-16 18:12 ` Boqun Feng
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=160DB953-1588-418E-A490-381009CD8DE0@gmail.com \
--to=comexk@gmail.com \
--cc=a.hindborg@samsung.com \
--cc=akiyks@gmail.com \
--cc=alex.gaynor@gmail.com \
--cc=aliceryhl@google.com \
--cc=benno.lossin@proton.me \
--cc=bjorn3_gh@protonmail.com \
--cc=boqun.feng@gmail.com \
--cc=bp@alien8.de \
--cc=catalin.marinas@arm.com \
--cc=dave.hansen@linux.intel.com \
--cc=dave@treblig.org \
--cc=dhowells@redhat.com \
--cc=dlustig@nvidia.com \
--cc=elver@google.com \
--cc=gary@garyguo.net \
--cc=gregkh@linuxfoundation.org \
--cc=hpa@zytor.com \
--cc=j.alglave@ucl.ac.uk \
--cc=joel@joelfernandes.org \
--cc=kent.overstreet@gmail.com \
--cc=kent.overstreet@linux.dev \
--cc=linux-arch@vger.kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=llvm@lists.linux.dev \
--cc=luc.maranget@inria.fr \
--cc=mark.rutland@arm.com \
--cc=mingo@redhat.com \
--cc=nathan@kernel.org \
--cc=ndesaulniers@google.com \
--cc=npiggin@gmail.com \
--cc=ojeda@kernel.org \
--cc=parri.andrea@gmail.com \
--cc=paulmck@kernel.org \
--cc=peterz@infradead.org \
--cc=pstanner@redhat.com \
--cc=rust-for-linux@vger.kernel.org \
--cc=stern@rowland.harvard.edu \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
--cc=wedsonaf@gmail.com \
--cc=will@kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).