From: "Dr. David Alan Gilbert" <dave@treblig.org>
To: Linus Torvalds <torvalds@linux-foundation.org>
Cc: "Kent Overstreet" <kent.overstreet@linux.dev>,
"Philipp Stanner" <pstanner@redhat.com>,
"Boqun Feng" <boqun.feng@gmail.com>,
rust-for-linux@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-arch@vger.kernel.org, llvm@lists.linux.dev,
"Miguel Ojeda" <ojeda@kernel.org>,
"Alex Gaynor" <alex.gaynor@gmail.com>,
"Wedson Almeida Filho" <wedsonaf@gmail.com>,
"Gary Guo" <gary@garyguo.net>,
"Björn Roy Baron" <bjorn3_gh@protonmail.com>,
"Benno Lossin" <benno.lossin@proton.me>,
"Andreas Hindborg" <a.hindborg@samsung.com>,
"Alice Ryhl" <aliceryhl@google.com>,
"Alan Stern" <stern@rowland.harvard.edu>,
"Andrea Parri" <parri.andrea@gmail.com>,
"Will Deacon" <will@kernel.org>,
"Peter Zijlstra" <peterz@infradead.org>,
"Nicholas Piggin" <npiggin@gmail.com>,
"David Howells" <dhowells@redhat.com>,
"Jade Alglave" <j.alglave@ucl.ac.uk>,
"Luc Maranget" <luc.maranget@inria.fr>,
"Paul E. McKenney" <paulmck@kernel.org>,
"Akira Yokosawa" <akiyks@gmail.com>,
"Daniel Lustig" <dlustig@nvidia.com>,
"Joel Fernandes" <joel@joelfernandes.org>,
"Nathan Chancellor" <nathan@kernel.org>,
"Nick Desaulniers" <ndesaulniers@google.com>,
kent.overstreet@gmail.com,
"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
elver@google.com, "Mark Rutland" <mark.rutland@arm.com>,
"Thomas Gleixner" <tglx@linutronix.de>,
"Ingo Molnar" <mingo@redhat.com>,
"Borislav Petkov" <bp@alien8.de>,
"Dave Hansen" <dave.hansen@linux.intel.com>,
x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>,
"Catalin Marinas" <catalin.marinas@arm.com>,
linux-arm-kernel@lists.infradead.org,
linux-fsdevel@vger.kernel.org
Subject: Re: [WIP 0/3] Memory model and atomic API in Rust
Date: Tue, 26 Mar 2024 14:35:19 +0000 [thread overview]
Message-ID: <ZgLdJwx1Mld-MJeX@gallifrey> (raw)
In-Reply-To: <CAHk-=wjwxKD9CxYsf5x+K5fJbJa_JYZh1eKB4PT5cZJq1+foGw@mail.gmail.com>
* Linus Torvalds (torvalds@linux-foundation.org) wrote:
> On Mon, 25 Mar 2024 at 17:05, Dr. David Alan Gilbert <dave@treblig.org> wrote:
> >
> > Isn't one of the aims of the Rust/C++ idea that you can't forget to access
> > a shared piece of data atomically?
>
> If that is an aim, it's a really *bad* one.
>
> Really.
>
> It very much should never have been an aim, and I hope it wasn't. I
> think, and hope, that the source of the C++ and Rust bad decisions is
> cluelessness, not active malice.
Oh that hit a nerve :-)
> Take Rust - one big point of Rust is the whole "safe" thing, but it's
> very much not a straightjacket like Pascal was. There's a "safe" part
> to Rust, but equally importantly, there's also the "unsafe" part to
> Rust.
>
> The safe part is the one that most programmers are supposed to use.
> It's the one that allows you to not have to worry too much about
> things. It's the part that makes it much harder to screw up.
>
> But the *unsafe* part is what makes Rust powerful. It's the part that
> works behind the curtain. It's the part that may be needed to make the
> safe parts *work*.
>
> And yes, an application programmer might never actually need to use
> it, and in fact in many projects the rule might be that unsafe Rust is
> simply never even an option - but that doesn't mean that the unsafe
> parts don't exist.
>
> Because those unsafe parts are needed to make it all work in reality.
>
> And you should never EVER base your whole design around the "safe"
> part. Then you get a language that is a straight-jacket.
>
> So I'd very strongly argue that the core atomics should be done the
> "unsafe" way - allow people to specify exactly when they want exactly
> what access. Allow people to mix and match and have overlapping
> partial aliases, because if you implement things like locking, you
> *need* those partially aliasing accesses, and you need to make
> overlapping atomics where sometimes you access only one part of the
> field.
>
> And yes, that will be unsafe, and it might even be unportable, but
> it's exactly the kind of thing you need in order to avoid having to
> use assembly language to do your locking.
>
> And by all means, you should relegate that to the "unsafe corner" of
> the language. And maybe don't talk about the unsafe sharp edges in the
> first chapter of the book about the language.
>
> But you should _start_ the design of your language memory model around
> the unsafe "raw atomic access operations" model.
>
> Then you can use those strictly more powerful operations, and you
> create an object model *around* it.
>
> So you create safe objects like just an atomic counter. In *that*
> corner of the language, you have the "safe atomics" - they aren't the
> fundamental implementation, but they are the safe wrappers *around*
> the more powerful (but unsafe) core.
>
> With that "atomic counter" you cannot forget to do atomic accesses,
> because that safe corner of the world doesn't _have_ anything but the
> safe atomic accesses for every time you use the object.
>
> See? Having the capability to do powerful and maybe unsafe things does
> not force people to expose and use all that power. You can - and
> should - wrap the powerful model with safer and simpler interfaces.
I'd agree it's important to get the primitives right; but
I'd argue that from a design point of view it's probably better to keep
both in mind from early on; you need to create a safe interface which
people can actually use most of the time, otherwise you're not getting
any benefit; so yes get the bases right, but just keep a feel for how
they'll get encapsulated so most of the more boring code can be safe.
> This isn't something specific to atomics. Not even remotely. This is
> quite fundamental. You often literally _cannot_ do interesting things
> using only safe interfaces. You want safe memory allocations - but to
> actually write the allocator itself, you want to have all those unsafe
> escape methods - all those raw pointers with arbitrary arithmetic etc.
>
> And if you don't have unsafe escapes, you end up doing what so many
> languages did: the libraries are written in something more powerful
> like C, because C literally can do things that other languages
> *cannot* do.
Yeh that's fine, I'm not at all arguing against that; but it doesn't
mean you shouldn't keep an eye on how the safe side should look; even in the
kernel.
Get it right and those unsafe escapes shouldn't be needed too commonly;
get it wrong and you'll either have painful abstractions or end up with
unsafes shotgunned all over the place.
> Don't let people fool you with talk about Turing machines and similar
> smoke-and-mirror garbage. It's a bedtime story for first-year CS
> students. It's not true.
My infinitely long tape is still on back order.
Dave
> things. If your language doesn't have those unsafe escapes, your
> language is inherently weaker, and inherently worse for it.
>
> Linus
>
--
-----Open up your eyes, open up your mind, open up your code -------
/ Dr. David Alan Gilbert | Running GNU/Linux | Happy \
\ dave @ treblig.org | | In Hex /
\ _________________________|_____ http://www.treblig.org |_______/
next prev parent reply other threads:[~2024-03-26 14:35 UTC|newest]
Thread overview: 76+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-22 23:38 [WIP 0/3] Memory model and atomic API in Rust Boqun Feng
2024-03-22 23:38 ` [WIP 1/3] rust: Introduce atomic module Boqun Feng
2024-03-22 23:52 ` Andrew Lunn
2024-03-23 0:03 ` Boqun Feng
2024-03-23 19:13 ` Miguel Ojeda
2024-03-23 19:30 ` Boqun Feng
2024-03-23 9:58 ` Alice Ryhl
2024-03-23 14:10 ` Andrew Lunn
2024-03-23 19:09 ` Miguel Ojeda
2024-03-26 5:56 ` Trevor Gross
2024-03-22 23:38 ` [WIP 2/3] rust: atomic: Add ARM64 fetch_add_relaxed() Boqun Feng
2024-03-22 23:38 ` [WIP 3/3] rust: atomic: Add fetch_sub_release() Boqun Feng
2024-03-22 23:57 ` [WIP 0/3] Memory model and atomic API in Rust Kent Overstreet
2024-03-23 0:12 ` Linus Torvalds
2024-03-23 0:21 ` Kent Overstreet
2024-03-23 0:36 ` Linus Torvalds
2024-03-23 2:07 ` Kent Overstreet
2024-03-23 2:26 ` Boqun Feng
2024-03-23 2:33 ` Kent Overstreet
2024-03-23 2:57 ` Boqun Feng
2024-03-23 3:10 ` Kent Overstreet
2024-03-23 3:51 ` Boqun Feng
2024-03-23 4:16 ` Kent Overstreet
2024-03-25 13:56 ` Philipp Stanner
2024-03-25 17:44 ` Linus Torvalds
2024-03-25 18:59 ` Kent Overstreet
2024-03-25 19:44 ` Linus Torvalds
2024-03-25 21:14 ` Kent Overstreet
2024-03-25 21:37 ` Boqun Feng
2024-03-25 22:09 ` Kent Overstreet
2024-03-25 22:38 ` Boqun Feng
2024-03-25 23:02 ` Kent Overstreet
2024-03-25 23:41 ` Boqun Feng
2024-03-26 0:05 ` Dr. David Alan Gilbert
2024-03-26 0:36 ` Kent Overstreet
2024-03-26 1:35 ` Dr. David Alan Gilbert
2024-03-26 3:28 ` Kent Overstreet
2024-03-26 2:51 ` Boqun Feng
2024-03-26 3:49 ` Linus Torvalds
2024-03-26 14:35 ` Dr. David Alan Gilbert [this message]
2024-03-27 16:16 ` comex
2024-03-27 18:50 ` Kent Overstreet
2024-03-27 19:07 ` Linus Torvalds
2024-03-27 19:41 ` Kent Overstreet
2024-03-27 20:45 ` Linus Torvalds
2024-03-27 21:41 ` Kent Overstreet
2024-03-27 22:57 ` Linus Torvalds
2024-03-27 23:35 ` Kent Overstreet
2024-03-27 21:21 ` Boqun Feng
2024-03-27 21:49 ` Kent Overstreet
2024-03-27 22:26 ` Boqun Feng
2024-03-27 21:56 ` comex
2024-03-27 22:02 ` comex
2024-04-05 17:13 ` Philipp Stanner
2024-04-08 16:02 ` Matthew Wilcox
2024-04-08 16:55 ` Paul E. McKenney
2024-04-08 17:03 ` Matthew Wilcox
2024-04-08 18:47 ` Paul E. McKenney
2024-04-09 0:58 ` Kent Overstreet
2024-04-09 4:47 ` Paul E. McKenney
2024-04-08 17:01 ` Linus Torvalds
2024-04-08 18:14 ` Al Viro
2024-04-08 20:05 ` Linus Torvalds
2024-03-23 21:40 ` comex
2024-03-24 15:22 ` Alan Stern
2024-03-24 17:37 ` comex
2024-03-23 0:15 ` Boqun Feng
2024-03-23 0:49 ` Boqun Feng
2024-03-23 1:42 ` Kent Overstreet
2024-03-23 14:29 ` Andrew Lunn
2024-03-23 14:41 ` Boqun Feng
2024-03-23 14:55 ` Boqun Feng
2024-03-25 10:44 ` Mark Rutland
2024-03-25 20:59 ` Boqun Feng
2024-04-09 10:50 ` Peter Zijlstra
2024-04-16 18:12 ` Boqun Feng
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZgLdJwx1Mld-MJeX@gallifrey \
--to=dave@treblig.org \
--cc=a.hindborg@samsung.com \
--cc=akiyks@gmail.com \
--cc=alex.gaynor@gmail.com \
--cc=aliceryhl@google.com \
--cc=benno.lossin@proton.me \
--cc=bjorn3_gh@protonmail.com \
--cc=boqun.feng@gmail.com \
--cc=bp@alien8.de \
--cc=catalin.marinas@arm.com \
--cc=dave.hansen@linux.intel.com \
--cc=dhowells@redhat.com \
--cc=dlustig@nvidia.com \
--cc=elver@google.com \
--cc=gary@garyguo.net \
--cc=gregkh@linuxfoundation.org \
--cc=hpa@zytor.com \
--cc=j.alglave@ucl.ac.uk \
--cc=joel@joelfernandes.org \
--cc=kent.overstreet@gmail.com \
--cc=kent.overstreet@linux.dev \
--cc=linux-arch@vger.kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=llvm@lists.linux.dev \
--cc=luc.maranget@inria.fr \
--cc=mark.rutland@arm.com \
--cc=mingo@redhat.com \
--cc=nathan@kernel.org \
--cc=ndesaulniers@google.com \
--cc=npiggin@gmail.com \
--cc=ojeda@kernel.org \
--cc=parri.andrea@gmail.com \
--cc=paulmck@kernel.org \
--cc=peterz@infradead.org \
--cc=pstanner@redhat.com \
--cc=rust-for-linux@vger.kernel.org \
--cc=stern@rowland.harvard.edu \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
--cc=wedsonaf@gmail.com \
--cc=will@kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).