linux-kernel - Re: [PATCH 03/13] rust: lock: introduce `Mutex`

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZCr0ZDlvlFHFIRbh@Boquns-Mac-mini.local>
Date:   Mon, 3 Apr 2023 08:44:36 -0700
From:   Boqun Feng <boqun.feng@...il.com>
To:     Gary Guo <gary@...yguo.net>
Cc:     Wedson Almeida Filho <wedsonaf@...il.com>,
        Peter Zijlstra <peterz@...radead.org>,
        rust-for-linux@...r.kernel.org, Miguel Ojeda <ojeda@...nel.org>,
        Alex Gaynor <alex.gaynor@...il.com>,
        Björn Roy Baron <bjorn3_gh@...tonmail.com>,
        linux-kernel@...r.kernel.org,
        Wedson Almeida Filho <walmeida@...rosoft.com>,
        Ingo Molnar <mingo@...hat.com>, Will Deacon <will@...nel.org>,
        Waiman Long <longman@...hat.com>
Subject: Re: [PATCH 03/13] rust: lock: introduce `Mutex`

On Mon, Apr 03, 2023 at 04:25:29PM +0100, Gary Guo wrote:
> On Mon, 3 Apr 2023 10:50:09 -0300
> Wedson Almeida Filho <wedsonaf@...il.com> wrote:
> 
> > On Mon, Apr 03, 2023 at 10:20:52AM +0200, Peter Zijlstra wrote:
> > > On Thu, Mar 30, 2023 at 11:47:12AM -0700, Boqun Feng wrote:  
> > > > On Thu, Mar 30, 2023 at 03:01:08PM +0200, Peter Zijlstra wrote:  
> > > > > On Thu, Mar 30, 2023 at 01:39:44AM -0300, Wedson Almeida Filho wrote:  
> > > > > > From: Wedson Almeida Filho <walmeida@...rosoft.com>
> > > > > > 
> > > > > > This is the `struct mutex` lock backend and allows Rust code to use the
> > > > > > kernel mutex idiomatically.  
> > > > > 
> > > > > What, if anything, are the plans to support the various lockdep
> > > > > annotations? Idem for the spinlock thing in the other patch I suppose.  
> > > > 
> > > > FWIW:
> > > > 
> > > > *	At the init stage, SpinLock and Mutex in Rust use initializers
> > > > 	that are aware of the lockdep, so everything (lockdep_map and
> > > > 	lock_class) is all set up.
> > > > 
> > > > *	At acquire or release time, Rust locks just use ffi to call C
> > > > 	functions that have lockdep annotations in them, so lockdep
> > > > 	should just work.
> > > >   
> > > 
> > > ffi is what the C++ world calls RAII ?  
> > 
> > No, ffi is 'foreign function interface', it just means that the caller will use
> > the same ABI as the callee.
> > 
> > > But yes, I got that far, but I wondered about things like
> > > spin_lock_nested(&foo, SINGLE_DEPTH_NESTING) and other such 'advanced'
> > > annotations.
> > > 
> > > Surely we're going to be needing them at some point. I suppose you can
> > > do the single depth nesting one with a special guard type (or whatever
> > > you call that in the rust world) ?  
> > 
> > I haven't looked at all the advanced annotations, but something like
> > spin_lock_nested/mutex_lock_nested can be exposed as a lock_nested() associated
> > function of the `Lock` type, so one would do:
> > 
> >   let guard = my_mutex.lock_nested(SINGLE_DEPTH_NESTING);
> >   // Do something with data protected by my_mutex.
> 
> I don't think an additional function would work. It's not okay to
> perform both nested locking and non-nested locking on the same lock

Note that lock_nested() here is simply a lockdep concept, it means
locking nested under the same lock class (key), not lock instance, for
example:

	spinlock_t X1;
	spinlock_t X2;

	// X1 and X2 are of the same lock class X
	spin_lock(&X1);
	spin_lock(&X2); // lockdep will report a deadlock.

	// However, if we know that X1 and X2 has some ordering to lock,
	// e.g. X1 is the lock for a directory and X2 is the lock for
	// the file in the directory, we can
	spin_lock(&X1);
	spin_lock_nested(&X2, SINGLE_DEPTH_NESTING);

	// and lockdep won't complain.

There is some design space here for Rust, since we may be able to put
the nested information in the type.

Regards,
Boqun

> because non-nested locking will give you a mutable reference, and
> getting another reference from nested lock guard would violate aliasing
> rules.
> 
> A new lock type would be needed for nested locking, and guard of it can
> only hand out immutable reference.
> 
> Best,
> Gary