On 05/14, Alexei Starovoitov wrote:
> On Tue, May 14, 2019 at 10:53 AM Stanislav Fomichev <sdf@xxxxxxxxxxx> wrote:
> >
> > Existing __rcu annotations don't add anything to the safety.
>
> what do you mean?
> BPF_PROG_RUN_ARRAY derefs these pointers under rcu.
And I'm not removing them from the struct definitions, I'm removing __rcu
from the helpers' arguments only. Because those helpers are always called
with the mutex and don't need it. To reiterate: rcu_dereference_protected
is enough to get a pointer (from __rcu annotated) for the duration
of the mutex, helpers can operate on the non-annotated (dereferenced) prog
array.
Read section still does the following (BPF_PROG_RUN_ARRAY):
rcu_read_lock();
p = rcu_dereference(__rcu'd progs);
while (p) {}
rcu_read_unlock();
And write sections do:
mutex_lock(&mtx);
p = rcu_dereference_protected(__rcu'd progs, lockdep_is_held(&mtx);
// ^^^ does rcu_dereference in the mutex protected section
bpf_prog_array_length(p);
bpf_prog_array_copy_to_user(p, ...);
bpf_prog_array_delete_safe(p);
bpf_prog_array_copy_info(p);
bpf_prog_array_copy(p, ...);
bpf_prog_array_free(p);
// ^^^ all these helpers are consistent already with or
// without __rcu annotation because we hold a mutex and
// guarantee no concurrent updates, so __rcu annotations
// for their input arguments is not needed.
mutex_unlock(&mtx);
