关于linux内核的list.h中INIT_LIST_HEAD()中的WRITE_ONCE()的讨论

zhang

当前linux内核的主线的/include/linux/list.h的INIT_LIST_HEAD()的定义是这样的:

1. /**
   
2. * INIT_LIST_HEAD - Initialize a list_head structure
   
3. * @list: list_head structure to be initialized.
   
4. *
   
5. * Initializes the list_head to point to itself.  If it is a list header,
   
6. * the result is an empty list.
   
7. */
   
8. static inline void INIT_LIST_HEAD(struct list_head *list)
   
9. {
   
10.     WRITE_ONCE(list->next, list);
    
11.     WRITE_ONCE(list->prev, list);
    
12. }

复制代码

WRITE_ONCE(list->next, list)等同于list->next=list;
WRITE_ONCE(list->prev, list)等同于list->prev=list;
据我了解,加了WRITE_ONCE()是为了防止编译器自作主张进行重排

第一个WRITE_ONCE的提交链接: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2f073848c3cc8aff2655ab7c46d8c0de90cf4e50

list: Use WRITE_ONCE() when initializing list_head structures
Code that does lockless emptiness testing of non-RCU lists is relying
on INIT_LIST_HEAD() to write the list head's ->next pointer atomically,
particularly when INIT_LIST_HEAD() is invoked from list_del_init().
This commit therefore adds WRITE_ONCE() to this function's pointer stores
that could affect the head's ->next pointer.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Diffstat
-rw-r--r--    include/linux/list.h    2   
1 files changed, 1 insertions, 1 deletions
diff --git a/include/linux/list.h b/include/linux/list.h
index 06c2d887a9188..5356f4d661a72 100644
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -24,7 +24,7 @@

static inline void INIT_LIST_HEAD(struct list_head *list)
{
-    list->next = list;
+    WRITE_ONCE(list->next, list);
     list->prev = list;
}

我看了一下提交者的理由,自己想了一个例子来说明,如下:

1. //CPU0和CPU1并发访问共享变量entry,且无锁
   
2. //CPU0
   
3. list_del_init(entry);
   
4. do_something();          // 期间把 entry 指针写到一个全局可见的指针中
   
5.                          // 或者释放了自旋锁，而其他 CPU 在等待
   
6. // 其他 CPU 现在可以无锁地访问 entry
   
7. 
   
8. //内联展开后
   
9. __list_del_entry(entry);
   
10. INIT_LIST_HEAD(entry);
    
11. do_something();
    
12. //内联继续展开
    
13. __list_del_entry(entry);
    
14. WRITE_ONCE(list->next, list);
    
15. WRITE_ONCE(list->prev, list);
    
16. do_something();
    
17. 
    
18. //假设没有WRITE_ONCE,CPU0执行
    
19. __list_del_entry(entry);
    
20. list->next=list;
    
21. list->prev=list;
    
22. do_something();
    
23. //假设do_something()的执行和entry无关,编译器可以这样重排
    
24. __list_del_entry(entry);
    
25. do_something();
    
26. entry->next=entry;
    
27. entry->prev=entry;
    
28. 
    
29. // CPU1
    
30. if (list_empty(entry)) {
    
31.     //...
    
32. }
    
33. //展开后
    
34. if (READ_ONCE(entry->next) == entry) {
    
35.     //...
    
36. }
    
37. //假设没有READ_ONCE,CPU1执行
    
38. if (entry->next == entry) { //无锁判空
    
39.     //...
    
40. }
    
41. 
    
42. //最终编译器优化的结果
    
43. //CPU0
    
44. __list_del_entry(entry);
    
45. do_something();
    
46. entry->next=entry;
    
47. entry->prev=entry;
    
48. //CPU1
    
49. if (entry->next == entry) { //无锁判空
    
50.     //...
    
51. }
    
52. 
    
53. //并发执行
    
54. CPU0执行__list_del_entry(entry); 和 do_something();
    
55.             |
    
56.             |
    
57.             ↓
    
58. CPU1执行if (entry->next == entry) { //无锁判空
    
59.     //...
    
60. }
    
61.             |
    
62.             |
    
63.             ↓
    
64. CPU1发现entry仍然是旧值,原因是CPU0尚未执行
    
65. entry->next=entry;和entry->prev=entry;
    
66.             |
    
67.             |
    
68.             ↓
    
69. CPU1无锁判空失败!!!

复制代码

不知道我举的例子是否正确,向大家请教