From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:52913) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bm0sQ-000590-1y for qemu-devel@nongnu.org; Mon, 19 Sep 2016 11:53:03 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bm0sL-00058o-0f for qemu-devel@nongnu.org; Mon, 19 Sep 2016 11:53:01 -0400 Received: from mail-wm0-f52.google.com ([74.125.82.52]:38154) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bm0sK-00058V-NI for qemu-devel@nongnu.org; Mon, 19 Sep 2016 11:52:56 -0400 Received: by mail-wm0-f52.google.com with SMTP id l132so17138616wmf.1 for ; Mon, 19 Sep 2016 08:52:56 -0700 (PDT) From: =?UTF-8?q?Alex=20Benn=C3=A9e?= Date: Mon, 19 Sep 2016 16:51:31 +0100 Message-Id: <20160919155139.28371-1-alex.bennee@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [Qemu-devel] [RFC 0/8] A couple of fixes for ThreadSanitizer List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org, pbonzini@redhat.com, cota@braap.org, stefanha@redhat.com, kwolf@redhat.com Cc: mttcg@listserver.greensocs.com, fred.konrad@greensocs.com, a.rigo@virtualopensystems.com, bobby.prani@gmail.com, nikunj@linux.vnet.ibm.com, mark.burton@greensocs.com, jan.kiszka@siemens.com, serge.fdrv@gmail.com, rth@twiddle.net, peter.maydell@linaro.org, claudio.fontana@huawei.com, =?UTF-8?q?Alex=20Benn=C3=A9e?= Hi, As a precursor to next set of MTTCG reviews in my inbox I had a quick look at the current state of using ThreadSanitizer with QEMU. There are a number of patches here: 1,2,3: workarounds for the compiler when tsan enabled 4,5,6,7: various fixes using atomic_set/read() 8: defend the build in Travis The fixes are mostly theoretical for x86 hosts as individual writes can't fight with each other to corrupt the final value. However being explicit about this is the correct thing to do and it reduces the noise of reports. With this series I'm still seeing some warnings about qht_insert racing with tb_alloc but the fixes didn't work so we suspect this might be a false positive from tsan. I've dropped the workaround from the series for now. In system-mode the big generator of warnings is coroutines which are heavily used in the block layer, for example: WARNING: ThreadSanitizer: data race (pid=11820) Read of size 8 at 0x7d0400008fa0 by thread T2: #0 strlen (libtsan.so.0+0x000000025f6d) #1 pthread_setname_np (libpthread.so.0+0x000000012395) #2 (libglib-2.0.so.0+0x000000070bad) Previous write of size 8 at 0x7d0400008fa0 by main thread (mutexes: write M658): #0 malloc (libtsan.so.0+0x0000000254a3) #1 g_malloc (libglib-2.0.so.0+0x00000004f728) #2 qemu_coroutine_new util/coroutine-gthread.c:144 (qemu-system-aarch64+0x000000c79ad0) #3 qemu_coroutine_create util/qemu-coroutine.c:75 (qemu-system-aarch64+0x000000c77f9d) #4 bdrv_prwv_co block/io.c:590 (qemu-system-aarch64+0x000000b9dd75) I think these are fixable with memory barriers but I'm going to need to re-watch the KVM Forum video on the subject to remind myself of the black magic that coroutines involves (unless anyone else wants to tackle that). With this series applied you can enable ThreadSanitizer with the following command line: ./configure --extra-cflags="-g3 -O0 \ -fsantize=thread \ -fsanitize-blacklist=/home/alex/lsrc/qemu/qemu.git/blacklist.tsan" \ --with-coroutine=gthread --disable-pie --enable-debug --enable-debug-info breakdown: -fsanitize=thread - enables sanitizer -fsanitize-blacklist - skip things the compiler finds hard, like SSE --with-coroutine=gthread - tsan chokes on other forms of coroutine --disable-pie - tsan no longer works with PIE --enable-debug --enable-debug-info - better backtraces Alex Bennée (7): ui/vnc-enc-tight: add abort() for unexpected default tcg/optimize: move default return out of if statement new: blacklist.tsan qom/object: update class cache atomically cpu: atomically modify cpu->exit_request util/qht: atomically set b->hashes .travis.yml: add gcc sanitizer build Paolo Bonzini (1): seqlock: use atomic writes for the sequence .travis.yml | 16 ++++++++++++++++ blacklist.tsan | 2 ++ cpu-exec.c | 8 ++++---- include/qemu/seqlock.h | 4 ++-- qom/cpu.c | 4 ++-- qom/object.c | 15 ++++++++------- tcg/optimize.c | 3 +-- ui/vnc-enc-tight.c | 2 ++ util/qht.c | 10 +++++----- 9 files changed, 42 insertions(+), 22 deletions(-) create mode 100644 blacklist.tsan -- 2.9.3