From: Robert Foley <robert.foley@linaro.org>
To: qemu-devel@nongnu.org
Cc: robert.foley@linaro.org,
Richard Henderson <richard.henderson@linaro.org>,
cota@braap.org, Paolo Bonzini <pbonzini@redhat.com>,
peter.puhov@linaro.org, alex.bennee@linaro.org
Subject: [PATCH 13/19] accel/tcg: Fixed tsan warnings.
Date: Fri, 22 May 2020 12:07:49 -0400 [thread overview]
Message-ID: <20200522160755.886-14-robert.foley@linaro.org> (raw)
In-Reply-To: <20200522160755.886-1-robert.foley@linaro.org>
For example:
WARNING: ThreadSanitizer: data race (pid=35425)
Write of size 4 at 0x7bbc000000ac by main thread (mutexes: write M875):
#0 cpu_reset_interrupt hw/core/cpu.c:107:28 (qemu-system-aarch64+0x843790)
#1 arm_cpu_set_irq target/arm/cpu.c (qemu-system-aarch64+0x616265)
#2 qemu_set_irq hw/core/irq.c:44:5 (qemu-system-aarch64+0x8462ca)
Previous atomic read of size 4 at 0x7bbc000000ac by thread T6:
#0 __tsan_atomic32_load <null> (qemu-system-aarch64+0x394c1c)
#1 cpu_handle_interrupt accel/tcg/cpu-exec.c:534:9 (qemu-system-aarch64+0x4b7e79)
#2 cpu_exec accel/tcg/cpu-exec.c:720:17 (qemu-system-aarch64+0x4b7e79)
or
WARNING: ThreadSanitizer: data race (pid=25425)
Read of size 8 at 0x7f8ad8e138d0 by thread T10:
#0 tb_lookup_cmp accel/tcg/cpu-exec.c:307:13 (qemu-system-aarch64+0x4ac4d2)
#1 qht_do_lookup util/qht.c:502:34 (qemu-system-aarch64+0xd05264)
Previous write of size 8 at 0x7f8ad8e138d0 by thread T15 (mutexes: write M728311726235541804):
#0 tb_link_page accel/tcg/translate-all.c:1625:26 (qemu-system-aarch64+0x4b0bf2)
#1 tb_gen_code accel/tcg/translate-all.c:1865:19 (qemu-system-aarch64+0x4b0bf2)
#2 tb_find accel/tcg/cpu-exec.c:407:14 (qemu-system-aarch64+0x4ad77c)
Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Robert Foley <robert.foley@linaro.org>
---
accel/tcg/tcg-all.c | 4 ++--
accel/tcg/tcg-runtime.c | 7 ++++++-
accel/tcg/translate-all.c | 6 +++++-
hw/core/cpu.c | 2 +-
4 files changed, 14 insertions(+), 5 deletions(-)
diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index 3b4fda5640..f94ea4c4b3 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -54,8 +54,8 @@ static void tcg_handle_interrupt(CPUState *cpu, int mask)
int old_mask;
g_assert(qemu_mutex_iothread_locked());
- old_mask = cpu->interrupt_request;
- cpu->interrupt_request |= mask;
+ old_mask = atomic_read(&cpu->interrupt_request);
+ atomic_or(&cpu->interrupt_request, mask);
/*
* If called from iothread context, wake the target cpu in
diff --git a/accel/tcg/tcg-runtime.c b/accel/tcg/tcg-runtime.c
index 446465a09a..bd0cd77450 100644
--- a/accel/tcg/tcg-runtime.c
+++ b/accel/tcg/tcg-runtime.c
@@ -31,6 +31,7 @@
#include "disas/disas.h"
#include "exec/log.h"
#include "tcg/tcg.h"
+#include "qemu/tsan.h"
/* 32-bit helpers */
@@ -151,6 +152,7 @@ void *HELPER(lookup_tb_ptr)(CPUArchState *env)
TranslationBlock *tb;
target_ulong cs_base, pc;
uint32_t flags;
+ void *tc_ptr;
tb = tb_lookup__cpu_state(cpu, &pc, &cs_base, &flags, curr_cflags());
if (tb == NULL) {
@@ -161,7 +163,10 @@ void *HELPER(lookup_tb_ptr)(CPUArchState *env)
TARGET_FMT_lx "/" TARGET_FMT_lx "/%#x] %s\n",
cpu->cpu_index, tb->tc.ptr, cs_base, pc, flags,
lookup_symbol(pc));
- return tb->tc.ptr;
+ TSAN_ANNOTATE_IGNORE_READS_BEGIN();
+ tc_ptr = tb->tc.ptr;
+ TSAN_ANNOTATE_IGNORE_READS_END();
+ return tc_ptr;
}
void HELPER(exit_atomic)(CPUArchState *env)
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 3fb71a1503..6c0e61994c 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -58,6 +58,7 @@
#include "exec/log.h"
#include "sysemu/cpus.h"
#include "sysemu/tcg.h"
+#include "qemu/tsan.h"
/* #define DEBUG_TB_INVALIDATE */
/* #define DEBUG_TB_FLUSH */
@@ -1704,6 +1705,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
max_insns = 1;
}
+ TSAN_ANNOTATE_IGNORE_WRITES_BEGIN();
buffer_overflow:
tb = tcg_tb_alloc(tcg_ctx);
if (unlikely(!tb)) {
@@ -1902,9 +1904,11 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
orig_aligned -= ROUND_UP(sizeof(*tb), qemu_icache_linesize);
atomic_set(&tcg_ctx->code_gen_ptr, (void *)orig_aligned);
tb_destroy(tb);
+ TSAN_ANNOTATE_IGNORE_WRITES_END();
return existing_tb;
}
tcg_tb_insert(tb);
+ TSAN_ANNOTATE_IGNORE_WRITES_END();
return tb;
}
@@ -2409,7 +2413,7 @@ void dump_opcount_info(void)
void cpu_interrupt(CPUState *cpu, int mask)
{
g_assert(qemu_mutex_iothread_locked());
- cpu->interrupt_request |= mask;
+ atomic_or(&cpu->interrupt_request, mask);
atomic_set(&cpu_neg(cpu)->icount_decr.u16.high, -1);
}
diff --git a/hw/core/cpu.c b/hw/core/cpu.c
index 77703d62b7..6c16ccc426 100644
--- a/hw/core/cpu.c
+++ b/hw/core/cpu.c
@@ -104,7 +104,7 @@ void cpu_reset_interrupt(CPUState *cpu, int mask)
if (need_lock) {
qemu_mutex_lock_iothread();
}
- cpu->interrupt_request &= ~mask;
+ atomic_and(&cpu->interrupt_request, ~mask);
if (need_lock) {
qemu_mutex_unlock_iothread();
}
--
2.17.1
next prev parent reply other threads:[~2020-05-22 16:22 UTC|newest]
Thread overview: 51+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-22 16:07 [PATCH 00/19] Add Thread Sanitizer support to QEMU Robert Foley
2020-05-22 16:07 ` [PATCH 01/19] configure: add --enable-tsan flag + fiber annotations for coroutine-ucontext Robert Foley
2020-05-23 16:55 ` Philippe Mathieu-Daudé
2020-05-26 12:38 ` Robert Foley
2020-06-17 14:24 ` Stefan Hajnoczi
2020-06-17 15:56 ` Alex Bennée
2020-06-17 21:27 ` Robert Foley
2020-05-22 16:07 ` [PATCH 02/19] cpu: convert queued work to a QSIMPLEQ Robert Foley
2020-05-24 10:20 ` Philippe Mathieu-Daudé
2020-05-26 15:01 ` Robert Foley
2020-05-22 16:07 ` [PATCH 03/19] thread: add qemu_spin_destroy Robert Foley
2020-05-22 16:07 ` [PATCH 04/19] cputlb: destroy CPUTLB with tlb_destroy Robert Foley
2020-05-22 16:07 ` [PATCH 05/19] qht: call qemu_spin_destroy for head buckets Robert Foley
2020-05-22 16:07 ` [PATCH 06/19] tcg: call qemu_spin_destroy for tb->jmp_lock Robert Foley
2020-05-22 16:07 ` [PATCH 07/19] translate-all: call qemu_spin_destroy for PageDesc Robert Foley
2020-05-22 16:07 ` [PATCH 08/19] thread: add tsan annotations to QemuSpin Robert Foley
2020-05-22 16:07 ` [PATCH 09/19] tests/docker: Added docker build support for TSan Robert Foley
2020-05-22 16:07 ` [PATCH 10/19] include/qemu: Added tsan.h for annotations Robert Foley
2020-05-23 17:20 ` Emilio G. Cota
2020-05-23 21:37 ` Emilio G. Cota
2020-05-22 16:07 ` [PATCH 11/19] accel/tcg: Fixed tsan warnings related to parallel_cpus Robert Foley
2020-05-23 17:21 ` Emilio G. Cota
2020-05-22 16:07 ` [PATCH 12/19] configure: added tsan support for blacklist Robert Foley
2020-05-23 17:27 ` Emilio G. Cota
2020-05-26 14:07 ` Robert Foley
2020-05-22 16:07 ` Robert Foley [this message]
2020-05-23 20:06 ` [PATCH 13/19] accel/tcg: Fixed tsan warnings Emilio G. Cota
2020-05-26 15:14 ` Robert Foley
2020-05-26 18:47 ` Paolo Bonzini
2020-05-22 16:07 ` [PATCH 14/19] util/async: " Robert Foley
2020-05-23 20:12 ` Emilio G. Cota
2020-05-26 15:19 ` Robert Foley
2020-05-26 10:32 ` Stefan Hajnoczi
2020-05-26 15:21 ` Robert Foley
2020-05-22 16:07 ` [PATCH 15/19] qht: Fix " Robert Foley
2020-05-23 20:44 ` Emilio G. Cota
2020-05-22 16:07 ` [PATCH 16/19] util: fixed tsan warnings in thread_pool.c Robert Foley
2020-05-26 20:18 ` Paolo Bonzini
2020-05-22 16:07 ` [PATCH 17/19] util: Added tsan annotate for thread name Robert Foley
2020-05-23 20:29 ` Emilio G. Cota
2020-05-22 16:07 ` [PATCH 18/19] target/arm: Fix tsan warning in cpu.c Robert Foley
2020-05-22 17:44 ` Peter Maydell
2020-05-22 21:33 ` Robert Foley
2020-05-22 22:36 ` Peter Maydell
2020-05-23 17:18 ` Emilio G. Cota
2020-05-26 14:01 ` Robert Foley
2020-05-22 16:07 ` [PATCH 19/19] docs: Added details on TSan to testing.rst Robert Foley
2020-05-23 20:29 ` Emilio G. Cota
2020-05-22 21:07 ` [PATCH 00/19] Add Thread Sanitizer support to QEMU no-reply
2020-05-23 21:36 ` Emilio G. Cota
2020-05-26 15:18 ` Robert Foley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200522160755.886-14-robert.foley@linaro.org \
--to=robert.foley@linaro.org \
--cc=alex.bennee@linaro.org \
--cc=cota@braap.org \
--cc=pbonzini@redhat.com \
--cc=peter.puhov@linaro.org \
--cc=qemu-devel@nongnu.org \
--cc=richard.henderson@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).