From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.3 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 523B7C433DB for ; Wed, 10 Mar 2021 17:53:06 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 0027F64F87 for ; Wed, 10 Mar 2021 17:53:05 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 0027F64F87 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=xen.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Received: from list by lists.xenproject.org with outflank-mailman.96253.181944 (Exim 4.92) (envelope-from ) id 1lK30o-0006cZ-3d; Wed, 10 Mar 2021 17:52:46 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 96253.181944; Wed, 10 Mar 2021 17:52:46 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1lK30o-0006cS-0C; Wed, 10 Mar 2021 17:52:46 +0000 Received: by outflank-mailman (input) for mailman id 96253; Wed, 10 Mar 2021 17:52:44 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1lK30m-0006cN-QW for xen-devel@lists.xenproject.org; Wed, 10 Mar 2021 17:52:44 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1lK30l-0007V9-Ln; Wed, 10 Mar 2021 17:52:43 +0000 Received: from 54-240-197-234.amazon.com ([54.240.197.234] helo=a483e7b01a66.ant.amazon.com) by xenbits.xenproject.org with esmtpsa (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1lK30l-0002Ey-CY; Wed, 10 Mar 2021 17:52:43 +0000 X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xen.org; s=20200302mail; h=Content-Transfer-Encoding:Content-Type:In-Reply-To: MIME-Version:Date:Message-ID:From:References:Cc:To:Subject; bh=Y+Jnnzkn2oABqEgNjtJPldwx3KVGV20n3G6bUgGAgJg=; b=pEloDGqOpsKLUeysr04r4Z0L1u 88eDOgabPg7LxJuwaVwKtiIlU+R7bmd0vXL/2lrKlyWc9cjUcycexjEsInYfLhuFZEbVS5ovguQRV 6Bt+uXSvJk9M1OOhSkN4tXTNfx23EMyVmM2Nj3hxCCbVYtneBcenBOA4EjKLnzKuAhds=; Subject: Re: [PATCH][4.15] gnttab: work around "may be used uninitialized" warning To: Jan Beulich Cc: Andrew Cooper , George Dunlap , Ian Jackson , Stefano Stabellini , Wei Liu , "xen-devel@lists.xenproject.org" References: <6bd14438-7dec-2176-eab5-5898f190c4d8@suse.com> From: Julien Grall Message-ID: Date: Wed, 10 Mar 2021 17:52:41 +0000 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Thunderbird/78.8.0 MIME-Version: 1.0 In-Reply-To: <6bd14438-7dec-2176-eab5-5898f190c4d8@suse.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 7bit Hi Jan, On 10/03/2021 16:21, Jan Beulich wrote: > On 10.03.2021 15:58, Julien Grall wrote: >> On 10/03/2021 10:13, Jan Beulich wrote: >>> Sadly I was wrong to suggest dropping vaddrs' initializer during review >>> of v2 of the patch introducing this code. gcc 4.3 can't cope. >> >> What's the error? > > The one quoted in the title. > >> Are you sure this is not going to hiding a potential >> miscompilation of the function? > > Miscompilation? It may hide us screwing up, but addressing such a > compiler warning by adding an initializer has been quite common > in the past. Well... When a compiler tells me a value may be unitialized, I read it as some optimization may decide to use the variable in a way I wasn't expected. >>> --- a/xen/common/grant_table.c >>> +++ b/xen/common/grant_table.c >>> @@ -4026,7 +4026,7 @@ int gnttab_acquire_resource( >>> struct grant_table *gt = d->grant_table; >>> unsigned int i, final_frame; >>> mfn_t tmp; >>> - void **vaddrs; >>> + void **vaddrs = NULL; >> I am a bit nervous to inialize vaddrs to NULL for a few reasons: >> 1) It is not 100% obvious (e.g. it takes more than a second) that >> vaddrs will always be initialized. > > But convincing ourselves was necessary even more so prior to this > change. We must not ever rely on the compiler to tell us about > issues in our code. We can only leverage that in some cases it > does. I didn't suggest that we should only rely on the compiler. I pointed out that we are telling the compiler to not worry. This may hide a valid concern from the compiler. > From this it (I think obviously) follows that without the > initializer we're at bigger risk than with it. I thought deferencing a NULL pointer was still a concern for PV? For the other setup, I agree that it would only lead to a crash rather than dereferencing anything. Yet I am not convinced this is that much better... >> 2) A compiler will not be able to help us if we are adding code >> without initialized vaddrs. >> >> It also feels wrong to me to try to write Xen in a way that will make a >> 10 years compiler happy... > > As said above - we've worked around limitations quite a few times > in the past. This is just one more instance. I find amusing you wrote that when you complained multiple time when someone was re-using existing bad pattern. :) > >> If we still want to support them, then maybe a better approach would be >> to turn off to turn off -Werror for some version of GCC. So we can >> continue to benefit from the newer compiler diagnostics. > > Avoiding use of -Werror is not an option imo: Once you start seeing > warnings, you have only two options imo: Either one decides to ignore > them all (and then one will also ignore new ones introduce by changes > yet to be submitted), or one would have to memorize, for every build > one does, which warnings one ought to ignore. The latter doesn't > scale, while the former is a code quality problem. > > Suppressing a particular class of warning might be an option, but > again risks somebody submitting code which elsewhere would trigger > warnings. This is pretty much what we are already doing slowly by initializing values to shut up older compilers. I agree this is more limited, but we also waive off diagnostics from every single compiler in that code rather than just one version. Hence why I suggested dropping -Werror for older compiler. This is not ideal but it would give us the ability to keep support for dinausor compiler and not hamper our ability to take advantage of newer compiler diagnostics. The ideal solution is to drop support for older compiler (see my other thread). But this sounds like a daunting task so far on x86... Anyway, I will not Nack the patch but will also not Ack it. I will let another maintainer ack this patch. Cheers, -- Julien Grall