[tsan] Instrument atomics

Hi!

This patch attempts to instrument __atomic_* and __sync_* builtins.
Unfortunately for none of the builtins there is 1:1 mapping to the tsan
replacements, tsan uses weirdo memory model encoding (instead of values
from 0 to 5 apparently 1 << 0 to 1 << 5, as if one could have more than
one memory model at the same time), so even for the easy cases GCC
has to transform them.  More importantly, there is no way to pass through
__ATOMIC_HLE_ACQUIRE/__ATOMIC_HLE_RELEASE.  Right now the patch just gives
up and doesn't replace anything if e.g.
__atomic_store_n (p, 0, __ATOMIC_HLE_RELEASE | __ATOMIC_RELEASE);
is seen, perhaps one could ignore the hle bits which are just an
optimization, but there is no way to find out in the generic code
whether the extra bits are just an optimization or change the behavior
of the builtin.

Another issue is that libtsan apparently internally uses just the deprecated
__sync_* builtins (or no builtins at all for load/store).  That in some
cases works (because __sync_* is usually equivalent to __atomic_* with
__ATOMIC_SEQ_CST memmodel), but for the load/store cases and for atomic
exchange it doesn't (the former don't provide any barrier, the latter
in __sync_lock_test_and_set is only __ATOMIC_ACQUIRE barrier).
Can libtsan at least conditionally, when built with GCC 4.7 or later,
use __atomic_* builtins instead of __sync_*?  One still probably has to
use __ATOMIC_SEQ_CST model anyway, otherwise there would need to be a switch
based on the mem model, as  only constant arguments to __atomic_* builtins
do something other than sequential consistency.

Another issue is that there are no fetch + nand (or nand + fetch) tsan
entrypoints, I could transform those into a loop using cas, but that looks
overkill, then it would be better to change libtsan.

The most important problem is that __tsan_atomic*_compare_exchange has just
a single memory model argument, while the __atomic_* builtins have two (one
for success, another one for failure).  Right now the patch just ignores
the failure memory model, but that might actually lead into not detecting
a race in a program when it should have been detected (note the failure
memory model can't be stronger than success memory model).  Would it be
possible to add another argument to those, and use the failure mode instead
of success mode if the atomic operation fails?

Apparently there are also no entry points for op and fetch (as opposed to
fetch and op), but the patch translates those into the corresponding
fetch and op libcalls with + val (etc.) on the result.

Oh, and there are no 16-byte atomics provided by libtsan, the library
would need to be built with -mcx16 on x86_64 for that and have the
additional entry points for unsigned __int128.  The patch doesn't touch
the 16-byte atomics, leaves them as is.

This patch is on top of the patch from yesterday which introduced use of
BUILT_IN_* functions in asan and builds them if the FE doesn't.

I've used the attached testcase to verify it compiles, and quickly skimmed
the changes it is doing, but haven't actually tested it more than that.

As for local statics mentioned in the PR too, those are in GCC handled by
__cxa_guard_{acquire,release,abort} library functions, so either libtsan would
need to intercept those calls, or we'd need to add some instrumentation
before and/or after that (what would be needed?).

And, I'm also wondering about string/memory builtins asan is instrumenting,
wouldn't it be useful to instrument those similarly for tsan (say also
just the first byte accessed and last one)?  I know you are overriding most
of them in libtsan, but some of them are often expanded inline (e.g. memcpy,
strlen, etc.) and thus the libtsan replacements aren't executed.
Or better yet, is there some libtsan entry point to report memory access
range?

2012-11-23  Jakub Jelinek  <jakub@redhat.com>

	PR sanitizer/55439
	* Makefile.in (tsan.o): Depend on tree-ssa-propagate.h.
	* sanitizer.def: Add __tsan_atomic* builtins.
	* asan.c (initialize_sanitizer_builtins): Adjust to also
	initialize __tsan_atomic* builtins.
	* tsan.c: Include tree-ssa-propagate.h.
	(enum tsan_atomic_action): New enum.
	(tsan_atomic_table): New table.
	(instrument_builtin_call): New function.
	(instrument_gimple): Take pointer to gimple_stmt_iterator
	instead of gimple_stmt_iterator.  Call instrument_builtin_call
	on builtin call stmts.
	(instrument_memory_accesses): Adjust instrument_gimple caller.
	* builtin-types.def (BT_FN_BOOL_VPTR_PTR_I1_INT,
	BT_FN_BOOL_VPTR_PTR_I2_INT, BT_FN_BOOL_VPTR_PTR_I4_INT,
	BT_FN_BOOL_VPTR_PTR_I8_INT): New.

	Jakub
extern void bar (void *);

template <typename T>
__attribute__((noinline, noclone)) T
foo (T *p, bool var)
{
  T x = 0, y;
  x += __sync_fetch_and_add (p, 1); bar ((void *) p);
  x += __sync_fetch_and_sub (p, 2); bar ((void *) p);
  x += __sync_fetch_and_and (p, 7); bar ((void *) p);
  x += __sync_fetch_and_or (p, 1); bar ((void *) p);
  x += __sync_fetch_and_xor (p, 2); bar ((void *) p);
  x += __sync_fetch_and_nand (p, 4); bar ((void *) p);
  x += __sync_add_and_fetch (p, 1); bar ((void *) p);
  x += __sync_sub_and_fetch (p, 2); bar ((void *) p);
  x += __sync_and_and_fetch (p, 7); bar ((void *) p);
  x += __sync_or_and_fetch (p, 1); bar ((void *) p);
  x += __sync_xor_and_fetch (p, 2); bar ((void *) p);
  x += __sync_nand_and_fetch (p, 4); bar ((void *) p);
  x += __sync_bool_compare_and_swap (p, 7, 3); bar ((void *) p);
  x += __sync_val_compare_and_swap (p, 7, 3); bar ((void *) p);
  x += __sync_lock_test_and_set (p, 9); bar ((void *) p);
  __sync_lock_release (p); bar ((void *) p);
  __sync_synchronize (); bar ((void *) p);
  x += __atomic_exchange_n (p, 9, __ATOMIC_RELAXED); bar ((void *) p);
  x += __atomic_exchange_n (p, 9, __ATOMIC_SEQ_CST); bar ((void *) p);
  x += __atomic_load_n (p, __ATOMIC_RELAXED); bar ((void *) p);
  x += __atomic_load_n (p, __ATOMIC_SEQ_CST); bar ((void *) p);
  y = 6;
  x += __atomic_compare_exchange_n (p, &y, 8, true, __ATOMIC_RELAXED, __ATOMIC_RELAXED); bar ((void *) p);
  y = 6;
  x += __atomic_compare_exchange_n (p, &y, 8, false, __ATOMIC_RELAXED, __ATOMIC_RELAXED); bar ((void *) p);
  y = 6;
  x += __atomic_compare_exchange_n (p, &y, 8, var, __ATOMIC_RELAXED, __ATOMIC_RELAXED); bar ((void *) p);
  y = 6;
  x += __atomic_compare_exchange_n (p, &y, 8, true, __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST); bar ((void *) p);
  y = 6;
  x += __atomic_compare_exchange_n (p, &y, 8, false, __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST); bar ((void *) p);
  y = 6;
  x += __atomic_compare_exchange_n (p, &y, 8, var, __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST); bar ((void *) p);
  __atomic_store_n (p, 9, __ATOMIC_RELAXED); bar ((void *) p);
  __atomic_store_n (p, 9, __ATOMIC_SEQ_CST); bar ((void *) p);
  x += __atomic_add_fetch (p, 1, __ATOMIC_RELAXED); bar ((void *) p);
  x += __atomic_add_fetch (p, 1, __ATOMIC_SEQ_CST); bar ((void *) p);
  x += __atomic_sub_fetch (p, 2, __ATOMIC_RELAXED); bar ((void *) p);
  x += __atomic_sub_fetch (p, 2, __ATOMIC_SEQ_CST); bar ((void *) p);
  x += __atomic_and_fetch (p, 7, __ATOMIC_RELAXED); bar ((void *) p);
  x += __atomic_and_fetch (p, 7, __ATOMIC_SEQ_CST); bar ((void *) p);
  x += __atomic_or_fetch (p, 1, __ATOMIC_RELAXED); bar ((void *) p);
  x += __atomic_or_fetch (p, 1, __ATOMIC_SEQ_CST); bar ((void *) p);
  x += __atomic_xor_fetch (p, 2, __ATOMIC_RELAXED); bar ((void *) p);
  x += __atomic_xor_fetch (p, 2, __ATOMIC_SEQ_CST); bar ((void *) p);
  x += __atomic_nand_fetch (p, 4, __ATOMIC_RELAXED); bar ((void *) p);
  x += __atomic_nand_fetch (p, 4, __ATOMIC_SEQ_CST); bar ((void *) p);
  x += __atomic_fetch_add (p, 1, __ATOMIC_RELAXED); bar ((void *) p);
  x += __atomic_fetch_add (p, 1, __ATOMIC_SEQ_CST); bar ((void *) p);
  x += __atomic_fetch_sub (p, 2, __ATOMIC_RELAXED); bar ((void *) p);
  x += __atomic_fetch_sub (p, 2, __ATOMIC_SEQ_CST); bar ((void *) p);
  x += __atomic_fetch_and (p, 7, __ATOMIC_RELAXED); bar ((void *) p);
  x += __atomic_fetch_and (p, 7, __ATOMIC_SEQ_CST); bar ((void *) p);
  x += __atomic_fetch_or (p, 1, __ATOMIC_RELAXED); bar ((void *) p);
  x += __atomic_fetch_or (p, 1, __ATOMIC_SEQ_CST); bar ((void *) p);
  x += __atomic_fetch_xor (p, 2, __ATOMIC_RELAXED); bar ((void *) p);
  x += __atomic_fetch_xor (p, 2, __ATOMIC_SEQ_CST); bar ((void *) p);
  x += __atomic_fetch_nand (p, 4, __ATOMIC_RELAXED); bar ((void *) p);
  x += __atomic_fetch_nand (p, 4, __ATOMIC_SEQ_CST); bar ((void *) p);
  __atomic_thread_fence (__ATOMIC_RELAXED); bar ((void *) p);
  __atomic_thread_fence (__ATOMIC_SEQ_CST); bar ((void *) p);
  __atomic_signal_fence (__ATOMIC_RELAXED); bar ((void *) p);
  __atomic_signal_fence (__ATOMIC_SEQ_CST); bar ((void *) p);
  return x;
}

void
baz (bool var)
{
  unsigned char c = 0;
  unsigned short s = 0;
  unsigned int i = 0;
  unsigned long l = 0;
  unsigned __int128 q = 0;
  foo (&c, var);
  foo (&s, var);
  foo (&i, var);
  foo (&l, var);
  foo (&q, var);
}

[tsan] Instrument atomics

Commit Message

Comments

Patch