On Thu, Jan 10, 2019 at 1:47 PM Andrea Parri <andrea.pa...@amarulasolutions.com> wrote: > > On Thu, Jan 10, 2019 at 01:38:11PM +0100, Dmitry Vyukov wrote: > > On Thu, Jan 10, 2019 at 1:30 PM Andrea Parri > > <andrea.pa...@amarulasolutions.com> wrote: > > > > > > > For seqcounts we currently simply ignore all accesses within the read > > > > section (thus the requirement to dynamically track read sections). > > > > What does LKMM say about seqlocks? > > > > > > LKMM does not currently model seqlocks, if that's what you're asking; > > > c.f., tools/memory-model/linux-kernel.def for a list of the currently > > > supported synchronization primitives. > > > > > > LKMM has also no notion of "data race", it insists that the code must > > > contain no unmarked accesses; we have been discussing such extensions > > > since at least Dec'17 (we're not quite there!, as mentioned by Paul). > > > > How does it call cases that do contain unmarked accesses then? :) > > "work-in-progress" ;), or "limitation" (see tools/memory-model/README)
Let's call it /data race/ interim then :) Which also have literally undefined behavior in LKMM. Which now precisely matches the implementation language (C) definitions. Which is nice. > > > My opinion is that ignoring all accesses within a given read section > > > _can_ lead to false negatives > > > > Absolutely. But this is a deliberate decision. > > For our tools we consider priority 1: no false positives. Period. > > Priority 2: also report some true positives in best effort manner. > > This sound reasonable to me. But please don't overlook the fact that > to be able to talk about "false positive" and "false negative" (for a > data race detector) we need to agree about "what a data race is". Having a formal model would be undoubtedly good. But in practice things are much simpler. The complex cases that majority of LKMM deals with are <<1% of kernel concurrency. The majority of kernel cases are "no concurrent accesses at all", "always protected by a mutex", "passed as argument to a new thread", "the canonical store-release/load-acquire synchronization". For these I hope there is no controversy across C, POSIX, gcc, clang, kernel. Handling these cases in a race detector brings 99.9% of benefit. And for more complex cases (like seqlock) we can always approximate as "no races there" which inevitably satisfy our priorities (if you report nothing, you don't report false positives). But I am much more concerned about actual kernel code and behavior wrt a memory model. We are talking about interaction between LKMM <-> KTSAN. When a way more important question is LKMM <-> actual kernel behavior. KTSAN is really a secondary thing in this picture. So if anything needs a memory model, or needs to be blocked on a memory model, that's writing kernel code ;) > (The hope, of course, is that the LKMM will have a say soon here ...) > > Andrea > > > > > > > (in every possible definition of "data > > > race" and "read sections" I can think of at the moment ;D): > > > > > > P0 P1 > > > read_seqbegin() x = 1; > > > r0 = x; > > > read_seqretry() // =0 > > > > > > ought to be "racy"..., right? (I didn't audit all the callsites for > > > read_{seqbegin,seqretry}(), but I wouldn't be surprised to find such > > > pattern ;D ... "legacy", as you recalled). > > > > > > Andrea