Re: URCU feature request?

--00000000000050ccc4063e3af15b
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

> It looks like you want runtime verification for the usage of the API.
> Did you know that URCU can now be compiled against ThreadSanitizer
> (TSAN)?  If a user misuses the API or makes incorrect assumptions about
> the guarantees offered by RCU, TSAN will most likely detect those
> issues.  Coupled with the other debug features we already have, this
> makes it very hard to not trigger an error path when the API is used
> incorrectly.

Really?! I've used TSAN and got a bunch of false positives, I believe, but
maybe they're not false positives? How do you remove the false positives,
or know that they're not false positives?

> Note that certain kind of errors could actually be flag at compile time
> with the proper tooling.  For example, the Linux kernel uses a `__rcu'
> attribute that Sparse can understand to flag improper use of
> RCU=E2=80=91protected pointers.  I=E2=80=99d be very open to exposing som=
ething similar
> (an attribute) for static checkers.

wow thanks for the info! I knew compile time checks would be possible but
requiring compiler operability which is a higher hanging fruit for me. Is
'__rcu' compatible with custom concurrency? For example rcu_dereference a
pointer then locking a mutex inside the pointer then unlock read then
continue using the pointer? I cant come up with something usefull other
than a language rework. Is it much work making the __urcu attribute?

fre. 5. sep. 2025 kl. 20:04 skrev Olivier Dion <[email protected]>:

> On Thu, 04 Sep 2025, Thobias Knudsen <[email protected]> wrote:
> >> I am confuse about the overall discussion here.  Are we talking about
> >> static checking of RCU pointers usage or runtime checking?
> >>
> >> Is is possible to see the implementation you made so I can understand
> >> better?
> >
> > Sorry for being late to answer :/
> > The library overrides a subset of urcu and lfht functions with macros a=
nd
> > replaces them with other functions which checks in runtime if the
> functions
> > are called in the correct order.
> > here is the code: https://github.com/ThobiasKnudsen/urcu_lfht_safe
>
> It looks like you want runtime verification for the usage of the API.
> Did you know that URCU can now be compiled against ThreadSanitizer
> (TSAN)?  If a user misuses the API or makes incorrect assumptions about
> the guarantees offered by RCU, TSAN will most likely detect those
> issues.  Coupled with the other debug features we already have, this
> makes it very hard to not trigger an error path when the API is used
> incorrectly.
>
> Note that certain kind of errors could actually be flag at compile time
> with the proper tooling.  For example, the Linux kernel uses a `__rcu'
> attribute that Sparse can understand to flag improper use of
> RCU=E2=80=91protected pointers.  I=E2=80=99d be very open to exposing som=
ething similar
> (an attribute) for static checkers.
>
> [...]
>
> Thanks,
> Olivier
> --
> Olivier Dion
> EfficiOS Inc.
> https://www.efficios.com
>

--00000000000050ccc4063e3af15b
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto"><div dir=3D"ltr"><div dir=3D"ltr">&gt; It looks like you =
want runtime verification for the usage of the API.<br>&gt; Did you know th=
at URCU can now be compiled against ThreadSanitizer<br>&gt; (TSAN)?=C2=A0 I=
f a user misuses the API or makes incorrect assumptions about<br>&gt; the g=
uarantees offered by RCU, TSAN will most likely detect those<br>&gt; issues=
.=C2=A0 Coupled with the other debug features we already have, this<br>&gt;=
 makes it very hard to not trigger an error path when the API is used<br>&g=
t; incorrectly.<div><br></div><div>Really?! I&#39;ve used TSAN and got a bu=
nch of false positives, I believe, but maybe they&#39;re not false positive=
s? How do you remove the false positives, or know that they&#39;re not fals=
e positives?</div><div><br></div><div>&gt; Note that certain kind of errors=
 could actually be flag at compile time<br>&gt; with the proper tooling.=C2=
=A0 For example, the Linux kernel uses a `__rcu&#39;<br>&gt; attribute that=
 Sparse can understand to flag improper use of<br>&gt; RCU=E2=80=91protecte=
d pointers.=C2=A0 I=E2=80=99d be very open to exposing something similar<br=
>&gt; (an attribute) for static checkers.</div><div><br></div><div>wow than=
ks for the info! I knew compile time checks would be possible but requiring=
 compiler operability which is a higher=C2=A0hanging fruit for me. Is &#39;=
__rcu&#39; compatible with custom concurrency? For example rcu_dereference =
a pointer then locking a mutex inside the pointer then unlock read then con=
tinue using the pointer? I cant come up with something usefull other than a=
 language rework. Is it much work making the __urcu attribute?=C2=A0</div><=
/div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">f=
re. 5. sep. 2025 kl. 20:04 skrev Olivier Dion &lt;<a href=3D"mailto:odion@e=
fficios.com" target=3D"_blank" rel=3D"noreferrer">[email protected]</a>&gt=
;:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0=
.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Thu, 04 Se=
p 2025, Thobias Knudsen &lt;<a href=3D"mailto:[email protected]" target=3D"=
_blank" rel=3D"noreferrer">[email protected]</a>&gt; wrote:<br>
&gt;&gt; I am confuse about the overall discussion here.=C2=A0 Are we talki=
ng about<br>
&gt;&gt; static checking of RCU pointers usage or runtime checking?<br>
&gt;&gt;<br>
&gt;&gt; Is is possible to see the implementation you made so I can underst=
and<br>
&gt;&gt; better?<br>
&gt;<br>
&gt; Sorry for being late to answer :/<br>
&gt; The library overrides a subset of urcu and lfht functions with macros =
and<br>
&gt; replaces them with other functions which checks in runtime if the func=
tions<br>
&gt; are called in the correct order.<br>
&gt; here is the code: <a href=3D"https://github.com/ThobiasKnudsen/urcu_lf=
ht_safe" rel=3D"noreferrer noreferrer" target=3D"_blank">https://github.com=
/ThobiasKnudsen/urcu_lfht_safe</a><br>
<br>
It looks like you want runtime verification for the usage of the API.<br>
Did you know that URCU can now be compiled against ThreadSanitizer<br>
(TSAN)?=C2=A0 If a user misuses the API or makes incorrect assumptions abou=
t<br>
the guarantees offered by RCU, TSAN will most likely detect those<br>
issues.=C2=A0 Coupled with the other debug features we already have, this<b=
r>
makes it very hard to not trigger an error path when the API is used<br>
incorrectly.<br>
<br>
Note that certain kind of errors could actually be flag at compile time<br>
with the proper tooling.=C2=A0 For example, the Linux kernel uses a `__rcu&=
#39;<br>
attribute that Sparse can understand to flag improper use of<br>
RCU=E2=80=91protected pointers.=C2=A0 I=E2=80=99d be very open to exposing =
something similar<br>
(an attribute) for static checkers.<br>
<br>
[...]<br>
<br>
Thanks,<br>
Olivier<br>
-- <br>
Olivier Dion<br>
EfficiOS Inc.<br>
<a href=3D"https://www.efficios.com" rel=3D"noreferrer noreferrer" target=
=3D"_blank">https://www.efficios.com</a><br>
</blockquote></div></div></div>

--00000000000050ccc4063e3af15b--