ThreadSanitizer APIs for External Libraries Kuba Mracek, Apple - - PowerPoint PPT Presentation

▶
threadsanitizer apis for external libraries
SMART_READER_LITE
LIVE PREVIEW

ThreadSanitizer APIs for External Libraries Kuba Mracek, Apple - - PowerPoint PPT Presentation

Feb 02, 2024 226 likes •711 views

ThreadSanitizer APIs for External Libraries Kuba Mracek, Apple ThreadSanitizer ThreadSanitizer Data race detector ThreadSanitizer Data race detector LLVM IR instrumentation: ThreadSanitizer Data race detector LLVM

slide-1
SLIDE 1

Kuba Mracek, Apple

  • ThreadSanitizer APIs


for External Libraries

slide-2
SLIDE 2

ThreadSanitizer

slide-3
SLIDE 3

ThreadSanitizer

  • Data race detector
slide-4
SLIDE 4

ThreadSanitizer

  • Data race detector
  • LLVM IR instrumentation:
slide-5
SLIDE 5

ThreadSanitizer

  • Data race detector
  • LLVM IR instrumentation:
  • memory reads and writes
slide-6
SLIDE 6

ThreadSanitizer

  • Data race detector
  • LLVM IR instrumentation:
  • memory reads and writes
  • atomic operations (load, store, RMW, CAS)
slide-7
SLIDE 7

Thread 1 Thread 2 Thread 3

slide-8
SLIDE 8

Thread 1 Thread 2 Thread 3 events events events

slide-9
SLIDE 9

happens-before data race detector

Thread 1 Thread 2 Thread 3 events events events

slide-10
SLIDE 10

happens-before data race detector

Thread 1 Thread 2 Thread 3 events events events Memory reads Memory writes Synchronization events

slide-11
SLIDE 11

happens-before data race detector

Thread 1 Thread 2 Thread 3 events events events

slide-12
SLIDE 12

happens-before data race detector

Thread 1 Thread 2 Thread 3 events events events

🐟

slide-13
SLIDE 13

happens-before data race detector

Thread 1 Thread 2 Thread 3 events events events

🐟

$ ./racyapp WARNING: ThreadSanitizer: data race (pid=19219) Write of size 4 at 0x7fcf47b21bc0 by thread T1: #0 Thread1 race.c:4 (exe+0x00000000a360) Previous write of size 4 at 0x7fcf47b21bc0 by main thread: #0 main race.c:10 (exe+0x00000000a3b4) …

slide-14
SLIDE 14

Libraries and Frameworks

slide-15
SLIDE 15

Libraries and Frameworks

  • Precompiled code is not instrumented
slide-16
SLIDE 16

Libraries and Frameworks

  • Precompiled code is not instrumented

instrumented

slide-17
SLIDE 17

Libraries and Frameworks

  • Precompiled code is not instrumented

call API instrumented

slide-18
SLIDE 18

Libraries and Frameworks

  • Precompiled code is not instrumented

call API .so instrumented non-instrumented

slide-19
SLIDE 19

Libraries and Frameworks

  • Precompiled code is not instrumented

call API .so🐟 instrumented non-instrumented

slide-20
SLIDE 20

Libraries and Frameworks

  • Precompiled code is not instrumented

call API .so🐟

🚬

instrumented non-instrumented

slide-21
SLIDE 21

Libraries and Frameworks

  • Precompiled code is not instrumented

call API .so instrumented instrumented

slide-22
SLIDE 22

Libraries and Frameworks

  • Precompiled code is not instrumented

call API .so🐟 instrumented instrumented

slide-23
SLIDE 23

Libraries and Frameworks

  • Precompiled code is not instrumented
  • APIs expect users to ensure thread safety

call API .so🐟 instrumented instrumented

slide-24
SLIDE 24

Libraries and Frameworks

  • Precompiled code is not instrumented
  • APIs expect users to ensure thread safety

call API .so

🐟

instrumented

slide-25
SLIDE 25

Libraries and Frameworks

  • Precompiled code is not instrumented
  • APIs expect users to ensure thread safety

call API .so

🐟

instrumented

slide-26
SLIDE 26

New: APIs for Libraries

slide-27
SLIDE 27

New: APIs for Libraries

  • ThreadSanitizer provides callbacks for libraries to inform about read/write-like

events of high-level objects:

slide-28
SLIDE 28

New: APIs for Libraries

  • ThreadSanitizer provides callbacks for libraries to inform about read/write-like

events of high-level objects:

__tsan_external_read(void *addr, void *caller_pc, void *tag); __tsan_external_write(void *addr, void *caller_pc, void *tag);

slide-29
SLIDE 29

New: APIs for Libraries

  • ThreadSanitizer provides callbacks for libraries to inform about read/write-like

events of high-level objects:

  • High-level object = basically any object you work with
  • array, map, graph node, data object, UI element, …

__tsan_external_read(void *addr, void *caller_pc, void *tag); __tsan_external_write(void *addr, void *caller_pc, void *tag);

slide-30
SLIDE 30

Example: CoreFoundation

slide-31
SLIDE 31

Example: CoreFoundation

  • Provides APIs for basic collections:





CFMutableArrayRef CFArrayCreateMutable(/*…*/);
 void CFArrayAppendValue(CFArrayRef array, /*…*/);
 CFIndex CFArrayGetCount(CFArrayRef array);

slide-32
SLIDE 32

Example: CoreFoundation

  • Provides APIs for basic collections:





CFMutableArrayRef CFArrayCreateMutable(/*…*/);
 void CFArrayAppendValue(CFArrayRef array, /*…*/);
 CFIndex CFArrayGetCount(CFArrayRef array);

  • User must ensure thread safety
slide-33
SLIDE 33

// Modifies the array void CFArrayAppendValue(CFArrayRef array, /*…*/) { __tsan_external_write(array, CALLER_PC, tag); /*…*/ } // Reads the array CFIndex CFArrayGetCount(CFArrayRef array) { __tsan_external_read(array, CALLER_PC, tag); /*…*/ }

slide-34
SLIDE 34

// Modifies the array void CFArrayAppendValue(CFArrayRef array, /*…*/) { if (is_tsan_present) __tsan_external_write(array, CALLER_PC, tag); /*…*/ } // Reads the array CFIndex CFArrayGetCount(CFArrayRef array) { if (is_tsan_present) __tsan_external_read(array, CALLER_PC, tag); /*…*/ }

slide-35
SLIDE 35

================== WARNING: ThreadSanitizer: race on a library object Read-only access of CFMutableArray at 0x7b0c00046b30 by thread T2: #0 CFArrayGetCount (CoreFoundation:x86_64) #1 Thread1 main.m:16 (demoapp:x86_64) Previous modifying access of CFMutableArray at 0x7b0c00046b30 by thread T3: #0 CFArrayAppendValue (CoreFoundation:x86_64) #1 Thread2 main.m:21 (demoapp:x86_64) Location is heap block of size 40 at 0x7b0c00046b30 allocated by main thread: … SUMMARY: ThreadSanitizer: race on a library object main.m:16 in Thread1 ==================

slide-36
SLIDE 36

================== WARNING: ThreadSanitizer: race on a library object Read-only access of CFMutableArray at 0x7b0c00046b30 by thread T2: #0 CFArrayGetCount (CoreFoundation:x86_64) #1 Thread1 main.m:16 (demoapp:x86_64) Previous modifying access of CFMutableArray at 0x7b0c00046b30 by thread T3: #0 CFArrayAppendValue (CoreFoundation:x86_64) #1 Thread2 main.m:21 (demoapp:x86_64) Location is heap block of size 40 at 0x7b0c00046b30 allocated by main thread: … SUMMARY: ThreadSanitizer: race on a library object main.m:16 in Thread1 ================== report description

slide-37
SLIDE 37

================== WARNING: ThreadSanitizer: race on a library object Read-only access of CFMutableArray at 0x7b0c00046b30 by thread T2: #0 CFArrayGetCount (CoreFoundation:x86_64) #1 Thread1 main.m:16 (demoapp:x86_64) Previous modifying access of CFMutableArray at 0x7b0c00046b30 by thread T3: #0 CFArrayAppendValue (CoreFoundation:x86_64) #1 Thread2 main.m:21 (demoapp:x86_64) Location is heap block of size 40 at 0x7b0c00046b30 allocated by main thread: … SUMMARY: ThreadSanitizer: race on a library object main.m:16 in Thread1 ================== type of the object report description

slide-38
SLIDE 38

================== WARNING: ThreadSanitizer: race on a library object Read-only access of CFMutableArray at 0x7b0c00046b30 by thread T2: #0 CFArrayGetCount (CoreFoundation:x86_64) #1 Thread1 main.m:16 (demoapp:x86_64) Previous modifying access of CFMutableArray at 0x7b0c00046b30 by thread T3: #0 CFArrayAppendValue (CoreFoundation:x86_64) #1 Thread2 main.m:21 (demoapp:x86_64) Location is heap block of size 40 at 0x7b0c00046b30 allocated by main thread: … SUMMARY: ThreadSanitizer: race on a library object main.m:16 in Thread1 ================== type of the object report description API call

slide-39
SLIDE 39

More Details

slide-40
SLIDE 40

More Details

  • Tags to identify the type of the object
slide-41
SLIDE 41

More Details

  • Tags to identify the type of the object
  • Provide caller PC
slide-42
SLIDE 42

More Details

  • Tags to identify the type of the object
  • Provide caller PC
  • Weak imports
slide-43
SLIDE 43

More Details

  • Tags to identify the type of the object
  • Provide caller PC
  • Weak imports
  • Detect ThreadSanitizer at initialization time
slide-44
SLIDE 44

More Details

  • Tags to identify the type of the object
  • Provide caller PC
  • Weak imports
  • Detect ThreadSanitizer at initialization time
  • Contact me or thread-sanitizer@googlegroups.com mailing list
slide-45
SLIDE 45

More Details

  • Tags to identify the type of the object
  • Provide caller PC
  • Weak imports
  • Detect ThreadSanitizer at initialization time
  • Contact me or thread-sanitizer@googlegroups.com mailing list
  • Already used by Foundation, CoreFoundation and Swift
slide-46
SLIDE 46

If you’re developing a popular library used in multithreaded programs, consider adopting these APIs!

slide-47
SLIDE 47