[PATCH 00/14] Add clang Thread Safety Analysis (TSA) support

[Anup Patel]

On Wed, Jul 29, 2026 at 10:14 PM Carlos López
<carlos.lopezr4096 at gmail.com> wrote:
>
> Enable the use of clang's Thread Safety Analysis [0]. TSA is a clang
> language extension that allows detecting potential invalid locking
> patterns and race conditions at compile time, with zero runtime
> overhead. TSA relies on annotations to express the relationships between
> data and locks, and the expected state of a lock at certain points in
> the program.
>
> The first two commits introduce the basic infrastructure to use the TSA
> annotations. The last commit enables TSA by default in the Makefile.
> Commits in between add the new annotations to particular OpenSBI
> subsystems.
>
> The general pattern is:
> * Struct fields are rearranged so that locks appear before the
>   field(s) they protect. This is needed for the compiler to be able to
>   perform analysis. Protected fields are annotated with GUARDED_BY() /
>   PT_GUARDED_BY().
> * Functions that access spinlock-protected fields are annotated wth
>   MUST_HOLD().
> * Functions that acquire a spinlock, and which may plausibly be called
>   with that spinlock held, are annotated with MUST_NOT_HOLD() to prevent
>   potential future deadlocks.
> * Initializer functions and other special cases are excluded via
>   NO_THREAD_SAFETY_ANALYSIS.
>
> This successfully results in detecting incorrect locking. For example, the
> following change:
>
> diff --git a/lib/sbi/sbi_fifo.c b/lib/sbi/sbi_fifo.c
> index 88b8888d2e81..5348b7452f64 100644
> --- a/lib/sbi/sbi_fifo.c
> +++ b/lib/sbi/sbi_fifo.c
> @@ -37,9 +37,7 @@ u16 sbi_fifo_avail(struct sbi_fifo *fifo)
>         if (!fifo)
>                 return 0;
>
> -       spin_lock(&fifo->qlock);
>         ret = fifo->avail;
> -       spin_unlock(&fifo->qlock);
>
>         return ret;
>  }
>
> Results in a build error:
>
>   lib/sbi/sbi_fifo.c:41:14: error: reading variable 'avail' requires holding spinlock '&sbi_fifo::qlock' [-Werror,-Wthread-safety-analysis]
>    41 |         ret = fifo->avail;
>       |                     ^
>   1 error generated.
>
> Tested with clang 19.1.7 and 22.1.8.
>
> [0] https://clang.llvm.org/docs/ThreadSafetyAnalysis.html
>
> Carlos López (14):
>   include: sbi: add thread safety analysis macros
>   lib: sbi_locks: annotate spinlock APIs for TSA
>   lib: sbi_fifo: add TSA annotations
>   lib: sbi_heap: add TSA annotations
>   lib: sbi_scratch: add TSA annotations
>   lib: rpmi: add TSA annotations
>   lib: sbi_timer: add TSA annotations
>   lib: htif: add TSA annotations
>   lib: sbi_domain: add TSA annotations
>   lib: sbi_sse: inline enable event locking
>   lib: sbi_sse: pass SSE hart state explicitly
>   lib: sbi_sse: add TSA annotations
>   lib: test: disable TSA for spinlock tests
>   Makefile: enable Thread Safety Analysis

Overall, TSA support in OpenSBI is a very good addition
but I am facing the following compile error:

 CC        lib/sbi/sbi_ecall_hsm.o
In file included from opensbi/lib/sbi/sbi_ecall_hsm.c:10:
opensbi/include/sbi/sbi_domain.h:199:49: error: use of undeclared
identifier 'assigned_harts_lock'
  199 |         struct sbi_hartmask assigned_harts
GUARDED_BY(&assigned_harts_lock);


Is there any particular clang version required for this ?
I am using "Ubuntu clang version 18.1.3 (1ubuntu1)"

Regards,
Anup