2009-03-04 04:28:35 +01:00
|
|
|
/*
|
|
|
|
* Copyright (C) 2008 The Android Open Source Project
|
|
|
|
* All rights reserved.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* * Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* * Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in
|
|
|
|
* the documentation and/or other materials provided with the
|
|
|
|
* distribution.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
|
|
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
|
|
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
|
|
|
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
|
|
|
* COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
|
|
|
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
|
|
|
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
|
|
|
|
* OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
|
|
|
|
* AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
|
|
|
|
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
|
|
|
|
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
* SUCH DAMAGE.
|
|
|
|
*/
|
|
|
|
#ifndef _PTHREAD_INTERNAL_H_
|
|
|
|
#define _PTHREAD_INTERNAL_H_
|
|
|
|
|
|
|
|
#include <pthread.h>
|
2015-03-07 02:23:53 +01:00
|
|
|
#include <stdatomic.h>
|
2009-03-04 04:28:35 +01:00
|
|
|
|
2015-10-23 05:07:56 +02:00
|
|
|
#include "private/bionic_lock.h"
|
2014-12-04 06:36:24 +01:00
|
|
|
#include "private/bionic_tls.h"
|
|
|
|
|
Implement pthread_attr_getinheritsched/pthread_attr_setinheritsched.
Historically, Android defaulted to EXPLICIT but with a special case
because SCHED_NORMAL/priority 0 was awkward. Because the code couldn't
actually tell whether SCHED_NORMAL/priority 0 was a genuine attempt to
explicitly set those attributes (because the parent thread is SCHED_FIFO,
say) or just because the pthread_attr_t was left at its defaults.
Now we support INHERIT, we could call sched_getscheduler to see whether
we actually need to call sched_setscheduler, but since the major cost
is the fixed syscall overhead, we may as well just conservatively
call sched_setscheduler and let the kernel decide whether it's a
no-op. (Especially because we'd then have to add both sched_getscheduler
and sched_setscheduler to any seccomp filter.)
Platform code (or app code that only needs to support >= P) can actually
add a call to pthread_attr_setinheritsched to say that they just want
to inherit (if they know that none of their threads actually mess with
scheduler attributes at all), which will save them a sched_setscheduler
call except in the doubly-special case of SCHED_RESET_ON_FORK (which we
do handle).
An alternative would be "make pthread_attr_setschedparams and
pthread_attr_setschedprio set EXPLICIT and change the platform default
to INHERIT", but even though I can only think of weird pathological
examples where anyone would notice that change, that behavior -- of
pthread_attr_setschedparams/pthread_attr_setschedprio overriding an
earlier call to pthread_attr_setinheritsched -- isn't allowed by POSIX
(whereas defaulting to EXPLICIT is).
If we have a lot of trouble with this change in the app compatibility
testing phase, though, we'll want to reconsider this decision!
-*-
This change also removes a comment about setting the scheduler attributes
in main_thread because we'd have to actually keep them up to date,
and it's not clear that doing so would be worth the trouble.
Also make async_safe_format_log preserve errno so we don't have to be
so careful around it.
Bug: http://b/67471710
Test: ran tests
Change-Id: Idd026c4ce78a536656adcb57aa2e7b2c616eeddf
2017-10-18 00:34:41 +02:00
|
|
|
// Has the thread been detached by a pthread_join or pthread_detach call?
|
2014-07-30 23:48:10 +02:00
|
|
|
#define PTHREAD_ATTR_FLAG_DETACHED 0x00000001
|
|
|
|
|
Implement pthread_attr_getinheritsched/pthread_attr_setinheritsched.
Historically, Android defaulted to EXPLICIT but with a special case
because SCHED_NORMAL/priority 0 was awkward. Because the code couldn't
actually tell whether SCHED_NORMAL/priority 0 was a genuine attempt to
explicitly set those attributes (because the parent thread is SCHED_FIFO,
say) or just because the pthread_attr_t was left at its defaults.
Now we support INHERIT, we could call sched_getscheduler to see whether
we actually need to call sched_setscheduler, but since the major cost
is the fixed syscall overhead, we may as well just conservatively
call sched_setscheduler and let the kernel decide whether it's a
no-op. (Especially because we'd then have to add both sched_getscheduler
and sched_setscheduler to any seccomp filter.)
Platform code (or app code that only needs to support >= P) can actually
add a call to pthread_attr_setinheritsched to say that they just want
to inherit (if they know that none of their threads actually mess with
scheduler attributes at all), which will save them a sched_setscheduler
call except in the doubly-special case of SCHED_RESET_ON_FORK (which we
do handle).
An alternative would be "make pthread_attr_setschedparams and
pthread_attr_setschedprio set EXPLICIT and change the platform default
to INHERIT", but even though I can only think of weird pathological
examples where anyone would notice that change, that behavior -- of
pthread_attr_setschedparams/pthread_attr_setschedprio overriding an
earlier call to pthread_attr_setinheritsched -- isn't allowed by POSIX
(whereas defaulting to EXPLICIT is).
If we have a lot of trouble with this change in the app compatibility
testing phase, though, we'll want to reconsider this decision!
-*-
This change also removes a comment about setting the scheduler attributes
in main_thread because we'd have to actually keep them up to date,
and it's not clear that doing so would be worth the trouble.
Also make async_safe_format_log preserve errno so we don't have to be
so careful around it.
Bug: http://b/67471710
Test: ran tests
Change-Id: Idd026c4ce78a536656adcb57aa2e7b2c616eeddf
2017-10-18 00:34:41 +02:00
|
|
|
// Has the thread been joined by another thread?
|
2015-01-06 18:31:00 +01:00
|
|
|
#define PTHREAD_ATTR_FLAG_JOINED 0x00000002
|
2014-07-30 23:48:10 +02:00
|
|
|
|
2017-10-28 00:28:54 +02:00
|
|
|
// Used for pthread_attr_setinheritsched. We need two flags for this apparent
|
|
|
|
// boolean because our historical behavior matches neither of the POSIX choices.
|
Implement pthread_attr_getinheritsched/pthread_attr_setinheritsched.
Historically, Android defaulted to EXPLICIT but with a special case
because SCHED_NORMAL/priority 0 was awkward. Because the code couldn't
actually tell whether SCHED_NORMAL/priority 0 was a genuine attempt to
explicitly set those attributes (because the parent thread is SCHED_FIFO,
say) or just because the pthread_attr_t was left at its defaults.
Now we support INHERIT, we could call sched_getscheduler to see whether
we actually need to call sched_setscheduler, but since the major cost
is the fixed syscall overhead, we may as well just conservatively
call sched_setscheduler and let the kernel decide whether it's a
no-op. (Especially because we'd then have to add both sched_getscheduler
and sched_setscheduler to any seccomp filter.)
Platform code (or app code that only needs to support >= P) can actually
add a call to pthread_attr_setinheritsched to say that they just want
to inherit (if they know that none of their threads actually mess with
scheduler attributes at all), which will save them a sched_setscheduler
call except in the doubly-special case of SCHED_RESET_ON_FORK (which we
do handle).
An alternative would be "make pthread_attr_setschedparams and
pthread_attr_setschedprio set EXPLICIT and change the platform default
to INHERIT", but even though I can only think of weird pathological
examples where anyone would notice that change, that behavior -- of
pthread_attr_setschedparams/pthread_attr_setschedprio overriding an
earlier call to pthread_attr_setinheritsched -- isn't allowed by POSIX
(whereas defaulting to EXPLICIT is).
If we have a lot of trouble with this change in the app compatibility
testing phase, though, we'll want to reconsider this decision!
-*-
This change also removes a comment about setting the scheduler attributes
in main_thread because we'd have to actually keep them up to date,
and it's not clear that doing so would be worth the trouble.
Also make async_safe_format_log preserve errno so we don't have to be
so careful around it.
Bug: http://b/67471710
Test: ran tests
Change-Id: Idd026c4ce78a536656adcb57aa2e7b2c616eeddf
2017-10-18 00:34:41 +02:00
|
|
|
#define PTHREAD_ATTR_FLAG_INHERIT 0x00000004
|
2017-10-28 00:28:54 +02:00
|
|
|
#define PTHREAD_ATTR_FLAG_EXPLICIT 0x00000008
|
Implement pthread_attr_getinheritsched/pthread_attr_setinheritsched.
Historically, Android defaulted to EXPLICIT but with a special case
because SCHED_NORMAL/priority 0 was awkward. Because the code couldn't
actually tell whether SCHED_NORMAL/priority 0 was a genuine attempt to
explicitly set those attributes (because the parent thread is SCHED_FIFO,
say) or just because the pthread_attr_t was left at its defaults.
Now we support INHERIT, we could call sched_getscheduler to see whether
we actually need to call sched_setscheduler, but since the major cost
is the fixed syscall overhead, we may as well just conservatively
call sched_setscheduler and let the kernel decide whether it's a
no-op. (Especially because we'd then have to add both sched_getscheduler
and sched_setscheduler to any seccomp filter.)
Platform code (or app code that only needs to support >= P) can actually
add a call to pthread_attr_setinheritsched to say that they just want
to inherit (if they know that none of their threads actually mess with
scheduler attributes at all), which will save them a sched_setscheduler
call except in the doubly-special case of SCHED_RESET_ON_FORK (which we
do handle).
An alternative would be "make pthread_attr_setschedparams and
pthread_attr_setschedprio set EXPLICIT and change the platform default
to INHERIT", but even though I can only think of weird pathological
examples where anyone would notice that change, that behavior -- of
pthread_attr_setschedparams/pthread_attr_setschedprio overriding an
earlier call to pthread_attr_setinheritsched -- isn't allowed by POSIX
(whereas defaulting to EXPLICIT is).
If we have a lot of trouble with this change in the app compatibility
testing phase, though, we'll want to reconsider this decision!
-*-
This change also removes a comment about setting the scheduler attributes
in main_thread because we'd have to actually keep them up to date,
and it's not clear that doing so would be worth the trouble.
Also make async_safe_format_log preserve errno so we don't have to be
so careful around it.
Bug: http://b/67471710
Test: ran tests
Change-Id: Idd026c4ce78a536656adcb57aa2e7b2c616eeddf
2017-10-18 00:34:41 +02:00
|
|
|
|
2016-01-07 04:51:43 +01:00
|
|
|
class pthread_key_data_t {
|
|
|
|
public:
|
2015-02-21 01:15:33 +01:00
|
|
|
uintptr_t seq; // Use uintptr_t just for alignment, as we use pointer below.
|
|
|
|
void* data;
|
|
|
|
};
|
|
|
|
|
2015-03-07 02:23:53 +01:00
|
|
|
enum ThreadJoinState {
|
|
|
|
THREAD_NOT_JOINED,
|
|
|
|
THREAD_EXITED_NOT_JOINED,
|
|
|
|
THREAD_JOINED,
|
|
|
|
THREAD_DETACHED
|
|
|
|
};
|
|
|
|
|
2016-01-07 04:51:43 +01:00
|
|
|
class thread_local_dtor;
|
2015-11-25 02:24:06 +01:00
|
|
|
|
2016-01-07 04:51:43 +01:00
|
|
|
class pthread_internal_t {
|
Remove the global thread list.
Another release, another attempt to fix this bug.
This change affects pthread_detach, pthread_getcpuclockid,
pthread_getschedparam/pthread_setschedparam, pthread_join, and pthread_kill:
instead of returning ESRCH when passed an invalid pthread_t, they'll now SEGV.
Note that this doesn't change behavior as much as you might think: the old
lookup only held the global thread list lock for the duration of the lookup,
so there was still a race between that and the dereference in the caller,
given that callers actually need the tid to pass to some syscall or other,
and sometimes update fields in the pthread_internal_t struct too.
We can't check thread->tid against 0 to see whether a pthread_t is still
valid because a dead thread gets its thread struct unmapped along with its
stack, so the dereference isn't safe.
Taking the affected functions one by one:
* pthread_getcpuclockid and pthread_getschedparam/pthread_setschedparam
should be fine. Unsafe calls to those seem highly unlikely.
* Unsafe pthread_detach callers probably want to switch to
pthread_attr_setdetachstate instead, or using pthread_detach(pthread_self())
from the new thread's start routine rather than doing the detach in the
parent.
* pthread_join calls should be safe anyway, because a joinable thread won't
actually exit and unmap until it's joined. If you're joining an
unjoinable thread, the fix is to stop marking it detached. If you're
joining an already-joined thread, you need to rethink your design.
* Unsafe pthread_kill calls aren't portably fixable. (And are obviously
inherently non-portable as-is.) The best alternative on Android is to
use pthread_gettid_np at some point that you know the thread to be alive,
and then call kill/tgkill directly. That's still not completely safe
because if you're too late, the tid may have been reused, but then your
code is inherently unsafe anyway.
If we find too much code is still broken, we can come back and disable
the global thread list lookups for anything targeting >= O and then have
another go at really removing this in P...
Bug: http://b/19636317
Test: N6P boots, bionic tests pass
Change-Id: Ia92641212f509344b99ee2a9bfab5383147fcba6
2017-01-04 23:12:54 +01:00
|
|
|
public:
|
2017-02-02 03:41:38 +01:00
|
|
|
class pthread_internal_t* next;
|
|
|
|
class pthread_internal_t* prev;
|
|
|
|
|
2013-11-16 02:40:18 +01:00
|
|
|
pid_t tid;
|
|
|
|
|
2014-06-20 01:39:01 +02:00
|
|
|
private:
|
|
|
|
pid_t cached_pid_;
|
|
|
|
|
|
|
|
public:
|
|
|
|
pid_t invalidate_cached_pid() {
|
|
|
|
pid_t old_value;
|
|
|
|
get_cached_pid(&old_value);
|
|
|
|
set_cached_pid(0);
|
|
|
|
return old_value;
|
|
|
|
}
|
|
|
|
|
|
|
|
void set_cached_pid(pid_t value) {
|
|
|
|
cached_pid_ = value;
|
|
|
|
}
|
|
|
|
|
|
|
|
bool get_cached_pid(pid_t* cached_pid) {
|
|
|
|
*cached_pid = cached_pid_;
|
|
|
|
return (*cached_pid != 0);
|
|
|
|
}
|
|
|
|
|
2013-11-16 02:40:18 +01:00
|
|
|
pthread_attr_t attr;
|
|
|
|
|
2015-03-07 02:23:53 +01:00
|
|
|
_Atomic(ThreadJoinState) join_state;
|
|
|
|
|
2013-11-16 02:40:18 +01:00
|
|
|
__pthread_cleanup_t* cleanup_stack;
|
|
|
|
|
|
|
|
void* (*start_routine)(void*);
|
|
|
|
void* start_routine_arg;
|
|
|
|
void* return_value;
|
|
|
|
|
|
|
|
void* alternate_signal_stack;
|
|
|
|
|
2015-10-23 05:07:56 +02:00
|
|
|
Lock startup_handshake_lock;
|
2014-05-28 21:35:33 +02:00
|
|
|
|
2015-01-06 18:31:00 +01:00
|
|
|
size_t mmap_size;
|
2014-12-23 04:17:33 +01:00
|
|
|
|
2015-11-25 02:24:06 +01:00
|
|
|
thread_local_dtor* thread_local_dtors;
|
|
|
|
|
2014-12-04 06:36:24 +01:00
|
|
|
void* tls[BIONIC_TLS_SLOTS];
|
|
|
|
|
2015-02-21 01:15:33 +01:00
|
|
|
pthread_key_data_t key_data[BIONIC_PTHREAD_KEY_COUNT];
|
|
|
|
|
2013-11-16 02:40:18 +01:00
|
|
|
/*
|
|
|
|
* The dynamic linker implements dlerror(3), which makes it hard for us to implement this
|
|
|
|
* per-thread buffer by simply using malloc(3) and free(3).
|
|
|
|
*/
|
2012-10-17 00:54:46 +02:00
|
|
|
#define __BIONIC_DLERROR_BUFFER_SIZE 512
|
2013-11-16 02:40:18 +01:00
|
|
|
char dlerror_buffer[__BIONIC_DLERROR_BUFFER_SIZE];
|
2017-02-22 21:19:05 +01:00
|
|
|
|
|
|
|
bionic_tls* bionic_tls;
|
2015-03-20 18:58:04 +01:00
|
|
|
};
|
2009-03-04 04:28:35 +01:00
|
|
|
|
2017-02-02 03:41:38 +01:00
|
|
|
__LIBC_HIDDEN__ int __init_thread(pthread_internal_t* thread);
|
2017-09-19 23:02:50 +02:00
|
|
|
__LIBC_HIDDEN__ bool __init_tls(pthread_internal_t* thread);
|
2017-02-02 03:41:38 +01:00
|
|
|
__LIBC_HIDDEN__ void __init_thread_stack_guard(pthread_internal_t* thread);
|
Remove the global thread list.
Another release, another attempt to fix this bug.
This change affects pthread_detach, pthread_getcpuclockid,
pthread_getschedparam/pthread_setschedparam, pthread_join, and pthread_kill:
instead of returning ESRCH when passed an invalid pthread_t, they'll now SEGV.
Note that this doesn't change behavior as much as you might think: the old
lookup only held the global thread list lock for the duration of the lookup,
so there was still a race between that and the dereference in the caller,
given that callers actually need the tid to pass to some syscall or other,
and sometimes update fields in the pthread_internal_t struct too.
We can't check thread->tid against 0 to see whether a pthread_t is still
valid because a dead thread gets its thread struct unmapped along with its
stack, so the dereference isn't safe.
Taking the affected functions one by one:
* pthread_getcpuclockid and pthread_getschedparam/pthread_setschedparam
should be fine. Unsafe calls to those seem highly unlikely.
* Unsafe pthread_detach callers probably want to switch to
pthread_attr_setdetachstate instead, or using pthread_detach(pthread_self())
from the new thread's start routine rather than doing the detach in the
parent.
* pthread_join calls should be safe anyway, because a joinable thread won't
actually exit and unmap until it's joined. If you're joining an
unjoinable thread, the fix is to stop marking it detached. If you're
joining an already-joined thread, you need to rethink your design.
* Unsafe pthread_kill calls aren't portably fixable. (And are obviously
inherently non-portable as-is.) The best alternative on Android is to
use pthread_gettid_np at some point that you know the thread to be alive,
and then call kill/tgkill directly. That's still not completely safe
because if you're too late, the tid may have been reused, but then your
code is inherently unsafe anyway.
If we find too much code is still broken, we can come back and disable
the global thread list lookups for anything targeting >= O and then have
another go at really removing this in P...
Bug: http://b/19636317
Test: N6P boots, bionic tests pass
Change-Id: Ia92641212f509344b99ee2a9bfab5383147fcba6
2017-01-04 23:12:54 +01:00
|
|
|
__LIBC_HIDDEN__ void __init_alternate_signal_stack(pthread_internal_t*);
|
2014-09-12 01:11:43 +02:00
|
|
|
|
2017-02-02 03:41:38 +01:00
|
|
|
__LIBC_HIDDEN__ pthread_t __pthread_internal_add(pthread_internal_t* thread);
|
|
|
|
__LIBC_HIDDEN__ pthread_internal_t* __pthread_internal_find(pthread_t pthread_id);
|
|
|
|
__LIBC_HIDDEN__ void __pthread_internal_remove(pthread_internal_t* thread);
|
|
|
|
__LIBC_HIDDEN__ void __pthread_internal_remove_and_free(pthread_internal_t* thread);
|
|
|
|
|
2015-03-18 22:14:02 +01:00
|
|
|
// Make __get_thread() inlined for performance reason. See http://b/19825434.
|
|
|
|
static inline __always_inline pthread_internal_t* __get_thread() {
|
2016-06-30 01:19:25 +02:00
|
|
|
void** tls = __get_tls();
|
|
|
|
if (__predict_true(tls)) {
|
|
|
|
return reinterpret_cast<pthread_internal_t*>(tls[TLS_SLOT_THREAD_ID]);
|
|
|
|
}
|
|
|
|
|
|
|
|
// This happens when called during libc initialization before TLS has been initialized.
|
|
|
|
return nullptr;
|
2015-03-18 22:14:02 +01:00
|
|
|
}
|
2009-03-04 04:28:35 +01:00
|
|
|
|
2017-02-22 21:19:05 +01:00
|
|
|
static inline __always_inline bionic_tls& __get_bionic_tls() {
|
|
|
|
return *__get_thread()->bionic_tls;
|
|
|
|
}
|
|
|
|
|
2013-02-11 21:18:47 +01:00
|
|
|
__LIBC_HIDDEN__ void pthread_key_clean_all(void);
|
|
|
|
|
2017-06-28 02:01:57 +02:00
|
|
|
// Address space is precious on LP32, so use the minimum unit: one page.
|
|
|
|
// On LP64, we could use more but there's no obvious advantage to doing
|
|
|
|
// so, and the various media processes use RLIMIT_AS as a way to limit
|
|
|
|
// the amount of allocation they'll do.
|
|
|
|
#define PTHREAD_GUARD_SIZE PAGE_SIZE
|
|
|
|
|
|
|
|
// SIGSTKSZ (8KiB) is not big enough.
|
|
|
|
// An snprintf to a stack buffer of size PATH_MAX consumes ~7KiB of stack.
|
|
|
|
// Also, on 64-bit, logging uses more than 8KiB by itself:
|
2017-03-07 02:45:33 +01:00
|
|
|
// https://code.google.com/p/android/issues/detail?id=187064
|
2017-06-28 02:01:57 +02:00
|
|
|
#define SIGNAL_STACK_SIZE_WITHOUT_GUARD (16 * 1024)
|
2016-03-31 02:48:50 +02:00
|
|
|
|
2017-06-28 02:01:57 +02:00
|
|
|
// Traditionally we gave threads a 1MiB stack. When we started
|
|
|
|
// allocating per-thread alternate signal stacks to ease debugging of
|
|
|
|
// stack overflows, we subtracted the same amount we were using there
|
|
|
|
// from the default thread stack size. This should keep memory usage
|
|
|
|
// roughly constant.
|
|
|
|
#define PTHREAD_STACK_SIZE_DEFAULT ((1 * 1024 * 1024) - SIGNAL_STACK_SIZE_WITHOUT_GUARD)
|
2013-09-14 01:34:43 +02:00
|
|
|
|
2015-09-22 20:16:15 +02:00
|
|
|
// Leave room for a guard page in the internally created signal stacks.
|
2017-06-28 02:01:57 +02:00
|
|
|
#define SIGNAL_STACK_SIZE (SIGNAL_STACK_SIZE_WITHOUT_GUARD + PTHREAD_GUARD_SIZE)
|
2015-03-31 05:03:57 +02:00
|
|
|
|
2017-06-28 02:01:57 +02:00
|
|
|
// Needed by fork.
|
2013-10-30 22:40:09 +01:00
|
|
|
__LIBC_HIDDEN__ extern void __bionic_atfork_run_prepare();
|
|
|
|
__LIBC_HIDDEN__ extern void __bionic_atfork_run_child();
|
|
|
|
__LIBC_HIDDEN__ extern void __bionic_atfork_run_parent();
|
2009-03-04 04:28:35 +01:00
|
|
|
|
|
|
|
#endif /* _PTHREAD_INTERNAL_H_ */
|