Commit graph

211 commits

Author SHA1 Message Date
Elliott Hughes
3069270d86 am c2bba24d: Merge "Give the timer_create SIGEV_THREAD helper threads sensible names."
* commit 'c2bba24d0a6b906f00d7b9f20ac9d32d63bb2e9d':
  Give the timer_create SIGEV_THREAD helper threads sensible names.
2012-06-06 11:35:32 -07:00
Elliott Hughes
470631ed79 Give the timer_create SIGEV_THREAD helper threads sensible names.
Bug: 6609676
Change-Id: I286b197c75beee4d9930b0973f2d7dd47c14e91c
2012-06-06 10:32:56 -07:00
Iliyan Malchev
252a5c854a resolved conflicts for merge of e1dd3c28 to jb-dev-plus-aosp
Change-Id: I58b9c13d20771aa39b703ec05cbff8aeaad38fe8
2012-06-02 08:14:36 -07:00
Iliyan Malchev
f0ddaa2fac am 7d2e24eb: bionic: introduce libc.debug.malloc.program
* commit '7d2e24eb167b6257f7935c7bd2023a708704ca1a':
  bionic: introduce libc.debug.malloc.program
2012-06-01 19:03:06 -07:00
Iliyan Malchev
e1dd3c287b bionic: import heaptracker as chk_malloc
This patch is a rewrite of libc.debug.malloc = 10 (chk_malloc).  It provides
the same features as the original (poison freed memory, detect heap overruns
and underruns), except that it provides more debugging information whenever it
detects a problem.

In addition to the original features, the new chk_malloc() implementation
detects multiple frees within a given range of the last N allocations, N being
configurable via the system property libc.debug.malloc.backlog.

Finally, this patch keeps track of all outstanding memory allocations.  On
program exit, we walk that list and report each outstanding allocation.

(There is support (not enabled) for a scanner thread periodically walks over
the list of outstanding allocations as well as the backlog of recently-freed
allocations, checking for heap-usage errors.)

Feature overview:

  1) memory leaks
  2) multiple frees
  3) use after free
  4) overrun

Implementation:

-- for each allocation, there is a:
  1) stack trace at the time the allocation is made
  2) if the memory is freed, there is also a stack trace at the point
  3) a front and rear guard (fence)
  4) the stack traces are kept together with the allocation

-- the following lists and maintained

  1) all outstanding memory allocations
  3) a backlog of allocations what are freed; when you call free(), instead of
     actually freed, the allocation is moved to this backlog;
  4) when the backlog of allocations gets full, the oldest entry gets evicted
     from it; at that point, the allocation is checked for overruns or
     use-after-free errors, and then actually freed.
  5) when the program exits, the list of outstanding allocations and the
     backlog are inspected for errors, then freed;

To use this, set the following system properties before running the process or
processes you want to inspect:

libc.malloc.debug.backlog # defaults to 100
libc.malloc.debug 10

When a problem is detected, you will see the following on logcat for a multiple
free:

E/libc    ( 7233): +++ ALLOCATION 0x404b9278 SIZE 10 BYTES MULTIPLY FREED!
E/libc    ( 7233): +++ ALLOCATION 0x404b9278 SIZE 10 ALLOCATED HERE:
E/libc    ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
E/libc    ( 7233):      #00  pc 0000c35a  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #01  pc 0000c658  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #02  pc 00016d80  /system/lib/libc.so
E/libc    ( 7233):      #03  pc 4009647c  /system/bin/malloctest
E/libc    ( 7233):      #04  pc 00016f24  /system/lib/libc.so
E/libc    ( 7233): +++ ALLOCATION 0x404b9278 SIZE 10 FIRST FREED HERE:
E/libc    ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
E/libc    ( 7233):      #00  pc 0000c35a  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #01  pc 0000c7d2  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #02  pc 00016d94  /system/lib/libc.so
E/libc    ( 7233):      #03  pc 40096490  /system/bin/malloctest
E/libc    ( 7233):      #04  pc 00016f24  /system/lib/libc.so
E/libc    ( 7233): +++ ALLOCATION 0x404b9278 SIZE 10 NOW BEING FREED HERE:
E/libc    ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
E/libc    ( 7233):      #00  pc 0000c35a  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #01  pc 0000c6ac  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #02  pc 00016d94  /system/lib/libc.so
E/libc    ( 7233):      #03  pc 400964a0  /system/bin/malloctest
E/libc    ( 7233):      #04  pc 00016f24  /system/lib/libc.so

The following for a heap overrun and underrun:

E/libc    ( 7233): +++ REAR GUARD MISMATCH [10, 11)
E/libc    ( 7233): +++ ALLOCATION 0x404b9198 SIZE 10 HAS A CORRUPTED REAR GUARD
E/libc    ( 7233): +++ ALLOCATION 0x404b9198 SIZE 10 ALLOCATED HERE:
E/libc    ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
E/libc    ( 7233):      #00  pc 0000c35a  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #01  pc 0000c658  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #02  pc 00016d80  /system/lib/libc.so
E/libc    ( 7233):      #03  pc 40096438  /system/bin/malloctest
E/libc    ( 7233):      #04  pc 00016f24  /system/lib/libc.so
E/libc    ( 7233): +++ ALLOCATION 0x404b9198 SIZE 10 FREED HERE:
E/libc    ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
E/libc    ( 7233):      #00  pc 0000c35a  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #01  pc 0000c7d2  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #02  pc 00016d94  /system/lib/libc.so
E/libc    ( 7233):      #03  pc 40096462  /system/bin/malloctest
E/libc    ( 7233):      #04  pc 00016f24  /system/lib/libc.so
E/libc    ( 7233): +++ ALLOCATION 0x404b9358 SIZE 10 HAS A CORRUPTED FRONT GUARD
E/libc    ( 7233): +++ ALLOCATION 0x404b9358 SIZE 10 ALLOCATED HERE:
E/libc    ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
E/libc    ( 7233):      #00  pc 0000c35a  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #01  pc 0000c658  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #02  pc 00016d80  /system/lib/libc.so
E/libc    ( 7233):      #03  pc 400964ba  /system/bin/malloctest
E/libc    ( 7233):      #04  pc 00016f24  /system/lib/libc.so
E/libc    ( 7233): +++ ALLOCATION 0x404b9358 SIZE 10 FREED HERE:
E/libc    ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
E/libc    ( 7233):      #00  pc 0000c35a  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #01  pc 0000c7d2  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #02  pc 00016d94  /system/lib/libc.so
E/libc    ( 7233):      #03  pc 400964e4  /system/bin/malloctest
E/libc    ( 7233):      #04  pc 00016f24  /system/lib/libc.so

The following for a memory leak:

E/libc    ( 7233): +++ THERE ARE 1 LEAKED ALLOCATIONS
E/libc    ( 7233): +++ DELETING 4096 BYTES OF LEAKED MEMORY AT 0x404b95e8 (1 REMAINING)
E/libc    ( 7233): +++ ALLOCATION 0x404b95e8 SIZE 4096 ALLOCATED HERE:
E/libc    ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
E/libc    ( 7233):      #00  pc 0000c35a  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #01  pc 0000c658  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #02  pc 00016d80  /system/lib/libc.so
E/libc    ( 7233):      #03  pc 0001bc94  /system/lib/libc.so
E/libc    ( 7233):      #04  pc 0001edf6  /system/lib/libc.so
E/libc    ( 7233):      #05  pc 0001b80a  /system/lib/libc.so
E/libc    ( 7233):      #06  pc 0001c086  /system/lib/libc.so
E/libc    ( 7233):      #07  pc 40096402  /system/bin/malloctest
E/libc    ( 7233):      #08  pc 00016f24  /system/lib/libc.so

Change-Id: Ic440e9d05a01e2ea86b25e8998714e88bc2d16e0
Signed-off-by: Iliyan Malchev <malchev@google.com>
2012-06-01 15:54:34 -07:00
Iliyan Malchev
7d2e24eb16 bionic: introduce libc.debug.malloc.program
libc.debug.malloc.program  provides an additional level of control over which
processes to enable libc.debug.malloc functionality for.  The string value of
libc.debug.malloc.program is matched against the program name; if the value of
libc.debug.malloc.program is a substring of the program name, then malloc debug
is applied to that program at whatever level libc.debug.malloc specifies.

If lib.debug.malloc.program is not specified, then libc.debug.malloc has the
same effect as before.

For example, to enable libc.deubug.malloc = 10 only to the mediaserver, do the
following:

   adb root # necessary for setprop
   adb setprop libc.debug.malloc.program mediaserver
   adb setprop libc.debug.malloc 10
   adb kill -9 $(pid mediaserver)

Change-Id: I6f01c12f033c8e2e015d73025369d7f1685ba200
Signed-off-by: Iliyan Malchev <malchev@google.com>
2012-05-30 20:03:47 -07:00
Ben Cheng
d7b60b207b am c84ff11d: Print the corrupted address passed to free().
* commit 'c84ff11dad26435dc5760bceda18e8f1175a6061':
  Print the corrupted address passed to free().
2012-05-24 17:21:03 -07:00
Ben Cheng
c84ff11dad Print the corrupted address passed to free().
For example:

@@@ ABORTING: INVALID HEAP ADDRESS IN dlfree addr=0x5c3bfbd0
Fatal signal 11 (SIGSEGV) at 0xdeadbaad (code=1), thread 2942

The addr=0x5c3bfbd0 part is new.

Change-Id: I8670144b2b0a3a6182384150d762c97dfee5452f
2012-05-24 17:06:43 -07:00
Elliott Hughes
eab2889e66 am fd955033: Merge "pthread: Invalidate stale stack pointers on pthread_exit()"
* commit 'fd95503347acba5c52d669a186ad2b161338a8a7':
  pthread: Invalidate stale stack pointers on pthread_exit()
2012-05-09 12:53:16 -07:00
Bjorn Andersson
0753dc653e pthread: Invalidate stale stack pointers on pthread_exit()
A call to pthread_key_delete() after pthread_exit() have unmapped the stack of a thread
but before the ongoing pthread_join() have finished executing will result in an access
to unmapped memory.
Avoid this by invalidating the stack_base and tls pointers during pthread_exit().

This is based on the investigation and proprosed solution by
Srinavasa Nagaraju <srinavasa.x.nagaraju@sonyericsson.com>

Change-Id: I145fb5d57930e91b00f1609d7b2cd16a55d5b3a9
2012-05-08 17:43:57 -07:00
Elliott Hughes
9c3eca7bce resolved conflicts for merge of 6cf3c7c5 to jb-dev-plus-aosp
Change-Id: Ib22a8ae1ef63bf9b9c82ce6e22afd188ba7c2806
2012-05-08 13:26:28 -07:00
Pierre Peiffer
d0c884d359 Let pthread_create fail if schedparam can't be set
The creation of a thread succeeds even if the requested scheduling
parameters can not be set. This is not POSIX compliant, and even
worse, it leads to a wrong behavior. Let pthread_create() fail in this
case.

Change-Id: Ice66e2a720975c6bde9fe86c2cf8f649533a169c
Signed-off-by: Christian Bejram <christian.bejram@stericsson.com>
2012-05-08 10:54:51 -07:00
Elliott Hughes
ff0d1ce4df am e3bc7192: Merge "bionic: fix integer overflows in chk_malloc(), leak_malloc(), and leak_memalign()"
* commit 'e3bc7192ec4254bed00eb8b352735665c6072995':
  bionic: fix integer overflows in chk_malloc(), leak_malloc(), and leak_memalign()
2012-05-07 14:00:01 -07:00
Xi Wang
7f5aa4f35e bionic: fix integer overflows in chk_malloc(), leak_malloc(), and leak_memalign()
The allocation size in chk_malloc(), leak_malloc(), and leak_memalign()
functions may be rounded up to a small value, leading to buffer overflows.
The code only runs in debugging mode.

This patch complements commit 6f04a0f4 (CVE-2009-0607).

Change-Id: Id899bcd2bcd2ea2205e5753c433390710032dc83
Signed-off-by: Xi Wang <xi.wang@gmail.com>
2012-05-07 10:50:21 -07:00
Ken Sumrall
6baffed252 Add the posix_memalign(3) function to bionic
The posix_memalign(3) function is very similar to the traditional
memalign(3) function, but with better error reporting and a guarantee
that the memory it allocates can be freed.  In bionic, memalign(3)
allocated memory can be freed, so posix_memalign(3) is just a wrapper
around memalign(3).

Change-Id: I62ee908aa5ba6b887d8446a00d8298d080a6a299
2012-04-27 09:34:53 -07:00
Evgeniy Stepanov
1a78fbb5c8 Initialize TLS before any application code is run.
Since e19d702b8e, dlsym and friends use recursive mutexes that
require the current thread id, which is not available before the libc
constructor. This prevents us from using dlsym() in .preinit_array.

This change moves TLS initialization from libc constructor to the earliest
possible point - immediately after linker itself is relocated. As a result,
pthread_internal_t for the initial thread is available from the start.

As a bonus, values stored in TLS in .preinit_array are not lost when libc is
initialized.

Change-Id: Iee5a710ee000173bff63e924adeb4a4c600c1e2d
2012-04-13 00:08:11 +04:00
Jean-Baptiste Queru
faca92f2f1 Handle pthread-related changes (mutex/atfork)
First commit:

Revert "Revert "am be741d47: am 2f460fbe: am 73b5cad9: Merge "bionic: Fix wrong kernel_id in pthread descriptor after fork()"""

This reverts commit 06823da2f0.

Second commit:

bionic: fix atfork hanlder_mutex deadlock

This cherry-picks commit 34e89c232d

After applying the kernel_id fix, the system refused to boot up and we
got following crash log:
I/DEBUG   (  113): pid: 618, tid: 618  >>> org.simalliance.openmobileapi.service:remote <<<
I/DEBUG   (  113): signal 16 (SIGSTKFLT), code -6 (?), fault addr --------
I/DEBUG   (  113):  eax fffffe00  ebx b77de994  ecx 00000080  edx 00724002
I/DEBUG   (  113):  esi 00000000  edi 00004000
I/DEBUG   (  113):  xcs 00000073  xds 0000007b  xes 0000007b  xfs 00000000 xss 0000007b
I/DEBUG   (  113):  eip b7761351  ebp bfdf3de8  esp bfdf3dc4  flags 00000202
I/DEBUG   (  113):     #00  eip: 00015351  /system/lib/libc.so
I/DEBUG   (  113):     #01  eip: 0000d13c  /system/lib/libc.so (pthread_mutex_lock)
I/DEBUG   (  113):     #02  eip: 00077b48  /system/lib/libc.so (__bionic_atfork_run_prepare)
I/DEBUG   (  113):     #03  eip: 00052cdb  /system/lib/libc.so (fork)
I/DEBUG   (  113):     #04  eip: 0009ae91  /system/lib/libdvm.so (_Z18dvmOptimizeDexFileillPKcjjb)
I/DEBUG   (  113):     #05  eip: 000819d6  /system/lib/libdvm.so (_Z14dvmJarFileOpenPKcS0_PP7JarFileb)
I/DEBUG   (  113):     #06  eip: 000b175e  /system/lib/libdvm.so (_ZL40Dalvik_dalvik_system_DexFile_openDexFilePKjP6JValue)
I/DEBUG   (  113):     #07  eip: 0011fb94  /system/lib/libdvm.so

Root cause:
The atfork uses the mutex handler_mutex to protect the atfork_head. The
parent will call __bionic_atfork_run_prepare() to lock the handler_mutex,
and need both the parent and child to unlock their own copy of handler_mutex
after fork. At that time, the owner of hanlder_mutex is set as the parent.
If we apply the kernel_id fix, then the child's kernel_id will be set as
child's tid.
The handler_mutex is a recursive lock, and pthread_mutex_unlock(&hander_mutex)
will fail because the mutex owner is the parent, while the current tid
(__get_thread()->kernel_id) is child, not matched with the mutex owner.
At that time, the handler_mutex is left in lock state.If the child wants to
fork other process after than, then it will try to lock handler_mutex, and
then be deadlocked.

Fix:
Since the child has its own copy of vm space from the the parent, the
child space's handler_mutex should be reset to the initialized state.

Change-Id: I3907dd9a153418fb78862f2aa6d0302c375d9e27
Signed-off-by: Jack Ren <jack.ren@intel.com>
Signed-off-by: Chenyang Du <chenyang.du@intel.com>
Signed-off-by: Bruce Beare <bruce.j.beare@intel.com>

Change-Id: Ic8072f366a877443a60fe215f3c00b3df5a259c8
2012-03-26 15:38:59 -07:00
Ben Cheng
eaae81082c Initialize mspace->least_addr properly in the mmap path.
BUG: 6206963
Change-Id: Id2ab580246de50a4511b56a734a7bece98fb945c
2012-03-21 15:47:12 -07:00
Ben Cheng
21eab513e7 New additions/bug fixes required/found when porting perf.
New functions:
	tfind
	tsearch
	tdelete
	twalk
	tdestroy (GNU extension)

Bug fix: the current implementation for realpath would crash
	if the second argument (resolved_path) is NULL.

New headers:
	ar.h
	search.h

Change-Id: Ib6c1e42fc186a6d597a6e5a9692b16acaa155804
2012-03-20 12:54:55 -07:00
Jack Ren
34e89c232d bionic: fix atfork hanlder_mutex deadlock
After applying the kernel_id fix, the system refused to boot up and we
got following crash log:
I/DEBUG   (  113): pid: 618, tid: 618  >>> org.simalliance.openmobileapi.service:remote <<<
I/DEBUG   (  113): signal 16 (SIGSTKFLT), code -6 (?), fault addr --------
I/DEBUG   (  113):  eax fffffe00  ebx b77de994  ecx 00000080  edx 00724002
I/DEBUG   (  113):  esi 00000000  edi 00004000
I/DEBUG   (  113):  xcs 00000073  xds 0000007b  xes 0000007b  xfs 00000000 xss 0000007b
I/DEBUG   (  113):  eip b7761351  ebp bfdf3de8  esp bfdf3dc4  flags 00000202
I/DEBUG   (  113):     #00  eip: 00015351  /system/lib/libc.so
I/DEBUG   (  113):     #01  eip: 0000d13c  /system/lib/libc.so (pthread_mutex_lock)
I/DEBUG   (  113):     #02  eip: 00077b48  /system/lib/libc.so (__bionic_atfork_run_prepare)
I/DEBUG   (  113):     #03  eip: 00052cdb  /system/lib/libc.so (fork)
I/DEBUG   (  113):     #04  eip: 0009ae91  /system/lib/libdvm.so (_Z18dvmOptimizeDexFileillPKcjjb)
I/DEBUG   (  113):     #05  eip: 000819d6  /system/lib/libdvm.so (_Z14dvmJarFileOpenPKcS0_PP7JarFileb)
I/DEBUG   (  113):     #06  eip: 000b175e  /system/lib/libdvm.so (_ZL40Dalvik_dalvik_system_DexFile_openDexFilePKjP6JValue)
I/DEBUG   (  113):     #07  eip: 0011fb94  /system/lib/libdvm.so

Root cause:
The atfork uses the mutex handler_mutex to protect the atfork_head. The
parent will call __bionic_atfork_run_prepare() to lock the handler_mutex,
and need both the parent and child to unlock their own copy of handler_mutex
after fork. At that time, the owner of hanlder_mutex is set as the parent.
If we apply the kernel_id fix, then the child's kernel_id will be set as
child's tid.
The handler_mutex is a recursive lock, and pthread_mutex_unlock(&hander_mutex)
will fail because the mutex owner is the parent, while the current tid
(__get_thread()->kernel_id) is child, not matched with the mutex owner.
At that time, the handler_mutex is left in lock state.If the child wants to
fork other process after than, then it will try to lock handler_mutex, and
then be deadlocked.

Fix:
Since the child has its own copy of vm space from the the parent, the
child space's handler_mutex should be reset to the initialized state.

Change-Id: I3907dd9a153418fb78862f2aa6d0302c375d9e27
Signed-off-by: Jack Ren <jack.ren@intel.com>
Signed-off-by: Chenyang Du <chenyang.du@intel.com>
Signed-off-by: Bruce Beare <bruce.j.beare@intel.com>
2012-03-17 17:08:54 +08:00
Guang Zhu
06823da2f0 Revert "am be741d47: am 2f460fbe: am 73b5cad9: Merge "bionic: Fix wrong kernel_id in pthread descriptor after fork()""
This reverts commit 76d56cf4a9, reversing
changes made to c59ba4595b.

Bug: 6157577
2012-03-12 22:05:36 -07:00
Elliott Hughes
76d56cf4a9 am be741d47: am 2f460fbe: am 73b5cad9: Merge "bionic: Fix wrong kernel_id in pthread descriptor after fork()"
* commit 'be741d472868a8ffcb455588f18cda889b0f465c':
  bionic: Fix wrong kernel_id in pthread descriptor after fork()
2012-03-12 17:12:35 -07:00
Jack Ren
d8bc6e7119 bionic: Fix wrong kernel_id in pthread descriptor after fork()
After forking, the kernel_id field in the phtread_internal_t returned by pthread_self()
is incorrect --- it's the tid from the parent, not the new tid of the
child.

The root cause is that: currently the kernel_id is set by
_init_thread(), which is called in 2 cases:
(1) called by __libc_init_common(). That happens when the execv( ) is
called after fork( ). But when the zygote tries to fork the android
application, the child application doesn't call execv( ), instread, it
tries to call the Java main method directly.
(2) called by pthread_create(). That happens when a new thread is
created.

For the lead thread which is the thread created by fork(), it should
call execv() but it doesn't, as described in (1) above. So its kernel_id
will inherit the parent's kernel_id.

Fixed it in this patch.

Change-Id: I63513e82af40ec5fe51fbb69456b1843e4bc0fc7
Signed-off-by: Chenyang Du <chenyang.du@intel.com>
Signed-off-by: Jack Ren <jack.ren@intel.com>
Signed-off-by: Bruce Beare <bruce.j.beare@intel.com>
2012-03-12 23:14:56 +08:00
Dianne Hackborn
058d6d88b9 Update bionic to know users and isolated uids for uid string representation.
Change-Id: I6681bacd69299a7f9837ef8025a80c5562081bad
2012-02-09 16:14:28 -08:00
David 'Digit' Turner
e1414aa96b libc: remove global lock from recursive mutex implementation.
This optimization improves the performance of recursive locks
drastically. When running the thread_stress program on a Xoom,
the total time to perform all operations goes from 1500 ms to
500 ms on average after this change is pushed to the device.

Change-Id: I5d9407a9191bdefdaccff7e7edefc096ebba9a9d
2012-01-30 10:13:41 +01:00
David 'Digit' Turner
b57db7581c libc: Fix recursive mutex lock implementation.
This fixes a bug that was introduced in the latest pthread optimization.
It happens when a recursive lock is contented by several threads. The main
issue was that the atomic counter increment in _recursive_increment() could
be annihilated by a non-conditional write in pthread_mutex_lock() used to
update the value's lower bits to indicate contention.

This patch re-introduces the use of the global recursive lock in
_recursive_increment(). This will hit performance, but a future patch
will be provided to remove it from the source code.

Change-Id: Ie22069d376cebf2e7d613ba00b6871567f333544
2012-01-24 13:20:38 +01:00
Mathias Agopian
68d03fdbd8 Merge "implement pthread mutex deadlock detection" 2012-01-05 14:05:30 -08:00
Ken Sumrall
85aad90956 Add the posix_memalign(3) function to bionic
The posix_memalign(3) function is very similar to the traditional
memalign(3) function, but with better error reporting and a guarantee
that the memory it allocates can be freed.  In bionic, memalign(3)
allocated memory can be freed, so posix_memalign(3) is just a wrapper
around memalign(3).

Change-Id: I62ee908aa5ba6b887d8446a00d8298d080a6a299
2011-12-14 20:55:43 -08:00
Mathias Agopian
7c0c379372 implement pthread mutex deadlock detection
this works by building a directed graph of acquired
pthread mutexes and making sure there are no loops in
that graph.

this feature is enabled with:

    setprop debug.libc.pthread 1

when a potential deadlock is detected, a large warning is
output to the log with appropriate back traces.

currently disabled at compile-time. set PTHREAD_DEBUG_ENABLED=1
to enable.

Change-Id: I916eed2319599e8aaf8f229d3f18a8ddbec3aa8a
2011-12-09 14:38:57 -08:00
David 'Digit' Turner
022d303116 libc: optimize pthread mutex lock/unlock operations (1/2)
This patch provides several small optimizations to the
implementation of mutex locking and unlocking. Note that
a following patch will get rid of the global recursion
lock, and provide a few more aggressive changes, I
though it'd be simpler to split this change in two parts.

+ New behaviour: pthread_mutex_lock et al now detect
  recursive mutex overflows and will return EAGAIN in
  this case, as suggested by POSIX. Before, the counter
  would just wrap to 0.

- Remove un-necessary reloads of the mutex value from memory
  by storing it in a local variable (mvalue)

- Remove un-necessary reload of the mutex value by passing
  the 'shared' local variable to _normal_lock / _normal_unlock

- Remove un-necessary reload of the mutex value by using a
  new macro (MUTEX_VALUE_OWNER()) to compare the thread id
  for recursive/errorcheck mutexes

- Use a common inlined function to increment the counter
  of a recursive mutex. Also do not use the global
  recursion lock in this case to speed it up.

Change-Id: I106934ec3a8718f8f852ef547f3f0e9d9435c816
2011-12-07 22:09:48 +01:00
David 'Digit' Turner
6c6de44f04 libc: optimize pthread_once() implementation.
This patch changes the implementation of pthread_once()
to avoid the use of a single global recursive mutex. This
should also slightly speed up the non-common case where
we have to call the init function, or wait for another
thread to finish the call.

Change-Id: I8a93f4386c56fb89b5d0eb716689c2ce43bdcad9
2011-12-07 22:06:36 +01:00
Rabin Vincent
6e9d51701e am a73de44b: am 177ba8cb: Prevent deadlock when using fork
* commit 'a73de44b7c0a50908ea8afe16134316cfc6cfbbe':
  Prevent deadlock when using fork
2011-12-06 16:04:56 -08:00
Rabin Vincent
177ba8cb42 Prevent deadlock when using fork
When forking of a new process in bionic, it is critical that it
does not allocate any memory according to the comment in
java_lang_ProcessManager.c:
"Note: We cannot malloc() or free() after this point!
A no-longer-running thread may be holding on to the heap lock, and
an attempt to malloc() or free() would result in deadlock."
However, as fork is using standard lib calls when tracing it a bit,
they might allocate memory, and thus causing the deadlock.
This is a rewrite so that the function cpuacct_add, that fork calls,
will use system calls instead of standard lib calls.

Signed-off-by: christian bejram <christian.bejram@stericsson.com>

Change-Id: Iff22ea6b424ce9f9bf0ac8e9c76593f689e0cc86
2011-12-06 08:39:18 -08:00
Jean-Baptiste Queru
c5819d427d Merge 35765066 from ics-mr1-plus-aosp
Change-Id: Ibaeb49dc20f3c736417d5cb68769e7b501a61632
2011-12-06 08:35:08 -08:00
Bruce Beare
e4a21c89a8 signal: Align the sigset_t size passed to from user space to kernel.
Pass kernel space sigset_t size to __rt_sigprocmask to workaround
the miss-match of NSIG/sigset_t definition between kernel and bionic.

Note: Patch originally from Google...
Change-Id: I4840fdc56d0b90d7ce2334250f04a84caffcba2a
Signed-off-by: Chenyang Du <chenyang.du@intel.com>
Signed-off-by: Bruce Beare <bruce.j.beare@intel.com>
2011-12-05 18:37:33 -08:00
Bruce Beare
aed4a4c90b am 75039baf: am 89d3fdca: MALLOC_DEBUG: enable the option libc.debug.malloc = 10
* commit '75039bafde8e6f03caffa9d6aa7142a09ba50952':
  MALLOC_DEBUG: enable the option libc.debug.malloc = 10
2011-12-05 17:02:20 -08:00
Bruce Beare
89d3fdcae2 MALLOC_DEBUG: enable the option libc.debug.malloc = 10
Fix the compile warning to let the libc.debug.malloc=10 works well
Due to unsuitable value comparison, which cause compiler optimize the
code of comparing two digits.

Change-Id: I0bedd596c9ca2ba308fb008da20ecb328d8548f5
Signed-off-by: Bruce Beare <bruce.j.beare@intel.com>
Author: liu chuansheng <chuansheng.liu@intel.com>
2011-12-05 14:58:55 -08:00
Jack Ren
bec5dec947 am 0c3d21e6: am e480fc83: bionic: fix pthread_{create, exit}/signal race condition
* commit '0c3d21e63c6e75ae73aaf2b8d64af0bd8caa6beb':
  bionic: fix pthread_{create, exit}/signal race condition
2011-11-30 10:50:59 -08:00
Jack Ren
e480fc83b2 bionic: fix pthread_{create, exit}/signal race condition
(1) in pthread_create:
    If the one signal is received before esp is subtracted by 16 and
    __thread_entry( ) is called, the stack will be cleared by kernel
    when it tries to contruct the signal stack frame. That will cause
    that __thread_entry will get a wrong tls pointer from the stack
    which leads to the segment fault when trying to access tls content.

(2) in pthread_exit
    After pthread_exit called system call unmap(), its stack will be
    freed.  If one signal is received at that time, there is no stack
    available for it.

Fixed by subtracting the child's esp by 16 before the clone system
call and by blocking signal handling before pthread_exit is started.

Author: Jack Ren <jack.ren@intel.com>
Signed-off-by: Bruce Beare <bruce.j.beare@intel.com>
2011-11-29 17:09:51 -08:00
Jeff Brown
95a17848d3 Merge "Add tgkill syscall." 2011-11-21 13:13:26 -08:00
Jeff Brown
10c8ce59a4 Add tgkill syscall.
Use tgkill instead of tkill to implement pthread_kill.
This is safer in the event that the thread has already terminated
and its id has been reused by a different process.

Change-Id: Ied715e11d7eadeceead79f33db5e2b5722954ac9
2011-11-18 16:40:48 -08:00
Nick Kralevich
5f64df4bc3 ASLR: enable pthread stack location randomization
Allow the kernel to choose a memory location to put the
thread stack, rather than hard coding 0x10000000

Change-Id: Ib1f37cf0273d4977e8d274fbdab9431ec1b7cb4f
2011-11-18 10:07:12 -08:00
David 'Digit' Turner
e31bfae2ba bionic: Do not use <sys/atomics.h> for platform code.
We're going to modify the __atomic_xxx implementation to provide
full memory barriers, to avoid problems for NDK machine code that
link to these functions.

First step is to remove their usage from our platform code.
We now use inlined versions of the same functions for a slight
performance boost.

+ remove obsolete atomics_x86.c (was never compiled)

NOTE: This improvement was benchmarked on various devices.
      Comparing a pthread mutex lock + atomic increment + unlock
      we get:

  - ARMv7 emulator, running on a 2.4 GHz Xeon:
       before: 396 ns    after: 288 ns

  - x86 emulator in KVM mode on same machine:
       before: 27 ns     after: 27 ns

  - Google Nexus S, in ARMv7 mode (single-core):
       before: 82 ns     after: 76 ns

  - Motorola Xoom, in ARMv7 mode (multi-core):
       before: 121 ns    after: 120 ns

The code has also been rebuilt in ARMv5TE mode for correctness.

Change-Id: Ic1dc72b173d59b2e7af901dd70d6a72fb2f64b17
2011-11-16 16:28:10 +01:00
David 'Digit' Turner
9bf330b567 libc: fix the pthread_sigmask implementation
The old code didn't work because the kernel expects a 64-bit sigset_t
while the one provided by our ABI is only 32-bit. This is originally
due to the fact that the kernel headers themselves define sigset_t
as a 32-bit type when __KERNEL__ is not defined (apparently to cater
to libc5 or some similarly old C library).

We can't modify the size of sigset_t without breaking the NDK ABI,
so instead perform runtime translation during the call.

Change-Id: Ibfdc3cbceaff864af7a05ca193aa050047b4773f
2011-11-14 22:57:24 +01:00
Glenn Kasten
d53cae0e45 Add non-NDK internal API __pthread_gettid
Tracking bugs 5267571 and 5090073 (for deadlock detection logs).

Change-Id: Icb90f91ec1525607551c2234ef921bf88296484f
2011-09-16 12:38:28 -07:00
David 'Digit' Turner
30e30acf10 am 6b6ebeca: am 3a131026: resolved conflicts for merge of 50a83255 to gingerbread-plus-aosp
* commit '6b6ebeca985fb3843b56b507ac4ac1be44080a9c':
  enable support for large files (> 2G)
  Enable functional DSO object destruction
  x86: Enable -fstack-protector
  Update X86 Bionic CRT files for unwind/exceptions
  bionic, libthread_db x86 fixes
  Updated gcc 4.4.3 IA toolchain doesn't require the .ctors list
  Remove an extra register move.
  Replace __atomic_XXX with GCC __sync_XXX intrinsics.
  move some typedefs to procfs.h required by gdbserver build
  use consistent guards for off_t and size_t defines for IA
  Simplify variable typing for IA builds
  sigsetmask.c was not processing the "mask" argument.
  Add defines for CAIF support
  Remove extra/unneeded copy of fenv.h
  Use proper variable typing
  Update ATOM string routines to latest
  Fix undefined reference to dl_iterate_phdr for x86
  Fix missing NL
  ptrace.c Fix source file format to unix from dos
2011-07-13 14:53:56 -07:00
David 'Digit' Turner
6b6ebeca98 am 3a131026: resolved conflicts for merge of 50a83255 to gingerbread-plus-aosp
* commit '3a13102637c8be53edf28f96598ac11aaa3e14df':
  enable support for large files (> 2G)
  Enable functional DSO object destruction
  x86: Enable -fstack-protector
  Update X86 Bionic CRT files for unwind/exceptions
  bionic, libthread_db x86 fixes
  Updated gcc 4.4.3 IA toolchain doesn't require the .ctors list
  Remove an extra register move.
  Replace __atomic_XXX with GCC __sync_XXX intrinsics.
  move some typedefs to procfs.h required by gdbserver build
  use consistent guards for off_t and size_t defines for IA
  Simplify variable typing for IA builds
  sigsetmask.c was not processing the "mask" argument.
  Add defines for CAIF support
  Remove extra/unneeded copy of fenv.h
  Use proper variable typing
  Update ATOM string routines to latest
  Fix undefined reference to dl_iterate_phdr for x86
  Fix missing NL
  ptrace.c Fix source file format to unix from dos
2011-07-11 13:25:01 -07:00
David 'Digit' Turner
3a13102637 resolved conflicts for merge of 50a83255 to gingerbread-plus-aosp
Change-Id: Idf1971120bbdd52676f95aa3aa69f62342dc012e
2011-07-11 21:39:14 +02:00
James Rose
3435fc600d bionic, libthread_db x86 fixes
Orig-Change-Id: I3be997f5f1f6a894a3c200d4f325cf3bfd428c66
Author: James Rose <james.rose@intel.com>
Signed-off-by: Bruce Beare <bruce.j.beare@intel.com>
2011-07-07 22:46:16 +02:00
Bruce Beare
bf29647964 Updated gcc 4.4.3 IA toolchain doesn't require the .ctors list
Orig-Change-Id: Ia840a19a45257128eccdcf25d105f500f2d90741
Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
Signed-off-by: Bruce Beare <bruce.j.beare@intel.com>
2011-07-07 22:46:16 +02:00