about summary refs log tree commit diff
Commit message (Collapse)AuthorAgeFilesLines
* fix false ownership of mutexes due to tid reuse, using robust listRich Felker2014-08-164-23/+26
| | | | | | | | | | | | | | | | | | | | | | | per the resolution of Austin Group issue 755, the POSIX requirement that ownership be enforced for recursive and error-checking mutexes does not allow a random new thread to acquire ownership of an orphaned mutex just because it happened to be assigned the same tid as the original owner that exited with the mutex locked. one possible fix for this issue would be to disallow the kernel thread to terminate when it exited with mutexes held, permanently reserving the tid against reuse. however, this does not solve the problem for process-shared mutexes where lifetime cannot be controlled, so it was not used. the alternate approach I've taken is to reuse the robust mutex system for non-robust recursive and error-checking mutexes. when a thread exits, the kernel (or the new userspace robust-list code added in commit b092f1c5fa9c048e12d002c7b972df5ecbe96d1d) will set the owner-died bit for these orphaned mutexes, but since the mutex-type is not robust, pthread_mutex_trylock will not allow a new owner to acquire them. instead, they remain in a state of being permanently locked, as desired.
* optimize locking against vm changes for mmap/munmapRich Felker2014-08-162-8/+7
| | | | | | | | | | the whole point of this locking is to prevent munmap, or mmap with MAP_FIXED, from deallocating virtual addresses, or changing the backing a given virtual address refers to, during certain race windows involving self-synchronized unmapping or destruction of pthread synchronization objects. there is no need for exclusion in the other direction, so it suffices to take the lock momentarily and release it before making the syscall, rather than holding it across the syscall.
* enable private futex for process-local robust mutexesRich Felker2014-08-163-1/+25
| | | | | | | | | | | | | | | | | | | | | | the kernel always uses non-private wake when walking the robust list when a thread or process exits, so it's not able to wake waiters listening with the private futex flag. this problem is solved by doing the equivalent in userspace as the last step of pthread_exit. care is taken to remove mutexes from the robust list before unlocking them so that the kernel will not attempt to access them again, possibly after another thread locks them. this removal code can treat the list as singly-linked, since no further code which would add or remove items is able to run at this point. moreover, the pending pointer is not needed since the mutexes being unlocked are all process-local; in the case of asynchronous process termination, they all cease to exist. since a process-local robust mutex cannot come into existence without a call to pthread_mutexattr_setrobust in the same process, the code for userspace robust list processing is put in that source file, and a weak alias to a dummy function is used to avoid pulling in this bloat as part of pthread_exit in static-linked programs.
* make futex operations use private-futex mode when possibleRich Felker2014-08-1523-66/+82
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | private-futex uses the virtual address of the futex int directly as the hash key rather than requiring the kernel to resolve the address to an underlying backing for the mapping in which it lies. for certain usage patterns it improves performance significantly. in many places, the code using futex __wake and __wait operations was already passing a correct fixed zero or nonzero flag for the priv argument, so no change was needed at the site of the call, only in the __wake and __wait functions themselves. in other places, especially where the process-shared attribute for a synchronization object was not previously tracked, additional new code is needed. for mutexes, the only place to store the flag is in the type field, so additional bit masking logic is needed for accessing the type. for non-process-shared condition variable broadcasts, the futex requeue operation is unable to requeue from a private futex to a process-shared one in the mutex structure, so requeue is simply disabled in this case by waking all waiters. for robust mutexes, the kernel always performs a non-private wake when the owner dies. in order not to introduce a behavioral regression in non-process-shared robust mutexes (when the owning thread dies), they are simply forced to be treated as process-shared for now, giving correct behavior at the expense of performance. this can be fixed by adding explicit code to pthread_exit to do the right thing for non-shared robust mutexes in userspace rather than relying on the kernel to do it, and will be fixed in this way later. since not all supported kernels have private futex support, the new code detects EINVAL from the futex syscall and falls back to making the call without the private flag. no attempt to cache the result is made; caching it and using the cached value efficiently is somewhat difficult, and not worth the complexity when the benefits would be seen only on ancient kernels which have numerous other limitations and bugs anyway.
* fix #ifdef inside a macro argument list in __init_tls.cSzabolcs Nagy2014-08-131-4/+3
| | | | | C99 6.10.3p11 disallows such constructs so use an #ifdef outside of the argument list of __syscall
* fix CPU_EQUAL macro in sched.hSzabolcs Nagy2014-08-131-1/+1
|
* add inline isspace in ctype.h as an optimizationSzabolcs Nagy2014-08-133-9/+7
| | | | | | | | | | | | | | | | | | | | | isspace can be a bottleneck in a simple parser, inlining it gives slightly smaller and faster code src/locale/pleval.o already had this optimization, the size change for other libc functions for i386 is src/internal/intscan.o 2134 2118 -16 src/locale/dcngettext.o 1562 1552 -10 src/network/res_msend.o 1961 1940 -21 src/network/lookup_name.o 2627 2608 -19 src/network/getnameinfo.o 1814 1811 -3 src/network/lookup_serv.o 643 624 -19 src/stdio/vfscanf.o 2675 2663 -12 src/stdlib/atoll.o 117 107 -10 src/stdlib/atoi.o 95 91 -4 src/stdlib/atol.o 95 91 -4 src/time/strptime.o 1515 1503 -12 (TOTALS) 432451 432321 -130
* add dlerror message for static-linked dlsym failureRich Felker2014-08-081-0/+2
|
* fix dlerror when using dlopen with a static libcClément Vasseur2014-08-081-0/+2
| | | | | when the dynamic loader is disabled, dlopen fails correctly but dlerror did not return a human readable error string like it should have.
* make clearenv available with _BSD_SOURCEClément Vasseur2014-08-081-1/+1
| | | | | glibc declares clearenv under _BSD_SOURCE, some applications might depend on it being available this way.
* make endmntent function handle null argumentTimo Teräs2014-08-081-1/+1
| | | | | The function originates from SunOS 4.x in which the null argument is allowed. glibc also handles this case.
* release 1.1.4 v1.1.4Rich Felker2014-07-312-1/+36
|
* update notice on broken gcc versions in INSTALL fileRich Felker2014-07-311-2/+4
|
* update COPYRIGHT file to reflect new contributorsRich Felker2014-07-311-1/+5
|
* harden locale name handling and prevent slashes in LC_MESSAGESRich Felker2014-07-311-3/+3
| | | | | | | | | | | | | | | | | | | | the code which loads locale files was already rejecting locale names containing slashes. however, LC_MESSAGES records a locale name even if libc does not have a matching locale file, so that gettext or application code can use the recorded locale name for message translations to languages that libc does not support. this recorded name was not being checked for slashes, meaning that such code could potentially be tricked into directory traversal. in addition, since the value of a locale category is sometimes used as a pathname component by callers, the improved code rejects any value beginning with a dot. this prevents traversal to the parent directory via "..", use of the top-level locale directory via ".", and also avoids "hidden" directories as a side effect. finally, overly long locale names are now rejected (treated as an unrecognized name and thus as an alias for C.UTF-8) rather than being truncated.
* implement ffsl and ffsll functionsRich Felker2014-07-313-0/+16
| | | | | | per the resolution of Austin Group issue #617, these are accepted for XSI option in POSIX future and thus I'm treating them as standard functions.
* limit visibility of ffs function declaration to _XOPEN_SOURCERich Felker2014-07-311-0/+2
| | | | | per the standard, ffs is XSI shaded, whereas the other functions in this header are in the base.
* fix broken offset argument to the mmap2 syscall on or1kRich Felker2014-07-301-0/+2
| | | | | | for or1k, the kernel expects the offset passed to mmap2 in units of the 8k page size, not the standard unit of 4k used on most other archs.
* add framework for mmap2 syscall unit to vary by archRich Felker2014-07-302-2/+7
|
* provide PAGE_SIZE as a constant value of 8192 on or1kRich Felker2014-07-301-0/+1
| | | | | according to Stefan Kristiansson, or1k page size is not actually variable and the value of 8192 is part of the ABI.
* plural rule evaluator rewrite for dcngettextSzabolcs Nagy2014-07-301-128/+106
| | | | | | | | | | | | | | | | | | | | | | | using an operator precedence parser the code size became smaller and it is only slower by about %10 size of old vs new pleval.o on different archs: (with inlined isspace added to pleval.c for now) old: text data bss dec hex filename 828 0 0 828 33c pl.i386.o 1152 0 0 1152 480 pl.arm.o 1704 0 0 1704 6a8 pl.mips.o 1328 0 0 1328 530 pl.ppc.o 992 0 0 992 3e0 pl.x64.o new: text data bss dec hex filename 693 0 0 693 2b5 pl.i386.o 972 0 0 972 3cc pl.arm.o 1276 0 0 1276 4fc pl.mips.o 1087 0 0 1087 43f pl.ppc.o 846 0 0 846 34e pl.x64.o
* reimplement if_nameindex and getifaddrs using netlinkTimo Teräs2014-07-294-184/+411
| | | | | | | | | | | | | | the previous implementations had several deficiencies, the most severe of which was the inability to report unconfigured interfaces or interfaces without ipv4 addresses. among the options discussed for fixing this, using netlink turned out to be the one with the least cost and most additional advantages. other improvements include: if_nameindex now avoids duplicates in the list it produces, but still includes legacy-style interface aliases if any are in use. getifaddrs now reports hardware addresses and includes the scope_id for link-local ipv6 addresses in the resulting address.
* fix terminal control ioctl constants for shRich Felker2014-07-291-4/+8
| | | | | | | | | | | | this commit changes the names to match the kernel names, exposing under the normal names the "old" versions which work with a smaller termios structure compatible with the userspace structure, and renaming the "new" versions with "2" on the end like the kernel has. this fixes spurious warnings "Unsupported ioctl: cmd=0x802c542a" from qemu-sh4 and should be more correct anyway, since our userspace termios structure does not have meaningful information in the part which the kernel would be interpreting as speeds with the new ioctl.
* tweaks to plural rules evaluatorSzabolcs Nagy2014-07-291-54/+44
| | | | | const parsing, depth accounting and failure handling was changed a bit so the generated code is slightly smaller.
* harden dcngettext plural processingRich Felker2014-07-291-2/+3
| | | | | | | | | | while the __mo_lookup backend can verify that the translated message ends with a null terminator, is has no way to know nplurals and thus no way to verify that sufficiently many null terminators are present in the string to satisfy all plural forms. the code in dcngettext was already attempting to avoid reading past the end of the mo file mapping, but failed to do so because the strlen call itself could over-read. using strnlen instead allows us to avoid the problem.
* harden mo file processing for locale/translationsRich Felker2014-07-291-2/+6
| | | | | | | | | | | | rather than just checking that the start of the string lies within the mapping, also check that the nominal length remains within the mapping, and that the null terminator is present at the nominal length. this ensures that the caller, using the result as a C string, will not read past the end of the mapping. the nominal length is never exposed to the caller, but it's useful internally to find where the null terminator should be without having to restort to linear search via strnlen/memchr.
* implement non-default plural rules for ngettext translationsRich Felker2014-07-282-8/+243
| | | | | the new code in dcngettext was written by me, and the expression evaluator by Szabolcs Nagy (nsz).
* remove unused a_cas_l from or1k atomic.hRich Felker2014-07-271-5/+0
| | | | this follows the same logic as in the previous commit for other archs.
* clean up unused and inconsistent atomics in arch dirsRich Felker2014-07-278-100/+0
| | | | | | | | | | | the a_cas_l, a_swap_l, a_swap_p, and a_store_l operations were probably used a long time ago when only i386 and x86_64 were supported. as other archs were added, support for them was inconsistent, and they are obviously not in use at present. having them around potentially confuses readers working on new ports, and the type-punning hacks and inconsistent use of types in their definitions is not a style I wish to perpetuate in the source tree, so removing them seems appropriate.
* fix insufficient synchronization in sh atomic asmRich Felker2014-07-271-1/+2
| | | | | | | while other usage I've seen only has the synco instruction after the atomic operation, I cannot find any documentation indicating that this is correct. certainly all stores before the atomic need to have been synchronized before the atomic operation takes place.
* implement gettext message translation functionsRich Felker2014-07-274-68/+271
| | | | | | | | | | | | | | | | | | | this commit replaces the stub implementations with working message translation functions. translation units are factored so as to prevent pulling in the legacy, non-library-safe functions which use a global textdomain in modern code which is using the versions with an explicit domain argument. bind_textdomain_codeset is also placed in its own file since it should not be needed by most programs. this implementation is still missing some features: the LANGUAGE environment variable (for multiple fallback languages) is not honored, and non-default plural-form rules are not supported. these issues will be addressed in a later commit. one notable difference from the GNU implementation is that there is no default path for loading translation files. in principle one could be added, but since the documented correct usage is to call the bindtextdomain function, a default path is probably unnecessary.
* add support for LC_TIME and LC_MESSAGES translationsRich Felker2014-07-267-13/+23
| | | | | | | | | | | | | | | | | for LC_MESSAGES, translation of strerror and similar literal message functions is supported. for messages in other places (particularly the dynamic linker) that use format strings, translation is not yet supported. in order to make it possible and safe, such messages will need to be refactored to separate the textual content from the format. for LC_TIME, the day and month names and strftime-style format strings provided by nl_langinfo are supported for translation. however there may be limitations, as some of the original C-locale nl_langinfo strings are non-unique and thus perhaps non-suitable as keys. overall, the locale support activated by this commit should not be seen as complete and polished but as a basis for beginning to test locale functionality and implement locales.
* add missing yes/no strings to nl_langinfoRich Felker2014-07-261-2/+2
| | | | | these were removed from the standard but still offered as an extension in langinfo.h, so nl_langinfo should support them.
* fix nl_langinfo table for LC_TIME era-related itemsRich Felker2014-07-261-1/+2
| | | | | due to a skipped slot and missing null terminator, the last few strings were off by one or two slots from their item codes.
* implement mo file string lookup for translationsRich Felker2014-07-264-0/+71
| | | | | | | | | | the core is based on a binary search; hash table is not used. both native and reverse-endian mo files are supported. all offsets read from the mapped mo file are checked against the mapping size to prevent the possibility of reads outside the mapping. this commit has no observable effects since there are not yet any callers to the message translation code.
* implement locale file loading and state for remaining locale categoriesRich Felker2014-07-244-2/+80
| | | | | | | | there is still no code which actually uses the loaded locale files, so the main observable effect of this commit is that calls to setlocale store and give back the names of the selected locales for the remaining categories (LC_TIME, LC_COLLATE, LC_MONETARY) if a locale file by the requested name could be loaded.
* fix locale environment variable logic for empty stringsRich Felker2014-07-241-3/+3
| | | | | | per POSIX (XBD 8.2) LC_*/LANG environment variables set to to the empty string are supposed to be treated as if they were not set at all.
* add new PR_SET_THP_DISABLE and PR_GET_THP_DISABLE prctl flagsSzabolcs Nagy2014-07-201-0/+3
| | | | | they can be used to set or query if transparent huge pages are disabled. introduced in linux 3.15 commit a0715cc22601e8830ace98366c0c2bd8da52af52
* add pacing rate information to the tcp_info struct in tcp.hSzabolcs Nagy2014-07-201-0/+2
| | | | | used by monitoring applications such as ss from iproute2 introduced in linux 3.15 commit 977cb0ecf82eb6d15562573c31edebf90db35163
* add new ethernet packet types ETH_P_80221, ETH_P_LOOPBACKSzabolcs Nagy2014-07-201-2/+4
| | | | | | | | | | ETH_P_80221 is ethertype for IEEE Std 802.21 - Media Independent Handover Protocol introduced in linux 3.15 commit b62faf3cdc875a1ac5a10696cf6ea0b12bab1596 ETH_P_LOOPBACK is the correct packet type for loopback in IEEE 802.3* introduced in linux 3.15 commit 61ccbb684421d374fdcd7cf5d6b024b06f03ce4e some defines were shuffled to be in ascending order and match the kernel header
* add syscall numbers for the new renameat2 syscallSzabolcs Nagy2014-07-207-0/+19
| | | | | it's like rename but with flags eg. to allow atomic exchange of two files, introduced in linux 3.15 commit 520c8b16505236fc82daa352e6c5e73cd9870cff
* fix regression that negated some mips syscall error returnsRich Felker2014-07-201-5/+5
| | | | | | | | due to what was essentially a copy and paste error, the changes made in commit f61be1f875a2758509d6e9e2cf6f1d9603b28b65 caused syscalls with 5 or 6 arguments (and syscalls with 2, 3, or 4 arguments when compiled with clang compatibility) to negate the returned error code a second time, breaking errno reporting.
* fix mips struct stat dev_t members for big endianRich Felker2014-07-191-20/+81
| | | | | | | | | | | | | | | | | | | | | | the mips version of this structure on the kernel side wrongly has 32-bit type rather than 64-bit type. fortunately there is adjacent padding to bring it up to 64 bits, and on little-endian, this allows us to treat the adjacent kernel st_dev and st_pad0[0] as as single 64-bit dev_t. however, on big endian, such treatment results in the upper and lower 32-bit parts of the dev_t value being swapped. for the purpose of just comparing st_dev values this did not break anything, but it precluded actually processing the device numbers as major/minor values. since the broken kernel behavior that needs to be worked around is isolated to one arch, I put the workarounds in syscall_arch.h rather than adding a stat fixup path in the common code. on little endian mips, the added code optimizes out completely. the changes necessary were incompatible with the way the __asm_syscall macro was factored so I just removed it and flattened the individual __syscallN functions. this arguably makes the code easier to read and understand, anyway.
* add issetugid function to check for elevated privilegeBrent Cook2014-07-192-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | this function provides a way for third-party library code to use the same logic that's used internally in libc for suppressing untrusted input/state (e.g. the environment) when the application is running with privleges elevated by the setuid or setgid bit or some other mechanism. its semantics are intended to match the openbsd function by the same name. there was some question as to whether this function is necessary: getauxval(AT_SECURE) was proposed as an alternative. however, this has several drawbacks. the most obvious is that it asks programmers to be aware of an implementation detail of ELF-based systems (the aux vector) rather than simply the semantic predicate to be checked. and trying to write a safe, reliable version of issetugid in terms of getauxval is difficult. for example, early versions of the glibc getauxval did not report ENOENT, which could lead to false negatives if AT_SECURE was not present in the aux vector (this could probably only happen when running on non-linux kernels under linux emulation, since glibc does not support linux versions old enough to lack AT_SECURE). as for musl, getauxval has always properly reported errors, but prior to commit 7bece9c2095ee81f14b1088f6b0ba2f37fecb283, the musl implementation did not emulate AT_SECURE if missing, which would result in a false positive. since musl actually does partially support kernels that lack AT_SECURE, this was problematic. the intent is that library authors will use issetugid if its availability is detected at build time, and only fall back to the unreliable alternatives on systems that lack it. patch by Brent Cook. commit message/rationale by Rich Felker.
* fix or1k atomic storeRich Felker2014-07-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | at the very least, a compiler barrier is required no matter what, and that was missing. current or1k implementations have strong ordering, but this is not guaranteed as part of the ISA, so some sort of synchronizing operation is necessary. in principle we should use l.msync, but due to misinterpretation of the spec, it was wrongly treated as an optional instruction and is not supported by some implementations. if future kernels trap it and treat it as a nop (rather than illegal instruction) when the hardware/emulator does not support it, we could consider using it. in the absence of l.msync support, the l.lwa/l.swa instructions, which are specified to have a built-in l.msync, need to be used. the easiest way to use them to implement atomic store is to perform an atomic swap and throw away the result. using compare-and-swap would be lighter, and would probably be sufficient for all actual usage cases, but checking this is difficult and error-prone: with store implemented in terms of swap, it's guaranteed that, when another atomic operation is performed at the same time as the store, either the result of the store followed by the other operation, or just the store (clobbering the other operation's result) is seen. if store were implemented in terms of cas, there are cases where this invariant would fail to hold, and we would need detailed rules for the situations in which the store operation is well-defined.
* fix missing barriers in powerpc atomic storeRich Felker2014-07-191-1/+5
|
* fix microblaze atomic storeRich Felker2014-07-191-1/+3
| | | | | | | | | | | | | | | | as far as I can tell, microblaze is strongly ordered, but this does not seem to be well-documented and the assumption may need revisiting. even with strong ordering, however, a volatile C assignment is not sufficient to implement atomic store, since it does not preclude reordering by the compiler with respect to non-volatile stores and loads. simply flanking a C store with empty volatile asm blocks with memory clobbers would achieve the desired result, but is likely to result in worse code generation, since the address and value for the store may need to be spilled. actually writing the store in asm, so that there's only one asm block, should give optimal code generation while satisfying the requirement for having a compiler barrier.
* fix missing barrier instructions in powerpc atomic asmRich Felker2014-07-191-1/+4
|
* fix missing barrier instructions in mips atomic asmRich Felker2014-07-191-14/+18
| | | | | | | | previously I had wrongly assumed the ll/sc instructions also provided memory synchronization; apparently they do not. this commit adds sync instructions before and after each atomic operation and changes the atomic store to simply use sync before and after a plain store, rather than a useless compare-and-swap.
* use memory constraints for mips atomic asmRich Felker2014-07-191-24/+24
| | | | | | | | | | | | | | | | despite lacking the semantic content that the asm accesses the pointed-to object rather than just using its address as a value, the mips asm was not actually broken. the asm blocks were declared volatile, meaning that the compiler must treat them as having unknown side effects. however changing the asm to use memory constraints is desirable not just from a semantic correctness and consistency standpoint, but also produces better code. the compiler is able to use base/offset addressing expressions for the atomic object's address rather than having to load the address into a single register. this improves access to global locks in static libc, and access to non-zero-offset atomic fields in synchronization primitives, etc.
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-11-08 20:36:36 +0000