about summary refs log tree commit diff
path: root/src/thread/pthread_create.c
Commit message (Collapse)AuthorAgeFilesLines
* add pthread_attr_setstack interface (and get)Rich Felker2012-06-091-9/+13
| | | | | | | | | | | | | i originally omitted these (optional, per POSIX) interfaces because i considered them backwards implementation details. however, someone later brought to my attention a fairly legitimate use case: allocating thread stacks in memory that's setup for sharing and/or fast transfer between CPU and GPU so that the thread can move data to a GPU directly from automatic-storage buffers without having to go through additional buffer copies. perhaps there are other situations in which these interfaces are useful too.
* remove no-longer-needed unblocking of signals in pthread_createRich Felker2012-06-021-1/+0
| | | | | | | this action is now performed in pthread_self initialization; it must be performed there in case the first call to pthread_create is from a signal handler, in which case the old signal mask could be restored on return from the signal.
* simplify cancellation push/pop slightlyRich Felker2012-05-231-2/+2
| | | | | no need to pass unnecessary extra arguments on to the core code in pthread_create.c. this just wastes cycles and code bloat.
* make pthread stacks non-executableRich Felker2012-05-041-1/+1
| | | | | | | | | | | | | this change is necessary or pthread_create will always fail on security-hardened kernels. i considered first trying to make the stack executable and simply retrying without execute permissions when the first try fails, but (1) this would incur a serious performance penalty on hardened systems, and (2) having the stack be executable is just a bad idea from a security standpoint. if there is real-world "GNU C" code that uses nested functions with threads, and it can't be fixed, we'll have to consider other ways of solving the problem, but for now this seems like the best fix.
* overhaul SSP support to use a real canaryRich Felker2012-05-031-0/+1
| | | | | | | | | | | | | pthread structure has been adjusted to match the glibc/GCC abi for where the canary is stored on i386 and x86_64. it will need variants for other archs to provide the added security of the canary's entropy, but even without that it still works as well as the old "minimal" ssp support. eventually such changes will be made anyway, since they are also needed for GCC/C11 thread-local storage support (not yet implemented). care is taken not to attempt initializing the thread pointer unless the program actually uses SSP (by reference to __stack_chk_fail).
* fix pthread_cleanup_pop(1) crash in non-thread-capable, static-linked programsRich Felker2012-02-281-2/+0
|
* small fix for new pthread cleanup stuffRich Felker2012-02-091-1/+0
| | | | | | | even if pthread_create/exit code is not linked, run flag needs to be checked and cleanup function potentially run on pop. thus, move the code to the module that's always linked when pthread_cleanup_push/pop is used.
* replace bad cancellation cleanup abi with a sane oneRich Felker2012-02-091-16/+14
| | | | | | | | | | | | | | | | | | | | | | the old abi was intended to duplicate glibc's abi at the expense of being ugly and slow, but it turns out glib was not even using that abi except on non-gcc-compatible compilers (which it doesn't even support) and was instead using an exceptions-in-c/unwind-based approach whose abi we could not duplicate anyway without nasty dwarf2/unwind integration. the new abi is copied from a very old glibc abi, which seems to still be supported/present in current glibc. it avoids all unwinding, whether by sjlj or exceptions, and merely maintains a linked list of cleanup functions to be called from the context of pthread_exit. i've made some care to ensure that longjmp out of a cleanup function should work, even though it is not required to. this change breaks abi compatibility with programs which were using pthread cancellation, which is unfortunate, but that's why i'm making the change now rather than later. considering that most pthread features have not been usable until recently anyway, i don't see it as a major issue at this point.
* fix incorrect allocation failure check in pthread_createRich Felker2011-09-271-1/+1
| | | | | mmap returns MAP_FAILED not 0 because some idiot thought the ability to mmap the null pointer page would be a good idea...
* overhaul clone syscall wrappingRich Felker2011-09-181-5/+5
| | | | | | | | | | | | | | | | | | | | several things are changed. first, i have removed the old __uniclone function signature and replaced it with the "standard" linux __clone/clone signature. this was necessary to expose clone to applications anyway, and it makes it easier to port __clone to new archs, since it's now testable independently of pthread_create. secondly, i have removed all references to the ugly ldt descriptor structure (i386 only) from the c code and pthread structure. in places where it is needed, it is now created on the stack just when it's needed, in assembly code. thus, the i386 __clone function takes the desired thread pointer as its argument, rather than an ldt descriptor pointer, just like on all other sane archs. this should not affect applications since there is really no way an application can use clone with threads/tls in a way that doesn't horribly conflict with and clobber the underlying implementation's use. applications are expected to use clone only for creating actual processes, possibly with new namespace features and whatnot.
* pthread and synccall cleanup, new __synccall_wait opRich Felker2011-08-121-5/+1
| | | | | | | | | fix up clone signature to match the actual behavior. the new __syncall_wait function allows a __synccall callback to wait for other threads to continue without returning, so that it can resume action after the caller finishes. this interface could be made significantly more general/powerful with minimal effort, but i'll wait to do that until it's actually useful for something.
* further debloat cancellation handlersRich Felker2011-08-031-0/+13
| | | | | | | cleanup push and pop are also no-ops if pthread_exit is not reachable. this can make a big difference for library code which needs to protect itself against cancellation, but which is unlikely to actually be used in programs with threads/cancellation.
* missed detail in cancellation bloat fixRich Felker2011-08-031-1/+1
|
* fix static linking dependency bloat with cancellationRich Felker2011-08-031-6/+1
| | | | | | | previously, pthread_cleanup_push/pop were pulling in all of pthread_create due to dependency on the __pthread_unwind_next function. this was not needed, as cancellation cleanup handlers can never be called unless pthread_exit or pthread_cancel is reachable.
* add proper fuxed-based locking for stdioRich Felker2011-07-301-0/+16
| | | | | | | | | | | | | | | | | | | | | | previously, stdio used spinlocks, which would be unacceptable if we ever add support for thread priorities, and which yielded pathologically bad performance if an application attempted to use flockfile on a key file as a major/primary locking mechanism. i had held off on making this change for fear that it would hurt performance in the non-threaded case, but actually support for recursive locking had already inflicted that cost. by having the internal locking functions store a flag indicating whether they need to perform unlocking, rather than using the actual recursive lock counter, i was able to combine the conditionals at unlock time, eliminating any additional cost, and also avoid a nasty corner case where a huge number of calls to ftrylockfile could cause deadlock later at the point of internal locking. this commit also fixes some issues with usage of pthread_self conflicting with __attribute__((const)) which resulted in crashes with some compiler versions/optimizations, mainly in flockfile prior to pthread_create.
* new attempt at making set*id() safe and robustRich Felker2011-07-291-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | changing credentials in a multi-threaded program is extremely difficult on linux because it requires synchronizing the change between all threads, which have their own thread-local credentials on the kernel side. this is further complicated by the fact that changing the real uid can fail due to exceeding RLIMIT_NPROC, making it possible that the syscall will succeed in some threads but fail in others. the old __rsyscall approach being replaced was robust in that it would report failure if any one thread failed, but in this case, the program would be left in an inconsistent state where individual threads might have different uid. (this was not as bad as glibc, which would sometimes even fail to report the failure entirely!) the new approach being committed refuses to change real user id when it cannot temporarily set the rlimit to infinity. this is completely POSIX conformant since POSIX does not require an implementation to allow real-user-id changes for non-privileged processes whatsoever. still, setting the real uid can fail due to memory allocation in the kernel, but this can only happen if there is not already a cached object for the target user. thus, we forcibly serialize the syscalls attempts, and fail the entire operation on the first failure. this *should* lead to an all-or-nothing success/failure result, but it's still fragile and highly dependent on kernel developers not breaking things worse than they're already broken. ideally linux will eventually add a CLONE_USERCRED flag that would give POSIX conformant credential changes without any hacks from userspace, and all of this code would become redundant and could be removed ~10 years down the line when everyone has abandoned the old broken kernels. i'm not holding my breath...
* fix race condition in pthread_killRich Felker2011-06-141-0/+2
| | | | | | | | | | | | | | if thread id was reused by the kernel between the time pthread_kill read it from the userspace pthread_t object and the time of the tgkill syscall, a signal could be sent to the wrong thread. the tgkill syscall was supposed to prevent this race (versus the old tkill syscall) but it can't; it can only help in the case where the tid is reused in a different process, but not when the tid is reused in the same process. the only solution i can see is an extra lock to prevent threads from exiting while another thread is trying to pthread_kill them. it should be very very cheap in the non-contended case.
* run dtors before taking the exit-lock in pthread exitRich Felker2011-06-141-2/+2
| | | | previously a long-running dtor could cause pthread_detach to block.
* minor locking optimizationsRich Felker2011-06-141-1/+1
|
* optimize out useless default-attribute object in pthread_createRich Felker2011-05-071-7/+7
|
* optimize compound-literal sigset_t's not to contain useless hurd bitsRich Felker2011-05-071-2/+2
|
* overhaul implementation-internal signal protectionsRich Felker2011-05-071-12/+4
| | | | | | | | | | | | | | | | | | | the new approach relies on the fact that the only ways to create sigset_t objects without invoking UB are to use the sig*set() functions, or from the masks returned by sigprocmask, sigaction, etc. or in the ucontext_t argument to a signal handler. thus, as long as sigfillset and sigaddset avoid adding the "protected" signals, there is no way the application will ever obtain a sigset_t including these bits, and thus no need to add the overhead of checking/clearing them when sigprocmask or sigaction is called. note that the old code actually *failed* to remove the bits from sa_mask when sigaction was called. the new implementations are also significantly smaller, simpler, and faster due to ignoring the useless "GNU HURD signals" 65-1024, which are not used and, if there's any sanity in the world, never will be used.
* move some more code out of pthread_create.cRich Felker2011-04-191-6/+2
| | | | this also de-uglifies the dummy function aliasing a bit.
* pthread_exit is not supposed to affect cancellabilityRich Felker2011-04-171-2/+0
| | | | | if the exit was caused by cancellation, __cancel has already set these flags anyway.
* fix pthread_exit from cancellation handlerRich Felker2011-04-171-5/+5
| | | | | cancellation frames were not correctly popped, so this usage would not only loop, but also reuse discarded and invalid parts of the stack.
* clean up handling of thread/nothread mode, lockingRich Felker2011-04-171-14/+8
|
* overhaul pthread cancellationRich Felker2011-04-171-35/+13
| | | | | | | | | | | | | | | | | | | | | | this patch improves the correctness, simplicity, and size of cancellation-related code. modulo any small errors, it should now be completely conformant, safe, and resource-leak free. the notion of entering and exiting cancellation-point context has been completely eliminated and replaced with alternative syscall assembly code for cancellable syscalls. the assembly is responsible for setting up execution context information (stack pointer and address of the syscall instruction) which the cancellation signal handler can use to determine whether the interrupted code was in a cancellable state. these changes eliminate race conditions in the previous generation of cancellation handling code (whereby a cancellation request received just prior to the syscall would not be processed, leaving the syscall to block, potentially indefinitely), and remedy an issue where non-cancellable syscalls made from signal handlers became cancellable if the signal handler interrupted a cancellation point. x86_64 asm is untested and may need a second try to get it right.
* use a separate signal from SIGCANCEL for SIGEV_THREAD timersRich Felker2011-04-141-2/+0
| | | | | | otherwise we cannot support an application's desire to use asynchronous cancellation within the callback function. this change also slightly debloats pthread_create.c.
* simplify cancellation point handlingRich Felker2011-04-131-13/+2
| | | | | | we take advantage of the fact that unless self->cancelpt is 1, cancellation cannot happen. so just increment it by 2 to temporarily block cancellation. this drops pthread_create.o well under 1k.
* consistency: change all remaining syscalls to use SYS_ rather than __NR_ prefixRich Felker2011-04-061-1/+1
|
* move rsyscall out of pthread_create moduleRich Felker2011-04-061-96/+9
| | | | | | | | | | | | | | this is something of a tradeoff, as now set*id() functions, rather than pthread_create, are what pull in the code overhead for dealing with linux's refusal to implement proper POSIX thread-vs-process semantics. my motivations are: 1. it's cleaner this way, especially cleaner to optimize out the rsyscall locking overhead from pthread_create when it's not needed. 2. it's expected that only a tiny number of core system programs will ever use set*id() functions, whereas many programs may want to use threads, and making thread overhead tiny is an incentive for "light" programs to try threads.
* pthread exit stuff: don't bother setting errno when we won't check it.Rich Felker2011-04-061-2/+2
|
* fix rsyscall handler: must not clobber errno from signal contextRich Felker2011-04-061-2/+4
|
* new framework to inhibit thread cancellation when neededRich Felker2011-04-051-3/+13
| | | | | | | with these small changes, libc functions which need to call functions which are cancellation points, but which themselves must not be cancellation points, can use the CANCELPT_INHIBIT and CANCELPT_RESUME macros to temporarily inhibit all cancellation.
* pthread_create need not set errnoRich Felker2011-04-031-1/+1
|
* block all signals during rsyscallRich Felker2011-04-031-4/+9
| | | | | otherwise a signal handler could see an inconsistent and nonconformant program state where different threads have different uids/gids.
* fix race condition in rsyscall handlerRich Felker2011-04-031-1/+1
| | | | | | | | | | | | | | | | | | the problem: there is a (single-instruction) race condition window between a thread flagging itself dead and decrementing itself from the thread count. if it receives the rsyscall signal at this exact moment, the rsyscall caller will never succeed in signalling enough flags to succeed, and will deadlock forever. in previous versions of musl, the about-to-terminate thread masked all signals prior to decrementing the thread count, but this cost a whole syscall just to account for extremely rare races. the solution is a huge hack: rather than blocking in the signal handler if the thread is dead, modify the signal mask of the saved context and return in order to prevent further signal handling by the dead thread. this allows the dead thread to continue decrementing the thread count (if it had not yet done so) and exiting, even while the live part of the program blocks for rsyscall.
* don't trust siginfo in rsyscall handlerRich Felker2011-04-031-3/+2
| | | | | | | | for some inexplicable reason, linux allows the sender of realtime signals to spoof its identity. permission checks for sending signals should limit the impact to same-user processes, but just to be safe, we avoid trusting the siginfo structure and instead simply examine the program state to see if we're in the middle of a legitimate rsyscall.
* simplify calling of timer signal handlerRich Felker2011-04-031-7/+4
|
* omit pthread tsd dtor code if tsd is not usedRich Felker2011-04-031-13/+6
|
* simplify setting result on thread cancellationRich Felker2011-04-011-1/+1
|
* fix misspelled PTHREAD_CANCELED constantRich Felker2011-04-011-1/+1
|
* major improvements to cancellation handlingRich Felker2011-03-291-6/+12
| | | | | | | | | | | | | - there is no longer any risk of spoofing cancellation requests, since the cancel flag is set in pthread_cancel rather than in the signal handler. - cancellation signal is no longer unblocked when running the cancellation handlers. instead, pthread_create will cause any new threads created from a cancellation handler to unblock their own cancellation signal. - various tweaks in preparation for POSIX timer support.
* match glibc/lsb cancellation abi on i386Rich Felker2011-03-251-0/+5
| | | | | | | | glibc made the ridiculous choice to use pass-by-register calling convention for these functions, which is impossible to duplicate directly on non-gcc compilers. instead, we use ugly asm to wrap and convert the calling convention. presumably this works with every compiler anyone could potentially want to use.
* overhaul cancellation to fix resource leaks and dangerous behavior with signalsRich Felker2011-03-241-5/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | this commit addresses two issues: 1. a race condition, whereby a cancellation request occurring after a syscall returned from kernelspace but before the subsequent CANCELPT_END would cause cancellable resource-allocating syscalls (like open) to leak resources. 2. signal handlers invoked while the thread was blocked at a cancellation point behaved as if asynchronous cancellation mode wer in effect, resulting in potentially dangerous state corruption if a cancellation request occurs. the glibc/nptl implementation of threads shares both of these issues. with this commit, both are fixed. however, cancellation points encountered in a signal handler will not be acted upon if the signal was received while the thread was already at a cancellation point. they will of course be acted upon after the signal handler returns, so in real-world usage where signal handlers quickly return, it should not be a problem. it's possible to solve this problem too by having sigaction() wrap all signal handlers with a function that uses a pthread_cleanup handler to catch cancellation, patch up the saved context, and return into the cancellable function that will catch and act upon the cancellation. however that would be a lot of complexity for minimal if any benefit...
* global cleanup to use the new syscall interfaceRich Felker2011-03-201-1/+1
|
* syscall overhaul part two - unify public and internal syscall interfaceRich Felker2011-03-191-3/+3
| | | | | | | | | | | | | | | | with this patch, the syscallN() functions are no longer needed; a variadic syscall() macro allows syscalls with anywhere from 0 to 6 arguments to be made with a single macro name. also, manually casting each non-integer argument with (long) is no longer necessary; the casts are hidden in the macros. some source files which depended on being able to define the old macro SYSCALL_RETURNS_ERRNO have been modified to directly use __syscall() instead of syscall(). references to SYSCALL_SIGSET_SIZE and SYSCALL_LL have also been changed. x86_64 has not been tested, and may need a follow-up commit to fix any minor bugs/oversights.
* overhaul syscall interfaceRich Felker2011-03-191-2/+2
| | | | | | | | | | | | | | | this commit shuffles around the location of syscall definitions so that we can make a syscall() library function with both SYS_* and __NR_* style syscall names available to user applications, provides the syscall() library function, and optimizes the code that performs the actual inline syscalls in the library itself. previously on i386 when built as PIC (shared library), syscalls were incurring bus lock (lock prefix) overhead at entry and exit, due to the way the ebx register was being loaded (xchg instruction with a memory operand). now the xchg takes place between two registers. further cleanup to arch/$(ARCH)/syscall.h is planned.
* cut out a syscall on thread creation in the case where guard size is 0Rich Felker2011-03-161-1/+1
|
* implement flockfile api, rework stdio lockingRich Felker2011-03-121-0/+1
|