Commit Graph

1738 Commits

Author SHA1 Message Date
Rich Felker
cf3fd3d002 TLS fixes, mainly alignment handling
compute offsets from the thread pointer statically when loading the
library, rather than repeating the logic on each thread creation. not
only is the latter less efficient at runtime; it also fails to provide
solid guarantees that the offsets will remain the same when the
initial alignment of memory is different. the new alignment handling
is both more rigorous and simpler.

the old code was also clobbering TLS bss with random image data in
some cases due to using tls_size (size of TLS segment) instead of
tls_len (length of the TLS data image).
2012-10-06 01:22:51 -04:00
Rich Felker
f4f77c068f fix/improve shared library ctor/dtor handling, allow recursive dlopen
some libraries call dlopen from their constructors, resulting in
recursive calls to dlopen. previously, this resulted in deadlock. I'm
now unlocking the dlopen lock before running constructors (this is
especially important since the lock also blocked pthread_create and
was being held while application code runs!) and using a separate
recursive mutex protecting the ctor/dtor state instead.

in order to prevent the same ctor from being called more than once, a
module is considered "constructed" just before the ctor runs.

also, switch from using atexit to register each dtor to using a single
atexit call to register the dynamic linker's dtor processing as just
one handler. this is necessary because atexit performs allocation and
may fail, but the library has already been loaded and cannot be
backed-out at the time dtor registration is performed. this change
also ensures that all dtors run after all atexit functions, rather
than in mixed order.
2012-10-05 13:09:09 -04:00
Rich Felker
5f88c0edd5 small dynamic linker module search fix
libraries loaded more than once by pathname should not get shortnames
that would cause them to later be used to satisfy non-pathname load
requests.
2012-10-05 12:09:54 -04:00
Rich Felker
dcd6037150 support for TLS in dynamic-loaded (dlopen) modules
unlike other implementations, this one reserves memory for new TLS in
all pre-existing threads at dlopen-time, and dlopen will fail with no
resources consumed and no new libraries loaded if memory is not
available. memory is not immediately distributed to running threads;
that would be too complex and too costly. instead, assurances are made
that threads needing the new TLS can obtain it in an async-signal-safe
way from a buffer belonging to the dynamic linker/new module (via
atomic fetch-and-add based allocator).

I've re-appropriated the lock that was previously used for __synccall
(synchronizing set*id() syscalls between threads) as a general
pthread_create lock. it's a "backwards" rwlock where the "read"
operation is safe atomic modification of the live thread count, which
multiple threads can perform at the same time, and the "write"
operation is making sure the count does not increase during an
operation that depends on it remaining bounded (__synccall or dlopen).
in static-linked programs that don't use __synccall, this lock is a
no-op and has no cost.
2012-10-05 11:51:50 -04:00
Rich Felker
642b7593c3 fix race condition in dlopen
orig_tail was being saved before the lock was obtained, allowing
dlopen failure to roll-back other dlopens that had succeeded.
2012-10-05 01:15:25 -04:00
Rich Felker
99a2af6f45 fix incorrect TLS reloc macro names in x86_64 reloc.h 2012-10-05 01:00:40 -04:00
Rich Felker
9c74856af7 dynamic-linked TLS support for everything but dlopen'd libs
currently, only i386 is tested. x86_64 and arm should probably work.
the necessary relocation types for mips and microblaze have not been
added because I don't understand how they're supposed to work, and I'm
not even sure if it's defined yet on microblaze. I may be able to
reverse engineer the requirements out of gcc/binutils output.
2012-10-04 22:48:33 -04:00
Rich Felker
c91aa03d24 remove freeing of dynamic linker data when dlopen/dlsym are not used
this was an optimization to save/recover a minimal amount of extra
memory for use by malloc, that's becoming increasingly costly to keep
around. freeing this data:

1. breaks debugging with gdb (it can't find library symbols)
2. breaks thread-local storage in shared libraries

it would be possible to disable freeing when TLS is used, but in
addition to the above breakages, tracking whether dlopen/dlsym is used
adds a cost to every symbol lookup, possibly making program startup
slower for large programs. combined with the complexity, it's not
worth it. we already save/recover plenty of memory in the dynamic
linker with reclaim_gaps.
2012-10-04 21:08:53 -04:00
Rich Felker
9b153c043e beginnings of full TLS support in shared libraries
this code will not work yet because the necessary relocations are not
supported, and cannot be supported without some internal changes to
how relocation processing works (coming soon).
2012-10-04 21:01:56 -04:00
Rich Felker
bc6a35fb7b partial TLS support for dynamic-linked programs
only TLS in the main program is supported so far; TLS defined in
shared libraries will not work yet.
2012-10-04 20:04:13 -04:00
Rich Felker
8431d7972f TLS (GNU/C11 thread-local storage) support for static-linked programs
the design for TLS in dynamic-linked programs is mostly complete too,
but I have not yet implemented it. cost is nonzero but still low for
programs which do not use TLS and/or do not use threads (a few hundred
bytes of new code, plus dependency on memcpy). i believe it can be
made smaller at some point by merging __init_tls and __init_security
into __libc_start_main and avoiding duplicate auxv-parsing code.

at the same time, I've also slightly changed the logic pthread_create
uses to allocate guard pages to ensure that guard pages are not
counted towards commit charge.
2012-10-04 16:35:46 -04:00
Rich Felker
adefe830dd tell the assembler to mark all files as not requiring executable stack
for some reason this option is undocumented. not sure when it was
added, so I'm using a configure test. gcc was already setting the mark
correctly for C files, but assembler source files would need ugly
.note boilerplate in every single file to achieve this without the
option to the assembler.

blame whoever thought it would be a good idea to make the stack
executable by default rather than doing it the other way around...
2012-10-03 11:49:58 -04:00
Rich Felker
030e526392 add getopt reset support
based on proposed patches by Daniel Cegiełka, with minor changes:
- use a weak symbol for optreset so it doesn't clash with namespace
- also reset optpos (position in multi-option arg like -lR)
- also make getopt_long support reset
2012-09-30 20:00:38 -04:00
Rich Felker
e44849f5cf protect sem_open against cancellation
also fix one minor bug: failure to free the early-reserved slot when
the semaphore later found to already be mapped.
2012-09-30 19:44:45 -04:00
Rich Felker
bf258341b7 overhaul sem_open
this function was overly complicated and not even obviously correct.
avoid using openat/linkat just like in shm_open, and instead expand
pathname using code shared with shm_open. remove bogus (and dangerous,
with priorities) use of spinlocks.

this commit also heavily streamlines the code and ensures there are no
failure cases that can happen after a new semaphore has been created
in the filesystem, since that case is unreportable.
2012-09-30 19:35:40 -04:00
Rich Felker
6e2372a86c clean up, bugfixes, and general improvement for shm_open/shm_unlink
1. don't make non-cloexec file descriptors
2. cancellation safety (cleanup handlers were missing, now unneeded)
3. share name validation/mapping code between open/unlink functions
4. avoid wasteful/slow syscalls
2012-09-30 17:53:54 -04:00
Rich Felker
2e3648b85d define some _POSIX_* macros that were omitted; required for XSI conformance 2012-09-30 01:52:17 -04:00
Rich Felker
d712dd396d more close-on-exec fixes, mostly using new "e" flag to fopen 2012-09-29 18:14:46 -04:00
Rich Felker
8582a6e9f2 add 'e' modifier (close-on-exec) to fopen and fdopen
this feature will be in the next version of POSIX, and can be used
internally immediately. there are many internal uses of fopen where
close-on-exec is needed to fix bugs.
2012-09-29 18:09:34 -04:00
Rich Felker
f2d08cf755 fix some more O_CLOEXEC/SOCK_CLOEXEC issues 2012-09-29 17:59:50 -04:00
Rich Felker
3609e019f3 always expose accept4
it will be in the next version of POSIX
2012-09-29 17:44:33 -04:00
Rich Felker
9735d50070 always expose dup3 and pipe2
they will be in the next version of POSIX
2012-09-29 17:42:21 -04:00
Rich Felker
dc62790dee move accept4, dup3, and pipe2 to non-linux-specific locations
these interfaces have been adopted by the Austin Group for inclusion
in the next version of POSIX.
2012-09-29 17:40:42 -04:00
Rich Felker
79a5e73e51 emulate SOCK_CLOEXEC and SOCK_NONBLOCK for old (pre-2.6.27) kernels
also update syslog to use SOCK_CLOEXEC rather than separate fcntl
step, to make it safe in multithreaded programs that run external
programs.

emulation is not atomic; it could be made atomic by holding a lock on
forking during the operation, but this seems like overkill. my goal is
not to achieve perfect behavior on old kernels (which have plenty of
other imperfect behavior already) but to avoid catastrophic breakage
in (1) syslog, which would give no output on old kernels with the
change to use SOCK_CLOEXEC, and (2) programs built on a new kernel
where configure scripts detected a working SOCK_CLOEXEC, which later
get run on older kernels (they may otherwise fail to work completely).
2012-09-29 17:36:27 -04:00
Rich Felker
3d8d90c5cc sem_open should make process-shared semaphores
this did not matter because we don't yet treat process-shared special.
when private futex support is added, however, it will matter.
2012-09-29 16:49:32 -04:00
Rich Felker
39f296a95b use O_CLOEXEC to open semaphore files in sem_open 2012-09-29 16:48:52 -04:00
Rich Felker
c983e6415a fix some indention-with-spaces that crept in 2012-09-29 01:14:07 -04:00
Rich Felker
8c0a3d9e5c microblaze port
based on initial work by rdp, with heavy modifications. some features
including threads are untested because qemu app-level emulation seems
to be broken and I do not have a proper system image for testing.
2012-09-29 01:05:31 -04:00
Rich Felker
e0ea44cb76 fix arm clone syscall bug (no effect unless app uses clone)
the code to exit the new thread/process after the start function
returns was mixed up in its syscall convention.
2012-09-27 18:56:10 -04:00
Rich Felker
68dbd05039 optimize strchrnul/strcspn not to scan string twice on no-match
when strchr fails, and important piece of information already
computed, the string length, is thrown away. have strchrnul (with
namespace protection) be the underlying function so this information
can be kept, and let strchr be a wrapper for it. this also allows
strcspn to be considerably faster in the case where the match set has
a single element that's not matched.
2012-09-27 17:19:09 -04:00
Rich Felker
3f9ff1514e slightly cleaner strlen, also seems to compile to better code
testing with gcc 4.6.3 on x86, -Os, the old version does a duplicate
null byte check after the first loop. this is purely the compiler
being stupid, but the old code was also stupid and unintuitive in how
it expressed the check.
2012-09-27 16:56:33 -04:00
Rich Felker
507faa63cb fix dirname to handle input of form "foo/" correctly
also optimized a bit.
2012-09-26 00:56:07 -04:00
Rich Felker
82dc1e2e78 fix handling of EINTR during close()
austin group interpretation for defect 
(http://austingroupbugs.net/view.php?id=529) tightens the
requirements on close such that, if it returns with EINTR, the file
descriptor must not be closed. the linux kernel developers vehemently
disagree with this, and will not change it. we catch and remap EINTR
to EINPROGRESS, which the standard allows close() to return when the
operation was not finished but the file descriptor has been closed.
2012-09-24 22:39:08 -04:00
Rich Felker
4b49060da0 fix getaddrinfo to accept port 0 (zero)
new behavior can be summarized as:
inputs that parse completely as a decimal number are treated as one,
and rejected only if the result is out of 16-bit range.
inputs that do not parse as a decimal number (where strtoul leaves
anything left over in the input) are searched in /etc/services.
2012-09-22 16:19:06 -04:00
Rich Felker
15d1112032 fix remaining IPC_64 issue (shmctl)
also cleanup cruft related to the issue
2012-09-22 16:08:58 -04:00
Rich Felker
cccc13221d fix IPC_64 in msgctl too 2012-09-22 08:04:17 -04:00
Rich Felker
fce46bf980 fix broken semctl on systems that don't use IPC_64 flag
not tested on mips and arm; they may still be broken. x86_64 should be
ok now.
2012-09-22 08:02:42 -04:00
Rich Felker
0b3e2257fa offer REALGCC variable to configure musl-gcc wrapper at runtime
this is useful when the underlying gcc is already a wrapper, which is
the case at least on some uclibc-based system images. it's also useful
for running an older/newer/nondefault version of gcc.
2012-09-21 13:47:26 -04:00
Rich Felker
f600105eef LFS64 alias for prlimit
issue reported/requested by Justin Cormack
2012-09-21 04:05:01 -04:00
Rich Felker
662da62eb7 add clock_adjtime, remap_file_pages, and syncfs syscall wrappers
patch by Justin Cormack, with slight modification
2012-09-16 22:26:23 -04:00
Rich Felker
bd261bf25e release notes for 0.9.6 2012-09-16 00:10:08 -04:00
Rich Felker
6d05d86297 add O_EXEC open mode
the linux O_PATH mode provides the necessary semantics for both the
O_SEARCH and O_EXEC modes defined and required by POSIX 2008.
2012-09-15 23:45:41 -04:00
Rich Felker
93ea998c9c add crypt_md5 password hash
contributed by nsz
2012-09-15 23:41:07 -04:00
Rich Felker
5a1abeeb7c fix stupid bug in updating of O_ACCMODE for O_SEARCH support
this could cause major bugs, and warrants a fix release right away.
2012-09-15 23:17:00 -04:00
Rich Felker
7ad42b9496 0.9.5 release notes 2012-09-15 03:38:20 -04:00
Rich Felker
075fdb909b fix syscall asm constraints for arm too
no problems were detected so far, but the constraints seem to have
been invalid just like the mips ones.
2012-09-15 03:19:41 -04:00
Rich Felker
aeaceb1fa8 revert low rounds-count limits in crypt hashes
it was determined in discussion that these kind of limits are not
sufficient to protect single-threaded servers against denial of
service attacks from maliciously large round counts. the time scales
simply vary too much; many users will want login passwords with rounds
counts on a scale that gives decisecond latency, while highly loaded
webservers will need millisecond latency or shorter.

still some limit is left in place; the idea is not to protect against
attacks, but to avoid the runtime of a single call to crypt being, for
all practical purposes, infinite, so that configuration errors can be
caught and fixed without bringing down whole systems. these limits are
very high, on the order of minute-long runtimes for modest systems.
2012-09-15 03:03:21 -04:00
Rich Felker
881868382a update mips cancellation-point syscall asm with 7-arg and r25 fixes
these fixes were already made to the normal syscall asm but not the
cancellation point version.
2012-09-15 02:24:12 -04:00
Rich Felker
4221f154ff fix buggy constraints in mips inline syscall asm
if same register is used for input/output, the compiler must be told.
otherwise is generates random junk code that clobbers the result. in
pure syscall-wrapper functions, nothing went wrong, but in more
complex functions where register allocation is non-trivial, things
broke badly.
2012-09-15 02:22:10 -04:00
Rich Felker
afd209deb7 workaround gcc got-register-reload performance problems in malloc
with this patch, the malloc in libc.so built with -Os is nearly the
same speed as the one built with -O3. thus it solves the performance
regression that resulted from removing the forced -O3 when building
libc.so; now libc.so can be both small and fast.
2012-09-14 23:52:51 -04:00