1 /*
2 * Copyright (C) 2008 The Android Open Source Project
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * * Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * * Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in
12 * the documentation and/or other materials provided with the
13 * distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 #include <pthread.h>
30
31 #include <errno.h>
32 #include <string.h>
33 #include <sys/mman.h>
34 #include <unistd.h>
35
36 #include "pthread_internal.h"
37
38 #include "private/bionic_macros.h"
39 #include "private/bionic_prctl.h"
40 #include "private/bionic_ssp.h"
41 #include "private/bionic_tls.h"
42 #include "private/libc_logging.h"
43 #include "private/ErrnoRestorer.h"
44
45 // x86 uses segment descriptors rather than a direct pointer to TLS.
46 #if defined(__i386__)
47 #include <asm/ldt.h>
48 void __init_user_desc(struct user_desc*, bool, void*);
49 #endif
50
51 extern "C" int __isthreaded;
52
53 // This code is used both by each new pthread and the code that initializes the main thread.
__init_tls(pthread_internal_t * thread)54 void __init_tls(pthread_internal_t* thread) {
55 // Slot 0 must point to itself. The x86 Linux kernel reads the TLS from %fs:0.
56 thread->tls[TLS_SLOT_SELF] = thread->tls;
57 thread->tls[TLS_SLOT_THREAD_ID] = thread;
58
59 // Add a guard page before and after.
60 size_t allocation_size = BIONIC_TLS_SIZE + 2 * PAGE_SIZE;
61 void* allocation = mmap(nullptr, allocation_size, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
62 if (allocation == MAP_FAILED) {
63 __libc_fatal("failed to allocate TLS");
64 }
65 prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, allocation, allocation_size, "bionic TLS guard page");
66
67 thread->bionic_tls = reinterpret_cast<bionic_tls*>(static_cast<char*>(allocation) + PAGE_SIZE);
68 if (mprotect(thread->bionic_tls, BIONIC_TLS_SIZE, PROT_READ | PROT_WRITE) != 0) {
69 __libc_fatal("failed to mprotect TLS");
70 }
71 prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, thread->bionic_tls, BIONIC_TLS_SIZE, "bionic TLS");
72 }
73
__init_thread_stack_guard(pthread_internal_t * thread)74 void __init_thread_stack_guard(pthread_internal_t* thread) {
75 // GCC looks in the TLS for the stack guard on x86, so copy it there from our global.
76 thread->tls[TLS_SLOT_STACK_GUARD] = reinterpret_cast<void*>(__stack_chk_guard);
77 }
78
__init_alternate_signal_stack(pthread_internal_t * thread)79 void __init_alternate_signal_stack(pthread_internal_t* thread) {
80 // Create and set an alternate signal stack.
81 void* stack_base = mmap(NULL, SIGNAL_STACK_SIZE, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
82 if (stack_base != MAP_FAILED) {
83
84 // Create a guard page to catch stack overflows in signal handlers.
85 if (mprotect(stack_base, PAGE_SIZE, PROT_NONE) == -1) {
86 munmap(stack_base, SIGNAL_STACK_SIZE);
87 return;
88 }
89 stack_t ss;
90 ss.ss_sp = reinterpret_cast<uint8_t*>(stack_base) + PAGE_SIZE;
91 ss.ss_size = SIGNAL_STACK_SIZE - PAGE_SIZE;
92 ss.ss_flags = 0;
93 sigaltstack(&ss, NULL);
94 thread->alternate_signal_stack = stack_base;
95
96 // We can only use const static allocated string for mapped region name, as Android kernel
97 // uses the string pointer directly when dumping /proc/pid/maps.
98 prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, ss.ss_sp, ss.ss_size, "thread signal stack");
99 prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, stack_base, PAGE_SIZE, "thread signal stack guard page");
100 }
101 }
102
__init_thread(pthread_internal_t * thread)103 int __init_thread(pthread_internal_t* thread) {
104 int error = 0;
105
106 if (__predict_true((thread->attr.flags & PTHREAD_ATTR_FLAG_DETACHED) == 0)) {
107 atomic_init(&thread->join_state, THREAD_NOT_JOINED);
108 } else {
109 atomic_init(&thread->join_state, THREAD_DETACHED);
110 }
111
112 // Set the scheduling policy/priority of the thread.
113 if (thread->attr.sched_policy != SCHED_NORMAL) {
114 sched_param param;
115 param.sched_priority = thread->attr.sched_priority;
116 if (sched_setscheduler(thread->tid, thread->attr.sched_policy, ¶m) == -1) {
117 #if defined(__LP64__)
118 // For backwards compatibility reasons, we only report failures on 64-bit devices.
119 error = errno;
120 #endif
121 __libc_format_log(ANDROID_LOG_WARN, "libc",
122 "pthread_create sched_setscheduler call failed: %s", strerror(errno));
123 }
124 }
125
126 thread->cleanup_stack = NULL;
127
128 return error;
129 }
130
__create_thread_mapped_space(size_t mmap_size,size_t stack_guard_size)131 static void* __create_thread_mapped_space(size_t mmap_size, size_t stack_guard_size) {
132 // Create a new private anonymous map.
133 int prot = PROT_READ | PROT_WRITE;
134 int flags = MAP_PRIVATE | MAP_ANONYMOUS | MAP_NORESERVE;
135 void* space = mmap(NULL, mmap_size, prot, flags, -1, 0);
136 if (space == MAP_FAILED) {
137 __libc_format_log(ANDROID_LOG_WARN,
138 "libc",
139 "pthread_create failed: couldn't allocate %zu-bytes mapped space: %s",
140 mmap_size, strerror(errno));
141 return NULL;
142 }
143
144 // Stack is at the lower end of mapped space, stack guard region is at the lower end of stack.
145 // Set the stack guard region to PROT_NONE, so we can detect thread stack overflow.
146 if (mprotect(space, stack_guard_size, PROT_NONE) == -1) {
147 __libc_format_log(ANDROID_LOG_WARN, "libc",
148 "pthread_create failed: couldn't mprotect PROT_NONE %zu-byte stack guard region: %s",
149 stack_guard_size, strerror(errno));
150 munmap(space, mmap_size);
151 return NULL;
152 }
153 prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, space, stack_guard_size, "thread stack guard page");
154
155 return space;
156 }
157
__allocate_thread(pthread_attr_t * attr,pthread_internal_t ** threadp,void ** child_stack)158 static int __allocate_thread(pthread_attr_t* attr, pthread_internal_t** threadp, void** child_stack) {
159 size_t mmap_size;
160 uint8_t* stack_top;
161
162 if (attr->stack_base == NULL) {
163 // The caller didn't provide a stack, so allocate one.
164 // Make sure the stack size and guard size are multiples of PAGE_SIZE.
165 mmap_size = BIONIC_ALIGN(attr->stack_size + sizeof(pthread_internal_t), PAGE_SIZE);
166 attr->guard_size = BIONIC_ALIGN(attr->guard_size, PAGE_SIZE);
167 attr->stack_base = __create_thread_mapped_space(mmap_size, attr->guard_size);
168 if (attr->stack_base == NULL) {
169 return EAGAIN;
170 }
171 stack_top = reinterpret_cast<uint8_t*>(attr->stack_base) + mmap_size;
172 } else {
173 // Remember the mmap size is zero and we don't need to free it.
174 mmap_size = 0;
175 stack_top = reinterpret_cast<uint8_t*>(attr->stack_base) + attr->stack_size;
176 }
177
178 // Mapped space(or user allocated stack) is used for:
179 // pthread_internal_t
180 // thread stack (including guard page)
181
182 // To safely access the pthread_internal_t and thread stack, we need to find a 16-byte aligned boundary.
183 stack_top = reinterpret_cast<uint8_t*>(
184 (reinterpret_cast<uintptr_t>(stack_top) - sizeof(pthread_internal_t)) & ~0xf);
185
186 pthread_internal_t* thread = reinterpret_cast<pthread_internal_t*>(stack_top);
187 if (mmap_size == 0) {
188 // If thread was not allocated by mmap(), it may not have been cleared to zero.
189 // So assume the worst and zero it.
190 memset(thread, 0, sizeof(pthread_internal_t));
191 }
192 attr->stack_size = stack_top - reinterpret_cast<uint8_t*>(attr->stack_base);
193
194 thread->mmap_size = mmap_size;
195 thread->attr = *attr;
196 __init_tls(thread);
197 __init_thread_stack_guard(thread);
198
199 *threadp = thread;
200 *child_stack = stack_top;
201 return 0;
202 }
203
__pthread_start(void * arg)204 static int __pthread_start(void* arg) {
205 pthread_internal_t* thread = reinterpret_cast<pthread_internal_t*>(arg);
206
207 // Wait for our creating thread to release us. This lets it have time to
208 // notify gdb about this thread before we start doing anything.
209 // This also provides the memory barrier needed to ensure that all memory
210 // accesses previously made by the creating thread are visible to us.
211 thread->startup_handshake_lock.lock();
212
213 __init_alternate_signal_stack(thread);
214
215 void* result = thread->start_routine(thread->start_routine_arg);
216 pthread_exit(result);
217
218 return 0;
219 }
220
221 // A dummy start routine for pthread_create failures where we've created a thread but aren't
222 // going to run user code on it. We swap out the user's start routine for this and take advantage
223 // of the regular thread teardown to free up resources.
__do_nothing(void *)224 static void* __do_nothing(void*) {
225 return NULL;
226 }
227
pthread_create(pthread_t * thread_out,pthread_attr_t const * attr,void * (* start_routine)(void *),void * arg)228 int pthread_create(pthread_t* thread_out, pthread_attr_t const* attr,
229 void* (*start_routine)(void*), void* arg) {
230 ErrnoRestorer errno_restorer;
231
232 // Inform the rest of the C library that at least one thread was created.
233 __isthreaded = 1;
234
235 pthread_attr_t thread_attr;
236 if (attr == NULL) {
237 pthread_attr_init(&thread_attr);
238 } else {
239 thread_attr = *attr;
240 attr = NULL; // Prevent misuse below.
241 }
242
243 pthread_internal_t* thread = NULL;
244 void* child_stack = NULL;
245 int result = __allocate_thread(&thread_attr, &thread, &child_stack);
246 if (result != 0) {
247 return result;
248 }
249
250 // Create a lock for the thread to wait on once it starts so we can keep
251 // it from doing anything until after we notify the debugger about it
252 //
253 // This also provides the memory barrier we need to ensure that all
254 // memory accesses previously performed by this thread are visible to
255 // the new thread.
256 thread->startup_handshake_lock.init(false);
257 thread->startup_handshake_lock.lock();
258
259 thread->start_routine = start_routine;
260 thread->start_routine_arg = arg;
261
262 thread->set_cached_pid(getpid());
263
264 int flags = CLONE_VM | CLONE_FS | CLONE_FILES | CLONE_SIGHAND | CLONE_THREAD | CLONE_SYSVSEM |
265 CLONE_SETTLS | CLONE_PARENT_SETTID | CLONE_CHILD_CLEARTID;
266 void* tls = reinterpret_cast<void*>(thread->tls);
267 #if defined(__i386__)
268 // On x86 (but not x86-64), CLONE_SETTLS takes a pointer to a struct user_desc rather than
269 // a pointer to the TLS itself.
270 user_desc tls_descriptor;
271 __init_user_desc(&tls_descriptor, false, tls);
272 tls = &tls_descriptor;
273 #endif
274 int rc = clone(__pthread_start, child_stack, flags, thread, &(thread->tid), tls, &(thread->tid));
275 if (rc == -1) {
276 int clone_errno = errno;
277 // We don't have to unlock the mutex at all because clone(2) failed so there's no child waiting to
278 // be unblocked, but we're about to unmap the memory the mutex is stored in, so this serves as a
279 // reminder that you can't rewrite this function to use a ScopedPthreadMutexLocker.
280 thread->startup_handshake_lock.unlock();
281 if (thread->mmap_size != 0) {
282 munmap(thread->attr.stack_base, thread->mmap_size);
283 }
284 __libc_format_log(ANDROID_LOG_WARN, "libc", "pthread_create failed: clone failed: %s", strerror(errno));
285 return clone_errno;
286 }
287
288 int init_errno = __init_thread(thread);
289 if (init_errno != 0) {
290 // Mark the thread detached and replace its start_routine with a no-op.
291 // Letting the thread run is the easiest way to clean up its resources.
292 atomic_store(&thread->join_state, THREAD_DETACHED);
293 __pthread_internal_add(thread);
294 thread->start_routine = __do_nothing;
295 thread->startup_handshake_lock.unlock();
296 return init_errno;
297 }
298
299 // Publish the pthread_t and unlock the mutex to let the new thread start running.
300 *thread_out = __pthread_internal_add(thread);
301 thread->startup_handshake_lock.unlock();
302
303 return 0;
304 }
305