[glibc/azanella/bz30558-posix_timer-v10] linux: Do not spawn a new thread for SIGEV_THREAD (BZ 30558, 27895, 29705, 32833)
Adhemerval Zanella via Glibc-cvs <[email protected]> Mon, 13 Jul 2026 12:19:07 +0000 (GMT)
| Newsgroups | gmane.comp.lib.glibc.cvs |
|---|---|
| Message-ID | <[email protected]> |
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=9d528833ac4a3195c561ce625c0d705c5c2cb3f0 commit 9d528833ac4a3195c561ce625c0d705c5c2cb3f0 Author: Adhemerval Zanella <[email protected]> Date: Mon Jun 19 14:11:58 2023 -0300 linux: Do not spawn a new thread for SIGEV_THREAD (BZ 30558, 27895, 29705, 32833) The current timer_create SIGEV_THREAD implementation has some downsides: 1. There is no way to report failure at thread creation when a timer triggers. It means that it might occur unreported and with missed events depending of the system load. 2. The background thread is also kept in the background even when there are no more timers, consuming resources and also misleading memory profile tools (BZ 29705). 3. There is a lot of metadata that needs to be kept: a control variable for helper thread creation, a list of active SIGEV_THREAD timers, atfork handlers to cleanup the list. 4. timer_create does not propagate all thread attributes to the new thread (BZ 27895). 5. Kernel might deliver in-flight events for a timer after it was destroyed by timer_delete. The timer_helper_thread mechanism to handle it does not cover all possible issue, which leads to callbacks being wrongly triggered (BZ 32833). This new implementation moves the thread creation to timer_create, so any failure is reported to the caller. Also, the same thread will serve multiple timers, thus there are no unreported missed events. Avoiding parallel timer activation also avoids possible parallel timer invocations seeing the same overrun value. SIGTIMER is used internally and aliases SIGCANCEL (__SIGRTMIN). The helper thread keeps it blocked while waiting for expirations with sigwaitinfo, and unblocks it only around the notification function so that an asynchronous pthread_cancel targeting the pthread_t obtained from pthread_self within the notification is delivered and acted upon (POSIX requires SIGEV_THREAD to behave as if a fresh thread serviced each notification). Because the same signal number is unblocked there, the SIGCANCEL handler is installed eagerly from timer_create: otherwise a timer re-fire or a timer_delete wake reaching the notification thread would hit the default disposition of __SIGRTMIN and terminate the process. For the same reason timer_delete wakes the helper with SIGTIMER queued with SI_QUEUE instead of tgkill, so the wake is not mistaken for a cancellation by the handler. Unblocking SIGTIMER during the notification forces overrun accounting into userspace. The kernel only counts an expiration as an overrun while a signal for the timer is still pending; but with the signal unblocked every expiration that arrives during the notification is delivered promptly to the handler and ignored, so the kernel never leaves one pending and never counts it (timer_getoverrun would thus always report zero). The handler instead counts these ignored expirations, and timer_create adds the ones the kernel folded in while the helper was blocked between firings, into a per-timer cumulative counter returned by timer_getoverrun. The counter is never reset across notifications (otherwise the overruns of a slow notification would be lost when the next one starts) and saturates at DELAYTIMER_MAX, matching the kernel. This lets an application detect a notification function too slow for the interval and take corrective action, such as re-arming the timer with timer_settime. The notification runs under a cancellation landing pad rooted at the wait loop: a pthread_cancel or a pthread_exit from the notification function unwinds back into the loop, a cleanup handler resets all internal thread state, and the helper serves the next firing instead of terminating. This also avoids the need to recreate the thread for a pthread_exit call (and the possible unreported missed events from a failed thread creation). It also prevents the re-use issue when a newly-allocated timer has in-flight events being delivered by the kernel (BZ 32833). Performance-wise it uses less CPU time for multiple thread activations, although each thread now requires a sigwaitinfo which generates more context-switches/page-faults (check comment 7 from BZ 30558). I would expect that latency should improve, since it avoids a thread creation for each timer expiration. Checked on aarch64-linux-gnu, x86_64-linux-gnu and i686-linux-gnu. Diff: --- nptl/Makefile | 1 + nptl/allocatestack.c | 23 +- nptl/descr.h | 7 + nptl/pthread_cancel.c | 51 +--- nptl/pthread_cancel_signal.c | 90 +++++++ nptl/pthread_create.c | 83 ++++++ rt/Makefile | 11 +- rt/tst-timer-sigmask.c | 15 +- rt/tst-timer10.c | 109 ++++++++ rt/tst-timer6.c | 79 ++++++ rt/tst-timer7.c | 91 +++++++ rt/tst-timer8.c | 107 ++++++++ rt/tst-timer8x.c | 21 ++ rt/tst-timer9.c | 90 +++++++ sysdeps/nptl/Makefile | 2 - sysdeps/nptl/fork.h | 2 - sysdeps/nptl/pthreadP.h | 22 ++ sysdeps/unix/sysv/linux/internal-signals.h | 8 - sysdeps/unix/sysv/linux/kernel-posix-cpu-timers.h | 2 + sysdeps/unix/sysv/linux/kernel-posix-timers.h | 96 +++---- sysdeps/unix/sysv/linux/timer_create.c | 313 +++++++++++++++------- sysdeps/unix/sysv/linux/timer_delete.c | 57 ++-- sysdeps/unix/sysv/linux/timer_getoverr.c | 6 + sysdeps/unix/sysv/linux/timer_routines.c | 154 ----------- 24 files changed, 1022 insertions(+), 418 deletions(-) diff --git a/nptl/Makefile b/nptl/Makefile index 97a0fb7f65..e3aa715f68 100644 --- a/nptl/Makefile +++ b/nptl/Makefile @@ -93,6 +93,7 @@ routines = \ pthread_barrierattr_init \ pthread_barrierattr_setpshared \ pthread_cancel \ + pthread_cancel_signal \ pthread_cleanup_upto \ pthread_clockjoin \ pthread_cond_broadcast \ diff --git a/nptl/allocatestack.c b/nptl/allocatestack.c index b2ecb00113..f4eb62369b 100644 --- a/nptl/allocatestack.c +++ b/nptl/allocatestack.c @@ -124,28 +124,7 @@ get_cached_stack (size_t *sizep, void **memp) *sizep = result->stackblock_size; *memp = result->stackblock; - /* Cancellation handling is back to the default. */ - result->cancelhandling = 0; - result->cleanup = NULL; - result->setup_failed = 0; - - /* No pending event. */ - result->nextevent = NULL; - - result->exiting = false; - __libc_lock_init (result->exit_lock); - memset (&result->tls_state, 0, sizeof result->tls_state); - - result->getrandom_buf = NULL; - - /* Clear the DTV. */ - dtv_t *dtv = GET_DTV (TLS_TPADJ (result)); - for (size_t cnt = 0; cnt < dtv[-1].counter; ++cnt) - free (dtv[1 + cnt].pointer.to_free); - memset (dtv, '\0', (dtv[-1].counter + 1) * sizeof (dtv_t)); - - /* Re-initialize the TLS. */ - _dl_allocate_tls_init (TLS_TPADJ (result), false); + __pthread_init_stack (result); return result; } diff --git a/nptl/descr.h b/nptl/descr.h index 627cc3980f..3c42f1575a 100644 --- a/nptl/descr.h +++ b/nptl/descr.h @@ -414,6 +414,13 @@ struct pthread /* Used on strsignal. */ struct tls_internal_t tls_state; + /* POSIX per-process timer. */ + int timerid; + + /* POSIX per-process timer/SSIGEV_THREAD, the cumulative number of timer + expirations that could not be serviced by the notification function. */ + int timer_overrun; + /* getrandom vDSO per-thread opaque state. */ void *getrandom_buf; diff --git a/nptl/pthread_cancel.c b/nptl/pthread_cancel.c index 5a5a637d7c..dfe7d5643f 100644 --- a/nptl/pthread_cancel.c +++ b/nptl/pthread_cancel.c @@ -15,45 +15,11 @@ License along with the GNU C Library; if not, see <https://www.gnu.org/licenses/>. */ -#include <errno.h> -#include <signal.h> -#include <stdlib.h> #include "pthreadP.h" -#include <atomic.h> -#include <sysdep.h> -#include <unistd.h> #include <unwind-link.h> -#include <cancellation-pc-check.h> #include <stdio.h> #include <gnu/lib-names.h> -#include <sys/single_threaded.h> - -/* For asynchronous cancellation we use a signal. */ -static void -sigcancel_handler (int sig, siginfo_t *si, void *ctx) -{ - /* Safety check. It would be possible to call this function for - other signals and send a signal from another process. This is not - correct and might even be a security problem. Try to catch as - many incorrect invocations as possible. */ - if (sig != SIGCANCEL - || si->si_pid != __getpid() - || si->si_code != SI_TKILL) - return; - - /* Check if asynchronous cancellation mode is set and cancellation is not - already in progress, or if interrupted instruction pointer falls within - the cancellable syscall bridge. - For interruptable syscalls with external side-effects (i.e. partial - reads), the kernel will set the IP to after __syscall_cancel_arch_end, - thus disabling the cancellation and allowing the process to handle such - conditions. */ - struct pthread *self = THREAD_SELF; - int oldval = atomic_load_relaxed (&self->cancelhandling); - if (cancel_enabled_and_canceled_and_async (oldval) - || cancellation_pc_check (ctx)) - __syscall_do_cancel (); -} +#include <shlib-compat.h> int __pthread_cancel (pthread_t th) @@ -67,20 +33,7 @@ __pthread_cancel (pthread_t th) determined. */ return 0; - static int init_sigcancel = 0; - if (atomic_load_relaxed (&init_sigcancel) == 0) - { - struct sigaction sa; - sa.sa_sigaction = sigcancel_handler; - /* The signal handle should be non-interruptible to avoid the risk of - spurious EINTR caused by SIGCANCEL sent to process or if - pthread_cancel() is called while cancellation is disabled in the - target thread. */ - sa.sa_flags = SA_SIGINFO | SA_RESTART; - __sigemptyset (&sa.sa_mask); - __libc_sigaction (SIGCANCEL, &sa, NULL); - atomic_store_relaxed (&init_sigcancel, 1); - } + __pthread_install_sigcancel_handler (); #ifdef SHARED /* Trigger an error if libgcc_s cannot be loaded. */ diff --git a/nptl/pthread_cancel_signal.c b/nptl/pthread_cancel_signal.c new file mode 100644 index 0000000000..2ddd6848bc --- /dev/null +++ b/nptl/pthread_cancel_signal.c @@ -0,0 +1,90 @@ +/* Signal handling for pthread cancellation. + Copyright (C) 2002-2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + <https://www.gnu.org/licenses/>. */ + +#include <stdbool.h> +#include <stdint.h> +#include <sys/ucontext.h> +#include <cancellation-pc-check.h> +#include <kernel-posix-timers.h> +#include "pthreadP.h" +#include <unistd.h> + +/* For asynchronous cancellation we use a signal. */ +static void +sigcancel_handler (int sig, siginfo_t *si, void *ctx) +{ + if (sig != SIGCANCEL) + return; + + /* A timer expiration (SI_TIMER) delivered and the expiration cannot be + serviced now, so it is ignored and recorded as an overrun. si_overrun + accounts for any further expirations the kernel folded into this one. */ + if (si->si_code == SI_TIMER) + { + struct pthread *self = THREAD_SELF; + int inc; + if (INT_ADD_WRAPV (si->si_overrun, 1, &inc)) + inc = INT_MAX; + timer_overrun_add (&self->timer_overrun, inc); + return; + } + + /* Safety check. It would be possible to call this function for + other signals and send a signal from another process. This is not + correct and might even be a security problem. Try to catch as + many incorrect invocations as possible. */ + if (si->si_pid != __getpid() + || si->si_code != SI_TKILL) + return; + + /* Check if asynchronous cancellation mode is set and cancellation is not + already in progress, or if interrupted instruction pointer falls within + the cancellable syscall bridge. + For interruptable syscalls with external side-effects (i.e. partial + reads), the kernel will set the IP to after __syscall_cancel_arch_end, + thus disabling the cancellation and allowing the process to handle such + conditions. */ + struct pthread *self = THREAD_SELF; + int oldval = atomic_load_relaxed (&self->cancelhandling); + if (cancel_enabled_and_canceled_and_async (oldval) + || cancellation_pc_check (ctx)) + __syscall_do_cancel (); +} + +/* Install the SIGCANCEL handler if it has not been installed yet. This is + done lazily from __pthread_cancel, and eagerly from the POSIX timer code + (which unblocks SIGCANCEL/SIGTIMER in the SIGEV_THREAD helper thread and + therefore needs the handler in place before any signal can be delivered). */ +void +__pthread_install_sigcancel_handler (void) +{ + static int init_sigcancel = 0; + if (atomic_load_relaxed (&init_sigcancel) == 0) + { + struct sigaction sa; + sa.sa_sigaction = sigcancel_handler; + /* The signal handle should be non-interruptible to avoid the risk of + spurious EINTR caused by SIGCANCEL sent to process or if + pthread_cancel() is called while cancellation is disabled in the + target thread. */ + sa.sa_flags = SA_SIGINFO | SA_RESTART; + __sigemptyset (&sa.sa_mask); + __libc_sigaction (SIGCANCEL, &sa, NULL); + atomic_store_relaxed (&init_sigcancel, 1); + } +} diff --git a/nptl/pthread_create.c b/nptl/pthread_create.c index fcb06c68c7..88822224df 100644 --- a/nptl/pthread_create.c +++ b/nptl/pthread_create.c @@ -92,6 +92,44 @@ late_init (void) NULL, __NSIG_BYTES); } +static void +__pthread_init_stack (struct pthread *result) +{ + /* Cancellation handling is back to the default. */ + result->cancelhandling = 0; + result->cleanup = NULL; + result->setup_failed = 0; + + /* No pending event. */ + result->nextevent = NULL; + + result->exiting = false; + __libc_lock_init (result->exit_lock); + memset (&result->tls_state, 0, sizeof result->tls_state); + + /* getrandom_buf, timerid and timer_overrun are intentionally not reset + here: + + - getrandom_buf: the prior thread's exit path calls + __getrandom_vdso_release, and resetting it here in would orphan a live + buffer (or force a fresh allocation if). + + - timerid and timer_overrun: meaningful only for SIGEV_THREAD helper + threads. timerid is written by the thread setup before releasing the + helper from its setup barrier; timer_overrun is a cumulative overrun + count that must survive across every notification (including a + cancelled or exited one) so timer_getoverrun can still read it. */ + + /* Clear the DTV. */ + dtv_t *dtv = GET_DTV (TLS_TPADJ (result)); + for (size_t cnt = 0; cnt < dtv[-1].counter; ++cnt) + free (dtv[1 + cnt].pointer.to_free); + memset (dtv, '\0', (dtv[-1].counter + 1) * sizeof (dtv_t)); + + /* Re-initialize the TLS. */ + _dl_allocate_tls_init (TLS_TPADJ (result), false); +} + /* Code to allocate and deallocate a stack. */ #include "allocatestack.c" @@ -644,6 +682,51 @@ report_thread_creation (struct pthread *pd) return false; } +/* Reset internal thread state as if the start thread routine was initially + called from pthread_create. It is used on POSIX timers to reset the + SIGEV_THREAD thread after a timer activation (as required by POSIX in + Realtime Signal Generation and Delivery): each firing must behave as if a + fresh thread was created, so TLS destructors, TSD destructors, libc + per-thread state, the DTV, the signal mask, and cancellation state are all + reset. + + The per-thread vDSO getrandom buffer (getrandom_buf) is *not* reset here. + It is internal, opaque state that advances forward-securely on each use, so + no observable data leaks across firings. + + The kernel timer id (timerid) is also *not* reset here: it identifies the + active timer for this helper thread and timer_delete signals exit by + setting its MSB, which the helper thread checks after each firing. */ +void +__pthread_reset_state (void *arg) +{ + struct pthread *self = THREAD_SELF; + + /* Call destructors for the thread_local TLS variables. */ + call_function_static_weak (__call_tls_dtors); + + /* Run the destructor for the thread-local data. */ + __nptl_deallocate_tsd (); + + /* Clean up any state libc stored in thread-local variables. */ + __libc_thread_freeres (); + + /* Reset internal TCB state. */ + struct pthread_reset_cleanup_args_t *args = arg; + self->cleanup_jmp_buf = args->cleanup_jmp_buf; + self->cleanup_jmp_buf->priv.data.prev = NULL; + self->cleanup_jmp_buf->priv.data.cleanup = NULL; + self->cleanup_jmp_buf->priv.data.canceltype = 0; + self->cleanup = NULL; + self->exc = (struct _Unwind_Exception) { 0 }; + self->cancelhandling = 0; + self->nextevent = NULL; + + __pthread_init_stack (self); + + /* Reset to the expected initial signal mask. */ + internal_signal_restore_set (&self->sigmask); +} int __pthread_create_2_1 (pthread_t *newthread, const pthread_attr_t *attr, diff --git a/rt/Makefile b/rt/Makefile index f39e9674e5..e92a766f13 100644 --- a/rt/Makefile +++ b/rt/Makefile @@ -76,7 +76,13 @@ tests := tst-shm tst-timer tst-timer2 \ tst-cpuclock2 tst-cputimer1 tst-cputimer2 tst-cputimer3 \ tst-clock_nanosleep2 \ tst-shm-cancel \ - tst-mqueue10 + tst-mqueue10 \ + tst-timer6 \ + tst-timer7 \ + tst-timer8 \ + tst-timer8x \ + tst-timer9 \ + tst-timer10 tests-internal := tst-timer-sigmask tests-time64 := \ @@ -98,6 +104,9 @@ include ../Rules CFLAGS-aio_suspend.c += -fexceptions CFLAGS-mq_timedreceive.c += -fexceptions -fasynchronous-unwind-tables CFLAGS-mq_timedsend.c += -fexceptions -fasynchronous-unwind-tables +CFLAGS-timer_create.c += -fexceptions -fasynchronous-unwind-tables + +CFLAGS-tst-timer8x.c += -fexceptions -fasynchronous-unwind-tables # Exclude fortified routines from being built with _FORTIFY_SOURCE routines_no_fortify += \ diff --git a/rt/tst-timer-sigmask.c b/rt/tst-timer-sigmask.c index 869194bde6..4ce4927c9e 100644 --- a/rt/tst-timer-sigmask.c +++ b/rt/tst-timer-sigmask.c @@ -38,19 +38,22 @@ thread_handler (union sigval sv) printf ("%s: blocked signal mask = { ", __func__); for (int sig = 1; sig < NSIG; sig++) { - /* POSIX timers threads created to handle SIGEV_THREAD block all - signals except SIGKILL, SIGSTOP and glibc internals ones. */ + /* While the notification function runs, the SIGEV_THREAD helper blocks + all signals except SIGKILL, SIGSTOP, SIGSETXID, and SIGCANCEL (the + last, which aliases SIGTIMER, is unblocked around the notification + function so that it can be cancelled). */ if (sigismember (&ss, sig)) - { - TEST_VERIFY (sig != SIGKILL && sig != SIGSTOP); - TEST_VERIFY (!is_internal_signal (sig)); - } + TEST_VERIFY (sig != SIGKILL && sig != SIGSTOP && sig != SIGSETXID + && sig != SIGCANCEL); if (test_verbose && sigismember (&ss, sig)) printf ("%d, ", sig); } if (test_verbose > 0) printf ("}\n"); + /* SIGCANCEL must be unblocked here so pthread_cancel is honored. */ + TEST_VERIFY (!sigismember (&ss, SIGCANCEL)); + xpthread_barrier_wait (&barrier); } diff --git a/rt/tst-timer10.c b/rt/tst-timer10.c new file mode 100644 index 0000000000..8194932288 --- /dev/null +++ b/rt/tst-timer10.c @@ -0,0 +1,109 @@ +/* Check that timer_getoverrun accumulates SIGEV_THREAD overruns across + multiple notifications. + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public License as + published by the Free Software Foundation; either version 2.1 of the + License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; see the file COPYING.LIB. If + not, see <https://www.gnu.org/licenses/>. */ + + +/* A periodic timer whose notification function runs longer than the interval + overruns on every firing. Because the helper serves one notification at a + time and the missed expirations are delivered promptly (SIGTIMER unblocked) + rather than left pending, they are tracked in userspace. The count must be + cumulative and overruns from earlier notifications must not be lost when + a new notification starts. */ + +#include <signal.h> +#include <stdatomic.h> +#include <time.h> + +#include <support/check.h> + +enum { interval_nsec = 10000000 }; /* 0.01s */ +enum { run_intervals = 4 }; +enum { notifications = 6 }; + +static atomic_int reached_final; +static atomic_int keep_spinning = 1; +static atomic_int overrun_cumulative; + +static timer_t timerid; + +static void +busy_wait (long int nsec) +{ + struct timespec start, now; + clock_gettime (CLOCK_MONOTONIC, &start); + do + clock_gettime (CLOCK_MONOTONIC, &now); + while ((now.tv_sec - start.tv_sec) * NSEC_PER_SEC + + (now.tv_nsec - start.tv_nsec) < nsec); +} + +static void +on_timer (union sigval sv) +{ + static int n; + + if (++n < notifications) + /* Run past several interval boundaries so this notification overruns. */ + busy_wait ((long int) run_intervals * interval_nsec); + else if (n == notifications) + { + /* Cumulative overruns from the prior notifications. */ + atomic_store_explicit (&overrun_cumulative, timer_getoverrun (timerid), + memory_order_relaxed); + atomic_store_explicit (&reached_final, 1, memory_order_release); + while (atomic_load_explicit (&keep_spinning, memory_order_acquire)) + ; + } +} + +static int +do_test (void) +{ + struct sigevent ev = + { + .sigev_notify = SIGEV_THREAD, + .sigev_notify_function = on_timer, + }; + TEST_COMPARE (timer_create (CLOCK_MONOTONIC, &ev, &timerid), 0); + + struct itimerspec its = + { .it_value = { .tv_nsec = interval_nsec }, + .it_interval = { .tv_nsec = interval_nsec } }; + TEST_COMPARE (timer_settime (timerid, 0, &its, NULL), 0); + + while (atomic_load_explicit (&reached_final, memory_order_acquire) == 0) + ; + + /* Each of the (notifications - 1) prior notifications missed about + (run_intervals - 1) expirations, so the cumulative count is several + times what one notification alone contributes. */ + int overrun = atomic_load_explicit (&overrun_cumulative, + memory_order_relaxed); + TEST_VERIFY (overrun >= notifications); + printf ("debug: overrun = %d\n", overrun); + + struct itimerspec its_stop = { 0 }; + TEST_COMPARE (timer_settime (timerid, 0, &its_stop, NULL), 0); + atomic_store_explicit (&keep_spinning, 0, memory_order_release); + TEST_COMPARE (timer_delete (timerid), 0); + + return 0; +} + +#define TIMEOUT 15 +#include <support/test-driver.c> diff --git a/rt/tst-timer6.c b/rt/tst-timer6.c new file mode 100644 index 0000000000..545bfa6695 --- /dev/null +++ b/rt/tst-timer6.c @@ -0,0 +1,79 @@ +/* Check re-use timer id for SIGEV_THREAD (BZ 32833) + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public License as + published by the Free Software Foundation; either version 2.1 of the + License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; see the file COPYING.LIB. If + not, see <https://www.gnu.org/licenses/>. */ + +#include <signal.h> +#include <time.h> +#include <support/check.h> + +/* The test depends of the system load and scheduler pressure, so the + number of iteration is arbitrary to not take too much time. */ +enum { niters = 1<<13 }; + +static void +on_good_timer (union sigval sv) +{ +} + +static void +on_bad_timer (union sigval sv) +{ + FAIL_EXIT1 ("triggered bad timer"); +} + +static int +do_test (void) +{ + struct itimerspec its_long = { .it_value = { .tv_sec = 180 } }; + struct itimerspec its_short = { .it_value = { .tv_nsec = 1000 } }; + struct itimerspec its_zero = { .it_interval = { .tv_sec = 0 } }; + + struct sigevent ev_short = + { + .sigev_notify = SIGEV_THREAD, + .sigev_notify_function = on_good_timer, + }; + + struct sigevent ev_long = + { + .sigev_notify = SIGEV_THREAD, + .sigev_notify_function = on_bad_timer, + }; + + for (int which = 0; which < niters; which++) + { + struct sigevent *ev = which & 0x1 ? &ev_short : &ev_long; + struct itimerspec *its = which & 0x1 ? &its_short : &its_long; + + timer_t timerid; + if (timer_create (CLOCK_REALTIME, ev, &timerid) == -1) + FAIL_EXIT1 ("timer_create: %m"); + + if (timer_settime (timerid, 0, its, NULL) == -1) + FAIL_EXIT1 ("timer_settime: %m"); + + if (timer_settime (timerid, 0, &its_zero, NULL) == -1) + FAIL_EXIT1 ("timer_settime: %m"); + + if (timer_delete (timerid) == -1) + FAIL_EXIT1 ("timer_delete: %m"); + } + + return 0; +} + +#include <support/test-driver.c> diff --git a/rt/tst-timer7.c b/rt/tst-timer7.c new file mode 100644 index 0000000000..80663c1c22 --- /dev/null +++ b/rt/tst-timer7.c @@ -0,0 +1,91 @@ +/* Check if thread local storage is reset on each SIGEV_THREAD trigger. + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public License as + published by the Free Software Foundation; either version 2.1 of the + License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; see the file COPYING.LIB. If + not, see <https://www.gnu.org/licenses/>. */ + +#include <array_length.h> +#include <semaphore.h> +#include <signal.h> +#include <string.h> +#include <time.h> + +#include <support/check.h> + +static sem_t sem; + +static __thread int var1; +#define VAR2_LEN 32 +static __thread char var2[] = { [0 ... VAR2_LEN] = 0xcc }; + +static const char var2_expected[] = { [0 ... VAR2_LEN] = 0xcc }; + +static void +on_timer (union sigval sv) +{ + TEST_COMPARE (var1, 0); + TEST_COMPARE_BLOB (var2, array_length (var2), + var2_expected, array_length (var2_expected)); + + var1 = 1; + memset (var2, 0x00, array_length (var2)); + + sem_post (&sem); +} + +#define NITERS 10 + +static int +do_test (void) +{ + const struct itimerspec its = + { .it_value = { .tv_nsec = 10000000 /* 0.01s */ }, + .it_interval = { .tv_nsec = 10000000 /* 0.01s */ } }; + const struct itimerspec its_stop = { 0 }; + + sem_init (&sem, 0, 0); + + timer_t timerid; + struct sigevent ev = + { + .sigev_notify = SIGEV_THREAD, + .sigev_notify_function = on_timer, + }; + if (timer_create (CLOCK_REALTIME, &ev, &timerid) == -1) + FAIL_EXIT1 ("timer_create: %m"); + + if (timer_settime (timerid, 0, &its, NULL) == -1) + FAIL_EXIT1 ("timer_settime: %m"); + + for (int i = 0; i < NITERS; i++) + { + if (sem_wait (&sem) != 0) + FAIL_EXIT1 ("sem_wait: %m"); + } + + /* Disarm before deleting to minimise the chance of an in-flight + invocation racing with timer_delete. */ + if (timer_settime (timerid, 0, &its_stop, NULL) == -1) + FAIL_EXIT1 ("timer_settime: %m"); + + if (timer_delete (timerid) == -1) + FAIL_EXIT1 ("timer_delete: %m"); + + sem_destroy (&sem); + + return 0; +} + +#include <support/test-driver.c> diff --git a/rt/tst-timer8.c b/rt/tst-timer8.c new file mode 100644 index 0000000000..56b940f40f --- /dev/null +++ b/rt/tst-timer8.c @@ -0,0 +1,107 @@ +/* Check that SIGEV_THREAD notification functions honor cancellation + (BZ 30558). + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public License as + published by the Free Software Foundation; either version 2.1 of the + License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; see the file COPYING.LIB. If + not, see <https://www.gnu.org/licenses/>. */ + +/* POSIX requires SIGEV_THREAD notifications to behave as if a new thread was + created for each delivery and thus it must support cancellation. */ + +#include <pthread.h> +#include <signal.h> +#include <stdatomic.h> +#include <time.h> + +#include <support/check.h> + +/* Set by the notification function on its first firing, once it has published + handler_thread and is about to spin; waited on by do_test. */ +static atomic_int handler_started; + +/* Set by a later firing, proving the helper survived the cancellation and is + reused; waited on by do_test. */ +static atomic_int handler_reused; + +static pthread_t handler_thread; + +static void +on_timer (union sigval sv) +{ + /* Plain static (not thread-local) storage, so it survives the per-firing + thread state reset and lets us act only on the first firing. */ + static atomic_int firings; + + if (atomic_fetch_add (&firings, 1) == 0) + { + handler_thread = pthread_self (); + + TEST_COMPARE (pthread_setcancelstate (PTHREAD_CANCEL_ENABLE, NULL), 0); + TEST_COMPARE (pthread_setcanceltype (PTHREAD_CANCEL_ASYNCHRONOUS, NULL), + 0); + + /* Publish handler_thread and signal do_test. */ + atomic_store_explicit (&handler_started, 1, memory_order_release); + + /* Spin until asynchronously cancelled, and the flag is never cleared. + The only way out is the cancellation. */ + while (atomic_load_explicit (&handler_started, memory_order_relaxed)) + ; + } + else + atomic_store_explicit (&handler_reused, 1, memory_order_release); +} + +static int +do_test (void) +{ + timer_t timerid; + struct sigevent ev = + { + .sigev_notify = SIGEV_THREAD, + .sigev_notify_function = on_timer, + }; + TEST_COMPARE (timer_create (CLOCK_REALTIME, &ev, &timerid), 0); + + /* Periodic so that a firing keeps arriving after the first one is + cancelled. */ + struct itimerspec its = + { .it_value = { .tv_nsec = 10000000 /* 0.01s */ }, + .it_interval = { .tv_nsec = 10000000 /* 0.01s */ } }; + TEST_COMPARE (timer_settime (timerid, 0, &its, NULL), 0); + + /* Busy wait until the notification function is spinning. */ + while (atomic_load_explicit (&handler_started, memory_order_acquire) == 0) + ; + + TEST_COMPARE (pthread_cancel (handler_thread), 0); + + /* If the cancellation is honored the spin is interrupted, the helper resets + and resumes, and a later firing sets handler_reused. */ + while (atomic_load_explicit (&handler_reused, memory_order_acquire) == 0) + ; + + /* The helper survived the cancellation and is still alive. */ + TEST_COMPARE (pthread_kill (handler_thread, 0), 0); + + struct itimerspec its_stop = { 0 }; + TEST_COMPARE (timer_settime (timerid, 0, &its_stop, NULL), 0); + TEST_COMPARE (timer_delete (timerid), 0); + + return 0; +} + +#define TIMEOUT 10 +#include <support/test-driver.c> diff --git a/rt/tst-timer8x.c b/rt/tst-timer8x.c new file mode 100644 index 0000000000..74624955f0 --- /dev/null +++ b/rt/tst-timer8x.c @@ -0,0 +1,21 @@ +/* Check that SIGEV_THREAD notification functions honor cancellation + (BZ 30558). + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public License as + published by the Free Software Foundation; either version 2.1 of the + License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; see the file COPYING.LIB. If + not, see <https://www.gnu.org/licenses/>. */ + +/* It is built with -fexceptions and -fasynchronous-unwind-tables. */ +#include "tst-timer8.c" diff --git a/rt/tst-timer9.c b/rt/tst-timer9.c new file mode 100644 index 0000000000..fe2d80227b --- /dev/null +++ b/rt/tst-timer9.c @@ -0,0 +1,90 @@ +/* Check that timer_getoverrun reports SIGEV_THREAD expirations. + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public License as + published by the Free Software Foundation; either version 2.1 of the + License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; see the file COPYING.LIB. If + not, see <https://www.gnu.org/licenses/>. */ + +#include <signal.h> +#include <stdatomic.h> +#include <time.h> + +#include <support/check.h> + +static atomic_int handler_started; +static atomic_int keep_spinning = 1; + +static void +on_timer (union sigval sv) +{ + static atomic_int firings; + + if (atomic_fetch_add (&firings, 1) == 0) + { + atomic_store_explicit (&handler_started, 1, memory_order_release); + + /* Simulate handler stuck under load. While this runs, further + expirations are delivered and folded into the timer overrun. */ + while (atomic_load_explicit (&keep_spinning, memory_order_acquire)) + ; + } +} + +static int +do_test (void) +{ + timer_t timerid; + struct sigevent ev = + { + .sigev_notify = SIGEV_THREAD, + .sigev_notify_function = on_timer, + }; + TEST_COMPARE (timer_create (CLOCK_REALTIME, &ev, &timerid), 0); + + /* Periodic so expirations keep arriving while the first delivery spins. */ + enum { interval_nsec = 10000000 }; /* 0.01s */ + struct itimerspec its = + { .it_value = { .tv_nsec = interval_nsec }, + .it_interval = { .tv_nsec = interval_nsec } }; + TEST_COMPARE (timer_settime (timerid, 0, &its, NULL), 0); + + /* Busy wait (acquire) until the notification function is spinning. */ + while (atomic_load_explicit (&handler_started, memory_order_acquire) == 0) + ; + + /* Let several expirations pile up while the notification is stuck. */ + enum { wait_intervals = 10 }; + struct timespec delay = + { .tv_sec = 0, .tv_nsec = wait_intervals * interval_nsec }; + TEST_COMPARE (nanosleep (&delay, NULL), 0); + + /* The overrun is read while the notification is still spinning, so it is + stable. */ + int overrun = timer_getoverrun (timerid); + if (overrun == -1) + FAIL_EXIT1 ("timer_getoverrun: %m"); + if (overrun == 0) + FAIL_EXIT1 ("timer_getoverrun returned 0"); + + /* Disarm before releasing. */ + struct itimerspec its_stop = { 0 }; + TEST_COMPARE (timer_settime (timerid, 0, &its_stop, NULL), 0); + atomic_store_explicit (&keep_spinning, 0, memory_order_release); + TEST_COMPARE (timer_delete (timerid), 0); + + return 0; +} + +#define TIMEOUT 10 +#include <support/test-driver.c> diff --git a/sysdeps/nptl/Makefile b/sysdeps/nptl/Makefile index 03c9c05640..47f5ba5824 100644 --- a/sysdeps/nptl/Makefile +++ b/sysdeps/nptl/Makefile @@ -16,8 +16,6 @@ # <https://www.gnu.org/licenses/>. ifeq ($(subdir),rt) -sysdep_routines += timer_routines - tests += tst-mqueue8x CFLAGS-tst-mqueue8x.c += -fexceptions endif diff --git a/sysdeps/nptl/fork.h b/sysdeps/nptl/fork.h index c09e57c5ab..31ac12812f 100644 --- a/sysdeps/nptl/fork.h +++ b/sysdeps/nptl/fork.h @@ -20,7 +20,6 @@ #define _FORK_H #include <assert.h> -#include <kernel-posix-timers.h> #include <ldsodefs.h> #include <list.h> #include <mqueue.h> @@ -46,7 +45,6 @@ fork_system_setup_after_fork (void) __default_pthread_attr_lock = LLL_LOCK_INITIALIZER; call_function_static_weak (__mq_notify_fork_subprocess); - call_function_static_weak (__timer_fork_subprocess); call_function_static_weak (__getrandom_fork_subprocess); } diff --git a/sysdeps/nptl/pthreadP.h b/sysdeps/nptl/pthreadP.h index de432d4032..b636271739 100644 --- a/sysdeps/nptl/pthreadP.h +++ b/sysdeps/nptl/pthreadP.h @@ -667,6 +667,28 @@ int __pthread_attr_extension (struct pthread_attr *attr) attribute_hidden # define PTHREAD_STATIC_FN_REQUIRE(name) __asm (".globl " #name); #endif +struct pthread_reset_cleanup_args_t +{ + /* The thread's original (start_thread) cancellation landing pad. It is + restored into self->cleanup_jmp_buf so the reused helper thread is left + in a ristine state after the notification function returns, calls + pthread_exit, or is cancelled. */ + struct pthread_unwind_buf *cleanup_jmp_buf; +}; + +/* Reset the thread's internal state to a point as close to the initial call + to pthread_create. It is designed to be used as the argument to + pthread_cleanup_push along with a struct pthread_reset_cleanup_args_t + pointer in args with a valid cleanup_jmp_buf used to reset the threads own + copy. */ +void __pthread_reset_state (void *arg) attribute_hidden; + +/* Install the process-wide SIGCANCEL handler if it is not already installed. + Used lazily by pthread_cancel and eagerly by the POSIX timer SIGEV_THREAD + support. */ +void __pthread_install_sigcancel_handler (void) attribute_hidden; + + /* Make a deep copy of the attribute *SOURCE in *TARGET. *TARGET is not assumed to have been initialized. Returns 0 on success, or a positive error code otherwise. */ diff --git a/sysdeps/unix/sysv/linux/internal-signals.h b/sysdeps/unix/sysv/linux/internal-signals.h index a8f1c87b46..02a086f7d5 100644 --- a/sysdeps/unix/sysv/linux/internal-signals.h +++ b/sysdeps/unix/sysv/linux/internal-signals.h @@ -108,12 +108,4 @@ static const sigset_t sigtimer_set = { } }; -/* Unblock only SIGTIMER. */ -static inline void -signal_unblock_sigtimer (void) -{ - INTERNAL_SYSCALL_CALL (rt_sigprocmask, SIG_UNBLOCK, &sigtimer_set, NULL, - __NSIG_BYTES); -} - #endif diff --git a/sysdeps/unix/sysv/linux/kernel-posix-cpu-timers.h b/sysdeps/unix/sysv/linux/kernel-posix-cpu-timers.h index bea1e0e62d..c95b504d5f 100644 --- a/sysdeps/unix/sysv/linux/kernel-posix-cpu-timers.h +++ b/sysdeps/unix/sysv/linux/kernel-posix-cpu-timers.h @@ -20,6 +20,8 @@ #define CPUCLOCK_SCHED 2 #define CPUCLOCK_MAX 3 +#include <sys/types.h> + static inline clockid_t make_process_cpuclock (unsigned int pid, clockid_t clock) { diff --git a/sysdeps/unix/sysv/linux/kernel-posix-timers.h b/sysdeps/unix/sysv/linux/kernel-posix-timers.h index 9b7859b1c6..51d297a8f0 100644 --- a/sysdeps/unix/sysv/linux/kernel-posix-timers.h +++ b/sysdeps/unix/sysv/linux/kernel-posix-timers.h @@ -19,29 +19,8 @@ #include <setjmp.h> #include <signal.h> #include <sys/types.h> - - -/* Nonzero if the system calls are not available. */ -extern int __no_posix_timers attribute_hidden; - -/* Callback to start helper thread. */ -extern void __timer_start_helper_thread (void) attribute_hidden; - -/* Control variable for helper thread creation. */ -extern pthread_once_t __timer_helper_once attribute_hidden; - -/* Called from fork so that the new subprocess re-creates the - notification thread if necessary. */ -void __timer_fork_subprocess (void) attribute_hidden; - -/* TID of the helper thread. */ -extern pid_t __timer_helper_tid attribute_hidden; - -/* List of active SIGEV_THREAD timers. */ -extern struct timer *__timer_active_sigev_thread attribute_hidden; - -/* Lock for __timer_active_sigev_thread. */ -extern pthread_mutex_t __timer_active_sigev_thread_lock attribute_hidden; +#include <intprops.h> +#include <nptl/descr.h> extern __typeof (timer_create) __timer_create; libc_hidden_proto (__timer_create) @@ -53,25 +32,12 @@ libc_hidden_proto (__timer_getoverrun) /* Type of timers in the kernel. */ typedef int kernel_timer_t; -/* Internal representation of SIGEV_THREAD timer. */ -struct timer -{ - kernel_timer_t ktimerid; - - void (*thrfunc) (sigval_t); - sigval_t sival; - pthread_attr_t attr; - - /* Next element in list of active SIGEV_THREAD timers. */ - struct timer *next; -}; - - /* For !SIGEV_THREAD, the resulting 'timer_t' is the returned kernel timer - identifier (kernel_timer_t), while for SIGEV_THREAD it uses the fact malloc - returns at least _Alignof (max_align_t) pointers plus that valid - kernel_timer_t are always positive to set the MSB bit of the returned - 'timer_t' to indicate the timer handles a SIGEV_THREAD. */ + identifier (kernel_timer_t), while for SIGEV_THREAD it assumes the + pthread_t at least 8-bytes aligned. + + For SIGEV_THREAD, the sign bit (INT_MIN) is set on timer_delete to + signal the helper thread to exit its sigwaitinfo loop. */ static inline timer_t kernel_timer_to_timerid (kernel_timer_t ktimerid) @@ -80,7 +46,7 @@ kernel_timer_to_timerid (kernel_timer_t ktimerid) } static inline timer_t -timer_to_timerid (struct timer *ptr) +pthread_to_timerid (pthread_t ptr) { return (timer_t) (INTPTR_MIN | (uintptr_t) ptr >> 1); } @@ -91,19 +57,53 @@ timer_is_sigev_thread (timer_t timerid) return (intptr_t) timerid < 0; } -static inline struct timer * -timerid_to_timer (timer_t timerid) +static inline struct pthread * +timerid_to_pthread (timer_t timerid) { - return (struct timer *)((uintptr_t) timerid << 1); + return (struct pthread *)((uintptr_t) timerid << 1); } static inline kernel_timer_t timerid_to_kernel_timer (timer_t timerid) { if (timer_is_sigev_thread (timerid)) - return timerid_to_timer (timerid)->ktimerid; - else - return (kernel_timer_t) ((uintptr_t) timerid); + { + /* The load is concurrent with timer_delete's atomic OR of INT_MIN (see + timerid_signal_delete) when another thread is deleting the same + timer. */ + struct pthread *pthr = timerid_to_pthread (timerid); + return atomic_load_relaxed (&pthr->timerid) & INT_MAX; + } + return (uintptr_t) timerid; +} + +static inline void +timerid_signal_delete (kernel_timer_t *timerid) +{ + /* Relaxed MO is sufficient because this is followed by a signal which is a + full memory barrier. */ + atomic_fetch_or_relaxed (timerid, INT_MIN); +} + +static inline kernel_timer_t +timerid_clear (kernel_timer_t timerid) +{ + return timerid & INT_MAX; +} + +/* Add INC (>= 0) overruns to *OVERRUN, saturating at INT_MAX (DELAYTIMER_MAX) + instead of wrapping, matching the kernel's own overrun accounting. The + helper thread is the only writer: the dequeue in timer_create.c runs with + SIGTIMER blocked, and sigcancel_handler (which also handles SIGTIMER) runs + with it auto-blocked, so these updates never overlap. The atomic is + required due a concurrent timer_getoverrun reader. */ +static inline void +timer_overrun_add (int *overrun, int inc) +{ + int newval; + if (INT_ADD_WRAPV (atomic_load_relaxed (overrun), inc, &newval)) + newval = INT_MAX; + atomic_store_relaxed (overrun, newval); } /* New targets use int instead of timer_t. The difference only diff --git a/sysdeps/unix/sysv/linux/timer_create.c b/sysdeps/unix/sysv/linux/timer_create.c index 0889ce66f5..daa3e5764c 100644 --- a/sysdeps/unix/sysv/linux/timer_create.c +++ b/sysdeps/unix/sysv/linux/timer_create.c @@ -15,46 +15,216 @@ License along with the GNU C Library; see the file COPYING.LIB. If not, see <https://www.gnu.org/licenses/>. */ -#include <errno.h> -#include <pthread.h> -#include <signal.h> -#include <stdlib.h> -#include <string.h> -#include <time.h> -#include <sysdep.h> -#include <internaltypes.h> +#include <jmpbuf-unwind.h> +#include <kernel-posix-cpu-timers.h> +#include <kernel-posix-timers.h> +#include <ldsodefs.h> +#include <libc-diag.h> +#include <libc-internal.h> +#include <libc-lock.h> #include <pthreadP.h> -#include "kernel-posix-timers.h" -#include "kernel-posix-cpu-timers.h" #include <shlib-compat.h> +struct timer_helper_thread_args_t +{ + /* The barrier is used to synchronize the arguments copy from timer_create + and the SIGEV_THREAD thread and to instruct the thread to exit if the + timer_create syscall fails. */ + pthread_barrier_t barrier; + struct sigevent *evp; +}; + +static void * +timer_helper_thread (void *arg) +{ + struct pthread *self = THREAD_SELF; + struct timer_helper_thread_args_t *args = arg; + struct pthread_reset_cleanup_args_t clargs = { + .cleanup_jmp_buf = self->cleanup_jmp_buf + }; + + void (*thrfunc) (sigval_t) = args->evp->sigev_notify_function; + sigval_t sival = args->evp->sigev_value; + + __pthread_barrier_wait (&args->barrier); + /* timer_create syscall failed. */ + if (self->exiting) + return 0; + + while (1) + { + siginfo_t si; + while (__sigwaitinfo (&sigtimer_set, &si) < 0); + + if (si.si_code == SI_TIMER) + { + /* Add the expirations the kernel folded into this delivery (missed + while the helper was blocked in sigwaitinfo) to the running + total. Further expirations that arrive while the notification + runs are delivered to the signal handler and added there. + The counter is cumulative and never reset, a plain store here + would clobber the overruns accumulated by the previous + notification's handler deliveries, since those are not + tracked by the kernel. */ + timer_overrun_add (&self->timer_overrun, si.si_overrun); + + /* POSIX requires SIGEV_THREAD notifications to behave as if a new + thread was created for each delivery. Since the same helper + thread serves multiple firings, install a cancellation landing + pad rooted at this loop: if the notification function returns + normally, calls pthread_exit, or is cancelled, control unwinds + back here, the cleanup handler resets all observable per-thread + state - TLS destructors, TSD, libc thread-local state, DTV, + signal mask, and cancellation state - and the helper serves the + next firing instead of terminating. State that must survive + across firings is intentionally preserved: the vDSO getrandom + buffer (opaque, forward-secure) and timerid (used to detect + timer_delete via its MSB after each firing). */ + struct pthread_unwind_buf cancel_buf; + DIAG_PUSH_NEEDS_COMMENT; + /* Same false-positive -Wstringop-overflow as in start_thread. */ + DIAG_IGNORE_NEEDS_COMMENT (11, "-Wstringop-overflow="); + int not_first_call + = setjmp ((struct __jmp_buf_tag *) cancel_buf.cancel_jmp_buf); + DIAG_POP_NEEDS_COMMENT; + cancel_buf.priv.data.prev = NULL; + cancel_buf.priv.data.cleanup = NULL; + + if (__glibc_likely (! not_first_call)) + { + self->cleanup_jmp_buf = &cancel_buf; + pthread_cleanup_push (__pthread_reset_state, &clargs); + + /* Enable asynchronous cancellation. A timer re-fire (SI_TIMER) + or the timer_delete wake (SI_QUEUE) reaching the handler is + ignored, so it neither cancels nor is queued. */ + internal_signal_unblock_signal (SIGTIMER); + + thrfunc (sival); + + pthread_cleanup_pop (1); + } + } + + /* timer_delete sets the MSB and wakes this thread. Relaxed MO is + sufficient because signaling this thread is a memory barrier. */ + if (atomic_load_relaxed (&self->timerid) < 0) + break; + } + + return NULL; +} + +/* Set up a SIGEV_THREAD timer: spawn the helper thread that will run the + user's notify function on each firing, then create the kernel timer bound + to that thread's TID. Returns 0 on success and stores the resulting + timer_t in *TIMERID; returns -1 with errno set on failure (from + __pthread_attr_setsigmask_internal, __pthread_create, or the timer_create + syscall). ATTR is consumed but not destroyed by this function. */ +static int +timer_create_sigev_thread (clockid_t clockid, struct sigevent *evp, + timer_t *timerid, pthread_attr_t *attr) +{ + /* The helper thread unblocks SIGTIMER/SIGCANCEL only while running the + notification function; there an interval re-fire or a pthread_cancel can + be delivered to the SIGCANCEL handler, which must therefore already be + installed. */ + __pthread_install_sigcancel_handler (); + + /* Block all signals in the helper thread but SIGSETXID. SIGTIMER stays + blocked so it can be consumed synchronously with sigwaitinfo between + firings; it is unblocked only around the notification function. */ + sigset_t ss; + __sigfillset (&ss); + __sigdelset (&ss, SIGSETXID); + if (__pthread_attr_setsigmask_internal (attr, &ss) < 0) + return -1; + + struct timer_helper_thread_args_t args = { .evp = evp }; + __pthread_barrier_init (&args.barrier, NULL, 2); + + pthread_t th; + int r = __pthread_create (&th, attr, timer_helper_thread, &args); + if (r != 0) + { + __set_errno (r); + return -1; + } + + struct pthread *pthr = (struct pthread *)th; + /* SIGEV_THREAD_ID delivers the signal to a specific thread by TID. + SIGEV_SIGNAL is not combined here because SIGEV_THREAD_ID already + implies signal delivery; the kernel treats them as orthogonal bits + and the TID field alone is sufficient to route SIGTIMER correctly. */ + struct sigevent kevp = + { + .sigev_value.sival_ptr = NULL, + .sigev_signo = SIGTIMER, + .sigev_notify = SIGEV_THREAD_ID, + ._sigev_un = { ._tid = pthr->tid }, + }; + + /* Use INTERNAL_SYSCALL_CALL so the error code can be captured directly + without going through errno; errno is set only after the barrier + wait below, which would otherwise be free to clobber it. */ + kernel_timer_t ktimerid; + long int sc = INTERNAL_SYSCALL_CALL (timer_create, clockid, &kevp, + &ktimerid); + if (INTERNAL_SYSCALL_ERROR_P (sc)) + { + ktimerid = -1; + /* On timer creation failure we need to signal the helper thread to + exit and we cannot use a negative timerid value after the + pthread_barrier_wait because we cannot distinguish between a timer + creation failure and a request to delete a timer if it happens to + arrive quickly (e.g. two timers are created in sequence, where the + first succeeds). + + We re-use the 'exiting' member to signal the failure, it is set only + at pthread_create to prevent pthread_kill from sending further + signals. Since the thread should not be user-visible, signals are + only sent during timer_delete. */ + pthr->exiting = true; + } + pthr->timerid = ktimerid; + pthr->timer_overrun = 0; + /* Signal the thread to continue execution after it copies the arguments + or exit if the timer can not be created. */ + __pthread_barrier_wait (&args.barrier); + + if (ktimerid < 0) + { + __set_errno (INTERNAL_SYSCALL_ERRNO (sc)); + return -1; + } + + *timerid = pthread_to_timerid (th); + + return 0; +} + int ___timer_create (clockid_t clock_id, struct sigevent *evp, timer_t *timerid) { - { - clockid_t syscall_clockid = (clock_id == CLOCK_PROCESS_CPUTIME_ID - ? PROCESS_CLOCK - : clock_id == CLOCK_THREAD_CPUTIME_ID - ? THREAD_CLOCK - : clock_id); - - /* If the user wants notification via a thread we need to handle - this special. */ - if (evp == NULL - || __builtin_expect (evp->sigev_notify != SIGEV_THREAD, 1)) - { - struct sigevent local_evp; + clockid_t syscall_clockid = (clock_id == CLOCK_PROCESS_CPUTIME_ID + ? PROCESS_CLOCK + : clock_id == CLOCK_THREAD_CPUTIME_ID + ? THREAD_CLOCK + : clock_id); + switch (evp != NULL ? evp->sigev_notify : SIGEV_SIGNAL) + { + case SIGEV_NONE: + case SIGEV_SIGNAL: + case SIGEV_THREAD_ID: + { + struct sigevent kevp; if (evp == NULL) { - /* The kernel has to pass up the timer ID which is a - userlevel object. Therefore we cannot leave it up to - the kernel to determine it. */ - local_evp.sigev_notify = SIGEV_SIGNAL; - local_evp.sigev_signo = SIGALRM; - local_evp.sigev_value.sival_ptr = NULL; - - evp = &local_evp; + kevp.sigev_notify = SIGEV_SIGNAL; + kevp.sigev_signo = SIGALRM; + kevp.sigev_value.sival_ptr = NULL; + evp = &kevp; } kernel_timer_t ktimerid; @@ -64,75 +234,34 @@ ___timer_create (clockid_t clock_id, struct sigevent *evp, timer_t *timerid) *timerid = kernel_timer_to_timerid (ktimerid); } - else + break; + case SIGEV_THREAD: { - /* Create the helper thread. */ - __pthread_once (&__timer_helper_once, __timer_start_helper_thread); - if (__timer_helper_tid == 0) - { - /* No resources to start the helper thread. */ - __set_errno (EAGAIN); - return -1; - } - - struct timer *newp = malloc (sizeof (struct timer)); - if (newp == NULL) - return -1; - - /* Copy the thread parameters the user provided. */ - newp->sival = evp->sigev_value; - newp->thrfunc = evp->sigev_notify_function; - - /* We cannot simply copy the thread attributes since the - implementation might keep internal information for - each instance. */ - __pthread_attr_init (&newp->attr); + pthread_attr_t attr; if (evp->sigev_notify_attributes != NULL) { - struct pthread_attr *nattr; - struct pthread_attr *oattr; - - nattr = (struct pthread_attr *) &newp->attr; - oattr = (struct pthread_attr *) evp->sigev_notify_attributes; - - nattr->schedparam = oattr->schedparam; - nattr->schedpolicy = oattr->schedpolicy; - nattr->flags = oattr->flags; - nattr->guardsize = oattr->guardsize; - nattr->stackaddr = oattr->stackaddr; - nattr->stacksize = oattr->stacksize; + int r = __pthread_attr_copy (&attr, evp->sigev_notify_attributes); + if (r != 0) + { + __set_errno (r); + return -1; + } } + else + __pthread_attr_init (&attr); + __pthread_attr_setdetachstate (&attr, PTHREAD_CREATE_DETACHED); - /* In any case set the detach flag. */ - __pthread_attr_setdetachstate (&newp->attr, PTHREAD_CREATE_DETACHED); - - /* Create the event structure for the kernel timer. */ - struct sigevent sev = - { .sigev_value.sival_ptr = newp, - .sigev_signo = SIGTIMER, - .sigev_notify = SIGEV_SIGNAL | SIGEV_THREAD_ID, - ._sigev_un = { ._pad = { [0] = __timer_helper_tid } } }; - - /* Create the timer. */ - int res; - res = INTERNAL_SYSCALL_CALL (timer_create, syscall_clockid, &sev, - &newp->ktimerid); - if (INTERNAL_SYSCALL_ERROR_P (res)) - { - free (newp); - __set_errno (INTERNAL_SYSCALL_ERRNO (res)); - return -1; - } + int r = timer_create_sigev_thread (syscall_clockid, evp, timerid, + &attr); - /* Add to the queue of active timers with thread delivery. */ - __pthread_mutex_lock (&__timer_active_sigev_thread_lock); - newp->next = __timer_active_sigev_thread; - __timer_active_sigev_thread = newp; - __pthread_mutex_unlock (&__timer_active_sigev_thread_lock); + __pthread_attr_destroy (&attr); - *timerid = timer_to_timerid (newp); + return r; } - } + default: + __set_errno (EINVAL); + return -1; + } return 0; } diff --git a/sysdeps/unix/sysv/linux/timer_delete.c b/sysdeps/unix/sysv/linux/timer_delete.c index 9a6e74328e..a215e213b9 100644 --- a/sysdeps/unix/sysv/linux/timer_delete.c +++ b/sysdeps/unix/sysv/linux/timer_delete.c @@ -15,10 +15,8 @@ License along with the GNU C Library; see the file COPYING.LIB. If not, see <https://www.gnu.org/licenses/>. */ -#include <errno.h> -#include <stdlib.h> +#include <unistd.h> #include <time.h> -#include <sysdep.h> #include "kernel-posix-timers.h" #include <pthreadP.h> #include <shlib-compat.h> @@ -26,42 +24,33 @@ int ___timer_delete (timer_t timerid) { - kernel_timer_t ktimerid = timerid_to_kernel_timer (timerid); - int res = INLINE_SYSCALL_CALL (timer_delete, ktimerid); - - if (res == 0) + if (timer_is_sigev_thread (timerid)) { - if (timer_is_sigev_thread (timerid)) - { - struct timer *kt = timerid_to_timer (timerid); + struct pthread *th = timerid_to_pthread (timerid); + kernel_timer_t ktimerid = timerid_to_kernel_timer (timerid); - /* Remove the timer from the list. */ - __pthread_mutex_lock (&__timer_active_sigev_thread_lock); - if (__timer_active_sigev_thread == kt) - __timer_active_sigev_thread = kt->next; - else - { - struct timer *prevp = __timer_active_sigev_thread; - while (prevp->next != NULL) - if (prevp->next == kt) - { - prevp->next = kt->next; - break; - } - else - prevp = prevp->next; - } - __pthread_mutex_unlock (&__timer_active_sigev_thread_lock); - - free (kt); - } + /* Delete the kernel timer first so no new events are generated + after this function returns. */ + int ret = INLINE_SYSCALL_CALL (timer_delete, ktimerid); + if (ret != 0) + return ret; + /* Signal the helper thread to exit its sigwaitinfo loop. */ + timerid_signal_delete (&th->timerid); + /* The helper threads leaves SIGTIMER/SIGCANCEL unblocked while running + the notification function, and a tgkill would arrive as SI_TKILL + and could be mistaken for a cancellation by the SIGCANCEL handler. + With SI_QUEUE the handler ignores it (only SI_TKILL cancels), while + a helper blocked in sigwaitinfo still wakes up, observes the MSB set + above (si_code != SI_TIMER), and exits. */ + siginfo_t info = { 0 }; + info.si_signo = SIGTIMER; + info.si_code = SI_QUEUE; + INTERNAL_SYSCALL_CALL (rt_tgsigqueueinfo, __getpid (), th->tid, + SIGTIMER, &info); return 0; } - - /* The kernel timer is not known or something else bad happened. - Return the error. */ - return -1; + return INLINE_SYSCALL_CALL (timer_delete, timerid); } versioned_symbol (libc, ___timer_delete, timer_delete, GLIBC_2_34); libc_hidden_ver (___timer_delete, __timer_delete) diff --git a/sysdeps/unix/sysv/linux/timer_getoverr.c b/sysdeps/unix/sysv/linux/timer_getoverr.c index 45530b73aa..ea0b95f342 100644 --- a/sysdeps/unix/sysv/linux/timer_getoverr.c +++ b/sysdeps/unix/sysv/linux/timer_getoverr.c @@ -24,6 +24,12 @@ int ___timer_getoverrun (timer_t timerid) { + /* For SIGEV_THREAD the notification thread keeps SIGTIMER unblocked while + running, so expirations delivered during a notification are ignored by + the kernel and counted in userspace instead. */ + if (timer_is_sigev_thread (timerid)) + return atomic_load_relaxed (&timerid_to_pthread (timerid)->timer_overrun); + kernel_timer_t ktimerid = timerid_to_kernel_timer (timerid); return INLINE_SYSCALL_CALL (timer_getoverrun, ktimerid); } diff --git a/sysdeps/unix/sysv/linux/timer_routines.c b/sysdeps/unix/sysv/linux/timer_routines.c deleted file mode 100644 index 7ba6dd78ba..0000000000 --- a/sysdeps/unix/sysv/linux/timer_routines.c +++ /dev/null @@ -1,154 +0,0 @@ -/* Copyright (C) 2003-2026 Free Software Foundation, Inc. - This file is part of the GNU C Library. - - The GNU C Library is free software; you can redistribute it and/or - modify it under the terms of the GNU Lesser General Public License as - published by the Free Software Foundation; either version 2.1 of the - License, or (at your option) any later version. - - The GNU C Library is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - Lesser General Public License for more details. - - You should have received a copy of the GNU Lesser General Public - License along with the GNU C Library; see the file COPYING.LIB. If - not, see <https://www.gnu.org/licenses/>. */ - -#include <errno.h> -#include <setjmp.h> -#include <signal.h> -#include <stdbool.h> -#include <sysdep-cancel.h> -#include <pthreadP.h> -#include "kernel-posix-timers.h" - - -/* List of active SIGEV_THREAD timers. */ -struct timer *__timer_active_sigev_thread; - -/* Lock for _timer_active_sigev_thread. */ -pthread_mutex_t __timer_active_sigev_thread_lock = PTHREAD_MUTEX_INITIALIZER; - -struct thread_start_data -{ - void (*thrfunc) (sigval_t); - sigval_t sival; -}; - - -/* Helper thread to call the user-provided function. */ -static void * -timer_sigev_thread (void *arg) -{ - signal_unblock_sigtimer (); - - struct thread_start_data *td = (struct thread_start_data *) arg; - void (*thrfunc) (sigval_t) = td->thrfunc; - sigval_t sival = td->sival; - - /* The TD object was allocated in timer_helper_thread. */ - free (td); - - /* Call the user-provided function. */ - thrfunc (sival); - - return NULL; -} - - -/* Helper function to support starting threads for SIGEV_THREAD. */ -static _Noreturn void * -timer_helper_thread (void *arg) -{ - /* Endless loop of waiting for signals. The loop is only ended when - the thread is canceled. */ - while (1) - { - siginfo_t si; - - while (__sigwaitinfo (&sigtimer_set, &si) < 0); - if (si.si_code == SI_TIMER) - { - struct timer *tk = (struct timer *) si.si_ptr; - - /* Check the timer is still used and will not go away - while we are reading the values here. */ - __pthread_mutex_lock (&__timer_active_sigev_thread_lock); - - struct timer *runp = __timer_active_sigev_thread; - while (runp != NULL) - if (runp == tk) - break; - else - runp = runp->next; - - if (runp != NULL) - { - struct thread_start_data *td = malloc (sizeof (*td)); - - /* There is not much we can do if the allocation fails. */ - if (td != NULL) - { - /* This is the signal we are waiting for. */ - td->thrfunc = tk->thrfunc; - td->sival = tk->sival; - - pthread_t th; - __pthread_create (&th, &tk->attr, timer_sigev_thread, td); - } - } - - __pthread_mutex_unlock (&__timer_active_sigev_thread_lock); - } - } -} - - -/* Control variable for helper thread creation. */ -pthread_once_t __timer_helper_once = PTHREAD_ONCE_INIT; - - -/* TID of the helper thread. */ -pid_t __timer_helper_tid; - - -/* Reset variables so that after a fork a new helper thread gets started. */ -void -__timer_fork_subprocess (void) -{ - __timer_helper_once = PTHREAD_ONCE_INIT; - __timer_helper_tid = 0; -} - - -void -__timer_start_helper_thread (void) -{ - /* The helper thread needs only very little resources - and should go away automatically when canceled. */ - pthread_attr_t attr; - __pthread_attr_init (&attr); - __pthread_attr_setstacksize (&attr, __pthread_get_minstack (&attr)); - - /* Block all signals in the helper thread but SIGSETXID. */ - sigset_t ss; - __sigfillset (&ss); - __sigdelset (&ss, SIGSETXID); - int res = __pthread_attr_setsigmask_internal (&attr, &ss); - if (res != 0) - { - __pthread_attr_destroy (&attr); - return; - } - - /* Create the helper thread for this timer. */ - pthread_t th; - res = __pthread_create (&th, &attr, timer_helper_thread, NULL); - if (res == 0) - /* We managed to start the helper thread. */ - __timer_helper_tid = ((struct pthread *) th)->tid; - - /* No need for the attribute anymore. */ - __pthread_attr_destroy (&attr); -}