This document details libc/libm/libdl additions and behavior changes.
See also Android linker changes for NDK developers for changes related to native code loading in various Android releases.
You can see the current status with respect to POSIX in the form of tests: https://android.googlesource.com/platform/bionic/+/master/tests/headers/posix/
Some POSIX functionality is not supported by the Linux kernel, and is guarded with tests for
__linux__. Other functionality is not supported by bionic or glibc, and guarded with tests for
__GLIBC__. In other cases historical accidents mean 32-bit bionic diverged but 64-bit bionic matches POSIX; these are guarded with
Most bionic-only diversions should be accompanied by an explanatory comment.
Missing functions are either obsolete or explicitly disallowed by SELinux:
<monetary.h>. See discussion.
pthread_cancel). Unlikely to ever be implemented because of the difficulty and cost of implementing it, and the difficulty of using it correctly. See This is why we can't have safe cancellation points for more about thread cancellation.
./libc/tools/check-symbols-glibc.py in bionic/ for the current list of POSIX functions implemented by glibc but not by bionic.
Current libc symbols: https://android.googlesource.com/platform/bionic/+/master/libc/libc.map.txt
New libc functions in R (API level 30):
<threads.h>(available as inlines for older API levels).
mlock2(Linux-specific GNU extensions).
statx(Linux-specific GNU extensions).
New libc behavior in R (API level 30):
New libc functions in Q (API level 29):
reallocarray(BSD/GNU extension in
getloadavg(BSD/GNU extension in <stdlib.h>)
New libc behavior in Q (API level 29):
%mextension, rather than a special-case hack in
popennow always uses
O_CLOEXEC, not just with the
aligned_alloccorrectly verifies that
sizeis a multiple of
%nwith the printf family is now reported as a FORTIFY failure. Previous versions of Android would ignore the
%nbut not consume the corresponding pointer argument, leading to obscure errors. The scanf family is unchanged.
%v. (strftime already supported them all.)
New libc functions in P (API level 28):
pthread_mutexattr_setprotocol(mutex priority inheritance)
sigset64_tallowing LP32 access to real-time signals
New libc behavior in P (API level 28):
%Ssupport in the printf family (previously only the wprintf family supported these).
%m[support in the scanf family.
%ssupport in strptime (strftime already supported it).
pthread_mutex_tafter it's been destroyed will be detected at runtime and reported as a FORTIFY failure.
DIR*to libc is now detected at runtime and reported as a FORTIFY failure.
New libc functions in O (API level 26):
New libc behavior in O (API level 26):
pthread_tto libc is now detected at runtime and reported as a FORTIFY failure. Most commonly this is a result of confusing
New libc functions in N (API level 24):
_FILE_OFFSET_BITS=64support in bionic (8)
New libc behavior in N (API level 24):
sem_waitnow returns EINTR when interrupted by a signal.
New libc functions in M (API level 23):
New libc functions in L (API level 21):
New libc functions in K (API level 19):
New libc functions in J-MR2 (API level 18):
New libc functions in J-MR1 (API level 17):
New libc functions in J (API level 16):
libc function count over time:
|OS||API level||Function count|
Data collected by:
ndk-r21$ for i in `ls -1v platforms/android-*/arch-arm/usr/lib/libc.so` ; do \ echo $i; nm $i | grep -w T | wc -l ; done
Current libm symbols: https://android.googlesource.com/platform/bionic/+/master/libm/libm.map.txt
0 remaining missing C11/POSIX libm functions.
New libm functions in O (API level 26):
New libm functions in M (API level 23):
New libm functions in L (API level 21):
New libm functions in J-MR2 (API level 18):
Most bionic bug fixes and improvements have been made without checks for the app's
targetSdkVersion. As of O there were exactly two exceptions, but there are likely to be more in future because of Project Treble.
As part of a long-term goal to remove the global thread list, and in an attempt to flush out racy code, we changed how an invalid
pthread_t is handled. For
pthread_kill, instead of returning ESRCH when passed an invalid
pthread_t, if you‘re targeting O or above, they’ll abort with the message “attempt to use invalid pthread_t”.
Note that this doesn't change behavior as much as you might think: the old lookup only held the global thread list lock for the duration of the lookup, so there was still a race between that and the dereference in the caller, given that callers actually need the tid to pass to some syscall or other, and sometimes update fields in the
pthread_internal_t struct too.
We can‘t check a thread’s tid against 0 to see whether a
pthread_t is still valid because a dead thread gets its thread struct unmapped along with its stack, so the dereference isn't safe.
To fix your code, taking the affected functions one by one:
pthread_setschedparam should be fine. Unsafe calls to those seem highly unlikely.
pthread_detach callers probably want to switch to
pthread_attr_setdetachstate instead, or use
pthread_detach(pthread_self()); from the new thread's start routine rather than calling detach in the parent.
pthread_join calls should be safe anyway, because a joinable thread won‘t actually exit and unmap until it’s joined. If you‘re joining an unjoinable thread, the fix is to stop marking it detached. If you’re joining an already-joined thread, you need to rethink your design!
pthread_kill calls aren‘t portably fixable. (And are obviously inherently non-portable as-is.) The best alternative on Android is to use
pthread_gettid_np at some point that you know the thread to be alive, and then call
tgkill with signal 0 (which checks whether a process exists rather than actually sending a signal). That’s still not completely safe because if you're too late the tid may have been reused, but your code is inherently unsafe without a redesign anyway.
POSIX says that
sem_wait can be interrupted by delivery of a signal. This wasn't historically true in Android, and when we fixed this bug we found that existing code relied on the old behavior. To preserve compatibility,
sem_wait can only return EINTR on Android if the app targets N or later.
_FORTIFY_SOURCE macro can be used to enable extra automatic bounds checking for common libc functions. If a buffer overrun is detected, the program is safely aborted as in this example.
Note that in recent releases Android's FORTIFY has been extended to cover other issues. It can now detect, for example, passing
O_CREAT to open(2) without specifying a mode. It also performs some checking regardless of whether the caller was built with FORTIFY enabled. In P, for example, calling a
pthread_mutex_ function on a destroyed mutex, calling a
<dirent.h> function on a null pointer, using
%n with the printf(3) family, or using the scanf(3)
m modifier incorrectly will all result in FORTIFY failures even for code not built with FORTIFY.
More background information is available in our FORTIFY in Android blog post.
The Android platform is built with
-D_FORTIFY_SOURCE=2, but NDK users need to manually enable FORTIFY by setting that themselves in whatever build system they‘re using. The exact subset of FORTIFY available to NDK users will depend on their target ABI level, because when a FORTIFY check can’t be guaranteed at compile-time, a call to a run-time
_chk function is added.