am 9f3a11ed: am cddb15b8: am b4e74db7: am 3fa71b8e: Merge "Remove sshd."

* commit '9f3a11edde07af068217581cf11c004f1cdca3f0':
diff --git a/debuggerd/crasher.c b/debuggerd/crasher.c
index e11d9af..9df3c64 100644
--- a/debuggerd/crasher.c
+++ b/debuggerd/crasher.c
@@ -7,6 +7,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <sys/cdefs.h>
+#include <sys/mman.h>
 #include <sys/ptrace.h>
 #include <sys/socket.h>
 #include <sys/wait.h>
@@ -156,6 +157,10 @@
         return EXIT_SUCCESS;
     } else if (!strcmp(arg, "heap-usage")) {
         abuse_heap();
+    } else if (!strcmp(arg, "SIGSEGV-unmapped")) {
+        char* map = mmap(NULL, sizeof(int), PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+        munmap(map, sizeof(int));
+        map[0] = '8';
     }
 
     fprintf(stderr, "%s OP\n", __progname);
@@ -175,6 +180,7 @@
     fprintf(stderr, "  SIGPIPE               cause a SIGPIPE\n");
     fprintf(stderr, "  SIGSEGV               cause a SIGSEGV at address 0x0 (synonym: crash)\n");
     fprintf(stderr, "  SIGSEGV-non-null      cause a SIGSEGV at a non-zero address\n");
+    fprintf(stderr, "  SIGSEGV-unmapped      mmap/munmap a region of memory and then attempt to access it\n");
     fprintf(stderr, "  SIGTRAP               cause a SIGTRAP\n");
     fprintf(stderr, "prefix any of the above with 'thread-' to not run\n");
     fprintf(stderr, "on the process' main thread.\n");
diff --git a/debuggerd/tombstone.cpp b/debuggerd/tombstone.cpp
index dea016d..f41166b 100755
--- a/debuggerd/tombstone.cpp
+++ b/debuggerd/tombstone.cpp
@@ -329,10 +329,11 @@
 }
 
 static void dump_map(log_t* log, const backtrace_map_t* map, bool fault_addr) {
-  _LOG(log, logtype::MAPS, "%s%" PRIPTR "-%" PRIPTR " %c%c%c %s\n",
-         (fault_addr? "--->" : "    "), map->start, map->end,
+  _LOG(log, logtype::MAPS, "%s%" PRIPTR "-%" PRIPTR " %c%c%c  %7" PRIdPTR "  %s\n",
+         (fault_addr? "--->" : "    "), map->start, map->end - 1,
          (map->flags & PROT_READ) ? 'r' : '-', (map->flags & PROT_WRITE) ? 'w' : '-',
-         (map->flags & PROT_EXEC) ? 'x' : '-', map->name.c_str());
+         (map->flags & PROT_EXEC) ? 'x' : '-',
+         (map->end - map->start), map->name.c_str());
 }
 
 static void dump_nearby_maps(BacktraceMap* map, log_t* log, pid_t tid) {
@@ -342,28 +343,31 @@
     _LOG(log, logtype::MAPS, "cannot get siginfo for %d: %s\n", tid, strerror(errno));
     return;
   }
-  if (!signal_has_si_addr(si.si_signo)) {
-    return;
-  }
 
+  bool is_running = (si.si_code == SI_USER);
   uintptr_t addr = reinterpret_cast<uintptr_t>(si.si_addr);
   addr &= ~0xfff;     // round to 4K page boundary
-  if (addr == 0) {    // null-pointer deref
+  if (!is_running && addr == 0) {    // null-pointer deref
     return;
   }
 
-  _LOG(log, logtype::MAPS, "\nmemory map: (fault address prefixed with --->)\n");
+  _LOG(log, logtype::MAPS, "\nmemory map: %s\n", is_running? "" : "(fault address prefixed with --->)");
 
-  bool found_map = false;
-  for (BacktraceMap::const_iterator it = map->begin(); it != map->end(); ++it) {
-    bool in_map = addr >= (*it).start && addr < (*it).end;
-    dump_map(log, &*it, in_map);
-    if(in_map) {
-      found_map = true;
-    }
+  if(!is_running && (addr < map->begin()->start)) {
+    _LOG(log, logtype::MAPS, "--->Fault address falls at %" PRIPTR " before any mapped regions\n", addr);
   }
-  if(!found_map) {
-    _LOG(log, logtype::ERROR, "\nFault address was not in any map!");
+
+  BacktraceMap::const_iterator prev = map->begin();
+  for (BacktraceMap::const_iterator it = map->begin(); it != map->end(); ++it) {
+    if (addr >= (*prev).end && addr < (*it).start) {
+      _LOG(log, logtype::MAPS, "--->Fault address falls at %" PRIPTR " between mapped regions\n", addr);
+    }
+    prev = it;
+    bool in_map = !is_running && (addr >= (*it).start) && (addr < (*it).end);
+    dump_map(log, &*it, in_map);
+  }
+  if (!is_running && (addr >= (*prev).end)) {
+    _LOG(log, logtype::MAPS, "--->Fault address falls at %" PRIPTR " after any mapped regions\n", addr);
   }
 }
 
diff --git a/include/cutils/atomic.h b/include/cutils/atomic.h
index 1787e34..b9b18c4 100644
--- a/include/cutils/atomic.h
+++ b/include/cutils/atomic.h
@@ -25,8 +25,20 @@
 #endif
 
 /*
- * A handful of basic atomic operations.  The appropriate pthread
- * functions should be used instead of these whenever possible.
+ * A handful of basic atomic operations.
+ * THESE ARE HERE FOR LEGACY REASONS ONLY.  AVOID.
+ *
+ * PREFERRED ALTERNATIVES:
+ * - Use C++/C/pthread locks/mutexes whenever there is not a
+ *   convincing reason to do otherwise.  Note that very clever and
+ *   complicated, but correct, lock-free code is often slower than
+ *   using locks, especially where nontrivial data structures
+ *   are involved.
+ * - C11 stdatomic.h.
+ * - Where supported, C++11 std::atomic<T> .
+ *
+ * PLEASE STOP READING HERE UNLESS YOU ARE TRYING TO UNDERSTAND
+ * OR UPDATE OLD CODE.
  *
  * The "acquire" and "release" terms can be defined intuitively in terms
  * of the placement of memory barriers in a simple lock implementation:
@@ -74,6 +86,17 @@
 /*
  * Perform an atomic load with "acquire" or "release" ordering.
  *
+ * Note that the notion of a "release" ordering for a load does not
+ * really fit into the C11 or C++11 memory model.  The extra ordering
+ * is normally observable only by code using memory_order_relaxed
+ * atomics, or data races.  In the rare cases in which such ordering
+ * is called for, use memory_order_relaxed atomics and a leading
+ * atomic_thread_fence (typically with memory_order_acquire,
+ * not memory_order_release!) instead.  If you do not understand
+ * this comment, you are in the vast majority, and should not be
+ * using release loads or replacing them with anything other than
+ * locks or default sequentially consistent atomics.
+ *
  * This is only necessary if you need the memory barrier.  A 32-bit read
  * from a 32-bit aligned address is atomic on all supported platforms.
  */
@@ -88,6 +111,14 @@
 /*
  * Perform an atomic store with "acquire" or "release" ordering.
  *
+ * Note that the notion of a "acquire" ordering for a store does not
+ * really fit into the C11 or C++11 memory model.  The extra ordering
+ * is normally observable only by code using memory_order_relaxed
+ * atomics, or data races.  In the rare cases in which such ordering
+ * is called for, use memory_order_relaxed atomics and a trailing
+ * atomic_thread_fence (typically with memory_order_release,
+ * not memory_order_acquire!) instead.
+ *
  * This is only necessary if you need the memory barrier.  A 32-bit write
  * to a 32-bit aligned address is atomic on all supported platforms.
  */
diff --git a/rootdir/init.rc b/rootdir/init.rc
index b3ccae1..1bbc7ab 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -255,6 +255,7 @@
     mkdir /data/misc/bluetooth 0770 system system
     mkdir /data/misc/keystore 0700 keystore keystore
     mkdir /data/misc/keychain 0771 system system
+    mkdir /data/misc/net 0750 root shell
     mkdir /data/misc/radio 0770 system radio
     mkdir /data/misc/sms 0770 system radio
     mkdir /data/misc/zoneinfo 0775 system system