Home | History | Annotate | Download | only in bionic
      1 /*
      2  * Copyright (C) 2008 The Android Open Source Project
      3  * All rights reserved.
      4  *
      5  * Redistribution and use in source and binary forms, with or without
      6  * modification, are permitted provided that the following conditions
      7  * are met:
      8  *  * Redistributions of source code must retain the above copyright
      9  *    notice, this list of conditions and the following disclaimer.
     10  *  * Redistributions in binary form must reproduce the above copyright
     11  *    notice, this list of conditions and the following disclaimer in
     12  *    the documentation and/or other materials provided with the
     13  *    distribution.
     14  *
     15  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
     16  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
     17  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
     18  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
     19  * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
     20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
     21  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
     22  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
     23  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
     24  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
     25  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     26  * SUCH DAMAGE.
     27  */
     28 
     29 #include <assert.h>
     30 #include <errno.h>
     31 #include <fcntl.h>
     32 #include <limits.h>
     33 #include <malloc.h>
     34 #include <memory.h>
     35 #include <pthread.h>
     36 #include <signal.h>
     37 #include <stdint.h>
     38 #include <stdio.h>
     39 #include <stdlib.h>
     40 #include <sys/atomics.h>
     41 #include <sys/mman.h>
     42 #include <sys/prctl.h>
     43 #include <sys/stat.h>
     44 #include <sys/types.h>
     45 #include <time.h>
     46 #include <unistd.h>
     47 
     48 #include "bionic_atomic_inline.h"
     49 #include "bionic_futex.h"
     50 #include "bionic_pthread.h"
     51 #include "bionic_tls.h"
     52 #include "pthread_internal.h"
     53 #include "thread_private.h"
     54 
     55 extern void pthread_debug_mutex_lock_check(pthread_mutex_t *mutex);
     56 extern void pthread_debug_mutex_unlock_check(pthread_mutex_t *mutex);
     57 
     58 extern int  __pthread_clone(int (*fn)(void*), void *child_stack, int flags, void *arg);
     59 extern void _exit_with_stack_teardown(void * stackBase, int stackSize, int retCode);
     60 extern void _exit_thread(int  retCode);
     61 extern int  __set_errno(int);
     62 
     63 int  __futex_wake_ex(volatile void *ftx, int pshared, int val)
     64 {
     65     return __futex_syscall3(ftx, pshared ? FUTEX_WAKE : FUTEX_WAKE_PRIVATE, val);
     66 }
     67 
     68 int  __futex_wait_ex(volatile void *ftx, int pshared, int val, const struct timespec *timeout)
     69 {
     70     return __futex_syscall4(ftx, pshared ? FUTEX_WAIT : FUTEX_WAIT_PRIVATE, val, timeout);
     71 }
     72 
     73 #define  __likely(cond)    __builtin_expect(!!(cond), 1)
     74 #define  __unlikely(cond)  __builtin_expect(!!(cond), 0)
     75 
     76 #ifdef __i386__
     77 #define ATTRIBUTES __attribute__((noinline)) __attribute__((fastcall))
     78 #else
     79 #define ATTRIBUTES __attribute__((noinline))
     80 #endif
     81 
     82 void ATTRIBUTES _thread_created_hook(pid_t thread_id);
     83 
     84 static const int kPthreadInitFailed = 1;
     85 
     86 #define PTHREAD_ATTR_FLAG_DETACHED      0x00000001
     87 #define PTHREAD_ATTR_FLAG_USER_STACK    0x00000002
     88 
     89 #define DEFAULT_STACKSIZE (1024 * 1024)
     90 
     91 static pthread_mutex_t mmap_lock = PTHREAD_MUTEX_INITIALIZER;
     92 
     93 
     94 static const pthread_attr_t gDefaultPthreadAttr = {
     95     .flags = 0,
     96     .stack_base = NULL,
     97     .stack_size = DEFAULT_STACKSIZE,
     98     .guard_size = PAGE_SIZE,
     99     .sched_policy = SCHED_NORMAL,
    100     .sched_priority = 0
    101 };
    102 
    103 static pthread_internal_t* gThreadList = NULL;
    104 static pthread_mutex_t gThreadListLock = PTHREAD_MUTEX_INITIALIZER;
    105 static pthread_mutex_t gDebuggerNotificationLock = PTHREAD_MUTEX_INITIALIZER;
    106 
    107 
    108 static void
    109 _pthread_internal_free(pthread_internal_t* thread)
    110 {
    111     if (thread != NULL) {
    112         free(thread);
    113     }
    114 }
    115 
    116 
    117 static void
    118 _pthread_internal_remove_locked( pthread_internal_t*  thread )
    119 {
    120     thread->next->prev = thread->prev;
    121     thread->prev[0]    = thread->next;
    122 }
    123 
    124 static void
    125 _pthread_internal_remove( pthread_internal_t*  thread )
    126 {
    127     pthread_mutex_lock(&gThreadListLock);
    128     _pthread_internal_remove_locked(thread);
    129     pthread_mutex_unlock(&gThreadListLock);
    130 }
    131 
    132 __LIBC_ABI_PRIVATE__ void
    133 _pthread_internal_add(pthread_internal_t* thread)
    134 {
    135     pthread_mutex_lock(&gThreadListLock);
    136 
    137     thread->prev = &gThreadList;
    138     thread->next = *(thread->prev);
    139     if (thread->next != NULL) {
    140         thread->next->prev = &thread->next;
    141     }
    142     *(thread->prev) = thread;
    143 
    144     pthread_mutex_unlock(&gThreadListLock);
    145 }
    146 
    147 __LIBC_ABI_PRIVATE__ pthread_internal_t*
    148 __get_thread(void)
    149 {
    150     void**  tls = (void**)__get_tls();
    151 
    152     return  (pthread_internal_t*) tls[TLS_SLOT_THREAD_ID];
    153 }
    154 
    155 
    156 void*
    157 __get_stack_base(int  *p_stack_size)
    158 {
    159     pthread_internal_t*  thread = __get_thread();
    160 
    161     *p_stack_size = thread->attr.stack_size;
    162     return thread->attr.stack_base;
    163 }
    164 
    165 
    166 void  __init_tls(void**  tls, void*  thread)
    167 {
    168     int  nn;
    169 
    170     ((pthread_internal_t*)thread)->tls = tls;
    171 
    172     // slot 0 must point to the tls area, this is required by the implementation
    173     // of the x86 Linux kernel thread-local-storage
    174     tls[TLS_SLOT_SELF]      = (void*)tls;
    175     tls[TLS_SLOT_THREAD_ID] = thread;
    176     for (nn = TLS_SLOT_ERRNO; nn < BIONIC_TLS_SLOTS; nn++)
    177        tls[nn] = 0;
    178 
    179     __set_tls( (void*)tls );
    180 }
    181 
    182 
    183 /*
    184  * This trampoline is called from the assembly _pthread_clone() function.
    185  */
    186 void __thread_entry(int (*func)(void*), void *arg, void **tls)
    187 {
    188     // Wait for our creating thread to release us. This lets it have time to
    189     // notify gdb about this thread before we start doing anything.
    190     //
    191     // This also provides the memory barrier needed to ensure that all memory
    192     // accesses previously made by the creating thread are visible to us.
    193     pthread_mutex_t* start_mutex = (pthread_mutex_t*) &tls[TLS_SLOT_SELF];
    194     pthread_mutex_lock(start_mutex);
    195     pthread_mutex_destroy(start_mutex);
    196 
    197     pthread_internal_t* thread = (pthread_internal_t*) tls[TLS_SLOT_THREAD_ID];
    198     __init_tls(tls, thread);
    199 
    200     if ((thread->internal_flags & kPthreadInitFailed) != 0) {
    201         pthread_exit(NULL);
    202     }
    203 
    204     int result = func(arg);
    205     pthread_exit((void*) result);
    206 }
    207 
    208 #include <private/logd.h>
    209 
    210 __LIBC_ABI_PRIVATE__
    211 int _init_thread(pthread_internal_t* thread, pid_t kernel_id, pthread_attr_t* attr,
    212                  void* stack_base, bool add_to_thread_list)
    213 {
    214     int error = 0;
    215 
    216     if (attr == NULL) {
    217         thread->attr = gDefaultPthreadAttr;
    218     } else {
    219         thread->attr = *attr;
    220     }
    221     thread->attr.stack_base = stack_base;
    222     thread->kernel_id       = kernel_id;
    223 
    224     // Make a note of whether the user supplied this stack (so we know whether or not to free it).
    225     if (attr->stack_base == stack_base) {
    226         thread->attr.flags |= PTHREAD_ATTR_FLAG_USER_STACK;
    227     }
    228 
    229     // Set the scheduling policy/priority of the thread.
    230     if (thread->attr.sched_policy != SCHED_NORMAL) {
    231         struct sched_param param;
    232         param.sched_priority = thread->attr.sched_priority;
    233         if (sched_setscheduler(kernel_id, thread->attr.sched_policy, &param) == -1) {
    234             // For back compat reasons, we just warn about possible invalid sched_policy
    235             const char* msg = "pthread_create sched_setscheduler call failed: %s\n";
    236             __libc_android_log_print(ANDROID_LOG_WARN, "libc", msg, strerror(errno));
    237         }
    238     }
    239 
    240     pthread_cond_init(&thread->join_cond, NULL);
    241     thread->join_count = 0;
    242     thread->cleanup_stack = NULL;
    243 
    244     if (add_to_thread_list) {
    245         _pthread_internal_add(thread);
    246     }
    247 
    248     return error;
    249 }
    250 
    251 static void *mkstack(size_t size, size_t guard_size)
    252 {
    253     pthread_mutex_lock(&mmap_lock);
    254 
    255     int prot = PROT_READ | PROT_WRITE;
    256     int flags = MAP_PRIVATE | MAP_ANONYMOUS | MAP_NORESERVE;
    257     void* stack = mmap(NULL, size, prot, flags, -1, 0);
    258     if (stack == MAP_FAILED) {
    259         stack = NULL;
    260         goto done;
    261     }
    262 
    263     if (mprotect(stack, guard_size, PROT_NONE) == -1) {
    264         munmap(stack, size);
    265         stack = NULL;
    266         goto done;
    267     }
    268 
    269 done:
    270     pthread_mutex_unlock(&mmap_lock);
    271     return stack;
    272 }
    273 
    274 /*
    275  * Create a new thread. The thread's stack is laid out like so:
    276  *
    277  * +---------------------------+
    278  * |     pthread_internal_t    |
    279  * +---------------------------+
    280  * |                           |
    281  * |          TLS area         |
    282  * |                           |
    283  * +---------------------------+
    284  * |                           |
    285  * .                           .
    286  * .         stack area        .
    287  * .                           .
    288  * |                           |
    289  * +---------------------------+
    290  * |         guard page        |
    291  * +---------------------------+
    292  *
    293  *  note that TLS[0] must be a pointer to itself, this is required
    294  *  by the thread-local storage implementation of the x86 Linux
    295  *  kernel, where the TLS pointer is read by reading fs:[0]
    296  */
    297 int pthread_create(pthread_t *thread_out, pthread_attr_t const * attr,
    298                    void *(*start_routine)(void *), void * arg)
    299 {
    300     int old_errno = errno;
    301 
    302     /* this will inform the rest of the C library that at least one thread
    303      * was created. this will enforce certain functions to acquire/release
    304      * locks (e.g. atexit()) to protect shared global structures.
    305      *
    306      * this works because pthread_create() is not called by the C library
    307      * initialization routine that sets up the main thread's data structures.
    308      */
    309     __isthreaded = 1;
    310 
    311     pthread_internal_t* thread = calloc(sizeof(*thread), 1);
    312     if (thread == NULL) {
    313         return ENOMEM;
    314     }
    315 
    316     if (attr == NULL) {
    317         attr = &gDefaultPthreadAttr;
    318     }
    319 
    320     // make sure the stack is PAGE_SIZE aligned
    321     size_t stack_size = (attr->stack_size + (PAGE_SIZE-1)) & ~(PAGE_SIZE-1);
    322     uint8_t* stack = attr->stack_base;
    323     if (stack == NULL) {
    324         stack = mkstack(stack_size, attr->guard_size);
    325         if (stack == NULL) {
    326             _pthread_internal_free(thread);
    327             return ENOMEM;
    328         }
    329     }
    330 
    331     // Make room for TLS
    332     void** tls = (void**)(stack + stack_size - BIONIC_TLS_SLOTS*sizeof(void*));
    333 
    334     // Create a mutex for the thread in TLS_SLOT_SELF to wait on once it starts so we can keep
    335     // it from doing anything until after we notify the debugger about it
    336     //
    337     // This also provides the memory barrier we need to ensure that all
    338     // memory accesses previously performed by this thread are visible to
    339     // the new thread.
    340     pthread_mutex_t* start_mutex = (pthread_mutex_t*) &tls[TLS_SLOT_SELF];
    341     pthread_mutex_init(start_mutex, NULL);
    342     pthread_mutex_lock(start_mutex);
    343 
    344     tls[TLS_SLOT_THREAD_ID] = thread;
    345 
    346     int flags = CLONE_FILES | CLONE_FS | CLONE_VM | CLONE_SIGHAND |
    347                 CLONE_THREAD | CLONE_SYSVSEM | CLONE_DETACHED;
    348     int tid = __pthread_clone((int(*)(void*))start_routine, tls, flags, arg);
    349 
    350     if (tid < 0) {
    351         int clone_errno = errno;
    352         pthread_mutex_unlock(start_mutex);
    353         if (stack != attr->stack_base) {
    354             munmap(stack, stack_size);
    355         }
    356         _pthread_internal_free(thread);
    357         errno = old_errno;
    358         return clone_errno;
    359     }
    360 
    361     int init_errno = _init_thread(thread, tid, (pthread_attr_t*) attr, stack, true);
    362     if (init_errno != 0) {
    363         // Mark the thread detached and let its __thread_entry run to
    364         // completion. (It'll just exit immediately, cleaning up its resources.)
    365         thread->internal_flags |= kPthreadInitFailed;
    366         thread->attr.flags |= PTHREAD_ATTR_FLAG_DETACHED;
    367         pthread_mutex_unlock(start_mutex);
    368         errno = old_errno;
    369         return init_errno;
    370     }
    371 
    372     // Notify any debuggers about the new thread.
    373     pthread_mutex_lock(&gDebuggerNotificationLock);
    374     _thread_created_hook(tid);
    375     pthread_mutex_unlock(&gDebuggerNotificationLock);
    376 
    377     // Publish the pthread_t and let the thread run.
    378     *thread_out = (pthread_t) thread;
    379     pthread_mutex_unlock(start_mutex);
    380 
    381     return 0;
    382 }
    383 
    384 
    385 int pthread_attr_init(pthread_attr_t * attr)
    386 {
    387     *attr = gDefaultPthreadAttr;
    388     return 0;
    389 }
    390 
    391 int pthread_attr_destroy(pthread_attr_t * attr)
    392 {
    393     memset(attr, 0x42, sizeof(pthread_attr_t));
    394     return 0;
    395 }
    396 
    397 int pthread_attr_setdetachstate(pthread_attr_t * attr, int state)
    398 {
    399     if (state == PTHREAD_CREATE_DETACHED) {
    400         attr->flags |= PTHREAD_ATTR_FLAG_DETACHED;
    401     } else if (state == PTHREAD_CREATE_JOINABLE) {
    402         attr->flags &= ~PTHREAD_ATTR_FLAG_DETACHED;
    403     } else {
    404         return EINVAL;
    405     }
    406     return 0;
    407 }
    408 
    409 int pthread_attr_getdetachstate(pthread_attr_t const * attr, int * state)
    410 {
    411     *state = (attr->flags & PTHREAD_ATTR_FLAG_DETACHED)
    412            ? PTHREAD_CREATE_DETACHED
    413            : PTHREAD_CREATE_JOINABLE;
    414     return 0;
    415 }
    416 
    417 int pthread_attr_setschedpolicy(pthread_attr_t * attr, int policy)
    418 {
    419     attr->sched_policy = policy;
    420     return 0;
    421 }
    422 
    423 int pthread_attr_getschedpolicy(pthread_attr_t const * attr, int * policy)
    424 {
    425     *policy = attr->sched_policy;
    426     return 0;
    427 }
    428 
    429 int pthread_attr_setschedparam(pthread_attr_t * attr, struct sched_param const * param)
    430 {
    431     attr->sched_priority = param->sched_priority;
    432     return 0;
    433 }
    434 
    435 int pthread_attr_getschedparam(pthread_attr_t const * attr, struct sched_param * param)
    436 {
    437     param->sched_priority = attr->sched_priority;
    438     return 0;
    439 }
    440 
    441 int pthread_attr_setstacksize(pthread_attr_t * attr, size_t stack_size)
    442 {
    443     if ((stack_size & (PAGE_SIZE - 1) || stack_size < PTHREAD_STACK_MIN)) {
    444         return EINVAL;
    445     }
    446     attr->stack_size = stack_size;
    447     return 0;
    448 }
    449 
    450 int pthread_attr_getstacksize(pthread_attr_t const * attr, size_t * stack_size)
    451 {
    452     *stack_size = attr->stack_size;
    453     return 0;
    454 }
    455 
    456 int pthread_attr_setstackaddr(pthread_attr_t * attr, void * stack_addr)
    457 {
    458 #if 1
    459     // It's not clear if this is setting the top or bottom of the stack, so don't handle it for now.
    460     return ENOSYS;
    461 #else
    462     if ((uint32_t)stack_addr & (PAGE_SIZE - 1)) {
    463         return EINVAL;
    464     }
    465     attr->stack_base = stack_addr;
    466     return 0;
    467 #endif
    468 }
    469 
    470 int pthread_attr_getstackaddr(pthread_attr_t const * attr, void ** stack_addr)
    471 {
    472     *stack_addr = (char*)attr->stack_base + attr->stack_size;
    473     return 0;
    474 }
    475 
    476 int pthread_attr_setstack(pthread_attr_t * attr, void * stack_base, size_t stack_size)
    477 {
    478     if ((stack_size & (PAGE_SIZE - 1) || stack_size < PTHREAD_STACK_MIN)) {
    479         return EINVAL;
    480     }
    481     if ((uint32_t)stack_base & (PAGE_SIZE - 1)) {
    482         return EINVAL;
    483     }
    484     attr->stack_base = stack_base;
    485     attr->stack_size = stack_size;
    486     return 0;
    487 }
    488 
    489 int pthread_attr_getstack(pthread_attr_t const * attr, void ** stack_base, size_t * stack_size)
    490 {
    491     *stack_base = attr->stack_base;
    492     *stack_size = attr->stack_size;
    493     return 0;
    494 }
    495 
    496 int pthread_attr_setguardsize(pthread_attr_t * attr, size_t guard_size)
    497 {
    498     if (guard_size & (PAGE_SIZE - 1) || guard_size < PAGE_SIZE) {
    499         return EINVAL;
    500     }
    501 
    502     attr->guard_size = guard_size;
    503     return 0;
    504 }
    505 
    506 int pthread_attr_getguardsize(pthread_attr_t const * attr, size_t * guard_size)
    507 {
    508     *guard_size = attr->guard_size;
    509     return 0;
    510 }
    511 
    512 int pthread_getattr_np(pthread_t thid, pthread_attr_t * attr)
    513 {
    514     pthread_internal_t * thread = (pthread_internal_t *)thid;
    515     *attr = thread->attr;
    516     return 0;
    517 }
    518 
    519 int pthread_attr_setscope(pthread_attr_t *attr, int  scope)
    520 {
    521     if (scope == PTHREAD_SCOPE_SYSTEM)
    522         return 0;
    523     if (scope == PTHREAD_SCOPE_PROCESS)
    524         return ENOTSUP;
    525 
    526     return EINVAL;
    527 }
    528 
    529 int pthread_attr_getscope(pthread_attr_t const *attr)
    530 {
    531     return PTHREAD_SCOPE_SYSTEM;
    532 }
    533 
    534 
    535 /* CAVEAT: our implementation of pthread_cleanup_push/pop doesn't support C++ exceptions
    536  *         and thread cancelation
    537  */
    538 
    539 void __pthread_cleanup_push( __pthread_cleanup_t*      c,
    540                              __pthread_cleanup_func_t  routine,
    541                              void*                     arg )
    542 {
    543     pthread_internal_t*  thread = __get_thread();
    544 
    545     c->__cleanup_routine  = routine;
    546     c->__cleanup_arg      = arg;
    547     c->__cleanup_prev     = thread->cleanup_stack;
    548     thread->cleanup_stack = c;
    549 }
    550 
    551 void __pthread_cleanup_pop( __pthread_cleanup_t*  c, int  execute )
    552 {
    553     pthread_internal_t*  thread = __get_thread();
    554 
    555     thread->cleanup_stack = c->__cleanup_prev;
    556     if (execute)
    557         c->__cleanup_routine(c->__cleanup_arg);
    558 }
    559 
    560 /* used by pthread_exit() to clean all TLS keys of the current thread */
    561 static void pthread_key_clean_all(void);
    562 
    563 void pthread_exit(void * retval)
    564 {
    565     pthread_internal_t*  thread     = __get_thread();
    566     void*                stack_base = thread->attr.stack_base;
    567     int                  stack_size = thread->attr.stack_size;
    568     int                  user_stack = (thread->attr.flags & PTHREAD_ATTR_FLAG_USER_STACK) != 0;
    569     sigset_t mask;
    570 
    571     // call the cleanup handlers first
    572     while (thread->cleanup_stack) {
    573         __pthread_cleanup_t*  c = thread->cleanup_stack;
    574         thread->cleanup_stack   = c->__cleanup_prev;
    575         c->__cleanup_routine(c->__cleanup_arg);
    576     }
    577 
    578     // call the TLS destructors, it is important to do that before removing this
    579     // thread from the global list. this will ensure that if someone else deletes
    580     // a TLS key, the corresponding value will be set to NULL in this thread's TLS
    581     // space (see pthread_key_delete)
    582     pthread_key_clean_all();
    583 
    584     // if the thread is detached, destroy the pthread_internal_t
    585     // otherwise, keep it in memory and signal any joiners
    586     if (thread->attr.flags & PTHREAD_ATTR_FLAG_DETACHED) {
    587         _pthread_internal_remove(thread);
    588         _pthread_internal_free(thread);
    589     } else {
    590         pthread_mutex_lock(&gThreadListLock);
    591 
    592        /* make sure that the thread struct doesn't have stale pointers to a stack that
    593         * will be unmapped after the exit call below.
    594         */
    595         if (!user_stack) {
    596             thread->attr.stack_base = NULL;
    597             thread->attr.stack_size = 0;
    598             thread->tls = NULL;
    599         }
    600 
    601        /* the join_count field is used to store the number of threads waiting for
    602         * the termination of this thread with pthread_join(),
    603         *
    604         * if it is positive we need to signal the waiters, and we do not touch
    605         * the count (it will be decremented by the waiters, the last one will
    606         * also remove/free the thread structure
    607         *
    608         * if it is zero, we set the count value to -1 to indicate that the
    609         * thread is in 'zombie' state: it has stopped executing, and its stack
    610         * is gone (as well as its TLS area). when another thread calls pthread_join()
    611         * on it, it will immediately free the thread and return.
    612         */
    613         thread->return_value = retval;
    614         if (thread->join_count > 0) {
    615             pthread_cond_broadcast(&thread->join_cond);
    616         } else {
    617             thread->join_count = -1;  /* zombie thread */
    618         }
    619         pthread_mutex_unlock(&gThreadListLock);
    620     }
    621 
    622     sigfillset(&mask);
    623     sigdelset(&mask, SIGSEGV);
    624     (void)sigprocmask(SIG_SETMASK, &mask, (sigset_t *)NULL);
    625 
    626     // destroy the thread stack
    627     if (user_stack)
    628         _exit_thread((int)retval);
    629     else
    630         _exit_with_stack_teardown(stack_base, stack_size, (int)retval);
    631 }
    632 
    633 int pthread_join(pthread_t thid, void ** ret_val)
    634 {
    635     pthread_internal_t*  thread = (pthread_internal_t*)thid;
    636     int                  count;
    637 
    638     // check that the thread still exists and is not detached
    639     pthread_mutex_lock(&gThreadListLock);
    640 
    641     for (thread = gThreadList; thread != NULL; thread = thread->next)
    642         if (thread == (pthread_internal_t*)thid)
    643             goto FoundIt;
    644 
    645     pthread_mutex_unlock(&gThreadListLock);
    646     return ESRCH;
    647 
    648 FoundIt:
    649     if (thread->attr.flags & PTHREAD_ATTR_FLAG_DETACHED) {
    650         pthread_mutex_unlock(&gThreadListLock);
    651         return EINVAL;
    652     }
    653 
    654    /* wait for thread death when needed
    655     *
    656     * if the 'join_count' is negative, this is a 'zombie' thread that
    657     * is already dead and without stack/TLS
    658     *
    659     * otherwise, we need to increment 'join-count' and wait to be signaled
    660     */
    661    count = thread->join_count;
    662     if (count >= 0) {
    663         thread->join_count += 1;
    664         pthread_cond_wait( &thread->join_cond, &gThreadListLock );
    665         count = --thread->join_count;
    666     }
    667     if (ret_val)
    668         *ret_val = thread->return_value;
    669 
    670     /* remove thread descriptor when we're the last joiner or when the
    671      * thread was already a zombie.
    672      */
    673     if (count <= 0) {
    674         _pthread_internal_remove_locked(thread);
    675         _pthread_internal_free(thread);
    676     }
    677     pthread_mutex_unlock(&gThreadListLock);
    678     return 0;
    679 }
    680 
    681 int  pthread_detach( pthread_t  thid )
    682 {
    683     pthread_internal_t*  thread;
    684     int                  result = 0;
    685     int                  flags;
    686 
    687     pthread_mutex_lock(&gThreadListLock);
    688     for (thread = gThreadList; thread != NULL; thread = thread->next)
    689         if (thread == (pthread_internal_t*)thid)
    690             goto FoundIt;
    691 
    692     result = ESRCH;
    693     goto Exit;
    694 
    695 FoundIt:
    696     do {
    697         flags = thread->attr.flags;
    698 
    699         if ( flags & PTHREAD_ATTR_FLAG_DETACHED ) {
    700             /* thread is not joinable ! */
    701             result = EINVAL;
    702             goto Exit;
    703         }
    704     }
    705     while ( __bionic_cmpxchg( flags, flags | PTHREAD_ATTR_FLAG_DETACHED,
    706                               (volatile int*)&thread->attr.flags ) != 0 );
    707 Exit:
    708     pthread_mutex_unlock(&gThreadListLock);
    709     return result;
    710 }
    711 
    712 pthread_t pthread_self(void)
    713 {
    714     return (pthread_t)__get_thread();
    715 }
    716 
    717 int pthread_equal(pthread_t one, pthread_t two)
    718 {
    719     return (one == two ? 1 : 0);
    720 }
    721 
    722 int pthread_getschedparam(pthread_t thid, int * policy,
    723                           struct sched_param * param)
    724 {
    725     int  old_errno = errno;
    726 
    727     pthread_internal_t * thread = (pthread_internal_t *)thid;
    728     int err = sched_getparam(thread->kernel_id, param);
    729     if (!err) {
    730         *policy = sched_getscheduler(thread->kernel_id);
    731     } else {
    732         err = errno;
    733         errno = old_errno;
    734     }
    735     return err;
    736 }
    737 
    738 int pthread_setschedparam(pthread_t thid, int policy,
    739                           struct sched_param const * param)
    740 {
    741     pthread_internal_t * thread = (pthread_internal_t *)thid;
    742     int                  old_errno = errno;
    743     int                  ret;
    744 
    745     ret = sched_setscheduler(thread->kernel_id, policy, param);
    746     if (ret < 0) {
    747         ret = errno;
    748         errno = old_errno;
    749     }
    750     return ret;
    751 }
    752 
    753 
    754 /* a mutex is implemented as a 32-bit integer holding the following fields
    755  *
    756  * bits:     name     description
    757  * 31-16     tid      owner thread's kernel id (recursive and errorcheck only)
    758  * 15-14     type     mutex type
    759  * 13        shared   process-shared flag
    760  * 12-2      counter  counter of recursive mutexes
    761  * 1-0       state    lock state (0, 1 or 2)
    762  */
    763 
    764 /* Convenience macro, creates a mask of 'bits' bits that starts from
    765  * the 'shift'-th least significant bit in a 32-bit word.
    766  *
    767  * Examples: FIELD_MASK(0,4)  -> 0xf
    768  *           FIELD_MASK(16,9) -> 0x1ff0000
    769  */
    770 #define  FIELD_MASK(shift,bits)           (((1 << (bits))-1) << (shift))
    771 
    772 /* This one is used to create a bit pattern from a given field value */
    773 #define  FIELD_TO_BITS(val,shift,bits)    (((val) & ((1 << (bits))-1)) << (shift))
    774 
    775 /* And this one does the opposite, i.e. extract a field's value from a bit pattern */
    776 #define  FIELD_FROM_BITS(val,shift,bits)  (((val) >> (shift)) & ((1 << (bits))-1))
    777 
    778 /* Mutex state:
    779  *
    780  * 0 for unlocked
    781  * 1 for locked, no waiters
    782  * 2 for locked, maybe waiters
    783  */
    784 #define  MUTEX_STATE_SHIFT      0
    785 #define  MUTEX_STATE_LEN        2
    786 
    787 #define  MUTEX_STATE_MASK           FIELD_MASK(MUTEX_STATE_SHIFT, MUTEX_STATE_LEN)
    788 #define  MUTEX_STATE_FROM_BITS(v)   FIELD_FROM_BITS(v, MUTEX_STATE_SHIFT, MUTEX_STATE_LEN)
    789 #define  MUTEX_STATE_TO_BITS(v)     FIELD_TO_BITS(v, MUTEX_STATE_SHIFT, MUTEX_STATE_LEN)
    790 
    791 #define  MUTEX_STATE_UNLOCKED            0   /* must be 0 to match __PTHREAD_MUTEX_INIT_VALUE */
    792 #define  MUTEX_STATE_LOCKED_UNCONTENDED  1   /* must be 1 due to atomic dec in unlock operation */
    793 #define  MUTEX_STATE_LOCKED_CONTENDED    2   /* must be 1 + LOCKED_UNCONTENDED due to atomic dec */
    794 
    795 #define  MUTEX_STATE_FROM_BITS(v)    FIELD_FROM_BITS(v, MUTEX_STATE_SHIFT, MUTEX_STATE_LEN)
    796 #define  MUTEX_STATE_TO_BITS(v)      FIELD_TO_BITS(v, MUTEX_STATE_SHIFT, MUTEX_STATE_LEN)
    797 
    798 #define  MUTEX_STATE_BITS_UNLOCKED            MUTEX_STATE_TO_BITS(MUTEX_STATE_UNLOCKED)
    799 #define  MUTEX_STATE_BITS_LOCKED_UNCONTENDED  MUTEX_STATE_TO_BITS(MUTEX_STATE_LOCKED_UNCONTENDED)
    800 #define  MUTEX_STATE_BITS_LOCKED_CONTENDED    MUTEX_STATE_TO_BITS(MUTEX_STATE_LOCKED_CONTENDED)
    801 
    802 /* return true iff the mutex if locked with no waiters */
    803 #define  MUTEX_STATE_BITS_IS_LOCKED_UNCONTENDED(v)  (((v) & MUTEX_STATE_MASK) == MUTEX_STATE_BITS_LOCKED_UNCONTENDED)
    804 
    805 /* return true iff the mutex if locked with maybe waiters */
    806 #define  MUTEX_STATE_BITS_IS_LOCKED_CONTENDED(v)   (((v) & MUTEX_STATE_MASK) == MUTEX_STATE_BITS_LOCKED_CONTENDED)
    807 
    808 /* used to flip from LOCKED_UNCONTENDED to LOCKED_CONTENDED */
    809 #define  MUTEX_STATE_BITS_FLIP_CONTENTION(v)      ((v) ^ (MUTEX_STATE_BITS_LOCKED_CONTENDED ^ MUTEX_STATE_BITS_LOCKED_UNCONTENDED))
    810 
    811 /* Mutex counter:
    812  *
    813  * We need to check for overflow before incrementing, and we also need to
    814  * detect when the counter is 0
    815  */
    816 #define  MUTEX_COUNTER_SHIFT         2
    817 #define  MUTEX_COUNTER_LEN           11
    818 #define  MUTEX_COUNTER_MASK          FIELD_MASK(MUTEX_COUNTER_SHIFT, MUTEX_COUNTER_LEN)
    819 
    820 #define  MUTEX_COUNTER_BITS_WILL_OVERFLOW(v)    (((v) & MUTEX_COUNTER_MASK) == MUTEX_COUNTER_MASK)
    821 #define  MUTEX_COUNTER_BITS_IS_ZERO(v)          (((v) & MUTEX_COUNTER_MASK) == 0)
    822 
    823 /* Used to increment the counter directly after overflow has been checked */
    824 #define  MUTEX_COUNTER_BITS_ONE      FIELD_TO_BITS(1,MUTEX_COUNTER_SHIFT,MUTEX_COUNTER_LEN)
    825 
    826 /* Returns true iff the counter is 0 */
    827 #define  MUTEX_COUNTER_BITS_ARE_ZERO(v)  (((v) & MUTEX_COUNTER_MASK) == 0)
    828 
    829 /* Mutex shared bit flag
    830  *
    831  * This flag is set to indicate that the mutex is shared among processes.
    832  * This changes the futex opcode we use for futex wait/wake operations
    833  * (non-shared operations are much faster).
    834  */
    835 #define  MUTEX_SHARED_SHIFT    13
    836 #define  MUTEX_SHARED_MASK     FIELD_MASK(MUTEX_SHARED_SHIFT,1)
    837 
    838 /* Mutex type:
    839  *
    840  * We support normal, recursive and errorcheck mutexes.
    841  *
    842  * The constants defined here *cannot* be changed because they must match
    843  * the C library ABI which defines the following initialization values in
    844  * <pthread.h>:
    845  *
    846  *   __PTHREAD_MUTEX_INIT_VALUE
    847  *   __PTHREAD_RECURSIVE_MUTEX_VALUE
    848  *   __PTHREAD_ERRORCHECK_MUTEX_INIT_VALUE
    849  */
    850 #define  MUTEX_TYPE_SHIFT      14
    851 #define  MUTEX_TYPE_LEN        2
    852 #define  MUTEX_TYPE_MASK       FIELD_MASK(MUTEX_TYPE_SHIFT,MUTEX_TYPE_LEN)
    853 
    854 #define  MUTEX_TYPE_NORMAL          0  /* Must be 0 to match __PTHREAD_MUTEX_INIT_VALUE */
    855 #define  MUTEX_TYPE_RECURSIVE       1
    856 #define  MUTEX_TYPE_ERRORCHECK      2
    857 
    858 #define  MUTEX_TYPE_TO_BITS(t)       FIELD_TO_BITS(t, MUTEX_TYPE_SHIFT, MUTEX_TYPE_LEN)
    859 
    860 #define  MUTEX_TYPE_BITS_NORMAL      MUTEX_TYPE_TO_BITS(MUTEX_TYPE_NORMAL)
    861 #define  MUTEX_TYPE_BITS_RECURSIVE   MUTEX_TYPE_TO_BITS(MUTEX_TYPE_RECURSIVE)
    862 #define  MUTEX_TYPE_BITS_ERRORCHECK  MUTEX_TYPE_TO_BITS(MUTEX_TYPE_ERRORCHECK)
    863 
    864 /* Mutex owner field:
    865  *
    866  * This is only used for recursive and errorcheck mutexes. It holds the
    867  * kernel TID of the owning thread. Note that this works because the Linux
    868  * kernel _only_ uses 16-bit values for thread ids.
    869  *
    870  * More specifically, it will wrap to 10000 when it reaches over 32768 for
    871  * application processes. You can check this by running the following inside
    872  * an adb shell session:
    873  *
    874     OLDPID=$$;
    875     while true; do
    876     NEWPID=$(sh -c 'echo $$')
    877     if [ "$NEWPID" -gt 32768 ]; then
    878         echo "AARGH: new PID $NEWPID is too high!"
    879         exit 1
    880     fi
    881     if [ "$NEWPID" -lt "$OLDPID" ]; then
    882         echo "****** Wrapping from PID $OLDPID to $NEWPID. *******"
    883     else
    884         echo -n "$NEWPID!"
    885     fi
    886     OLDPID=$NEWPID
    887     done
    888 
    889  * Note that you can run the same example on a desktop Linux system,
    890  * the wrapping will also happen at 32768, but will go back to 300 instead.
    891  */
    892 #define  MUTEX_OWNER_SHIFT     16
    893 #define  MUTEX_OWNER_LEN       16
    894 
    895 #define  MUTEX_OWNER_FROM_BITS(v)    FIELD_FROM_BITS(v,MUTEX_OWNER_SHIFT,MUTEX_OWNER_LEN)
    896 #define  MUTEX_OWNER_TO_BITS(v)      FIELD_TO_BITS(v,MUTEX_OWNER_SHIFT,MUTEX_OWNER_LEN)
    897 
    898 /* Convenience macros.
    899  *
    900  * These are used to form or modify the bit pattern of a given mutex value
    901  */
    902 
    903 
    904 
    905 /* a mutex attribute holds the following fields
    906  *
    907  * bits:     name       description
    908  * 0-3       type       type of mutex
    909  * 4         shared     process-shared flag
    910  */
    911 #define  MUTEXATTR_TYPE_MASK   0x000f
    912 #define  MUTEXATTR_SHARED_MASK 0x0010
    913 
    914 
    915 int pthread_mutexattr_init(pthread_mutexattr_t *attr)
    916 {
    917     if (attr) {
    918         *attr = PTHREAD_MUTEX_DEFAULT;
    919         return 0;
    920     } else {
    921         return EINVAL;
    922     }
    923 }
    924 
    925 int pthread_mutexattr_destroy(pthread_mutexattr_t *attr)
    926 {
    927     if (attr) {
    928         *attr = -1;
    929         return 0;
    930     } else {
    931         return EINVAL;
    932     }
    933 }
    934 
    935 int pthread_mutexattr_gettype(const pthread_mutexattr_t *attr, int *type)
    936 {
    937     if (attr) {
    938         int  atype = (*attr & MUTEXATTR_TYPE_MASK);
    939 
    940          if (atype >= PTHREAD_MUTEX_NORMAL &&
    941              atype <= PTHREAD_MUTEX_ERRORCHECK) {
    942             *type = atype;
    943             return 0;
    944         }
    945     }
    946     return EINVAL;
    947 }
    948 
    949 int pthread_mutexattr_settype(pthread_mutexattr_t *attr, int type)
    950 {
    951     if (attr && type >= PTHREAD_MUTEX_NORMAL &&
    952                 type <= PTHREAD_MUTEX_ERRORCHECK ) {
    953         *attr = (*attr & ~MUTEXATTR_TYPE_MASK) | type;
    954         return 0;
    955     }
    956     return EINVAL;
    957 }
    958 
    959 /* process-shared mutexes are not supported at the moment */
    960 
    961 int pthread_mutexattr_setpshared(pthread_mutexattr_t *attr, int  pshared)
    962 {
    963     if (!attr)
    964         return EINVAL;
    965 
    966     switch (pshared) {
    967     case PTHREAD_PROCESS_PRIVATE:
    968         *attr &= ~MUTEXATTR_SHARED_MASK;
    969         return 0;
    970 
    971     case PTHREAD_PROCESS_SHARED:
    972         /* our current implementation of pthread actually supports shared
    973          * mutexes but won't cleanup if a process dies with the mutex held.
    974          * Nevertheless, it's better than nothing. Shared mutexes are used
    975          * by surfaceflinger and audioflinger.
    976          */
    977         *attr |= MUTEXATTR_SHARED_MASK;
    978         return 0;
    979     }
    980     return EINVAL;
    981 }
    982 
    983 int pthread_mutexattr_getpshared(pthread_mutexattr_t *attr, int *pshared)
    984 {
    985     if (!attr || !pshared)
    986         return EINVAL;
    987 
    988     *pshared = (*attr & MUTEXATTR_SHARED_MASK) ? PTHREAD_PROCESS_SHARED
    989                                                : PTHREAD_PROCESS_PRIVATE;
    990     return 0;
    991 }
    992 
    993 int pthread_mutex_init(pthread_mutex_t *mutex,
    994                        const pthread_mutexattr_t *attr)
    995 {
    996     int value = 0;
    997 
    998     if (mutex == NULL)
    999         return EINVAL;
   1000 
   1001     if (__likely(attr == NULL)) {
   1002         mutex->value = MUTEX_TYPE_BITS_NORMAL;
   1003         return 0;
   1004     }
   1005 
   1006     if ((*attr & MUTEXATTR_SHARED_MASK) != 0)
   1007         value |= MUTEX_SHARED_MASK;
   1008 
   1009     switch (*attr & MUTEXATTR_TYPE_MASK) {
   1010     case PTHREAD_MUTEX_NORMAL:
   1011         value |= MUTEX_TYPE_BITS_NORMAL;
   1012         break;
   1013     case PTHREAD_MUTEX_RECURSIVE:
   1014         value |= MUTEX_TYPE_BITS_RECURSIVE;
   1015         break;
   1016     case PTHREAD_MUTEX_ERRORCHECK:
   1017         value |= MUTEX_TYPE_BITS_ERRORCHECK;
   1018         break;
   1019     default:
   1020         return EINVAL;
   1021     }
   1022 
   1023     mutex->value = value;
   1024     return 0;
   1025 }
   1026 
   1027 
   1028 /*
   1029  * Lock a non-recursive mutex.
   1030  *
   1031  * As noted above, there are three states:
   1032  *   0 (unlocked, no contention)
   1033  *   1 (locked, no contention)
   1034  *   2 (locked, contention)
   1035  *
   1036  * Non-recursive mutexes don't use the thread-id or counter fields, and the
   1037  * "type" value is zero, so the only bits that will be set are the ones in
   1038  * the lock state field.
   1039  */
   1040 static __inline__ void
   1041 _normal_lock(pthread_mutex_t*  mutex, int shared)
   1042 {
   1043     /* convenience shortcuts */
   1044     const int unlocked           = shared | MUTEX_STATE_BITS_UNLOCKED;
   1045     const int locked_uncontended = shared | MUTEX_STATE_BITS_LOCKED_UNCONTENDED;
   1046     /*
   1047      * The common case is an unlocked mutex, so we begin by trying to
   1048      * change the lock's state from 0 (UNLOCKED) to 1 (LOCKED).
   1049      * __bionic_cmpxchg() returns 0 if it made the swap successfully.
   1050      * If the result is nonzero, this lock is already held by another thread.
   1051      */
   1052     if (__bionic_cmpxchg(unlocked, locked_uncontended, &mutex->value) != 0) {
   1053         const int locked_contended = shared | MUTEX_STATE_BITS_LOCKED_CONTENDED;
   1054         /*
   1055          * We want to go to sleep until the mutex is available, which
   1056          * requires promoting it to state 2 (CONTENDED). We need to
   1057          * swap in the new state value and then wait until somebody wakes us up.
   1058          *
   1059          * __bionic_swap() returns the previous value.  We swap 2 in and
   1060          * see if we got zero back; if so, we have acquired the lock.  If
   1061          * not, another thread still holds the lock and we wait again.
   1062          *
   1063          * The second argument to the __futex_wait() call is compared
   1064          * against the current value.  If it doesn't match, __futex_wait()
   1065          * returns immediately (otherwise, it sleeps for a time specified
   1066          * by the third argument; 0 means sleep forever).  This ensures
   1067          * that the mutex is in state 2 when we go to sleep on it, which
   1068          * guarantees a wake-up call.
   1069          */
   1070         while (__bionic_swap(locked_contended, &mutex->value) != unlocked)
   1071             __futex_wait_ex(&mutex->value, shared, locked_contended, 0);
   1072     }
   1073     ANDROID_MEMBAR_FULL();
   1074 }
   1075 
   1076 /*
   1077  * Release a non-recursive mutex.  The caller is responsible for determining
   1078  * that we are in fact the owner of this lock.
   1079  */
   1080 static __inline__ void
   1081 _normal_unlock(pthread_mutex_t*  mutex, int shared)
   1082 {
   1083     ANDROID_MEMBAR_FULL();
   1084 
   1085     /*
   1086      * The mutex state will be 1 or (rarely) 2.  We use an atomic decrement
   1087      * to release the lock.  __bionic_atomic_dec() returns the previous value;
   1088      * if it wasn't 1 we have to do some additional work.
   1089      */
   1090     if (__bionic_atomic_dec(&mutex->value) != (shared|MUTEX_STATE_BITS_LOCKED_UNCONTENDED)) {
   1091         /*
   1092          * Start by releasing the lock.  The decrement changed it from
   1093          * "contended lock" to "uncontended lock", which means we still
   1094          * hold it, and anybody who tries to sneak in will push it back
   1095          * to state 2.
   1096          *
   1097          * Once we set it to zero the lock is up for grabs.  We follow
   1098          * this with a __futex_wake() to ensure that one of the waiting
   1099          * threads has a chance to grab it.
   1100          *
   1101          * This doesn't cause a race with the swap/wait pair in
   1102          * _normal_lock(), because the __futex_wait() call there will
   1103          * return immediately if the mutex value isn't 2.
   1104          */
   1105         mutex->value = shared;
   1106 
   1107         /*
   1108          * Wake up one waiting thread.  We don't know which thread will be
   1109          * woken or when it'll start executing -- futexes make no guarantees
   1110          * here.  There may not even be a thread waiting.
   1111          *
   1112          * The newly-woken thread will replace the 0 we just set above
   1113          * with 2, which means that when it eventually releases the mutex
   1114          * it will also call FUTEX_WAKE.  This results in one extra wake
   1115          * call whenever a lock is contended, but lets us avoid forgetting
   1116          * anyone without requiring us to track the number of sleepers.
   1117          *
   1118          * It's possible for another thread to sneak in and grab the lock
   1119          * between the zero assignment above and the wake call below.  If
   1120          * the new thread is "slow" and holds the lock for a while, we'll
   1121          * wake up a sleeper, which will swap in a 2 and then go back to
   1122          * sleep since the lock is still held.  If the new thread is "fast",
   1123          * running to completion before we call wake, the thread we
   1124          * eventually wake will find an unlocked mutex and will execute.
   1125          * Either way we have correct behavior and nobody is orphaned on
   1126          * the wait queue.
   1127          */
   1128         __futex_wake_ex(&mutex->value, shared, 1);
   1129     }
   1130 }
   1131 
   1132 /* This common inlined function is used to increment the counter of an
   1133  * errorcheck or recursive mutex.
   1134  *
   1135  * For errorcheck mutexes, it will return EDEADLK
   1136  * If the counter overflows, it will return EAGAIN
   1137  * Otherwise, it atomically increments the counter and returns 0
   1138  * after providing an acquire barrier.
   1139  *
   1140  * mtype is the current mutex type
   1141  * mvalue is the current mutex value (already loaded)
   1142  * mutex pointers to the mutex.
   1143  */
   1144 static __inline__ __attribute__((always_inline)) int
   1145 _recursive_increment(pthread_mutex_t* mutex, int mvalue, int mtype)
   1146 {
   1147     if (mtype == MUTEX_TYPE_BITS_ERRORCHECK) {
   1148         /* trying to re-lock a mutex we already acquired */
   1149         return EDEADLK;
   1150     }
   1151 
   1152     /* Detect recursive lock overflow and return EAGAIN.
   1153      * This is safe because only the owner thread can modify the
   1154      * counter bits in the mutex value.
   1155      */
   1156     if (MUTEX_COUNTER_BITS_WILL_OVERFLOW(mvalue)) {
   1157         return EAGAIN;
   1158     }
   1159 
   1160     /* We own the mutex, but other threads are able to change
   1161      * the lower bits (e.g. promoting it to "contended"), so we
   1162      * need to use an atomic cmpxchg loop to update the counter.
   1163      */
   1164     for (;;) {
   1165         /* increment counter, overflow was already checked */
   1166         int newval = mvalue + MUTEX_COUNTER_BITS_ONE;
   1167         if (__likely(__bionic_cmpxchg(mvalue, newval, &mutex->value) == 0)) {
   1168             /* mutex is still locked, not need for a memory barrier */
   1169             return 0;
   1170         }
   1171         /* the value was changed, this happens when another thread changes
   1172          * the lower state bits from 1 to 2 to indicate contention. This
   1173          * cannot change the counter, so simply reload and try again.
   1174          */
   1175         mvalue = mutex->value;
   1176     }
   1177 }
   1178 
   1179 __LIBC_HIDDEN__
   1180 int pthread_mutex_lock_impl(pthread_mutex_t *mutex)
   1181 {
   1182     int mvalue, mtype, tid, new_lock_type, shared;
   1183 
   1184     if (__unlikely(mutex == NULL))
   1185         return EINVAL;
   1186 
   1187     mvalue = mutex->value;
   1188     mtype = (mvalue & MUTEX_TYPE_MASK);
   1189     shared = (mvalue & MUTEX_SHARED_MASK);
   1190 
   1191     /* Handle normal case first */
   1192     if ( __likely(mtype == MUTEX_TYPE_BITS_NORMAL) ) {
   1193         _normal_lock(mutex, shared);
   1194         return 0;
   1195     }
   1196 
   1197     /* Do we already own this recursive or error-check mutex ? */
   1198     tid = __get_thread()->kernel_id;
   1199     if ( tid == MUTEX_OWNER_FROM_BITS(mvalue) )
   1200         return _recursive_increment(mutex, mvalue, mtype);
   1201 
   1202     /* Add in shared state to avoid extra 'or' operations below */
   1203     mtype |= shared;
   1204 
   1205     /* First, if the mutex is unlocked, try to quickly acquire it.
   1206      * In the optimistic case where this works, set the state to 1 to
   1207      * indicate locked with no contention */
   1208     if (mvalue == mtype) {
   1209         int newval = MUTEX_OWNER_TO_BITS(tid) | mtype | MUTEX_STATE_BITS_LOCKED_UNCONTENDED;
   1210         if (__bionic_cmpxchg(mvalue, newval, &mutex->value) == 0) {
   1211             ANDROID_MEMBAR_FULL();
   1212             return 0;
   1213         }
   1214         /* argh, the value changed, reload before entering the loop */
   1215         mvalue = mutex->value;
   1216     }
   1217 
   1218     for (;;) {
   1219         int newval;
   1220 
   1221         /* if the mutex is unlocked, its value should be 'mtype' and
   1222          * we try to acquire it by setting its owner and state atomically.
   1223          * NOTE: We put the state to 2 since we _know_ there is contention
   1224          * when we are in this loop. This ensures all waiters will be
   1225          * unlocked.
   1226          */
   1227         if (mvalue == mtype) {
   1228             newval = MUTEX_OWNER_TO_BITS(tid) | mtype | MUTEX_STATE_BITS_LOCKED_CONTENDED;
   1229             /* TODO: Change this to __bionic_cmpxchg_acquire when we
   1230              *        implement it to get rid of the explicit memory
   1231              *        barrier below.
   1232              */
   1233             if (__unlikely(__bionic_cmpxchg(mvalue, newval, &mutex->value) != 0)) {
   1234                 mvalue = mutex->value;
   1235                 continue;
   1236             }
   1237             ANDROID_MEMBAR_FULL();
   1238             return 0;
   1239         }
   1240 
   1241         /* the mutex is already locked by another thread, if its state is 1
   1242          * we will change it to 2 to indicate contention. */
   1243         if (MUTEX_STATE_BITS_IS_LOCKED_UNCONTENDED(mvalue)) {
   1244             newval = MUTEX_STATE_BITS_FLIP_CONTENTION(mvalue); /* locked state 1 => state 2 */
   1245             if (__unlikely(__bionic_cmpxchg(mvalue, newval, &mutex->value) != 0)) {
   1246                 mvalue = mutex->value;
   1247                 continue;
   1248             }
   1249             mvalue = newval;
   1250         }
   1251 
   1252         /* wait until the mutex is unlocked */
   1253         __futex_wait_ex(&mutex->value, shared, mvalue, NULL);
   1254 
   1255         mvalue = mutex->value;
   1256     }
   1257     /* NOTREACHED */
   1258 }
   1259 
   1260 int pthread_mutex_lock(pthread_mutex_t *mutex)
   1261 {
   1262     int err = pthread_mutex_lock_impl(mutex);
   1263 #ifdef PTHREAD_DEBUG
   1264     if (PTHREAD_DEBUG_ENABLED) {
   1265         if (!err) {
   1266             pthread_debug_mutex_lock_check(mutex);
   1267         }
   1268     }
   1269 #endif
   1270     return err;
   1271 }
   1272 
   1273 __LIBC_HIDDEN__
   1274 int pthread_mutex_unlock_impl(pthread_mutex_t *mutex)
   1275 {
   1276     int mvalue, mtype, tid, oldv, shared;
   1277 
   1278     if (__unlikely(mutex == NULL))
   1279         return EINVAL;
   1280 
   1281     mvalue = mutex->value;
   1282     mtype  = (mvalue & MUTEX_TYPE_MASK);
   1283     shared = (mvalue & MUTEX_SHARED_MASK);
   1284 
   1285     /* Handle common case first */
   1286     if (__likely(mtype == MUTEX_TYPE_BITS_NORMAL)) {
   1287         _normal_unlock(mutex, shared);
   1288         return 0;
   1289     }
   1290 
   1291     /* Do we already own this recursive or error-check mutex ? */
   1292     tid = __get_thread()->kernel_id;
   1293     if ( tid != MUTEX_OWNER_FROM_BITS(mvalue) )
   1294         return EPERM;
   1295 
   1296     /* If the counter is > 0, we can simply decrement it atomically.
   1297      * Since other threads can mutate the lower state bits (and only the
   1298      * lower state bits), use a cmpxchg to do it.
   1299      */
   1300     if (!MUTEX_COUNTER_BITS_IS_ZERO(mvalue)) {
   1301         for (;;) {
   1302             int newval = mvalue - MUTEX_COUNTER_BITS_ONE;
   1303             if (__likely(__bionic_cmpxchg(mvalue, newval, &mutex->value) == 0)) {
   1304                 /* success: we still own the mutex, so no memory barrier */
   1305                 return 0;
   1306             }
   1307             /* the value changed, so reload and loop */
   1308             mvalue = mutex->value;
   1309         }
   1310     }
   1311 
   1312     /* the counter is 0, so we're going to unlock the mutex by resetting
   1313      * its value to 'unlocked'. We need to perform a swap in order
   1314      * to read the current state, which will be 2 if there are waiters
   1315      * to awake.
   1316      *
   1317      * TODO: Change this to __bionic_swap_release when we implement it
   1318      *        to get rid of the explicit memory barrier below.
   1319      */
   1320     ANDROID_MEMBAR_FULL();  /* RELEASE BARRIER */
   1321     mvalue = __bionic_swap(mtype | shared | MUTEX_STATE_BITS_UNLOCKED, &mutex->value);
   1322 
   1323     /* Wake one waiting thread, if any */
   1324     if (MUTEX_STATE_BITS_IS_LOCKED_CONTENDED(mvalue)) {
   1325         __futex_wake_ex(&mutex->value, shared, 1);
   1326     }
   1327     return 0;
   1328 }
   1329 
   1330 int pthread_mutex_unlock(pthread_mutex_t *mutex)
   1331 {
   1332 #ifdef PTHREAD_DEBUG
   1333     if (PTHREAD_DEBUG_ENABLED) {
   1334         pthread_debug_mutex_unlock_check(mutex);
   1335     }
   1336 #endif
   1337     return pthread_mutex_unlock_impl(mutex);
   1338 }
   1339 
   1340 __LIBC_HIDDEN__
   1341 int pthread_mutex_trylock_impl(pthread_mutex_t *mutex)
   1342 {
   1343     int mvalue, mtype, tid, oldv, shared;
   1344 
   1345     if (__unlikely(mutex == NULL))
   1346         return EINVAL;
   1347 
   1348     mvalue = mutex->value;
   1349     mtype  = (mvalue & MUTEX_TYPE_MASK);
   1350     shared = (mvalue & MUTEX_SHARED_MASK);
   1351 
   1352     /* Handle common case first */
   1353     if ( __likely(mtype == MUTEX_TYPE_BITS_NORMAL) )
   1354     {
   1355         if (__bionic_cmpxchg(shared|MUTEX_STATE_BITS_UNLOCKED,
   1356                              shared|MUTEX_STATE_BITS_LOCKED_UNCONTENDED,
   1357                              &mutex->value) == 0) {
   1358             ANDROID_MEMBAR_FULL();
   1359             return 0;
   1360         }
   1361 
   1362         return EBUSY;
   1363     }
   1364 
   1365     /* Do we already own this recursive or error-check mutex ? */
   1366     tid = __get_thread()->kernel_id;
   1367     if ( tid == MUTEX_OWNER_FROM_BITS(mvalue) )
   1368         return _recursive_increment(mutex, mvalue, mtype);
   1369 
   1370     /* Same as pthread_mutex_lock, except that we don't want to wait, and
   1371      * the only operation that can succeed is a single cmpxchg to acquire the
   1372      * lock if it is released / not owned by anyone. No need for a complex loop.
   1373      */
   1374     mtype |= shared | MUTEX_STATE_BITS_UNLOCKED;
   1375     mvalue = MUTEX_OWNER_TO_BITS(tid) | mtype | MUTEX_STATE_BITS_LOCKED_UNCONTENDED;
   1376 
   1377     if (__likely(__bionic_cmpxchg(mtype, mvalue, &mutex->value) == 0)) {
   1378         ANDROID_MEMBAR_FULL();
   1379         return 0;
   1380     }
   1381 
   1382     return EBUSY;
   1383 }
   1384 
   1385 int pthread_mutex_trylock(pthread_mutex_t *mutex)
   1386 {
   1387     int err = pthread_mutex_trylock_impl(mutex);
   1388 #ifdef PTHREAD_DEBUG
   1389     if (PTHREAD_DEBUG_ENABLED) {
   1390         if (!err) {
   1391             pthread_debug_mutex_lock_check(mutex);
   1392         }
   1393     }
   1394 #endif
   1395     return err;
   1396 }
   1397 
   1398 /* initialize 'ts' with the difference between 'abstime' and the current time
   1399  * according to 'clock'. Returns -1 if abstime already expired, or 0 otherwise.
   1400  */
   1401 static int
   1402 __timespec_to_absolute(struct timespec*  ts, const struct timespec*  abstime, clockid_t  clock)
   1403 {
   1404     clock_gettime(clock, ts);
   1405     ts->tv_sec  = abstime->tv_sec - ts->tv_sec;
   1406     ts->tv_nsec = abstime->tv_nsec - ts->tv_nsec;
   1407     if (ts->tv_nsec < 0) {
   1408         ts->tv_sec--;
   1409         ts->tv_nsec += 1000000000;
   1410     }
   1411     if ((ts->tv_nsec < 0) || (ts->tv_sec < 0))
   1412         return -1;
   1413 
   1414     return 0;
   1415 }
   1416 
   1417 /* initialize 'abstime' to the current time according to 'clock' plus 'msecs'
   1418  * milliseconds.
   1419  */
   1420 static void
   1421 __timespec_to_relative_msec(struct timespec*  abstime, unsigned  msecs, clockid_t  clock)
   1422 {
   1423     clock_gettime(clock, abstime);
   1424     abstime->tv_sec  += msecs/1000;
   1425     abstime->tv_nsec += (msecs%1000)*1000000;
   1426     if (abstime->tv_nsec >= 1000000000) {
   1427         abstime->tv_sec++;
   1428         abstime->tv_nsec -= 1000000000;
   1429     }
   1430 }
   1431 
   1432 __LIBC_HIDDEN__
   1433 int pthread_mutex_lock_timeout_np_impl(pthread_mutex_t *mutex, unsigned msecs)
   1434 {
   1435     clockid_t        clock = CLOCK_MONOTONIC;
   1436     struct timespec  abstime;
   1437     struct timespec  ts;
   1438     int               mvalue, mtype, tid, oldv, new_lock_type, shared;
   1439 
   1440     /* compute absolute expiration time */
   1441     __timespec_to_relative_msec(&abstime, msecs, clock);
   1442 
   1443     if (__unlikely(mutex == NULL))
   1444         return EINVAL;
   1445 
   1446     mvalue = mutex->value;
   1447     mtype  = (mvalue & MUTEX_TYPE_MASK);
   1448     shared = (mvalue & MUTEX_SHARED_MASK);
   1449 
   1450     /* Handle common case first */
   1451     if ( __likely(mtype == MUTEX_TYPE_BITS_NORMAL) )
   1452     {
   1453         const int unlocked           = shared | MUTEX_STATE_BITS_UNLOCKED;
   1454         const int locked_uncontended = shared | MUTEX_STATE_BITS_LOCKED_UNCONTENDED;
   1455         const int locked_contended   = shared | MUTEX_STATE_BITS_LOCKED_CONTENDED;
   1456 
   1457         /* fast path for uncontended lock. Note: MUTEX_TYPE_BITS_NORMAL is 0 */
   1458         if (__bionic_cmpxchg(unlocked, locked_uncontended, &mutex->value) == 0) {
   1459             ANDROID_MEMBAR_FULL();
   1460             return 0;
   1461         }
   1462 
   1463         /* loop while needed */
   1464         while (__bionic_swap(locked_contended, &mutex->value) != unlocked) {
   1465             if (__timespec_to_absolute(&ts, &abstime, clock) < 0)
   1466                 return EBUSY;
   1467 
   1468             __futex_wait_ex(&mutex->value, shared, locked_contended, &ts);
   1469         }
   1470         ANDROID_MEMBAR_FULL();
   1471         return 0;
   1472     }
   1473 
   1474     /* Do we already own this recursive or error-check mutex ? */
   1475     tid = __get_thread()->kernel_id;
   1476     if ( tid == MUTEX_OWNER_FROM_BITS(mvalue) )
   1477         return _recursive_increment(mutex, mvalue, mtype);
   1478 
   1479     /* the following implements the same loop than pthread_mutex_lock_impl
   1480      * but adds checks to ensure that the operation never exceeds the
   1481      * absolute expiration time.
   1482      */
   1483     mtype |= shared;
   1484 
   1485     /* first try a quick lock */
   1486     if (mvalue == mtype) {
   1487         mvalue = MUTEX_OWNER_TO_BITS(tid) | mtype | MUTEX_STATE_BITS_LOCKED_UNCONTENDED;
   1488         if (__likely(__bionic_cmpxchg(mtype, mvalue, &mutex->value) == 0)) {
   1489             ANDROID_MEMBAR_FULL();
   1490             return 0;
   1491         }
   1492         mvalue = mutex->value;
   1493     }
   1494 
   1495     for (;;) {
   1496         struct timespec ts;
   1497 
   1498         /* if the value is 'unlocked', try to acquire it directly */
   1499         /* NOTE: put state to 2 since we know there is contention */
   1500         if (mvalue == mtype) /* unlocked */ {
   1501             mvalue = MUTEX_OWNER_TO_BITS(tid) | mtype | MUTEX_STATE_BITS_LOCKED_CONTENDED;
   1502             if (__bionic_cmpxchg(mtype, mvalue, &mutex->value) == 0) {
   1503                 ANDROID_MEMBAR_FULL();
   1504                 return 0;
   1505             }
   1506             /* the value changed before we could lock it. We need to check
   1507              * the time to avoid livelocks, reload the value, then loop again. */
   1508             if (__timespec_to_absolute(&ts, &abstime, clock) < 0)
   1509                 return EBUSY;
   1510 
   1511             mvalue = mutex->value;
   1512             continue;
   1513         }
   1514 
   1515         /* The value is locked. If 'uncontended', try to switch its state
   1516          * to 'contented' to ensure we get woken up later. */
   1517         if (MUTEX_STATE_BITS_IS_LOCKED_UNCONTENDED(mvalue)) {
   1518             int newval = MUTEX_STATE_BITS_FLIP_CONTENTION(mvalue);
   1519             if (__bionic_cmpxchg(mvalue, newval, &mutex->value) != 0) {
   1520                 /* this failed because the value changed, reload it */
   1521                 mvalue = mutex->value;
   1522             } else {
   1523                 /* this succeeded, update mvalue */
   1524                 mvalue = newval;
   1525             }
   1526         }
   1527 
   1528         /* check time and update 'ts' */
   1529         if (__timespec_to_absolute(&ts, &abstime, clock) < 0)
   1530             return EBUSY;
   1531 
   1532         /* Only wait to be woken up if the state is '2', otherwise we'll
   1533          * simply loop right now. This can happen when the second cmpxchg
   1534          * in our loop failed because the mutex was unlocked by another
   1535          * thread.
   1536          */
   1537         if (MUTEX_STATE_BITS_IS_LOCKED_CONTENDED(mvalue)) {
   1538             if (__futex_wait_ex(&mutex->value, shared, mvalue, &ts) == ETIMEDOUT) {
   1539                 return EBUSY;
   1540             }
   1541             mvalue = mutex->value;
   1542         }
   1543     }
   1544     /* NOTREACHED */
   1545 }
   1546 
   1547 int pthread_mutex_lock_timeout_np(pthread_mutex_t *mutex, unsigned msecs)
   1548 {
   1549     int err = pthread_mutex_lock_timeout_np_impl(mutex, msecs);
   1550 #ifdef PTHREAD_DEBUG
   1551     if (PTHREAD_DEBUG_ENABLED) {
   1552         if (!err) {
   1553             pthread_debug_mutex_lock_check(mutex);
   1554         }
   1555     }
   1556 #endif
   1557     return err;
   1558 }
   1559 
   1560 int pthread_mutex_destroy(pthread_mutex_t *mutex)
   1561 {
   1562     int ret;
   1563 
   1564     /* use trylock to ensure that the mutex value is
   1565      * valid and is not already locked. */
   1566     ret = pthread_mutex_trylock_impl(mutex);
   1567     if (ret != 0)
   1568         return ret;
   1569 
   1570     mutex->value = 0xdead10cc;
   1571     return 0;
   1572 }
   1573 
   1574 
   1575 
   1576 int pthread_condattr_init(pthread_condattr_t *attr)
   1577 {
   1578     if (attr == NULL)
   1579         return EINVAL;
   1580 
   1581     *attr = PTHREAD_PROCESS_PRIVATE;
   1582     return 0;
   1583 }
   1584 
   1585 int pthread_condattr_getpshared(pthread_condattr_t *attr, int *pshared)
   1586 {
   1587     if (attr == NULL || pshared == NULL)
   1588         return EINVAL;
   1589 
   1590     *pshared = *attr;
   1591     return 0;
   1592 }
   1593 
   1594 int pthread_condattr_setpshared(pthread_condattr_t *attr, int pshared)
   1595 {
   1596     if (attr == NULL)
   1597         return EINVAL;
   1598 
   1599     if (pshared != PTHREAD_PROCESS_SHARED &&
   1600         pshared != PTHREAD_PROCESS_PRIVATE)
   1601         return EINVAL;
   1602 
   1603     *attr = pshared;
   1604     return 0;
   1605 }
   1606 
   1607 int pthread_condattr_destroy(pthread_condattr_t *attr)
   1608 {
   1609     if (attr == NULL)
   1610         return EINVAL;
   1611 
   1612     *attr = 0xdeada11d;
   1613     return 0;
   1614 }
   1615 
   1616 /* We use one bit in condition variable values as the 'shared' flag
   1617  * The rest is a counter.
   1618  */
   1619 #define COND_SHARED_MASK        0x0001
   1620 #define COND_COUNTER_INCREMENT  0x0002
   1621 #define COND_COUNTER_MASK       (~COND_SHARED_MASK)
   1622 
   1623 #define COND_IS_SHARED(c)  (((c)->value & COND_SHARED_MASK) != 0)
   1624 
   1625 /* XXX *technically* there is a race condition that could allow
   1626  * XXX a signal to be missed.  If thread A is preempted in _wait()
   1627  * XXX after unlocking the mutex and before waiting, and if other
   1628  * XXX threads call signal or broadcast UINT_MAX/2 times (exactly),
   1629  * XXX before thread A is scheduled again and calls futex_wait(),
   1630  * XXX then the signal will be lost.
   1631  */
   1632 
   1633 int pthread_cond_init(pthread_cond_t *cond,
   1634                       const pthread_condattr_t *attr)
   1635 {
   1636     if (cond == NULL)
   1637         return EINVAL;
   1638 
   1639     cond->value = 0;
   1640 
   1641     if (attr != NULL && *attr == PTHREAD_PROCESS_SHARED)
   1642         cond->value |= COND_SHARED_MASK;
   1643 
   1644     return 0;
   1645 }
   1646 
   1647 int pthread_cond_destroy(pthread_cond_t *cond)
   1648 {
   1649     if (cond == NULL)
   1650         return EINVAL;
   1651 
   1652     cond->value = 0xdeadc04d;
   1653     return 0;
   1654 }
   1655 
   1656 /* This function is used by pthread_cond_broadcast and
   1657  * pthread_cond_signal to atomically decrement the counter
   1658  * then wake-up 'counter' threads.
   1659  */
   1660 static int
   1661 __pthread_cond_pulse(pthread_cond_t *cond, int  counter)
   1662 {
   1663     long flags;
   1664 
   1665     if (__unlikely(cond == NULL))
   1666         return EINVAL;
   1667 
   1668     flags = (cond->value & ~COND_COUNTER_MASK);
   1669     for (;;) {
   1670         long oldval = cond->value;
   1671         long newval = ((oldval - COND_COUNTER_INCREMENT) & COND_COUNTER_MASK)
   1672                       | flags;
   1673         if (__bionic_cmpxchg(oldval, newval, &cond->value) == 0)
   1674             break;
   1675     }
   1676 
   1677     /*
   1678      * Ensure that all memory accesses previously made by this thread are
   1679      * visible to the woken thread(s).  On the other side, the "wait"
   1680      * code will issue any necessary barriers when locking the mutex.
   1681      *
   1682      * This may not strictly be necessary -- if the caller follows
   1683      * recommended practice and holds the mutex before signaling the cond
   1684      * var, the mutex ops will provide correct semantics.  If they don't
   1685      * hold the mutex, they're subject to race conditions anyway.
   1686      */
   1687     ANDROID_MEMBAR_FULL();
   1688 
   1689     __futex_wake_ex(&cond->value, COND_IS_SHARED(cond), counter);
   1690     return 0;
   1691 }
   1692 
   1693 int pthread_cond_broadcast(pthread_cond_t *cond)
   1694 {
   1695     return __pthread_cond_pulse(cond, INT_MAX);
   1696 }
   1697 
   1698 int pthread_cond_signal(pthread_cond_t *cond)
   1699 {
   1700     return __pthread_cond_pulse(cond, 1);
   1701 }
   1702 
   1703 int pthread_cond_wait(pthread_cond_t *cond, pthread_mutex_t *mutex)
   1704 {
   1705     return pthread_cond_timedwait(cond, mutex, NULL);
   1706 }
   1707 
   1708 int __pthread_cond_timedwait_relative(pthread_cond_t *cond,
   1709                                       pthread_mutex_t * mutex,
   1710                                       const struct timespec *reltime)
   1711 {
   1712     int  status;
   1713     int  oldvalue = cond->value;
   1714 
   1715     pthread_mutex_unlock(mutex);
   1716     status = __futex_wait_ex(&cond->value, COND_IS_SHARED(cond), oldvalue, reltime);
   1717     pthread_mutex_lock(mutex);
   1718 
   1719     if (status == (-ETIMEDOUT)) return ETIMEDOUT;
   1720     return 0;
   1721 }
   1722 
   1723 int __pthread_cond_timedwait(pthread_cond_t *cond,
   1724                              pthread_mutex_t * mutex,
   1725                              const struct timespec *abstime,
   1726                              clockid_t clock)
   1727 {
   1728     struct timespec ts;
   1729     struct timespec * tsp;
   1730 
   1731     if (abstime != NULL) {
   1732         if (__timespec_to_absolute(&ts, abstime, clock) < 0)
   1733             return ETIMEDOUT;
   1734         tsp = &ts;
   1735     } else {
   1736         tsp = NULL;
   1737     }
   1738 
   1739     return __pthread_cond_timedwait_relative(cond, mutex, tsp);
   1740 }
   1741 
   1742 int pthread_cond_timedwait(pthread_cond_t *cond,
   1743                            pthread_mutex_t * mutex,
   1744                            const struct timespec *abstime)
   1745 {
   1746     return __pthread_cond_timedwait(cond, mutex, abstime, CLOCK_REALTIME);
   1747 }
   1748 
   1749 
   1750 /* this one exists only for backward binary compatibility */
   1751 int pthread_cond_timedwait_monotonic(pthread_cond_t *cond,
   1752                                      pthread_mutex_t * mutex,
   1753                                      const struct timespec *abstime)
   1754 {
   1755     return __pthread_cond_timedwait(cond, mutex, abstime, CLOCK_MONOTONIC);
   1756 }
   1757 
   1758 int pthread_cond_timedwait_monotonic_np(pthread_cond_t *cond,
   1759                                      pthread_mutex_t * mutex,
   1760                                      const struct timespec *abstime)
   1761 {
   1762     return __pthread_cond_timedwait(cond, mutex, abstime, CLOCK_MONOTONIC);
   1763 }
   1764 
   1765 int pthread_cond_timedwait_relative_np(pthread_cond_t *cond,
   1766                                       pthread_mutex_t * mutex,
   1767                                       const struct timespec *reltime)
   1768 {
   1769     return __pthread_cond_timedwait_relative(cond, mutex, reltime);
   1770 }
   1771 
   1772 int pthread_cond_timeout_np(pthread_cond_t *cond,
   1773                             pthread_mutex_t * mutex,
   1774                             unsigned msecs)
   1775 {
   1776     struct timespec ts;
   1777 
   1778     ts.tv_sec = msecs / 1000;
   1779     ts.tv_nsec = (msecs % 1000) * 1000000;
   1780 
   1781     return __pthread_cond_timedwait_relative(cond, mutex, &ts);
   1782 }
   1783 
   1784 
   1785 
   1786 /* A technical note regarding our thread-local-storage (TLS) implementation:
   1787  *
   1788  * There can be up to TLSMAP_SIZE independent TLS keys in a given process,
   1789  * though the first TLSMAP_START keys are reserved for Bionic to hold
   1790  * special thread-specific variables like errno or a pointer to
   1791  * the current thread's descriptor.
   1792  *
   1793  * while stored in the TLS area, these entries cannot be accessed through
   1794  * pthread_getspecific() / pthread_setspecific() and pthread_key_delete()
   1795  *
   1796  * also, some entries in the key table are pre-allocated (see tlsmap_lock)
   1797  * to greatly simplify and speedup some OpenGL-related operations. though the
   1798  * initialy value will be NULL on all threads.
   1799  *
   1800  * you can use pthread_getspecific()/setspecific() on these, and in theory
   1801  * you could also call pthread_key_delete() as well, though this would
   1802  * probably break some apps.
   1803  *
   1804  * The 'tlsmap_t' type defined below implements a shared global map of
   1805  * currently created/allocated TLS keys and the destructors associated
   1806  * with them. You should use tlsmap_lock/unlock to access it to avoid
   1807  * any race condition.
   1808  *
   1809  * the global TLS map simply contains a bitmap of allocated keys, and
   1810  * an array of destructors.
   1811  *
   1812  * each thread has a TLS area that is a simple array of TLSMAP_SIZE void*
   1813  * pointers. the TLS area of the main thread is stack-allocated in
   1814  * __libc_init_common, while the TLS area of other threads is placed at
   1815  * the top of their stack in pthread_create.
   1816  *
   1817  * when pthread_key_create() is called, it finds the first free key in the
   1818  * bitmap, then set it to 1, saving the destructor altogether
   1819  *
   1820  * when pthread_key_delete() is called. it will erase the key's bitmap bit
   1821  * and its destructor, and will also clear the key data in the TLS area of
   1822  * all created threads. As mandated by Posix, it is the responsability of
   1823  * the caller of pthread_key_delete() to properly reclaim the objects that
   1824  * were pointed to by these data fields (either before or after the call).
   1825  *
   1826  */
   1827 
   1828 /* TLS Map implementation
   1829  */
   1830 
   1831 #define TLSMAP_START      (TLS_SLOT_MAX_WELL_KNOWN+1)
   1832 #define TLSMAP_SIZE       BIONIC_TLS_SLOTS
   1833 #define TLSMAP_BITS       32
   1834 #define TLSMAP_WORDS      ((TLSMAP_SIZE+TLSMAP_BITS-1)/TLSMAP_BITS)
   1835 #define TLSMAP_WORD(m,k)  (m)->map[(k)/TLSMAP_BITS]
   1836 #define TLSMAP_MASK(k)    (1U << ((k)&(TLSMAP_BITS-1)))
   1837 
   1838 /* this macro is used to quickly check that a key belongs to a reasonable range */
   1839 #define TLSMAP_VALIDATE_KEY(key)  \
   1840     ((key) >= TLSMAP_START && (key) < TLSMAP_SIZE)
   1841 
   1842 /* the type of tls key destructor functions */
   1843 typedef void (*tls_dtor_t)(void*);
   1844 
   1845 typedef struct {
   1846     int         init;                  /* see comment in tlsmap_lock() */
   1847     uint32_t    map[TLSMAP_WORDS];     /* bitmap of allocated keys */
   1848     tls_dtor_t  dtors[TLSMAP_SIZE];    /* key destructors */
   1849 } tlsmap_t;
   1850 
   1851 static pthread_mutex_t  _tlsmap_lock = PTHREAD_MUTEX_INITIALIZER;
   1852 static tlsmap_t         _tlsmap;
   1853 
   1854 /* lock the global TLS map lock and return a handle to it */
   1855 static __inline__ tlsmap_t* tlsmap_lock(void)
   1856 {
   1857     tlsmap_t*   m = &_tlsmap;
   1858 
   1859     pthread_mutex_lock(&_tlsmap_lock);
   1860     /* we need to initialize the first entry of the 'map' array
   1861      * with the value TLS_DEFAULT_ALLOC_MAP. doing it statically
   1862      * when declaring _tlsmap is a bit awkward and is going to
   1863      * produce warnings, so do it the first time we use the map
   1864      * instead
   1865      */
   1866     if (__unlikely(!m->init)) {
   1867         TLSMAP_WORD(m,0) = TLS_DEFAULT_ALLOC_MAP;
   1868         m->init          = 1;
   1869     }
   1870     return m;
   1871 }
   1872 
   1873 /* unlock the global TLS map */
   1874 static __inline__ void tlsmap_unlock(tlsmap_t*  m)
   1875 {
   1876     pthread_mutex_unlock(&_tlsmap_lock);
   1877     (void)m;  /* a good compiler is a happy compiler */
   1878 }
   1879 
   1880 /* test to see wether a key is allocated */
   1881 static __inline__ int tlsmap_test(tlsmap_t*  m, int  key)
   1882 {
   1883     return (TLSMAP_WORD(m,key) & TLSMAP_MASK(key)) != 0;
   1884 }
   1885 
   1886 /* set the destructor and bit flag on a newly allocated key */
   1887 static __inline__ void tlsmap_set(tlsmap_t*  m, int  key, tls_dtor_t  dtor)
   1888 {
   1889     TLSMAP_WORD(m,key) |= TLSMAP_MASK(key);
   1890     m->dtors[key]       = dtor;
   1891 }
   1892 
   1893 /* clear the destructor and bit flag on an existing key */
   1894 static __inline__ void  tlsmap_clear(tlsmap_t*  m, int  key)
   1895 {
   1896     TLSMAP_WORD(m,key) &= ~TLSMAP_MASK(key);
   1897     m->dtors[key]       = NULL;
   1898 }
   1899 
   1900 /* allocate a new TLS key, return -1 if no room left */
   1901 static int tlsmap_alloc(tlsmap_t*  m, tls_dtor_t  dtor)
   1902 {
   1903     int  key;
   1904 
   1905     for ( key = TLSMAP_START; key < TLSMAP_SIZE; key++ ) {
   1906         if ( !tlsmap_test(m, key) ) {
   1907             tlsmap_set(m, key, dtor);
   1908             return key;
   1909         }
   1910     }
   1911     return -1;
   1912 }
   1913 
   1914 
   1915 int pthread_key_create(pthread_key_t *key, void (*destructor_function)(void *))
   1916 {
   1917     uint32_t   err = ENOMEM;
   1918     tlsmap_t*  map = tlsmap_lock();
   1919     int        k   = tlsmap_alloc(map, destructor_function);
   1920 
   1921     if (k >= 0) {
   1922         *key = k;
   1923         err  = 0;
   1924     }
   1925     tlsmap_unlock(map);
   1926     return err;
   1927 }
   1928 
   1929 
   1930 /* This deletes a pthread_key_t. note that the standard mandates that this does
   1931  * not call the destructor of non-NULL key values. Instead, it is the
   1932  * responsibility of the caller to properly dispose of the corresponding data
   1933  * and resources, using any means it finds suitable.
   1934  *
   1935  * On the other hand, this function will clear the corresponding key data
   1936  * values in all known threads. this prevents later (invalid) calls to
   1937  * pthread_getspecific() to receive invalid/stale values.
   1938  */
   1939 int pthread_key_delete(pthread_key_t key)
   1940 {
   1941     uint32_t             err;
   1942     pthread_internal_t*  thr;
   1943     tlsmap_t*            map;
   1944 
   1945     if (!TLSMAP_VALIDATE_KEY(key)) {
   1946         return EINVAL;
   1947     }
   1948 
   1949     map = tlsmap_lock();
   1950 
   1951     if (!tlsmap_test(map, key)) {
   1952         err = EINVAL;
   1953         goto err1;
   1954     }
   1955 
   1956     /* clear value in all threads */
   1957     pthread_mutex_lock(&gThreadListLock);
   1958     for ( thr = gThreadList; thr != NULL; thr = thr->next ) {
   1959         /* avoid zombie threads with a negative 'join_count'. these are really
   1960          * already dead and don't have a TLS area anymore.
   1961          *
   1962          * similarly, it is possible to have thr->tls == NULL for threads that
   1963          * were just recently created through pthread_create() but whose
   1964          * startup trampoline (__thread_entry) hasn't been run yet by the
   1965          * scheduler. thr->tls will also be NULL after it's stack has been
   1966          * unmapped but before the ongoing pthread_join() is finished.
   1967          * so check for this too.
   1968          */
   1969         if (thr->join_count < 0 || !thr->tls)
   1970             continue;
   1971 
   1972         thr->tls[key] = NULL;
   1973     }
   1974     tlsmap_clear(map, key);
   1975 
   1976     pthread_mutex_unlock(&gThreadListLock);
   1977     err = 0;
   1978 
   1979 err1:
   1980     tlsmap_unlock(map);
   1981     return err;
   1982 }
   1983 
   1984 
   1985 int pthread_setspecific(pthread_key_t key, const void *ptr)
   1986 {
   1987     int        err = EINVAL;
   1988     tlsmap_t*  map;
   1989 
   1990     if (TLSMAP_VALIDATE_KEY(key)) {
   1991         /* check that we're trying to set data for an allocated key */
   1992         map = tlsmap_lock();
   1993         if (tlsmap_test(map, key)) {
   1994             ((uint32_t *)__get_tls())[key] = (uint32_t)ptr;
   1995             err = 0;
   1996         }
   1997         tlsmap_unlock(map);
   1998     }
   1999     return err;
   2000 }
   2001 
   2002 void * pthread_getspecific(pthread_key_t key)
   2003 {
   2004     if (!TLSMAP_VALIDATE_KEY(key)) {
   2005         return NULL;
   2006     }
   2007 
   2008     /* for performance reason, we do not lock/unlock the global TLS map
   2009      * to check that the key is properly allocated. if the key was not
   2010      * allocated, the value read from the TLS should always be NULL
   2011      * due to pthread_key_delete() clearing the values for all threads.
   2012      */
   2013     return (void *)(((unsigned *)__get_tls())[key]);
   2014 }
   2015 
   2016 /* Posix mandates that this be defined in <limits.h> but we don't have
   2017  * it just yet.
   2018  */
   2019 #ifndef PTHREAD_DESTRUCTOR_ITERATIONS
   2020 #  define PTHREAD_DESTRUCTOR_ITERATIONS  4
   2021 #endif
   2022 
   2023 /* this function is called from pthread_exit() to remove all TLS key data
   2024  * from this thread's TLS area. this must call the destructor of all keys
   2025  * that have a non-NULL data value (and a non-NULL destructor).
   2026  *
   2027  * because destructors can do funky things like deleting/creating other
   2028  * keys, we need to implement this in a loop
   2029  */
   2030 static void pthread_key_clean_all(void)
   2031 {
   2032     tlsmap_t*    map;
   2033     void**       tls = (void**)__get_tls();
   2034     int          rounds = PTHREAD_DESTRUCTOR_ITERATIONS;
   2035 
   2036     map = tlsmap_lock();
   2037 
   2038     for (rounds = PTHREAD_DESTRUCTOR_ITERATIONS; rounds > 0; rounds--)
   2039     {
   2040         int  kk, count = 0;
   2041 
   2042         for (kk = TLSMAP_START; kk < TLSMAP_SIZE; kk++) {
   2043             if ( tlsmap_test(map, kk) )
   2044             {
   2045                 void*       data = tls[kk];
   2046                 tls_dtor_t  dtor = map->dtors[kk];
   2047 
   2048                 if (data != NULL && dtor != NULL)
   2049                 {
   2050                    /* we need to clear the key data now, this will prevent the
   2051                     * destructor (or a later one) from seeing the old value if
   2052                     * it calls pthread_getspecific() for some odd reason
   2053                     *
   2054                     * we do not do this if 'dtor == NULL' just in case another
   2055                     * destructor function might be responsible for manually
   2056                     * releasing the corresponding data.
   2057                     */
   2058                     tls[kk] = NULL;
   2059 
   2060                    /* because the destructor is free to call pthread_key_create
   2061                     * and/or pthread_key_delete, we need to temporarily unlock
   2062                     * the TLS map
   2063                     */
   2064                     tlsmap_unlock(map);
   2065                     (*dtor)(data);
   2066                     map = tlsmap_lock();
   2067 
   2068                     count += 1;
   2069                 }
   2070             }
   2071         }
   2072 
   2073         /* if we didn't call any destructor, there is no need to check the
   2074          * TLS data again
   2075          */
   2076         if (count == 0)
   2077             break;
   2078     }
   2079     tlsmap_unlock(map);
   2080 }
   2081 
   2082 // man says this should be in <linux/unistd.h>, but it isn't
   2083 extern int tgkill(int tgid, int tid, int sig);
   2084 
   2085 int pthread_kill(pthread_t tid, int sig)
   2086 {
   2087     int  ret;
   2088     int  old_errno = errno;
   2089     pthread_internal_t * thread = (pthread_internal_t *)tid;
   2090 
   2091     ret = tgkill(getpid(), thread->kernel_id, sig);
   2092     if (ret < 0) {
   2093         ret = errno;
   2094         errno = old_errno;
   2095     }
   2096 
   2097     return ret;
   2098 }
   2099 
   2100 /* Despite the fact that our kernel headers define sigset_t explicitly
   2101  * as a 32-bit integer, the kernel system call really expects a 64-bit
   2102  * bitmap for the signal set, or more exactly an array of two-32-bit
   2103  * values (see $KERNEL/arch/$ARCH/include/asm/signal.h for details).
   2104  *
   2105  * Unfortunately, we cannot fix the sigset_t definition without breaking
   2106  * the C library ABI, so perform a little runtime translation here.
   2107  */
   2108 typedef union {
   2109     sigset_t   bionic;
   2110     uint32_t   kernel[2];
   2111 } kernel_sigset_t;
   2112 
   2113 /* this is a private syscall stub */
   2114 extern int __rt_sigprocmask(int, const kernel_sigset_t *, kernel_sigset_t *, size_t);
   2115 
   2116 int pthread_sigmask(int how, const sigset_t *set, sigset_t *oset)
   2117 {
   2118     /* pthread_sigmask must return the error code, but the syscall
   2119      * will set errno instead and return 0/-1
   2120      */
   2121     int ret, old_errno = errno;
   2122 
   2123     /* We must convert *set into a kernel_sigset_t */
   2124     kernel_sigset_t  in_set, *in_set_ptr;
   2125     kernel_sigset_t  out_set;
   2126 
   2127     in_set.kernel[0] = in_set.kernel[1] = 0;
   2128     out_set.kernel[0] = out_set.kernel[1] = 0;
   2129 
   2130     /* 'in_set_ptr' is the second parameter to __rt_sigprocmask. It must be NULL
   2131      * if 'set' is NULL to ensure correct semantics (which in this case would
   2132      * be to ignore 'how' and return the current signal set into 'oset'.
   2133      */
   2134     if (set == NULL) {
   2135         in_set_ptr = NULL;
   2136     } else {
   2137         in_set.bionic = *set;
   2138         in_set_ptr = &in_set;
   2139     }
   2140 
   2141     ret = __rt_sigprocmask(how, in_set_ptr, &out_set, sizeof(kernel_sigset_t));
   2142     if (ret < 0)
   2143         ret = errno;
   2144 
   2145     if (oset)
   2146         *oset = out_set.bionic;
   2147 
   2148     errno = old_errno;
   2149     return ret;
   2150 }
   2151 
   2152 
   2153 int pthread_getcpuclockid(pthread_t  tid, clockid_t  *clockid)
   2154 {
   2155     const int            CLOCK_IDTYPE_BITS = 3;
   2156     pthread_internal_t*  thread = (pthread_internal_t*)tid;
   2157 
   2158     if (!thread)
   2159         return ESRCH;
   2160 
   2161     *clockid = CLOCK_THREAD_CPUTIME_ID | (thread->kernel_id << CLOCK_IDTYPE_BITS);
   2162     return 0;
   2163 }
   2164 
   2165 
   2166 /* NOTE: this implementation doesn't support a init function that throws a C++ exception
   2167  *       or calls fork()
   2168  */
   2169 int  pthread_once( pthread_once_t*  once_control,  void (*init_routine)(void) )
   2170 {
   2171     static pthread_mutex_t   once_lock = PTHREAD_RECURSIVE_MUTEX_INITIALIZER;
   2172     volatile pthread_once_t* ocptr = once_control;
   2173     pthread_once_t value;
   2174 
   2175     /* PTHREAD_ONCE_INIT is 0, we use the following bit flags
   2176      *
   2177      *   bit 0 set  -> initialization is under way
   2178      *   bit 1 set  -> initialization is complete
   2179      */
   2180 #define ONCE_INITIALIZING           (1 << 0)
   2181 #define ONCE_COMPLETED              (1 << 1)
   2182 
   2183     /* First check if the once is already initialized. This will be the common
   2184     * case and we want to make this as fast as possible. Note that this still
   2185     * requires a load_acquire operation here to ensure that all the
   2186     * stores performed by the initialization function are observable on
   2187     * this CPU after we exit.
   2188     */
   2189     if (__likely((*ocptr & ONCE_COMPLETED) != 0)) {
   2190         ANDROID_MEMBAR_FULL();
   2191         return 0;
   2192     }
   2193 
   2194     for (;;) {
   2195         /* Try to atomically set the INITIALIZING flag.
   2196          * This requires a cmpxchg loop, and we may need
   2197          * to exit prematurely if we detect that
   2198          * COMPLETED is now set.
   2199          */
   2200         int32_t  oldval, newval;
   2201 
   2202         do {
   2203             oldval = *ocptr;
   2204             if ((oldval & ONCE_COMPLETED) != 0)
   2205                 break;
   2206 
   2207             newval = oldval | ONCE_INITIALIZING;
   2208         } while (__bionic_cmpxchg(oldval, newval, ocptr) != 0);
   2209 
   2210         if ((oldval & ONCE_COMPLETED) != 0) {
   2211             /* We detected that COMPLETED was set while in our loop */
   2212             ANDROID_MEMBAR_FULL();
   2213             return 0;
   2214         }
   2215 
   2216         if ((oldval & ONCE_INITIALIZING) == 0) {
   2217             /* We got there first, we can jump out of the loop to
   2218              * handle the initialization */
   2219             break;
   2220         }
   2221 
   2222         /* Another thread is running the initialization and hasn't completed
   2223          * yet, so wait for it, then try again. */
   2224         __futex_wait_ex(ocptr, 0, oldval, NULL);
   2225     }
   2226 
   2227     /* call the initialization function. */
   2228     (*init_routine)();
   2229 
   2230     /* Do a store_release indicating that initialization is complete */
   2231     ANDROID_MEMBAR_FULL();
   2232     *ocptr = ONCE_COMPLETED;
   2233 
   2234     /* Wake up any waiters, if any */
   2235     __futex_wake_ex(ocptr, 0, INT_MAX);
   2236 
   2237     return 0;
   2238 }
   2239 
   2240 /* This value is not exported by kernel headers, so hardcode it here */
   2241 #define MAX_TASK_COMM_LEN	16
   2242 #define TASK_COMM_FMT 		"/proc/self/task/%u/comm"
   2243 
   2244 int pthread_setname_np(pthread_t thid, const char *thname)
   2245 {
   2246     size_t thname_len;
   2247     int saved_errno, ret;
   2248 
   2249     if (thid == 0 || thname == NULL)
   2250         return EINVAL;
   2251 
   2252     thname_len = strlen(thname);
   2253     if (thname_len >= MAX_TASK_COMM_LEN)
   2254         return ERANGE;
   2255 
   2256     saved_errno = errno;
   2257     if (thid == pthread_self())
   2258     {
   2259         ret = prctl(PR_SET_NAME, (unsigned long)thname, 0, 0, 0) ? errno : 0;
   2260     }
   2261     else
   2262     {
   2263         /* Have to change another thread's name */
   2264         pthread_internal_t *thread = (pthread_internal_t *)thid;
   2265         char comm_name[sizeof(TASK_COMM_FMT) + 8];
   2266         ssize_t n;
   2267         int fd;
   2268 
   2269         snprintf(comm_name, sizeof(comm_name), TASK_COMM_FMT, (unsigned int)thread->kernel_id);
   2270         fd = open(comm_name, O_RDWR);
   2271         if (fd == -1)
   2272         {
   2273             ret = errno;
   2274             goto exit;
   2275         }
   2276         n = TEMP_FAILURE_RETRY(write(fd, thname, thname_len));
   2277         close(fd);
   2278 
   2279         if (n < 0)
   2280             ret = errno;
   2281         else if ((size_t)n != thname_len)
   2282             ret = EIO;
   2283         else
   2284             ret = 0;
   2285     }
   2286 exit:
   2287     errno = saved_errno;
   2288     return ret;
   2289 }
   2290 
   2291 /* Return the kernel thread ID for a pthread.
   2292  * This is only defined for implementations where pthread <-> kernel is 1:1, which this is.
   2293  * Not the same as pthread_getthreadid_np, which is commonly defined to be opaque.
   2294  * Internal, not an NDK API.
   2295  */
   2296 
   2297 pid_t __pthread_gettid(pthread_t thid)
   2298 {
   2299     pthread_internal_t* thread = (pthread_internal_t*)thid;
   2300     return thread->kernel_id;
   2301 }
   2302 
   2303 int __pthread_settid(pthread_t thid, pid_t tid)
   2304 {
   2305     if (thid == 0)
   2306         return EINVAL;
   2307 
   2308     pthread_internal_t* thread = (pthread_internal_t*)thid;
   2309     thread->kernel_id = tid;
   2310 
   2311     return 0;
   2312 }
   2313