What binary value does Thread and Process ID Register contains in Android ARM?

Question

I have following instructions in Android shared library:

MRC p15, 0, R3,c13,c0, 3 
LDR R3, [R3,#4] 
MOV R0, #0 
STR R0, [R3,#0xC]

According to ARM documentation:

Reading or writing the Thread and Process ID Registers has no effect on the processor state or operation. These registers provide OS support and must be managed by the OS.

That's nice, but what is implementation of this register value in Android or ARM Linux?

From the code, it tries to read Thread and Process ID Register value as structure,and it reads some field with offset 4. This field is pointer to structure itself, and it writes 0 to field with offset 12.

So, the register value is for sure not pthread_t, because, according to Android source codes, pthread_t field with offset 4 is unsigned int and not pointer to any structure.

Does anyone know where can I find definition of structure returned by MRC c13::c0::3 in Android ARM?

Answer 1

Just in case anyone else will have the same issue, after reading a lot of Android sources and real applications memory dumps, I found that:

• MRC c13::c0::3 returns pointer to structure that contains 2 words.
• The 2nd world is the same value as pthread_self returns (i. e. it is pthread_t of current thread).
• pthread_t is actually pointer to pthread_internal_t structure, you can see its definition here for example https://android.googlesource.com/platform/bionic.git/+/refs/heads/android10-release/libc/bionic/pthread_internal.h
• From the definition, field at offset 12 (0xC) is pid_t cached_pid_.

So, this code sets cached pid value to 0. It looks like it is required to force getpid to read real pid value instead of using cached one (PID caching is known source of bugs in some glibc versions).