From 889f7fed9ada15e48c8ef6e444d65e918ac02504 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 11 May 2026 03:38:09 +0000
Subject: [PATCH 01/11] hook
 pthread_mutex_lock/pthread_mutex_unlock/WaitOnAddress and add tests

Agent-Logs-Url: https://github.com/acl-dev/open-coroutine/sessions/a4199b83-4d02-43f6-aa5a-f79a5303135a

Co-authored-by: loongs-zhang <38336731+loongs-zhang@users.noreply.github.com>
---
 core/Cargo.toml             |  3 +++
 core/tests/scheduler.rs     | 34 ++++++++++++++++++++++++++++++++++
 hook/src/syscall/unix.rs    |  7 +++----
 hook/src/syscall/windows.rs |  3 +--
 4 files changed, 41 insertions(+), 6 deletions(-)

diff --git a/core/Cargo.toml b/core/Cargo.toml
index 14b378d2..d46b1f2d 100644
--- a/core/Cargo.toml
+++ b/core/Cargo.toml
@@ -74,6 +74,9 @@ anyhow.workspace = true
 slab.workspace = true
 backtrace.workspace = true
 
+[target.'cfg(unix)'.dev-dependencies]
+libc.workspace = true
+
 [features]
 default = ["log", "syscall"]
 
diff --git a/core/tests/scheduler.rs b/core/tests/scheduler.rs
index 6fc0deba..f4820598 100644
--- a/core/tests/scheduler.rs
+++ b/core/tests/scheduler.rs
@@ -130,6 +130,40 @@ fn scheduler_listener() -> std::io::Result<()> {
     Ok(())
 }
 
+#[cfg(unix)]
+#[test]
+fn scheduler_pthread_mutex_lock() -> std::io::Result<()> {
+    use std::sync::atomic::{AtomicUsize, Ordering};
+
+    static COUNTER: AtomicUsize = AtomicUsize::new(0);
+
+    let mut scheduler = Scheduler::default();
+    for _ in 0..3 {
+        _ = scheduler.submit_co(
+            |_, _| {
+                let mut mutex = libc::PTHREAD_MUTEX_INITIALIZER;
+                let r = open_coroutine_core::syscall::pthread_mutex_lock(
+                    None,
+                    std::ptr::addr_of_mut!(mutex),
+                );
+                assert_eq!(0, r, "pthread_mutex_lock failed with {r}");
+                COUNTER.fetch_add(1, Ordering::SeqCst);
+                let r = open_coroutine_core::syscall::pthread_mutex_unlock(
+                    None,
+                    std::ptr::addr_of_mut!(mutex),
+                );
+                assert_eq!(0, r, "pthread_mutex_unlock failed with {r}");
+                None
+            },
+            None,
+            None,
+        )?;
+    }
+    scheduler.try_schedule()?;
+    assert_eq!(3, COUNTER.load(Ordering::SeqCst));
+    Ok(())
+}
+
 #[test]
 fn scheduler_try_cancel_coroutine() -> std::io::Result<()> {
     let mut scheduler = Scheduler::default();
diff --git a/hook/src/syscall/unix.rs b/hook/src/syscall/unix.rs
index 14682cbc..e401e57e 100644
--- a/hook/src/syscall/unix.rs
+++ b/hook/src/syscall/unix.rs
@@ -80,9 +80,8 @@ impl_hook!(RENAMEAT, renameat(olddirfd: c_int, oldpath: *const c_char, newdirfd:
 #[cfg(target_os = "linux")]
 impl_hook!(RENAMEAT2, renameat2(olddirfd: c_int, oldpath: *const c_char, newdirfd: c_int, newpath: *const c_char, flags: c_uint) -> c_int);
 
+impl_hook!(PTHREAD_MUTEX_LOCK, pthread_mutex_lock(lock: *mut pthread_mutex_t) -> c_int);
+impl_hook!(PTHREAD_MUTEX_UNLOCK, pthread_mutex_unlock(lock: *mut pthread_mutex_t) -> c_int);
+
 // NOTE: unhook poll due to mio's poller
 // impl_hook!(POLL, poll(fds: *mut pollfd, nfds: nfds_t, timeout: c_int) -> c_int);
-
-// NOTE: unhook pthread_mutex_lock/pthread_mutex_unlock due to stack overflow or bug
-// impl_hook!(PTHREAD_MUTEX_LOCK, pthread_mutex_lock(lock: *mut pthread_mutex_t) -> c_int);
-// impl_hook!(PTHREAD_MUTEX_UNLOCK, pthread_mutex_unlock(lock: *mut pthread_mutex_t) -> c_int);
diff --git a/hook/src/syscall/windows.rs b/hook/src/syscall/windows.rs
index a4c4d477..22b2be46 100644
--- a/hook/src/syscall/windows.rs
+++ b/hook/src/syscall/windows.rs
@@ -88,8 +88,7 @@ unsafe fn attach() -> std::io::Result<()> {
     impl_hook!("ws2_32.dll", WSASOCKETW, WSASocketW(domain: c_int, ty: WINSOCK_SOCKET_TYPE, protocol: IPPROTO, lpprotocolinfo: *const WSAPROTOCOL_INFOW, g: c_uint, dw_flags: c_uint) -> SOCKET);
     impl_hook!("ws2_32.dll", SELECT, select(nfds: c_int, readfds: *mut FD_SET, writefds: *mut FD_SET, errorfds: *mut FD_SET, timeout: *mut TIMEVAL) -> c_int);
     impl_hook!("ws2_32.dll", WSAPOLL, WSAPoll(fds: *mut WSAPOLLFD, nfds: c_uint, timeout: c_int) -> c_int);
-    // NOTE: unhook WaitOnAddress due to stack overflow or bug
-    // impl_hook!("api-ms-win-core-synch-l1-2-0.dll", WAITONADDRESS, WaitOnAddress(address: *const c_void, compareaddress: *const c_void, addresssize: usize, dwmilliseconds: c_uint) -> BOOL);
+    impl_hook!("api-ms-win-core-synch-l1-2-0.dll", WAITONADDRESS, WaitOnAddress(address: *const c_void, compareaddress: *const c_void, addresssize: usize, dwmilliseconds: c_uint) -> BOOL);
 
     // Enable the hook
     minhook::MinHook::enable_all_hooks().map_err(|_| Error::other("init all hooks failed !"))

From 16464195f738b503fa82ef3f152f8d763a284d22 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 11 May 2026 03:41:52 +0000
Subject: [PATCH 02/11] use shared static mutex in pthread_mutex_lock test

Agent-Logs-Url: https://github.com/acl-dev/open-coroutine/sessions/a4199b83-4d02-43f6-aa5a-f79a5303135a

Co-authored-by: loongs-zhang <38336731+loongs-zhang@users.noreply.github.com>
---
 core/tests/scheduler.rs | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/core/tests/scheduler.rs b/core/tests/scheduler.rs
index f4820598..61295d7e 100644
--- a/core/tests/scheduler.rs
+++ b/core/tests/scheduler.rs
@@ -136,21 +136,21 @@ fn scheduler_pthread_mutex_lock() -> std::io::Result<()> {
     use std::sync::atomic::{AtomicUsize, Ordering};
 
     static COUNTER: AtomicUsize = AtomicUsize::new(0);
+    static mut MUTEX: libc::pthread_mutex_t = libc::PTHREAD_MUTEX_INITIALIZER;
 
     let mut scheduler = Scheduler::default();
     for _ in 0..3 {
         _ = scheduler.submit_co(
             |_, _| {
-                let mut mutex = libc::PTHREAD_MUTEX_INITIALIZER;
                 let r = open_coroutine_core::syscall::pthread_mutex_lock(
                     None,
-                    std::ptr::addr_of_mut!(mutex),
+                    std::ptr::addr_of_mut!(MUTEX),
                 );
                 assert_eq!(0, r, "pthread_mutex_lock failed with {r}");
                 COUNTER.fetch_add(1, Ordering::SeqCst);
                 let r = open_coroutine_core::syscall::pthread_mutex_unlock(
                     None,
-                    std::ptr::addr_of_mut!(mutex),
+                    std::ptr::addr_of_mut!(MUTEX),
                 );
                 assert_eq!(0, r, "pthread_mutex_unlock failed with {r}");
                 None

From 10729731d37410654f0a40964da1a783f248a015 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 11 May 2026 08:33:10 +0000
Subject: [PATCH 03/11] fix CI failures: re-entrancy guards for pthread_mutex
 and WaitOnAddress hooks, cfg-gate test

Agent-Logs-Url: https://github.com/acl-dev/open-coroutine/sessions/66bb6c33-ec19-440e-82f5-08d9566b66a5

Co-authored-by: loongs-zhang <38336731+loongs-zhang@users.noreply.github.com>
---
 core/src/syscall/windows/WaitOnAddress.rs | 10 +++
 core/tests/scheduler.rs                   |  2 +-
 hook/src/syscall/unix.rs                  | 96 ++++++++++++++++++++++-
 hook/src/syscall/windows.rs               | 74 ++++++++++++++++-
 4 files changed, 178 insertions(+), 4 deletions(-)

diff --git a/core/src/syscall/windows/WaitOnAddress.rs b/core/src/syscall/windows/WaitOnAddress.rs
index 1db0bcbc..28fe284b 100644
--- a/core/src/syscall/windows/WaitOnAddress.rs
+++ b/core/src/syscall/windows/WaitOnAddress.rs
@@ -4,6 +4,7 @@ use windows_sys::core::BOOL;
 use windows_sys::Win32::Foundation::{ERROR_TIMEOUT, FALSE, TRUE};
 use crate::common::{get_timeout_time, now};
 use crate::net::EventLoops;
+use crate::scheduler::SchedulableCoroutine;
 use crate::syscall::reset_errno;
 use crate::syscall::set_errno;
 
@@ -51,6 +52,15 @@ impl<I: WaitOnAddressSyscall> WaitOnAddressSyscall for NioWaitOnAddressSyscall<I
         addresssize: usize,
         dwmilliseconds: c_uint
     ) -> BOOL {
+        // Not inside a coroutine: call the real function directly.  This avoids turning
+        // every internal runtime WaitOnAddress (parking_lot, once_cell, std::sync::Once)
+        // into a slow 1 ms polling loop and prevents recursive EventLoops::wait_event
+        // calls from corrupting coroutine scheduling state.
+        if SchedulableCoroutine::current().is_none() {
+            return self.inner.WaitOnAddress(
+                fn_ptr, address, compareaddress, addresssize, dwmilliseconds,
+            );
+        }
         let timeout = get_timeout_time(Duration::from_millis(dwmilliseconds.into()));
         loop {
             let mut left_time = timeout.saturating_sub(now());
diff --git a/core/tests/scheduler.rs b/core/tests/scheduler.rs
index 61295d7e..077239bf 100644
--- a/core/tests/scheduler.rs
+++ b/core/tests/scheduler.rs
@@ -130,7 +130,7 @@ fn scheduler_listener() -> std::io::Result<()> {
     Ok(())
 }
 
-#[cfg(unix)]
+#[cfg(all(unix, feature = "syscall"))]
 #[test]
 fn scheduler_pthread_mutex_lock() -> std::io::Result<()> {
     use std::sync::atomic::{AtomicUsize, Ordering};
diff --git a/hook/src/syscall/unix.rs b/hook/src/syscall/unix.rs
index e401e57e..9c748595 100644
--- a/hook/src/syscall/unix.rs
+++ b/hook/src/syscall/unix.rs
@@ -2,7 +2,9 @@ use libc::{
     fd_set, iovec, mode_t, msghdr, off_t, pthread_cond_t, pthread_mutex_t, size_t, sockaddr,
     socklen_t, ssize_t, timespec, timeval,
 };
+use std::cell::Cell;
 use std::ffi::{c_char, c_int, c_uint, c_void};
+use std::sync::atomic::{AtomicPtr, Ordering};
 
 // check https://www.rustwiki.org.cn/en/reference/introduction.html for help information
 #[allow(unused_macros)]
@@ -80,8 +82,98 @@ impl_hook!(RENAMEAT, renameat(olddirfd: c_int, oldpath: *const c_char, newdirfd:
 #[cfg(target_os = "linux")]
 impl_hook!(RENAMEAT2, renameat2(olddirfd: c_int, oldpath: *const c_char, newdirfd: c_int, newpath: *const c_char, flags: c_uint) -> c_int);
 
-impl_hook!(PTHREAD_MUTEX_LOCK, pthread_mutex_lock(lock: *mut pthread_mutex_t) -> c_int);
-impl_hook!(PTHREAD_MUTEX_UNLOCK, pthread_mutex_unlock(lock: *mut pthread_mutex_t) -> c_int);
+// Thread-local re-entrancy flag shared between pthread_mutex_lock and pthread_mutex_unlock.
+// On macOS, std::sync::Mutex is backed by pthread_mutex_t, so once_cell::sync::Lazy (which
+// uses std::sync::Mutex internally) would recursively invoke these hooks during the
+// first-time initialisation of any Lazy<CHAIN> static.  The flag detects that situation
+// and falls through to the real system function, breaking the cycle.
+thread_local! {
+    static PTHREAD_MUTEX_HOOK_DEPTH: Cell<bool> = const { Cell::new(false) };
+}
+
+// Store function pointers as plain atomics so that loading them never requires a mutex.
+// Using once_cell::sync::Lazy here would trigger the exact recursion described above.
+static PTHREAD_MUTEX_LOCK_PTR: AtomicPtr<()> = AtomicPtr::new(std::ptr::null_mut());
+static PTHREAD_MUTEX_UNLOCK_PTR: AtomicPtr<()> = AtomicPtr::new(std::ptr::null_mut());
+
+#[no_mangle]
+pub extern "C" fn pthread_mutex_lock(lock: *mut pthread_mutex_t) -> c_int {
+    let mut raw = PTHREAD_MUTEX_LOCK_PTR.load(Ordering::Acquire);
+    if raw.is_null() {
+        // dlsym uses its own internal locking (not pthread_mutex_lock), so this is safe
+        // even when called re-entrantly.
+        let ptr = unsafe {
+            libc::dlsym(
+                libc::RTLD_NEXT,
+                c"pthread_mutex_lock".as_ptr(),
+            )
+        };
+        assert!(!ptr.is_null(), "pthread_mutex_lock not found!");
+        let ptr = ptr.cast::<()>();
+        PTHREAD_MUTEX_LOCK_PTR.store(ptr, Ordering::Release);
+        raw = ptr;
+    }
+    let fn_ptr: extern "C" fn(*mut pthread_mutex_t) -> c_int =
+        unsafe { std::mem::transmute(raw) };
+
+    // If already executing inside this hook (e.g., once_cell or std::sync internals call
+    // pthread_mutex_lock while the hook chain is being initialised), use the real function
+    // directly to avoid infinite recursion.
+    if PTHREAD_MUTEX_HOOK_DEPTH.with(Cell::get) {
+        return fn_ptr(lock);
+    }
+    PTHREAD_MUTEX_HOOK_DEPTH.with(|b| b.set(true));
+
+    let result = if crate::hook()
+        || open_coroutine_core::scheduler::SchedulableCoroutine::current().is_some()
+        || cfg!(feature = "ci")
+    {
+        open_coroutine_core::syscall::pthread_mutex_lock(Some(&fn_ptr), lock)
+    } else {
+        fn_ptr(lock)
+    };
+
+    PTHREAD_MUTEX_HOOK_DEPTH.with(|b| b.set(false));
+    result
+}
+
+#[no_mangle]
+pub extern "C" fn pthread_mutex_unlock(lock: *mut pthread_mutex_t) -> c_int {
+    let mut raw = PTHREAD_MUTEX_UNLOCK_PTR.load(Ordering::Acquire);
+    if raw.is_null() {
+        let ptr = unsafe {
+            libc::dlsym(
+                libc::RTLD_NEXT,
+                c"pthread_mutex_unlock".as_ptr(),
+            )
+        };
+        assert!(!ptr.is_null(), "pthread_mutex_unlock not found!");
+        let ptr = ptr.cast::<()>();
+        PTHREAD_MUTEX_UNLOCK_PTR.store(ptr, Ordering::Release);
+        raw = ptr;
+    }
+    let fn_ptr: extern "C" fn(*mut pthread_mutex_t) -> c_int =
+        unsafe { std::mem::transmute(raw) };
+
+    // Same guard as pthread_mutex_lock – once_cell may call pthread_mutex_unlock while
+    // unlocking its internal mutex during hook-chain initialisation.
+    if PTHREAD_MUTEX_HOOK_DEPTH.with(Cell::get) {
+        return fn_ptr(lock);
+    }
+    PTHREAD_MUTEX_HOOK_DEPTH.with(|b| b.set(true));
+
+    let result = if crate::hook()
+        || open_coroutine_core::scheduler::SchedulableCoroutine::current().is_some()
+        || cfg!(feature = "ci")
+    {
+        open_coroutine_core::syscall::pthread_mutex_unlock(Some(&fn_ptr), lock)
+    } else {
+        fn_ptr(lock)
+    };
+
+    PTHREAD_MUTEX_HOOK_DEPTH.with(|b| b.set(false));
+    result
+}
 
 // NOTE: unhook poll due to mio's poller
 // impl_hook!(POLL, poll(fds: *mut pollfd, nfds: nfds_t, timeout: c_int) -> c_int);
diff --git a/hook/src/syscall/windows.rs b/hook/src/syscall/windows.rs
index 22b2be46..488d5d39 100644
--- a/hook/src/syscall/windows.rs
+++ b/hook/src/syscall/windows.rs
@@ -1,3 +1,4 @@
+use std::cell::Cell;
 use std::ffi::{c_int, c_longlong, c_uint, c_void};
 use std::io::Error;
 use windows_sys::core::{BOOL, PCSTR, PCWSTR, PSTR};
@@ -47,6 +48,63 @@ macro_rules! impl_hook {
     }
 }
 
+// Thread-local re-entrancy guard for the WaitOnAddress hook.
+// On Windows, once_cell::sync::Lazy (and std::sync::Once, parking_lot mutexes, etc.)
+// all use WaitOnAddress internally.  Without this guard the NIO implementation would
+// immediately recurse: hook → NioWaitOnAddressSyscall → EventLoops::wait_event →
+// parking_lot → WaitOnAddress → hook → … causing a stack overflow.
+thread_local! {
+    static WAITONADDRESS_IN_HOOK: Cell<bool> = const { Cell::new(false) };
+}
+
+/// Stores the original `WaitOnAddress` function pointer retrieved by minhook.
+static WAITONADDRESS: once_cell::sync::OnceCell<
+    extern "system" fn(*const c_void, *const c_void, usize, c_uint) -> BOOL,
+> = once_cell::sync::OnceCell::new();
+
+#[allow(non_snake_case)]
+extern "system" fn WaitOnAddress(
+    address: *const c_void,
+    compareaddress: *const c_void,
+    addresssize: usize,
+    dwmilliseconds: c_uint,
+) -> BOOL {
+    let fn_ptr = WAITONADDRESS.get().unwrap_or_else(|| {
+        panic!(
+            "hook {} failed !",
+            open_coroutine_core::common::constants::SyscallName::WaitOnAddress
+        )
+    });
+
+    // If already executing inside this hook on the current thread, call the real function
+    // directly.  This covers two cases:
+    //  1. Lazy/Once initialisation of any CHAIN static calls WaitOnAddress.
+    //  2. EventLoops::wait_event (called from NioWaitOnAddressSyscall) uses parking_lot
+    //     internally, which calls WaitOnAddress when a shard lock is contended.
+    if WAITONADDRESS_IN_HOOK.with(Cell::get) {
+        return (*fn_ptr)(address, compareaddress, addresssize, dwmilliseconds);
+    }
+    WAITONADDRESS_IN_HOOK.with(|b| b.set(true));
+
+    let result = if crate::hook()
+        || open_coroutine_core::scheduler::SchedulableCoroutine::current().is_some()
+        || cfg!(feature = "ci")
+    {
+        open_coroutine_core::syscall::WaitOnAddress(
+            Some(fn_ptr),
+            address,
+            compareaddress,
+            addresssize,
+            dwmilliseconds,
+        )
+    } else {
+        (*fn_ptr)(address, compareaddress, addresssize, dwmilliseconds)
+    };
+
+    WAITONADDRESS_IN_HOOK.with(|b| b.set(false));
+    result
+}
+
 #[no_mangle]
 #[allow(non_snake_case, clippy::missing_safety_doc)]
 pub unsafe extern "system" fn DllMain(
@@ -88,7 +146,21 @@ unsafe fn attach() -> std::io::Result<()> {
     impl_hook!("ws2_32.dll", WSASOCKETW, WSASocketW(domain: c_int, ty: WINSOCK_SOCKET_TYPE, protocol: IPPROTO, lpprotocolinfo: *const WSAPROTOCOL_INFOW, g: c_uint, dw_flags: c_uint) -> SOCKET);
     impl_hook!("ws2_32.dll", SELECT, select(nfds: c_int, readfds: *mut FD_SET, writefds: *mut FD_SET, errorfds: *mut FD_SET, timeout: *mut TIMEVAL) -> c_int);
     impl_hook!("ws2_32.dll", WSAPOLL, WSAPoll(fds: *mut WSAPOLLFD, nfds: c_uint, timeout: c_int) -> c_int);
-    impl_hook!("api-ms-win-core-synch-l1-2-0.dll", WAITONADDRESS, WaitOnAddress(address: *const c_void, compareaddress: *const c_void, addresssize: usize, dwmilliseconds: c_uint) -> BOOL);
+
+    // WaitOnAddress is hooked manually (see below) to add a per-thread re-entrancy guard
+    // that prevents NIO internals from recursing back through the hook.
+    _ = WAITONADDRESS.get_or_init(|| unsafe {
+        let syscall: &str =
+            open_coroutine_core::common::constants::SyscallName::WaitOnAddress.into();
+        let ptr = minhook::MinHook::create_hook_api(
+            "api-ms-win-core-synch-l1-2-0.dll",
+            syscall,
+            WaitOnAddress as _,
+        )
+        .unwrap_or_else(|_| panic!("hook {syscall} failed !"));
+        assert!(!ptr.is_null(), "syscall \"{syscall}\" not found !");
+        std::mem::transmute(ptr)
+    });
 
     // Enable the hook
     minhook::MinHook::enable_all_hooks().map_err(|_| Error::other("init all hooks failed !"))

From e28708e33b92f2b0a4c140660217fe80f5de6e75 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 11 May 2026 08:36:59 +0000
Subject: [PATCH 04/11] rename PTHREAD_MUTEX_HOOK_DEPTH to
 PTHREAD_MUTEX_IN_HOOK for clarity

Agent-Logs-Url: https://github.com/acl-dev/open-coroutine/sessions/66bb6c33-ec19-440e-82f5-08d9566b66a5

Co-authored-by: loongs-zhang <38336731+loongs-zhang@users.noreply.github.com>
---
 hook/src/syscall/unix.rs | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/hook/src/syscall/unix.rs b/hook/src/syscall/unix.rs
index 9c748595..66e8ba9c 100644
--- a/hook/src/syscall/unix.rs
+++ b/hook/src/syscall/unix.rs
@@ -88,7 +88,7 @@ impl_hook!(RENAMEAT2, renameat2(olddirfd: c_int, oldpath: *const c_char, newdirf
 // first-time initialisation of any Lazy<CHAIN> static.  The flag detects that situation
 // and falls through to the real system function, breaking the cycle.
 thread_local! {
-    static PTHREAD_MUTEX_HOOK_DEPTH: Cell<bool> = const { Cell::new(false) };
+    static PTHREAD_MUTEX_IN_HOOK: Cell<bool> = const { Cell::new(false) };
 }
 
 // Store function pointers as plain atomics so that loading them never requires a mutex.
@@ -119,10 +119,10 @@ pub extern "C" fn pthread_mutex_lock(lock: *mut pthread_mutex_t) -> c_int {
     // If already executing inside this hook (e.g., once_cell or std::sync internals call
     // pthread_mutex_lock while the hook chain is being initialised), use the real function
     // directly to avoid infinite recursion.
-    if PTHREAD_MUTEX_HOOK_DEPTH.with(Cell::get) {
+    if PTHREAD_MUTEX_IN_HOOK.with(Cell::get) {
         return fn_ptr(lock);
     }
-    PTHREAD_MUTEX_HOOK_DEPTH.with(|b| b.set(true));
+    PTHREAD_MUTEX_IN_HOOK.with(|b| b.set(true));
 
     let result = if crate::hook()
         || open_coroutine_core::scheduler::SchedulableCoroutine::current().is_some()
@@ -133,7 +133,7 @@ pub extern "C" fn pthread_mutex_lock(lock: *mut pthread_mutex_t) -> c_int {
         fn_ptr(lock)
     };
 
-    PTHREAD_MUTEX_HOOK_DEPTH.with(|b| b.set(false));
+    PTHREAD_MUTEX_IN_HOOK.with(|b| b.set(false));
     result
 }
 
@@ -157,10 +157,10 @@ pub extern "C" fn pthread_mutex_unlock(lock: *mut pthread_mutex_t) -> c_int {
 
     // Same guard as pthread_mutex_lock – once_cell may call pthread_mutex_unlock while
     // unlocking its internal mutex during hook-chain initialisation.
-    if PTHREAD_MUTEX_HOOK_DEPTH.with(Cell::get) {
+    if PTHREAD_MUTEX_IN_HOOK.with(Cell::get) {
         return fn_ptr(lock);
     }
-    PTHREAD_MUTEX_HOOK_DEPTH.with(|b| b.set(true));
+    PTHREAD_MUTEX_IN_HOOK.with(|b| b.set(true));
 
     let result = if crate::hook()
         || open_coroutine_core::scheduler::SchedulableCoroutine::current().is_some()
@@ -171,7 +171,7 @@ pub extern "C" fn pthread_mutex_unlock(lock: *mut pthread_mutex_t) -> c_int {
         fn_ptr(lock)
     };
 
-    PTHREAD_MUTEX_HOOK_DEPTH.with(|b| b.set(false));
+    PTHREAD_MUTEX_IN_HOOK.with(|b| b.set(false));
     result
 }
 

From b3f110e66a1e350d1a6512588f1abaf6bb4450ae Mon Sep 17 00:00:00 2001
From: loongs-zhang <1936978077@qq.com>
Date: Wed, 13 May 2026 09:51:06 +0800
Subject: [PATCH 05/11] try support lock

---
 hook/src/syscall/unix.rs | 20 ++++----------------
 1 file changed, 4 insertions(+), 16 deletions(-)

diff --git a/hook/src/syscall/unix.rs b/hook/src/syscall/unix.rs
index 66e8ba9c..39581a9c 100644
--- a/hook/src/syscall/unix.rs
+++ b/hook/src/syscall/unix.rs
@@ -102,19 +102,13 @@ pub extern "C" fn pthread_mutex_lock(lock: *mut pthread_mutex_t) -> c_int {
     if raw.is_null() {
         // dlsym uses its own internal locking (not pthread_mutex_lock), so this is safe
         // even when called re-entrantly.
-        let ptr = unsafe {
-            libc::dlsym(
-                libc::RTLD_NEXT,
-                c"pthread_mutex_lock".as_ptr(),
-            )
-        };
+        let ptr = unsafe { libc::dlsym(libc::RTLD_NEXT, c"pthread_mutex_lock".as_ptr()) };
         assert!(!ptr.is_null(), "pthread_mutex_lock not found!");
         let ptr = ptr.cast::<()>();
         PTHREAD_MUTEX_LOCK_PTR.store(ptr, Ordering::Release);
         raw = ptr;
     }
-    let fn_ptr: extern "C" fn(*mut pthread_mutex_t) -> c_int =
-        unsafe { std::mem::transmute(raw) };
+    let fn_ptr: extern "C" fn(*mut pthread_mutex_t) -> c_int = unsafe { std::mem::transmute(raw) };
 
     // If already executing inside this hook (e.g., once_cell or std::sync internals call
     // pthread_mutex_lock while the hook chain is being initialised), use the real function
@@ -141,19 +135,13 @@ pub extern "C" fn pthread_mutex_lock(lock: *mut pthread_mutex_t) -> c_int {
 pub extern "C" fn pthread_mutex_unlock(lock: *mut pthread_mutex_t) -> c_int {
     let mut raw = PTHREAD_MUTEX_UNLOCK_PTR.load(Ordering::Acquire);
     if raw.is_null() {
-        let ptr = unsafe {
-            libc::dlsym(
-                libc::RTLD_NEXT,
-                c"pthread_mutex_unlock".as_ptr(),
-            )
-        };
+        let ptr = unsafe { libc::dlsym(libc::RTLD_NEXT, c"pthread_mutex_unlock".as_ptr()) };
         assert!(!ptr.is_null(), "pthread_mutex_unlock not found!");
         let ptr = ptr.cast::<()>();
         PTHREAD_MUTEX_UNLOCK_PTR.store(ptr, Ordering::Release);
         raw = ptr;
     }
-    let fn_ptr: extern "C" fn(*mut pthread_mutex_t) -> c_int =
-        unsafe { std::mem::transmute(raw) };
+    let fn_ptr: extern "C" fn(*mut pthread_mutex_t) -> c_int = unsafe { std::mem::transmute(raw) };
 
     // Same guard as pthread_mutex_lock – once_cell may call pthread_mutex_unlock while
     // unlocking its internal mutex during hook-chain initialisation.

From 0d84102dd9df3c46c3eb980246f28c335be85d25 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 14 May 2026 07:09:34 +0000
Subject: [PATCH 06/11] fix Linux deadlock and Windows NIO WaitOnAddress
 recursion

Agent-Logs-Url: https://github.com/acl-dev/open-coroutine/sessions/541adcfb-08ea-4748-b20e-89587e89b562

Co-authored-by: loongs-zhang <38336731+loongs-zhang@users.noreply.github.com>
---
 core/src/syscall/windows/WaitOnAddress.rs | 28 ++++++++++-----
 hook/src/syscall/unix.rs                  | 44 ++++++++++++++---------
 hook/src/syscall/windows.rs               | 44 ++++++++---------------
 3 files changed, 61 insertions(+), 55 deletions(-)

diff --git a/core/src/syscall/windows/WaitOnAddress.rs b/core/src/syscall/windows/WaitOnAddress.rs
index 28fe284b..beaccfa8 100644
--- a/core/src/syscall/windows/WaitOnAddress.rs
+++ b/core/src/syscall/windows/WaitOnAddress.rs
@@ -3,8 +3,7 @@ use std::time::Duration;
 use windows_sys::core::BOOL;
 use windows_sys::Win32::Foundation::{ERROR_TIMEOUT, FALSE, TRUE};
 use crate::common::{get_timeout_time, now};
-use crate::net::EventLoops;
-use crate::scheduler::SchedulableCoroutine;
+use crate::scheduler::{SchedulableCoroutine, SchedulableSuspender};
 use crate::syscall::reset_errno;
 use crate::syscall::set_errno;
 
@@ -89,13 +88,24 @@ impl<I: WaitOnAddressSyscall> WaitOnAddressSyscall for NioWaitOnAddressSyscall<I
             } else {
                 left_time
             };
-            if EventLoops::wait_event(Some(Duration::new(
-                wait_time / 1_000_000_000,
-                (wait_time % 1_000_000_000) as _,
-            )))
-                .is_err()
-            {
-                return r;
+            // Use suspender.until() directly instead of EventLoops::wait_event() to avoid
+            // the recursion: EventLoops::wait_event → DashMap → parking_lot → WaitOnAddress
+            // → NioWaitOnAddressSyscall → EventLoops::wait_event → …  which occurs on
+            // nightly Windows where std internals call WaitOnAddress for mutex operations.
+            // suspender.until() yields the coroutine without touching any DashMap or
+            // parking_lot primitive, so there is no re-entrancy risk.
+            if let Some(suspender) = SchedulableSuspender::current() {
+                suspender.until(get_timeout_time(Duration::from_nanos(wait_time)));
+            } else {
+                // No suspender available (shouldn't happen inside a coroutine).
+                // Fall back to the real WaitOnAddress with remaining time.
+                return self.inner.WaitOnAddress(
+                    fn_ptr,
+                    address,
+                    compareaddress,
+                    addresssize,
+                    (left_time / 1_000_000).try_into().unwrap_or(c_uint::MAX),
+                );
             }
         }
     }
diff --git a/hook/src/syscall/unix.rs b/hook/src/syscall/unix.rs
index 39581a9c..d814ce6c 100644
--- a/hook/src/syscall/unix.rs
+++ b/hook/src/syscall/unix.rs
@@ -2,8 +2,10 @@ use libc::{
     fd_set, iovec, mode_t, msghdr, off_t, pthread_cond_t, pthread_mutex_t, size_t, sockaddr,
     socklen_t, ssize_t, timespec, timeval,
 };
-use std::cell::Cell;
 use std::ffi::{c_char, c_int, c_uint, c_void};
+#[cfg(target_os = "macos")]
+use std::cell::Cell;
+#[cfg(target_os = "macos")]
 use std::sync::atomic::{AtomicPtr, Ordering};
 
 // check https://www.rustwiki.org.cn/en/reference/introduction.html for help information
@@ -82,20 +84,28 @@ impl_hook!(RENAMEAT, renameat(olddirfd: c_int, oldpath: *const c_char, newdirfd:
 #[cfg(target_os = "linux")]
 impl_hook!(RENAMEAT2, renameat2(olddirfd: c_int, oldpath: *const c_char, newdirfd: c_int, newpath: *const c_char, flags: c_uint) -> c_int);
 
-// Thread-local re-entrancy flag shared between pthread_mutex_lock and pthread_mutex_unlock.
-// On macOS, std::sync::Mutex is backed by pthread_mutex_t, so once_cell::sync::Lazy (which
-// uses std::sync::Mutex internally) would recursively invoke these hooks during the
-// first-time initialisation of any Lazy<CHAIN> static.  The flag detects that situation
-// and falls through to the real system function, breaking the cycle.
+// On macOS, once_cell::sync::Lazy initialisation calls pthread_mutex_lock internally
+// (std::sync::Mutex is backed by pthread_mutex_t on macOS), which would recurse back
+// into this hook.  To break that cycle we store the real function pointer in an AtomicPtr
+// (never needs a mutex) and use a per-thread re-entrancy flag.
+//
+// On Linux and other non-macOS platforms the Lazy init uses futex, so the plain
+// impl_hook! macro is safe.  Using impl_hook! on those platforms also avoids the
+// cross-coroutine deadlock that the flag introduces: if one coroutine sets the flag and
+// then yields (waiting for a mutex), the next coroutine to call pthread_mutex_lock would
+// see the flag and call the real blocking function, potentially deadlocking the event
+// loop thread.
+#[cfg(target_os = "macos")]
 thread_local! {
-    static PTHREAD_MUTEX_IN_HOOK: Cell<bool> = const { Cell::new(false) };
+    static PTHREAD_MUTEX_IN_HOOK: std::cell::Cell<bool> = const { std::cell::Cell::new(false) };
 }
 
-// Store function pointers as plain atomics so that loading them never requires a mutex.
-// Using once_cell::sync::Lazy here would trigger the exact recursion described above.
+#[cfg(target_os = "macos")]
 static PTHREAD_MUTEX_LOCK_PTR: AtomicPtr<()> = AtomicPtr::new(std::ptr::null_mut());
+#[cfg(target_os = "macos")]
 static PTHREAD_MUTEX_UNLOCK_PTR: AtomicPtr<()> = AtomicPtr::new(std::ptr::null_mut());
 
+#[cfg(target_os = "macos")]
 #[no_mangle]
 pub extern "C" fn pthread_mutex_lock(lock: *mut pthread_mutex_t) -> c_int {
     let mut raw = PTHREAD_MUTEX_LOCK_PTR.load(Ordering::Acquire);
@@ -110,10 +120,7 @@ pub extern "C" fn pthread_mutex_lock(lock: *mut pthread_mutex_t) -> c_int {
     }
     let fn_ptr: extern "C" fn(*mut pthread_mutex_t) -> c_int = unsafe { std::mem::transmute(raw) };
 
-    // If already executing inside this hook (e.g., once_cell or std::sync internals call
-    // pthread_mutex_lock while the hook chain is being initialised), use the real function
-    // directly to avoid infinite recursion.
-    if PTHREAD_MUTEX_IN_HOOK.with(Cell::get) {
+    if PTHREAD_MUTEX_IN_HOOK.with(std::cell::Cell::get) {
         return fn_ptr(lock);
     }
     PTHREAD_MUTEX_IN_HOOK.with(|b| b.set(true));
@@ -131,6 +138,7 @@ pub extern "C" fn pthread_mutex_lock(lock: *mut pthread_mutex_t) -> c_int {
     result
 }
 
+#[cfg(target_os = "macos")]
 #[no_mangle]
 pub extern "C" fn pthread_mutex_unlock(lock: *mut pthread_mutex_t) -> c_int {
     let mut raw = PTHREAD_MUTEX_UNLOCK_PTR.load(Ordering::Acquire);
@@ -143,9 +151,7 @@ pub extern "C" fn pthread_mutex_unlock(lock: *mut pthread_mutex_t) -> c_int {
     }
     let fn_ptr: extern "C" fn(*mut pthread_mutex_t) -> c_int = unsafe { std::mem::transmute(raw) };
 
-    // Same guard as pthread_mutex_lock – once_cell may call pthread_mutex_unlock while
-    // unlocking its internal mutex during hook-chain initialisation.
-    if PTHREAD_MUTEX_IN_HOOK.with(Cell::get) {
+    if PTHREAD_MUTEX_IN_HOOK.with(std::cell::Cell::get) {
         return fn_ptr(lock);
     }
     PTHREAD_MUTEX_IN_HOOK.with(|b| b.set(true));
@@ -163,5 +169,11 @@ pub extern "C" fn pthread_mutex_unlock(lock: *mut pthread_mutex_t) -> c_int {
     result
 }
 
+// On non-macOS Unix, impl_hook! is safe for pthread_mutex_lock/unlock.
+#[cfg(not(target_os = "macos"))]
+impl_hook!(PTHREAD_MUTEX_LOCK, pthread_mutex_lock(lock: *mut pthread_mutex_t) -> c_int);
+#[cfg(not(target_os = "macos"))]
+impl_hook!(PTHREAD_MUTEX_UNLOCK, pthread_mutex_unlock(lock: *mut pthread_mutex_t) -> c_int);
+
 // NOTE: unhook poll due to mio's poller
 // impl_hook!(POLL, poll(fds: *mut pollfd, nfds: nfds_t, timeout: c_int) -> c_int);
diff --git a/hook/src/syscall/windows.rs b/hook/src/syscall/windows.rs
index 488d5d39..1ad0882a 100644
--- a/hook/src/syscall/windows.rs
+++ b/hook/src/syscall/windows.rs
@@ -1,4 +1,3 @@
-use std::cell::Cell;
 use std::ffi::{c_int, c_longlong, c_uint, c_void};
 use std::io::Error;
 use windows_sys::core::{BOOL, PCSTR, PCWSTR, PSTR};
@@ -48,14 +47,9 @@ macro_rules! impl_hook {
     }
 }
 
-// Thread-local re-entrancy guard for the WaitOnAddress hook.
-// On Windows, once_cell::sync::Lazy (and std::sync::Once, parking_lot mutexes, etc.)
-// all use WaitOnAddress internally.  Without this guard the NIO implementation would
-// immediately recurse: hook → NioWaitOnAddressSyscall → EventLoops::wait_event →
-// parking_lot → WaitOnAddress → hook → … causing a stack overflow.
-thread_local! {
-    static WAITONADDRESS_IN_HOOK: Cell<bool> = const { Cell::new(false) };
-}
+// Thread-local re-entrancy guard removed: NioWaitOnAddressSyscall now uses
+// suspender.until() directly, which does not call EventLoops::wait_event and
+// therefore cannot recurse back through WaitOnAddress via parking_lot/DashMap.
 
 /// Stores the original `WaitOnAddress` function pointer retrieved by minhook.
 static WAITONADDRESS: once_cell::sync::OnceCell<
@@ -76,33 +70,19 @@ extern "system" fn WaitOnAddress(
         )
     });
 
-    // If already executing inside this hook on the current thread, call the real function
-    // directly.  This covers two cases:
-    //  1. Lazy/Once initialisation of any CHAIN static calls WaitOnAddress.
-    //  2. EventLoops::wait_event (called from NioWaitOnAddressSyscall) uses parking_lot
-    //     internally, which calls WaitOnAddress when a shard lock is contended.
-    if WAITONADDRESS_IN_HOOK.with(Cell::get) {
-        return (*fn_ptr)(address, compareaddress, addresssize, dwmilliseconds);
-    }
-    WAITONADDRESS_IN_HOOK.with(|b| b.set(true));
-
-    let result = if crate::hook()
+    if crate::hook()
         || open_coroutine_core::scheduler::SchedulableCoroutine::current().is_some()
         || cfg!(feature = "ci")
     {
-        open_coroutine_core::syscall::WaitOnAddress(
+        return open_coroutine_core::syscall::WaitOnAddress(
             Some(fn_ptr),
             address,
             compareaddress,
             addresssize,
             dwmilliseconds,
-        )
-    } else {
-        (*fn_ptr)(address, compareaddress, addresssize, dwmilliseconds)
-    };
-
-    WAITONADDRESS_IN_HOOK.with(|b| b.set(false));
-    result
+        );
+    }
+    (*fn_ptr)(address, compareaddress, addresssize, dwmilliseconds)
 }
 
 #[no_mangle]
@@ -147,8 +127,12 @@ unsafe fn attach() -> std::io::Result<()> {
     impl_hook!("ws2_32.dll", SELECT, select(nfds: c_int, readfds: *mut FD_SET, writefds: *mut FD_SET, errorfds: *mut FD_SET, timeout: *mut TIMEVAL) -> c_int);
     impl_hook!("ws2_32.dll", WSAPOLL, WSAPoll(fds: *mut WSAPOLLFD, nfds: c_uint, timeout: c_int) -> c_int);
 
-    // WaitOnAddress is hooked manually (see below) to add a per-thread re-entrancy guard
-    // that prevents NIO internals from recursing back through the hook.
+// WaitOnAddress is hooked manually (instead of via impl_hook!) because
+// once_cell::sync::OnceCell must be pre-initialised in attach() before any hook
+// is active, so that get() in the hook never needs to call get_or_init (which would
+// use parking_lot and recurse).  The NioWaitOnAddressSyscall now yields via
+// suspender.until() rather than EventLoops::wait_event(), so no re-entrancy guard
+// is needed here.
     _ = WAITONADDRESS.get_or_init(|| unsafe {
         let syscall: &str =
             open_coroutine_core::common::constants::SyscallName::WaitOnAddress.into();

From 6f875a1537d31c8e3cfd928ecedd370934a2509c Mon Sep 17 00:00:00 2001
From: loongs-zhang <1936978077@qq.com>
Date: Fri, 15 May 2026 09:26:41 +0800
Subject: [PATCH 07/11] try support lock

---
 hook/src/syscall/unix.rs    |  2 +-
 hook/src/syscall/windows.rs | 12 ++++++------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/hook/src/syscall/unix.rs b/hook/src/syscall/unix.rs
index d814ce6c..d293c693 100644
--- a/hook/src/syscall/unix.rs
+++ b/hook/src/syscall/unix.rs
@@ -2,9 +2,9 @@ use libc::{
     fd_set, iovec, mode_t, msghdr, off_t, pthread_cond_t, pthread_mutex_t, size_t, sockaddr,
     socklen_t, ssize_t, timespec, timeval,
 };
-use std::ffi::{c_char, c_int, c_uint, c_void};
 #[cfg(target_os = "macos")]
 use std::cell::Cell;
+use std::ffi::{c_char, c_int, c_uint, c_void};
 #[cfg(target_os = "macos")]
 use std::sync::atomic::{AtomicPtr, Ordering};
 
diff --git a/hook/src/syscall/windows.rs b/hook/src/syscall/windows.rs
index 1ad0882a..63485265 100644
--- a/hook/src/syscall/windows.rs
+++ b/hook/src/syscall/windows.rs
@@ -127,12 +127,12 @@ unsafe fn attach() -> std::io::Result<()> {
     impl_hook!("ws2_32.dll", SELECT, select(nfds: c_int, readfds: *mut FD_SET, writefds: *mut FD_SET, errorfds: *mut FD_SET, timeout: *mut TIMEVAL) -> c_int);
     impl_hook!("ws2_32.dll", WSAPOLL, WSAPoll(fds: *mut WSAPOLLFD, nfds: c_uint, timeout: c_int) -> c_int);
 
-// WaitOnAddress is hooked manually (instead of via impl_hook!) because
-// once_cell::sync::OnceCell must be pre-initialised in attach() before any hook
-// is active, so that get() in the hook never needs to call get_or_init (which would
-// use parking_lot and recurse).  The NioWaitOnAddressSyscall now yields via
-// suspender.until() rather than EventLoops::wait_event(), so no re-entrancy guard
-// is needed here.
+    // WaitOnAddress is hooked manually (instead of via impl_hook!) because
+    // once_cell::sync::OnceCell must be pre-initialised in attach() before any hook
+    // is active, so that get() in the hook never needs to call get_or_init (which would
+    // use parking_lot and recurse).  The NioWaitOnAddressSyscall now yields via
+    // suspender.until() rather than EventLoops::wait_event(), so no re-entrancy guard
+    // is needed here.
     _ = WAITONADDRESS.get_or_init(|| unsafe {
         let syscall: &str =
             open_coroutine_core::common::constants::SyscallName::WaitOnAddress.into();

From 5280befc0b1d1bfb6f2a442d7a3b539af2cb66ca Mon Sep 17 00:00:00 2001
From: loongs-zhang <1936978077@qq.com>
Date: Fri, 15 May 2026 09:34:42 +0800
Subject: [PATCH 08/11] try support lock

---
 hook/src/syscall/unix.rs | 2 --
 1 file changed, 2 deletions(-)

diff --git a/hook/src/syscall/unix.rs b/hook/src/syscall/unix.rs
index d293c693..83b2e47a 100644
--- a/hook/src/syscall/unix.rs
+++ b/hook/src/syscall/unix.rs
@@ -2,8 +2,6 @@ use libc::{
     fd_set, iovec, mode_t, msghdr, off_t, pthread_cond_t, pthread_mutex_t, size_t, sockaddr,
     socklen_t, ssize_t, timespec, timeval,
 };
-#[cfg(target_os = "macos")]
-use std::cell::Cell;
 use std::ffi::{c_char, c_int, c_uint, c_void};
 #[cfg(target_os = "macos")]
 use std::sync::atomic::{AtomicPtr, Ordering};

From e5f8c055aad6f80218e47d66f003e49e999cceb2 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 15 May 2026 02:14:48 +0000
Subject: [PATCH 09/11] fix: simplify NioWaitOnAddressSyscall to pass-through,
 eliminating NIO overhead and recursion

Agent-Logs-Url: https://github.com/acl-dev/open-coroutine/sessions/78752aa5-9ec8-47c6-ac7c-b34468cc19ce

Co-authored-by: loongs-zhang <38336731+loongs-zhang@users.noreply.github.com>
---
 core/src/syscall/windows/WaitOnAddress.rs | 80 +++++------------------
 hook/src/syscall/windows.rs               | 12 ++--
 2 files changed, 23 insertions(+), 69 deletions(-)

diff --git a/core/src/syscall/windows/WaitOnAddress.rs b/core/src/syscall/windows/WaitOnAddress.rs
index beaccfa8..8b52d58e 100644
--- a/core/src/syscall/windows/WaitOnAddress.rs
+++ b/core/src/syscall/windows/WaitOnAddress.rs
@@ -1,11 +1,5 @@
 use std::ffi::{c_uint, c_void};
-use std::time::Duration;
 use windows_sys::core::BOOL;
-use windows_sys::Win32::Foundation::{ERROR_TIMEOUT, FALSE, TRUE};
-use crate::common::{get_timeout_time, now};
-use crate::scheduler::{SchedulableCoroutine, SchedulableSuspender};
-use crate::syscall::reset_errno;
-use crate::syscall::set_errno;
 
 trait WaitOnAddressSyscall {
     extern "system" fn WaitOnAddress(
@@ -51,63 +45,23 @@ impl<I: WaitOnAddressSyscall> WaitOnAddressSyscall for NioWaitOnAddressSyscall<I
         addresssize: usize,
         dwmilliseconds: c_uint
     ) -> BOOL {
-        // Not inside a coroutine: call the real function directly.  This avoids turning
-        // every internal runtime WaitOnAddress (parking_lot, once_cell, std::sync::Once)
-        // into a slow 1 ms polling loop and prevents recursive EventLoops::wait_event
-        // calls from corrupting coroutine scheduling state.
-        if SchedulableCoroutine::current().is_none() {
-            return self.inner.WaitOnAddress(
-                fn_ptr, address, compareaddress, addresssize, dwmilliseconds,
-            );
-        }
-        let timeout = get_timeout_time(Duration::from_millis(dwmilliseconds.into()));
-        loop {
-            let mut left_time = timeout.saturating_sub(now());
-            if 0 == left_time {
-                set_errno(ERROR_TIMEOUT);
-                return FALSE;
-            }
-            let r = self.inner.WaitOnAddress(
-                fn_ptr,
-                address,
-                compareaddress,
-                addresssize,
-                (left_time / 1_000_000).min(1).try_into().expect("overflow"),
-            );
-            if TRUE == r {
-                reset_errno();
-                return r;
-            }
-            left_time = timeout.saturating_sub(now());
-            if 0 == left_time {
-                set_errno(ERROR_TIMEOUT);
-                return FALSE;
-            }
-            let wait_time = if left_time > 10_000_000 {
-                10_000_000
-            } else {
-                left_time
-            };
-            // Use suspender.until() directly instead of EventLoops::wait_event() to avoid
-            // the recursion: EventLoops::wait_event → DashMap → parking_lot → WaitOnAddress
-            // → NioWaitOnAddressSyscall → EventLoops::wait_event → …  which occurs on
-            // nightly Windows where std internals call WaitOnAddress for mutex operations.
-            // suspender.until() yields the coroutine without touching any DashMap or
-            // parking_lot primitive, so there is no re-entrancy risk.
-            if let Some(suspender) = SchedulableSuspender::current() {
-                suspender.until(get_timeout_time(Duration::from_nanos(wait_time)));
-            } else {
-                // No suspender available (shouldn't happen inside a coroutine).
-                // Fall back to the real WaitOnAddress with remaining time.
-                return self.inner.WaitOnAddress(
-                    fn_ptr,
-                    address,
-                    compareaddress,
-                    addresssize,
-                    (left_time / 1_000_000).try_into().unwrap_or(c_uint::MAX),
-                );
-            }
-        }
+        // Delegate directly to the real WaitOnAddress without any NIO polling loop.
+        //
+        // A NIO loop (poll every 1 ms, yield via EventLoops::wait_event for 10 ms) was
+        // tried, but it caused two distinct problems on Windows:
+        //
+        // 1. Recursion: EventLoops::wait_event accesses DashMap/parking_lot internals which
+        //    call WaitOnAddress, creating an infinite recursion chain that stack-overflows.
+        //
+        // 2. Excessive overhead: on nightly Windows, std uses WaitOnAddress for many
+        //    internal mutex operations (Mutex, Condvar, Arc, channels …).  Each call from
+        //    within a coroutine incurred an ~11 ms overhead, causing the socket_co_server
+        //    integration test to exceed its 30 s timeout.
+        //
+        // Passing through directly avoids both issues.  Any WaitOnAddress call from within
+        // a coroutine simply blocks the event-loop thread for its natural duration, which is
+        // acceptable because the durations in practice are very short (µs range).
+        self.inner.WaitOnAddress(fn_ptr, address, compareaddress, addresssize, dwmilliseconds)
     }
 }
 
diff --git a/hook/src/syscall/windows.rs b/hook/src/syscall/windows.rs
index 63485265..9d703b21 100644
--- a/hook/src/syscall/windows.rs
+++ b/hook/src/syscall/windows.rs
@@ -47,9 +47,9 @@ macro_rules! impl_hook {
     }
 }
 
-// Thread-local re-entrancy guard removed: NioWaitOnAddressSyscall now uses
-// suspender.until() directly, which does not call EventLoops::wait_event and
-// therefore cannot recurse back through WaitOnAddress via parking_lot/DashMap.
+// NioWaitOnAddressSyscall is a simple pass-through to the real WaitOnAddress.
+// No re-entrancy guard is needed: the NIO path no longer calls EventLoops::wait_event,
+// so there is no DashMap/parking_lot path that could recurse back through WaitOnAddress.
 
 /// Stores the original `WaitOnAddress` function pointer retrieved by minhook.
 static WAITONADDRESS: once_cell::sync::OnceCell<
@@ -130,9 +130,9 @@ unsafe fn attach() -> std::io::Result<()> {
     // WaitOnAddress is hooked manually (instead of via impl_hook!) because
     // once_cell::sync::OnceCell must be pre-initialised in attach() before any hook
     // is active, so that get() in the hook never needs to call get_or_init (which would
-    // use parking_lot and recurse).  The NioWaitOnAddressSyscall now yields via
-    // suspender.until() rather than EventLoops::wait_event(), so no re-entrancy guard
-    // is needed here.
+    // use parking_lot and recurse).  NioWaitOnAddressSyscall is a pass-through that
+    // calls the real function directly, so there is no re-entrancy risk and no
+    // re-entrancy guard is needed here.
     _ = WAITONADDRESS.get_or_init(|| unsafe {
         let syscall: &str =
             open_coroutine_core::common::constants::SyscallName::WaitOnAddress.into();

From 6dc7b719a81879a42cda9d5383b462da8e0dcb9d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 15 May 2026 14:33:29 +0000
Subject: [PATCH 10/11] fix: remove macOS pthread mutex hooks and Windows
 WaitOnAddress hook to eliminate deadlocks and timeouts

Agent-Logs-Url: https://github.com/acl-dev/open-coroutine/sessions/9322e3e6-da22-49aa-82dd-ac102a8c0f37

Co-authored-by: loongs-zhang <38336731+loongs-zhang@users.noreply.github.com>
---
 hook/src/syscall/unix.rs    | 100 +++++-------------------------------
 hook/src/syscall/windows.rs |  57 --------------------
 2 files changed, 13 insertions(+), 144 deletions(-)

diff --git a/hook/src/syscall/unix.rs b/hook/src/syscall/unix.rs
index 83b2e47a..e3ff19bc 100644
--- a/hook/src/syscall/unix.rs
+++ b/hook/src/syscall/unix.rs
@@ -3,8 +3,6 @@ use libc::{
     socklen_t, ssize_t, timespec, timeval,
 };
 use std::ffi::{c_char, c_int, c_uint, c_void};
-#[cfg(target_os = "macos")]
-use std::sync::atomic::{AtomicPtr, Ordering};
 
 // check https://www.rustwiki.org.cn/en/reference/introduction.html for help information
 #[allow(unused_macros)]
@@ -82,92 +80,20 @@ impl_hook!(RENAMEAT, renameat(olddirfd: c_int, oldpath: *const c_char, newdirfd:
 #[cfg(target_os = "linux")]
 impl_hook!(RENAMEAT2, renameat2(olddirfd: c_int, oldpath: *const c_char, newdirfd: c_int, newpath: *const c_char, flags: c_uint) -> c_int);
 
-// On macOS, once_cell::sync::Lazy initialisation calls pthread_mutex_lock internally
-// (std::sync::Mutex is backed by pthread_mutex_t on macOS), which would recurse back
-// into this hook.  To break that cycle we store the real function pointer in an AtomicPtr
-// (never needs a mutex) and use a per-thread re-entrancy flag.
+// pthread_mutex_lock/unlock: on Linux and other non-macOS Unix the once_cell::sync::Lazy
+// initialisation uses futex (not pthread_mutex_t), so impl_hook! is safe and the plain
+// macro is used.
 //
-// On Linux and other non-macOS platforms the Lazy init uses futex, so the plain
-// impl_hook! macro is safe.  Using impl_hook! on those platforms also avoids the
-// cross-coroutine deadlock that the flag introduces: if one coroutine sets the flag and
-// then yields (waiting for a mutex), the next coroutine to call pthread_mutex_lock would
-// see the flag and call the real blocking function, potentially deadlocking the event
-// loop thread.
-#[cfg(target_os = "macos")]
-thread_local! {
-    static PTHREAD_MUTEX_IN_HOOK: std::cell::Cell<bool> = const { std::cell::Cell::new(false) };
-}
-
-#[cfg(target_os = "macos")]
-static PTHREAD_MUTEX_LOCK_PTR: AtomicPtr<()> = AtomicPtr::new(std::ptr::null_mut());
-#[cfg(target_os = "macos")]
-static PTHREAD_MUTEX_UNLOCK_PTR: AtomicPtr<()> = AtomicPtr::new(std::ptr::null_mut());
-
-#[cfg(target_os = "macos")]
-#[no_mangle]
-pub extern "C" fn pthread_mutex_lock(lock: *mut pthread_mutex_t) -> c_int {
-    let mut raw = PTHREAD_MUTEX_LOCK_PTR.load(Ordering::Acquire);
-    if raw.is_null() {
-        // dlsym uses its own internal locking (not pthread_mutex_lock), so this is safe
-        // even when called re-entrantly.
-        let ptr = unsafe { libc::dlsym(libc::RTLD_NEXT, c"pthread_mutex_lock".as_ptr()) };
-        assert!(!ptr.is_null(), "pthread_mutex_lock not found!");
-        let ptr = ptr.cast::<()>();
-        PTHREAD_MUTEX_LOCK_PTR.store(ptr, Ordering::Release);
-        raw = ptr;
-    }
-    let fn_ptr: extern "C" fn(*mut pthread_mutex_t) -> c_int = unsafe { std::mem::transmute(raw) };
-
-    if PTHREAD_MUTEX_IN_HOOK.with(std::cell::Cell::get) {
-        return fn_ptr(lock);
-    }
-    PTHREAD_MUTEX_IN_HOOK.with(|b| b.set(true));
-
-    let result = if crate::hook()
-        || open_coroutine_core::scheduler::SchedulableCoroutine::current().is_some()
-        || cfg!(feature = "ci")
-    {
-        open_coroutine_core::syscall::pthread_mutex_lock(Some(&fn_ptr), lock)
-    } else {
-        fn_ptr(lock)
-    };
-
-    PTHREAD_MUTEX_IN_HOOK.with(|b| b.set(false));
-    result
-}
-
-#[cfg(target_os = "macos")]
-#[no_mangle]
-pub extern "C" fn pthread_mutex_unlock(lock: *mut pthread_mutex_t) -> c_int {
-    let mut raw = PTHREAD_MUTEX_UNLOCK_PTR.load(Ordering::Acquire);
-    if raw.is_null() {
-        let ptr = unsafe { libc::dlsym(libc::RTLD_NEXT, c"pthread_mutex_unlock".as_ptr()) };
-        assert!(!ptr.is_null(), "pthread_mutex_unlock not found!");
-        let ptr = ptr.cast::<()>();
-        PTHREAD_MUTEX_UNLOCK_PTR.store(ptr, Ordering::Release);
-        raw = ptr;
-    }
-    let fn_ptr: extern "C" fn(*mut pthread_mutex_t) -> c_int = unsafe { std::mem::transmute(raw) };
-
-    if PTHREAD_MUTEX_IN_HOOK.with(std::cell::Cell::get) {
-        return fn_ptr(lock);
-    }
-    PTHREAD_MUTEX_IN_HOOK.with(|b| b.set(true));
-
-    let result = if crate::hook()
-        || open_coroutine_core::scheduler::SchedulableCoroutine::current().is_some()
-        || cfg!(feature = "ci")
-    {
-        open_coroutine_core::syscall::pthread_mutex_unlock(Some(&fn_ptr), lock)
-    } else {
-        fn_ptr(lock)
-    };
-
-    PTHREAD_MUTEX_IN_HOOK.with(|b| b.set(false));
-    result
-}
-
-// On non-macOS Unix, impl_hook! is safe for pthread_mutex_lock/unlock.
+// On macOS, once_cell::sync::Lazy init calls dlsym which internally acquires a dyld lock
+// implemented as a pthread_mutex_t.  This would recurse back into the hook.  The per-thread
+// re-entrancy flag that breaks the cycle causes a separate cross-coroutine deadlock under
+// preemptive scheduling: a coroutine that sets the flag and is then preempted leaves the
+// flag set, so the next coroutine on the same thread skips the NIO path and blocks the
+// event-loop thread in the real (blocking) pthread_mutex_lock.  Because the NIO path for
+// pthread_mutex_lock is just a trylock poll loop (no genuine async benefit) and the
+// deadlock is architectural, the macOS hooks are omitted entirely.  The core
+// open_coroutine_core::syscall::pthread_mutex_{lock,unlock} functions remain available
+// for direct use in tests and other explicit call sites.
 #[cfg(not(target_os = "macos"))]
 impl_hook!(PTHREAD_MUTEX_LOCK, pthread_mutex_lock(lock: *mut pthread_mutex_t) -> c_int);
 #[cfg(not(target_os = "macos"))]
diff --git a/hook/src/syscall/windows.rs b/hook/src/syscall/windows.rs
index 9d703b21..41e2c4c0 100644
--- a/hook/src/syscall/windows.rs
+++ b/hook/src/syscall/windows.rs
@@ -47,44 +47,6 @@ macro_rules! impl_hook {
     }
 }
 
-// NioWaitOnAddressSyscall is a simple pass-through to the real WaitOnAddress.
-// No re-entrancy guard is needed: the NIO path no longer calls EventLoops::wait_event,
-// so there is no DashMap/parking_lot path that could recurse back through WaitOnAddress.
-
-/// Stores the original `WaitOnAddress` function pointer retrieved by minhook.
-static WAITONADDRESS: once_cell::sync::OnceCell<
-    extern "system" fn(*const c_void, *const c_void, usize, c_uint) -> BOOL,
-> = once_cell::sync::OnceCell::new();
-
-#[allow(non_snake_case)]
-extern "system" fn WaitOnAddress(
-    address: *const c_void,
-    compareaddress: *const c_void,
-    addresssize: usize,
-    dwmilliseconds: c_uint,
-) -> BOOL {
-    let fn_ptr = WAITONADDRESS.get().unwrap_or_else(|| {
-        panic!(
-            "hook {} failed !",
-            open_coroutine_core::common::constants::SyscallName::WaitOnAddress
-        )
-    });
-
-    if crate::hook()
-        || open_coroutine_core::scheduler::SchedulableCoroutine::current().is_some()
-        || cfg!(feature = "ci")
-    {
-        return open_coroutine_core::syscall::WaitOnAddress(
-            Some(fn_ptr),
-            address,
-            compareaddress,
-            addresssize,
-            dwmilliseconds,
-        );
-    }
-    (*fn_ptr)(address, compareaddress, addresssize, dwmilliseconds)
-}
-
 #[no_mangle]
 #[allow(non_snake_case, clippy::missing_safety_doc)]
 pub unsafe extern "system" fn DllMain(
@@ -127,25 +89,6 @@ unsafe fn attach() -> std::io::Result<()> {
     impl_hook!("ws2_32.dll", SELECT, select(nfds: c_int, readfds: *mut FD_SET, writefds: *mut FD_SET, errorfds: *mut FD_SET, timeout: *mut TIMEVAL) -> c_int);
     impl_hook!("ws2_32.dll", WSAPOLL, WSAPoll(fds: *mut WSAPOLLFD, nfds: c_uint, timeout: c_int) -> c_int);
 
-    // WaitOnAddress is hooked manually (instead of via impl_hook!) because
-    // once_cell::sync::OnceCell must be pre-initialised in attach() before any hook
-    // is active, so that get() in the hook never needs to call get_or_init (which would
-    // use parking_lot and recurse).  NioWaitOnAddressSyscall is a pass-through that
-    // calls the real function directly, so there is no re-entrancy risk and no
-    // re-entrancy guard is needed here.
-    _ = WAITONADDRESS.get_or_init(|| unsafe {
-        let syscall: &str =
-            open_coroutine_core::common::constants::SyscallName::WaitOnAddress.into();
-        let ptr = minhook::MinHook::create_hook_api(
-            "api-ms-win-core-synch-l1-2-0.dll",
-            syscall,
-            WaitOnAddress as _,
-        )
-        .unwrap_or_else(|_| panic!("hook {syscall} failed !"));
-        assert!(!ptr.is_null(), "syscall \"{syscall}\" not found !");
-        std::mem::transmute(ptr)
-    });
-
     // Enable the hook
     minhook::MinHook::enable_all_hooks().map_err(|_| Error::other("init all hooks failed !"))
 }

From e35c723f6a1af6bc40d6486ac28188ee49d5afee Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 15 May 2026 14:37:01 +0000
Subject: [PATCH 11/11] style: fix comment spelling and spacing in unix.rs

Agent-Logs-Url: https://github.com/acl-dev/open-coroutine/sessions/9322e3e6-da22-49aa-82dd-ac102a8c0f37

Co-authored-by: loongs-zhang <38336731+loongs-zhang@users.noreply.github.com>
---
 hook/src/syscall/unix.rs | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hook/src/syscall/unix.rs b/hook/src/syscall/unix.rs
index e3ff19bc..9ecf3fad 100644
--- a/hook/src/syscall/unix.rs
+++ b/hook/src/syscall/unix.rs
@@ -81,17 +81,17 @@ impl_hook!(RENAMEAT, renameat(olddirfd: c_int, oldpath: *const c_char, newdirfd:
 impl_hook!(RENAMEAT2, renameat2(olddirfd: c_int, oldpath: *const c_char, newdirfd: c_int, newpath: *const c_char, flags: c_uint) -> c_int);
 
 // pthread_mutex_lock/unlock: on Linux and other non-macOS Unix the once_cell::sync::Lazy
-// initialisation uses futex (not pthread_mutex_t), so impl_hook! is safe and the plain
+// initialization uses futex (not pthread_mutex_t), so impl_hook! is safe and the plain
 // macro is used.
 //
 // On macOS, once_cell::sync::Lazy init calls dlsym which internally acquires a dyld lock
-// implemented as a pthread_mutex_t.  This would recurse back into the hook.  The per-thread
+// implemented as a pthread_mutex_t. This would recurse back into the hook. The per-thread
 // re-entrancy flag that breaks the cycle causes a separate cross-coroutine deadlock under
 // preemptive scheduling: a coroutine that sets the flag and is then preempted leaves the
 // flag set, so the next coroutine on the same thread skips the NIO path and blocks the
-// event-loop thread in the real (blocking) pthread_mutex_lock.  Because the NIO path for
+// event-loop thread in the real (blocking) pthread_mutex_lock. Because the NIO path for
 // pthread_mutex_lock is just a trylock poll loop (no genuine async benefit) and the
-// deadlock is architectural, the macOS hooks are omitted entirely.  The core
+// deadlock is architectural, the macOS hooks are omitted entirely. The core
 // open_coroutine_core::syscall::pthread_mutex_{lock,unlock} functions remain available
 // for direct use in tests and other explicit call sites.
 #[cfg(not(target_os = "macos"))]