Linux下SIGSTOP的特殊特征和实现
一、问题的引出
在多线程用户态程序中，为了更加准确详细的从一个线程观察另一个线程的行为，可能有时候需要让目标线程暂时安静下来，从而便于观测和监控。关于这个行为，首先想到的当然就是向一个线程发送一个SIGSTOP信号(注意，不是向进程，就是通过内核的tkill系统调用，或者说pthread_kill)，从而让线程处于STOP状态，之后再通过SIGCONT让线程继续运行，这样是最为简单而环保的方法。但是事实测试的时候会发现这个信号即使是只发给内核的单个线程，也会造成整个线程组中所有线程被停止，这就是一个比较奇怪的现象了。
二、内核对tkill的处理
linux-2.6.37.1\kernel\signal.c
SYSCALL_DEFINE2(tkill, pid_t, pid, int, sig)
{
/* This is only valid for single tasks */
if (pid <= 0)
return -EINVAL;
return do_tkill(0, pid, sig);
}
-->>>do_tkill--->>>do_send_sig_info(sig, info, p, false)---->>>send_signal--->>>__send_signal
pending = group ? &t->signal->shared_pending : &t->pending;
从代码上看，tkill发出的信号是发送给了线程私有的pending信号队列，所以直到这里看来，它依然是应该只有目标线程会接受这个信号。
三、停止线程组代码实现
do_signal--->>>get_signal_to_deliver
signr = tracehook_get_signal(current, regs, info, return_ka);
if (unlikely(signr < 0))
goto relock;
if (unlikely(signr != 0))
ka = return_ka;
else {
if (unlikely(signal->group_stop_count > 0) &&
do_signal_stop(0))结合后面的说明，如果说线程正处在一个线程组停止状态并且还有未处于stop状态的线程，则执行do_signal_stop自行停止调度。
goto relock;
signr = dequeue_signal(current, ¤t->blocked,
info);
if (!signr)
break; /* will return 0 */
if (signr != SIGKILL) {
signr = ptrace_signal(signr, info,
regs, cookie);
if (!signr)
continue;
}
………………
内核定义的停止信号
#define SIG_KERNEL_STOP_MASK (\
rt_sigmask(SIGSTOP) | rt_sigmask(SIGTSTP) | \
rt_sigmask(SIGTTIN) | rt_sigmask(SIGTTOU) )
if (sig_kernel_stop(signr)) {所以SIGSTOP信号将会走入该流程。
/*
* The default action is to stop all threads in
* the thread group. The job control signals
* do nothing in an orphaned pgrp, but SIGSTOP
* always works. Note that siglock needs to be
* dropped during the call to is_orphaned_pgrp()
* because of lock ordering with tasklist_lock.
* This allows an intervening SIGCONT to be posted.
* We need to check for that and bail out if necessary.
*/
if (signr != SIGSTOP) {这里也说明了很多TTY操作，如SIGTTIN等也会对线程组产生影响。
spin_unlock_irq(&sighand->siglock);
/* signals can be posted during this window */
if (is_current_pgrp_orphaned())
goto relock;
spin_lock_irq(&sighand->siglock);
}
if (likely(do_signal_stop(info->si_signo))) {
/* It released the siglock. */
goto relock;
}
/*
* We didn't actually stop, due to a race
* with SIGCONT or something like that.
*/
continue;
}
下面是do_signal_stop的代码，这个是对于这个特征的核心代码
/*
* This performs the stopping for SIGSTOP and other stop signals.
* We have to stop all threads in the thread group.
* Returns nonzero if we've actually stopped and released the siglock.
* Returns zero if we didn't stop and still hold the siglock.
*/
static int do_signal_stop(int signr)
{
struct signal_struct *sig = current->signal;
int notify;
if (!sig->group_stop_count) {如果说gropu_stop_Count为零，则说明线程组STOP还没有启动，所以在下面的指令中要把这个值设置为需要被STOP的线程的数目。
struct task_struct *t;
if (!likely(sig->flags & SIGNAL_STOP_DEQUEUED) ||
unlikely(signal_group_exit(sig)))
return 0;
/*
* There is no group stop already in progress.
* We must initiate one now.
*/
sig->group_exit_code = signr;
sig->group_stop_count = 1;
for (t = next_thread(current); t != current; t = next_thread(t))
/*
* Setting state to TASK_STOPPED for a group
* stop is always done with the siglock held,
* so this check has no races.
*/
if (!(t->flags & PF_EXITING) &&
!task_is_stopped_or_traced(t)) {
sig->group_stop_count++;便利线程组中所有线程，对每一个尚未被处理的线程在group_stop_count中加一。
signal_wake_up(t, 0);
}
}
/*
* If there are no other threads in the group, or if there is
* a group stop in progress and we are the last to stop, report
* to the parent. When ptraced, every thread reports itself.
*/
notify = sig->group_stop_count == 1 ? CLD_STOPPED : 0;
notify = tracehook_notify_jctl(notify, CLD_STOPPED);
/*
* tracehook_notify_jctl() can drop and reacquire siglock, so
* we keep ->group_stop_count != 0 before the call. If SIGCONT
* or SIGKILL comes in between ->group_stop_count == 0.
*/
if (sig->group_stop_count) {
if (!--sig->group_stop_count)这个线程组全部完成了STOP。
sig->flags = SIGNAL_STOP_STOPPED;
current->exit_code = sig->group_exit_code;
__set_current_state(TASK_STOPPED);所有执行这个函数的线程都被设置为了TASK_STOPPED状态，接下来执行schedule函数之后该线程将会被从运行队列中移除，次数受该函数开始if中设置的group_stop_count值决定。。
}
spin_unlock_irq(¤t->sighand->siglock);
if (notify) {
read_lock(&tasklist_lock);
do_notify_parent_cldstop(current, notify);
read_unlock(&tasklist_lock);
}
/* Now we don't run again until woken by SIGCONT or SIGKILL */
do {从这里该线程将会切换出去，让出调度权，
schedule();
} while (try_to_freeze());
tracehook_finish_jctl();
current->exit_code = 0;
return 1;
}
四、调试器如何做到对单个线程的SIGSTOP
由于调试器和被调试任务之间有一种内核可以感知到的调试关系，也就是被调试任务的PT_PTRACED的标志位被置位，所以当一个线程收到信号并且要处理的时候，内核会首先给调试器一个机会
get_signal_to_deliver---->>ptrace_stop--->>do_notify_parent_cldstop
if ((current->ptrace & PT_PTRACED) && signr != SIGKILL) {
ptrace_signal_deliver(regs, cookie);
/* Let the debugger run. */
ptrace_stop(signr, signr, info);如果调试器在这个函数之后取消掉信号，也就是让exit_code清零，则下面的continue将会忽略这个信号。
/* We're back. Did the debugger cancel the sig? */
signr = current->exit_code;
if (signr == 0)
continue;
所以在没有启动线程组暂停之前，调试器优先获得控制权，所以调试器可以判断出是自己发送的信号，在进行必要的操作之后，通过ptrace系统调用再取消这个信号，从而让线程组退出夭折。linux-2.6.21\arch\i386\kernel\ptrace.c
long arch_ptrace(struct task_struct *child, long request, long addr, long data)
case PTRACE_SYSEMU: /* continue and stop at next syscall, which will not be executed */
case PTRACE_SYSCALL: /* continue and stop at next (return from) syscall */
case PTRACE_CONT: /* restart after signal. */
ret = -EIO;
if (!valid_signal(data))
break;
if (request == PTRACE_SYSEMU) {
set_tsk_thread_flag(child, TIF_SYSCALL_EMU);
clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
} else if (request == PTRACE_SYSCALL) {
set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
clear_tsk_thread_flag(child, TIF_SYSCALL_EMU);
} else {
clear_tsk_thread_flag(child, TIF_SYSCALL_EMU);
clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
}
child->exit_code = data;调试器可以通过PTRACE_CONT清除这个信号。
/* make sure the single step bit is not set. */
clear_singlestep(child);
wake_up_process(child);
ret = 0;
break;
