unsigned long signal;  // 當(dāng)前收到的信號(hào)，每一 bit 對(duì)應(yīng)一個(gè)信號(hào)，比如 0b10 對(duì)應(yīng)信號(hào) 2
unsigned long blocked; // 屏蔽這些信號(hào)，即不處理這些信號(hào)
/*
struct sigaction {
 __sighandler_t sa_handler; // 處理函數(shù)
 sigset_t sa_mask;
 unsigned long sa_flags;
 void (*sa_restorer)(void);
};
*/
struct sigaction sigaction[32]; // 信號(hào)對(duì)應(yīng)的處理函數(shù)，和信號(hào)的值一一對(duì)應(yīng)，比如信號(hào) 1 對(duì)應(yīng)數(shù)組 第一個(gè)元素

asmlinkage int sys_sigaction(int signum, const struct sigaction * action,
 struct sigaction * oldaction)
{
struct sigaction new_sa, *p;
// current 表示當(dāng)前調(diào)用進(jìn)程，p 指向 signum 對(duì)應(yīng)的處理函數(shù)
 p = signum - 1 + current->sigaction;
if (action) {
    // 復(fù)制內(nèi)存
  memcpy_fromfs(&new_sa, action, sizeof(struct sigaction));
 }
// 返回舊的處理函數(shù)
if (oldaction) {
int err = verify_area(VERIFY_WRITE, oldaction, sizeof(*oldaction));
if (err)
   return err;
  memcpy_tofs(oldaction, p, sizeof(struct sigaction));
 }
// 設(shè)置新的處理函數(shù)
if (action) {
  *p = new_sa;
  check_pending(signum);
 }
return0;
}

asmlinkage int sys_kill(int pid,int sig)
{
int err, retval = 0, count = 0;
// 如果沒有傳pid，則給該進(jìn)程所在組所有進(jìn)程發(fā)該信號(hào)
if (!pid)
return(kill_pg(current->pgrp,sig,0));
// 如果pid等于-1，則給除了自己和0進(jìn)程外的所有進(jìn)程發(fā)該信號(hào)
if (pid == -1) {
struct task_struct * p;
  for_each_task(p) {
   if (p->pid > 1 && p != current) {
    ++count;
    if ((err = send_sig(sig,p,0)) != -EPERM)
     retval = err;
   }
  }
return(count ? retval : -ESRCH);
 }
// 如果pid等于除-1外的負(fù)數(shù)，則取絕對(duì)值后，給該進(jìn)程組發(fā)該信號(hào)
if (pid < 0) 
return(kill_pg(-pid,sig,0));
/* Normal kill */
// 否則給某個(gè)進(jìn)程發(fā)該信號(hào)
return(kill_proc(pid,sig,0));
}

int kill_proc(int pid, int sig, int priv)
{
struct task_struct *p;
// 遍歷進(jìn)程列表，找到對(duì)應(yīng)的進(jìn)程，然后發(fā)送信號(hào)
 for_each_task(p) {
if (p && p->pid == pid)
   return send_sig(sig,p,priv);
 }
return(-ESRCH);
}

int send_sig(unsigned long sig,struct task_struct * p,int priv)
{
// 設(shè)置對(duì)應(yīng)的位為 1
 p->signal |= 1 << (sig-1);
return0;
}

_system_call:
 pushl %eax   # save orig_eax
 SAVE_ALL
 // 執(zhí)行系統(tǒng)調(diào)用
 movl _sys_call_table(,%eax,4),%eax
 call *%eax
 movl %eax,EAX(%esp)  # save the return value
 movl errno(%ebx),%edx
 negl %edx
 je ret_from_sys_call

ret_from_sys_call:
// 當(dāng)天進(jìn)程結(jié)構(gòu)體賦值到 eax
  movl _current,%eax
// 判斷是否有信號(hào)并且沒有被屏蔽
 movl blocked(%eax),%ecx
 movl %ecx,%ebx   
 notl %ecx
 andl signal(%eax),%ecx
// 非 0 說(shuō)明有信號(hào)需要處理
 jne signal_return

signal_return:
 movl %esp,%ecx
 pushl %ecx
 pushl %ebx
// 處理信號(hào)
 call _do_signal
 popl %ebx
 popl %ebx

asmlinkage int do_signal(unsigned long oldmask, struct pt_regs * regs)
{
// mask 等于 blocked 取反，表示沒有被屏蔽的信號(hào)
unsignedlong mask = ~current->blocked;
unsignedlong handler_signal = 0;
unsignedlong *frame = NULL;
unsignedlong eip = 0;
unsignedlong signr;
struct sigaction * sa;
// 收集需要處理的信號(hào)
while ((signr = current->signal & mask)) {
    // 獲取
  __asm__("bsf %3,%1\n\t"
   "btrl %1,%0"
   :"=m" (current->signal),"=r" (signr)
   :"0" (current->signal), "1" (signr));
  signr++;
    // 哪些信息需要處理
  handler_signal |= 1 << (signr-1);
    // 執(zhí)行當(dāng)前信號(hào)時(shí)需要屏蔽的信息，取反再與得到最終需要處理的信息
  mask &= ~sa->sa_mask;
 }

// 當(dāng)前的指令地址
 eip = regs->eip;
 frame = (unsignedlong *) regs->esp;
 signr = 1;
 sa = current->sigaction;
// 逐個(gè)信號(hào)處理
for (mask = 1 ; mask ; sa++,signr++,mask += mask) {
    // 構(gòu)造棧內(nèi)存布局
  setup_frame(sa,&frame,eip,regs,signr,oldmask);
    // do_signal 執(zhí)行完畢后執(zhí)行的執(zhí)行
  eip = (unsignedlong) sa->sa_handler;
  current->blocked |= sa->sa_mask;
  oldmask |= sa->sa_mask;
 }
// 設(shè)置信息的棧地址和指令
 regs->esp = (unsignedlong) frame;
 regs->eip = eip;  /* "return" to the first handler */
return1;
}

void setup_frame(struct sigaction * sa, 
                     unsigned long ** fp, // 當(dāng)前的棧地址
                     unsigned long eip,
                     struct pt_regs * regs,
                     int signr, 
                     unsigned long oldmask)
{
      unsignedlong * frame;
      frame = *fp;
      // ...
      put_fs_long(signr, frame+1);
      put_fs_long(eip, frame+16);// 執(zhí)行完處理函數(shù)后的回跳地址
      put_fs_long(regs->cs, frame+17);
      put_fs_long(regs->eflags, frame+18);
      put_fs_long(regs->esp, frame+19);
      put_fs_long(regs->ss, frame+20);
      put_fs_long(0x0000b858, CODE(0)); /* popl %eax ; movl $,%eax */
      put_fs_long(0x80cd0000, CODE(4)); /* int $0x80 */
      // 恢復(fù)現(xiàn)場(chǎng)，回到正常流程。
      put_fs_long(__NR_sigreturn, CODE(2));
}

/*
  struct signal_struct {
    // 進(jìn)程級(jí)的信號(hào)，多個(gè)線程共享
    struct sigpending shared_pending;
  }
*/
struct signal_struct *signal;   // 進(jìn)程級(jí)信號(hào)
struct sighand_struct *sighand; // 進(jìn)程級(jí)信號(hào)處理函數(shù)
sigset_t blocked, real_blocked; // 線程級(jí)信號(hào)屏蔽字
/*
  // 同一個(gè)信號(hào)可能收到多次，在 list 中排隊(duì)，通過 signal 表示收到了什么信號(hào)
  struct sigpending {
    struct list_head list; // 收到的所有信號(hào)
    sigset_t signal; // 收到了哪些信號(hào)
  };
*/
struct sigpending pending; // 線程級(jí)收到的信號(hào)

unsigned long sas_ss_sp; // 信號(hào)處理函數(shù)的棧
size_t sas_ss_size;

asmlinkage int sys_clone(struct pt_regs regs)
{
return do_fork(...);
}

long do_fork(...)
{
struct task_struct *p;
// 復(fù)制內(nèi)容
 p = copy_process(clone_flags, stack_start, regs, stack_size, parent_tidptr, child_tidptr, pid);
return pid;
}

static task_t *copy_process(...)
{
int retval;
struct task_struct *p = NULL;

// 創(chuàng)建線程必須設(shè)置 CLONE_SIGHAN，共享信號(hào)處理函數(shù)
if ((clone_flags & CLONE_THREAD) && !(clone_flags & CLONE_SIGHAND))
return ERR_PTR(-EINVAL);
    
// 獲取一個(gè)新的 task_struct 結(jié)構(gòu)體，內(nèi)容復(fù)制當(dāng)前進(jìn)程的
 p = dup_task_struct(current);  
// 初始化信號(hào)相關(guān)字段
 clear_tsk_thread_flag(p, TIF_SIGPENDING);
 init_sigpending(&p->pending);

/*
    // 引用計(jì)數(shù)加一
    if (clone_flags & (CLONE_SIGHAND | CLONE_THREAD)) {
      atomic_inc(¤t->sighand->count);
      return 0;
    }
  */
  copy_sighand(clone_flags, p));

/*
    // 引用計(jì)數(shù)加一
    if (clone_flags & CLONE_THREAD) {
      atomic_inc(¤t->signal->count);
      atomic_inc(¤t->signal->live);
      return 0;
    }
  */
  copy_signal(clone_flags, p));
}

// tgid 為線程組 id，即進(jìn)程 id，pid 為線程 id，即 tid
asmlinkage long sys_tgkill(int tgid, int pid, int sig)
{
struct siginfo info;
int error;
struct task_struct *p;

 info.si_signo = sig;
 info.si_errno = 0;
 info.si_code = SI_TKILL;
 info.si_pid = current->tgid;
 info.si_uid = current->uid;
// 根據(jù)線程 id 找到對(duì)應(yīng)的 task_struct
 p = find_task_by_pid(pid);
 error = -ESRCH;
// 只能給同進(jìn)程的線程發(fā)
if (p && (p->tgid == tgid)) {
if (sig && p->sighand) {
   error = specific_send_sig_info(sig, &info, p);
  }
 }
return error;
}

static int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
{
int ret = 0;
 ret = send_signal(sig, info, t, &t->pending);
return ret;
}

static int send_signal(int sig, struct siginfo *info, struct task_struct *t,
   struct sigpending *signals)
{
struct sigqueue * q = NULL;
int ret = 0;
// 分配一個(gè) struct sigqueue，表示一個(gè)信號(hào)
 q = __sigqueue_alloc(t, GFP_ATOMIC);
if (q) {
    // 插入 task_struct 結(jié)構(gòu)體 pending 字段的隊(duì)列，即線程級(jí)的信號(hào)
  list_add_tail(&q->list, &signals->list);
    // ...
 }
// 設(shè)置 bitmap，表示收到該信號(hào)
  sigaddset(&signals->signal, sig);
}

asmlinkage long sys_kill(int pid, int sig)
{
struct siginfo info;

 info.si_signo = sig;
 info.si_errno = 0;
 info.si_code = SI_USER;
 info.si_pid = current->tgid;
 info.si_uid = current->uid;
return kill_something_info(sig, &info, pid);
}

static int kill_something_info(int sig, struct siginfo *info, int pid)
{
return kill_proc_info(sig, info, pid);
}

int kill_proc_info(int sig, struct siginfo *info, pid_t pid)
{
int error;
struct task_struct *p;

 read_lock(&tasklist_lock);
// 通過 pid 找到進(jìn)程結(jié)構(gòu)體
 p = find_task_by_pid(pid);
 error = -ESRCH;
if (p)
  error = group_send_sig_info(sig, info, p);
 read_unlock(&tasklist_lock);
return error;
}

int group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
{
unsignedlong flags;
int ret;

if (!ret && sig && p->sighand) {
  ret = __group_send_sig_info(sig, info, p);
 }

return ret;
}

staticint __group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
{
int ret = 0;
 ret = send_signal(sig, info, p, &p->signal->shared_pending);
 __group_complete_signal(sig, p);
return0;
}

// p 沒有屏蔽該信號(hào)，p 不是退出狀態(tài)，p 是當(dāng)前 task_struct 或沒有待處理的信號(hào)
#define wants_signal(sig, p, mask)    \
 (!sigismember(&(p)->blocked, sig)  \
  && !((p)->state & mask)   \
  && !((p)->flags & PF_EXITING)   \
  && (task_curr(p) || !signal_pending(p)))

staticvoid __group_complete_signal(int sig, struct task_struct *p)
{
unsignedint mask;
struct task_struct *t;
// p 適合處理該信號(hào)則給 p
if (wants_signal(sig, p, mask))
  t = p;
elseif (thread_group_empty(p))
/*
   * There is just one thread and it does not need to be woken.
   * It will dequeue unblocked signals before it runs again.
   */
return;
else {
/*
   * Otherwise try to find a suitable thread.
   */
    
  t = p->signal->curr_target;
if (t == NULL)
   /* restart balancing at this thread */
   t = p->signal->curr_target = p;
    
    // 遍歷進(jìn)程下的線程看哪個(gè)適合處理
while (!wants_signal(sig, t, mask)) {
   t = next_thread(t);
   if (t == p->signal->curr_target)
    /*
     * No thread needs to be woken.
     * Any eligible threads will see
     * the signal in the queue soon.
     */
    return;
  }
  p->signal->curr_target = t;
 }
// 喚醒選擇的線程處理信號(hào)
  signal_wake_up(t, ....);
return;
}

void do_notify_resume(struct pt_regs *regs, sigset_t *oldset,
        __u32 thread_info_flags)
{
if (thread_info_flags & _TIF_SIGPENDING)
  do_signal(regs,oldset);
}

int fastcall do_signal(struct pt_regs *regs, sigset_t *oldset)
{
siginfo_t info;
int signr;
struct k_sigaction ka;
// 獲取一個(gè)信號(hào)
 signr = get_signal_to_deliver(&info, &ka, regs, NULL);
if (signr > 0) {
    // 處理信號(hào)
  handle_signal(signr, &info, &ka, oldset, regs);
return1;
 }

return0;
}

int get_signal_to_deliver(siginfo_t *info, struct k_sigaction *return_ka,
     struct pt_regs *regs, void *cookie)
{
sigset_t *mask = ¤t->blocked;
int signr = 0;

relock:
 spin_lock_irq(¤t->sighand->siglock);
for (;;) {
struct k_sigaction *ka;
    // 獲取一個(gè)信號(hào)
  signr = dequeue_signal(current, mask, info);
    // 設(shè)置信號(hào)處理函數(shù)
  ka = ¤t->sighand->action[signr-1];
  }
return signr;
}

int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
{
// 先從線程自己的信號(hào)字段獲取
int signr = __dequeue_signal(&tsk->pending, mask, info);
// 沒有再?gòu)倪M(jìn)程的信號(hào)獲取
if (!signr)
  signr = __dequeue_signal(&tsk->signal->shared_pending,
      mask, info);
return signr;
}

staticint __dequeue_signal(struct sigpending *pending, sigset_t *mask,
   siginfo_t *info)
{
int sig = 0;
// 獲取下一個(gè)待處理的信息
 sig = next_signal(pending, mask);
if (sig) {
    // 處理了該信號(hào)，修改相關(guān)的數(shù)據(jù)結(jié)構(gòu)
if (!collect_signal(sig, pending, info))
   sig = 0;
 }
 recalc_sigpending();

return sig;
}

static inline int collect_signal(int sig, struct sigpending *list, siginfo_t *info)
{
struct sigqueue *q, *first = NULL;
int still_pending = 0;

// 從信號(hào)隊(duì)列中獲取一個(gè)信號(hào)，并判斷是否還有該信號(hào)需要處理，因?yàn)橐活愋盘?hào)可能會(huì)收到多個(gè)
 list_for_each_entry(q, &list->list, list) {
if (q->info.si_signo == sig) {
   if (first) {
    still_pending = 1;
    break;
   }
   first = q;
  }
 }
if (first) {
    // 移出隊(duì)列
  list_del_init(&first->list);
  copy_siginfo(info, &first->info);
  __sigqueue_free(first);
    // 如果沒有該類信號(hào)則把信號(hào) bitmap 置 0
if (!still_pending)
   sigdelset(&list->signal, sig);
 }
return1;
}