Linux Signal–Part 1. The Basics

Linux Signals Overview

Linux supports both POSIX reliable/standard signals and real-time signals. The first 31 signals are standard signals. Real time signals ranges from 34 to 64. The Linux command “kill -l” lists all signals numbers and names.

This post discusses reliable signals only.

A signal can be synchronous or asynchronous to the process, depending what caused the signal. Synchronous signals are also referred as traps, because they cause a trap into a kernel trap handler. An example is signal caused due to illegal instruction. Asynchronous signals are also referred as interrupts, they’re external to the current execution context and often used to send asynchronous events to a process.

If a process is in interruptible sleep state, the kernel can deliver the signal to the process and wake it up to handle it. For example, the process is waiting for terminal IO. If a process is in uninterruptible sleep, the kernel will hold the signal until the process wakes up. For instance, the process is waiting for disk IO.

Linux kernel maintains signal information for each process. The information includes an array of signal handlers and related information. Once a signal is generated, the kernel sets a bit in corresponding to the signal. Since it’s a single bit, multiple occurrences and a single occurrence are equivalent.

Signals names always start with SIG, they are defined by positive integer constants called signal numbers in the header file signal.h. signal.h is normally found in /usr/include/ directory of Linux. The actual signal numbers are usually defined in /usr/include/bits/signum.h.

Signals can happens at random times and the process can tell kernel to do one of the three things when a signal occurs,

1. ignore the signal. All except two signals (SIGSTOP and SIGKILL) can be ignored. SIGKILL always terminate a process, while SIGSTOP always clears any pending/queued SIGCONT signals and stop the process (a stopped is process may be resumed later, which is different from a terminated process). In addition, some hardware generated signals may cause the process behavior undefined if ignored (e.g. SIGSEGV).

2. catch the signal. All except two signals (SIGSTOP and SIGKILL) can be caught. We tell the kernel to execute a handler function whenever the signal occurs.

3. apply default action. Every signal has a default action. There’re four possible actions if the signal is not ignored or caught.

• ignore: nothing happens
• terminate: the process is terminated
• terminate + coredump: create a core dump file and then terminate the process
• stop: stop all threads in the process. The process goes to TASK_STOPPED state.

Linux Signals One by One

SIGHUP(1): Hangup. The signal is sent to the controlling process when a disconnect is detected by its controlling terminal interface. By default, the process is terminated.

SIGINT(2): Interrupt. The signal is sent to all foreground processes when the interrupt key (often DELETE or Control – C) is pressed. By default, the foreground processes are terminated.

SIGQUIT(3): Quit. The signal is sent to all foreground processes when the quit key (often Control – \) is pressed. In addition to terminates the foreground processes, it creates a core dump file.

SIGILL(4): Illegal instruction. It is generated when a process has executed an illegal (malformed, privileged, or unknown) hardware instruction. By default, the process is terminated and a core dump is created.

Below is a program that generates SIGILL,

typedef void(*FUNC)(void);

int main(void) {

   const static unsigned char insn[4] = {0xff, 0xff, 0xff, 0xff};

   FUNC function = (FUNC) insn;

   function();

   return 0;

}

SIGTRAP(5): Trace trap. It is used as a mechanism to notify a debugger when the process execution hits a breakpoint. By default, the process is killed and a core dump is created.

SIGABRT(6): Abort. It is generated by calling the abort function. The process terminates abnormally and a core dump file will be created by default.

SIGBUS(7): Bus error, BUS refers to the address bus in the context of a bus error. It indicates implementation defined hardware fault. It is usually caused by improper memory handling. By default, the process is terminated and a core dump is created.

SIGFPE(8): Floating point exception. It is sent to a process when it performs an illegal arithmetic operation. Note that although it is named so mainly for backward compatibility. Some common cases are dividing by 0 or floating point overflow.By default, the process is terminated and a core dump is created.

int main(void)

{

      /* "volatile" needed to eliminate compile-time optimizations */

      volatile int x = 42; 

      volatile int y = 0;

      x=x/y;

      return 0; /* Never reached */

}

SIGKILL(9): Kill. This signal always cause the process to terminate. It cannot be ignored or caught. It provides a sure way to kill a process for users with proper privilege.

SIGUSR1(10): User defined signal 1. It is sent to a process to indicate user-defined conditions. By default, the process is terminated.

SIGSEGV(11): Segmentation fault. Invalid memory segment access. By default, the process is terminated and a core dump is created. Some common cases of SIGSEGV are buffer overflow, using uninitialized pointers, dereferencing NULL pointers, exceeding the allowable stack size, attempting to access the memory the program doesn’t own, etc.

#include <stdio.h>

#include <stdlib.h>

int main(void) {

   int* a;

   a[1] = 0;

   return 0;

}

SIGUSR2(12): User defined signal 2. It is sent to a process to indicate user-defined conditions. By default, the process is terminated.

SIGPIPE(13): Broken pipe. By default, the process is terminated. It is sent to a process when it tries writing to a pipe without a process connecting to the other end.

SIGALRM(14): Alarm clock. By default, the process is terminated. It is sent to a process when a time limit has exceeded. Programs usually use SIGALRM to make a long running operation time out, or to perform an action at regular intervals.

SIGTERM(15): Termination signal. It is the default signal sent by kill and killall command. By default, the process is terminated.

SIGSTKFLT(16): Stack fault. By default, the process is terminated.

SIGCHLD/SIGCLD(17): Child process has stopped or exited, changed. By default, the signal is ignored by the process. A process can create a child process using fork. The signal is sent to the parent process when the child process terminates.

SIGCONT(18): Continue executing, if stopped. It resumes the process from TASK_STOPPED state and also clears any pending/queued stop signals. This happens no matter the process blocks, catches, or ignores the SIGCONT signal. By default, the signal is ignored.

SIGSTOP(19): Stop executing. The signal cannot be caught or ignored. It clears any pending/queued SIGCONT signals and stops the process.

SIGTSTP(20): Terminal stop signal. It clears any pending/queued SIGCONT signals no matter the signal is blocked, ignored or caught. Though it may or may not stop the process later on. By default, it stops the process. It is the signal sent to the process by its controlling terminal when user presses the SUSP key combination (Ctrl + Z normally).

SIGTTIN(21): Background process trying to read, from TTY. It clears any pending/queued SIGCONT signals no matter the signal is blocked, ignored or caught. Though it may or may not stop the process later on. By default, it stops the process.

SIGTTOU(22): Background process trying to write, to TTY. It clears any pending/queued SIGCONT signals no matter the signal is blocked, ignored or caught. Though it may or may not stop the process later on. By default, it stops the process.

SIGURG(23): Urgent condition on socket. By default, the signal is ignored by the process. It is sent to a process with async IO configured by fcntl system call on Linux when out-of-band data is available on a file descriptor connected to a socket.

SIGXCPU(24): CPU limit exceeded. By default, the process is terminated and a core dump is created. It is sent to a process when it has used the CPU for a duration that exceeds a certain predetermined user set value.

SIGXFSZ(25): File size limit exceeded. By default, the process is terminated and a core dump is created. It is sent to a process when it has created a file that exceeded the maximum allowed size.

SIGVTALRM(26): Virtual alarm clock. By default, the process is terminated. It is sent to a process when a time limit has reached. It counts only the time spent executing the process itself.

SIGPROF(27): Profiling alarm clock. By default, the process is terminated. It is sent to a process when a time limited has reached. It counts the time spent by the process and the system executing on behalf of the process.

SIGWINCH(28): Window size change. By default, the process is ignored. It is sent to a process when its controlling terminal size changes. It gives the process an opportunity to adjust its display.

SIGIO/SIGPOLL(29): I/O now possible. By default, the process is terminated. It is sent to a process when an async IO event occurs.

SIGPWR(30): Power failure restart. By default, the process is terminated. It is sent to a process when the system experiences power failure. This gives the process an opportunity to save its state.

SIGSYS/SIGUNUSED(31): Bad system call. By default, the process is terminated and a core dump is created. It is sent to a process when a bad argument is passed to a system call.

References:
1. Linux signal overview man page: http://linux.die.net/man/7/signal
2. Advanced Programming in the UNIX Environment, 2nd edition.
3. Linux signal.h and some other header source files.
4. SIGKILL wikipedia page: http://en.wikipedia.org/wiki/SIGILL
5. SIGFPE wikipedia page: http://en.wikipedia.org/wiki/SIGFPE
6. SIGBUS wikipedia page: http://en.wikipedia.org/wiki/SIGBUS