runtime: more gentle handling of signal masks

Ian proposed an improved way of handling signals masks in Go, motivated
by a problem where the Android java runtime expects certain signals to
be blocked for all JVM threads. Discussion here

https://groups.google.com/forum/#!topic/golang-dev/_TSCkQHJt6g

Ian's text is used in the following:

A Go program always needs to have the synchronous signals enabled.
These are the signals for which _SigPanic is set in sigtable, namely
SIGSEGV, SIGBUS, SIGFPE.

A Go program that uses the os/signal package, and calls signal.Notify,
needs to have at least one thread which is not blocking that signal,
but it doesn't matter much which one.

Unix programs do not change signal mask across execve.  They inherit
signal masks across fork.  The shell uses this fact to some extent;
for example, the job control signals (SIGTTIN, SIGTTOU, SIGTSTP) are
blocked for commands run due to backquote quoting or $().

Our current position on signal masks was not thought out.  We wandered
into step by step, e.g., http://golang.org/cl/7323067 .

This CL does the following:

In minit, save the signal mask, and unblock the synchronous signals,
and SIGILL, SIGTRAP, SIGPROF, SIGSTKFLT (for systems that have it),
and any signals for which os/signal.Notify is currently active.  The
latter set of signals can be reliably maintained by
sigenable/sigdisable.

In unminit, restore the signal mask.

In c-archive/c-shared mode, the first time that os/signal.Notify is
called, start a new thread, that calls minit as usual, and then goes
to sleep.  The purpose of this is to ensure that there is always a
thread that is not blocking the notified signals.

The effect on Go programs will be that if they are invoked with some
non-synchronous signals blocked, those signals will normally be
ignored.  Previously, those signals would mostly be ignored.  A change
in behaviour will occur for programs started with any of these signals
blocked, if they receive the signal: SIGHUP, SIGINT, SIGQUIT, SIGABRT,
SIGTERM.  Previously those signals would always cause a crash (unless
using the os/signal package); with this change, they will be ignored
if the program is started with the signal blocked (and does not use
the os/signal package).

This CL only implements the changes for linux, darwin, netbsd, and
solaris. Dragonfly and freebsd are missing the how parameter in the
assembly implementation of sigprocmask, and openbsd is missing the
oldset parameter.

./all.bash completes successfully on linux/amd64.

Change-Id: I188098ba7eb85eae4c14861269cc466f2aa40e8c

Author: Elias Naur

misc/cgo/test/cgo_linux_test.go

@@ -6,7 +6,8 @@ package cgotest
 
 import "testing"
 
-func TestSetgid(t *testing.T)  { testSetgid(t) }
-func Test6997(t *testing.T)    { test6997(t) }
-func TestBuildID(t *testing.T) { testBuildID(t) }
-func Test9400(t *testing.T)    { test9400(t) }
+func TestSetgid(t *testing.T)      { testSetgid(t) }
+func Test6997(t *testing.T)        { test6997(t) }
+func TestBuildID(t *testing.T)     { testBuildID(t) }
+func Test9400(t *testing.T)        { test9400(t) }
+func TestSigProcMask(t *testing.T) { testSigProcMask(t) }

misc/cgo/test/sigprocmask_linux.c

@@ -0,0 +1,35 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+#include <signal.h>
+#include <stdlib.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <unistd.h>
+
+extern void IntoGoAndBack();
+
+int CheckBlocked() {
+	sigset_t mask;
+	sigprocmask(SIG_BLOCK, NULL, &mask);
+	return sigismember(&mask, SIGIO);
+}
+
+static void* sigthreadfunc(void* unused) {
+	sigset_t mask;
+	sigemptyset(&mask);
+	sigaddset(&mask, SIGIO);
+	sigprocmask(SIG_BLOCK, &mask, NULL);
+	IntoGoAndBack();
+}
+
+int RunSigThread() {
+	pthread_t thread;
+	int r;
+
+	r = pthread_create(&thread, NULL, &sigthreadfunc, NULL);
+	if (r != 0)
+		return r;
+	return pthread_join(thread, NULL);
+}

misc/cgo/test/sigprocmask_linux.go

@@ -0,0 +1,30 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cgotest
+
+/*
+#cgo CFLAGS: -pthread
+#cgo LDFLAGS: -pthread
+extern int RunSigThread();
+extern int CheckBlocked();
+*/
+import "C"
+import "testing"
+
+var blocked bool
+
+//export IntoGoAndBack
+func IntoGoAndBack() {
+	blocked = C.CheckBlocked() != 0
+}
+
+func testSigProcMask(t *testing.T) {
+	if r := C.RunSigThread(); r != 0 {
+		t.Error("pthread_create/pthread_join failed")
+	}
+	if !blocked {
+		t.Error("Go runtime unblocked SIGIO")
+	}
+}

src/runtime/os1_darwin.go

@@ -132,11 +132,28 @@ func minit() {
 	// Initialize signal handling.
 	_g_ := getg()
 	signalstack((*byte)(unsafe.Pointer(_g_.m.gsignal.stack.lo)), 32*1024)
-	sigprocmask(_SIG_SETMASK, &sigset_none, nil)
+
+	smask := (*uint32)(unsafe.Pointer(&_g_.m.sigmask))
+	if unsafe.Sizeof(*smask) > unsafe.Sizeof(_g_.m.sigmask) {
+		throw("insufficient storage for signal mask")
+	}
+
+	// save current signal mask for muninit and unblock essential signals.
+	var nset uint32 = sigActive[0]
+	for i := range sigtable {
+		if sigtable[i].flags&_SigUnblock != 0 {
+			nset |= 1 << (uint32(i) - 1)
+		}
+	}
+	sigprocmask(_SIG_UNBLOCK, &nset, nil)
 }
 
 // Called from dropm to undo the effect of an minit.
 func unminit() {
+	_g_ := getg()
+	smask := (*uint32)(unsafe.Pointer(&_g_.m.sigmask))
+	sigprocmask(_SIG_SETMASK, smask, nil)
+
 	signalstack(nil, 0)
 }
 
@@ -447,6 +464,11 @@ func signalstack(p *byte, n int32) {
 	sigaltstack(&st, nil)
 }
 
+func unblocksig(i uint32) {
+	var sset uint32 = 1 << (i - 1)
+	sigprocmask(_SIG_UNBLOCK, &sset, nil)
+}
+
 func unblocksignals() {
 	sigprocmask(_SIG_SETMASK, &sigset_none, nil)
 }

src/runtime/os1_dragonfly.go

@@ -215,6 +215,10 @@ func signalstack(p *byte, n int32) {
 	sigaltstack(&st, nil)
 }
 
+func unblocksig(sig uint32) {
+	// TODO(elias.naur): Implement when sigprocmask takes a _SIG_UNBLOCK parameter
+}
+
 func unblocksignals() {
 	sigprocmask(&sigset_none, nil)
 }

src/runtime/os1_freebsd.go

@@ -217,6 +217,10 @@ func signalstack(p *byte, n int32) {
 	sigaltstack(&st, nil)
 }
 
+func unblocksig(sig uint32) {
+	// TODO(elias.naur): Implement when sigprocmask takes a _SIG_UNBLOCK parameter
+}
+
 func unblocksignals() {
 	sigprocmask(&sigset_none, nil)
 }

src/runtime/os1_linux.go

@@ -196,11 +196,28 @@ func minit() {
 	// Initialize signal handling.
 	_g_ := getg()
 	signalstack((*byte)(unsafe.Pointer(_g_.m.gsignal.stack.lo)), 32*1024)
-	rtsigprocmask(_SIG_SETMASK, &sigset_none, nil, int32(unsafe.Sizeof(sigset_none)))
+
+	smask := (*sigset)(unsafe.Pointer(&_g_.m.sigmask))
+	if unsafe.Sizeof(*smask) > unsafe.Sizeof(_g_.m.sigmask) {
+		throw("insufficient storage for signal mask")
+	}
+
+	// save current signal mask for muninit and unblock essential signals.
+	var nset sigset
+	copy(nset[:], sigActive[:])
+	for i := range sigtable {
+		if sigtable[i].flags&_SigUnblock != 0 {
+			nset[(i-1)/32] |= 1 << ((uint32(i) - 1) & 31)
+		}
+	}
+	rtsigprocmask(_SIG_UNBLOCK, &nset, smask, int32(unsafe.Sizeof(nset)))
 }
 
 // Called from dropm to undo the effect of an minit.
 func unminit() {
+	_g_ := getg()
+	smask := (*sigset)(unsafe.Pointer(&_g_.m.sigmask))
+	rtsigprocmask(_SIG_SETMASK, smask, nil, int32(unsafe.Sizeof(*smask)))
 	signalstack(nil, 0)
 }
 
@@ -304,6 +321,14 @@ func signalstack(p *byte, n int32) {
 	sigaltstack(&st, nil)
 }
 
+func unblocksig(i uint32) {
+	var ss sigset
+	if w := (i - 1) / 32; w < uint32(len(ss)) {
+		ss[(i-1)/32] |= 1 << ((i - 1) & 31)
+		rtsigprocmask(_SIG_UNBLOCK, &ss, nil, int32(unsafe.Sizeof(ss)))
+	}
+}
+
 func unblocksignals() {
 	rtsigprocmask(_SIG_SETMASK, &sigset_none, nil, int32(unsafe.Sizeof(sigset_none)))
 }

src/runtime/os1_netbsd.go

@@ -147,11 +147,29 @@ func minit() {
 
 	// Initialize signal handling
 	signalstack((*byte)(unsafe.Pointer(_g_.m.gsignal.stack.lo)), 32*1024)
-	sigprocmask(_SIG_SETMASK, &sigset_none, nil)
+
+	smask := (*sigset)(unsafe.Pointer(&_g_.m.sigmask))
+	if unsafe.Sizeof(*smask) > unsafe.Sizeof(_g_.m.sigmask) {
+		throw("insufficient storage for signal mask")
+	}
+
+	// save current signal mask for muninit and unblock essential signals.
+	var nset sigset
+	copy(nset.__bits[:], sigActive[:])
+	for i := range sigtable {
+		if sigtable[i].flags&_SigUnblock != 0 {
+			nset.__bits[(i-1)/32] |= 1 << ((uint32(i) - 1) & 31)
+		}
+	}
+	sigprocmask(_SIG_UNBLOCK, &nset, smask)
 }
 
 // Called from dropm to undo the effect of an minit.
 func unminit() {
+	_g_ := getg()
+	smask := (*sigset)(unsafe.Pointer(&_g_.m.sigmask))
+	sigprocmask(_SIG_SETMASK, smask, nil)
+
 	signalstack(nil, 0)
 }
 
@@ -206,6 +224,14 @@ func signalstack(p *byte, n int32) {
 	sigaltstack(&st, nil)
 }
 
+func unblocksig(i uint32) {
+	var ss sigset
+	if w := (i - 1) / 32; w < uint32(len(ss.__bits)) {
+		ss.__bits[(i-1)/32] |= 1 << ((i - 1) & 31)
+		sigprocmask(_SIG_UNBLOCK, &ss, nil)
+	}
+}
+
 func unblocksignals() {
 	sigprocmask(_SIG_SETMASK, &sigset_none, nil)
 }

src/runtime/os1_openbsd.go

@@ -217,6 +217,10 @@ func signalstack(p *byte, n int32) {
 	sigaltstack(&st, nil)
 }
 
+func unblocksig(sig uint32) {
+	// TODO(elias.naur): Implement when sigprocmask takes an oldset parameter
+}
+
 func unblocksignals() {
 	sigprocmask(_SIG_SETMASK, sigset_none)
 }

src/runtime/os2_linux.go

@@ -8,6 +8,7 @@ const (
 	_SS_DISABLE  = 2
 	_NSIG        = 65
 	_SI_USER     = 0
+	_SIG_UNBLOCK = 1
 	_SIG_SETMASK = 2
 	_RLIMIT_AS   = 9
 )

src/runtime/os2_solaris.go

@@ -6,6 +6,7 @@ package runtime
 
 const (
 	_SS_DISABLE  = 2
+	_SIG_UNBLOCK = 2
 	_SIG_SETMASK = 3
 	_NSIG        = 73 /* number of signals in sigtable array */
 	_SI_USER     = 0

src/runtime/os3_solaris.go

@@ -197,11 +197,29 @@ func minit() {
 	asmcgocall(unsafe.Pointer(funcPC(miniterrno)), unsafe.Pointer(&libc____errno))
 	// Initialize signal handling
 	signalstack((*byte)(unsafe.Pointer(_g_.m.gsignal.stack.lo)), 32*1024)
-	sigprocmask(_SIG_SETMASK, &sigset_none, nil)
+
+	smask := (*sigset)(unsafe.Pointer(&_g_.m.sigmask))
+	if unsafe.Sizeof(*smask) > unsafe.Sizeof(_g_.m.sigmask) {
+		throw("insufficient storage for signal mask")
+	}
+
+	// save current signal mask for muninit and unblock essential signals.
+	var nset sigset
+	copy(nset.__sigbits[:], sigActive[:])
+	for i := range sigtable {
+		if sigtable[i].flags&_SigUnblock != 0 {
+			nset.__sigbits[(i-1)/32] |= 1 << ((uint32(i) - 1) & 31)
+		}
+	}
+	sigprocmask(_SIG_UNBLOCK, &nset, smask)
 }
 
 // Called from dropm to undo the effect of an minit.
 func unminit() {
+	_g_ := getg()
+	smask := (*sigset)(unsafe.Pointer(&_g_.m.sigmask))
+	sigprocmask(_SIG_SETMASK, smask, nil)
+
 	signalstack(nil, 0)
 }
 
@@ -278,6 +296,14 @@ func signalstack(p *byte, n int32) {
 	sigaltstack(&st, nil)
 }
 
+func unblocksig(i uint32) {
+	var ss sigset
+	if w := (i - 1) / 32; w < uint32(len(ss.__sigbits)) {
+		ss.__sigbits[(i-1)/32] |= 1 << ((i - 1) & 31)
+		sigprocmask(_SIG_UNBLOCK, &ss, nil)
+	}
+}
+
 func unblocksignals() {
 	sigprocmask(_SIG_SETMASK, &sigset_none, nil)
 }

src/runtime/runtime2.go

@@ -266,6 +266,7 @@ type m struct {
 	// Fields not known to debuggers.
 	procid        uint64     // for debuggers, but offset not hard-coded
 	gsignal       *g         // signal-handling g
+	sigmask       [4]uintptr // storage for saved signal mask
 	tls           [4]uintptr // thread-local storage (for x86 extern register)
 	mstartfn      func()
 	curg          *g       // current running goroutine
@@ -469,15 +470,16 @@ type sigtabtt struct {
 }
 
 const (
-	_SigNotify   = 1 << 0 // let signal.Notify have signal, even if from kernel
-	_SigKill     = 1 << 1 // if signal.Notify doesn't take it, exit quietly
-	_SigThrow    = 1 << 2 // if signal.Notify doesn't take it, exit loudly
-	_SigPanic    = 1 << 3 // if the signal is from the kernel, panic
-	_SigDefault  = 1 << 4 // if the signal isn't explicitly requested, don't monitor it
-	_SigHandling = 1 << 5 // our signal handler is registered
-	_SigIgnored  = 1 << 6 // the signal was ignored before we registered for it
-	_SigGoExit   = 1 << 7 // cause all runtime procs to exit (only used on Plan 9).
-	_SigSetStack = 1 << 8 // add SA_ONSTACK to libc handler
+	_SigNotify   = 1 << iota // let signal.Notify have signal, even if from kernel
+	_SigKill                 // if signal.Notify doesn't take it, exit quietly
+	_SigThrow                // if signal.Notify doesn't take it, exit loudly
+	_SigPanic                // if the signal is from the kernel, panic
+	_SigDefault              // if the signal isn't explicitly requested, don't monitor it
+	_SigHandling             // our signal handler is registered
+	_SigIgnored              // the signal was ignored before we registered for it
+	_SigGoExit               // cause all runtime procs to exit (only used on Plan 9).
+	_SigSetStack             // add SA_ONSTACK to libc handler
+	_SigUnblock              // unblocked in minit()
 )
 
 // Layout of in-memory per-function information prepared by linker