// kernel/exit.c:1085-1088
SYSCALL_DEFINE1(exit, int, error_code)
{
    do_exit((error_code&0xff)<<8);
}

// kernel/exit.c:1129-1134
SYSCALL_DEFINE1(exit_group, int, error_code)
{
    do_group_exit((error_code & 0xff) << 8);
    /* NOTREACHED */
    return 0;
}

// kernel/exit.c:1095-1122
void __noreturn
do_group_exit(int exit_code)
{
    struct signal_struct *sig = current->signal;

    if (sig->flags & SIGNAL_GROUP_EXIT)          // line 1099
        exit_code = sig->group_exit_code;         // line 1100
    else if (sig->group_exec_task)                // line 1101
        exit_code = 0;
    else {
        struct sighand_struct *const sighand = current->sighand;

        spin_lock_irq(&sighand->siglock);         // line 1106
        if (sig->flags & SIGNAL_GROUP_EXIT)       // line 1107
            /* Another thread got here before we took the lock.  */
            exit_code = sig->group_exit_code;     // line 1109
        else if (sig->group_exec_task)            // line 1110
            exit_code = 0;
        else {
            sig->group_exit_code = exit_code;     // line 1113
            sig->flags = SIGNAL_GROUP_EXIT;       // line 1114
            zap_other_threads(current);           // line 1115
        }
        spin_unlock_irq(&sighand->siglock);       // line 1117
    }

    do_exit(exit_code);                           // line 1120
    /* NOTREACHED */
}

// kernel/exit.c:1024-1083
void __noreturn make_task_dead(int signr)
{
    struct task_struct *tsk = current;
    unsigned int limit;

    if (unlikely(in_interrupt()))                // line 1038
        panic("Aiee, killing interrupt handler!");
    if (unlikely(!tsk->pid))                     // line 1040
        panic("Attempted to kill the idle task!");

    if (unlikely(irqs_disabled())) {             // line 1043
        pr_info("note: %s[%d] exited with irqs disabled\n",
            current->comm, task_pid_nr(current));
        local_irq_enable();
    }
    if (unlikely(in_atomic())) {                 // line 1048
        pr_info("note: %s[%d] exited with preempt_count %d\n",
            current->comm, task_pid_nr(current),
            preempt_count());
        preempt_count_set(PREEMPT_ENABLED);
    }

    limit = READ_ONCE(oops_limit);              // line 1065
    if (atomic_inc_return(&oops_count) >= limit && limit)
        panic("Oopsed too often (kernel.oops_limit is %d)", limit);

    if (unlikely(tsk->flags & PF_EXITING)) {   // line 1073
        pr_alert("Fixing recursive fault but reboot is needed!\n");
        futex_exit_recursive(tsk);
        tsk->exit_state = EXIT_DEAD;
        refcount_inc(&tsk->rcu_users);
        preempt_disable();
        do_task_dead();
    }

    do_exit(signr);                             // line 1082

// kernel/exit.c:897-908
void __noreturn do_exit(long code)
{
    struct task_struct *tsk = current;
    struct kthread *kthread;
    int group_dead;

    WARN_ON(irqs_disabled());
    WARN_ON(tsk->plug);

    kthread = tsk_is_kthread(tsk);
    if (unlikely(kthread))
        kthread_do_exit(kthread, code);

    kcov_task_exit(tsk);                        // line 910
    kmsan_task_exit(tsk);                       // line 911

    synchronize_group_exit(tsk, code);          // line 913

// kernel/exit.c:868-895
static void synchronize_group_exit(struct task_struct *tsk, long code)
{
    struct sighand_struct *sighand = tsk->sighand;
    struct signal_struct *signal = tsk->signal;
    struct core_state *core_state;

    spin_lock_irq(&sighand->siglock);
    signal->quick_threads--;                    // line 875
    if ((signal->quick_threads == 0) &&
        !(signal->flags & SIGNAL_GROUP_EXIT)) {
        signal->flags = SIGNAL_GROUP_EXIT;      // line 878
        signal->group_exit_code = code;
        signal->group_stop_count = 0;
    }

    core_state = signal->core_state;
    spin_unlock_irq(&sighand->siglock);

    if (unlikely(core_state))
        coredump_task_exit(tsk, core_state);

    ptrace_event(PTRACE_EVENT_EXIT, code);      // line 914
    user_events_exit(tsk);                      // line 915

    io_uring_files_cancel();                    // line 917

    sched_mm_cid_exit(tsk);                     // line 918

    exit_signals(tsk);  /* sets PF_EXITING */   // line 919

// kernel/signal.c:3116-3164
void exit_signals(struct task_struct *tsk)
{
    int group_stop = 0;
    sigset_t unblocked;

    cgroup_threadgroup_change_begin(tsk);

    if (thread_group_empty(tsk) || (tsk->signal->flags & SIGNAL_GROUP_EXIT)) {
        tsk->flags |= PF_EXITING;               // line 3128
        cgroup_threadgroup_change_end(tsk);
        return;
    }

    spin_lock_irq(&tsk->sighand->siglock);
    tsk->flags |= PF_EXITING;                   // line 3138

    cgroup_threadgroup_change_end(tsk);

    if (!task_sigpending(tsk))                  // line 3142
        goto out;

    unblocked = tsk->blocked;
    signotset(&unblocked);                      // line 3146
    retarget_shared_pending(tsk, &unblocked);   // line 3147

    seccomp_filter_release(tsk);                // line 921

    acct_update_integrals(tsk);                 // line 923
    group_dead = atomic_dec_and_test(&tsk->signal->live);  // line 924

    if (group_dead) {
        if (unlikely(is_global_init(tsk)))      // line 930
            panic("Attempted to kill init! exitcode=0x%08x\n",
                tsk->signal->group_exit_code ?: (int)code);  // line 932

#ifdef CONFIG_POSIX_TIMERS
        hrtimer_cancel(&tsk->signal->real_timer);  // line 935
        exit_itimers(tsk);                       // line 936
#endif

    tsk->exit_code = code;                      // line 946
    taskstats_exit(tsk, group_dead);            // line 947
    trace_sched_process_exit(tsk, group_dead);  // line 948

    perf_event_exit_task(tsk);                  // line 957
    unwind_deferred_task_exit(tsk);             // line 963

    exit_mm();                                  // line 965

// kernel/exit.c:550-585
static void exit_mm(void)
{
    struct mm_struct *mm = current->mm;

    exit_mm_release(current, mm);               // line 554
    if (!mm)
        return;
    mmap_read_lock(mm);                         // line 557
    mmgrab_lazy_tlb(mm);                        // line 558
    BUG_ON(mm != current->active_mm);
    task_lock(current);
    smp_mb__after_spinlock();                   // line 572
    local_irq_disable();
    current->user_dumpable = (get_dumpable(mm) == SUID_DUMP_USER);
    current->mm = NULL;                         // line 575
    membarrier_update_current_mm(NULL);         // line 576
    enter_lazy_tlb(mm, current);                // line 577
    local_irq_enable();
    task_unlock(current);
    mmap_read_unlock(mm);
    mm_update_next_owner(mm);                   // line 581
    mmput(mm);                                  // line 582
    if (test_thread_flag(TIF_MEMDIE))
        exit_oom_victim();
}

    mmgrab_lazy_tlb(mm);                        // line 558

    smp_mb__after_spinlock();                   // line 572

    current->mm = NULL;                         // line 575
    membarrier_update_current_mm(NULL);         // line 576
    enter_lazy_tlb(mm, current);                // line 577

    mm_update_next_owner(mm);                   // line 581
    mmput(mm);                                  // line 582

    exit_sem(tsk);                              // line 970

    exit_shm(tsk);                              // line 971

    exit_files(tsk);                            // line 972

    exit_fs(tsk);                               // line 973

    if (group_dead)
        disassociate_ctty(1);                   // line 975

    exit_nsproxy_namespaces(tsk);               // line 976

    exit_task_work(tsk);                        // line 977

    exit_thread(tsk);                           // line 978

    cgroup_task_exit(tsk);                      // line 981

    exit_tasks_rcu_start();                     // line 988
    exit_notify(tsk, group_dead);               // line 989
    proc_exit_connector(tsk);                   // line 990

// kernel/exit.c:737-780
static void exit_notify(struct task_struct *tsk, int group_dead)
{
    bool autoreap;
    struct task_struct *p, *n;
    LIST_HEAD(dead);

    write_lock_irq(&tasklist_lock);             // line 743
    forget_original_parent(tsk, &dead);         // line 744

    if (group_dead)
        kill_orphaned_pgrp(tsk->group_leader, NULL);  // line 747

    tsk->exit_state = EXIT_ZOMBIE;              // line 749

// kernel/exit.c:698-731
static void forget_original_parent(struct task_struct *father,
                    struct list_head *dead)
{
    struct task_struct *p, *t, *reaper;

    if (unlikely(!list_empty(&father->ptraced)))
        exit_ptrace(father, dead);              // line 704

    reaper = find_child_reaper(father, dead);   // line 707
    if (list_empty(&father->children))
        return;

    reaper = find_new_reaper(father, reaper);   // line 711
    list_for_each_entry(p, &father->children, sibling) {
        for_each_thread(p, t) {
            RCU_INIT_POINTER(t->real_parent, reaper);  // line 714
            BUG_ON((!t->ptrace) != (rcu_access_pointer(t->parent) == father));
            if (likely(!t->ptrace))
                t->parent = t->real_parent;     // line 717
            if (t->pdeath_signal)
                group_send_sig_info(t->pdeath_signal,
                            SEND_SIG_NOINFO, t,
                            PIDTYPE_TGID);      // line 720
        }
        if (!same_thread_group(reaper, father))
            reparent_leader(father, p, dead);   // line 728
    }
    list_splice_tail_init(&father->children, &reaper->children);
}

// kernel/exit.c:636-669
static struct task_struct *find_new_reaper(struct task_struct *father,
                       struct task_struct *child_reaper)
{
    struct task_struct *thread, *reaper;

    thread = find_alive_thread(father);         // line 641
    if (thread)
        return thread;                          // line 643 -- 同线程组的其他线程优先

    if (father->signal->has_child_subreaper) {  // line 645
        unsigned int ns_level = task_pid(father)->level;
        for (reaper = father->real_parent;
             task_pid(reaper)->level == ns_level;
             reaper = reaper->real_parent) {
            if (reaper == &init_task)
                break;
            if (!reaper->signal->is_child_subreaper)
                continue;
            thread = find_alive_thread(reaper);
            if (thread)
                return thread;
        }
    }

    return child_reaper;                        // line 668 -- init 进程兜底
}

            if (t->pdeath_signal)               // line 718
                group_send_sig_info(t->pdeath_signal,
                            SEND_SIG_NOINFO, t,
                            PIDTYPE_TGID);

    tsk->exit_state = EXIT_ZOMBIE;              // line 749

    if (unlikely(tsk->ptrace)) {                // line 751
        int sig = thread_group_leader(tsk) &&
                thread_group_empty(tsk) &&
                !ptrace_reparented(tsk) ?
            tsk->exit_signal : SIGCHLD;
        autoreap = do_notify_parent(tsk, sig);  // line 756
    } else if (thread_group_leader(tsk)) {      // line 757
        autoreap = thread_group_empty(tsk) &&
            do_notify_parent(tsk, tsk->exit_signal);  // line 759
    } else {
        autoreap = true;                        // line 761
        /* untraced sub-thread */
        do_notify_pidfd(tsk);                   // line 763
    }

    if (autoreap) {                             // line 766
        tsk->exit_state = EXIT_DEAD;            // line 767
        list_add(&tsk->ptrace_entry, &dead);    // line 768
    }

    /* mt-exec, de_thread() is waiting for group leader */
    if (unlikely(tsk->signal->notify_count < 0))  // line 772
        wake_up_process(tsk->signal->group_exec_task);  // line 773
    write_unlock_irq(&tasklist_lock);           // line 774

    list_for_each_entry_safe(p, n, &dead, ptrace_entry) {
        list_del_init(&p->ptrace_entry);
        release_task(p);                        // line 778
    }

// kernel/exit.c:1013-1020
    preempt_disable();                          // line 1013
    if (tsk->nr_dirtied)
        __this_cpu_add(dirty_throttle_leaks, tsk->nr_dirtied);
    exit_rcu();                                 // line 1016
    exit_tasks_rcu_finish();                    // line 1017

    lockdep_free_task(tsk);                     // line 1019
    do_task_dead();                             // line 1020

    if (tsk->nr_dirtied)
        __this_cpu_add(dirty_throttle_leaks, tsk->nr_dirtied);

    exit_rcu();                                 // line 1016
    exit_tasks_rcu_finish();                    // line 1017

    lockdep_free_task(tsk);                     // line 1019

// kernel/sched/core.c:6901-6915
void __noreturn do_task_dead(void)
{
    /* Causes final put_task_struct in finish_task_switch(): */
    set_special_state(TASK_DEAD);               // line 6904

    /* Tell freezer to ignore us: */
    current->flags |= PF_NOFREEZE;              // line 6907

    __schedule(SM_NONE);                        // line 6909
    BUG();

    for (;;)
        cpu_relax();
}

// kernel/exit.c:674-693
static void reparent_leader(struct task_struct *father, struct task_struct *p,
                struct list_head *dead)
{
    if (unlikely(p->exit_state == EXIT_DEAD))
        return;

    p->exit_signal = SIGCHLD;                  // line 681

    if (!p->ptrace &&
        p->exit_state == EXIT_ZOMBIE && thread_group_empty(p)) {
        if (do_notify_parent(p, p->exit_signal)) {
            p->exit_state = EXIT_DEAD;
            list_add(&p->ptrace_entry, dead);
        }
    }

    kill_orphaned_pgrp(p, father);             // line 692
}

// kernel/exit.c:598-627
static struct task_struct *find_child_reaper(struct task_struct *father,
                        struct list_head *dead)
{
    struct pid_namespace *pid_ns = task_active_pid_ns(father);
    struct task_struct *reaper = pid_ns->child_reaper;
    struct task_struct *p, *n;

    if (likely(reaper != father))
        return reaper;

    reaper = find_alive_thread(father);
    if (reaper) {
        pid_ns->child_reaper = reaper;
        return reaper;
    }

    write_unlock_irq(&tasklist_lock);

    list_for_each_entry_safe(p, n, dead, ptrace_entry) {
        list_del_init(&p->ptrace_entry);
        release_task(p);
    }

    zap_pid_ns_processes(pid_ns);
    write_lock_irq(&tasklist_lock);

    return father;
}

// include/linux/sched/signal.h:133-134
    unsigned int        is_child_subreaper:1;
    unsigned int        has_child_subreaper:1;

io_uring_files_cancel()     必须在 exit_files() 之前（io_uring 引用文件）
exit_signals(PF_EXITING)    必须在 seccomp_filter_release() 之前
perf_event_exit_task()      必须在 exit_mm() 之前（perf 访问 mm）
unwind_deferred_task_exit() 必须在 exit_mm() 之前（栈展开访问 mm）
exit_mm()                   必须在 exit_notify() 之前（OOM killer 相关）
exit_files()                必须在 exit_task_work() 之前（task_work 可能操作文件）
exit_notify()               必须在 preempt_disable() 之前（需要睡眠）
exit_rcu()                  必须在 lockdep_free_task() 之前（RCU 回调可能在锁中）
do_task_dead()              必须是最后一步（不可逆）

信号编号      类别              说明
  1-31       标准信号           POSIX.1 定义的传统信号，每个信号有特定含义
  32-33      保留              Linux 内部使用（SIGCANCEL/SIGSETXID for glibc）
  34-64      实时信号           POSIX.1b 定义的实时信号（SIGRTMIN-SIGRTMAX）

// include/uapi/asm-generic/signal.h
#define _NSIG     64
#define _NSIG_BPW  __BITS_PER_LONG
#define _NSIG_WORDS (_NSIG / _NSIG_BPW)

// include/linux/sched/signal.h:94-255
struct signal_struct {
    refcount_t      sigcnt;                // line 95
    atomic_t        live;                  // line 96
    int             nr_threads;            // line 97
    int             quick_threads;         // line 98
    struct list_head    thread_head;       // line 99

    wait_queue_head_t   wait_chldexit;     // line 101 -- wait4() 等待队列

    struct task_struct  *curr_target;      // line 104 -- 信号负载均衡目标

    struct sigpending   shared_pending;    // line 107 -- 共享待处理信号

    struct hlist_head   multiprocess;      // line 110 -- fork 期间的延迟信号

    int             group_exit_code;       // line 113 -- 线程组退出码
    int             notify_count;          // line 115 -- exec 通知计数
    struct task_struct *group_exec_task;   // line 116 -- 执行 exec 的线程

    int             group_stop_count;      // line 119 -- 组停止计数
    unsigned int    flags;                 // line 120 -- SIGNAL_* 标志

    struct core_state *core_state;         // line 122 -- coredump 状态

    unsigned int    is_child_subreaper:1;  // line 133
    unsigned int    has_child_subreaper:1; // line 134

// include/linux/sched/signal.h:260-270
#define SIGNAL_STOP_STOPPED     0x00000001  /* job control stop in effect */
#define SIGNAL_STOP_CONTINUED   0x00000002  /* SIGCONT since WCONTINUED reap */
#define SIGNAL_GROUP_EXIT       0x00000004  /* group exit in progress */
#define SIGNAL_CLD_STOPPED      0x00000010  /* 通知父进程：子进程停止 */
#define SIGNAL_CLD_CONTINUED    0x00000020  /* 通知父进程：子进程继续 */
#define SIGNAL_CLD_MASK         (SIGNAL_CLD_STOPPED|SIGNAL_CLD_CONTINUED)
#define SIGNAL_UNKILLABLE       0x00000040  /* for init: ignore fatal signals */

// include/linux/sched/signal.h:188-205
    seqlock_t stats_lock;
    u64 utime, stime, cutime, cstime;          // line 189
    u64 gtime;                                  // line 191
    u64 cgtime;                                 // line 192
    struct prev_cputime prev_cputime;           // line 193
    unsigned long nvcsw, nivcsw, cnvcsw, cnivcsw; // line 194
    unsigned long min_flt, maj_flt, cmin_flt, cmaj_flt; // line 195-196
    unsigned long inblock, oublock, cinblock, coublock; // line 196
    unsigned long maxrss, cmaxrss;              // line 196
    struct task_io_accounting ioac;             // line 197

    struct rlimit rlim[RLIM_NLIMITS];          // line 216

// include/linux/sched/signal.h:136-163
#ifdef CONFIG_POSIX_TIMERS
    unsigned int    timer_create_restore_ids:1;
    atomic_t        next_posix_timer_id;
    struct hlist_head   posix_timers;          // line 141
    struct hlist_head   ignored_posix_timers;  // line 142

    struct hrtimer real_timer;                 // line 145 -- ITIMER_REAL
    ktime_t it_real_incr;                      // line 146

    struct cpu_itimer it[2];                   // line 153 -- ITIMER_PROF/VIRTUAL

    struct thread_group_cputimer cputimer;     // line 159
#endif
    struct posix_cputimers posix_cputimers;    // line 163

// include/linux/sched/signal.h:21-26
struct sighand_struct {
    spinlock_t      siglock;                   // line 22
    refcount_t      count;                     // line 23
    wait_queue_head_t   signalfd_wqh;          // line 24
    struct k_sigaction  action[_NSIG];         // line 25
};

// include/linux/signal_types.h:37-56
struct sigaction {
    __sighandler_t  sa_handler;        // 信号处理函数或 SIG_DFL/SIG_IGN
    unsigned long   sa_flags;          // SA_* 标志
#ifdef __ARCH_HAS_SA_RESTORER
    __sigrestore_t  sa_restorer;       // sigreturn 恢复函数
#endif
    sigset_t        sa_mask;           // 处理期间要阻塞的信号集
};

struct k_sigaction {
    struct sigaction sa;
#ifdef __ARCH_HAS_KA_RESTORER
    __sigrestore_t  ka_restorer;
#endif
};

// include/linux/signal_types.h:32-35
struct sigpending {
    struct list_head list;      // sigqueue 链表头
    sigset_t signal;            // 信号位图
};

// include/linux/signal_types.h:22-27
struct sigqueue {
    struct list_head list;      // 链入 sigpending.list
    int flags;                  // SIGQUEUE_PREALLOC 等
    kernel_siginfo_t info;      // 信号附带信息
    struct ucounts *ucounts;    // 用户信号计数（限制每用户排队数）
};

// include/uapi/asm-generic/siginfo.h (简化)
typedef struct kernel_siginfo {
    __SIGINFO;
} kernel_siginfo_t;

// __SIGINFO 展开后的关键字段：
// int      si_signo;    -- 信号编号
// int      si_errno;    -- 关联的 errno
// int      si_code;     -- 信号来源代码 (SI_USER/SI_KERNEL/SI_QUEUE/...)
// int      si_pid;      -- 发送者 PID
// uid_t    si_uid;      -- 发送者 UID
// void    *si_addr;     -- 触发地址 (SIGSEGV 等使用)
// int      si_status;   -- 退出状态 (SIGCHLD 使用)
// union sigval si_value; -- 用户附带数据 (实时信号使用)

// include/linux/signal_types.h:67-71
struct ksignal {
    struct k_sigaction ka;      // 信号处理配置
    kernel_siginfo_t info;      // 信号信息
    int sig;                    // 信号编号
};

// include/linux/sched.h:1205
    struct sigpending   pending;

// include/linux/sched/signal.h:107
    struct sigpending   shared_pending;

// kernel/signal.c:1056
    pending = (type != PIDTYPE_PID) ? &t->signal->shared_pending : &t->pending;

// kernel/signal.c:627-633
    again:
    *type = PIDTYPE_PID;
    timer_sigq = NULL;
    signr = __dequeue_signal(&tsk->pending, mask, info, &timer_sigq);
    if (!signr) {
        *type = PIDTYPE_TGID;
        signr = __dequeue_signal(&tsk->signal->shared_pending,
                     mask, info, &timer_sigq);

// kernel/signal.c (complete_signal 的核心逻辑，简化)

// include/linux/signal.h:445-448
#define sig_kernel_only(sig)        siginmask(sig, SIG_KERNEL_ONLY_MASK)
#define sig_kernel_coredump(sig)    siginmask(sig, SIG_KERNEL_COREDUMP_MASK)
#define sig_kernel_ignore(sig)      siginmask(sig, SIG_KERNEL_IGNORE_MASK)
#define sig_kernel_stop(sig)        siginmask(sig, SIG_KERNEL_STOP_MASK)

#define SIG_KERNEL_IGNORE_MASK (\
    rt_sigmask(SIGCONT)   |  rt_sigmask(SIGCHLD)   | \
    rt_sigmask(SIGWINCH)  |  rt_sigmask(SIGURG)    )

#define SIG_KERNEL_COREDUMP_MASK (\
    rt_sigmask(SIGQUIT)   |  rt_sigmask(SIGILL)    | \
    rt_sigmask(SIGTRAP)   |  rt_sigmask(SIGABRT)   | \
    rt_sigmask(SIGFPE)    |  rt_sigmask(SIGSEGV)   | \
    rt_sigmask(SIGBUS)    |  rt_sigmask(SIGSYS)    | \
    rt_sigmask(SIGXCPU)   |  rt_sigmask(SIGXFSZ)   | \
    SIGEMT_MASK           )

#define SIG_KERNEL_STOP_MASK (\
    rt_sigmask(SIGSTOP)   |  rt_sigmask(SIGTSTP)   | \
    rt_sigmask(SIGTTIN)   |  rt_sigmask(SIGTTOU)   )

void handler(int signo);

void handler(int signo, siginfo_t *info, void *context);

// include/linux/signal.h:419-420
#define SIG_KERNEL_ONLY_MASK (\
    rt_sigmask(SIGKILL)   |  rt_sigmask(SIGSTOP))

#define sig_kernel_only(sig)    siginmask(sig, SIG_KERNEL_ONLY_MASK)

// include/linux/sched/signal.h:270
#define SIGNAL_UNKILLABLE    0x00000040  /* for init: ignore fatal signals */

// kernel/signal.c (prepare_signal 核心逻辑，简化)

// include/uapi/asm-generic/signal.h
#define _NSIG     64
#define _NSIG_BPW  __BITS_PER_LONG
#define _NSIG_WORDS (_NSIG / _NSIG_BPW)

typedef struct {
    unsigned long sig[_NSIG_WORDS];
} sigset_t;

// 位图操作（简化展示）
sigemptyset(set)      -- 清空所有位（无信号）
sigfillset(set)       -- 设置所有位（所有信号）
sigaddset(set, signo) -- 设置指定信号的位
sigdelset(set, signo) -- 清除指定信号的位
sigismember(set, signo) -- 测试指定信号的位是否设置
sigandsets(d, a, b)   -- d = a & b（交集）
sigorsets(d, a, b)    -- d = a | b（并集）
signandsets(d, a, b)  -- d = a & ~b（差集）
sigisemptyset(set)    -- 测试集合是否为空
sigtestsetmask(set, mask) -- 测试集合与掩码是否有交集
siginitset(set, mask) -- 用掩码初始化集合

// include/linux/sched.h:1201-1204
    sigset_t    blocked;        // 当前阻塞的信号集
    sigset_t    real_blocked;   // sigsuspend 期间的临时掩码
    sigset_t    saved_sigmask;  // 被信号中断时保存的原掩码

// kernel/signal.c:721-736
void signal_wake_up_state(struct task_struct *t, unsigned int state)
{
    lockdep_assert_held(&t->sighand->siglock);

    set_tsk_thread_flag(t, TIF_SIGPENDING);    // line 725

    if (!wake_up_state(t, state | TASK_INTERRUPTIBLE))  // line 734
        kick_process(t);                       // line 735
}

1. __send_signal_locked()
   -> sigaddset(&pending->signal, sig)
   -> complete_signal(sig, t, type)
      -> signal_wake_up_state(target, TASK_INTERRUPTIBLE)
         -> set_tsk_thread_flag(TIF_SIGPENDING)
         -> wake_up_state() 或 kick_process()

2. 目标线程被唤醒或在 IPI 中断返回时
   -> 检查 TIF_SIGPENDING
   -> exit_to_user_mode_loop()
      -> arch/x86/kernel/signal.c: do_signal()
         -> get_signal()
            -> dequeue_signal()
               -> __dequeue_signal(&tsk->pending, ...)      // 先查私有
               -> __dequeue_signal(&tsk->signal->shared_pending, ...)  // 再查共享
            -> 根据 ksignal.ka.sa_handler 决定处理方式
               -> SIG_DFL: 执行默认动作
               -> SIG_IGN: 丢弃
               -> 函数指针: setup_rt_frame() 构建用户栈帧

// kernel/signal.c:1042-1157
static int __send_signal_locked(int sig, struct kernel_siginfo *info,
                struct task_struct *t, enum pid_type type, bool force)
{
    struct sigpending *pending;
    struct sigqueue *q;
    int override_rlimit;
    int ret = 0, result;

    lockdep_assert_held(&t->sighand->siglock);

    result = TRACE_SIGNAL_IGNORED;
    if (!prepare_signal(sig, t, force))         // line 1053
        goto ret;

    pending = (type != PIDTYPE_PID) ? &t->signal->shared_pending : &t->pending;  // line 1056

    result = TRACE_SIGNAL_ALREADY_PENDING;
    if (legacy_queue(pending, sig))             // line 1063
        goto ret;

    if ((sig == SIGKILL) || (t->flags & PF_KTHREAD))  // line 1070
        goto out_set;

    if (sig < SIGRTMIN)                         // line 1082
        override_rlimit = (is_si_special(info) || info->si_code >= 0);
    else
        override_rlimit = 0;

    q = sigqueue_alloc(sig, t, GFP_ATOMIC, override_rlimit);  // line 1087

    if (q) {
        list_add_tail(&q->list, &pending->list);  // line 1090
        switch ((unsigned long) info) {
        case (unsigned long) SEND_SIG_NOINFO:   // line 1092
            clear_siginfo(&q->info);
            q->info.si_signo = sig;
            q->info.si_errno = 0;
            q->info.si_code = SI_USER;
            q->info.si_pid = task_tgid_nr_ns(current,
                            task_active_pid_ns(t));
            rcu_read_lock();
            q->info.si_uid = from_kuid_munged(...);
            rcu_read_unlock();
            break;
        case (unsigned long) SEND_SIG_PRIV:     // line 1105
            clear_siginfo(&q->info);
            q->info.si_signo = sig;
            q->info.si_code = SI_KERNEL;
            break;
        default:                                // line 1113
            copy_siginfo(&q->info, info);
            break;
        }
    }

out_set:
    signalfd_notify(t, sig);                    // line 1136
    sigaddset(&pending->signal, sig);           // line 1137

    if (type > PIDTYPE_TGID) {                  // line 1140
        // 处理 multiprocess 延迟信号
        // SIGCONT 清除停止信号，反之亦然
    }

    complete_signal(sig, t, type);              // line 1153

// kernel/signal.c:3947
SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
{
    struct kernel_siginfo info;

    prepare_kill_siginfo(sig, &info, PIDTYPE_TGID);

    return kill_something_info(sig, &info, pid);
}

// kernel/signal.c:3931
static void prepare_kill_siginfo(int sig, struct kernel_siginfo *info,
                 enum pid_type type)
{
    clear_siginfo(info);
    info->si_signo = sig;
    info->si_errno = 0;
    info->si_code = (type == PIDTYPE_PID) ? SI_TKILL : SI_USER;
    info->si_pid = task_tgid_vnr(current);
    info->si_uid = from_kuid_munged(current_user_ns(), current_uid());
}

// kernel/signal.c:1572
static int kill_something_info(int sig, struct kernel_siginfo *info, pid_t pid)
{
    int ret;

    if (pid > 0)
        return kill_proc_info(sig, info, pid);

    /* -INT_MIN is undefined.  Exclude this case to avoid a UBSAN warning */
    if (pid == INT_MIN)
        return -ESRCH;

    read_lock(&tasklist_lock);
    if (pid != -1) {
        ret = __kill_pgrp_info(sig, info,
                pid ? find_vpid(-pid) : task_pgrp(current));
    } else {
        int retval = 0, count = 0;
        struct task_struct * p;

        for_each_process(p) {
            if (task_pid_vnr(p) > 1 &&
                    !same_thread_group(p, current)) {
                int err = group_send_sig_info(sig, info, p,
                                  PIDTYPE_MAX);
                ++count;
                if (err != -EPERM)
                    retval = err;
            }
        }
        ret = count ? retval : -ESRCH;
    }
    read_unlock(&tasklist_lock);

    return ret;
}

// kernel/signal.c:1476
static int kill_proc_info(int sig, struct kernel_siginfo *info, pid_t pid)
{
    int error;
    rcu_read_lock();
    error = kill_pid_info(sig, info, find_vpid(pid));
    rcu_read_unlock();
    return error;
}

// kernel/signal.c:1471
int kill_pid_info(int sig, struct kernel_siginfo *info, struct pid *pid)
{
    return kill_pid_info_type(sig, info, pid, PIDTYPE_TGID);
}

// kernel/signal.c:1449
static int kill_pid_info_type(int sig, struct kernel_siginfo *info,
                struct pid *pid, enum pid_type type)
{
    int error = -ESRCH;
    struct task_struct *p;

    for (;;) {
        rcu_read_lock();
        p = pid_task(pid, PIDTYPE_PID);
        if (p)
            error = group_send_sig_info(sig, info, p, type);
        rcu_read_unlock();
        if (likely(!p || error != -ESRCH))
            return error;
        /*
         * The task was unhashed in between, try again.  If it
         * is dead, pid_task() will return NULL, if we race with
         * de_thread() it will find the new leader.
         */
    }
}

// kernel/signal.c:1429
int __kill_pgrp_info(int sig, struct kernel_siginfo *info, struct pid *pgrp)
{
    struct task_struct *p = NULL;
    int ret = -ESRCH;

    do_each_pid_task(pgrp, PIDTYPE_PGID, p) {
        int err = group_send_sig_info(sig, info, p, PIDTYPE_PGID);
        /*
         * If group_send_sig_info() succeeds at least once ret
         * becomes 0 and after that the code below has no effect.
         * Otherwise we return the last err or -ESRCH if this
         * process group is empty.
         */
        if (ret)
            ret = err;
    } while_each_pid_task(pgrp, PIDTYPE_PGID, p);

    return ret;
}

// kernel/signal.c:1409
int group_send_sig_info(int sig, struct kernel_siginfo *info,
            struct task_struct *p, enum pid_type type)
{
    int ret;

    rcu_read_lock();
    ret = check_kill_permission(sig, info, p);
    rcu_read_unlock();

    if (!ret && sig)
        ret = do_send_sig_info(sig, info, p, type);

    return ret;
}

// kernel/signal.c:799
static int check_kill_permission(int sig, struct kernel_siginfo *info,
                 struct task_struct *t)
{
    struct pid *sid;
    int error;

    if (!valid_signal(sig))
        return -EINVAL;

    if (!si_fromuser(info))
        return 0;

    error = audit_signal_info(sig, t);
    if (error)
        return error;

    if (!same_thread_group(current, t) &&
        !kill_ok_by_cred(t)) {
        switch (sig) {
        case SIGCONT:
            sid = task_session(t);
            if (!sid || sid == task_session(current))
                break;
            fallthrough;
        default:
            return -EPERM;
        }
    }

    return security_task_kill(t, info, sig, NULL);
}

// kernel/signal.c:783
static bool kill_ok_by_cred(struct task_struct *t)
{
    const struct cred *cred = current_cred();
    const struct cred *tcred = __task_cred(t);

    return uid_eq(cred->euid, tcred->suid) ||
           uid_eq(cred->euid, tcred->uid) ||
           uid_eq(cred->uid, tcred->suid) ||
           uid_eq(cred->uid, tcred->uid) ||
           ns_capable(tcred->user_ns, CAP_KILL);
}

// kernel/signal.c:1262
int do_send_sig_info(int sig, struct kernel_siginfo *info, struct task_struct *p,
            enum pid_type type)
{
    unsigned long flags;
    int ret = -ESRCH;

    if (lock_task_sighand(p, &flags)) {
        ret = send_signal_locked(sig, info, p, type);
        unlock_task_sighand(p, &flags);
    }

    return ret;
}

// kernel/signal.c:1183
int send_signal_locked(int sig, struct kernel_siginfo *info,
               struct task_struct *t, enum pid_type type)
{
    bool force = false;

    if (info == SEND_SIG_NOINFO) {
        /* Force if sent from an ancestor pid namespace */
        force = !task_pid_nr_ns(current, task_active_pid_ns(t));
    } else if (info == SEND_SIG_PRIV) {
        /* Don't ignore kernel generated signals */
        force = true;
    } else if (has_si_pid_and_uid(info)) {
        struct user_namespace *t_user_ns;

        rcu_read_lock();
        t_user_ns = task_cred_xxx(t, user_ns);
        if (current_user_ns() != t_user_ns) {
            kuid_t uid = make_kuid(current_user_ns(), info->si_uid);
            info->si_uid = from_kuid_munged(t_user_ns, uid);
        }
        rcu_read_unlock();

        /* A kernel generated signal? */
        force = (info->si_code == SI_KERNEL);

        /* From an ancestor pid namespace? */
        if (!task_pid_nr_ns(current, task_active_pid_ns(t))) {
            info->si_pid = 0;
            force = true;
        }
    }
    return __send_signal_locked(sig, info, t, type, force);
}

// kernel/signal.c:1042
static int __send_signal_locked(int sig, struct kernel_siginfo *info,
                struct task_struct *t, enum pid_type type, bool force)
{
    struct sigpending *pending;
    struct sigqueue *q;
    int override_rlimit;
    int ret = 0, result;

    lockdep_assert_held(&t->sighand->siglock);

    result = TRACE_SIGNAL_IGNORED;
    if (!prepare_signal(sig, t, force))
        goto ret;

// kernel/signal.c:877
if (signal->flags & SIGNAL_GROUP_EXIT) {
    if (signal->core_state)
        return sig == SIGKILL;
    return false;
}

// kernel/signal.c:884
} else if (sig_kernel_stop(sig)) {
    siginitset(&flush, sigmask(SIGCONT));
    flush_sigqueue_mask(p, &flush, &signal->shared_pending);
    for_each_thread(p, t)
        flush_sigqueue_mask(p, &flush, &t->pending);

// kernel/signal.c:892
} else if (sig == SIGCONT) {
    siginitset(&flush, SIG_KERNEL_STOP_MASK);
    flush_sigqueue_mask(p, &flush, &signal->shared_pending);
    for_each_thread(p, t) {
        flush_sigqueue_mask(p, &flush, &t->pending);
        task_clear_jobctl_pending(t, JOBCTL_STOP_PENDING);
        if (likely(!(t->ptrace & PT_SEIZED))) {
            t->jobctl &= ~JOBCTL_STOPPED;
            wake_up_state(t, __TASK_STOPPED);
        } else
            ptrace_trap_notify(t);
    }

// kernel/signal.c:106
static bool sig_ignored(struct task_struct *t, int sig, bool force)
{
    if (sigismember(&t->blocked, sig) || sigismember(&t->real_blocked, sig))
        return false;
    if (t->ptrace && sig != SIGKILL)
        return false;
    return sig_task_ignored(t, sig, force);
}