Lines Matching refs:stop

28 ptrace commands from the tracer is called ptrace-stop. Ptrace-stops can
29 be further subdivided into signal-delivery-stop, group-stop,
30 syscall-stop and so on. They are described in detail later.
38 not a ptrace-stop (because tracer can't query tracee status such as
41 ptrace-stop.
43 Note that killing signal will first cause signal-delivery-stop (on one
48 SIGKILL operates similarly, with exceptions. No signal-delivery-stop is
50 kills even within syscalls (syscall-exit-stop is not generated prior to
80 been observed to enter ptrace-stop. Note that there is no guarantee
93 When running tracee enters ptrace-stop, it notifies its tracer using
95 tracee to stop. Most of this document assumes that tracer waits with:
123 group-stop, PTRACE_EVENT stops, syscall-stops [, SINGLESTEP, SYSEMU,
131 	1.x.x Signal-delivery-stop
136 thread is traced, it enters signal-delivery-stop. By this point, signal
141 signal-delivery-stop doesn't happen until signal is unblocked, with the
144 Signal-delivery-stop is observed by tracer as waitpid returning with
147 ptrace-stop - see "Syscall-stops" and "execve" sections below for
149 group-stop - see below.
154 After signal-delivery-stop is observed by tracer, tracer should restart
162 distinguish it from signal-delivery-stop.
169 tracer would observe a new syscall-enter-stop for the same syscall,
171 tracer would observe a syscall-enter-stop for restart_syscall(2)
177 is that tracer observes group-stop, mistakes it for
178 signal-delivery-stop, restarts tracee with ptrace(PTRACE_rest, pid, 0,
184 signal-delivery-stop. Tracer can't suppress this side-effect (it can
187 waking up from group-stop may be followed by signal-delivery-stop for
192 Stopping signals cause (all threads of) process to enter group-stop.
203 	1.x.x Group-stop
206 all threads stop. If some threads are traced, they enter a group-stop.
207 Note that stopping signal will first cause signal-delivery-stop (on one
209 dispatched to a thread which isn't traced), group-stop will be
211 tracee reports its group-stop separately to corresponding tracer.
213 Group-stop is observed by tracer as waitpid returning with
222 tracer sees something else, it can't be group-stop. Otherwise, tracer
224 EINVAL, then it is definitely a group-stop. (Other failure codes are
227 As of kernel 2.6.38, after tracer sees tracee ptrace-stop and until it
233 signals: if tracer restarts tracee after group-stop, SIGSTOP is
250 PTRACE_EVENT_VFORK - stop before return from vfork/clone+CLONE_VFORK.
255 PTRACE_EVENT_FORK - stop before return from fork/clone+SIGCHLD
257 PTRACE_EVENT_CLONE - stop before return from clone
259 PTRACE_EVENT_VFORK_DONE - stop before return from
263 For all four stops described above: stop occurs in parent, not in newly
267 PTRACE_EVENT_EXEC - stop before return from exec.
269 PTRACE_EVENT_EXIT - stop before exit (including death from exit_group),
282 syscall-enter-stop just prior to entering any syscall. If tracer
283 restarts it with PTRACE_SYSCALL, tracee enters syscall-exit-stop when
285 signal-delivery-stop never happens between syscall-enter-stop and
286 syscall-exit-stop, it happens *after* syscall-exit-stop).
288 Other possibilities are that tracee may stop in a PTRACE_EVENT stop,
292 Syscall-enter-stop and syscall-exit-stop are observed by tracer as
297 Syscall-stops can be distinguished from signal-delivery-stop with
302 and performing PTRACE_GETSIGINFO for every syscall-stop may be somewhat
306 For example, on x86 rax = -ENOSYS in syscall-enter-stop. Since SIGTRAP
307 (like any other signal) always happens *after* syscall-exit-stop, and
309 "syscall-stop which is not syscall-enter-stop", IOW: it looks like a
310 "stray syscall-exit-stop" and can be detected this way. But such
316 Syscall-enter-stop and syscall-exit-stop are indistinguishable from
318 ptrace-stops in order to not misinterpret syscall-enter-stop as
319 syscall-exit-stop or vice versa. The rule is that syscall-enter-stop is
320 always followed by syscall-exit-stop, PTRACE_EVENT stop or tracee's
321 death - no other kinds of ptrace-stop can occur in between.
323 If after syscall-enter-stop tracer uses restarting command other than
324 PTRACE_SYSCALL, syscall-exit-stop is not generated.
338 to be in ptrace-stop, otherwise they fail with ESRCH.
340 When tracee is in ptrace-stop, tracer can read and write data to tracee
367 SYSEMU_SINGLESTEP. If tracee is in signal-delivery-stop, sig is the
377 see tracee enter signal-delivery-stop with other signal(s) first! The
389 tracee. It continues to run (doesn't enter ptrace-stop). A common
392 signal-delivery-stop.
399 signal-delivery-stop after they exit syscall which created them.
403 to be in ptrace-stop. If tracee is in signal-delivery-stop, signal can
408 thread), wait for tracee to stop in signal-delivery-stop for SIGSTOP
420 unless they were in group-stop. Handling of restart from group-stop is
423 signal-delivery-stop, pending signal is injected.
432 All other threads stop in PTRACE_EXIT stop, if requested by active
435 PTRACE_EVENT_EXEC stop happens, if requested by active ptrace option
454 case. It enables PTRACE_EVENT_EXEC stop which occurs before execve
457 Pid change happens before PTRACE_EVENT_EXEC stop, not after.
459 When tracer receives PTRACE_EVENT_EXEC stop notification, it is
475   ** we get syscall-entry-stop in thread 1: **
478   ** we get syscall-entry-stop in thread 2: **
482   ** we get syscall-exit-stop for PID0: **
490 generated by "kill -TRAP"), not a special kind of ptrace-stop.
505 This used to cause real parent of the process to stop receiving several
524 Group-stop notifications are sent to tracer, but not to real parent.
528 PTRACE_EVENT_EXIT stop will happen for it (if requested), but subsequent
539 SIGKILL signal may still cause PTRACE_EVENT_EXIT stop before actual