xref: /dragonfly/sys/kern/kern_exit.c (revision 092c2dd1)
1 /*
2  * Copyright (c) 1982, 1986, 1989, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *	@(#)kern_exit.c	8.7 (Berkeley) 2/12/94
35  * $FreeBSD: src/sys/kern/kern_exit.c,v 1.92.2.11 2003/01/13 22:51:16 dillon Exp $
36  */
37 
38 #include "opt_ktrace.h"
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/sysproto.h>
43 #include <sys/kernel.h>
44 #include <sys/malloc.h>
45 #include <sys/proc.h>
46 #include <sys/ktrace.h>
47 #include <sys/pioctl.h>
48 #include <sys/tty.h>
49 #include <sys/wait.h>
50 #include <sys/vnode.h>
51 #include <sys/resourcevar.h>
52 #include <sys/signalvar.h>
53 #include <sys/taskqueue.h>
54 #include <sys/ptrace.h>
55 #include <sys/acct.h>		/* for acct_process() function prototype */
56 #include <sys/filedesc.h>
57 #include <sys/shm.h>
58 #include <sys/sem.h>
59 #include <sys/jail.h>
60 #include <sys/kern_syscall.h>
61 #include <sys/unistd.h>
62 #include <sys/eventhandler.h>
63 #include <sys/dsched.h>
64 
65 #include <vm/vm.h>
66 #include <vm/vm_param.h>
67 #include <sys/lock.h>
68 #include <vm/pmap.h>
69 #include <vm/vm_map.h>
70 #include <vm/vm_extern.h>
71 
72 #include <sys/refcount.h>
73 #include <sys/spinlock2.h>
74 #include <sys/mplock2.h>
75 
76 #include <machine/vmm.h>
77 
78 static void reaplwps(void *context, int dummy);
79 static void reaplwp(struct lwp *lp);
80 static void killlwps(struct lwp *lp);
81 
82 static MALLOC_DEFINE(M_ATEXIT, "atexit", "atexit callback");
83 
84 /*
85  * callout list for things to do at exit time
86  */
87 struct exitlist {
88 	exitlist_fn function;
89 	TAILQ_ENTRY(exitlist) next;
90 };
91 
92 TAILQ_HEAD(exit_list_head, exitlist);
93 static struct exit_list_head exit_list = TAILQ_HEAD_INITIALIZER(exit_list);
94 
95 /*
96  * LWP reaper data
97  */
98 static struct task *deadlwp_task[MAXCPU];
99 static struct lwplist deadlwp_list[MAXCPU];
100 static struct lwkt_token deadlwp_token[MAXCPU];
101 
102 void (*linux_task_drop_callback)(thread_t td);
103 void (*linux_proc_drop_callback)(struct proc *p);
104 
105 /*
106  * exit --
107  *	Death of process.
108  *
109  * SYS_EXIT_ARGS(int rval)
110  */
111 int
112 sys_exit(struct exit_args *uap)
113 {
114 	exit1(W_EXITCODE(uap->rval, 0));
115 	/* NOTREACHED */
116 }
117 
118 /*
119  * Extended exit --
120  *	Death of a lwp or process with optional bells and whistles.
121  */
122 int
123 sys_extexit(struct extexit_args *uap)
124 {
125 	struct proc *p = curproc;
126 	int action, who;
127 	int error;
128 
129 	action = EXTEXIT_ACTION(uap->how);
130 	who = EXTEXIT_WHO(uap->how);
131 
132 	/* Check parameters before we might perform some action */
133 	switch (who) {
134 	case EXTEXIT_PROC:
135 	case EXTEXIT_LWP:
136 		break;
137 	default:
138 		return (EINVAL);
139 	}
140 
141 	switch (action) {
142 	case EXTEXIT_SIMPLE:
143 		break;
144 	case EXTEXIT_SETINT:
145 		error = copyout(&uap->status, uap->addr, sizeof(uap->status));
146 		if (error)
147 			return (error);
148 		break;
149 	default:
150 		return (EINVAL);
151 	}
152 
153 	lwkt_gettoken(&p->p_token);
154 
155 	switch (who) {
156 	case EXTEXIT_LWP:
157 		/*
158 		 * Be sure only to perform a simple lwp exit if there is at
159 		 * least one more lwp in the proc, which will call exit1()
160 		 * later, otherwise the proc will be an UNDEAD and not even a
161 		 * SZOMB!
162 		 */
163 		if (p->p_nthreads > 1) {
164 			lwp_exit(0, NULL);	/* called w/ p_token held */
165 			/* NOT REACHED */
166 		}
167 		/* else last lwp in proc:  do the real thing */
168 		/* FALLTHROUGH */
169 	default:	/* to help gcc */
170 	case EXTEXIT_PROC:
171 		lwkt_reltoken(&p->p_token);
172 		exit1(W_EXITCODE(uap->status, 0));
173 		/* NOTREACHED */
174 	}
175 
176 	/* NOTREACHED */
177 	lwkt_reltoken(&p->p_token);	/* safety */
178 }
179 
180 /*
181  * Kill all lwps associated with the current process except the
182  * current lwp.   Return an error if we race another thread trying to
183  * do the same thing and lose the race.
184  *
185  * If forexec is non-zero the current thread and process flags are
186  * cleaned up so they can be reused.
187  */
188 int
189 killalllwps(int forexec)
190 {
191 	struct lwp *lp = curthread->td_lwp;
192 	struct proc *p = lp->lwp_proc;
193 	int fakestop;
194 
195 	/*
196 	 * Interlock against P_WEXIT.  Only one of the process's thread
197 	 * is allowed to do the master exit.
198 	 */
199 	lwkt_gettoken(&p->p_token);
200 	if (p->p_flags & P_WEXIT) {
201 		lwkt_reltoken(&p->p_token);
202 		return (EALREADY);
203 	}
204 	p->p_flags |= P_WEXIT;
205 	lwkt_gettoken(&lp->lwp_token);
206 
207 	/*
208 	 * Set temporary stopped state in case we are racing a coredump.
209 	 * Otherwise the coredump may hang forever.
210 	 */
211 	if (lp->lwp_mpflags & LWP_MP_WSTOP) {
212 		fakestop = 0;
213 	} else {
214 		atomic_set_int(&lp->lwp_mpflags, LWP_MP_WSTOP);
215 		++p->p_nstopped;
216 		fakestop = 1;
217 		wakeup(&p->p_nstopped);
218 	}
219 
220 	/*
221 	 * Interlock with LWP_MP_WEXIT and kill any remaining LWPs
222 	 */
223 	atomic_set_int(&lp->lwp_mpflags, LWP_MP_WEXIT);
224 	if (p->p_nthreads > 1)
225 		killlwps(lp);
226 
227 	/*
228 	 * Undo temporary stopped state
229 	 */
230 	if (fakestop && (lp->lwp_mpflags & LWP_MP_WSTOP)) {
231 		atomic_clear_int(&lp->lwp_mpflags, LWP_MP_WSTOP);
232 		--p->p_nstopped;
233 	}
234 
235 	/*
236 	 * If doing this for an exec, clean up the remaining thread
237 	 * (us) for continuing operation after all the other threads
238 	 * have been killed.
239 	 */
240 	if (forexec) {
241 		atomic_clear_int(&lp->lwp_mpflags, LWP_MP_WEXIT);
242 		p->p_flags &= ~P_WEXIT;
243 	}
244 	lwkt_reltoken(&lp->lwp_token);
245 	lwkt_reltoken(&p->p_token);
246 
247 	return(0);
248 }
249 
250 /*
251  * Kill all LWPs except the current one.  Do not try to signal
252  * LWPs which have exited on their own or have already been
253  * signaled.
254  */
255 static void
256 killlwps(struct lwp *lp)
257 {
258 	struct proc *p = lp->lwp_proc;
259 	struct lwp *tlp;
260 
261 	/*
262 	 * Kill the remaining LWPs.  We must send the signal before setting
263 	 * LWP_MP_WEXIT.  The setting of WEXIT is optional but helps reduce
264 	 * races.  tlp must be held across the call as it might block and
265 	 * allow the target lwp to rip itself out from under our loop.
266 	 */
267 	FOREACH_LWP_IN_PROC(tlp, p) {
268 		LWPHOLD(tlp);
269 		lwkt_gettoken(&tlp->lwp_token);
270 		if ((tlp->lwp_mpflags & LWP_MP_WEXIT) == 0) {
271 			atomic_set_int(&tlp->lwp_mpflags, LWP_MP_WEXIT);
272 			lwpsignal(p, tlp, SIGKILL);
273 		}
274 		lwkt_reltoken(&tlp->lwp_token);
275 		LWPRELE(tlp);
276 	}
277 
278 	/*
279 	 * Wait for everything to clear out.  Also make sure any tstop()s
280 	 * are signalled (we are holding p_token for the interlock).
281 	 */
282 	wakeup(p);
283 	while (p->p_nthreads > 1)
284 		tsleep(&p->p_nthreads, 0, "killlwps", 0);
285 }
286 
287 /*
288  * Exit: deallocate address space and other resources, change proc state
289  * to zombie, and unlink proc from allproc and parent's lists.  Save exit
290  * status and rusage for wait().  Check for child processes and orphan them.
291  */
292 void
293 exit1(int rv)
294 {
295 	struct thread *td = curthread;
296 	struct proc *p = td->td_proc;
297 	struct lwp *lp = td->td_lwp;
298 	struct proc *q;
299 	struct proc *pp;
300 	struct proc *reproc;
301 	struct sysreaper *reap;
302 	struct vmspace *vm;
303 	struct vnode *vtmp;
304 	struct exitlist *ep;
305 	int error;
306 
307 	lwkt_gettoken(&p->p_token);
308 
309 	if (p->p_pid == 1) {
310 		kprintf("init died (signal %d, exit %d)\n",
311 		    WTERMSIG(rv), WEXITSTATUS(rv));
312 		panic("Going nowhere without my init!");
313 	}
314 	varsymset_clean(&p->p_varsymset);
315 	lockuninit(&p->p_varsymset.vx_lock);
316 
317 	/*
318 	 * Kill all lwps associated with the current process, return an
319 	 * error if we race another thread trying to do the same thing
320 	 * and lose the race.
321 	 */
322 	error = killalllwps(0);
323 	if (error) {
324 		lwp_exit(0, NULL);
325 		/* NOT REACHED */
326 	}
327 
328 	/* are we a task leader? */
329 	if (p == p->p_leader) {
330         	struct kill_args killArgs;
331 		killArgs.signum = SIGKILL;
332 		q = p->p_peers;
333 		while(q) {
334 			killArgs.pid = q->p_pid;
335 			/*
336 		         * The interface for kill is better
337 			 * than the internal signal
338 			 */
339 			sys_kill(&killArgs);
340 			q = q->p_peers;
341 		}
342 		while (p->p_peers)
343 			tsleep((caddr_t)p, 0, "exit1", 0);
344 	}
345 
346 #ifdef PGINPROF
347 	vmsizmon();
348 #endif
349 	STOPEVENT(p, S_EXIT, rv);
350 	p->p_flags |= P_POSTEXIT;	/* stop procfs stepping */
351 
352 	/*
353 	 * Check if any loadable modules need anything done at process exit.
354 	 * e.g. SYSV IPC stuff
355 	 * XXX what if one of these generates an error?
356 	 */
357 	p->p_xstat = rv;
358 
359 	/*
360 	 * XXX: imho, the eventhandler stuff is much cleaner than this.
361 	 *	Maybe we should move everything to use eventhandler.
362 	 */
363 	TAILQ_FOREACH(ep, &exit_list, next)
364 		(*ep->function)(td);
365 
366 	if (p->p_flags & P_PROFIL)
367 		stopprofclock(p);
368 
369 	SIGEMPTYSET(p->p_siglist);
370 	SIGEMPTYSET(lp->lwp_siglist);
371 	if (timevalisset(&p->p_realtimer.it_value))
372 		callout_terminate(&p->p_ithandle);
373 
374 	/*
375 	 * Reset any sigio structures pointing to us as a result of
376 	 * F_SETOWN with our pid.
377 	 */
378 	funsetownlst(&p->p_sigiolst);
379 
380 	/*
381 	 * Close open files and release open-file table.
382 	 * This may block!
383 	 */
384 	fdfree(p, NULL);
385 
386 	if (p->p_leader->p_peers) {
387 		q = p->p_leader;
388 		while(q->p_peers != p)
389 			q = q->p_peers;
390 		q->p_peers = p->p_peers;
391 		wakeup((caddr_t)p->p_leader);
392 	}
393 
394 	/*
395 	 * XXX Shutdown SYSV semaphores
396 	 */
397 	semexit(p);
398 
399 	/* The next two chunks should probably be moved to vmspace_exit. */
400 	vm = p->p_vmspace;
401 
402 	/*
403 	 * Clean up data related to virtual kernel operation.  Clean up
404 	 * any vkernel context related to the current lwp now so we can
405 	 * destroy p_vkernel.
406 	 */
407 	if (p->p_vkernel) {
408 		vkernel_lwp_exit(lp);
409 		vkernel_exit(p);
410 	}
411 
412 	/*
413 	 * Release the user portion of address space.  The exitbump prevents
414 	 * the vmspace from being completely eradicated (using holdcnt).
415 	 * This releases references to vnodes, which could cause I/O if the
416 	 * file has been unlinked.  We need to do this early enough that
417 	 * we can still sleep.
418 	 *
419 	 * We can't free the entire vmspace as the kernel stack may be mapped
420 	 * within that space also.
421 	 *
422 	 * Processes sharing the same vmspace may exit in one order, and
423 	 * get cleaned up by vmspace_exit() in a different order.  The
424 	 * last exiting process to reach this point releases as much of
425 	 * the environment as it can, and the last process cleaned up
426 	 * by vmspace_exit() (which decrements exitingcnt) cleans up the
427 	 * remainder.
428 	 *
429 	 * NOTE: Releasing p_token around this call is helpful if the
430 	 *	 vmspace had a huge RSS.  Otherwise some other process
431 	 *	 trying to do an allproc or other scan (like 'ps') may
432 	 *	 stall for a long time.
433 	 */
434 	lwkt_reltoken(&p->p_token);
435 	vmspace_relexit(vm);
436 	lwkt_gettoken(&p->p_token);
437 
438 	if (SESS_LEADER(p)) {
439 		struct session *sp = p->p_session;
440 
441 		if (sp->s_ttyvp) {
442 			/*
443 			 * We are the controlling process.  Signal the
444 			 * foreground process group, drain the controlling
445 			 * terminal, and revoke access to the controlling
446 			 * terminal.
447 			 *
448 			 * NOTE: while waiting for the process group to exit
449 			 * it is possible that one of the processes in the
450 			 * group will revoke the tty, so the ttyclosesession()
451 			 * function will re-check sp->s_ttyvp.
452 			 */
453 			if (sp->s_ttyp && (sp->s_ttyp->t_session == sp)) {
454 				if (sp->s_ttyp->t_pgrp)
455 					pgsignal(sp->s_ttyp->t_pgrp, SIGHUP, 1);
456 				ttywait(sp->s_ttyp);
457 				ttyclosesession(sp, 1); /* also revoke */
458 			}
459 			/*
460 			 * Release the tty.  If someone has it open via
461 			 * /dev/tty then close it (since they no longer can
462 			 * once we've NULL'd it out).
463 			 */
464 			ttyclosesession(sp, 0);
465 
466 			/*
467 			 * s_ttyp is not zero'd; we use this to indicate
468 			 * that the session once had a controlling terminal.
469 			 * (for logging and informational purposes)
470 			 */
471 		}
472 		sp->s_leader = NULL;
473 	}
474 	fixjobc(p, p->p_pgrp, 0);
475 	(void)acct_process(p);
476 #ifdef KTRACE
477 	/*
478 	 * release trace file
479 	 */
480 	if (p->p_tracenode)
481 		ktrdestroy(&p->p_tracenode);
482 	p->p_traceflag = 0;
483 #endif
484 	/*
485 	 * Release reference to text vnode
486 	 */
487 	if ((vtmp = p->p_textvp) != NULL) {
488 		p->p_textvp = NULL;
489 		vrele(vtmp);
490 	}
491 
492 	/* Release namecache handle to text file */
493 	if (p->p_textnch.ncp)
494 		cache_drop(&p->p_textnch);
495 
496 	/*
497 	 * We have to handle PPWAIT here or proc_move_allproc_zombie()
498 	 * will block on the PHOLD() the parent is doing.
499 	 *
500 	 * We are using the flag as an interlock so an atomic op is
501 	 * necessary to synchronize with the parent's cpu.
502 	 */
503 	if (p->p_flags & P_PPWAIT) {
504 		if (p->p_pptr && p->p_pptr->p_upmap)
505 			atomic_add_int(&p->p_pptr->p_upmap->invfork, -1);
506 		atomic_clear_int(&p->p_flags, P_PPWAIT);
507 		wakeup(p->p_pptr);
508 	}
509 
510 	/*
511 	 * Move the process to the zombie list.  This will block
512 	 * until the process p_lock count reaches 0.  The process will
513 	 * not be reaped until TDF_EXITING is set by cpu_thread_exit(),
514 	 * which is called from cpu_proc_exit().
515 	 *
516 	 * Interlock against waiters using p_waitgen.  We increment
517 	 * p_waitgen after completing the move of our process to the
518 	 * zombie list.
519 	 *
520 	 * WARNING: pp becomes stale when we block, clear it now as a
521 	 *	    reminder.
522 	 */
523 	proc_move_allproc_zombie(p);
524 	pp = p->p_pptr;
525 	atomic_add_long(&pp->p_waitgen, 1);
526 	pp = NULL;
527 
528 	/*
529 	 * release controlled reaper for exit if we own it and return the
530 	 * remaining reaper (the one for us), which we will drop after we
531 	 * are done.
532 	 */
533 	reap = reaper_exit(p);
534 
535 	/*
536 	 * Reparent all of this process's children to the init process or
537 	 * to the designated reaper.  We must hold the reaper's p_token in
538 	 * order to safely mess with p_children.
539 	 *
540 	 * We already hold p->p_token (to remove the children from our list).
541 	 */
542 	reproc = NULL;
543 	q = LIST_FIRST(&p->p_children);
544 	if (q) {
545 		reproc = reaper_get(reap);
546 		lwkt_gettoken(&reproc->p_token);
547 		while ((q = LIST_FIRST(&p->p_children)) != NULL) {
548 			PHOLD(q);
549 			lwkt_gettoken(&q->p_token);
550 			if (q != LIST_FIRST(&p->p_children)) {
551 				lwkt_reltoken(&q->p_token);
552 				PRELE(q);
553 				continue;
554 			}
555 			LIST_REMOVE(q, p_sibling);
556 			LIST_INSERT_HEAD(&reproc->p_children, q, p_sibling);
557 			q->p_pptr = reproc;
558 			q->p_ppid = reproc->p_pid;
559 			q->p_sigparent = SIGCHLD;
560 
561 			/*
562 			 * Traced processes are killed
563 			 * since their existence means someone is screwing up.
564 			 */
565 			if (q->p_flags & P_TRACED) {
566 				q->p_flags &= ~P_TRACED;
567 				ksignal(q, SIGKILL);
568 			}
569 			lwkt_reltoken(&q->p_token);
570 			PRELE(q);
571 		}
572 		lwkt_reltoken(&reproc->p_token);
573 		wakeup(reproc);
574 	}
575 
576 	/*
577 	 * Save exit status and final rusage info.  We no longer add
578 	 * child rusage info into self times, wait4() and kern_wait()
579 	 * handles it in order to properly support wait6().
580 	 */
581 	calcru_proc(p, &p->p_ru);
582 	/*ruadd(&p->p_ru, &p->p_cru); REMOVED */
583 
584 	/*
585 	 * notify interested parties of our demise.
586 	 */
587 	KNOTE(&p->p_klist, NOTE_EXIT);
588 
589 	/*
590 	 * Notify parent that we're gone.  If parent has the PS_NOCLDWAIT
591 	 * flag set, or if the handler is set to SIG_IGN, notify the reaper
592 	 * instead (it will handle this situation).
593 	 *
594 	 * NOTE: The reaper can still be the parent process.
595 	 *
596 	 * (must reload pp)
597 	 */
598 	if (p->p_pptr->p_sigacts->ps_flag & (PS_NOCLDWAIT | PS_CLDSIGIGN)) {
599 		if (reproc == NULL)
600 			reproc = reaper_get(reap);
601 		proc_reparent(p, reproc);
602 	}
603 	if (reproc)
604 		PRELE(reproc);
605 	if (reap)
606 		reaper_drop(reap);
607 
608 	/*
609 	 * Signal (possibly new) parent.
610 	 */
611 	pp = p->p_pptr;
612 	PHOLD(pp);
613 	if (p->p_sigparent && pp != initproc) {
614 		int sig = p->p_sigparent;
615 
616 		if (sig != SIGUSR1 && sig != SIGCHLD)
617 			sig = SIGCHLD;
618 	        ksignal(pp, sig);
619 	} else {
620 	        ksignal(pp, SIGCHLD);
621 	}
622 	p->p_flags &= ~P_TRACED;
623 	PRELE(pp);
624 
625 	/*
626 	 * cpu_exit is responsible for clearing curproc, since
627 	 * it is heavily integrated with the thread/switching sequence.
628 	 *
629 	 * Other substructures are freed from wait().
630 	 */
631 	if (p->p_limit) {
632 		struct plimit *rlimit;
633 
634 		rlimit = p->p_limit;
635 		p->p_limit = NULL;
636 		plimit_free(rlimit);
637 	}
638 
639 	/*
640 	 * Finally, call machine-dependent code to release as many of the
641 	 * lwp's resources as we can and halt execution of this thread.
642 	 *
643 	 * pp is a wild pointer now but still the correct wakeup() target.
644 	 * lwp_exit() only uses it to send the wakeup() signal to the likely
645 	 * parent.  Any reparenting race that occurs will get a signal
646 	 * automatically and not be an issue.
647 	 */
648 	lwp_exit(1, pp);
649 }
650 
651 /*
652  * Eventually called by every exiting LWP
653  *
654  * p->p_token must be held.  mplock may be held and will be released.
655  */
656 void
657 lwp_exit(int masterexit, void *waddr)
658 {
659 	struct thread *td = curthread;
660 	struct lwp *lp = td->td_lwp;
661 	struct proc *p = lp->lwp_proc;
662 	int dowake = 0;
663 
664 	/*
665 	 * Release the current user process designation on the process so
666 	 * the userland scheduler can work in someone else.
667 	 */
668 	p->p_usched->release_curproc(lp);
669 
670 	/*
671 	 * lwp_exit() may be called without setting LWP_MP_WEXIT, so
672 	 * make sure it is set here.
673 	 */
674 	ASSERT_LWKT_TOKEN_HELD(&p->p_token);
675 	atomic_set_int(&lp->lwp_mpflags, LWP_MP_WEXIT);
676 
677 	/*
678 	 * Clean up any virtualization
679 	 */
680 	if (lp->lwp_vkernel)
681 		vkernel_lwp_exit(lp);
682 
683 	if (td->td_vmm)
684 		vmm_vmdestroy();
685 
686 	/*
687 	 * Clean up select/poll support
688 	 */
689 	kqueue_terminate(&lp->lwp_kqueue);
690 
691 	if (td->td_linux_task)
692 		linux_task_drop_callback(td);
693 	if (masterexit && p->p_linux_mm)
694 		linux_proc_drop_callback(p);
695 
696 	/*
697 	 * Clean up any syscall-cached ucred or rlimit.
698 	 */
699 	if (td->td_ucred) {
700 		crfree(td->td_ucred);
701 		td->td_ucred = NULL;
702 	}
703 	if (td->td_limit) {
704 		struct plimit *rlimit;
705 
706 		rlimit = td->td_limit;
707 		td->td_limit = NULL;
708 		plimit_free(rlimit);
709         }
710 
711 	/*
712 	 * Cleanup any cached descriptors for this thread
713 	 */
714 	if (p->p_fd)
715 		fexitcache(td);
716 
717 	/*
718 	 * Nobody actually wakes us when the lock
719 	 * count reaches zero, so just wait one tick.
720 	 */
721 	while (lp->lwp_lock > 0)
722 		tsleep(lp, 0, "lwpexit", 1);
723 
724 	/* Hand down resource usage to our proc */
725 	ruadd(&p->p_ru, &lp->lwp_ru);
726 
727 	/*
728 	 * If we don't hold the process until the LWP is reaped wait*()
729 	 * may try to dispose of its vmspace before all the LWPs have
730 	 * actually terminated.
731 	 */
732 	PHOLD(p);
733 
734 	/*
735 	 * Do any remaining work that might block on us.  We should be
736 	 * coded such that further blocking is ok after decrementing
737 	 * p_nthreads but don't take the chance.
738 	 */
739 	dsched_exit_thread(td);
740 	biosched_done(curthread);
741 
742 	/*
743 	 * We have to use the reaper for all the LWPs except the one doing
744 	 * the master exit.  The LWP doing the master exit can just be
745 	 * left on p_lwps and the process reaper will deal with it
746 	 * synchronously, which is much faster.
747 	 *
748 	 * Wakeup anyone waiting on p_nthreads to drop to 1 or 0.
749 	 *
750 	 * The process is left held until the reaper calls lwp_dispose() on
751 	 * the lp (after calling lwp_wait()).
752 	 */
753 	if (masterexit == 0) {
754 		int cpu = mycpuid;
755 
756 		lwp_rb_tree_RB_REMOVE(&p->p_lwp_tree, lp);
757 		--p->p_nthreads;
758 		if ((p->p_flags & P_MAYBETHREADED) && p->p_nthreads <= 1)
759 			dowake = 1;
760 		lwkt_gettoken(&deadlwp_token[cpu]);
761 		LIST_INSERT_HEAD(&deadlwp_list[cpu], lp, u.lwp_reap_entry);
762 		taskqueue_enqueue(taskqueue_thread[cpu], deadlwp_task[cpu]);
763 		lwkt_reltoken(&deadlwp_token[cpu]);
764 	} else {
765 		--p->p_nthreads;
766 		if ((p->p_flags & P_MAYBETHREADED) && p->p_nthreads <= 1)
767 			dowake = 1;
768 	}
769 
770 	/*
771 	 * We no longer need p_token.
772 	 *
773 	 * Tell the userland scheduler that we are going away
774 	 */
775 	lwkt_reltoken(&p->p_token);
776 	p->p_usched->heuristic_exiting(lp, p);
777 
778 	/*
779 	 * Issue late wakeups after releasing our token to give us a chance
780 	 * to deschedule and switch away before another cpu in a wait*()
781 	 * reaps us.  This is done as late as possible to reduce contention.
782 	 */
783 	if (dowake)
784 		wakeup(&p->p_nthreads);
785 	if (waddr)
786 		wakeup(waddr);
787 
788 	cpu_lwp_exit();
789 }
790 
791 /*
792  * Wait until a lwp is completely dead.  The final interlock in this drama
793  * is when TDF_EXITING is set in cpu_thread_exit() just before the final
794  * switchout.
795  *
796  * At the point TDF_EXITING is set a complete exit is accomplished when
797  * TDF_RUNNING and TDF_PREEMPT_LOCK are both clear.  td_mpflags has two
798  * post-switch interlock flags that can be used to wait for the TDF_
799  * flags to clear.
800  *
801  * Returns non-zero on success, and zero if the caller needs to retry
802  * the lwp_wait().
803  */
804 static int
805 lwp_wait(struct lwp *lp)
806 {
807 	struct thread *td = lp->lwp_thread;
808 	u_int mpflags;
809 
810 	KKASSERT(lwkt_preempted_proc() != lp);
811 
812 	/*
813 	 * This bit of code uses the thread destruction interlock
814 	 * managed by lwkt_switch_return() to wait for the lwp's
815 	 * thread to completely disengage.
816 	 *
817 	 * It is possible for us to race another cpu core so we
818 	 * have to do this correctly.
819 	 */
820 	for (;;) {
821 		mpflags = td->td_mpflags;
822 		cpu_ccfence();
823 		if (mpflags & TDF_MP_EXITSIG)
824 			break;
825 		tsleep_interlock(td, 0);
826 		if (atomic_cmpset_int(&td->td_mpflags, mpflags,
827 				      mpflags | TDF_MP_EXITWAIT)) {
828 			tsleep(td, PINTERLOCKED, "lwpxt", 0);
829 		}
830 	}
831 
832 	/*
833 	 * We've already waited for the core exit but there can still
834 	 * be other refs from e.g. process scans and such.
835 	 */
836 	if (lp->lwp_lock > 0) {
837 		tsleep(lp, 0, "lwpwait1", 1);
838 		return(0);
839 	}
840 	if (td->td_refs) {
841 		tsleep(td, 0, "lwpwait2", 1);
842 		return(0);
843 	}
844 
845 	/*
846 	 * Now that we have the thread destruction interlock these flags
847 	 * really should already be cleaned up, keep a check for safety.
848 	 *
849 	 * We can't rip its stack out from under it until TDF_EXITING is
850 	 * set and both TDF_RUNNING and TDF_PREEMPT_LOCK are clear.
851 	 * TDF_PREEMPT_LOCK must be checked because TDF_RUNNING
852 	 * will be cleared temporarily if a thread gets preempted.
853 	 */
854 	while ((td->td_flags & (TDF_RUNNING |
855 				TDF_RUNQ |
856 			        TDF_PREEMPT_LOCK |
857 			        TDF_EXITING)) != TDF_EXITING) {
858 		tsleep(lp, 0, "lwpwait3", 1);
859 		return (0);
860 	}
861 
862 	KASSERT((td->td_flags & (TDF_RUNQ|TDF_TSLEEPQ)) == 0,
863 		("lwp_wait: td %p (%s) still on run or sleep queue",
864 		td, td->td_comm));
865 	return (1);
866 }
867 
868 /*
869  * Release the resources associated with a lwp.
870  * The lwp must be completely dead.
871  */
872 void
873 lwp_dispose(struct lwp *lp)
874 {
875 	struct thread *td = lp->lwp_thread;
876 
877 	KKASSERT(lwkt_preempted_proc() != lp);
878 	KKASSERT(lp->lwp_lock == 0);
879 	KKASSERT(td->td_refs == 0);
880 	KKASSERT((td->td_flags & (TDF_RUNNING |
881 				  TDF_RUNQ |
882 				  TDF_PREEMPT_LOCK |
883 				  TDF_EXITING)) == TDF_EXITING);
884 
885 	PRELE(lp->lwp_proc);
886 	lp->lwp_proc = NULL;
887 	if (td != NULL) {
888 		td->td_proc = NULL;
889 		td->td_lwp = NULL;
890 		lp->lwp_thread = NULL;
891 		lwkt_free_thread(td);
892 	}
893 	kfree(lp, M_LWP);
894 }
895 
896 int
897 sys_wait4(struct wait_args *uap)
898 {
899 	struct __wrusage wrusage;
900 	int error;
901 	int status;
902 	int options;
903 	id_t id;
904 	idtype_t idtype;
905 
906 	options = uap->options | WEXITED | WTRAPPED;
907 	id = uap->pid;
908 
909 	if (id == WAIT_ANY) {
910 		idtype = P_ALL;
911 	} else if (id == WAIT_MYPGRP) {
912 		idtype = P_PGID;
913 		id = curproc->p_pgid;
914 	} else if (id < 0) {
915 		idtype = P_PGID;
916 		id = -id;
917 	} else {
918 		idtype = P_PID;
919 	}
920 
921 	error = kern_wait(idtype, id, &status, options, &wrusage,
922 			  NULL, &uap->sysmsg_result);
923 
924 	if (error == 0 && uap->status)
925 		error = copyout(&status, uap->status, sizeof(*uap->status));
926 	if (error == 0 && uap->rusage) {
927 		ruadd(&wrusage.wru_self, &wrusage.wru_children);
928 		error = copyout(&wrusage.wru_self, uap->rusage, sizeof(*uap->rusage));
929 	}
930 	return (error);
931 }
932 
933 int
934 sys_wait6(struct wait6_args *uap)
935 {
936 	struct __wrusage wrusage;
937 	siginfo_t info;
938 	siginfo_t *infop;
939 	int error;
940 	int status;
941 	int options;
942 	id_t id;
943 	idtype_t idtype;
944 
945 	/*
946 	 * NOTE: wait6() requires WEXITED and WTRAPPED to be specified if
947 	 *	 desired.
948 	 */
949 	options = uap->options;
950 	idtype = uap->idtype;
951 	id = uap->id;
952 	infop = uap->info ? &info : NULL;
953 
954 	switch(idtype) {
955 	case P_PID:
956 	case P_PGID:
957 		if (id == WAIT_MYPGRP) {
958 			idtype = P_PGID;
959 			id = curproc->p_pgid;
960 		}
961 		break;
962 	default:
963 		/* let kern_wait deal with the remainder */
964 		break;
965 	}
966 
967 	error = kern_wait(idtype, id, &status, options,
968 			  &wrusage, infop, &uap->sysmsg_result);
969 
970 	if (error == 0 && uap->status)
971 		error = copyout(&status, uap->status, sizeof(*uap->status));
972 	if (error == 0 && uap->wrusage)
973 		error = copyout(&wrusage, uap->wrusage, sizeof(*uap->wrusage));
974 	if (error == 0 && uap->info)
975 		error = copyout(&info, uap->info, sizeof(*uap->info));
976 	return (error);
977 }
978 
979 /*
980  * kernel wait*() system call support
981  */
982 int
983 kern_wait(idtype_t idtype, id_t id, int *status, int options,
984 	  struct __wrusage *wrusage, siginfo_t *info, int *res)
985 {
986 	struct thread *td = curthread;
987 	struct lwp *lp;
988 	struct proc *q = td->td_proc;
989 	struct proc *p, *t;
990 	struct ucred *cr;
991 	struct pargs *pa;
992 	struct sigacts *ps;
993 	int nfound, error;
994 	long waitgen;
995 
996 	/*
997 	 * Must not have extraneous options.  Must have at least one
998 	 * matchable option.
999 	 */
1000 	if (options &~ (WUNTRACED|WNOHANG|WCONTINUED|WLINUXCLONE|WSTOPPED|
1001 			WEXITED|WTRAPPED|WNOWAIT)) {
1002 		return (EINVAL);
1003 	}
1004 	if ((options & (WEXITED | WUNTRACED | WCONTINUED | WTRAPPED)) == 0) {
1005 		return (EINVAL);
1006 	}
1007 
1008 	/*
1009 	 * Protect the q->p_children list
1010 	 */
1011 	lwkt_gettoken(&q->p_token);
1012 loop:
1013 	/*
1014 	 * All sorts of things can change due to blocking so we have to loop
1015 	 * all the way back up here.
1016 	 *
1017 	 * The problem is that if a process group is stopped and the parent
1018 	 * is doing a wait*(..., WUNTRACED, ...), it will see the STOP
1019 	 * of the child and then stop itself when it tries to return from the
1020 	 * system call.  When the process group is resumed the parent will
1021 	 * then get the STOP status even though the child has now resumed
1022 	 * (a followup wait*() will get the CONT status).
1023 	 *
1024 	 * Previously the CONT would overwrite the STOP because the tstop
1025 	 * was handled within tsleep(), and the parent would only see
1026 	 * the CONT when both are stopped and continued together.  This little
1027 	 * two-line hack restores this effect.
1028 	 *
1029 	 * No locks are held so we can safely block the process here.
1030 	 */
1031 	if (STOPLWP(q, td->td_lwp))
1032             tstop();
1033 
1034 	nfound = 0;
1035 
1036 	/*
1037 	 * Loop on children.
1038 	 *
1039 	 * NOTE: We don't want to break q's p_token in the loop for the
1040 	 *	 case where no children are found or we risk breaking the
1041 	 *	 interlock between child and parent.
1042 	 */
1043 	waitgen = atomic_fetchadd_long(&q->p_waitgen, 0x80000000);
1044 	LIST_FOREACH(p, &q->p_children, p_sibling) {
1045 		/*
1046 		 * Filter, (p) will be held on fall-through.  Try to optimize
1047 		 * this to avoid the atomic op until we are pretty sure we
1048 		 * want this process.
1049 		 */
1050 		switch(idtype) {
1051 		case P_ALL:
1052 			PHOLD(p);
1053 			break;
1054 		case P_PID:
1055 			if (p->p_pid != (pid_t)id)
1056 				continue;
1057 			PHOLD(p);
1058 			break;
1059 		case P_PGID:
1060 			if (p->p_pgid != (pid_t)id)
1061 				continue;
1062 			PHOLD(p);
1063 			break;
1064 		case P_SID:
1065 			PHOLD(p);
1066 			if (p->p_session && p->p_session->s_sid != (pid_t)id) {
1067 				PRELE(p);
1068 				continue;
1069 			}
1070 			break;
1071 		case P_UID:
1072 			PHOLD(p);
1073 			if (p->p_ucred->cr_uid != (uid_t)id) {
1074 				PRELE(p);
1075 				continue;
1076 			}
1077 			break;
1078 		case P_GID:
1079 			PHOLD(p);
1080 			if (p->p_ucred->cr_gid != (gid_t)id) {
1081 				PRELE(p);
1082 				continue;
1083 			}
1084 			break;
1085 		case P_JAILID:
1086 			PHOLD(p);
1087 			if (p->p_ucred->cr_prison &&
1088 			    p->p_ucred->cr_prison->pr_id != (int)id) {
1089 				PRELE(p);
1090 				continue;
1091 			}
1092 			break;
1093 		default:
1094 			/* unsupported filter */
1095 			continue;
1096 		}
1097 		/* (p) is held at this point */
1098 
1099 		/*
1100 		 * This special case handles a kthread spawned by linux_clone
1101 		 * (see linux_misc.c).  The linux_wait4 and linux_waitpid
1102 		 * functions need to be able to distinguish between waiting
1103 		 * on a process and waiting on a thread.  It is a thread if
1104 		 * p_sigparent is not SIGCHLD, and the WLINUXCLONE option
1105 		 * signifies we want to wait for threads and not processes.
1106 		 */
1107 		if ((p->p_sigparent != SIGCHLD) ^
1108 		    ((options & WLINUXCLONE) != 0)) {
1109 			PRELE(p);
1110 			continue;
1111 		}
1112 
1113 		nfound++;
1114 		if (p->p_stat == SZOMB && (options & WEXITED)) {
1115 			/*
1116 			 * We may go into SZOMB with threads still present.
1117 			 * We must wait for them to exit before we can reap
1118 			 * the master thread, otherwise we may race reaping
1119 			 * non-master threads.
1120 			 *
1121 			 * Only this routine can remove a process from
1122 			 * the zombie list and destroy it.
1123 			 */
1124 			if (PHOLDZOMB(p)) {
1125 				PRELE(p);
1126 				goto loop;
1127 			}
1128 			lwkt_gettoken(&p->p_token);
1129 			if (p->p_pptr != q) {
1130 				lwkt_reltoken(&p->p_token);
1131 				PRELE(p);
1132 				PRELEZOMB(p);
1133 				goto loop;
1134 			}
1135 			while (p->p_nthreads > 0) {
1136 				tsleep(&p->p_nthreads, 0, "lwpzomb", hz);
1137 			}
1138 
1139 			/*
1140 			 * Reap any LWPs left in p->p_lwps.  This is usually
1141 			 * just the last LWP.  This must be done before
1142 			 * we loop on p_lock since the lwps hold a ref on
1143 			 * it as a vmspace interlock.
1144 			 *
1145 			 * Once that is accomplished p_nthreads had better
1146 			 * be zero.
1147 			 */
1148 			while ((lp = RB_ROOT(&p->p_lwp_tree)) != NULL) {
1149 				/*
1150 				 * Make sure no one is using this lwp, before
1151 				 * it is removed from the tree.  If we didn't
1152 				 * wait it here, lwp tree iteration with
1153 				 * blocking operation would be broken.
1154 				 */
1155 				while (lp->lwp_lock > 0)
1156 					tsleep(lp, 0, "zomblwp", 1);
1157 				lwp_rb_tree_RB_REMOVE(&p->p_lwp_tree, lp);
1158 				reaplwp(lp);
1159 			}
1160 			KKASSERT(p->p_nthreads == 0);
1161 
1162 			/*
1163 			 * Don't do anything really bad until all references
1164 			 * to the process go away.  This may include other
1165 			 * LWPs which are still in the process of being
1166 			 * reaped.  We can't just pull the rug out from under
1167 			 * them because they may still be using the VM space.
1168 			 *
1169 			 * Certain kernel facilities such as /proc will also
1170 			 * put a hold on the process for short periods of
1171 			 * time.
1172 			 */
1173 			PRELE(p);		/* from top of loop */
1174 			PSTALL(p, "reap3", 1);	/* 1 ref (for PZOMBHOLD) */
1175 
1176 			/* Take care of our return values. */
1177 			*res = p->p_pid;
1178 
1179 			*status = p->p_xstat;
1180 			wrusage->wru_self = p->p_ru;
1181 			wrusage->wru_children = p->p_cru;
1182 
1183 			if (info) {
1184 				bzero(info, sizeof(*info));
1185 				info->si_errno = 0;
1186 				info->si_signo = SIGCHLD;
1187 				if (WIFEXITED(p->p_xstat)) {
1188 					info->si_code = CLD_EXITED;
1189 					info->si_status =
1190 						WEXITSTATUS(p->p_xstat);
1191 				} else {
1192 					info->si_code = CLD_KILLED;
1193 					info->si_status = WTERMSIG(p->p_xstat);
1194 				}
1195 				info->si_pid = p->p_pid;
1196 				info->si_uid = p->p_ucred->cr_uid;
1197 			}
1198 
1199 			/*
1200 			 * WNOWAIT shortcuts to done here, leaving the
1201 			 * child on the zombie list.
1202 			 */
1203 			if (options & WNOWAIT) {
1204 				lwkt_reltoken(&p->p_token);
1205 				PRELEZOMB(p);
1206 				error = 0;
1207 				goto done;
1208 			}
1209 
1210 			/*
1211 			 * If we got the child via a ptrace 'attach',
1212 			 * we need to give it back to the old parent.
1213 			 */
1214 			if (p->p_oppid && (t = pfind(p->p_oppid)) != NULL) {
1215 				p->p_oppid = 0;
1216 				proc_reparent(p, t);
1217 				ksignal(t, SIGCHLD);
1218 				wakeup((caddr_t)t);
1219 				PRELE(t);
1220 				lwkt_reltoken(&p->p_token);
1221 				PRELEZOMB(p);
1222 				error = 0;
1223 				goto done;
1224 			}
1225 
1226 			/*
1227 			 * Unlink the proc from its process group so that
1228 			 * the following operations won't lead to an
1229 			 * inconsistent state for processes running down
1230 			 * the zombie list.
1231 			 */
1232 			proc_remove_zombie(p);
1233 			proc_userunmap(p);
1234 			lwkt_reltoken(&p->p_token);
1235 			leavepgrp(p);
1236 
1237 			p->p_xstat = 0;
1238 			ruadd(&q->p_cru, &p->p_ru);
1239 			ruadd(&q->p_cru, &p->p_cru);
1240 
1241 			/*
1242 			 * Decrement the count of procs running with this uid.
1243 			 */
1244 			chgproccnt(p->p_ucred->cr_ruidinfo, -1, 0);
1245 
1246 			/*
1247 			 * Free up credentials.  p_spin is required to
1248 			 * avoid races against allproc scans.
1249 			 */
1250 			spin_lock(&p->p_spin);
1251 			cr = p->p_ucred;
1252 			p->p_ucred = NULL;
1253 			spin_unlock(&p->p_spin);
1254 			crfree(cr);
1255 
1256 			/*
1257 			 * Remove unused arguments
1258 			 */
1259 			pa = p->p_args;
1260 			p->p_args = NULL;
1261 			if (pa && refcount_release(&pa->ar_ref)) {
1262 				kfree(pa, M_PARGS);
1263 				pa = NULL;
1264 			}
1265 
1266 			ps = p->p_sigacts;
1267 			p->p_sigacts = NULL;
1268 			if (ps && refcount_release(&ps->ps_refcnt)) {
1269 				kfree(ps, M_SUBPROC);
1270 				ps = NULL;
1271 			}
1272 
1273 			/*
1274 			 * Our exitingcount was incremented when the process
1275 			 * became a zombie, now that the process has been
1276 			 * removed from (almost) all lists we should be able
1277 			 * to safely destroy its vmspace.  Wait for any current
1278 			 * holders to go away (so the vmspace remains stable),
1279 			 * then scrap it.
1280 			 *
1281 			 * NOTE: Releasing the parent process (q) p_token
1282 			 *	 across the vmspace_exitfree() call is
1283 			 *	 important here to reduce stalls on
1284 			 *	 interactions with (q) (such as
1285 			 *	 fork/exec/wait or 'ps').
1286 			 */
1287 			PSTALL(p, "reap4", 1);
1288 			lwkt_reltoken(&q->p_token);
1289 			vmspace_exitfree(p);
1290 			lwkt_gettoken(&q->p_token);
1291 			PSTALL(p, "reap5", 1);
1292 
1293 			/*
1294 			 * NOTE: We have to officially release ZOMB in order
1295 			 *	 to ensure that a racing thread in kern_wait()
1296 			 *	 which blocked on ZOMB is woken up.
1297 			 */
1298 			PRELEZOMB(p);
1299 			kfree(p->p_uidpcpu, M_SUBPROC);
1300 			kfree(p, M_PROC);
1301 			atomic_add_int(&nprocs, -1);
1302 			error = 0;
1303 			goto done;
1304 		}
1305 
1306 		/*
1307 		 * Process has not yet exited
1308 		 */
1309 		if ((p->p_stat == SSTOP || p->p_stat == SCORE) &&
1310 		    (p->p_flags & P_WAITED) == 0 &&
1311 		    (((p->p_flags & P_TRACED) && (options & WTRAPPED)) ||
1312 		     (options & WSTOPPED))) {
1313 			lwkt_gettoken(&p->p_token);
1314 			if (p->p_pptr != q) {
1315 				lwkt_reltoken(&p->p_token);
1316 				PRELE(p);
1317 				goto loop;
1318 			}
1319 			if ((p->p_stat != SSTOP && p->p_stat != SCORE) ||
1320 			    (p->p_flags & P_WAITED) != 0 ||
1321 			    ((p->p_flags & P_TRACED) == 0 &&
1322 			     (options & WUNTRACED) == 0)) {
1323 				lwkt_reltoken(&p->p_token);
1324 				PRELE(p);
1325 				goto loop;
1326 			}
1327 
1328 			/*
1329 			 * Don't set P_WAITED if WNOWAIT specified, leaving
1330 			 * the process in a waitable state.
1331 			 */
1332 			if ((options & WNOWAIT) == 0)
1333 				p->p_flags |= P_WAITED;
1334 
1335 			*res = p->p_pid;
1336 			*status = W_STOPCODE(p->p_xstat);
1337 			/* Zero rusage so we get something consistent. */
1338 			bzero(wrusage, sizeof(*wrusage));
1339 			error = 0;
1340 			if (info) {
1341 				bzero(info, sizeof(*info));
1342 				if (p->p_flags & P_TRACED)
1343 					info->si_code = CLD_TRAPPED;
1344 				else
1345 					info->si_code = CLD_STOPPED;
1346 				info->si_status = WSTOPSIG(p->p_xstat);
1347 			}
1348 			lwkt_reltoken(&p->p_token);
1349 			PRELE(p);
1350 			goto done;
1351 		}
1352 		if ((options & WCONTINUED) && (p->p_flags & P_CONTINUED)) {
1353 			lwkt_gettoken(&p->p_token);
1354 			if (p->p_pptr != q) {
1355 				lwkt_reltoken(&p->p_token);
1356 				PRELE(p);
1357 				goto loop;
1358 			}
1359 			if ((p->p_flags & P_CONTINUED) == 0) {
1360 				lwkt_reltoken(&p->p_token);
1361 				PRELE(p);
1362 				goto loop;
1363 			}
1364 
1365 			*res = p->p_pid;
1366 
1367 			/*
1368 			 * Don't set P_WAITED if WNOWAIT specified, leaving
1369 			 * the process in a waitable state.
1370 			 */
1371 			if ((options & WNOWAIT) == 0)
1372 				p->p_flags &= ~P_CONTINUED;
1373 
1374 			*status = SIGCONT;
1375 			error = 0;
1376 			if (info) {
1377 				bzero(info, sizeof(*info));
1378 				info->si_code = CLD_CONTINUED;
1379 				info->si_status = WSTOPSIG(p->p_xstat);
1380 			}
1381 			lwkt_reltoken(&p->p_token);
1382 			PRELE(p);
1383 			goto done;
1384 		}
1385 		PRELE(p);
1386 	}
1387 	if (nfound == 0) {
1388 		error = ECHILD;
1389 		goto done;
1390 	}
1391 	if (options & WNOHANG) {
1392 		*res = 0;
1393 		error = 0;
1394 		goto done;
1395 	}
1396 
1397 	/*
1398 	 * Wait for signal - interlocked using q->p_waitgen.
1399 	 */
1400 	error = 0;
1401 	while ((waitgen & 0x7FFFFFFF) == (q->p_waitgen & 0x7FFFFFFF)) {
1402 		tsleep_interlock(q, PCATCH);
1403 		waitgen = atomic_fetchadd_long(&q->p_waitgen, 0x80000000);
1404 		if ((waitgen & 0x7FFFFFFF) == (q->p_waitgen & 0x7FFFFFFF)) {
1405 			error = tsleep(q, PCATCH | PINTERLOCKED, "wait", 0);
1406 			break;
1407 		}
1408 	}
1409 	if (error) {
1410 done:
1411 		lwkt_reltoken(&q->p_token);
1412 		return (error);
1413 	}
1414 	goto loop;
1415 }
1416 
1417 /*
1418  * Change child's parent process to parent.
1419  *
1420  * p_children/p_sibling requires the parent's token, and
1421  * changing pptr requires the child's token, so we have to
1422  * get three tokens to do this operation.  We also need to
1423  * hold pointers that might get ripped out from under us to
1424  * preserve structural integrity.
1425  *
1426  * It is possible to race another reparent or disconnect or other
1427  * similar operation.  We must retry when this situation occurs.
1428  * Once we successfully reparent the process we no longer care
1429  * about any races.
1430  */
1431 void
1432 proc_reparent(struct proc *child, struct proc *parent)
1433 {
1434 	struct proc *opp;
1435 
1436 	PHOLD(parent);
1437 	while ((opp = child->p_pptr) != parent) {
1438 		PHOLD(opp);
1439 		lwkt_gettoken(&opp->p_token);
1440 		lwkt_gettoken(&child->p_token);
1441 		lwkt_gettoken(&parent->p_token);
1442 		if (child->p_pptr != opp) {
1443 			lwkt_reltoken(&parent->p_token);
1444 			lwkt_reltoken(&child->p_token);
1445 			lwkt_reltoken(&opp->p_token);
1446 			PRELE(opp);
1447 			continue;
1448 		}
1449 		LIST_REMOVE(child, p_sibling);
1450 		LIST_INSERT_HEAD(&parent->p_children, child, p_sibling);
1451 		child->p_pptr = parent;
1452 		child->p_ppid = parent->p_pid;
1453 		lwkt_reltoken(&parent->p_token);
1454 		lwkt_reltoken(&child->p_token);
1455 		lwkt_reltoken(&opp->p_token);
1456 		if (LIST_EMPTY(&opp->p_children))
1457 			wakeup(opp);
1458 		PRELE(opp);
1459 		break;
1460 	}
1461 	PRELE(parent);
1462 }
1463 
1464 /*
1465  * The next two functions are to handle adding/deleting items on the
1466  * exit callout list
1467  *
1468  * at_exit():
1469  * Take the arguments given and put them onto the exit callout list,
1470  * However first make sure that it's not already there.
1471  * returns 0 on success.
1472  */
1473 
1474 int
1475 at_exit(exitlist_fn function)
1476 {
1477 	struct exitlist *ep;
1478 
1479 #ifdef INVARIANTS
1480 	/* Be noisy if the programmer has lost track of things */
1481 	if (rm_at_exit(function))
1482 		kprintf("WARNING: exit callout entry (%p) already present\n",
1483 		    function);
1484 #endif
1485 	ep = kmalloc(sizeof(*ep), M_ATEXIT, M_NOWAIT);
1486 	if (ep == NULL)
1487 		return (ENOMEM);
1488 	ep->function = function;
1489 	TAILQ_INSERT_TAIL(&exit_list, ep, next);
1490 	return (0);
1491 }
1492 
1493 /*
1494  * Scan the exit callout list for the given item and remove it.
1495  * Returns the number of items removed (0 or 1)
1496  */
1497 int
1498 rm_at_exit(exitlist_fn function)
1499 {
1500 	struct exitlist *ep;
1501 
1502 	TAILQ_FOREACH(ep, &exit_list, next) {
1503 		if (ep->function == function) {
1504 			TAILQ_REMOVE(&exit_list, ep, next);
1505 			kfree(ep, M_ATEXIT);
1506 			return(1);
1507 		}
1508 	}
1509 	return (0);
1510 }
1511 
1512 /*
1513  * LWP reaper related code.
1514  */
1515 static void
1516 reaplwps(void *context, int dummy)
1517 {
1518 	struct lwplist *lwplist = context;
1519 	struct lwp *lp;
1520 	int cpu = mycpuid;
1521 
1522 	lwkt_gettoken(&deadlwp_token[cpu]);
1523 	while ((lp = LIST_FIRST(lwplist))) {
1524 		LIST_REMOVE(lp, u.lwp_reap_entry);
1525 		reaplwp(lp);
1526 	}
1527 	lwkt_reltoken(&deadlwp_token[cpu]);
1528 }
1529 
1530 static void
1531 reaplwp(struct lwp *lp)
1532 {
1533 	while (lwp_wait(lp) == 0)
1534 		;
1535 	lwp_dispose(lp);
1536 }
1537 
1538 static void
1539 deadlwp_init(void)
1540 {
1541 	int cpu;
1542 
1543 	for (cpu = 0; cpu < ncpus; cpu++) {
1544 		lwkt_token_init(&deadlwp_token[cpu], "deadlwpl");
1545 		LIST_INIT(&deadlwp_list[cpu]);
1546 		deadlwp_task[cpu] = kmalloc(sizeof(*deadlwp_task[cpu]),
1547 					    M_DEVBUF, M_WAITOK);
1548 		TASK_INIT(deadlwp_task[cpu], 0, reaplwps, &deadlwp_list[cpu]);
1549 	}
1550 }
1551 
1552 SYSINIT(deadlwpinit, SI_SUB_CONFIGURE, SI_ORDER_ANY, deadlwp_init, NULL);
1553