xref: /dragonfly/sys/kern/kern_exit.c (revision 50b09fda)
1 /*
2  * Copyright (c) 1982, 1986, 1989, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *	@(#)kern_exit.c	8.7 (Berkeley) 2/12/94
35  * $FreeBSD: src/sys/kern/kern_exit.c,v 1.92.2.11 2003/01/13 22:51:16 dillon Exp $
36  */
37 
38 #include "opt_ktrace.h"
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/sysproto.h>
43 #include <sys/kernel.h>
44 #include <sys/malloc.h>
45 #include <sys/proc.h>
46 #include <sys/ktrace.h>
47 #include <sys/pioctl.h>
48 #include <sys/tty.h>
49 #include <sys/wait.h>
50 #include <sys/vnode.h>
51 #include <sys/resourcevar.h>
52 #include <sys/signalvar.h>
53 #include <sys/taskqueue.h>
54 #include <sys/ptrace.h>
55 #include <sys/acct.h>		/* for acct_process() function prototype */
56 #include <sys/filedesc.h>
57 #include <sys/shm.h>
58 #include <sys/sem.h>
59 #include <sys/jail.h>
60 #include <sys/kern_syscall.h>
61 #include <sys/unistd.h>
62 #include <sys/eventhandler.h>
63 #include <sys/dsched.h>
64 
65 #include <vm/vm.h>
66 #include <vm/vm_param.h>
67 #include <sys/lock.h>
68 #include <vm/pmap.h>
69 #include <vm/vm_map.h>
70 #include <vm/vm_extern.h>
71 #include <sys/user.h>
72 
73 #include <sys/refcount.h>
74 #include <sys/thread2.h>
75 #include <sys/spinlock2.h>
76 #include <sys/mplock2.h>
77 
78 #include <machine/vmm.h>
79 
80 static void reaplwps(void *context, int dummy);
81 static void reaplwp(struct lwp *lp);
82 static void killlwps(struct lwp *lp);
83 
84 static MALLOC_DEFINE(M_ATEXIT, "atexit", "atexit callback");
85 
86 /*
87  * callout list for things to do at exit time
88  */
89 struct exitlist {
90 	exitlist_fn function;
91 	TAILQ_ENTRY(exitlist) next;
92 };
93 
94 TAILQ_HEAD(exit_list_head, exitlist);
95 static struct exit_list_head exit_list = TAILQ_HEAD_INITIALIZER(exit_list);
96 
97 /*
98  * LWP reaper data
99  */
100 static struct task *deadlwp_task[MAXCPU];
101 static struct lwplist deadlwp_list[MAXCPU];
102 static struct lwkt_token deadlwp_token[MAXCPU];
103 
104 /*
105  * exit --
106  *	Death of process.
107  *
108  * SYS_EXIT_ARGS(int rval)
109  */
110 int
111 sys_exit(struct exit_args *uap)
112 {
113 	exit1(W_EXITCODE(uap->rval, 0));
114 	/* NOTREACHED */
115 }
116 
117 /*
118  * Extended exit --
119  *	Death of a lwp or process with optional bells and whistles.
120  */
121 int
122 sys_extexit(struct extexit_args *uap)
123 {
124 	struct proc *p = curproc;
125 	int action, who;
126 	int error;
127 
128 	action = EXTEXIT_ACTION(uap->how);
129 	who = EXTEXIT_WHO(uap->how);
130 
131 	/* Check parameters before we might perform some action */
132 	switch (who) {
133 	case EXTEXIT_PROC:
134 	case EXTEXIT_LWP:
135 		break;
136 	default:
137 		return (EINVAL);
138 	}
139 
140 	switch (action) {
141 	case EXTEXIT_SIMPLE:
142 		break;
143 	case EXTEXIT_SETINT:
144 		error = copyout(&uap->status, uap->addr, sizeof(uap->status));
145 		if (error)
146 			return (error);
147 		break;
148 	default:
149 		return (EINVAL);
150 	}
151 
152 	lwkt_gettoken(&p->p_token);
153 
154 	switch (who) {
155 	case EXTEXIT_LWP:
156 		/*
157 		 * Be sure only to perform a simple lwp exit if there is at
158 		 * least one more lwp in the proc, which will call exit1()
159 		 * later, otherwise the proc will be an UNDEAD and not even a
160 		 * SZOMB!
161 		 */
162 		if (p->p_nthreads > 1) {
163 			lwp_exit(0, NULL);	/* called w/ p_token held */
164 			/* NOT REACHED */
165 		}
166 		/* else last lwp in proc:  do the real thing */
167 		/* FALLTHROUGH */
168 	default:	/* to help gcc */
169 	case EXTEXIT_PROC:
170 		lwkt_reltoken(&p->p_token);
171 		exit1(W_EXITCODE(uap->status, 0));
172 		/* NOTREACHED */
173 	}
174 
175 	/* NOTREACHED */
176 	lwkt_reltoken(&p->p_token);	/* safety */
177 }
178 
179 /*
180  * Kill all lwps associated with the current process except the
181  * current lwp.   Return an error if we race another thread trying to
182  * do the same thing and lose the race.
183  *
184  * If forexec is non-zero the current thread and process flags are
185  * cleaned up so they can be reused.
186  */
187 int
188 killalllwps(int forexec)
189 {
190 	struct lwp *lp = curthread->td_lwp;
191 	struct proc *p = lp->lwp_proc;
192 	int fakestop;
193 
194 	/*
195 	 * Interlock against P_WEXIT.  Only one of the process's thread
196 	 * is allowed to do the master exit.
197 	 */
198 	lwkt_gettoken(&p->p_token);
199 	if (p->p_flags & P_WEXIT) {
200 		lwkt_reltoken(&p->p_token);
201 		return (EALREADY);
202 	}
203 	p->p_flags |= P_WEXIT;
204 	lwkt_gettoken(&lp->lwp_token);
205 
206 	/*
207 	 * Set temporary stopped state in case we are racing a coredump.
208 	 * Otherwise the coredump may hang forever.
209 	 */
210 	if (lp->lwp_mpflags & LWP_MP_WSTOP) {
211 		fakestop = 0;
212 	} else {
213 		atomic_set_int(&lp->lwp_mpflags, LWP_MP_WSTOP);
214 		++p->p_nstopped;
215 		fakestop = 1;
216 		wakeup(&p->p_nstopped);
217 	}
218 
219 	/*
220 	 * Interlock with LWP_MP_WEXIT and kill any remaining LWPs
221 	 */
222 	atomic_set_int(&lp->lwp_mpflags, LWP_MP_WEXIT);
223 	if (p->p_nthreads > 1)
224 		killlwps(lp);
225 
226 	/*
227 	 * Undo temporary stopped state
228 	 */
229 	if (fakestop) {
230 		atomic_clear_int(&lp->lwp_mpflags, LWP_MP_WSTOP);
231 		--p->p_nstopped;
232 	}
233 
234 	/*
235 	 * If doing this for an exec, clean up the remaining thread
236 	 * (us) for continuing operation after all the other threads
237 	 * have been killed.
238 	 */
239 	if (forexec) {
240 		atomic_clear_int(&lp->lwp_mpflags, LWP_MP_WEXIT);
241 		p->p_flags &= ~P_WEXIT;
242 	}
243 	lwkt_reltoken(&lp->lwp_token);
244 	lwkt_reltoken(&p->p_token);
245 
246 	return(0);
247 }
248 
249 /*
250  * Kill all LWPs except the current one.  Do not try to signal
251  * LWPs which have exited on their own or have already been
252  * signaled.
253  */
254 static void
255 killlwps(struct lwp *lp)
256 {
257 	struct proc *p = lp->lwp_proc;
258 	struct lwp *tlp;
259 
260 	/*
261 	 * Kill the remaining LWPs.  We must send the signal before setting
262 	 * LWP_MP_WEXIT.  The setting of WEXIT is optional but helps reduce
263 	 * races.  tlp must be held across the call as it might block and
264 	 * allow the target lwp to rip itself out from under our loop.
265 	 */
266 	FOREACH_LWP_IN_PROC(tlp, p) {
267 		LWPHOLD(tlp);
268 		lwkt_gettoken(&tlp->lwp_token);
269 		if ((tlp->lwp_mpflags & LWP_MP_WEXIT) == 0) {
270 			atomic_set_int(&tlp->lwp_mpflags, LWP_MP_WEXIT);
271 			lwpsignal(p, tlp, SIGKILL);
272 		}
273 		lwkt_reltoken(&tlp->lwp_token);
274 		LWPRELE(tlp);
275 	}
276 
277 	/*
278 	 * Wait for everything to clear out.  Also make sure any tstop()s
279 	 * are signalled (we are holding p_token for the interlock).
280 	 */
281 	wakeup(p);
282 	while (p->p_nthreads > 1)
283 		tsleep(&p->p_nthreads, 0, "killlwps", 0);
284 }
285 
286 /*
287  * Exit: deallocate address space and other resources, change proc state
288  * to zombie, and unlink proc from allproc and parent's lists.  Save exit
289  * status and rusage for wait().  Check for child processes and orphan them.
290  */
291 void
292 exit1(int rv)
293 {
294 	struct thread *td = curthread;
295 	struct proc *p = td->td_proc;
296 	struct lwp *lp = td->td_lwp;
297 	struct proc *q;
298 	struct proc *pp;
299 	struct proc *reproc;
300 	struct sysreaper *reap;
301 	struct vmspace *vm;
302 	struct vnode *vtmp;
303 	struct exitlist *ep;
304 	int error;
305 
306 	lwkt_gettoken(&p->p_token);
307 
308 	if (p->p_pid == 1) {
309 		kprintf("init died (signal %d, exit %d)\n",
310 		    WTERMSIG(rv), WEXITSTATUS(rv));
311 		panic("Going nowhere without my init!");
312 	}
313 	varsymset_clean(&p->p_varsymset);
314 	lockuninit(&p->p_varsymset.vx_lock);
315 
316 	/*
317 	 * Kill all lwps associated with the current process, return an
318 	 * error if we race another thread trying to do the same thing
319 	 * and lose the race.
320 	 */
321 	error = killalllwps(0);
322 	if (error) {
323 		lwp_exit(0, NULL);
324 		/* NOT REACHED */
325 	}
326 
327 	/* are we a task leader? */
328 	if (p == p->p_leader) {
329         	struct kill_args killArgs;
330 		killArgs.signum = SIGKILL;
331 		q = p->p_peers;
332 		while(q) {
333 			killArgs.pid = q->p_pid;
334 			/*
335 		         * The interface for kill is better
336 			 * than the internal signal
337 			 */
338 			sys_kill(&killArgs);
339 			q = q->p_peers;
340 		}
341 		while (p->p_peers)
342 			tsleep((caddr_t)p, 0, "exit1", 0);
343 	}
344 
345 #ifdef PGINPROF
346 	vmsizmon();
347 #endif
348 	STOPEVENT(p, S_EXIT, rv);
349 	p->p_flags |= P_POSTEXIT;	/* stop procfs stepping */
350 
351 	/*
352 	 * Check if any loadable modules need anything done at process exit.
353 	 * e.g. SYSV IPC stuff
354 	 * XXX what if one of these generates an error?
355 	 */
356 	p->p_xstat = rv;
357 
358 	/*
359 	 * XXX: imho, the eventhandler stuff is much cleaner than this.
360 	 *	Maybe we should move everything to use eventhandler.
361 	 */
362 	TAILQ_FOREACH(ep, &exit_list, next)
363 		(*ep->function)(td);
364 
365 	if (p->p_flags & P_PROFIL)
366 		stopprofclock(p);
367 
368 	SIGEMPTYSET(p->p_siglist);
369 	SIGEMPTYSET(lp->lwp_siglist);
370 	if (timevalisset(&p->p_realtimer.it_value))
371 		callout_stop_sync(&p->p_ithandle);
372 
373 	/*
374 	 * Reset any sigio structures pointing to us as a result of
375 	 * F_SETOWN with our pid.
376 	 */
377 	funsetownlst(&p->p_sigiolst);
378 
379 	/*
380 	 * Close open files and release open-file table.
381 	 * This may block!
382 	 */
383 	fdfree(p, NULL);
384 
385 	if (p->p_leader->p_peers) {
386 		q = p->p_leader;
387 		while(q->p_peers != p)
388 			q = q->p_peers;
389 		q->p_peers = p->p_peers;
390 		wakeup((caddr_t)p->p_leader);
391 	}
392 
393 	/*
394 	 * XXX Shutdown SYSV semaphores
395 	 */
396 	semexit(p);
397 
398 	/* The next two chunks should probably be moved to vmspace_exit. */
399 	vm = p->p_vmspace;
400 
401 	/*
402 	 * Clean up data related to virtual kernel operation.  Clean up
403 	 * any vkernel context related to the current lwp now so we can
404 	 * destroy p_vkernel.
405 	 */
406 	if (p->p_vkernel) {
407 		vkernel_lwp_exit(lp);
408 		vkernel_exit(p);
409 	}
410 
411 	/*
412 	 * Release the user portion of address space.  The exitbump prevents
413 	 * the vmspace from being completely eradicated (using holdcnt).
414 	 * This releases references to vnodes, which could cause I/O if the
415 	 * file has been unlinked.  We need to do this early enough that
416 	 * we can still sleep.
417 	 *
418 	 * We can't free the entire vmspace as the kernel stack may be mapped
419 	 * within that space also.
420 	 *
421 	 * Processes sharing the same vmspace may exit in one order, and
422 	 * get cleaned up by vmspace_exit() in a different order.  The
423 	 * last exiting process to reach this point releases as much of
424 	 * the environment as it can, and the last process cleaned up
425 	 * by vmspace_exit() (which decrements exitingcnt) cleans up the
426 	 * remainder.
427 	 *
428 	 * NOTE: Releasing p_token around this call is helpful if the
429 	 *	 vmspace had a huge RSS.  Otherwise some other process
430 	 *	 trying to do an allproc or other scan (like 'ps') may
431 	 *	 stall for a long time.
432 	 */
433 	lwkt_reltoken(&p->p_token);
434 	vmspace_relexit(vm);
435 	lwkt_gettoken(&p->p_token);
436 
437 	if (SESS_LEADER(p)) {
438 		struct session *sp = p->p_session;
439 
440 		if (sp->s_ttyvp) {
441 			/*
442 			 * We are the controlling process.  Signal the
443 			 * foreground process group, drain the controlling
444 			 * terminal, and revoke access to the controlling
445 			 * terminal.
446 			 *
447 			 * NOTE: while waiting for the process group to exit
448 			 * it is possible that one of the processes in the
449 			 * group will revoke the tty, so the ttyclosesession()
450 			 * function will re-check sp->s_ttyvp.
451 			 */
452 			if (sp->s_ttyp && (sp->s_ttyp->t_session == sp)) {
453 				if (sp->s_ttyp->t_pgrp)
454 					pgsignal(sp->s_ttyp->t_pgrp, SIGHUP, 1);
455 				ttywait(sp->s_ttyp);
456 				ttyclosesession(sp, 1); /* also revoke */
457 			}
458 			/*
459 			 * Release the tty.  If someone has it open via
460 			 * /dev/tty then close it (since they no longer can
461 			 * once we've NULL'd it out).
462 			 */
463 			ttyclosesession(sp, 0);
464 
465 			/*
466 			 * s_ttyp is not zero'd; we use this to indicate
467 			 * that the session once had a controlling terminal.
468 			 * (for logging and informational purposes)
469 			 */
470 		}
471 		sp->s_leader = NULL;
472 	}
473 	fixjobc(p, p->p_pgrp, 0);
474 	(void)acct_process(p);
475 #ifdef KTRACE
476 	/*
477 	 * release trace file
478 	 */
479 	if (p->p_tracenode)
480 		ktrdestroy(&p->p_tracenode);
481 	p->p_traceflag = 0;
482 #endif
483 	/*
484 	 * Release reference to text vnode
485 	 */
486 	if ((vtmp = p->p_textvp) != NULL) {
487 		p->p_textvp = NULL;
488 		vrele(vtmp);
489 	}
490 
491 	/* Release namecache handle to text file */
492 	if (p->p_textnch.ncp)
493 		cache_drop(&p->p_textnch);
494 
495 	/*
496 	 * We have to handle PPWAIT here or proc_move_allproc_zombie()
497 	 * will block on the PHOLD() the parent is doing.
498 	 *
499 	 * We are using the flag as an interlock so an atomic op is
500 	 * necessary to synchronize with the parent's cpu.
501 	 */
502 	if (p->p_flags & P_PPWAIT) {
503 		if (p->p_pptr && p->p_pptr->p_upmap)
504 			atomic_add_int(&p->p_pptr->p_upmap->invfork, -1);
505 		atomic_clear_int(&p->p_flags, P_PPWAIT);
506 		wakeup(p->p_pptr);
507 	}
508 
509 	/*
510 	 * Move the process to the zombie list.  This will block
511 	 * until the process p_lock count reaches 0.  The process will
512 	 * not be reaped until TDF_EXITING is set by cpu_thread_exit(),
513 	 * which is called from cpu_proc_exit().
514 	 *
515 	 * Interlock against waiters using p_waitgen.  We increment
516 	 * p_waitgen after completing the move of our process to the
517 	 * zombie list.
518 	 *
519 	 * WARNING: pp becomes stale when we block, clear it now as a
520 	 *	    reminder.
521 	 */
522 	proc_move_allproc_zombie(p);
523 	pp = p->p_pptr;
524 	atomic_add_long(&pp->p_waitgen, 1);
525 	pp = NULL;
526 
527 	/*
528 	 * release controlled reaper for exit if we own it and return the
529 	 * remaining reaper (the one for us), which we will drop after we
530 	 * are done.
531 	 */
532 	reap = reaper_exit(p);
533 
534 	/*
535 	 * Reparent all of this process's children to the init process or
536 	 * to the designated reaper.  We must hold the reaper's p_token in
537 	 * order to safely mess with p_children.
538 	 *
539 	 * We already hold p->p_token (to remove the children from our list).
540 	 */
541 	reproc = NULL;
542 	q = LIST_FIRST(&p->p_children);
543 	if (q) {
544 		reproc = reaper_get(reap);
545 		lwkt_gettoken(&reproc->p_token);
546 		while ((q = LIST_FIRST(&p->p_children)) != NULL) {
547 			PHOLD(q);
548 			lwkt_gettoken(&q->p_token);
549 			if (q != LIST_FIRST(&p->p_children)) {
550 				lwkt_reltoken(&q->p_token);
551 				PRELE(q);
552 				continue;
553 			}
554 			LIST_REMOVE(q, p_sibling);
555 			LIST_INSERT_HEAD(&reproc->p_children, q, p_sibling);
556 			q->p_pptr = reproc;
557 			q->p_ppid = reproc->p_pid;
558 			q->p_sigparent = SIGCHLD;
559 
560 			/*
561 			 * Traced processes are killed
562 			 * since their existence means someone is screwing up.
563 			 */
564 			if (q->p_flags & P_TRACED) {
565 				q->p_flags &= ~P_TRACED;
566 				ksignal(q, SIGKILL);
567 			}
568 			lwkt_reltoken(&q->p_token);
569 			PRELE(q);
570 		}
571 		lwkt_reltoken(&reproc->p_token);
572 		wakeup(reproc);
573 	}
574 
575 	/*
576 	 * Save exit status and final rusage info.  We no longer add
577 	 * child rusage info into self times, wait4() and kern_wait()
578 	 * handles it in order to properly support wait6().
579 	 */
580 	calcru_proc(p, &p->p_ru);
581 	/*ruadd(&p->p_ru, &p->p_cru); REMOVED */
582 
583 	/*
584 	 * notify interested parties of our demise.
585 	 */
586 	KNOTE(&p->p_klist, NOTE_EXIT);
587 
588 	/*
589 	 * Notify parent that we're gone.  If parent has the PS_NOCLDWAIT
590 	 * flag set, or if the handler is set to SIG_IGN, notify the reaper
591 	 * instead (it will handle this situation).
592 	 *
593 	 * NOTE: The reaper can still be the parent process.
594 	 *
595 	 * (must reload pp)
596 	 */
597 	if (p->p_pptr->p_sigacts->ps_flag & (PS_NOCLDWAIT | PS_CLDSIGIGN)) {
598 		if (reproc == NULL)
599 			reproc = reaper_get(reap);
600 		proc_reparent(p, reproc);
601 	}
602 	if (reproc)
603 		PRELE(reproc);
604 	if (reap)
605 		reaper_drop(reap);
606 
607 	/*
608 	 * Signal (possibly new) parent.
609 	 */
610 	pp = p->p_pptr;
611 	PHOLD(pp);
612 	if (p->p_sigparent && pp != initproc) {
613 		int sig = p->p_sigparent;
614 
615 		if (sig != SIGUSR1 && sig != SIGCHLD)
616 			sig = SIGCHLD;
617 	        ksignal(pp, sig);
618 	} else {
619 	        ksignal(pp, SIGCHLD);
620 	}
621 	p->p_flags &= ~P_TRACED;
622 	PRELE(pp);
623 
624 	/*
625 	 * cpu_exit is responsible for clearing curproc, since
626 	 * it is heavily integrated with the thread/switching sequence.
627 	 *
628 	 * Other substructures are freed from wait().
629 	 */
630 	if (p->p_limit) {
631 		struct plimit *rlimit;
632 
633 		rlimit = p->p_limit;
634 		p->p_limit = NULL;
635 		plimit_free(rlimit);
636 	}
637 
638 	/*
639 	 * Finally, call machine-dependent code to release as many of the
640 	 * lwp's resources as we can and halt execution of this thread.
641 	 *
642 	 * pp is a wild pointer now but still the correct wakeup() target.
643 	 * lwp_exit() only uses it to send the wakeup() signal to the likely
644 	 * parent.  Any reparenting race that occurs will get a signal
645 	 * automatically and not be an issue.
646 	 */
647 	lwp_exit(1, pp);
648 }
649 
650 /*
651  * Eventually called by every exiting LWP
652  *
653  * p->p_token must be held.  mplock may be held and will be released.
654  */
655 void
656 lwp_exit(int masterexit, void *waddr)
657 {
658 	struct thread *td = curthread;
659 	struct lwp *lp = td->td_lwp;
660 	struct proc *p = lp->lwp_proc;
661 	int dowake = 0;
662 
663 	/*
664 	 * Release the current user process designation on the process so
665 	 * the userland scheduler can work in someone else.
666 	 */
667 	p->p_usched->release_curproc(lp);
668 
669 	/*
670 	 * lwp_exit() may be called without setting LWP_MP_WEXIT, so
671 	 * make sure it is set here.
672 	 */
673 	ASSERT_LWKT_TOKEN_HELD(&p->p_token);
674 	atomic_set_int(&lp->lwp_mpflags, LWP_MP_WEXIT);
675 
676 	/*
677 	 * Clean up any virtualization
678 	 */
679 	if (lp->lwp_vkernel)
680 		vkernel_lwp_exit(lp);
681 
682 	if (td->td_vmm)
683 		vmm_vmdestroy();
684 
685 	/*
686 	 * Clean up select/poll support
687 	 */
688 	kqueue_terminate(&lp->lwp_kqueue);
689 
690 	/*
691 	 * Clean up any syscall-cached ucred or rlimit.
692 	 */
693 	if (td->td_ucred) {
694 		crfree(td->td_ucred);
695 		td->td_ucred = NULL;
696 	}
697 	if (td->td_limit) {
698 		struct plimit *rlimit;
699 
700 		rlimit = td->td_limit;
701 		td->td_limit = NULL;
702 		plimit_free(rlimit);
703         }
704 
705 	/*
706 	 * Cleanup any cached descriptors for this thread
707 	 */
708 	if (p->p_fd)
709 		fexitcache(td);
710 
711 	/*
712 	 * Nobody actually wakes us when the lock
713 	 * count reaches zero, so just wait one tick.
714 	 */
715 	while (lp->lwp_lock > 0)
716 		tsleep(lp, 0, "lwpexit", 1);
717 
718 	/* Hand down resource usage to our proc */
719 	ruadd(&p->p_ru, &lp->lwp_ru);
720 
721 	/*
722 	 * If we don't hold the process until the LWP is reaped wait*()
723 	 * may try to dispose of its vmspace before all the LWPs have
724 	 * actually terminated.
725 	 */
726 	PHOLD(p);
727 
728 	/*
729 	 * Do any remaining work that might block on us.  We should be
730 	 * coded such that further blocking is ok after decrementing
731 	 * p_nthreads but don't take the chance.
732 	 */
733 	dsched_exit_thread(td);
734 	biosched_done(curthread);
735 
736 	/*
737 	 * We have to use the reaper for all the LWPs except the one doing
738 	 * the master exit.  The LWP doing the master exit can just be
739 	 * left on p_lwps and the process reaper will deal with it
740 	 * synchronously, which is much faster.
741 	 *
742 	 * Wakeup anyone waiting on p_nthreads to drop to 1 or 0.
743 	 *
744 	 * The process is left held until the reaper calls lwp_dispose() on
745 	 * the lp (after calling lwp_wait()).
746 	 */
747 	if (masterexit == 0) {
748 		int cpu = mycpuid;
749 
750 		lwp_rb_tree_RB_REMOVE(&p->p_lwp_tree, lp);
751 		--p->p_nthreads;
752 		if ((p->p_flags & P_MAYBETHREADED) && p->p_nthreads <= 1)
753 			dowake = 1;
754 		lwkt_gettoken(&deadlwp_token[cpu]);
755 		LIST_INSERT_HEAD(&deadlwp_list[cpu], lp, u.lwp_reap_entry);
756 		taskqueue_enqueue(taskqueue_thread[cpu], deadlwp_task[cpu]);
757 		lwkt_reltoken(&deadlwp_token[cpu]);
758 	} else {
759 		--p->p_nthreads;
760 		if ((p->p_flags & P_MAYBETHREADED) && p->p_nthreads <= 1)
761 			dowake = 1;
762 	}
763 
764 	/*
765 	 * We no longer need p_token.
766 	 *
767 	 * Tell the userland scheduler that we are going away
768 	 */
769 	lwkt_reltoken(&p->p_token);
770 	p->p_usched->heuristic_exiting(lp, p);
771 
772 	/*
773 	 * Issue late wakeups after releasing our token to give us a chance
774 	 * to deschedule and switch away before another cpu in a wait*()
775 	 * reaps us.  This is done as late as possible to reduce contention.
776 	 */
777 	if (dowake)
778 		wakeup(&p->p_nthreads);
779 	if (waddr)
780 		wakeup(waddr);
781 
782 	cpu_lwp_exit();
783 }
784 
785 /*
786  * Wait until a lwp is completely dead.  The final interlock in this drama
787  * is when TDF_EXITING is set in cpu_thread_exit() just before the final
788  * switchout.
789  *
790  * At the point TDF_EXITING is set a complete exit is accomplished when
791  * TDF_RUNNING and TDF_PREEMPT_LOCK are both clear.  td_mpflags has two
792  * post-switch interlock flags that can be used to wait for the TDF_
793  * flags to clear.
794  *
795  * Returns non-zero on success, and zero if the caller needs to retry
796  * the lwp_wait().
797  */
798 static int
799 lwp_wait(struct lwp *lp)
800 {
801 	struct thread *td = lp->lwp_thread;
802 	u_int mpflags;
803 
804 	KKASSERT(lwkt_preempted_proc() != lp);
805 
806 	/*
807 	 * This bit of code uses the thread destruction interlock
808 	 * managed by lwkt_switch_return() to wait for the lwp's
809 	 * thread to completely disengage.
810 	 *
811 	 * It is possible for us to race another cpu core so we
812 	 * have to do this correctly.
813 	 */
814 	for (;;) {
815 		mpflags = td->td_mpflags;
816 		cpu_ccfence();
817 		if (mpflags & TDF_MP_EXITSIG)
818 			break;
819 		tsleep_interlock(td, 0);
820 		if (atomic_cmpset_int(&td->td_mpflags, mpflags,
821 				      mpflags | TDF_MP_EXITWAIT)) {
822 			tsleep(td, PINTERLOCKED, "lwpxt", 0);
823 		}
824 	}
825 
826 	/*
827 	 * We've already waited for the core exit but there can still
828 	 * be other refs from e.g. process scans and such.
829 	 */
830 	if (lp->lwp_lock > 0) {
831 		tsleep(lp, 0, "lwpwait1", 1);
832 		return(0);
833 	}
834 	if (td->td_refs) {
835 		tsleep(td, 0, "lwpwait2", 1);
836 		return(0);
837 	}
838 
839 	/*
840 	 * Now that we have the thread destruction interlock these flags
841 	 * really should already be cleaned up, keep a check for safety.
842 	 *
843 	 * We can't rip its stack out from under it until TDF_EXITING is
844 	 * set and both TDF_RUNNING and TDF_PREEMPT_LOCK are clear.
845 	 * TDF_PREEMPT_LOCK must be checked because TDF_RUNNING
846 	 * will be cleared temporarily if a thread gets preempted.
847 	 */
848 	while ((td->td_flags & (TDF_RUNNING |
849 				TDF_RUNQ |
850 			        TDF_PREEMPT_LOCK |
851 			        TDF_EXITING)) != TDF_EXITING) {
852 		tsleep(lp, 0, "lwpwait3", 1);
853 		return (0);
854 	}
855 
856 	KASSERT((td->td_flags & (TDF_RUNQ|TDF_TSLEEPQ)) == 0,
857 		("lwp_wait: td %p (%s) still on run or sleep queue",
858 		td, td->td_comm));
859 	return (1);
860 }
861 
862 /*
863  * Release the resources associated with a lwp.
864  * The lwp must be completely dead.
865  */
866 void
867 lwp_dispose(struct lwp *lp)
868 {
869 	struct thread *td = lp->lwp_thread;
870 
871 	KKASSERT(lwkt_preempted_proc() != lp);
872 	KKASSERT(lp->lwp_lock == 0);
873 	KKASSERT(td->td_refs == 0);
874 	KKASSERT((td->td_flags & (TDF_RUNNING |
875 				  TDF_RUNQ |
876 				  TDF_PREEMPT_LOCK |
877 				  TDF_EXITING)) == TDF_EXITING);
878 
879 	PRELE(lp->lwp_proc);
880 	lp->lwp_proc = NULL;
881 	if (td != NULL) {
882 		td->td_proc = NULL;
883 		td->td_lwp = NULL;
884 		lp->lwp_thread = NULL;
885 		lwkt_free_thread(td);
886 	}
887 	kfree(lp, M_LWP);
888 }
889 
890 int
891 sys_wait4(struct wait_args *uap)
892 {
893 	struct __wrusage wrusage;
894 	int error;
895 	int status;
896 	int options;
897 	id_t id;
898 	idtype_t idtype;
899 
900 	options = uap->options | WEXITED | WTRAPPED;
901 	id = uap->pid;
902 
903 	if (id == WAIT_ANY) {
904 		idtype = P_ALL;
905 	} else if (id == WAIT_MYPGRP) {
906 		idtype = P_PGID;
907 		id = curproc->p_pgid;
908 	} else if (id < 0) {
909 		idtype = P_PGID;
910 		id = -id;
911 	} else {
912 		idtype = P_PID;
913 	}
914 
915 	error = kern_wait(idtype, id, &status, options, &wrusage,
916 			  NULL, &uap->sysmsg_result);
917 
918 	if (error == 0 && uap->status)
919 		error = copyout(&status, uap->status, sizeof(*uap->status));
920 	if (error == 0 && uap->rusage) {
921 		ruadd(&wrusage.wru_self, &wrusage.wru_children);
922 		error = copyout(&wrusage.wru_self, uap->rusage, sizeof(*uap->rusage));
923 	}
924 	return (error);
925 }
926 
927 int
928 sys_wait6(struct wait6_args *uap)
929 {
930 	struct __wrusage wrusage;
931 	struct __siginfo info;
932 	struct __siginfo *infop;
933 	int error;
934 	int status;
935 	int options;
936 	id_t id;
937 	idtype_t idtype;
938 
939 	/*
940 	 * NOTE: wait6() requires WEXITED and WTRAPPED to be specified if
941 	 *	 desired.
942 	 */
943 	options = uap->options;
944 	idtype = uap->idtype;
945 	id = uap->id;
946 	infop = uap->info ? &info : NULL;
947 
948 	switch(idtype) {
949 	case P_PID:
950 	case P_PGID:
951 		if (id == WAIT_MYPGRP) {
952 			idtype = P_PGID;
953 			id = curproc->p_pgid;
954 		}
955 		break;
956 	default:
957 		/* let kern_wait deal with the remainder */
958 		break;
959 	}
960 
961 	error = kern_wait(idtype, id, &status, options,
962 			  &wrusage, infop, &uap->sysmsg_result);
963 
964 	if (error == 0 && uap->status)
965 		error = copyout(&status, uap->status, sizeof(*uap->status));
966 	if (error == 0 && uap->wrusage)
967 		error = copyout(&wrusage, uap->wrusage, sizeof(*uap->wrusage));
968 	if (error == 0 && uap->info)
969 		error = copyout(&info, uap->info, sizeof(*uap->info));
970 	return (error);
971 }
972 
973 /*
974  * kernel wait*() system call support
975  */
976 int
977 kern_wait(idtype_t idtype, id_t id, int *status, int options,
978 	  struct __wrusage *wrusage, struct __siginfo *info, int *res)
979 {
980 	struct thread *td = curthread;
981 	struct lwp *lp;
982 	struct proc *q = td->td_proc;
983 	struct proc *p, *t;
984 	struct ucred *cr;
985 	struct pargs *pa;
986 	struct sigacts *ps;
987 	int nfound, error;
988 	long waitgen;
989 
990 	/*
991 	 * Must not have extraneous options.  Must have at least one
992 	 * matchable option.
993 	 */
994 	if (options &~ (WUNTRACED|WNOHANG|WCONTINUED|WLINUXCLONE|WSTOPPED|
995 			WEXITED|WTRAPPED|WNOWAIT)) {
996 		return (EINVAL);
997 	}
998 	if ((options & (WEXITED | WUNTRACED | WCONTINUED | WTRAPPED)) == 0) {
999 		return (EINVAL);
1000 	}
1001 
1002 	/*
1003 	 * Protect the q->p_children list
1004 	 */
1005 	lwkt_gettoken(&q->p_token);
1006 loop:
1007 	/*
1008 	 * All sorts of things can change due to blocking so we have to loop
1009 	 * all the way back up here.
1010 	 *
1011 	 * The problem is that if a process group is stopped and the parent
1012 	 * is doing a wait*(..., WUNTRACED, ...), it will see the STOP
1013 	 * of the child and then stop itself when it tries to return from the
1014 	 * system call.  When the process group is resumed the parent will
1015 	 * then get the STOP status even though the child has now resumed
1016 	 * (a followup wait*() will get the CONT status).
1017 	 *
1018 	 * Previously the CONT would overwrite the STOP because the tstop
1019 	 * was handled within tsleep(), and the parent would only see
1020 	 * the CONT when both are stopped and continued together.  This little
1021 	 * two-line hack restores this effect.
1022 	 */
1023 	if (STOPLWP(q, td->td_lwp))
1024             tstop();
1025 
1026 	nfound = 0;
1027 
1028 	/*
1029 	 * Loop on children.
1030 	 *
1031 	 * NOTE: We don't want to break q's p_token in the loop for the
1032 	 *	 case where no children are found or we risk breaking the
1033 	 *	 interlock between child and parent.
1034 	 */
1035 	waitgen = atomic_fetchadd_long(&q->p_waitgen, 0x80000000);
1036 	LIST_FOREACH(p, &q->p_children, p_sibling) {
1037 		/*
1038 		 * Filter, (p) will be held on fall-through.  Try to optimize
1039 		 * this to avoid the atomic op until we are pretty sure we
1040 		 * want this process.
1041 		 */
1042 		switch(idtype) {
1043 		case P_ALL:
1044 			PHOLD(p);
1045 			break;
1046 		case P_PID:
1047 			if (p->p_pid != (pid_t)id)
1048 				continue;
1049 			PHOLD(p);
1050 			break;
1051 		case P_PGID:
1052 			if (p->p_pgid != (pid_t)id)
1053 				continue;
1054 			PHOLD(p);
1055 			break;
1056 		case P_SID:
1057 			PHOLD(p);
1058 			if (p->p_session && p->p_session->s_sid != (pid_t)id) {
1059 				PRELE(p);
1060 				continue;
1061 			}
1062 			break;
1063 		case P_UID:
1064 			PHOLD(p);
1065 			if (p->p_ucred->cr_uid != (uid_t)id) {
1066 				PRELE(p);
1067 				continue;
1068 			}
1069 			break;
1070 		case P_GID:
1071 			PHOLD(p);
1072 			if (p->p_ucred->cr_gid != (gid_t)id) {
1073 				PRELE(p);
1074 				continue;
1075 			}
1076 			break;
1077 		case P_JAILID:
1078 			PHOLD(p);
1079 			if (p->p_ucred->cr_prison &&
1080 			    p->p_ucred->cr_prison->pr_id != (int)id) {
1081 				PRELE(p);
1082 				continue;
1083 			}
1084 			break;
1085 		default:
1086 			/* unsupported filter */
1087 			continue;
1088 		}
1089 		/* (p) is held at this point */
1090 
1091 		/*
1092 		 * This special case handles a kthread spawned by linux_clone
1093 		 * (see linux_misc.c).  The linux_wait4 and linux_waitpid
1094 		 * functions need to be able to distinguish between waiting
1095 		 * on a process and waiting on a thread.  It is a thread if
1096 		 * p_sigparent is not SIGCHLD, and the WLINUXCLONE option
1097 		 * signifies we want to wait for threads and not processes.
1098 		 */
1099 		if ((p->p_sigparent != SIGCHLD) ^
1100 		    ((options & WLINUXCLONE) != 0)) {
1101 			PRELE(p);
1102 			continue;
1103 		}
1104 
1105 		nfound++;
1106 		if (p->p_stat == SZOMB && (options & WEXITED)) {
1107 			/*
1108 			 * We may go into SZOMB with threads still present.
1109 			 * We must wait for them to exit before we can reap
1110 			 * the master thread, otherwise we may race reaping
1111 			 * non-master threads.
1112 			 *
1113 			 * Only this routine can remove a process from
1114 			 * the zombie list and destroy it.
1115 			 */
1116 			if (PHOLDZOMB(p)) {
1117 				PRELE(p);
1118 				goto loop;
1119 			}
1120 			lwkt_gettoken(&p->p_token);
1121 			if (p->p_pptr != q) {
1122 				lwkt_reltoken(&p->p_token);
1123 				PRELE(p);
1124 				PRELEZOMB(p);
1125 				goto loop;
1126 			}
1127 			while (p->p_nthreads > 0) {
1128 				tsleep(&p->p_nthreads, 0, "lwpzomb", hz);
1129 			}
1130 
1131 			/*
1132 			 * Reap any LWPs left in p->p_lwps.  This is usually
1133 			 * just the last LWP.  This must be done before
1134 			 * we loop on p_lock since the lwps hold a ref on
1135 			 * it as a vmspace interlock.
1136 			 *
1137 			 * Once that is accomplished p_nthreads had better
1138 			 * be zero.
1139 			 */
1140 			while ((lp = RB_ROOT(&p->p_lwp_tree)) != NULL) {
1141 				/*
1142 				 * Make sure no one is using this lwp, before
1143 				 * it is removed from the tree.  If we didn't
1144 				 * wait it here, lwp tree iteration with
1145 				 * blocking operation would be broken.
1146 				 */
1147 				while (lp->lwp_lock > 0)
1148 					tsleep(lp, 0, "zomblwp", 1);
1149 				lwp_rb_tree_RB_REMOVE(&p->p_lwp_tree, lp);
1150 				reaplwp(lp);
1151 			}
1152 			KKASSERT(p->p_nthreads == 0);
1153 
1154 			/*
1155 			 * Don't do anything really bad until all references
1156 			 * to the process go away.  This may include other
1157 			 * LWPs which are still in the process of being
1158 			 * reaped.  We can't just pull the rug out from under
1159 			 * them because they may still be using the VM space.
1160 			 *
1161 			 * Certain kernel facilities such as /proc will also
1162 			 * put a hold on the process for short periods of
1163 			 * time.
1164 			 */
1165 			PRELE(p);		/* from top of loop */
1166 			PSTALL(p, "reap3", 1);	/* 1 ref (for PZOMBHOLD) */
1167 
1168 			/* Take care of our return values. */
1169 			*res = p->p_pid;
1170 
1171 			*status = p->p_xstat;
1172 			wrusage->wru_self = p->p_ru;
1173 			wrusage->wru_children = p->p_cru;
1174 
1175 			if (info) {
1176 				bzero(info, sizeof(*info));
1177 				info->si_errno = 0;
1178 				info->si_signo = SIGCHLD;
1179 				if (p->p_xstat)
1180 					info->si_code = CLD_KILLED;
1181 				else
1182 					info->si_code = CLD_EXITED;
1183 				info->si_status = p->p_xstat;
1184 				info->si_pid = p->p_pid;
1185 				info->si_uid = p->p_ucred->cr_uid;
1186 			}
1187 
1188 			/*
1189 			 * WNOWAIT shortcuts to done here, leaving the
1190 			 * child on the zombie list.
1191 			 */
1192 			if (options & WNOWAIT) {
1193 				lwkt_reltoken(&p->p_token);
1194 				PRELEZOMB(p);
1195 				error = 0;
1196 				goto done;
1197 			}
1198 
1199 			/*
1200 			 * If we got the child via a ptrace 'attach',
1201 			 * we need to give it back to the old parent.
1202 			 */
1203 			if (p->p_oppid && (t = pfind(p->p_oppid)) != NULL) {
1204 				p->p_oppid = 0;
1205 				proc_reparent(p, t);
1206 				ksignal(t, SIGCHLD);
1207 				wakeup((caddr_t)t);
1208 				PRELE(t);
1209 				lwkt_reltoken(&p->p_token);
1210 				PRELEZOMB(p);
1211 				error = 0;
1212 				goto done;
1213 			}
1214 
1215 			/*
1216 			 * Unlink the proc from its process group so that
1217 			 * the following operations won't lead to an
1218 			 * inconsistent state for processes running down
1219 			 * the zombie list.
1220 			 */
1221 			proc_remove_zombie(p);
1222 			proc_userunmap(p);
1223 			lwkt_reltoken(&p->p_token);
1224 			leavepgrp(p);
1225 
1226 			p->p_xstat = 0;
1227 			ruadd(&q->p_cru, &p->p_ru);
1228 			ruadd(&q->p_cru, &p->p_cru);
1229 
1230 			/*
1231 			 * Decrement the count of procs running with this uid.
1232 			 */
1233 			chgproccnt(p->p_ucred->cr_ruidinfo, -1, 0);
1234 
1235 			/*
1236 			 * Free up credentials.  p_spin is required to
1237 			 * avoid races against allproc scans.
1238 			 */
1239 			spin_lock(&p->p_spin);
1240 			cr = p->p_ucred;
1241 			p->p_ucred = NULL;
1242 			spin_unlock(&p->p_spin);
1243 			crfree(cr);
1244 
1245 			/*
1246 			 * Remove unused arguments
1247 			 */
1248 			pa = p->p_args;
1249 			p->p_args = NULL;
1250 			if (pa && refcount_release(&pa->ar_ref)) {
1251 				kfree(pa, M_PARGS);
1252 				pa = NULL;
1253 			}
1254 
1255 			ps = p->p_sigacts;
1256 			p->p_sigacts = NULL;
1257 			if (ps && refcount_release(&ps->ps_refcnt)) {
1258 				kfree(ps, M_SUBPROC);
1259 				ps = NULL;
1260 			}
1261 
1262 			/*
1263 			 * Our exitingcount was incremented when the process
1264 			 * became a zombie, now that the process has been
1265 			 * removed from (almost) all lists we should be able
1266 			 * to safely destroy its vmspace.  Wait for any current
1267 			 * holders to go away (so the vmspace remains stable),
1268 			 * then scrap it.
1269 			 *
1270 			 * NOTE: Releasing the parent process (q) p_token
1271 			 *	 across the vmspace_exitfree() call is
1272 			 *	 important here to reduce stalls on
1273 			 *	 interactions with (q) (such as
1274 			 *	 fork/exec/wait or 'ps').
1275 			 */
1276 			PSTALL(p, "reap4", 1);
1277 			lwkt_reltoken(&q->p_token);
1278 			vmspace_exitfree(p);
1279 			lwkt_gettoken(&q->p_token);
1280 			PSTALL(p, "reap5", 1);
1281 
1282 			/*
1283 			 * NOTE: We have to officially release ZOMB in order
1284 			 *	 to ensure that a racing thread in kern_wait()
1285 			 *	 which blocked on ZOMB is woken up.
1286 			 */
1287 			PRELEZOMB(p);
1288 			kfree(p->p_uidpcpu, M_SUBPROC);
1289 			kfree(p, M_PROC);
1290 			atomic_add_int(&nprocs, -1);
1291 			error = 0;
1292 			goto done;
1293 		}
1294 
1295 		/*
1296 		 * Process has not yet exited
1297 		 */
1298 		if ((p->p_stat == SSTOP || p->p_stat == SCORE) &&
1299 		    (p->p_flags & P_WAITED) == 0 &&
1300 		    (((p->p_flags & P_TRACED) && (options & WTRAPPED)) ||
1301 		     (options & WSTOPPED))) {
1302 			lwkt_gettoken(&p->p_token);
1303 			if (p->p_pptr != q) {
1304 				lwkt_reltoken(&p->p_token);
1305 				PRELE(p);
1306 				goto loop;
1307 			}
1308 			if ((p->p_stat != SSTOP && p->p_stat != SCORE) ||
1309 			    (p->p_flags & P_WAITED) != 0 ||
1310 			    ((p->p_flags & P_TRACED) == 0 &&
1311 			     (options & WUNTRACED) == 0)) {
1312 				lwkt_reltoken(&p->p_token);
1313 				PRELE(p);
1314 				goto loop;
1315 			}
1316 
1317 			/*
1318 			 * Don't set P_WAITED if WNOWAIT specified, leaving
1319 			 * the process in a waitable state.
1320 			 */
1321 			if ((options & WNOWAIT) == 0)
1322 				p->p_flags |= P_WAITED;
1323 
1324 			*res = p->p_pid;
1325 			*status = W_STOPCODE(p->p_xstat);
1326 			/* Zero rusage so we get something consistent. */
1327 			bzero(wrusage, sizeof(*wrusage));
1328 			error = 0;
1329 			if (info) {
1330 				bzero(info, sizeof(*info));
1331 				if (p->p_flags & P_TRACED)
1332 					info->si_code = CLD_TRAPPED;
1333 				else
1334 					info->si_code = CLD_STOPPED;
1335 				info->si_status = p->p_xstat;
1336 			}
1337 			lwkt_reltoken(&p->p_token);
1338 			PRELE(p);
1339 			goto done;
1340 		}
1341 		if ((options & WCONTINUED) && (p->p_flags & P_CONTINUED)) {
1342 			lwkt_gettoken(&p->p_token);
1343 			if (p->p_pptr != q) {
1344 				lwkt_reltoken(&p->p_token);
1345 				PRELE(p);
1346 				goto loop;
1347 			}
1348 			if ((p->p_flags & P_CONTINUED) == 0) {
1349 				lwkt_reltoken(&p->p_token);
1350 				PRELE(p);
1351 				goto loop;
1352 			}
1353 
1354 			*res = p->p_pid;
1355 
1356 			/*
1357 			 * Don't set P_WAITED if WNOWAIT specified, leaving
1358 			 * the process in a waitable state.
1359 			 */
1360 			if ((options & WNOWAIT) == 0)
1361 				p->p_flags &= ~P_CONTINUED;
1362 
1363 			*status = SIGCONT;
1364 			error = 0;
1365 			if (info) {
1366 				bzero(info, sizeof(*info));
1367 				info->si_code = CLD_CONTINUED;
1368 				info->si_status = p->p_xstat;
1369 			}
1370 			lwkt_reltoken(&p->p_token);
1371 			PRELE(p);
1372 			goto done;
1373 		}
1374 		PRELE(p);
1375 	}
1376 	if (nfound == 0) {
1377 		error = ECHILD;
1378 		goto done;
1379 	}
1380 	if (options & WNOHANG) {
1381 		*res = 0;
1382 		error = 0;
1383 		goto done;
1384 	}
1385 
1386 	/*
1387 	 * Wait for signal - interlocked using q->p_waitgen.
1388 	 */
1389 	error = 0;
1390 	while ((waitgen & 0x7FFFFFFF) == (q->p_waitgen & 0x7FFFFFFF)) {
1391 		tsleep_interlock(q, PCATCH);
1392 		waitgen = atomic_fetchadd_long(&q->p_waitgen, 0x80000000);
1393 		if ((waitgen & 0x7FFFFFFF) == (q->p_waitgen & 0x7FFFFFFF)) {
1394 			error = tsleep(q, PCATCH | PINTERLOCKED, "wait", 0);
1395 			break;
1396 		}
1397 	}
1398 	if (error) {
1399 done:
1400 		lwkt_reltoken(&q->p_token);
1401 		return (error);
1402 	}
1403 	goto loop;
1404 }
1405 
1406 /*
1407  * Change child's parent process to parent.
1408  *
1409  * p_children/p_sibling requires the parent's token, and
1410  * changing pptr requires the child's token, so we have to
1411  * get three tokens to do this operation.  We also need to
1412  * hold pointers that might get ripped out from under us to
1413  * preserve structural integrity.
1414  *
1415  * It is possible to race another reparent or disconnect or other
1416  * similar operation.  We must retry when this situation occurs.
1417  * Once we successfully reparent the process we no longer care
1418  * about any races.
1419  */
1420 void
1421 proc_reparent(struct proc *child, struct proc *parent)
1422 {
1423 	struct proc *opp;
1424 
1425 	PHOLD(parent);
1426 	while ((opp = child->p_pptr) != parent) {
1427 		PHOLD(opp);
1428 		lwkt_gettoken(&opp->p_token);
1429 		lwkt_gettoken(&child->p_token);
1430 		lwkt_gettoken(&parent->p_token);
1431 		if (child->p_pptr != opp) {
1432 			lwkt_reltoken(&parent->p_token);
1433 			lwkt_reltoken(&child->p_token);
1434 			lwkt_reltoken(&opp->p_token);
1435 			PRELE(opp);
1436 			continue;
1437 		}
1438 		LIST_REMOVE(child, p_sibling);
1439 		LIST_INSERT_HEAD(&parent->p_children, child, p_sibling);
1440 		child->p_pptr = parent;
1441 		child->p_ppid = parent->p_pid;
1442 		lwkt_reltoken(&parent->p_token);
1443 		lwkt_reltoken(&child->p_token);
1444 		lwkt_reltoken(&opp->p_token);
1445 		if (LIST_EMPTY(&opp->p_children))
1446 			wakeup(opp);
1447 		PRELE(opp);
1448 		break;
1449 	}
1450 	PRELE(parent);
1451 }
1452 
1453 /*
1454  * The next two functions are to handle adding/deleting items on the
1455  * exit callout list
1456  *
1457  * at_exit():
1458  * Take the arguments given and put them onto the exit callout list,
1459  * However first make sure that it's not already there.
1460  * returns 0 on success.
1461  */
1462 
1463 int
1464 at_exit(exitlist_fn function)
1465 {
1466 	struct exitlist *ep;
1467 
1468 #ifdef INVARIANTS
1469 	/* Be noisy if the programmer has lost track of things */
1470 	if (rm_at_exit(function))
1471 		kprintf("WARNING: exit callout entry (%p) already present\n",
1472 		    function);
1473 #endif
1474 	ep = kmalloc(sizeof(*ep), M_ATEXIT, M_NOWAIT);
1475 	if (ep == NULL)
1476 		return (ENOMEM);
1477 	ep->function = function;
1478 	TAILQ_INSERT_TAIL(&exit_list, ep, next);
1479 	return (0);
1480 }
1481 
1482 /*
1483  * Scan the exit callout list for the given item and remove it.
1484  * Returns the number of items removed (0 or 1)
1485  */
1486 int
1487 rm_at_exit(exitlist_fn function)
1488 {
1489 	struct exitlist *ep;
1490 
1491 	TAILQ_FOREACH(ep, &exit_list, next) {
1492 		if (ep->function == function) {
1493 			TAILQ_REMOVE(&exit_list, ep, next);
1494 			kfree(ep, M_ATEXIT);
1495 			return(1);
1496 		}
1497 	}
1498 	return (0);
1499 }
1500 
1501 /*
1502  * LWP reaper related code.
1503  */
1504 static void
1505 reaplwps(void *context, int dummy)
1506 {
1507 	struct lwplist *lwplist = context;
1508 	struct lwp *lp;
1509 	int cpu = mycpuid;
1510 
1511 	lwkt_gettoken(&deadlwp_token[cpu]);
1512 	while ((lp = LIST_FIRST(lwplist))) {
1513 		LIST_REMOVE(lp, u.lwp_reap_entry);
1514 		reaplwp(lp);
1515 	}
1516 	lwkt_reltoken(&deadlwp_token[cpu]);
1517 }
1518 
1519 static void
1520 reaplwp(struct lwp *lp)
1521 {
1522 	while (lwp_wait(lp) == 0)
1523 		;
1524 	lwp_dispose(lp);
1525 }
1526 
1527 static void
1528 deadlwp_init(void)
1529 {
1530 	int cpu;
1531 
1532 	for (cpu = 0; cpu < ncpus; cpu++) {
1533 		lwkt_token_init(&deadlwp_token[cpu], "deadlwpl");
1534 		LIST_INIT(&deadlwp_list[cpu]);
1535 		deadlwp_task[cpu] = kmalloc(sizeof(*deadlwp_task[cpu]),
1536 					    M_DEVBUF, M_WAITOK);
1537 		TASK_INIT(deadlwp_task[cpu], 0, reaplwps, &deadlwp_list[cpu]);
1538 	}
1539 }
1540 
1541 SYSINIT(deadlwpinit, SI_SUB_CONFIGURE, SI_ORDER_ANY, deadlwp_init, NULL);
1542