xref: /dragonfly/sys/kern/kern_exit.c (revision 521a7b05)
1 /*
2  * Copyright (c) 1982, 1986, 1989, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by the University of
21  *	California, Berkeley and its contributors.
22  * 4. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *	@(#)kern_exit.c	8.7 (Berkeley) 2/12/94
39  * $FreeBSD: src/sys/kern/kern_exit.c,v 1.92.2.11 2003/01/13 22:51:16 dillon Exp $
40  * $DragonFly: src/sys/kern/kern_exit.c,v 1.80 2007/04/29 18:25:34 dillon Exp $
41  */
42 
43 #include "opt_compat.h"
44 #include "opt_ktrace.h"
45 
46 #include <sys/param.h>
47 #include <sys/systm.h>
48 #include <sys/sysproto.h>
49 #include <sys/kernel.h>
50 #include <sys/malloc.h>
51 #include <sys/proc.h>
52 #include <sys/ktrace.h>
53 #include <sys/pioctl.h>
54 #include <sys/tty.h>
55 #include <sys/wait.h>
56 #include <sys/vnode.h>
57 #include <sys/resourcevar.h>
58 #include <sys/signalvar.h>
59 #include <sys/taskqueue.h>
60 #include <sys/ptrace.h>
61 #include <sys/acct.h>		/* for acct_process() function prototype */
62 #include <sys/filedesc.h>
63 #include <sys/shm.h>
64 #include <sys/sem.h>
65 #include <sys/aio.h>
66 #include <sys/jail.h>
67 #include <sys/kern_syscall.h>
68 #include <sys/upcall.h>
69 #include <sys/caps.h>
70 #include <sys/unistd.h>
71 
72 #include <vm/vm.h>
73 #include <vm/vm_param.h>
74 #include <sys/lock.h>
75 #include <vm/pmap.h>
76 #include <vm/vm_map.h>
77 #include <vm/vm_zone.h>
78 #include <vm/vm_extern.h>
79 #include <sys/user.h>
80 
81 #include <sys/thread2.h>
82 #include <sys/sysref2.h>
83 
84 static void reaplwps(void *context, int dummy);
85 
86 static MALLOC_DEFINE(M_ATEXIT, "atexit", "atexit callback");
87 static MALLOC_DEFINE(M_ZOMBIE, "zombie", "zombie proc status");
88 
89 /*
90  * callout list for things to do at exit time
91  */
92 struct exitlist {
93 	exitlist_fn function;
94 	TAILQ_ENTRY(exitlist) next;
95 };
96 
97 TAILQ_HEAD(exit_list_head, exitlist);
98 static struct exit_list_head exit_list = TAILQ_HEAD_INITIALIZER(exit_list);
99 
100 /*
101  * LWP reaper data
102  */
103 struct task *deadlwp_task[MAXCPU];
104 struct lwplist deadlwp_list[MAXCPU];
105 
106 /*
107  * exit --
108  *	Death of process.
109  *
110  * SYS_EXIT_ARGS(int rval)
111  */
112 int
113 sys_exit(struct exit_args *uap)
114 {
115 	exit1(W_EXITCODE(uap->rval, 0));
116 	/* NOTREACHED */
117 }
118 
119 /*
120  * Extended exit --
121  *	Death of a lwp or process with optional bells and whistles.
122  */
123 int
124 sys_extexit(struct extexit_args *uap)
125 {
126 	int action, who;
127 	int error;
128 
129 	action = EXTEXIT_ACTION(uap->how);
130 	who = EXTEXIT_WHO(uap->how);
131 
132 	/* Check parameters before we might perform some action */
133 	switch (who) {
134 	case EXTEXIT_PROC:
135 	case EXTEXIT_LWP:
136 		break;
137 
138 	default:
139 		return (EINVAL);
140 	}
141 
142 	switch (action) {
143 	case EXTEXIT_SIMPLE:
144 		break;
145 
146 	case EXTEXIT_SETINT:
147 		error = copyout(&uap->status, uap->addr, sizeof(uap->status));
148 		if (error)
149 			return (error);
150 		break;
151 
152 	default:
153 		return (EINVAL);
154 	}
155 
156 	switch (who) {
157 	case EXTEXIT_LWP:
158 		/*
159 		 * Be sure only to perform a simple lwp exit if there is at
160 		 * least one more lwp in the proc, which will call exit1()
161 		 * later, otherwise the proc will be an UNDEAD and not even a
162 		 * SZOMB!
163 		 */
164 		if (curproc->p_nthreads > 1) {
165 			lwp_exit(0);
166 			/* NOT REACHED */
167 		}
168 		/* else last lwp in proc:  do the real thing */
169 		/* FALLTHROUGH */
170 
171 	default:	/* to help gcc */
172 	case EXTEXIT_PROC:
173 		exit1(W_EXITCODE(uap->status, 0));
174 		/* NOTREACHED */
175 	}
176 
177 	/* NOTREACHED */
178 }
179 
180 /*
181  * Kill all LWPs except the current one.  Do not try to signal
182  * LWPs which have exited on their own or have already been
183  * signaled.
184  */
185 void
186 killlwps(struct lwp *lp)
187 {
188 	struct proc *p = lp->lwp_proc;
189 	struct lwp *tlp;
190 
191 	/*
192 	 * Signal remaining LWPs, interlock with LWP_WEXIT.
193 	 */
194 	FOREACH_LWP_IN_PROC(tlp, p) {
195 		if ((tlp->lwp_flag & LWP_WEXIT) == 0) {
196 			tlp->lwp_flag |= LWP_WEXIT;
197 			lwp_signotify(tlp);
198 		}
199 	}
200 
201 	/*
202 	 * Wait for everything to clear out.
203 	 */
204 	while (p->p_nthreads > 1) {
205 		if (bootverbose)
206 			kprintf("killlwps: waiting for %d lwps of pid "
207 				"%d to die\n",
208 				p->p_nthreads - 1, p->p_pid);
209 		tsleep(&p->p_nthreads, 0, "killlwps", hz);
210 	}
211 }
212 
213 /*
214  * Exit: deallocate address space and other resources, change proc state
215  * to zombie, and unlink proc from allproc and parent's lists.  Save exit
216  * status and rusage for wait().  Check for child processes and orphan them.
217  */
218 void
219 exit1(int rv)
220 {
221 	struct thread *td = curthread;
222 	struct proc *p = td->td_proc;
223 	struct lwp *lp = td->td_lwp;
224 	struct proc *q, *nq;
225 	struct vmspace *vm;
226 	struct vnode *vtmp;
227 	struct exitlist *ep;
228 
229 	if (p->p_pid == 1) {
230 		kprintf("init died (signal %d, exit %d)\n",
231 		    WTERMSIG(rv), WEXITSTATUS(rv));
232 		panic("Going nowhere without my init!");
233 	}
234 
235 	/*
236 	 * Interlock against P_WEXIT.  Only one of the process's thread
237 	 * is allowed to do the master exit.
238 	 */
239 	if (p->p_flag & P_WEXIT) {
240 		lwp_exit(0);
241 		/* NOT REACHED */
242 	}
243 	p->p_flag |= P_WEXIT;
244 
245 	/*
246 	 * Interlock with LWP_WEXIT and kill any remaining LWPs
247 	 */
248 	lp->lwp_flag |= LWP_WEXIT;
249 	if (p->p_nthreads > 1)
250 		killlwps(lp);
251 
252 	caps_exit(lp->lwp_thread);
253 	aio_proc_rundown(p);
254 
255 	/* are we a task leader? */
256 	if (p == p->p_leader) {
257         	struct kill_args killArgs;
258 		killArgs.signum = SIGKILL;
259 		q = p->p_peers;
260 		while(q) {
261 			killArgs.pid = q->p_pid;
262 			/*
263 		         * The interface for kill is better
264 			 * than the internal signal
265 			 */
266 			sys_kill(&killArgs);
267 			nq = q;
268 			q = q->p_peers;
269 		}
270 		while (p->p_peers)
271 			tsleep((caddr_t)p, 0, "exit1", 0);
272 	}
273 
274 #ifdef PGINPROF
275 	vmsizmon();
276 #endif
277 	STOPEVENT(p, S_EXIT, rv);
278 	wakeup(&p->p_stype);	/* Wakeup anyone in procfs' PIOCWAIT */
279 
280 	/*
281 	 * Check if any loadable modules need anything done at process exit.
282 	 * e.g. SYSV IPC stuff
283 	 * XXX what if one of these generates an error?
284 	 */
285 	TAILQ_FOREACH(ep, &exit_list, next)
286 		(*ep->function)(td);
287 
288 	if (p->p_flag & P_PROFIL)
289 		stopprofclock(p);
290 	/*
291 	 * If parent is waiting for us to exit or exec,
292 	 * P_PPWAIT is set; we will wakeup the parent below.
293 	 */
294 	p->p_flag &= ~(P_TRACED | P_PPWAIT);
295 	SIGEMPTYSET(p->p_siglist);
296 	SIGEMPTYSET(lp->lwp_siglist);
297 	if (timevalisset(&p->p_realtimer.it_value))
298 		callout_stop(&p->p_ithandle);
299 
300 	/*
301 	 * Reset any sigio structures pointing to us as a result of
302 	 * F_SETOWN with our pid.
303 	 */
304 	funsetownlst(&p->p_sigiolst);
305 
306 	/*
307 	 * Close open files and release open-file table.
308 	 * This may block!
309 	 */
310 	fdfree(p);
311 	p->p_fd = NULL;
312 
313 	if(p->p_leader->p_peers) {
314 		q = p->p_leader;
315 		while(q->p_peers != p)
316 			q = q->p_peers;
317 		q->p_peers = p->p_peers;
318 		wakeup((caddr_t)p->p_leader);
319 	}
320 
321 	/*
322 	 * XXX Shutdown SYSV semaphores
323 	 */
324 	semexit(p);
325 
326 	KKASSERT(p->p_numposixlocks == 0);
327 
328 	/* The next two chunks should probably be moved to vmspace_exit. */
329 	vm = p->p_vmspace;
330 
331 	/*
332 	 * Release upcalls associated with this process
333 	 */
334 	if (vm->vm_upcalls)
335 		upc_release(vm, lp);
336 
337 	/* clean up data related to virtual kernel operation */
338 	if (p->p_vkernel)
339 		vkernel_exit(p);
340 
341 	/*
342 	 * Release user portion of address space.
343 	 * This releases references to vnodes,
344 	 * which could cause I/O if the file has been unlinked.
345 	 * Need to do this early enough that we can still sleep.
346 	 * Can't free the entire vmspace as the kernel stack
347 	 * may be mapped within that space also.
348 	 *
349 	 * Processes sharing the same vmspace may exit in one order, and
350 	 * get cleaned up by vmspace_exit() in a different order.  The
351 	 * last exiting process to reach this point releases as much of
352 	 * the environment as it can, and the last process cleaned up
353 	 * by vmspace_exit() (which decrements exitingcnt) cleans up the
354 	 * remainder.
355 	 */
356 	++vm->vm_exitingcnt;
357 	sysref_put(&vm->vm_sysref);
358 
359 	if (SESS_LEADER(p)) {
360 		struct session *sp = p->p_session;
361 		struct vnode *vp;
362 
363 		if (sp->s_ttyvp) {
364 			/*
365 			 * We are the controlling process.  Signal the
366 			 * foreground process group, drain the controlling
367 			 * terminal, and revoke access to the controlling
368 			 * terminal.
369 			 *
370 			 * NOTE: while waiting for the process group to exit
371 			 * it is possible that one of the processes in the
372 			 * group will revoke the tty, so we have to recheck.
373 			 */
374 			if (sp->s_ttyp && (sp->s_ttyp->t_session == sp)) {
375 				if (sp->s_ttyp->t_pgrp)
376 					pgsignal(sp->s_ttyp->t_pgrp, SIGHUP, 1);
377 				(void) ttywait(sp->s_ttyp);
378 				/*
379 				 * The tty could have been revoked
380 				 * if we blocked.
381 				 */
382 				if ((vp = sp->s_ttyvp) != NULL) {
383 					ttyclosesession(sp, 0);
384 					vx_lock(vp);
385 					VOP_REVOKE(vp, REVOKEALL);
386 					vx_unlock(vp);
387 					vrele(vp);	/* s_ttyvp ref */
388 				}
389 			}
390 			/*
391 			 * Release the tty.  If someone has it open via
392 			 * /dev/tty then close it (since they no longer can
393 			 * once we've NULL'd it out).
394 			 */
395 			if (sp->s_ttyvp)
396 				ttyclosesession(sp, 1);
397 			/*
398 			 * s_ttyp is not zero'd; we use this to indicate
399 			 * that the session once had a controlling terminal.
400 			 * (for logging and informational purposes)
401 			 */
402 		}
403 		sp->s_leader = NULL;
404 	}
405 	fixjobc(p, p->p_pgrp, 0);
406 	(void)acct_process(p);
407 #ifdef KTRACE
408 	/*
409 	 * release trace file
410 	 */
411 	if (p->p_tracenode)
412 		ktrdestroy(&p->p_tracenode);
413 	p->p_traceflag = 0;
414 #endif
415 	/*
416 	 * Release reference to text vnode
417 	 */
418 	if ((vtmp = p->p_textvp) != NULL) {
419 		p->p_textvp = NULL;
420 		vrele(vtmp);
421 	}
422 
423 	/*
424 	 * Move the process to the zombie list.  This will block
425 	 * until the process p_lock count reaches 0.  The process will
426 	 * not be reaped until TDF_EXITING is set by cpu_thread_exit(),
427 	 * which is called from cpu_proc_exit().
428 	 */
429 	proc_move_allproc_zombie(p);
430 
431 	q = LIST_FIRST(&p->p_children);
432 	if (q)		/* only need this if any child is S_ZOMB */
433 		wakeup((caddr_t) initproc);
434 	for (; q != 0; q = nq) {
435 		nq = LIST_NEXT(q, p_sibling);
436 		LIST_REMOVE(q, p_sibling);
437 		LIST_INSERT_HEAD(&initproc->p_children, q, p_sibling);
438 		q->p_pptr = initproc;
439 		q->p_sigparent = SIGCHLD;
440 		/*
441 		 * Traced processes are killed
442 		 * since their existence means someone is screwing up.
443 		 */
444 		if (q->p_flag & P_TRACED) {
445 			q->p_flag &= ~P_TRACED;
446 			ksignal(q, SIGKILL);
447 		}
448 	}
449 
450 	/*
451 	 * Save exit status and final rusage info, adding in child rusage
452 	 * info and self times.
453 	 */
454 	p->p_xstat = rv;
455 	calcru_proc(p, &p->p_ru);
456 	ruadd(&p->p_ru, &p->p_cru);
457 
458 	/*
459 	 * notify interested parties of our demise.
460 	 */
461 	KNOTE(&p->p_klist, NOTE_EXIT);
462 
463 	/*
464 	 * Notify parent that we're gone.  If parent has the PS_NOCLDWAIT
465 	 * flag set, notify process 1 instead (and hope it will handle
466 	 * this situation).
467 	 */
468 	if (p->p_pptr->p_sigacts->ps_flag & PS_NOCLDWAIT) {
469 		struct proc *pp = p->p_pptr;
470 		proc_reparent(p, initproc);
471 		/*
472 		 * If this was the last child of our parent, notify
473 		 * parent, so in case he was wait(2)ing, he will
474 		 * continue.
475 		 */
476 		if (LIST_EMPTY(&pp->p_children))
477 			wakeup((caddr_t)pp);
478 	}
479 
480 	if (p->p_sigparent && p->p_pptr != initproc) {
481 	        ksignal(p->p_pptr, p->p_sigparent);
482 	} else {
483 	        ksignal(p->p_pptr, SIGCHLD);
484 	}
485 
486 	wakeup((caddr_t)p->p_pptr);
487 	/*
488 	 * cpu_exit is responsible for clearing curproc, since
489 	 * it is heavily integrated with the thread/switching sequence.
490 	 *
491 	 * Other substructures are freed from wait().
492 	 */
493 	plimit_free(&p->p_limit);
494 
495 	/*
496 	 * Release the current user process designation on the process so
497 	 * the userland scheduler can work in someone else.
498 	 */
499 	p->p_usched->release_curproc(lp);
500 
501 	/*
502 	 * Finally, call machine-dependent code to release as many of the
503 	 * lwp's resources as we can and halt execution of this thread.
504 	 */
505 	lwp_exit(1);
506 }
507 
508 void
509 lwp_exit(int masterexit)
510 {
511 	struct lwp *lp = curthread->td_lwp;
512 	struct proc *p = lp->lwp_proc;
513 
514 	/*
515 	 * lwp_exit() may be called without setting LWP_WEXIT, so
516 	 * make sure it is set here.
517 	 */
518 	lp->lwp_flag |= LWP_WEXIT;
519 
520 	/*
521 	 * Nobody actually wakes us when the lock
522 	 * count reaches zero, so just wait one tick.
523 	 */
524 	while (lp->lwp_lock > 0)
525 		tsleep(lp, 0, "lwpexit", 1);
526 
527 	/* Hand down resource usage to our proc */
528 	ruadd(&p->p_ru, &lp->lwp_ru);
529 
530 	/*
531 	 * If we don't hold the process until the LWP is reaped wait*()
532 	 * may try to dispose of its vmspace before all the LWPs have
533 	 * actually terminated.
534 	 */
535 	PHOLD(p);
536 
537 	/*
538 	 * We have to use the reaper for all the LWPs except the one doing
539 	 * the master exit.  The LWP doing the master exit can just be
540 	 * left on p_lwps and the process reaper will deal with it
541 	 * synchronously, which is much faster.
542 	 */
543 	if (masterexit == 0) {
544 		LIST_REMOVE(lp, lwp_list);
545 		--p->p_nthreads;
546 		wakeup(&p->p_nthreads);
547 		LIST_INSERT_HEAD(&deadlwp_list[mycpuid], lp, lwp_list);
548 		taskqueue_enqueue(taskqueue_thread[mycpuid], deadlwp_task[mycpuid]);
549 	} else {
550 		--p->p_nthreads;
551 	}
552 	cpu_lwp_exit();
553 }
554 
555 /*
556  * Wait until a lwp is completely dead.
557  *
558  * If the thread is still executing, which can't be waited upon,
559  * return failure.  The caller is responsible of waiting a little
560  * bit and checking again.
561  *
562  * Suggested use:
563  * while (!lwp_wait(lp))
564  *	tsleep(lp, 0, "lwpwait", 1);
565  */
566 static int
567 lwp_wait(struct lwp *lp)
568 {
569 	struct thread *td = lp->lwp_thread;;
570 
571 	KKASSERT(lwkt_preempted_proc() != lp);
572 
573 	while (lp->lwp_lock > 0)
574 		tsleep(lp, 0, "lwpwait1", 1);
575 
576 	lwkt_wait_free(td);
577 
578 	/*
579 	 * The lwp's thread may still be in the middle
580 	 * of switching away, we can't rip its stack out from
581 	 * under it until TDF_EXITING is set and both
582 	 * TDF_RUNNING and TDF_PREEMPT_LOCK are clear.
583 	 * TDF_PREEMPT_LOCK must be checked because TDF_RUNNING
584 	 * will be cleared temporarily if a thread gets
585 	 * preempted.
586 	 *
587 	 * YYY no wakeup occurs, so we simply return failure
588 	 * and let the caller deal with sleeping and calling
589 	 * us again.
590 	 */
591 	if ((td->td_flags & (TDF_RUNNING|TDF_PREEMPT_LOCK|TDF_EXITING)) !=
592 	    TDF_EXITING)
593 		return (0);
594 
595 	return (1);
596 }
597 
598 /*
599  * Release the resources associated with a lwp.
600  * The lwp must be completely dead.
601  */
602 void
603 lwp_dispose(struct lwp *lp)
604 {
605 	struct thread *td = lp->lwp_thread;;
606 
607 	KKASSERT(lwkt_preempted_proc() != lp);
608 	KKASSERT(td->td_refs == 0);
609 	KKASSERT((td->td_flags & (TDF_RUNNING|TDF_PREEMPT_LOCK|TDF_EXITING)) ==
610 		 TDF_EXITING);
611 
612 	PRELE(lp->lwp_proc);
613 	lp->lwp_proc = NULL;
614 	if (td != NULL) {
615 		td->td_proc = NULL;
616 		td->td_lwp = NULL;
617 		lp->lwp_thread = NULL;
618 		lwkt_free_thread(td);
619 	}
620 	zfree(lwp_zone, lp);
621 }
622 
623 int
624 sys_wait4(struct wait_args *uap)
625 {
626 	struct rusage rusage;
627 	int error, status;
628 
629 	error = kern_wait(uap->pid, uap->status ? &status : NULL,
630 	    uap->options, uap->rusage ? &rusage : NULL, &uap->sysmsg_fds[0]);
631 
632 	if (error == 0 && uap->status)
633 		error = copyout(&status, uap->status, sizeof(*uap->status));
634 	if (error == 0 && uap->rusage)
635 		error = copyout(&rusage, uap->rusage, sizeof(*uap->rusage));
636 	return (error);
637 }
638 
639 /*
640  * wait1()
641  *
642  * wait_args(int pid, int *status, int options, struct rusage *rusage)
643  */
644 int
645 kern_wait(pid_t pid, int *status, int options, struct rusage *rusage, int *res)
646 {
647 	struct thread *td = curthread;
648 	struct proc *q = td->td_proc;
649 	struct proc *p, *t;
650 	int nfound, error;
651 
652 	if (pid == 0)
653 		pid = -q->p_pgid;
654 	if (options &~ (WUNTRACED|WNOHANG|WLINUXCLONE))
655 		return (EINVAL);
656 loop:
657 	/*
658 	 * Hack for backwards compatibility with badly written user code.
659 	 * Or perhaps we have to do this anyway, it is unclear. XXX
660 	 *
661 	 * The problem is that if a process group is stopped and the parent
662 	 * is doing a wait*(..., WUNTRACED, ...), it will see the STOP
663 	 * of the child and then stop itself when it tries to return from the
664 	 * system call.  When the process group is resumed the parent will
665 	 * then get the STOP status even though the child has now resumed
666 	 * (a followup wait*() will get the CONT status).
667 	 *
668 	 * Previously the CONT would overwrite the STOP because the tstop
669 	 * was handled within tsleep(), and the parent would only see
670 	 * the CONT when both are stopped and continued together.  This litte
671 	 * two-line hack restores this effect.
672 	 */
673 	while (q->p_stat == SSTOP)
674             tstop();
675 
676 	nfound = 0;
677 	LIST_FOREACH(p, &q->p_children, p_sibling) {
678 		if (pid != WAIT_ANY &&
679 		    p->p_pid != pid && p->p_pgid != -pid)
680 			continue;
681 
682 		/* This special case handles a kthread spawned by linux_clone
683 		 * (see linux_misc.c).  The linux_wait4 and linux_waitpid
684 		 * functions need to be able to distinguish between waiting
685 		 * on a process and waiting on a thread.  It is a thread if
686 		 * p_sigparent is not SIGCHLD, and the WLINUXCLONE option
687 		 * signifies we want to wait for threads and not processes.
688 		 */
689 		if ((p->p_sigparent != SIGCHLD) ^
690 		    ((options & WLINUXCLONE) != 0)) {
691 			continue;
692 		}
693 
694 		nfound++;
695 		if (p->p_stat == SZOMB) {
696 			/*
697 			 * Reap any LWPs left in p->p_lwps.  This is usually
698 			 * just the last LWP.  This must be done before
699 			 * we loop on p_lock since the lwps hold a ref on
700 			 * it as a vmspace interlock.
701 			 *
702 			 * Once that is accomplished p_nthreads had better
703 			 * be zero.
704 			 */
705 			reaplwps(&p->p_lwps, 0);
706 			KKASSERT(p->p_nthreads == 0);
707 
708 			/*
709 			 * Don't do anything really bad until all references
710 			 * to the process go away.  This may include other
711 			 * LWPs which are still in the process of being
712 			 * reaped.  We can't just pull the rug out from under
713 			 * them because they may still be using the VM space.
714 			 *
715 			 * Certain kernel facilities such as /proc will also
716 			 * put a hold on the process for short periods of
717 			 * time.
718 			 */
719 			while (p->p_lock)
720 				tsleep(p, 0, "reap3", hz);
721 
722 			/* scheduling hook for heuristic */
723 			/* XXX no lwp available, we need a different heuristic */
724 			/*
725 			p->p_usched->heuristic_exiting(td->td_lwp, deadlp);
726 			*/
727 
728 			/* Take care of our return values. */
729 			*res = p->p_pid;
730 			if (status)
731 				*status = p->p_xstat;
732 			if (rusage)
733 				*rusage = p->p_ru;
734 			/*
735 			 * If we got the child via a ptrace 'attach',
736 			 * we need to give it back to the old parent.
737 			 */
738 			if (p->p_oppid && (t = pfind(p->p_oppid))) {
739 				p->p_oppid = 0;
740 				proc_reparent(p, t);
741 				ksignal(t, SIGCHLD);
742 				wakeup((caddr_t)t);
743 				return (0);
744 			}
745 			p->p_xstat = 0;
746 			ruadd(&q->p_cru, &p->p_ru);
747 
748 			/*
749 			 * Decrement the count of procs running with this uid.
750 			 */
751 			chgproccnt(p->p_ucred->cr_ruidinfo, -1, 0);
752 
753 			/*
754 			 * Free up credentials.
755 			 */
756 			crfree(p->p_ucred);
757 			p->p_ucred = NULL;
758 
759 			/*
760 			 * Remove unused arguments
761 			 */
762 			if (p->p_args && --p->p_args->ar_ref == 0)
763 				FREE(p->p_args, M_PARGS);
764 
765 			/*
766 			 * Finally finished with old proc entry.
767 			 * Unlink it from its process group and free it.
768 			 */
769 			proc_remove_zombie(p);
770 			leavepgrp(p);
771 
772 			if (--p->p_sigacts->ps_refcnt == 0) {
773 				kfree(p->p_sigacts, M_SUBPROC);
774 				p->p_sigacts = NULL;
775 			}
776 
777 			vm_waitproc(p);
778 			zfree(proc_zone, p);
779 			nprocs--;
780 			return (0);
781 		}
782 		if (p->p_stat == SSTOP && (p->p_flag & P_WAITED) == 0 &&
783 		    (p->p_flag & P_TRACED || options & WUNTRACED)) {
784 			p->p_flag |= P_WAITED;
785 
786 			*res = p->p_pid;
787 			if (status)
788 				*status = W_STOPCODE(p->p_xstat);
789 			/* Zero rusage so we get something consistent. */
790 			if (rusage)
791 				bzero(rusage, sizeof(rusage));
792 			return (0);
793 		}
794 	}
795 	if (nfound == 0)
796 		return (ECHILD);
797 	if (options & WNOHANG) {
798 		*res = 0;
799 		return (0);
800 	}
801 	error = tsleep((caddr_t)q, PCATCH, "wait", 0);
802 	if (error)
803 		return (error);
804 	goto loop;
805 }
806 
807 /*
808  * make process 'parent' the new parent of process 'child'.
809  */
810 void
811 proc_reparent(struct proc *child, struct proc *parent)
812 {
813 
814 	if (child->p_pptr == parent)
815 		return;
816 
817 	LIST_REMOVE(child, p_sibling);
818 	LIST_INSERT_HEAD(&parent->p_children, child, p_sibling);
819 	child->p_pptr = parent;
820 }
821 
822 /*
823  * The next two functions are to handle adding/deleting items on the
824  * exit callout list
825  *
826  * at_exit():
827  * Take the arguments given and put them onto the exit callout list,
828  * However first make sure that it's not already there.
829  * returns 0 on success.
830  */
831 
832 int
833 at_exit(exitlist_fn function)
834 {
835 	struct exitlist *ep;
836 
837 #ifdef INVARIANTS
838 	/* Be noisy if the programmer has lost track of things */
839 	if (rm_at_exit(function))
840 		kprintf("WARNING: exit callout entry (%p) already present\n",
841 		    function);
842 #endif
843 	ep = kmalloc(sizeof(*ep), M_ATEXIT, M_NOWAIT);
844 	if (ep == NULL)
845 		return (ENOMEM);
846 	ep->function = function;
847 	TAILQ_INSERT_TAIL(&exit_list, ep, next);
848 	return (0);
849 }
850 
851 /*
852  * Scan the exit callout list for the given item and remove it.
853  * Returns the number of items removed (0 or 1)
854  */
855 int
856 rm_at_exit(exitlist_fn function)
857 {
858 	struct exitlist *ep;
859 
860 	TAILQ_FOREACH(ep, &exit_list, next) {
861 		if (ep->function == function) {
862 			TAILQ_REMOVE(&exit_list, ep, next);
863 			kfree(ep, M_ATEXIT);
864 			return(1);
865 		}
866 	}
867 	return (0);
868 }
869 
870 /*
871  * LWP reaper related code.
872  */
873 static void
874 reaplwps(void *context, int dummy)
875 {
876 	struct lwplist *lwplist = context;
877 	struct lwp *lp;
878 
879 	while ((lp = LIST_FIRST(lwplist))) {
880 		LIST_REMOVE(lp, lwp_list);
881 		while (lwp_wait(lp) == 0)
882 			tsleep(lp, 0, "lwpreap", 1);
883 		lwp_dispose(lp);
884 	}
885 }
886 
887 static void
888 deadlwp_init(void)
889 {
890 	int cpu;
891 
892 	for (cpu = 0; cpu < ncpus; cpu++) {
893 		LIST_INIT(&deadlwp_list[cpu]);
894 		deadlwp_task[cpu] = kmalloc(sizeof(*deadlwp_task[cpu]), M_DEVBUF, M_WAITOK);
895 		TASK_INIT(deadlwp_task[cpu], 0, reaplwps, &deadlwp_list[cpu]);
896 	}
897 }
898 
899 SYSINIT(deadlwpinit, SI_SUB_CONFIGURE, SI_ORDER_ANY, deadlwp_init, NULL);
900