xref: /dragonfly/sys/kern/kern_exit.c (revision 6a3cbbc2)
1 /*
2  * Copyright (c) 1982, 1986, 1989, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *	@(#)kern_exit.c	8.7 (Berkeley) 2/12/94
35  * $FreeBSD: src/sys/kern/kern_exit.c,v 1.92.2.11 2003/01/13 22:51:16 dillon Exp $
36  */
37 
38 #include "opt_ktrace.h"
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/sysproto.h>
43 #include <sys/kernel.h>
44 #include <sys/malloc.h>
45 #include <sys/proc.h>
46 #include <sys/ktrace.h>
47 #include <sys/pioctl.h>
48 #include <sys/tty.h>
49 #include <sys/wait.h>
50 #include <sys/vnode.h>
51 #include <sys/resourcevar.h>
52 #include <sys/signalvar.h>
53 #include <sys/taskqueue.h>
54 #include <sys/ptrace.h>
55 #include <sys/acct.h>		/* for acct_process() function prototype */
56 #include <sys/filedesc.h>
57 #include <sys/shm.h>
58 #include <sys/sem.h>
59 #include <sys/jail.h>
60 #include <sys/kern_syscall.h>
61 #include <sys/unistd.h>
62 #include <sys/eventhandler.h>
63 #include <sys/dsched.h>
64 
65 #include <vm/vm.h>
66 #include <vm/vm_param.h>
67 #include <sys/lock.h>
68 #include <vm/pmap.h>
69 #include <vm/vm_map.h>
70 #include <vm/vm_extern.h>
71 
72 #include <sys/refcount.h>
73 #include <sys/spinlock2.h>
74 
75 #include <machine/vmm.h>
76 
77 static void reaplwps(void *context, int dummy);
78 static void reaplwp(struct lwp *lp);
79 static void killlwps(struct lwp *lp);
80 
81 static MALLOC_DEFINE(M_ATEXIT, "atexit", "atexit callback");
82 
83 /*
84  * callout list for things to do at exit time
85  */
86 struct exitlist {
87 	exitlist_fn function;
88 	TAILQ_ENTRY(exitlist) next;
89 };
90 
91 TAILQ_HEAD(exit_list_head, exitlist);
92 static struct exit_list_head exit_list = TAILQ_HEAD_INITIALIZER(exit_list);
93 
94 /*
95  * LWP reaper data
96  */
97 static struct task *deadlwp_task[MAXCPU];
98 static struct lwplist deadlwp_list[MAXCPU];
99 static struct lwkt_token deadlwp_token[MAXCPU];
100 
101 void (*linux_task_drop_callback)(thread_t td);
102 void (*linux_proc_drop_callback)(struct proc *p);
103 
104 /*
105  * exit --
106  *	Death of process.
107  *
108  * SYS_EXIT_ARGS(int rval)
109  */
110 int
111 sys_exit(struct exit_args *uap)
112 {
113 	exit1(W_EXITCODE(uap->rval, 0));
114 	/* NOTREACHED */
115 }
116 
117 /*
118  * Extended exit --
119  *	Death of a lwp or process with optional bells and whistles.
120  */
121 int
122 sys_extexit(struct extexit_args *uap)
123 {
124 	struct proc *p = curproc;
125 	int action, who;
126 	int error;
127 
128 	action = EXTEXIT_ACTION(uap->how);
129 	who = EXTEXIT_WHO(uap->how);
130 
131 	/* Check parameters before we might perform some action */
132 	switch (who) {
133 	case EXTEXIT_PROC:
134 	case EXTEXIT_LWP:
135 		break;
136 	default:
137 		return (EINVAL);
138 	}
139 
140 	switch (action) {
141 	case EXTEXIT_SIMPLE:
142 		break;
143 	case EXTEXIT_SETINT:
144 		error = copyout(&uap->status, uap->addr, sizeof(uap->status));
145 		if (error)
146 			return (error);
147 		break;
148 	default:
149 		return (EINVAL);
150 	}
151 
152 	lwkt_gettoken(&p->p_token);
153 
154 	switch (who) {
155 	case EXTEXIT_LWP:
156 		/*
157 		 * Be sure only to perform a simple lwp exit if there is at
158 		 * least one more lwp in the proc, which will call exit1()
159 		 * later, otherwise the proc will be an UNDEAD and not even a
160 		 * SZOMB!
161 		 */
162 		if (p->p_nthreads > 1) {
163 			lwp_exit(0, NULL);	/* called w/ p_token held */
164 			/* NOT REACHED */
165 		}
166 		/* else last lwp in proc:  do the real thing */
167 		/* FALLTHROUGH */
168 	default:	/* to help gcc */
169 	case EXTEXIT_PROC:
170 		lwkt_reltoken(&p->p_token);
171 		exit1(W_EXITCODE(uap->status, 0));
172 		/* NOTREACHED */
173 	}
174 
175 	/* NOTREACHED */
176 	lwkt_reltoken(&p->p_token);	/* safety */
177 }
178 
179 /*
180  * Kill all lwps associated with the current process except the
181  * current lwp.   Return an error if we race another thread trying to
182  * do the same thing and lose the race.
183  *
184  * If forexec is non-zero the current thread and process flags are
185  * cleaned up so they can be reused.
186  */
187 int
188 killalllwps(int forexec)
189 {
190 	struct lwp *lp = curthread->td_lwp;
191 	struct proc *p = lp->lwp_proc;
192 	int fakestop;
193 
194 	/*
195 	 * Interlock against P_WEXIT.  Only one of the process's thread
196 	 * is allowed to do the master exit.
197 	 */
198 	lwkt_gettoken(&p->p_token);
199 	if (p->p_flags & P_WEXIT) {
200 		lwkt_reltoken(&p->p_token);
201 		return (EALREADY);
202 	}
203 	p->p_flags |= P_WEXIT;
204 	lwkt_gettoken(&lp->lwp_token);
205 
206 	/*
207 	 * Set temporary stopped state in case we are racing a coredump.
208 	 * Otherwise the coredump may hang forever.
209 	 */
210 	if (lp->lwp_mpflags & LWP_MP_WSTOP) {
211 		fakestop = 0;
212 	} else {
213 		atomic_set_int(&lp->lwp_mpflags, LWP_MP_WSTOP);
214 		++p->p_nstopped;
215 		fakestop = 1;
216 		wakeup(&p->p_nstopped);
217 	}
218 
219 	/*
220 	 * Interlock with LWP_MP_WEXIT and kill any remaining LWPs
221 	 */
222 	atomic_set_int(&lp->lwp_mpflags, LWP_MP_WEXIT);
223 	if (p->p_nthreads > 1)
224 		killlwps(lp);
225 
226 	/*
227 	 * Undo temporary stopped state
228 	 */
229 	if (fakestop && (lp->lwp_mpflags & LWP_MP_WSTOP)) {
230 		atomic_clear_int(&lp->lwp_mpflags, LWP_MP_WSTOP);
231 		--p->p_nstopped;
232 	}
233 
234 	/*
235 	 * If doing this for an exec, clean up the remaining thread
236 	 * (us) for continuing operation after all the other threads
237 	 * have been killed.
238 	 */
239 	if (forexec) {
240 		atomic_clear_int(&lp->lwp_mpflags, LWP_MP_WEXIT);
241 		p->p_flags &= ~P_WEXIT;
242 	}
243 	lwkt_reltoken(&lp->lwp_token);
244 	lwkt_reltoken(&p->p_token);
245 
246 	return(0);
247 }
248 
249 /*
250  * Kill all LWPs except the current one.  Do not try to signal
251  * LWPs which have exited on their own or have already been
252  * signaled.
253  */
254 static void
255 killlwps(struct lwp *lp)
256 {
257 	struct proc *p = lp->lwp_proc;
258 	struct lwp *tlp;
259 
260 	/*
261 	 * Kill the remaining LWPs.  We must send the signal before setting
262 	 * LWP_MP_WEXIT.  The setting of WEXIT is optional but helps reduce
263 	 * races.  tlp must be held across the call as it might block and
264 	 * allow the target lwp to rip itself out from under our loop.
265 	 */
266 	FOREACH_LWP_IN_PROC(tlp, p) {
267 		LWPHOLD(tlp);
268 		lwkt_gettoken(&tlp->lwp_token);
269 		if ((tlp->lwp_mpflags & LWP_MP_WEXIT) == 0) {
270 			atomic_set_int(&tlp->lwp_mpflags, LWP_MP_WEXIT);
271 			lwpsignal(p, tlp, SIGKILL);
272 		}
273 		lwkt_reltoken(&tlp->lwp_token);
274 		LWPRELE(tlp);
275 	}
276 
277 	/*
278 	 * Wait for everything to clear out.  Also make sure any tstop()s
279 	 * are signalled (we are holding p_token for the interlock).
280 	 */
281 	wakeup(p);
282 	while (p->p_nthreads > 1)
283 		tsleep(&p->p_nthreads, 0, "killlwps", 0);
284 }
285 
286 /*
287  * Exit: deallocate address space and other resources, change proc state
288  * to zombie, and unlink proc from allproc and parent's lists.  Save exit
289  * status and rusage for wait().  Check for child processes and orphan them.
290  */
291 void
292 exit1(int rv)
293 {
294 	struct thread *td = curthread;
295 	struct proc *p = td->td_proc;
296 	struct lwp *lp = td->td_lwp;
297 	struct proc *q;
298 	struct proc *pp;
299 	struct proc *reproc;
300 	struct sysreaper *reap;
301 	struct vmspace *vm;
302 	struct vnode *vtmp;
303 	struct exitlist *ep;
304 	int error;
305 
306 	lwkt_gettoken(&p->p_token);
307 
308 	if (p->p_pid == 1) {
309 		kprintf("init died (signal %d, exit %d)\n",
310 		    WTERMSIG(rv), WEXITSTATUS(rv));
311 		panic("Going nowhere without my init!");
312 	}
313 	varsymset_clean(&p->p_varsymset);
314 	lockuninit(&p->p_varsymset.vx_lock);
315 
316 	/*
317 	 * Kill all lwps associated with the current process, return an
318 	 * error if we race another thread trying to do the same thing
319 	 * and lose the race.
320 	 */
321 	error = killalllwps(0);
322 	if (error) {
323 		lwp_exit(0, NULL);
324 		/* NOT REACHED */
325 	}
326 
327 	/* are we a task leader? */
328 	if (p == p->p_leader) {
329         	struct kill_args killArgs;
330 		killArgs.signum = SIGKILL;
331 		q = p->p_peers;
332 		while(q) {
333 			killArgs.pid = q->p_pid;
334 			/*
335 		         * The interface for kill is better
336 			 * than the internal signal
337 			 */
338 			sys_kill(&killArgs);
339 			q = q->p_peers;
340 		}
341 		while (p->p_peers)
342 			tsleep((caddr_t)p, 0, "exit1", 0);
343 	}
344 
345 #ifdef PGINPROF
346 	vmsizmon();
347 #endif
348 	STOPEVENT(p, S_EXIT, rv);
349 	p->p_flags |= P_POSTEXIT;	/* stop procfs stepping */
350 
351 	/*
352 	 * Check if any loadable modules need anything done at process exit.
353 	 * e.g. SYSV IPC stuff
354 	 * XXX what if one of these generates an error?
355 	 */
356 	p->p_xstat = rv;
357 
358 	/*
359 	 * XXX: imho, the eventhandler stuff is much cleaner than this.
360 	 *	Maybe we should move everything to use eventhandler.
361 	 */
362 	TAILQ_FOREACH(ep, &exit_list, next)
363 		(*ep->function)(td);
364 
365 	if (p->p_flags & P_PROFIL)
366 		stopprofclock(p);
367 
368 	SIGEMPTYSET(p->p_siglist);
369 	SIGEMPTYSET(lp->lwp_siglist);
370 	if (timevalisset(&p->p_realtimer.it_value))
371 		callout_terminate(&p->p_ithandle);
372 
373 	/*
374 	 * Reset any sigio structures pointing to us as a result of
375 	 * F_SETOWN with our pid.
376 	 */
377 	funsetownlst(&p->p_sigiolst);
378 
379 	/*
380 	 * Close open files and release open-file table.
381 	 * This may block!
382 	 */
383 	fdfree(p, NULL);
384 
385 	if (p->p_leader->p_peers) {
386 		q = p->p_leader;
387 		while(q->p_peers != p)
388 			q = q->p_peers;
389 		q->p_peers = p->p_peers;
390 		wakeup((caddr_t)p->p_leader);
391 	}
392 
393 	/*
394 	 * XXX Shutdown SYSV semaphores
395 	 */
396 	semexit(p);
397 
398 	/* The next two chunks should probably be moved to vmspace_exit. */
399 	vm = p->p_vmspace;
400 
401 	/*
402 	 * Clean up data related to virtual kernel operation.  Clean up
403 	 * any vkernel context related to the current lwp now so we can
404 	 * destroy p_vkernel.
405 	 */
406 	if (p->p_vkernel) {
407 		vkernel_lwp_exit(lp);
408 		vkernel_exit(p);
409 	}
410 
411 	/*
412 	 * Release the user portion of address space.  The exitbump prevents
413 	 * the vmspace from being completely eradicated (using holdcnt).
414 	 * This releases references to vnodes, which could cause I/O if the
415 	 * file has been unlinked.  We need to do this early enough that
416 	 * we can still sleep.
417 	 *
418 	 * We can't free the entire vmspace as the kernel stack may be mapped
419 	 * within that space also.
420 	 *
421 	 * Processes sharing the same vmspace may exit in one order, and
422 	 * get cleaned up by vmspace_exit() in a different order.  The
423 	 * last exiting process to reach this point releases as much of
424 	 * the environment as it can, and the last process cleaned up
425 	 * by vmspace_exit() (which decrements exitingcnt) cleans up the
426 	 * remainder.
427 	 *
428 	 * NOTE: Releasing p_token around this call is helpful if the
429 	 *	 vmspace had a huge RSS.  Otherwise some other process
430 	 *	 trying to do an allproc or other scan (like 'ps') may
431 	 *	 stall for a long time.
432 	 */
433 	lwkt_reltoken(&p->p_token);
434 	vmspace_relexit(vm);
435 	lwkt_gettoken(&p->p_token);
436 
437 	if (SESS_LEADER(p)) {
438 		struct session *sp = p->p_session;
439 
440 		if (sp->s_ttyvp) {
441 			/*
442 			 * We are the controlling process.  Signal the
443 			 * foreground process group, drain the controlling
444 			 * terminal, and revoke access to the controlling
445 			 * terminal.
446 			 *
447 			 * NOTE: while waiting for the process group to exit
448 			 * it is possible that one of the processes in the
449 			 * group will revoke the tty, so the ttyclosesession()
450 			 * function will re-check sp->s_ttyvp.
451 			 */
452 			if (sp->s_ttyp && (sp->s_ttyp->t_session == sp)) {
453 				if (sp->s_ttyp->t_pgrp)
454 					pgsignal(sp->s_ttyp->t_pgrp, SIGHUP, 1);
455 				ttywait(sp->s_ttyp);
456 				ttyclosesession(sp, 1); /* also revoke */
457 			}
458 			/*
459 			 * Release the tty.  If someone has it open via
460 			 * /dev/tty then close it (since they no longer can
461 			 * once we've NULL'd it out).
462 			 */
463 			ttyclosesession(sp, 0);
464 
465 			/*
466 			 * s_ttyp is not zero'd; we use this to indicate
467 			 * that the session once had a controlling terminal.
468 			 * (for logging and informational purposes)
469 			 */
470 		}
471 		sp->s_leader = NULL;
472 	}
473 	fixjobc(p, p->p_pgrp, 0);
474 	(void)acct_process(p);
475 #ifdef KTRACE
476 	/*
477 	 * release trace file
478 	 */
479 	if (p->p_tracenode)
480 		ktrdestroy(&p->p_tracenode);
481 	p->p_traceflag = 0;
482 #endif
483 	/*
484 	 * Release reference to text vnode
485 	 */
486 	if ((vtmp = p->p_textvp) != NULL) {
487 		p->p_textvp = NULL;
488 		vrele(vtmp);
489 	}
490 
491 	/* Release namecache handle to text file */
492 	if (p->p_textnch.ncp)
493 		cache_drop(&p->p_textnch);
494 
495 	/*
496 	 * We have to handle PPWAIT here or proc_move_allproc_zombie()
497 	 * will block on the PHOLD() the parent is doing.
498 	 *
499 	 * We are using the flag as an interlock so an atomic op is
500 	 * necessary to synchronize with the parent's cpu.
501 	 */
502 	if (p->p_flags & P_PPWAIT) {
503 		if (p->p_pptr && p->p_pptr->p_upmap)
504 			atomic_add_int(&p->p_pptr->p_upmap->invfork, -1);
505 		atomic_clear_int(&p->p_flags, P_PPWAIT);
506 		wakeup(p->p_pptr);
507 	}
508 
509 	/*
510 	 * Move the process to the zombie list.  This will block
511 	 * until the process p_lock count reaches 0.  The process will
512 	 * not be reaped until TDF_EXITING is set by cpu_thread_exit(),
513 	 * which is called from cpu_proc_exit().
514 	 *
515 	 * Interlock against waiters using p_waitgen.  We increment
516 	 * p_waitgen after completing the move of our process to the
517 	 * zombie list.
518 	 *
519 	 * WARNING: pp becomes stale when we block, clear it now as a
520 	 *	    reminder.
521 	 */
522 	proc_move_allproc_zombie(p);
523 	pp = p->p_pptr;
524 	atomic_add_long(&pp->p_waitgen, 1);
525 	pp = NULL;
526 
527 	/*
528 	 * release controlled reaper for exit if we own it and return the
529 	 * remaining reaper (the one for us), which we will drop after we
530 	 * are done.
531 	 */
532 	reap = reaper_exit(p);
533 
534 	/*
535 	 * Reparent all of this process's children to the init process or
536 	 * to the designated reaper.  We must hold the reaper's p_token in
537 	 * order to safely mess with p_children.
538 	 *
539 	 * We already hold p->p_token (to remove the children from our list).
540 	 */
541 	reproc = NULL;
542 	q = LIST_FIRST(&p->p_children);
543 	if (q) {
544 		reproc = reaper_get(reap);
545 		lwkt_gettoken(&reproc->p_token);
546 		while ((q = LIST_FIRST(&p->p_children)) != NULL) {
547 			PHOLD(q);
548 			lwkt_gettoken(&q->p_token);
549 			if (q != LIST_FIRST(&p->p_children)) {
550 				lwkt_reltoken(&q->p_token);
551 				PRELE(q);
552 				continue;
553 			}
554 			LIST_REMOVE(q, p_sibling);
555 			LIST_INSERT_HEAD(&reproc->p_children, q, p_sibling);
556 			q->p_pptr = reproc;
557 			q->p_ppid = reproc->p_pid;
558 			q->p_sigparent = SIGCHLD;
559 
560 			/*
561 			 * Traced processes are killed
562 			 * since their existence means someone is screwing up.
563 			 */
564 			if (q->p_flags & P_TRACED) {
565 				q->p_flags &= ~P_TRACED;
566 				ksignal(q, SIGKILL);
567 			}
568 			lwkt_reltoken(&q->p_token);
569 			PRELE(q);
570 		}
571 		lwkt_reltoken(&reproc->p_token);
572 		wakeup(reproc);
573 	}
574 
575 	/*
576 	 * Save exit status and final rusage info.  We no longer add
577 	 * child rusage info into self times, wait4() and kern_wait()
578 	 * handles it in order to properly support wait6().
579 	 */
580 	calcru_proc(p, &p->p_ru);
581 	/*ruadd(&p->p_ru, &p->p_cru); REMOVED */
582 
583 	/*
584 	 * notify interested parties of our demise.
585 	 */
586 	KNOTE(&p->p_klist, NOTE_EXIT);
587 
588 	/*
589 	 * Notify parent that we're gone.  If parent has the PS_NOCLDWAIT
590 	 * flag set, or if the handler is set to SIG_IGN, notify the reaper
591 	 * instead (it will handle this situation).
592 	 *
593 	 * NOTE: The reaper can still be the parent process.
594 	 *
595 	 * (must reload pp)
596 	 */
597 	if (p->p_pptr->p_sigacts->ps_flag & (PS_NOCLDWAIT | PS_CLDSIGIGN)) {
598 		if (reproc == NULL)
599 			reproc = reaper_get(reap);
600 		proc_reparent(p, reproc);
601 	}
602 	if (reproc)
603 		PRELE(reproc);
604 	if (reap)
605 		reaper_drop(reap);
606 
607 	/*
608 	 * Signal (possibly new) parent.
609 	 */
610 	pp = p->p_pptr;
611 	PHOLD(pp);
612 	if (p->p_sigparent && pp != initproc) {
613 		int sig = p->p_sigparent;
614 
615 		if (sig != SIGUSR1 && sig != SIGCHLD)
616 			sig = SIGCHLD;
617 	        ksignal(pp, sig);
618 	} else {
619 	        ksignal(pp, SIGCHLD);
620 	}
621 	p->p_flags &= ~P_TRACED;
622 	PRELE(pp);
623 
624 	/*
625 	 * cpu_exit is responsible for clearing curproc, since
626 	 * it is heavily integrated with the thread/switching sequence.
627 	 *
628 	 * Other substructures are freed from wait().
629 	 */
630 	if (p->p_limit) {
631 		struct plimit *rlimit;
632 
633 		rlimit = p->p_limit;
634 		p->p_limit = NULL;
635 		plimit_free(rlimit);
636 	}
637 
638 	/*
639 	 * Finally, call machine-dependent code to release as many of the
640 	 * lwp's resources as we can and halt execution of this thread.
641 	 *
642 	 * pp is a wild pointer now but still the correct wakeup() target.
643 	 * lwp_exit() only uses it to send the wakeup() signal to the likely
644 	 * parent.  Any reparenting race that occurs will get a signal
645 	 * automatically and not be an issue.
646 	 */
647 	lwp_exit(1, pp);
648 }
649 
650 /*
651  * Eventually called by every exiting LWP
652  *
653  * p->p_token must be held.  mplock may be held and will be released.
654  */
655 void
656 lwp_exit(int masterexit, void *waddr)
657 {
658 	struct thread *td = curthread;
659 	struct lwp *lp = td->td_lwp;
660 	struct proc *p = lp->lwp_proc;
661 	int dowake = 0;
662 
663 	/*
664 	 * Release the current user process designation on the process so
665 	 * the userland scheduler can work in someone else.
666 	 */
667 	p->p_usched->release_curproc(lp);
668 
669 	/*
670 	 * Destroy the per-thread shared page and remove from any pmaps
671 	 * it resides in.
672 	 */
673 	lwp_userunmap(lp);
674 
675 	/*
676 	 * lwp_exit() may be called without setting LWP_MP_WEXIT, so
677 	 * make sure it is set here.
678 	 */
679 	ASSERT_LWKT_TOKEN_HELD(&p->p_token);
680 	atomic_set_int(&lp->lwp_mpflags, LWP_MP_WEXIT);
681 
682 	/*
683 	 * Clean up any virtualization
684 	 */
685 	if (lp->lwp_vkernel)
686 		vkernel_lwp_exit(lp);
687 
688 	if (td->td_vmm)
689 		vmm_vmdestroy();
690 
691 	/*
692 	 * Clean up select/poll support
693 	 */
694 	kqueue_terminate(&lp->lwp_kqueue);
695 
696 	if (td->td_linux_task)
697 		linux_task_drop_callback(td);
698 	if (masterexit && p->p_linux_mm)
699 		linux_proc_drop_callback(p);
700 
701 	/*
702 	 * Clean up any syscall-cached ucred or rlimit.
703 	 */
704 	if (td->td_ucred) {
705 		crfree(td->td_ucred);
706 		td->td_ucred = NULL;
707 	}
708 	if (td->td_limit) {
709 		struct plimit *rlimit;
710 
711 		rlimit = td->td_limit;
712 		td->td_limit = NULL;
713 		plimit_free(rlimit);
714         }
715 
716 	/*
717 	 * Cleanup any cached descriptors for this thread
718 	 */
719 	if (p->p_fd)
720 		fexitcache(td);
721 
722 	/*
723 	 * Nobody actually wakes us when the lock
724 	 * count reaches zero, so just wait one tick.
725 	 */
726 	while (lp->lwp_lock > 0)
727 		tsleep(lp, 0, "lwpexit", 1);
728 
729 	/* Hand down resource usage to our proc */
730 	ruadd(&p->p_ru, &lp->lwp_ru);
731 
732 	/*
733 	 * If we don't hold the process until the LWP is reaped wait*()
734 	 * may try to dispose of its vmspace before all the LWPs have
735 	 * actually terminated.
736 	 */
737 	PHOLD(p);
738 
739 	/*
740 	 * Do any remaining work that might block on us.  We should be
741 	 * coded such that further blocking is ok after decrementing
742 	 * p_nthreads but don't take the chance.
743 	 */
744 	dsched_exit_thread(td);
745 	biosched_done(curthread);
746 
747 	/*
748 	 * We have to use the reaper for all the LWPs except the one doing
749 	 * the master exit.  The LWP doing the master exit can just be
750 	 * left on p_lwps and the process reaper will deal with it
751 	 * synchronously, which is much faster.
752 	 *
753 	 * Wakeup anyone waiting on p_nthreads to drop to 1 or 0.
754 	 *
755 	 * The process is left held until the reaper calls lwp_dispose() on
756 	 * the lp (after calling lwp_wait()).
757 	 */
758 	if (masterexit == 0) {
759 		int cpu = mycpuid;
760 
761 		lwp_rb_tree_RB_REMOVE(&p->p_lwp_tree, lp);
762 		--p->p_nthreads;
763 		if ((p->p_flags & P_MAYBETHREADED) && p->p_nthreads <= 1)
764 			dowake = 1;
765 		lwkt_gettoken(&deadlwp_token[cpu]);
766 		LIST_INSERT_HEAD(&deadlwp_list[cpu], lp, u.lwp_reap_entry);
767 		taskqueue_enqueue(taskqueue_thread[cpu], deadlwp_task[cpu]);
768 		lwkt_reltoken(&deadlwp_token[cpu]);
769 	} else {
770 		--p->p_nthreads;
771 		if ((p->p_flags & P_MAYBETHREADED) && p->p_nthreads <= 1)
772 			dowake = 1;
773 	}
774 
775 	/*
776 	 * We no longer need p_token.
777 	 *
778 	 * Tell the userland scheduler that we are going away
779 	 */
780 	lwkt_reltoken(&p->p_token);
781 	p->p_usched->heuristic_exiting(lp, p);
782 
783 	/*
784 	 * Issue late wakeups after releasing our token to give us a chance
785 	 * to deschedule and switch away before another cpu in a wait*()
786 	 * reaps us.  This is done as late as possible to reduce contention.
787 	 */
788 	if (dowake)
789 		wakeup(&p->p_nthreads);
790 	if (waddr)
791 		wakeup(waddr);
792 
793 	cpu_lwp_exit();
794 }
795 
796 /*
797  * Wait until a lwp is completely dead.  The final interlock in this drama
798  * is when TDF_EXITING is set in cpu_thread_exit() just before the final
799  * switchout.
800  *
801  * At the point TDF_EXITING is set a complete exit is accomplished when
802  * TDF_RUNNING and TDF_PREEMPT_LOCK are both clear.  td_mpflags has two
803  * post-switch interlock flags that can be used to wait for the TDF_
804  * flags to clear.
805  *
806  * Returns non-zero on success, and zero if the caller needs to retry
807  * the lwp_wait().
808  */
809 static int
810 lwp_wait(struct lwp *lp)
811 {
812 	struct thread *td = lp->lwp_thread;
813 	u_int mpflags;
814 
815 	KKASSERT(lwkt_preempted_proc() != lp);
816 
817 	/*
818 	 * This bit of code uses the thread destruction interlock
819 	 * managed by lwkt_switch_return() to wait for the lwp's
820 	 * thread to completely disengage.
821 	 *
822 	 * It is possible for us to race another cpu core so we
823 	 * have to do this correctly.
824 	 */
825 	for (;;) {
826 		mpflags = td->td_mpflags;
827 		cpu_ccfence();
828 		if (mpflags & TDF_MP_EXITSIG)
829 			break;
830 		tsleep_interlock(td, 0);
831 		if (atomic_cmpset_int(&td->td_mpflags, mpflags,
832 				      mpflags | TDF_MP_EXITWAIT)) {
833 			tsleep(td, PINTERLOCKED, "lwpxt", 0);
834 		}
835 	}
836 
837 	/*
838 	 * We've already waited for the core exit but there can still
839 	 * be other refs from e.g. process scans and such.
840 	 */
841 	if (lp->lwp_lock > 0) {
842 		tsleep(lp, 0, "lwpwait1", 1);
843 		return(0);
844 	}
845 	if (td->td_refs) {
846 		tsleep(td, 0, "lwpwait2", 1);
847 		return(0);
848 	}
849 
850 	/*
851 	 * Now that we have the thread destruction interlock these flags
852 	 * really should already be cleaned up, keep a check for safety.
853 	 *
854 	 * We can't rip its stack out from under it until TDF_EXITING is
855 	 * set and both TDF_RUNNING and TDF_PREEMPT_LOCK are clear.
856 	 * TDF_PREEMPT_LOCK must be checked because TDF_RUNNING
857 	 * will be cleared temporarily if a thread gets preempted.
858 	 */
859 	while ((td->td_flags & (TDF_RUNNING |
860 				TDF_RUNQ |
861 			        TDF_PREEMPT_LOCK |
862 			        TDF_EXITING)) != TDF_EXITING) {
863 		tsleep(lp, 0, "lwpwait3", 1);
864 		return (0);
865 	}
866 
867 	KASSERT((td->td_flags & (TDF_RUNQ|TDF_TSLEEPQ)) == 0,
868 		("lwp_wait: td %p (%s) still on run or sleep queue",
869 		td, td->td_comm));
870 	return (1);
871 }
872 
873 /*
874  * Release the resources associated with a lwp.
875  * The lwp must be completely dead.
876  */
877 void
878 lwp_dispose(struct lwp *lp)
879 {
880 	struct thread *td = lp->lwp_thread;
881 
882 	KKASSERT(lwkt_preempted_proc() != lp);
883 	KKASSERT(lp->lwp_lock == 0);
884 	KKASSERT(td->td_refs == 0);
885 	KKASSERT((td->td_flags & (TDF_RUNNING |
886 				  TDF_RUNQ |
887 				  TDF_PREEMPT_LOCK |
888 				  TDF_EXITING)) == TDF_EXITING);
889 
890 	PRELE(lp->lwp_proc);
891 	lp->lwp_proc = NULL;
892 	if (td != NULL) {
893 		td->td_proc = NULL;
894 		td->td_lwp = NULL;
895 		lp->lwp_thread = NULL;
896 		lwkt_free_thread(td);
897 	}
898 	kfree(lp, M_LWP);
899 }
900 
901 int
902 sys_wait4(struct wait_args *uap)
903 {
904 	struct __wrusage wrusage;
905 	int error;
906 	int status;
907 	int options;
908 	id_t id;
909 	idtype_t idtype;
910 
911 	options = uap->options | WEXITED | WTRAPPED;
912 	id = uap->pid;
913 
914 	if (id == WAIT_ANY) {
915 		idtype = P_ALL;
916 	} else if (id == WAIT_MYPGRP) {
917 		idtype = P_PGID;
918 		id = curproc->p_pgid;
919 	} else if (id < 0) {
920 		idtype = P_PGID;
921 		id = -id;
922 	} else {
923 		idtype = P_PID;
924 	}
925 
926 	error = kern_wait(idtype, id, &status, options, &wrusage,
927 			  NULL, &uap->sysmsg_result);
928 
929 	if (error == 0 && uap->status)
930 		error = copyout(&status, uap->status, sizeof(*uap->status));
931 	if (error == 0 && uap->rusage) {
932 		ruadd(&wrusage.wru_self, &wrusage.wru_children);
933 		error = copyout(&wrusage.wru_self, uap->rusage, sizeof(*uap->rusage));
934 	}
935 	return (error);
936 }
937 
938 int
939 sys_wait6(struct wait6_args *uap)
940 {
941 	struct __wrusage wrusage;
942 	siginfo_t info;
943 	siginfo_t *infop;
944 	int error;
945 	int status;
946 	int options;
947 	id_t id;
948 	idtype_t idtype;
949 
950 	/*
951 	 * NOTE: wait6() requires WEXITED and WTRAPPED to be specified if
952 	 *	 desired.
953 	 */
954 	options = uap->options;
955 	idtype = uap->idtype;
956 	id = uap->id;
957 	infop = uap->info ? &info : NULL;
958 
959 	switch(idtype) {
960 	case P_PID:
961 	case P_PGID:
962 		if (id == WAIT_MYPGRP) {
963 			idtype = P_PGID;
964 			id = curproc->p_pgid;
965 		}
966 		break;
967 	default:
968 		/* let kern_wait deal with the remainder */
969 		break;
970 	}
971 
972 	error = kern_wait(idtype, id, &status, options,
973 			  &wrusage, infop, &uap->sysmsg_result);
974 
975 	if (error == 0 && uap->status)
976 		error = copyout(&status, uap->status, sizeof(*uap->status));
977 	if (error == 0 && uap->wrusage)
978 		error = copyout(&wrusage, uap->wrusage, sizeof(*uap->wrusage));
979 	if (error == 0 && uap->info)
980 		error = copyout(&info, uap->info, sizeof(*uap->info));
981 	return (error);
982 }
983 
984 /*
985  * kernel wait*() system call support
986  */
987 int
988 kern_wait(idtype_t idtype, id_t id, int *status, int options,
989 	  struct __wrusage *wrusage, siginfo_t *info, int *res)
990 {
991 	struct thread *td = curthread;
992 	struct lwp *lp;
993 	struct proc *q = td->td_proc;
994 	struct proc *p, *t;
995 	struct ucred *cr;
996 	struct pargs *pa;
997 	struct sigacts *ps;
998 	int nfound, error;
999 	long waitgen;
1000 
1001 	/*
1002 	 * Must not have extraneous options.  Must have at least one
1003 	 * matchable option.
1004 	 */
1005 	if (options &~ (WUNTRACED|WNOHANG|WCONTINUED|WLINUXCLONE|WSTOPPED|
1006 			WEXITED|WTRAPPED|WNOWAIT)) {
1007 		return (EINVAL);
1008 	}
1009 	if ((options & (WEXITED | WUNTRACED | WCONTINUED | WTRAPPED)) == 0) {
1010 		return (EINVAL);
1011 	}
1012 
1013 	/*
1014 	 * Protect the q->p_children list
1015 	 */
1016 	lwkt_gettoken(&q->p_token);
1017 loop:
1018 	/*
1019 	 * All sorts of things can change due to blocking so we have to loop
1020 	 * all the way back up here.
1021 	 *
1022 	 * The problem is that if a process group is stopped and the parent
1023 	 * is doing a wait*(..., WUNTRACED, ...), it will see the STOP
1024 	 * of the child and then stop itself when it tries to return from the
1025 	 * system call.  When the process group is resumed the parent will
1026 	 * then get the STOP status even though the child has now resumed
1027 	 * (a followup wait*() will get the CONT status).
1028 	 *
1029 	 * Previously the CONT would overwrite the STOP because the tstop
1030 	 * was handled within tsleep(), and the parent would only see
1031 	 * the CONT when both are stopped and continued together.  This little
1032 	 * two-line hack restores this effect.
1033 	 *
1034 	 * No locks are held so we can safely block the process here.
1035 	 */
1036 	if (STOPLWP(q, td->td_lwp))
1037             tstop();
1038 
1039 	nfound = 0;
1040 
1041 	/*
1042 	 * Loop on children.
1043 	 *
1044 	 * NOTE: We don't want to break q's p_token in the loop for the
1045 	 *	 case where no children are found or we risk breaking the
1046 	 *	 interlock between child and parent.
1047 	 */
1048 	waitgen = atomic_fetchadd_long(&q->p_waitgen, 0x80000000);
1049 	LIST_FOREACH(p, &q->p_children, p_sibling) {
1050 		/*
1051 		 * Skip children that another thread is already uninterruptably
1052 		 * reaping.
1053 		 */
1054 		if (PWAITRES_PENDING(p))
1055 			continue;
1056 
1057 		/*
1058 		 * Filter, (p) will be held on fall-through.  Try to optimize
1059 		 * this to avoid the atomic op until we are pretty sure we
1060 		 * want this process.
1061 		 */
1062 		switch(idtype) {
1063 		case P_ALL:
1064 			PHOLD(p);
1065 			break;
1066 		case P_PID:
1067 			if (p->p_pid != (pid_t)id)
1068 				continue;
1069 			PHOLD(p);
1070 			break;
1071 		case P_PGID:
1072 			if (p->p_pgid != (pid_t)id)
1073 				continue;
1074 			PHOLD(p);
1075 			break;
1076 		case P_SID:
1077 			PHOLD(p);
1078 			if (p->p_session && p->p_session->s_sid != (pid_t)id) {
1079 				PRELE(p);
1080 				continue;
1081 			}
1082 			break;
1083 		case P_UID:
1084 			PHOLD(p);
1085 			if (p->p_ucred->cr_uid != (uid_t)id) {
1086 				PRELE(p);
1087 				continue;
1088 			}
1089 			break;
1090 		case P_GID:
1091 			PHOLD(p);
1092 			if (p->p_ucred->cr_gid != (gid_t)id) {
1093 				PRELE(p);
1094 				continue;
1095 			}
1096 			break;
1097 		case P_JAILID:
1098 			PHOLD(p);
1099 			if (p->p_ucred->cr_prison &&
1100 			    p->p_ucred->cr_prison->pr_id != (int)id) {
1101 				PRELE(p);
1102 				continue;
1103 			}
1104 			break;
1105 		default:
1106 			/* unsupported filter */
1107 			continue;
1108 		}
1109 		/* (p) is held at this point */
1110 
1111 		/*
1112 		 * This special case handles a kthread spawned by linux_clone
1113 		 * (see linux_misc.c).  The linux_wait4 and linux_waitpid
1114 		 * functions need to be able to distinguish between waiting
1115 		 * on a process and waiting on a thread.  It is a thread if
1116 		 * p_sigparent is not SIGCHLD, and the WLINUXCLONE option
1117 		 * signifies we want to wait for threads and not processes.
1118 		 */
1119 		if ((p->p_sigparent != SIGCHLD) ^
1120 		    ((options & WLINUXCLONE) != 0)) {
1121 			PRELE(p);
1122 			continue;
1123 		}
1124 
1125 		nfound++;
1126 		if (p->p_stat == SZOMB && (options & WEXITED)) {
1127 			/*
1128 			 * We may go into SZOMB with threads still present.
1129 			 * We must wait for them to exit before we can reap
1130 			 * the master thread, otherwise we may race reaping
1131 			 * non-master threads.
1132 			 *
1133 			 * Only this routine can remove a process from
1134 			 * the zombie list and destroy it.
1135 			 *
1136 			 * This function will fail after sleeping if another
1137 			 * thread owns the zombie lock.  This function will
1138 			 * fail immediately or after sleeping if another
1139 			 * thread owns or obtains ownership of the reap via
1140 			 * WAITRES.
1141 			 */
1142 			if (PHOLDZOMB(p)) {
1143 				PRELE(p);
1144 				goto loop;
1145 			}
1146 			lwkt_gettoken(&p->p_token);
1147 			if (p->p_pptr != q) {
1148 				lwkt_reltoken(&p->p_token);
1149 				PRELE(p);
1150 				PRELEZOMB(p);
1151 				goto loop;
1152 			}
1153 
1154 			/*
1155 			 * We are the reaper, from this point on the reap
1156 			 * cannot be aborted.
1157 			 */
1158 			PWAITRES_SET(p);
1159 			while (p->p_nthreads > 0) {
1160 				tsleep(&p->p_nthreads, 0, "lwpzomb", hz);
1161 			}
1162 
1163 			/*
1164 			 * Reap any LWPs left in p->p_lwps.  This is usually
1165 			 * just the last LWP.  This must be done before
1166 			 * we loop on p_lock since the lwps hold a ref on
1167 			 * it as a vmspace interlock.
1168 			 *
1169 			 * Once that is accomplished p_nthreads had better
1170 			 * be zero.
1171 			 */
1172 			while ((lp = RB_ROOT(&p->p_lwp_tree)) != NULL) {
1173 				/*
1174 				 * Make sure no one is using this lwp, before
1175 				 * it is removed from the tree.  If we didn't
1176 				 * wait it here, lwp tree iteration with
1177 				 * blocking operation would be broken.
1178 				 */
1179 				while (lp->lwp_lock > 0)
1180 					tsleep(lp, 0, "zomblwp", 1);
1181 				lwp_rb_tree_RB_REMOVE(&p->p_lwp_tree, lp);
1182 				reaplwp(lp);
1183 			}
1184 			KKASSERT(p->p_nthreads == 0);
1185 
1186 			/*
1187 			 * Don't do anything really bad until all references
1188 			 * to the process go away.  This may include other
1189 			 * LWPs which are still in the process of being
1190 			 * reaped.  We can't just pull the rug out from under
1191 			 * them because they may still be using the VM space.
1192 			 *
1193 			 * Certain kernel facilities such as /proc will also
1194 			 * put a hold on the process for short periods of
1195 			 * time.
1196 			 */
1197 			PRELE(p);		/* from top of loop */
1198 			PSTALL(p, "reap3", 1);	/* 1 ref (for PZOMBHOLD) */
1199 
1200 			/* Take care of our return values. */
1201 			*res = p->p_pid;
1202 
1203 			*status = p->p_xstat;
1204 			wrusage->wru_self = p->p_ru;
1205 			wrusage->wru_children = p->p_cru;
1206 
1207 			if (info) {
1208 				bzero(info, sizeof(*info));
1209 				info->si_errno = 0;
1210 				info->si_signo = SIGCHLD;
1211 				if (WIFEXITED(p->p_xstat)) {
1212 					info->si_code = CLD_EXITED;
1213 					info->si_status =
1214 						WEXITSTATUS(p->p_xstat);
1215 				} else {
1216 					info->si_code = CLD_KILLED;
1217 					info->si_status = WTERMSIG(p->p_xstat);
1218 				}
1219 				info->si_pid = p->p_pid;
1220 				info->si_uid = p->p_ucred->cr_uid;
1221 			}
1222 
1223 			/*
1224 			 * WNOWAIT shortcuts to done here, leaving the
1225 			 * child on the zombie list.
1226 			 */
1227 			if (options & WNOWAIT) {
1228 				lwkt_reltoken(&p->p_token);
1229 				PRELEZOMB(p);
1230 				error = 0;
1231 				goto done;
1232 			}
1233 
1234 			/*
1235 			 * If we got the child via a ptrace 'attach',
1236 			 * we need to give it back to the old parent.
1237 			 */
1238 			if (p->p_oppid && (t = pfind(p->p_oppid)) != NULL) {
1239 				p->p_oppid = 0;
1240 				proc_reparent(p, t);
1241 				ksignal(t, SIGCHLD);
1242 				wakeup((caddr_t)t);
1243 				PRELE(t);
1244 				lwkt_reltoken(&p->p_token);
1245 				PRELEZOMB(p);
1246 				error = 0;
1247 				goto done;
1248 			}
1249 
1250 			/*
1251 			 * Unlink the proc from its process group so that
1252 			 * the following operations won't lead to an
1253 			 * inconsistent state for processes running down
1254 			 * the zombie list.
1255 			 */
1256 			proc_remove_zombie(p);
1257 			proc_userunmap(p);
1258 			lwkt_reltoken(&p->p_token);
1259 			leavepgrp(p);
1260 
1261 			p->p_xstat = 0;
1262 			ruadd(&q->p_cru, &p->p_ru);
1263 			ruadd(&q->p_cru, &p->p_cru);
1264 
1265 			/*
1266 			 * Decrement the count of procs running with this uid.
1267 			 */
1268 			chgproccnt(p->p_ucred->cr_ruidinfo, -1, 0);
1269 
1270 			/*
1271 			 * Free up credentials.  p_spin is required to
1272 			 * avoid races against allproc scans.
1273 			 */
1274 			spin_lock(&p->p_spin);
1275 			cr = p->p_ucred;
1276 			p->p_ucred = NULL;
1277 			spin_unlock(&p->p_spin);
1278 			crfree(cr);
1279 
1280 			/*
1281 			 * Remove unused arguments
1282 			 */
1283 			pa = p->p_args;
1284 			p->p_args = NULL;
1285 			if (pa && refcount_release(&pa->ar_ref)) {
1286 				kfree(pa, M_PARGS);
1287 				pa = NULL;
1288 			}
1289 
1290 			ps = p->p_sigacts;
1291 			p->p_sigacts = NULL;
1292 			if (ps && refcount_release(&ps->ps_refcnt)) {
1293 				kfree(ps, M_SUBPROC);
1294 				ps = NULL;
1295 			}
1296 
1297 			/*
1298 			 * Our exitingcount was incremented when the process
1299 			 * became a zombie, now that the process has been
1300 			 * removed from (almost) all lists we should be able
1301 			 * to safely destroy its vmspace.  Wait for any current
1302 			 * holders to go away (so the vmspace remains stable),
1303 			 * then scrap it.
1304 			 *
1305 			 * NOTE: Releasing the parent process (q) p_token
1306 			 *	 across the vmspace_exitfree() call is
1307 			 *	 important here to reduce stalls on
1308 			 *	 interactions with (q) (such as
1309 			 *	 fork/exec/wait or 'ps').
1310 			 */
1311 			PSTALL(p, "reap4", 1);
1312 			lwkt_reltoken(&q->p_token);
1313 			vmspace_exitfree(p);
1314 			lwkt_gettoken(&q->p_token);
1315 			PSTALL(p, "reap5", 1);
1316 
1317 			/*
1318 			 * NOTE: We have to officially release ZOMB in order
1319 			 *	 to ensure that a racing thread in kern_wait()
1320 			 *	 which blocked on ZOMB is woken up.
1321 			 */
1322 			PRELEZOMB(p);
1323 			kfree(p->p_uidpcpu, M_SUBPROC);
1324 			kfree(p, M_PROC);
1325 			atomic_add_int(&nprocs, -1);
1326 			error = 0;
1327 			goto done;
1328 		}
1329 
1330 		/*
1331 		 * Process has not yet exited
1332 		 */
1333 		if ((p->p_stat == SSTOP || p->p_stat == SCORE) &&
1334 		    (p->p_flags & P_WAITED) == 0 &&
1335 		    (((p->p_flags & P_TRACED) && (options & WTRAPPED)) ||
1336 		     (options & WSTOPPED))) {
1337 			lwkt_gettoken(&p->p_token);
1338 			if (p->p_pptr != q) {
1339 				lwkt_reltoken(&p->p_token);
1340 				PRELE(p);
1341 				goto loop;
1342 			}
1343 			if ((p->p_stat != SSTOP && p->p_stat != SCORE) ||
1344 			    (p->p_flags & P_WAITED) != 0 ||
1345 			    ((p->p_flags & P_TRACED) == 0 &&
1346 			     (options & WUNTRACED) == 0)) {
1347 				lwkt_reltoken(&p->p_token);
1348 				PRELE(p);
1349 				goto loop;
1350 			}
1351 
1352 			/*
1353 			 * Don't set P_WAITED if WNOWAIT specified, leaving
1354 			 * the process in a waitable state.
1355 			 */
1356 			if ((options & WNOWAIT) == 0)
1357 				p->p_flags |= P_WAITED;
1358 
1359 			*res = p->p_pid;
1360 			*status = W_STOPCODE(p->p_xstat);
1361 			/* Zero rusage so we get something consistent. */
1362 			bzero(wrusage, sizeof(*wrusage));
1363 			error = 0;
1364 			if (info) {
1365 				bzero(info, sizeof(*info));
1366 				if (p->p_flags & P_TRACED)
1367 					info->si_code = CLD_TRAPPED;
1368 				else
1369 					info->si_code = CLD_STOPPED;
1370 				info->si_status = WSTOPSIG(p->p_xstat);
1371 			}
1372 			lwkt_reltoken(&p->p_token);
1373 			PRELE(p);
1374 			goto done;
1375 		}
1376 		if ((options & WCONTINUED) && (p->p_flags & P_CONTINUED)) {
1377 			lwkt_gettoken(&p->p_token);
1378 			if (p->p_pptr != q) {
1379 				lwkt_reltoken(&p->p_token);
1380 				PRELE(p);
1381 				goto loop;
1382 			}
1383 			if ((p->p_flags & P_CONTINUED) == 0) {
1384 				lwkt_reltoken(&p->p_token);
1385 				PRELE(p);
1386 				goto loop;
1387 			}
1388 
1389 			*res = p->p_pid;
1390 
1391 			/*
1392 			 * Don't set P_WAITED if WNOWAIT specified, leaving
1393 			 * the process in a waitable state.
1394 			 */
1395 			if ((options & WNOWAIT) == 0)
1396 				p->p_flags &= ~P_CONTINUED;
1397 
1398 			*status = SIGCONT;
1399 			error = 0;
1400 			if (info) {
1401 				bzero(info, sizeof(*info));
1402 				info->si_code = CLD_CONTINUED;
1403 				info->si_status = WSTOPSIG(p->p_xstat);
1404 			}
1405 			lwkt_reltoken(&p->p_token);
1406 			PRELE(p);
1407 			goto done;
1408 		}
1409 		PRELE(p);
1410 	}
1411 	if (nfound == 0) {
1412 		error = ECHILD;
1413 		goto done;
1414 	}
1415 	if (options & WNOHANG) {
1416 		*res = 0;
1417 		error = 0;
1418 		goto done;
1419 	}
1420 
1421 	/*
1422 	 * Wait for signal - interlocked using q->p_waitgen.
1423 	 */
1424 	error = 0;
1425 	while ((waitgen & 0x7FFFFFFF) == (q->p_waitgen & 0x7FFFFFFF)) {
1426 		tsleep_interlock(q, PCATCH);
1427 		waitgen = atomic_fetchadd_long(&q->p_waitgen, 0x80000000);
1428 		if ((waitgen & 0x7FFFFFFF) == (q->p_waitgen & 0x7FFFFFFF)) {
1429 			error = tsleep(q, PCATCH | PINTERLOCKED, "wait", 0);
1430 			break;
1431 		}
1432 	}
1433 	if (error) {
1434 done:
1435 		lwkt_reltoken(&q->p_token);
1436 		return (error);
1437 	}
1438 	goto loop;
1439 }
1440 
1441 /*
1442  * Change child's parent process to parent.
1443  *
1444  * p_children/p_sibling requires the parent's token, and
1445  * changing pptr requires the child's token, so we have to
1446  * get three tokens to do this operation.  We also need to
1447  * hold pointers that might get ripped out from under us to
1448  * preserve structural integrity.
1449  *
1450  * It is possible to race another reparent or disconnect or other
1451  * similar operation.  We must retry when this situation occurs.
1452  * Once we successfully reparent the process we no longer care
1453  * about any races.
1454  */
1455 void
1456 proc_reparent(struct proc *child, struct proc *parent)
1457 {
1458 	struct proc *opp;
1459 
1460 	PHOLD(parent);
1461 	while ((opp = child->p_pptr) != parent) {
1462 		PHOLD(opp);
1463 		lwkt_gettoken(&opp->p_token);
1464 		lwkt_gettoken(&child->p_token);
1465 		lwkt_gettoken(&parent->p_token);
1466 		if (child->p_pptr != opp) {
1467 			lwkt_reltoken(&parent->p_token);
1468 			lwkt_reltoken(&child->p_token);
1469 			lwkt_reltoken(&opp->p_token);
1470 			PRELE(opp);
1471 			continue;
1472 		}
1473 		LIST_REMOVE(child, p_sibling);
1474 		LIST_INSERT_HEAD(&parent->p_children, child, p_sibling);
1475 		child->p_pptr = parent;
1476 		child->p_ppid = parent->p_pid;
1477 		lwkt_reltoken(&parent->p_token);
1478 		lwkt_reltoken(&child->p_token);
1479 		lwkt_reltoken(&opp->p_token);
1480 		if (LIST_EMPTY(&opp->p_children))
1481 			wakeup(opp);
1482 		PRELE(opp);
1483 		break;
1484 	}
1485 	PRELE(parent);
1486 }
1487 
1488 /*
1489  * The next two functions are to handle adding/deleting items on the
1490  * exit callout list
1491  *
1492  * at_exit():
1493  * Take the arguments given and put them onto the exit callout list,
1494  * However first make sure that it's not already there.
1495  * returns 0 on success.
1496  */
1497 
1498 int
1499 at_exit(exitlist_fn function)
1500 {
1501 	struct exitlist *ep;
1502 
1503 #ifdef INVARIANTS
1504 	/* Be noisy if the programmer has lost track of things */
1505 	if (rm_at_exit(function))
1506 		kprintf("WARNING: exit callout entry (%p) already present\n",
1507 		    function);
1508 #endif
1509 	ep = kmalloc(sizeof(*ep), M_ATEXIT, M_NOWAIT);
1510 	if (ep == NULL)
1511 		return (ENOMEM);
1512 	ep->function = function;
1513 	TAILQ_INSERT_TAIL(&exit_list, ep, next);
1514 	return (0);
1515 }
1516 
1517 /*
1518  * Scan the exit callout list for the given item and remove it.
1519  * Returns the number of items removed (0 or 1)
1520  */
1521 int
1522 rm_at_exit(exitlist_fn function)
1523 {
1524 	struct exitlist *ep;
1525 
1526 	TAILQ_FOREACH(ep, &exit_list, next) {
1527 		if (ep->function == function) {
1528 			TAILQ_REMOVE(&exit_list, ep, next);
1529 			kfree(ep, M_ATEXIT);
1530 			return(1);
1531 		}
1532 	}
1533 	return (0);
1534 }
1535 
1536 /*
1537  * LWP reaper related code.
1538  */
1539 static void
1540 reaplwps(void *context, int dummy)
1541 {
1542 	struct lwplist *lwplist = context;
1543 	struct lwp *lp;
1544 	int cpu = mycpuid;
1545 
1546 	lwkt_gettoken(&deadlwp_token[cpu]);
1547 	while ((lp = LIST_FIRST(lwplist))) {
1548 		LIST_REMOVE(lp, u.lwp_reap_entry);
1549 		reaplwp(lp);
1550 	}
1551 	lwkt_reltoken(&deadlwp_token[cpu]);
1552 }
1553 
1554 static void
1555 reaplwp(struct lwp *lp)
1556 {
1557 	while (lwp_wait(lp) == 0)
1558 		;
1559 	lwp_dispose(lp);
1560 }
1561 
1562 static void
1563 deadlwp_init(void)
1564 {
1565 	int cpu;
1566 
1567 	for (cpu = 0; cpu < ncpus; cpu++) {
1568 		lwkt_token_init(&deadlwp_token[cpu], "deadlwpl");
1569 		LIST_INIT(&deadlwp_list[cpu]);
1570 		deadlwp_task[cpu] = kmalloc(sizeof(*deadlwp_task[cpu]),
1571 					    M_DEVBUF, M_WAITOK);
1572 		TASK_INIT(deadlwp_task[cpu], 0, reaplwps, &deadlwp_list[cpu]);
1573 	}
1574 }
1575 
1576 SYSINIT(deadlwpinit, SI_SUB_CONFIGURE, SI_ORDER_ANY, deadlwp_init, NULL);
1577