xref: /dflybsd-src/sys/kern/kern_exit.c (revision b817bc49962aa12ba79f3216358895ff8dd6778f)
1 /*
2  * Copyright (c) 1982, 1986, 1989, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *	@(#)kern_exit.c	8.7 (Berkeley) 2/12/94
35  * $FreeBSD: src/sys/kern/kern_exit.c,v 1.92.2.11 2003/01/13 22:51:16 dillon Exp $
36  */
37 
38 #include "opt_compat.h"
39 #include "opt_ktrace.h"
40 
41 #include <sys/param.h>
42 #include <sys/systm.h>
43 #include <sys/sysproto.h>
44 #include <sys/kernel.h>
45 #include <sys/malloc.h>
46 #include <sys/proc.h>
47 #include <sys/ktrace.h>
48 #include <sys/pioctl.h>
49 #include <sys/tty.h>
50 #include <sys/wait.h>
51 #include <sys/vnode.h>
52 #include <sys/resourcevar.h>
53 #include <sys/signalvar.h>
54 #include <sys/taskqueue.h>
55 #include <sys/ptrace.h>
56 #include <sys/acct.h>		/* for acct_process() function prototype */
57 #include <sys/filedesc.h>
58 #include <sys/shm.h>
59 #include <sys/sem.h>
60 #include <sys/jail.h>
61 #include <sys/kern_syscall.h>
62 #include <sys/unistd.h>
63 #include <sys/eventhandler.h>
64 #include <sys/dsched.h>
65 
66 #include <vm/vm.h>
67 #include <vm/vm_param.h>
68 #include <sys/lock.h>
69 #include <vm/pmap.h>
70 #include <vm/vm_map.h>
71 #include <vm/vm_extern.h>
72 #include <sys/user.h>
73 
74 #include <sys/refcount.h>
75 #include <sys/thread2.h>
76 #include <sys/sysref2.h>
77 #include <sys/mplock2.h>
78 
79 #include <machine/vmm.h>
80 
81 static void reaplwps(void *context, int dummy);
82 static void reaplwp(struct lwp *lp);
83 static void killlwps(struct lwp *lp);
84 
85 static MALLOC_DEFINE(M_ATEXIT, "atexit", "atexit callback");
86 
87 /*
88  * callout list for things to do at exit time
89  */
90 struct exitlist {
91 	exitlist_fn function;
92 	TAILQ_ENTRY(exitlist) next;
93 };
94 
95 TAILQ_HEAD(exit_list_head, exitlist);
96 static struct exit_list_head exit_list = TAILQ_HEAD_INITIALIZER(exit_list);
97 
98 /*
99  * LWP reaper data
100  */
101 static struct task *deadlwp_task[MAXCPU];
102 static struct lwplist deadlwp_list[MAXCPU];
103 static struct lwkt_token deadlwp_token[MAXCPU];
104 
105 /*
106  * exit --
107  *	Death of process.
108  *
109  * SYS_EXIT_ARGS(int rval)
110  */
111 int
112 sys_exit(struct exit_args *uap)
113 {
114 	exit1(W_EXITCODE(uap->rval, 0));
115 	/* NOTREACHED */
116 }
117 
118 /*
119  * Extended exit --
120  *	Death of a lwp or process with optional bells and whistles.
121  */
122 int
123 sys_extexit(struct extexit_args *uap)
124 {
125 	struct proc *p = curproc;
126 	int action, who;
127 	int error;
128 
129 	action = EXTEXIT_ACTION(uap->how);
130 	who = EXTEXIT_WHO(uap->how);
131 
132 	/* Check parameters before we might perform some action */
133 	switch (who) {
134 	case EXTEXIT_PROC:
135 	case EXTEXIT_LWP:
136 		break;
137 	default:
138 		return (EINVAL);
139 	}
140 
141 	switch (action) {
142 	case EXTEXIT_SIMPLE:
143 		break;
144 	case EXTEXIT_SETINT:
145 		error = copyout(&uap->status, uap->addr, sizeof(uap->status));
146 		if (error)
147 			return (error);
148 		break;
149 	default:
150 		return (EINVAL);
151 	}
152 
153 	lwkt_gettoken(&p->p_token);
154 
155 	switch (who) {
156 	case EXTEXIT_LWP:
157 		/*
158 		 * Be sure only to perform a simple lwp exit if there is at
159 		 * least one more lwp in the proc, which will call exit1()
160 		 * later, otherwise the proc will be an UNDEAD and not even a
161 		 * SZOMB!
162 		 */
163 		if (p->p_nthreads > 1) {
164 			lwp_exit(0, NULL);	/* called w/ p_token held */
165 			/* NOT REACHED */
166 		}
167 		/* else last lwp in proc:  do the real thing */
168 		/* FALLTHROUGH */
169 	default:	/* to help gcc */
170 	case EXTEXIT_PROC:
171 		lwkt_reltoken(&p->p_token);
172 		exit1(W_EXITCODE(uap->status, 0));
173 		/* NOTREACHED */
174 	}
175 
176 	/* NOTREACHED */
177 	lwkt_reltoken(&p->p_token);	/* safety */
178 }
179 
180 /*
181  * Kill all lwps associated with the current process except the
182  * current lwp.   Return an error if we race another thread trying to
183  * do the same thing and lose the race.
184  *
185  * If forexec is non-zero the current thread and process flags are
186  * cleaned up so they can be reused.
187  *
188  * Caller must hold curproc->p_token
189  */
190 int
191 killalllwps(int forexec)
192 {
193 	struct lwp *lp = curthread->td_lwp;
194 	struct proc *p = lp->lwp_proc;
195 
196 	/*
197 	 * Interlock against P_WEXIT.  Only one of the process's thread
198 	 * is allowed to do the master exit.
199 	 */
200 	if (p->p_flags & P_WEXIT)
201 		return (EALREADY);
202 	p->p_flags |= P_WEXIT;
203 
204 	/*
205 	 * Interlock with LWP_MP_WEXIT and kill any remaining LWPs
206 	 */
207 	atomic_set_int(&lp->lwp_mpflags, LWP_MP_WEXIT);
208 	if (p->p_nthreads > 1)
209 		killlwps(lp);
210 
211 	/*
212 	 * If doing this for an exec, clean up the remaining thread
213 	 * (us) for continuing operation after all the other threads
214 	 * have been killed.
215 	 */
216 	if (forexec) {
217 		atomic_clear_int(&lp->lwp_mpflags, LWP_MP_WEXIT);
218 		p->p_flags &= ~P_WEXIT;
219 	}
220 	return(0);
221 }
222 
223 /*
224  * Kill all LWPs except the current one.  Do not try to signal
225  * LWPs which have exited on their own or have already been
226  * signaled.
227  */
228 static void
229 killlwps(struct lwp *lp)
230 {
231 	struct proc *p = lp->lwp_proc;
232 	struct lwp *tlp;
233 
234 	/*
235 	 * Kill the remaining LWPs.  We must send the signal before setting
236 	 * LWP_MP_WEXIT.  The setting of WEXIT is optional but helps reduce
237 	 * races.  tlp must be held across the call as it might block and
238 	 * allow the target lwp to rip itself out from under our loop.
239 	 */
240 	FOREACH_LWP_IN_PROC(tlp, p) {
241 		LWPHOLD(tlp);
242 		lwkt_gettoken(&tlp->lwp_token);
243 		if ((tlp->lwp_mpflags & LWP_MP_WEXIT) == 0) {
244 			lwpsignal(p, tlp, SIGKILL);
245 			atomic_set_int(&tlp->lwp_mpflags, LWP_MP_WEXIT);
246 		}
247 		lwkt_reltoken(&tlp->lwp_token);
248 		LWPRELE(tlp);
249 	}
250 
251 	/*
252 	 * Wait for everything to clear out.
253 	 */
254 	while (p->p_nthreads > 1)
255 		tsleep(&p->p_nthreads, 0, "killlwps", 0);
256 }
257 
258 /*
259  * Exit: deallocate address space and other resources, change proc state
260  * to zombie, and unlink proc from allproc and parent's lists.  Save exit
261  * status and rusage for wait().  Check for child processes and orphan them.
262  */
263 void
264 exit1(int rv)
265 {
266 	struct thread *td = curthread;
267 	struct proc *p = td->td_proc;
268 	struct lwp *lp = td->td_lwp;
269 	struct proc *q;
270 	struct proc *pp;
271 	struct vmspace *vm;
272 	struct vnode *vtmp;
273 	struct exitlist *ep;
274 	int error;
275 
276 	lwkt_gettoken(&p->p_token);
277 
278 	if (p->p_pid == 1) {
279 		kprintf("init died (signal %d, exit %d)\n",
280 		    WTERMSIG(rv), WEXITSTATUS(rv));
281 		panic("Going nowhere without my init!");
282 	}
283 	varsymset_clean(&p->p_varsymset);
284 	lockuninit(&p->p_varsymset.vx_lock);
285 
286 	/*
287 	 * Kill all lwps associated with the current process, return an
288 	 * error if we race another thread trying to do the same thing
289 	 * and lose the race.
290 	 */
291 	error = killalllwps(0);
292 	if (error) {
293 		lwp_exit(0, NULL);
294 		/* NOT REACHED */
295 	}
296 
297 	/* are we a task leader? */
298 	if (p == p->p_leader) {
299         	struct kill_args killArgs;
300 		killArgs.signum = SIGKILL;
301 		q = p->p_peers;
302 		while(q) {
303 			killArgs.pid = q->p_pid;
304 			/*
305 		         * The interface for kill is better
306 			 * than the internal signal
307 			 */
308 			sys_kill(&killArgs);
309 			q = q->p_peers;
310 		}
311 		while (p->p_peers)
312 			tsleep((caddr_t)p, 0, "exit1", 0);
313 	}
314 
315 #ifdef PGINPROF
316 	vmsizmon();
317 #endif
318 	STOPEVENT(p, S_EXIT, rv);
319 	p->p_flags |= P_POSTEXIT;	/* stop procfs stepping */
320 
321 	/*
322 	 * Check if any loadable modules need anything done at process exit.
323 	 * e.g. SYSV IPC stuff
324 	 * XXX what if one of these generates an error?
325 	 */
326 	p->p_xstat = rv;
327 	EVENTHANDLER_INVOKE(process_exit, p);
328 
329 	/*
330 	 * XXX: imho, the eventhandler stuff is much cleaner than this.
331 	 *	Maybe we should move everything to use eventhandler.
332 	 */
333 	TAILQ_FOREACH(ep, &exit_list, next)
334 		(*ep->function)(td);
335 
336 	if (p->p_flags & P_PROFIL)
337 		stopprofclock(p);
338 
339 	SIGEMPTYSET(p->p_siglist);
340 	SIGEMPTYSET(lp->lwp_siglist);
341 	if (timevalisset(&p->p_realtimer.it_value))
342 		callout_stop_sync(&p->p_ithandle);
343 
344 	/*
345 	 * Reset any sigio structures pointing to us as a result of
346 	 * F_SETOWN with our pid.
347 	 */
348 	funsetownlst(&p->p_sigiolst);
349 
350 	/*
351 	 * Close open files and release open-file table.
352 	 * This may block!
353 	 */
354 	fdfree(p, NULL);
355 
356 	if (p->p_leader->p_peers) {
357 		q = p->p_leader;
358 		while(q->p_peers != p)
359 			q = q->p_peers;
360 		q->p_peers = p->p_peers;
361 		wakeup((caddr_t)p->p_leader);
362 	}
363 
364 	/*
365 	 * XXX Shutdown SYSV semaphores
366 	 */
367 	semexit(p);
368 
369 	KKASSERT(p->p_numposixlocks == 0);
370 
371 	/* The next two chunks should probably be moved to vmspace_exit. */
372 	vm = p->p_vmspace;
373 
374 	/*
375 	 * Clean up data related to virtual kernel operation.  Clean up
376 	 * any vkernel context related to the current lwp now so we can
377 	 * destroy p_vkernel.
378 	 */
379 	if (p->p_vkernel) {
380 		vkernel_lwp_exit(lp);
381 		vkernel_exit(p);
382 	}
383 
384 	/*
385 	 * Release the user portion of address space.  The exitbump prevents
386 	 * the vmspace from being completely eradicated (using holdcnt).
387 	 * This releases references to vnodes, which could cause I/O if the
388 	 * file has been unlinked.  We need to do this early enough that
389 	 * we can still sleep.
390 	 *
391 	 * We can't free the entire vmspace as the kernel stack may be mapped
392 	 * within that space also.
393 	 *
394 	 * Processes sharing the same vmspace may exit in one order, and
395 	 * get cleaned up by vmspace_exit() in a different order.  The
396 	 * last exiting process to reach this point releases as much of
397 	 * the environment as it can, and the last process cleaned up
398 	 * by vmspace_exit() (which decrements exitingcnt) cleans up the
399 	 * remainder.
400 	 */
401 	vmspace_relexit(vm);
402 
403 	if (SESS_LEADER(p)) {
404 		struct session *sp = p->p_session;
405 
406 		if (sp->s_ttyvp) {
407 			/*
408 			 * We are the controlling process.  Signal the
409 			 * foreground process group, drain the controlling
410 			 * terminal, and revoke access to the controlling
411 			 * terminal.
412 			 *
413 			 * NOTE: while waiting for the process group to exit
414 			 * it is possible that one of the processes in the
415 			 * group will revoke the tty, so the ttyclosesession()
416 			 * function will re-check sp->s_ttyvp.
417 			 */
418 			if (sp->s_ttyp && (sp->s_ttyp->t_session == sp)) {
419 				if (sp->s_ttyp->t_pgrp)
420 					pgsignal(sp->s_ttyp->t_pgrp, SIGHUP, 1);
421 				ttywait(sp->s_ttyp);
422 				ttyclosesession(sp, 1); /* also revoke */
423 			}
424 			/*
425 			 * Release the tty.  If someone has it open via
426 			 * /dev/tty then close it (since they no longer can
427 			 * once we've NULL'd it out).
428 			 */
429 			ttyclosesession(sp, 0);
430 
431 			/*
432 			 * s_ttyp is not zero'd; we use this to indicate
433 			 * that the session once had a controlling terminal.
434 			 * (for logging and informational purposes)
435 			 */
436 		}
437 		sp->s_leader = NULL;
438 	}
439 	fixjobc(p, p->p_pgrp, 0);
440 	(void)acct_process(p);
441 #ifdef KTRACE
442 	/*
443 	 * release trace file
444 	 */
445 	if (p->p_tracenode)
446 		ktrdestroy(&p->p_tracenode);
447 	p->p_traceflag = 0;
448 #endif
449 	/*
450 	 * Release reference to text vnode
451 	 */
452 	if ((vtmp = p->p_textvp) != NULL) {
453 		p->p_textvp = NULL;
454 		vrele(vtmp);
455 	}
456 
457 	/* Release namecache handle to text file */
458 	if (p->p_textnch.ncp)
459 		cache_drop(&p->p_textnch);
460 
461 	/*
462 	 * We have to handle PPWAIT here or proc_move_allproc_zombie()
463 	 * will block on the PHOLD() the parent is doing.
464 	 *
465 	 * We are using the flag as an interlock so an atomic op is
466 	 * necessary to synchronize with the parent's cpu.
467 	 */
468 	if (p->p_flags & P_PPWAIT) {
469 		atomic_clear_int(&p->p_flags, P_PPWAIT);
470 		wakeup(p->p_pptr);
471 	}
472 
473 	/*
474 	 * Move the process to the zombie list.  This will block
475 	 * until the process p_lock count reaches 0.  The process will
476 	 * not be reaped until TDF_EXITING is set by cpu_thread_exit(),
477 	 * which is called from cpu_proc_exit().
478 	 *
479 	 * Interlock against waiters using p_waitgen.  We increment
480 	 * p_waitgen after completing the move of our process to the
481 	 * zombie list.
482 	 *
483 	 * WARNING: pp becomes stale when we block, clear it now as a
484 	 *	    reminder.
485 	 */
486 	proc_move_allproc_zombie(p);
487 	pp = p->p_pptr;
488 	atomic_add_long(&pp->p_waitgen, 1);
489 	pp = NULL;
490 
491 	/*
492 	 * Reparent all of this process's children to the init process.
493 	 * We must hold initproc->p_token in order to mess with
494 	 * initproc->p_children.  We already hold p->p_token (to remove
495 	 * the children from our list).
496 	 */
497 	q = LIST_FIRST(&p->p_children);
498 	if (q) {
499 		lwkt_gettoken(&initproc->p_token);
500 		while ((q = LIST_FIRST(&p->p_children)) != NULL) {
501 			PHOLD(q);
502 			lwkt_gettoken(&q->p_token);
503 			if (q != LIST_FIRST(&p->p_children)) {
504 				lwkt_reltoken(&q->p_token);
505 				PRELE(q);
506 				continue;
507 			}
508 			LIST_REMOVE(q, p_sibling);
509 			LIST_INSERT_HEAD(&initproc->p_children, q, p_sibling);
510 			q->p_pptr = initproc;
511 			q->p_sigparent = SIGCHLD;
512 
513 			/*
514 			 * Traced processes are killed
515 			 * since their existence means someone is screwing up.
516 			 */
517 			if (q->p_flags & P_TRACED) {
518 				q->p_flags &= ~P_TRACED;
519 				ksignal(q, SIGKILL);
520 			}
521 			lwkt_reltoken(&q->p_token);
522 			PRELE(q);
523 		}
524 		lwkt_reltoken(&initproc->p_token);
525 		wakeup(initproc);
526 	}
527 
528 	/*
529 	 * Save exit status and final rusage info, adding in child rusage
530 	 * info and self times.
531 	 */
532 	calcru_proc(p, &p->p_ru);
533 	ruadd(&p->p_ru, &p->p_cru);
534 
535 	/*
536 	 * notify interested parties of our demise.
537 	 */
538 	KNOTE(&p->p_klist, NOTE_EXIT);
539 
540 	/*
541 	 * Notify parent that we're gone.  If parent has the PS_NOCLDWAIT
542 	 * flag set, or if the handler is set to SIG_IGN, notify process 1
543 	 * instead (and hope it will handle this situation).
544 	 *
545 	 * (must reload pp)
546 	 */
547 	if (p->p_pptr->p_sigacts->ps_flag & (PS_NOCLDWAIT | PS_CLDSIGIGN)) {
548 		proc_reparent(p, initproc);
549 	}
550 
551 	pp = p->p_pptr;
552 	PHOLD(pp);
553 	if (p->p_sigparent && pp != initproc) {
554 	        ksignal(pp, p->p_sigparent);
555 	} else {
556 	        ksignal(pp, SIGCHLD);
557 	}
558 	p->p_flags &= ~P_TRACED;
559 	PRELE(pp);
560 
561 	/*
562 	 * cpu_exit is responsible for clearing curproc, since
563 	 * it is heavily integrated with the thread/switching sequence.
564 	 *
565 	 * Other substructures are freed from wait().
566 	 */
567 	plimit_free(p);
568 
569 	/*
570 	 * Finally, call machine-dependent code to release as many of the
571 	 * lwp's resources as we can and halt execution of this thread.
572 	 *
573 	 * pp is a wild pointer now but still the correct wakeup() target.
574 	 * lwp_exit() only uses it to send the wakeup() signal to the likely
575 	 * parent.  Any reparenting race that occurs will get a signal
576 	 * automatically and not be an issue.
577 	 */
578 	lwp_exit(1, pp);
579 }
580 
581 /*
582  * Eventually called by every exiting LWP
583  *
584  * p->p_token must be held.  mplock may be held and will be released.
585  */
586 void
587 lwp_exit(int masterexit, void *waddr)
588 {
589 	struct thread *td = curthread;
590 	struct lwp *lp = td->td_lwp;
591 	struct proc *p = lp->lwp_proc;
592 	int dowake = 0;
593 
594 	/*
595 	 * Release the current user process designation on the process so
596 	 * the userland scheduler can work in someone else.
597 	 */
598 	p->p_usched->release_curproc(lp);
599 
600 	/*
601 	 * lwp_exit() may be called without setting LWP_MP_WEXIT, so
602 	 * make sure it is set here.
603 	 */
604 	ASSERT_LWKT_TOKEN_HELD(&p->p_token);
605 	atomic_set_int(&lp->lwp_mpflags, LWP_MP_WEXIT);
606 
607 	/*
608 	 * Clean up any virtualization
609 	 */
610 	if (lp->lwp_vkernel)
611 		vkernel_lwp_exit(lp);
612 
613 	if (td->td_vmm)
614 		vmm_vmdestroy();
615 
616 	/*
617 	 * Clean up select/poll support
618 	 */
619 	kqueue_terminate(&lp->lwp_kqueue);
620 
621 	/*
622 	 * Clean up any syscall-cached ucred
623 	 */
624 	if (td->td_ucred) {
625 		crfree(td->td_ucred);
626 		td->td_ucred = NULL;
627 	}
628 
629 	/*
630 	 * Nobody actually wakes us when the lock
631 	 * count reaches zero, so just wait one tick.
632 	 */
633 	while (lp->lwp_lock > 0)
634 		tsleep(lp, 0, "lwpexit", 1);
635 
636 	/* Hand down resource usage to our proc */
637 	ruadd(&p->p_ru, &lp->lwp_ru);
638 
639 	/*
640 	 * If we don't hold the process until the LWP is reaped wait*()
641 	 * may try to dispose of its vmspace before all the LWPs have
642 	 * actually terminated.
643 	 */
644 	PHOLD(p);
645 
646 	/*
647 	 * Do any remaining work that might block on us.  We should be
648 	 * coded such that further blocking is ok after decrementing
649 	 * p_nthreads but don't take the chance.
650 	 */
651 	dsched_exit_thread(td);
652 	biosched_done(curthread);
653 
654 	/*
655 	 * We have to use the reaper for all the LWPs except the one doing
656 	 * the master exit.  The LWP doing the master exit can just be
657 	 * left on p_lwps and the process reaper will deal with it
658 	 * synchronously, which is much faster.
659 	 *
660 	 * Wakeup anyone waiting on p_nthreads to drop to 1 or 0.
661 	 *
662 	 * The process is left held until the reaper calls lwp_dispose() on
663 	 * the lp (after calling lwp_wait()).
664 	 */
665 	if (masterexit == 0) {
666 		int cpu = mycpuid;
667 
668 		lwp_rb_tree_RB_REMOVE(&p->p_lwp_tree, lp);
669 		--p->p_nthreads;
670 		if ((p->p_flags & P_MAYBETHREADED) && p->p_nthreads <= 1)
671 			dowake = 1;
672 		lwkt_gettoken(&deadlwp_token[cpu]);
673 		LIST_INSERT_HEAD(&deadlwp_list[cpu], lp, u.lwp_reap_entry);
674 		taskqueue_enqueue(taskqueue_thread[cpu], deadlwp_task[cpu]);
675 		lwkt_reltoken(&deadlwp_token[cpu]);
676 	} else {
677 		--p->p_nthreads;
678 		if ((p->p_flags & P_MAYBETHREADED) && p->p_nthreads <= 1)
679 			dowake = 1;
680 	}
681 
682 	/*
683 	 * We no longer need p_token.
684 	 *
685 	 * Tell the userland scheduler that we are going away
686 	 */
687 	lwkt_reltoken(&p->p_token);
688 	p->p_usched->heuristic_exiting(lp, p);
689 
690 	/*
691 	 * Issue late wakeups after releasing our token to give us a chance
692 	 * to deschedule and switch away before another cpu in a wait*()
693 	 * reaps us.  This is done as late as possible to reduce contention.
694 	 */
695 	if (dowake)
696 		wakeup(&p->p_nthreads);
697 	if (waddr)
698 		wakeup(waddr);
699 
700 	cpu_lwp_exit();
701 }
702 
703 /*
704  * Wait until a lwp is completely dead.  The final interlock in this drama
705  * is when TDF_EXITING is set in cpu_thread_exit() just before the final
706  * switchout.
707  *
708  * At the point TDF_EXITING is set a complete exit is accomplished when
709  * TDF_RUNNING and TDF_PREEMPT_LOCK are both clear.  td_mpflags has two
710  * post-switch interlock flags that can be used to wait for the TDF_
711  * flags to clear.
712  *
713  * Returns non-zero on success, and zero if the caller needs to retry
714  * the lwp_wait().
715  */
716 static int
717 lwp_wait(struct lwp *lp)
718 {
719 	struct thread *td = lp->lwp_thread;
720 	u_int mpflags;
721 
722 	KKASSERT(lwkt_preempted_proc() != lp);
723 
724 	/*
725 	 * This bit of code uses the thread destruction interlock
726 	 * managed by lwkt_switch_return() to wait for the lwp's
727 	 * thread to completely disengage.
728 	 *
729 	 * It is possible for us to race another cpu core so we
730 	 * have to do this correctly.
731 	 */
732 	for (;;) {
733 		mpflags = td->td_mpflags;
734 		cpu_ccfence();
735 		if (mpflags & TDF_MP_EXITSIG)
736 			break;
737 		tsleep_interlock(td, 0);
738 		if (atomic_cmpset_int(&td->td_mpflags, mpflags,
739 				      mpflags | TDF_MP_EXITWAIT)) {
740 			tsleep(td, PINTERLOCKED, "lwpxt", 0);
741 		}
742 	}
743 
744 	/*
745 	 * We've already waited for the core exit but there can still
746 	 * be other refs from e.g. process scans and such.
747 	 */
748 	if (lp->lwp_lock > 0) {
749 		tsleep(lp, 0, "lwpwait1", 1);
750 		return(0);
751 	}
752 	if (td->td_refs) {
753 		tsleep(td, 0, "lwpwait2", 1);
754 		return(0);
755 	}
756 
757 	/*
758 	 * Now that we have the thread destruction interlock these flags
759 	 * really should already be cleaned up, keep a check for safety.
760 	 *
761 	 * We can't rip its stack out from under it until TDF_EXITING is
762 	 * set and both TDF_RUNNING and TDF_PREEMPT_LOCK are clear.
763 	 * TDF_PREEMPT_LOCK must be checked because TDF_RUNNING
764 	 * will be cleared temporarily if a thread gets preempted.
765 	 */
766 	while ((td->td_flags & (TDF_RUNNING |
767 			        TDF_PREEMPT_LOCK |
768 			        TDF_EXITING)) != TDF_EXITING) {
769 		tsleep(lp, 0, "lwpwait3", 1);
770 		return (0);
771 	}
772 
773 	KASSERT((td->td_flags & (TDF_RUNQ|TDF_TSLEEPQ)) == 0,
774 		("lwp_wait: td %p (%s) still on run or sleep queue",
775 		td, td->td_comm));
776 	return (1);
777 }
778 
779 /*
780  * Release the resources associated with a lwp.
781  * The lwp must be completely dead.
782  */
783 void
784 lwp_dispose(struct lwp *lp)
785 {
786 	struct thread *td = lp->lwp_thread;
787 
788 	KKASSERT(lwkt_preempted_proc() != lp);
789 	KKASSERT(td->td_refs == 0);
790 	KKASSERT((td->td_flags & (TDF_RUNNING |
791 				  TDF_PREEMPT_LOCK |
792 				  TDF_EXITING)) == TDF_EXITING);
793 
794 	PRELE(lp->lwp_proc);
795 	lp->lwp_proc = NULL;
796 	if (td != NULL) {
797 		td->td_proc = NULL;
798 		td->td_lwp = NULL;
799 		lp->lwp_thread = NULL;
800 		lwkt_free_thread(td);
801 	}
802 	kfree(lp, M_LWP);
803 }
804 
805 int
806 sys_wait4(struct wait_args *uap)
807 {
808 	struct rusage rusage;
809 	int error, status;
810 
811 	error = kern_wait(uap->pid, (uap->status ? &status : NULL),
812 			  uap->options, (uap->rusage ? &rusage : NULL),
813 			  &uap->sysmsg_result);
814 
815 	if (error == 0 && uap->status)
816 		error = copyout(&status, uap->status, sizeof(*uap->status));
817 	if (error == 0 && uap->rusage)
818 		error = copyout(&rusage, uap->rusage, sizeof(*uap->rusage));
819 	return (error);
820 }
821 
822 /*
823  * wait1()
824  *
825  * wait_args(int pid, int *status, int options, struct rusage *rusage)
826  */
827 int
828 kern_wait(pid_t pid, int *status, int options, struct rusage *rusage, int *res)
829 {
830 	struct thread *td = curthread;
831 	struct lwp *lp;
832 	struct proc *q = td->td_proc;
833 	struct proc *p, *t;
834 	struct pargs *pa;
835 	struct sigacts *ps;
836 	int nfound, error;
837 	long waitgen;
838 
839 	if (pid == 0)
840 		pid = -q->p_pgid;
841 	if (options &~ (WUNTRACED|WNOHANG|WCONTINUED|WLINUXCLONE))
842 		return (EINVAL);
843 
844 	/*
845 	 * Protect the q->p_children list
846 	 */
847 	lwkt_gettoken(&q->p_token);
848 loop:
849 	/*
850 	 * All sorts of things can change due to blocking so we have to loop
851 	 * all the way back up here.
852 	 *
853 	 * The problem is that if a process group is stopped and the parent
854 	 * is doing a wait*(..., WUNTRACED, ...), it will see the STOP
855 	 * of the child and then stop itself when it tries to return from the
856 	 * system call.  When the process group is resumed the parent will
857 	 * then get the STOP status even though the child has now resumed
858 	 * (a followup wait*() will get the CONT status).
859 	 *
860 	 * Previously the CONT would overwrite the STOP because the tstop
861 	 * was handled within tsleep(), and the parent would only see
862 	 * the CONT when both are stopped and continued together.  This little
863 	 * two-line hack restores this effect.
864 	 */
865 	while (q->p_stat == SSTOP)
866             tstop();
867 
868 	nfound = 0;
869 
870 	/*
871 	 * Loop on children.
872 	 *
873 	 * NOTE: We don't want to break q's p_token in the loop for the
874 	 *	 case where no children are found or we risk breaking the
875 	 *	 interlock between child and parent.
876 	 */
877 	waitgen = atomic_fetchadd_long(&q->p_waitgen, 0x80000000);
878 	LIST_FOREACH(p, &q->p_children, p_sibling) {
879 		if (pid != WAIT_ANY &&
880 		    p->p_pid != pid && p->p_pgid != -pid) {
881 			continue;
882 		}
883 
884 		/*
885 		 * This special case handles a kthread spawned by linux_clone
886 		 * (see linux_misc.c).  The linux_wait4 and linux_waitpid
887 		 * functions need to be able to distinguish between waiting
888 		 * on a process and waiting on a thread.  It is a thread if
889 		 * p_sigparent is not SIGCHLD, and the WLINUXCLONE option
890 		 * signifies we want to wait for threads and not processes.
891 		 */
892 		if ((p->p_sigparent != SIGCHLD) ^
893 		    ((options & WLINUXCLONE) != 0)) {
894 			continue;
895 		}
896 
897 		nfound++;
898 		if (p->p_stat == SZOMB) {
899 			/*
900 			 * We may go into SZOMB with threads still present.
901 			 * We must wait for them to exit before we can reap
902 			 * the master thread, otherwise we may race reaping
903 			 * non-master threads.
904 			 *
905 			 * Only this routine can remove a process from
906 			 * the zombie list and destroy it, use PACQUIREZOMB()
907 			 * to serialize us and loop if it blocks (interlocked
908 			 * by the parent's q->p_token).
909 			 *
910 			 * WARNING!  (p) can be invalid when PHOLDZOMB(p)
911 			 *	     returns non-zero.  Be sure not to
912 			 *	     mess with it.
913 			 */
914 			if (PHOLDZOMB(p))
915 				goto loop;
916 			lwkt_gettoken(&p->p_token);
917 			if (p->p_pptr != q) {
918 				lwkt_reltoken(&p->p_token);
919 				PRELEZOMB(p);
920 				goto loop;
921 			}
922 			while (p->p_nthreads > 0) {
923 				tsleep(&p->p_nthreads, 0, "lwpzomb", hz);
924 			}
925 
926 			/*
927 			 * Reap any LWPs left in p->p_lwps.  This is usually
928 			 * just the last LWP.  This must be done before
929 			 * we loop on p_lock since the lwps hold a ref on
930 			 * it as a vmspace interlock.
931 			 *
932 			 * Once that is accomplished p_nthreads had better
933 			 * be zero.
934 			 */
935 			while ((lp = RB_ROOT(&p->p_lwp_tree)) != NULL) {
936 				lwp_rb_tree_RB_REMOVE(&p->p_lwp_tree, lp);
937 				reaplwp(lp);
938 			}
939 			KKASSERT(p->p_nthreads == 0);
940 
941 			/*
942 			 * Don't do anything really bad until all references
943 			 * to the process go away.  This may include other
944 			 * LWPs which are still in the process of being
945 			 * reaped.  We can't just pull the rug out from under
946 			 * them because they may still be using the VM space.
947 			 *
948 			 * Certain kernel facilities such as /proc will also
949 			 * put a hold on the process for short periods of
950 			 * time.
951 			 */
952 			PRELE(p);
953 			PSTALL(p, "reap3", 0);
954 
955 			/* Take care of our return values. */
956 			*res = p->p_pid;
957 
958 			if (status)
959 				*status = p->p_xstat;
960 			if (rusage)
961 				*rusage = p->p_ru;
962 
963 			/*
964 			 * If we got the child via a ptrace 'attach',
965 			 * we need to give it back to the old parent.
966 			 */
967 			if (p->p_oppid && (t = pfind(p->p_oppid)) != NULL) {
968 				PHOLD(p);
969 				p->p_oppid = 0;
970 				proc_reparent(p, t);
971 				ksignal(t, SIGCHLD);
972 				wakeup((caddr_t)t);
973 				error = 0;
974 				PRELE(t);
975 				lwkt_reltoken(&p->p_token);
976 				PRELEZOMB(p);
977 				goto done;
978 			}
979 
980 			/*
981 			 * Unlink the proc from its process group so that
982 			 * the following operations won't lead to an
983 			 * inconsistent state for processes running down
984 			 * the zombie list.
985 			 */
986 			proc_remove_zombie(p);
987 			lwkt_reltoken(&p->p_token);
988 			leavepgrp(p);
989 
990 			p->p_xstat = 0;
991 			ruadd(&q->p_cru, &p->p_ru);
992 
993 			/*
994 			 * Decrement the count of procs running with this uid.
995 			 */
996 			chgproccnt(p->p_ucred->cr_ruidinfo, -1, 0);
997 
998 			/*
999 			 * Free up credentials.
1000 			 */
1001 			crfree(p->p_ucred);
1002 			p->p_ucred = NULL;
1003 
1004 			/*
1005 			 * Remove unused arguments
1006 			 */
1007 			pa = p->p_args;
1008 			p->p_args = NULL;
1009 			if (pa && refcount_release(&pa->ar_ref)) {
1010 				kfree(pa, M_PARGS);
1011 				pa = NULL;
1012 			}
1013 
1014 			ps = p->p_sigacts;
1015 			p->p_sigacts = NULL;
1016 			if (ps && refcount_release(&ps->ps_refcnt)) {
1017 				kfree(ps, M_SUBPROC);
1018 				ps = NULL;
1019 			}
1020 
1021 			/*
1022 			 * Our exitingcount was incremented when the process
1023 			 * became a zombie, now that the process has been
1024 			 * removed from (almost) all lists we should be able
1025 			 * to safely destroy its vmspace.  Wait for any current
1026 			 * holders to go away (so the vmspace remains stable),
1027 			 * then scrap it.
1028 			 */
1029 			PSTALL(p, "reap4", 0);
1030 			vmspace_exitfree(p);
1031 			PSTALL(p, "reap5", 0);
1032 
1033 			/*
1034 			 * NOTE: We have to officially release ZOMB in order
1035 			 *	 to ensure that a racing thread in kern_wait()
1036 			 *	 which blocked on ZOMB is woken up.
1037 			 */
1038 			PHOLD(p);
1039 			PRELEZOMB(p);
1040 			kfree(p, M_PROC);
1041 			atomic_add_int(&nprocs, -1);
1042 			error = 0;
1043 			goto done;
1044 		}
1045 		if (p->p_stat == SSTOP && (p->p_flags & P_WAITED) == 0 &&
1046 		    ((p->p_flags & P_TRACED) || (options & WUNTRACED))) {
1047 			PHOLD(p);
1048 			lwkt_gettoken(&p->p_token);
1049 			if (p->p_pptr != q) {
1050 				lwkt_reltoken(&p->p_token);
1051 				PRELE(p);
1052 				goto loop;
1053 			}
1054 			if (p->p_stat != SSTOP ||
1055 			    (p->p_flags & P_WAITED) != 0 ||
1056 			    ((p->p_flags & P_TRACED) == 0 &&
1057 			     (options & WUNTRACED) == 0)) {
1058 				lwkt_reltoken(&p->p_token);
1059 				PRELE(p);
1060 				goto loop;
1061 			}
1062 
1063 			p->p_flags |= P_WAITED;
1064 
1065 			*res = p->p_pid;
1066 			if (status)
1067 				*status = W_STOPCODE(p->p_xstat);
1068 			/* Zero rusage so we get something consistent. */
1069 			if (rusage)
1070 				bzero(rusage, sizeof(*rusage));
1071 			error = 0;
1072 			lwkt_reltoken(&p->p_token);
1073 			PRELE(p);
1074 			goto done;
1075 		}
1076 		if ((options & WCONTINUED) && (p->p_flags & P_CONTINUED)) {
1077 			PHOLD(p);
1078 			lwkt_gettoken(&p->p_token);
1079 			if (p->p_pptr != q) {
1080 				lwkt_reltoken(&p->p_token);
1081 				PRELE(p);
1082 				goto loop;
1083 			}
1084 			if ((p->p_flags & P_CONTINUED) == 0) {
1085 				lwkt_reltoken(&p->p_token);
1086 				PRELE(p);
1087 				goto loop;
1088 			}
1089 
1090 			*res = p->p_pid;
1091 			p->p_flags &= ~P_CONTINUED;
1092 
1093 			if (status)
1094 				*status = SIGCONT;
1095 			error = 0;
1096 			lwkt_reltoken(&p->p_token);
1097 			PRELE(p);
1098 			goto done;
1099 		}
1100 	}
1101 	if (nfound == 0) {
1102 		error = ECHILD;
1103 		goto done;
1104 	}
1105 	if (options & WNOHANG) {
1106 		*res = 0;
1107 		error = 0;
1108 		goto done;
1109 	}
1110 
1111 	/*
1112 	 * Wait for signal - interlocked using q->p_waitgen.
1113 	 */
1114 	error = 0;
1115 	while ((waitgen & 0x7FFFFFFF) == (q->p_waitgen & 0x7FFFFFFF)) {
1116 		tsleep_interlock(q, PCATCH);
1117 		waitgen = atomic_fetchadd_long(&q->p_waitgen, 0x80000000);
1118 		if ((waitgen & 0x7FFFFFFF) == (q->p_waitgen & 0x7FFFFFFF)) {
1119 			error = tsleep(q, PCATCH | PINTERLOCKED, "wait", 0);
1120 			break;
1121 		}
1122 	}
1123 	if (error) {
1124 done:
1125 		lwkt_reltoken(&q->p_token);
1126 		return (error);
1127 	}
1128 	goto loop;
1129 }
1130 
1131 /*
1132  * Change child's parent process to parent.
1133  *
1134  * p_children/p_sibling requires the parent's token, and
1135  * changing pptr requires the child's token, so we have to
1136  * get three tokens to do this operation.  We also need to
1137  * hold pointers that might get ripped out from under us to
1138  * preserve structural integrity.
1139  *
1140  * It is possible to race another reparent or disconnect or other
1141  * similar operation.  We must retry when this situation occurs.
1142  * Once we successfully reparent the process we no longer care
1143  * about any races.
1144  */
1145 void
1146 proc_reparent(struct proc *child, struct proc *parent)
1147 {
1148 	struct proc *opp;
1149 
1150 	PHOLD(parent);
1151 	while ((opp = child->p_pptr) != parent) {
1152 		PHOLD(opp);
1153 		lwkt_gettoken(&opp->p_token);
1154 		lwkt_gettoken(&child->p_token);
1155 		lwkt_gettoken(&parent->p_token);
1156 		if (child->p_pptr != opp) {
1157 			lwkt_reltoken(&parent->p_token);
1158 			lwkt_reltoken(&child->p_token);
1159 			lwkt_reltoken(&opp->p_token);
1160 			PRELE(opp);
1161 			continue;
1162 		}
1163 		LIST_REMOVE(child, p_sibling);
1164 		LIST_INSERT_HEAD(&parent->p_children, child, p_sibling);
1165 		child->p_pptr = parent;
1166 		lwkt_reltoken(&parent->p_token);
1167 		lwkt_reltoken(&child->p_token);
1168 		lwkt_reltoken(&opp->p_token);
1169 		if (LIST_EMPTY(&opp->p_children))
1170 			wakeup(opp);
1171 		PRELE(opp);
1172 		break;
1173 	}
1174 	PRELE(parent);
1175 }
1176 
1177 /*
1178  * The next two functions are to handle adding/deleting items on the
1179  * exit callout list
1180  *
1181  * at_exit():
1182  * Take the arguments given and put them onto the exit callout list,
1183  * However first make sure that it's not already there.
1184  * returns 0 on success.
1185  */
1186 
1187 int
1188 at_exit(exitlist_fn function)
1189 {
1190 	struct exitlist *ep;
1191 
1192 #ifdef INVARIANTS
1193 	/* Be noisy if the programmer has lost track of things */
1194 	if (rm_at_exit(function))
1195 		kprintf("WARNING: exit callout entry (%p) already present\n",
1196 		    function);
1197 #endif
1198 	ep = kmalloc(sizeof(*ep), M_ATEXIT, M_NOWAIT);
1199 	if (ep == NULL)
1200 		return (ENOMEM);
1201 	ep->function = function;
1202 	TAILQ_INSERT_TAIL(&exit_list, ep, next);
1203 	return (0);
1204 }
1205 
1206 /*
1207  * Scan the exit callout list for the given item and remove it.
1208  * Returns the number of items removed (0 or 1)
1209  */
1210 int
1211 rm_at_exit(exitlist_fn function)
1212 {
1213 	struct exitlist *ep;
1214 
1215 	TAILQ_FOREACH(ep, &exit_list, next) {
1216 		if (ep->function == function) {
1217 			TAILQ_REMOVE(&exit_list, ep, next);
1218 			kfree(ep, M_ATEXIT);
1219 			return(1);
1220 		}
1221 	}
1222 	return (0);
1223 }
1224 
1225 /*
1226  * LWP reaper related code.
1227  */
1228 static void
1229 reaplwps(void *context, int dummy)
1230 {
1231 	struct lwplist *lwplist = context;
1232 	struct lwp *lp;
1233 	int cpu = mycpuid;
1234 
1235 	lwkt_gettoken(&deadlwp_token[cpu]);
1236 	while ((lp = LIST_FIRST(lwplist))) {
1237 		LIST_REMOVE(lp, u.lwp_reap_entry);
1238 		reaplwp(lp);
1239 	}
1240 	lwkt_reltoken(&deadlwp_token[cpu]);
1241 }
1242 
1243 static void
1244 reaplwp(struct lwp *lp)
1245 {
1246 	while (lwp_wait(lp) == 0)
1247 		;
1248 	lwp_dispose(lp);
1249 }
1250 
1251 static void
1252 deadlwp_init(void)
1253 {
1254 	int cpu;
1255 
1256 	for (cpu = 0; cpu < ncpus; cpu++) {
1257 		lwkt_token_init(&deadlwp_token[cpu], "deadlwpl");
1258 		LIST_INIT(&deadlwp_list[cpu]);
1259 		deadlwp_task[cpu] = kmalloc(sizeof(*deadlwp_task[cpu]),
1260 					    M_DEVBUF, M_WAITOK);
1261 		TASK_INIT(deadlwp_task[cpu], 0, reaplwps, &deadlwp_list[cpu]);
1262 	}
1263 }
1264 
1265 SYSINIT(deadlwpinit, SI_SUB_CONFIGURE, SI_ORDER_ANY, deadlwp_init, NULL);
1266