xref: /netbsd-src/sys/kern/kern_exit.c (revision a0698ed9d41653d7a2378819ad501a285ca0d401)
1 /*	$NetBSD: kern_exit.c,v 1.274 2019/03/01 09:02:03 hannken Exp $	*/
2 
3 /*-
4  * Copyright (c) 1998, 1999, 2006, 2007, 2008 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility,
9  * NASA Ames Research Center, and by Andrew Doran.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1982, 1986, 1989, 1991, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  * (c) UNIX System Laboratories, Inc.
37  * All or some portions of this file are derived from material licensed
38  * to the University of California by American Telephone and Telegraph
39  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
40  * the permission of UNIX System Laboratories, Inc.
41  *
42  * Redistribution and use in source and binary forms, with or without
43  * modification, are permitted provided that the following conditions
44  * are met:
45  * 1. Redistributions of source code must retain the above copyright
46  *    notice, this list of conditions and the following disclaimer.
47  * 2. Redistributions in binary form must reproduce the above copyright
48  *    notice, this list of conditions and the following disclaimer in the
49  *    documentation and/or other materials provided with the distribution.
50  * 3. Neither the name of the University nor the names of its contributors
51  *    may be used to endorse or promote products derived from this software
52  *    without specific prior written permission.
53  *
54  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
55  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
56  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
57  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
58  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
59  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
60  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
62  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
63  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
64  * SUCH DAMAGE.
65  *
66  *	@(#)kern_exit.c	8.10 (Berkeley) 2/23/95
67  */
68 
69 #include <sys/cdefs.h>
70 __KERNEL_RCSID(0, "$NetBSD: kern_exit.c,v 1.274 2019/03/01 09:02:03 hannken Exp $");
71 
72 #include "opt_ktrace.h"
73 #include "opt_dtrace.h"
74 #include "opt_sysv.h"
75 
76 #include <sys/param.h>
77 #include <sys/systm.h>
78 #include <sys/ioctl.h>
79 #include <sys/tty.h>
80 #include <sys/time.h>
81 #include <sys/resource.h>
82 #include <sys/kernel.h>
83 #include <sys/proc.h>
84 #include <sys/buf.h>
85 #include <sys/wait.h>
86 #include <sys/file.h>
87 #include <sys/fstrans.h>
88 #include <sys/vnode.h>
89 #include <sys/syslog.h>
90 #include <sys/pool.h>
91 #include <sys/uidinfo.h>
92 #include <sys/ptrace.h>
93 #include <sys/acct.h>
94 #include <sys/filedesc.h>
95 #include <sys/ras.h>
96 #include <sys/signalvar.h>
97 #include <sys/sched.h>
98 #include <sys/mount.h>
99 #include <sys/syscallargs.h>
100 #include <sys/kauth.h>
101 #include <sys/sleepq.h>
102 #include <sys/lockdebug.h>
103 #include <sys/ktrace.h>
104 #include <sys/cpu.h>
105 #include <sys/lwpctl.h>
106 #include <sys/atomic.h>
107 #include <sys/sdt.h>
108 
109 #include <uvm/uvm_extern.h>
110 
111 #ifdef DEBUG_EXIT
112 int debug_exit = 0;
113 #define DPRINTF(x) if (debug_exit) printf x
114 #else
115 #define DPRINTF(x)
116 #endif
117 
118 static int find_stopped_child(struct proc *, idtype_t, id_t, int,
119     struct proc **, struct wrusage *, siginfo_t *);
120 static void proc_free(struct proc *, struct wrusage *);
121 
122 /*
123  * DTrace SDT provider definitions
124  */
125 SDT_PROVIDER_DECLARE(proc);
126 SDT_PROBE_DEFINE1(proc, kernel, , exit, "int");
127 
128 /*
129  * Fill in the appropriate signal information, and signal the parent.
130  */
131 /* XXX noclone works around a gcc 4.5 bug on arm */
132 static void __noclone
133 exit_psignal(struct proc *p, struct proc *pp, ksiginfo_t *ksi)
134 {
135 
136 	KSI_INIT(ksi);
137 	if ((ksi->ksi_signo = P_EXITSIG(p)) == SIGCHLD) {
138 		if (p->p_xsig) {
139 			if (p->p_sflag & PS_COREDUMP)
140 				ksi->ksi_code = CLD_DUMPED;
141 			else
142 				ksi->ksi_code = CLD_KILLED;
143 			ksi->ksi_status = p->p_xsig;
144 		} else {
145 			ksi->ksi_code = CLD_EXITED;
146 			ksi->ksi_status = p->p_xexit;
147 		}
148 	} else {
149 		ksi->ksi_code = SI_USER;
150 		ksi->ksi_status = p->p_xsig;
151 	}
152 	/*
153 	 * We fill those in, even for non-SIGCHLD.
154 	 * It's safe to access p->p_cred unlocked here.
155 	 */
156 	ksi->ksi_pid = p->p_pid;
157 	ksi->ksi_uid = kauth_cred_geteuid(p->p_cred);
158 	/* XXX: is this still valid? */
159 	ksi->ksi_utime = p->p_stats->p_ru.ru_utime.tv_sec;
160 	ksi->ksi_stime = p->p_stats->p_ru.ru_stime.tv_sec;
161 }
162 
163 /*
164  * exit --
165  *	Death of process.
166  */
167 int
168 sys_exit(struct lwp *l, const struct sys_exit_args *uap, register_t *retval)
169 {
170 	/* {
171 		syscallarg(int)	rval;
172 	} */
173 	struct proc *p = l->l_proc;
174 
175 	/* Don't call exit1() multiple times in the same process. */
176 	mutex_enter(p->p_lock);
177 	if (p->p_sflag & PS_WEXIT) {
178 		mutex_exit(p->p_lock);
179 		lwp_exit(l);
180 	}
181 
182 	/* exit1() will release the mutex. */
183 	exit1(l, SCARG(uap, rval), 0);
184 	/* NOTREACHED */
185 	return (0);
186 }
187 
188 /*
189  * Exit: deallocate address space and other resources, change proc state
190  * to zombie, and unlink proc from allproc and parent's lists.  Save exit
191  * status and rusage for wait().  Check for child processes and orphan them.
192  *
193  * Must be called with p->p_lock held.  Does not return.
194  */
195 void
196 exit1(struct lwp *l, int exitcode, int signo)
197 {
198 	struct proc	*p, *child, *next_child, *old_parent, *new_parent;
199 	struct pgrp	*pgrp;
200 	ksiginfo_t	ksi;
201 	ksiginfoq_t	kq;
202 	int		wakeinit;
203 
204 	p = l->l_proc;
205 
206 	KASSERT(mutex_owned(p->p_lock));
207 	KASSERT(p->p_vmspace != NULL);
208 
209 	if (__predict_false(p == initproc)) {
210 		panic("init died (signal %d, exit %d)", signo, exitcode);
211 	}
212 
213 	p->p_sflag |= PS_WEXIT;
214 
215 	/*
216 	 * Force all other LWPs to exit before we do.  Only then can we
217 	 * begin to tear down the rest of the process state.
218 	 */
219 	if (p->p_nlwps > 1) {
220 		exit_lwps(l);
221 	}
222 
223 	ksiginfo_queue_init(&kq);
224 
225 	/*
226 	 * If we have been asked to stop on exit, do so now.
227 	 */
228 	if (__predict_false(p->p_sflag & PS_STOPEXIT)) {
229 		KERNEL_UNLOCK_ALL(l, &l->l_biglocks);
230 		sigclearall(p, &contsigmask, &kq);
231 
232 		if (!mutex_tryenter(proc_lock)) {
233 			mutex_exit(p->p_lock);
234 			mutex_enter(proc_lock);
235 			mutex_enter(p->p_lock);
236 		}
237 		p->p_waited = 0;
238 		p->p_pptr->p_nstopchild++;
239 		p->p_stat = SSTOP;
240 		mutex_exit(proc_lock);
241 		lwp_lock(l);
242 		p->p_nrlwps--;
243 		l->l_stat = LSSTOP;
244 		lwp_unlock(l);
245 		mutex_exit(p->p_lock);
246 		lwp_lock(l);
247 		mi_switch(l);
248 		KERNEL_LOCK(l->l_biglocks, l);
249 		mutex_enter(p->p_lock);
250 	}
251 
252 	/*
253 	 * Bin any remaining signals and mark the process as dying so it will
254 	 * not be found for, e.g. signals.
255 	 */
256 	sigfillset(&p->p_sigctx.ps_sigignore);
257 	sigclearall(p, NULL, &kq);
258 	p->p_stat = SDYING;
259 	mutex_exit(p->p_lock);
260 	ksiginfo_queue_drain(&kq);
261 
262 	/* Destroy any lwpctl info. */
263 	if (p->p_lwpctl != NULL)
264 		lwp_ctl_exit();
265 
266 	/*
267 	 * Drain all remaining references that procfs, ptrace and others may
268 	 * have on the process.
269 	 */
270 	rw_enter(&p->p_reflock, RW_WRITER);
271 
272 	DPRINTF(("%s: %d.%d exiting.\n", __func__, p->p_pid, l->l_lid));
273 
274 	timers_free(p, TIMERS_ALL);
275 #if defined(__HAVE_RAS)
276 	ras_purgeall();
277 #endif
278 
279 	/*
280 	 * Close open files, release open-file table and free signal
281 	 * actions.  This may block!
282 	 */
283 	fd_free();
284 	cwdfree(p->p_cwdi);
285 	p->p_cwdi = NULL;
286 	doexithooks(p);
287 	sigactsfree(p->p_sigacts);
288 
289 	/*
290 	 * Write out accounting data.
291 	 */
292 	(void)acct_process(l);
293 
294 #ifdef KTRACE
295 	/*
296 	 * Release trace file.
297 	 */
298 	if (p->p_tracep != NULL) {
299 		mutex_enter(&ktrace_lock);
300 		ktrderef(p);
301 		mutex_exit(&ktrace_lock);
302 	}
303 #endif
304 
305 	p->p_xexit = exitcode;
306 	p->p_xsig = signo;
307 
308 	/*
309 	 * If emulation has process exit hook, call it now.
310 	 * Set the exit status now so that the exit hook has
311 	 * an opportunity to tweak it (COMPAT_LINUX requires
312 	 * this for thread group emulation)
313 	 */
314 	if (p->p_emul->e_proc_exit)
315 		(*p->p_emul->e_proc_exit)(p);
316 
317 	/*
318 	 * Free the VM resources we're still holding on to.
319 	 * We must do this from a valid thread because doing
320 	 * so may block. This frees vmspace, which we don't
321 	 * need anymore. The only remaining lwp is the one
322 	 * we run at this moment, nothing runs in userland
323 	 * anymore.
324 	 */
325 	ruspace(p);	/* Update our vm resource use */
326 	uvm_proc_exit(p);
327 
328 	/*
329 	 * Stop profiling.
330 	 */
331 	if (__predict_false((p->p_stflag & PST_PROFIL) != 0)) {
332 		mutex_spin_enter(&p->p_stmutex);
333 		stopprofclock(p);
334 		mutex_spin_exit(&p->p_stmutex);
335 	}
336 
337 	/*
338 	 * If parent is waiting for us to exit or exec, PL_PPWAIT is set; we
339 	 * wake up the parent early to avoid deadlock.  We can do this once
340 	 * the VM resources are released.
341 	 */
342 	mutex_enter(proc_lock);
343 	if (p->p_lflag & PL_PPWAIT) {
344 		l->l_lwpctl = NULL; /* was on loan from blocked parent */
345 		p->p_lflag &= ~PL_PPWAIT;
346 		cv_broadcast(&p->p_pptr->p_waitcv);
347 	}
348 
349 	if (SESS_LEADER(p)) {
350 		struct vnode *vprele = NULL, *vprevoke = NULL;
351 		struct session *sp = p->p_session;
352 		struct tty *tp;
353 
354 		if (sp->s_ttyvp) {
355 			/*
356 			 * Controlling process.
357 			 * Signal foreground pgrp,
358 			 * drain controlling terminal
359 			 * and revoke access to controlling terminal.
360 			 */
361 			tp = sp->s_ttyp;
362 			mutex_spin_enter(&tty_lock);
363 			if (tp->t_session == sp) {
364 				/* we can't guarantee the revoke will do this */
365 				pgrp = tp->t_pgrp;
366 				tp->t_pgrp = NULL;
367 				tp->t_session = NULL;
368 				mutex_spin_exit(&tty_lock);
369 				if (pgrp != NULL) {
370 					pgsignal(pgrp, SIGHUP, 1);
371 				}
372 				mutex_exit(proc_lock);
373 				(void) ttywait(tp);
374 				mutex_enter(proc_lock);
375 
376 				/* The tty could have been revoked. */
377 				vprevoke = sp->s_ttyvp;
378 			} else
379 				mutex_spin_exit(&tty_lock);
380 			vprele = sp->s_ttyvp;
381 			sp->s_ttyvp = NULL;
382 			/*
383 			 * s_ttyp is not zero'd; we use this to indicate
384 			 * that the session once had a controlling terminal.
385 			 * (for logging and informational purposes)
386 			 */
387 		}
388 		sp->s_leader = NULL;
389 
390 		if (vprevoke != NULL || vprele != NULL) {
391 			if (vprevoke != NULL) {
392 				/* Releases proc_lock. */
393 				proc_sessrele(sp);
394 				VOP_REVOKE(vprevoke, REVOKEALL);
395 			} else
396 				mutex_exit(proc_lock);
397 			if (vprele != NULL)
398 				vrele(vprele);
399 			mutex_enter(proc_lock);
400 		}
401 	}
402 	fixjobc(p, p->p_pgrp, 0);
403 
404 	/* Release fstrans private data. */
405 	fstrans_lwp_dtor(l);
406 
407 	/*
408 	 * Finalize the last LWP's specificdata, as well as the
409 	 * specificdata for the proc itself.
410 	 */
411 	lwp_finispecific(l);
412 	proc_finispecific(p);
413 
414 	/*
415 	 * Notify interested parties of our demise.
416 	 */
417 	KNOTE(&p->p_klist, NOTE_EXIT);
418 
419 	SDT_PROBE(proc, kernel, , exit,
420 		((p->p_sflag & PS_COREDUMP) ? CLD_DUMPED :
421 		 (p->p_xsig ? CLD_KILLED : CLD_EXITED)),
422 		0,0,0,0);
423 
424 	/*
425 	 * Reset p_opptr pointer of all former children which got
426 	 * traced by another process and were reparented. We reset
427 	 * it to NULL here; the trace detach code then reparents
428 	 * the child to initproc. We only check allproc list, since
429 	 * eventual former children on zombproc list won't reference
430 	 * p_opptr anymore.
431 	 */
432 	if (__predict_false(p->p_slflag & PSL_CHTRACED)) {
433 		struct proc *q;
434 		PROCLIST_FOREACH(q, &allproc) {
435 			if (q->p_opptr == p)
436 				q->p_opptr = NULL;
437 		}
438 		PROCLIST_FOREACH(q, &zombproc) {
439 			if (q->p_opptr == p)
440 				q->p_opptr = NULL;
441 		}
442 	}
443 
444 	/*
445 	 * Give orphaned children to init(8).
446 	 */
447 	child = LIST_FIRST(&p->p_children);
448 	wakeinit = (child != NULL);
449 	for (; child != NULL; child = next_child) {
450 		next_child = LIST_NEXT(child, p_sibling);
451 
452 		/*
453 		 * Traced processes are killed since their existence
454 		 * means someone is screwing up. Since we reset the
455 		 * trace flags, the logic in sys_wait4() would not be
456 		 * triggered to reparent the process to its
457 		 * original parent, so we must do this here.
458 		 */
459 		if (__predict_false(child->p_slflag & PSL_TRACED)) {
460 			mutex_enter(p->p_lock);
461 			child->p_slflag &=
462 			    ~(PSL_TRACED|PSL_SYSCALL);
463 			mutex_exit(p->p_lock);
464 			if (child->p_opptr != child->p_pptr) {
465 				struct proc *t = child->p_opptr;
466 				proc_reparent(child, t ? t : initproc);
467 				child->p_opptr = NULL;
468 			} else
469 				proc_reparent(child, initproc);
470 			killproc(child, "orphaned traced process");
471 		} else
472 			proc_reparent(child, initproc);
473 	}
474 
475 	/*
476 	 * Move proc from allproc to zombproc, it's now nearly ready to be
477 	 * collected by parent.
478 	 */
479 	LIST_REMOVE(l, l_list);
480 	LIST_REMOVE(p, p_list);
481 	LIST_INSERT_HEAD(&zombproc, p, p_list);
482 
483 	/*
484 	 * Mark the process as dead.  We must do this before we signal
485 	 * the parent.
486 	 */
487 	p->p_stat = SDEAD;
488 
489 	/* Put in front of parent's sibling list for parent to collect it */
490 	old_parent = p->p_pptr;
491 	old_parent->p_nstopchild++;
492 	if (LIST_FIRST(&old_parent->p_children) != p) {
493 		/* Put child where it can be found quickly */
494 		LIST_REMOVE(p, p_sibling);
495 		LIST_INSERT_HEAD(&old_parent->p_children, p, p_sibling);
496 	}
497 
498 	/*
499 	 * Notify parent that we're gone.  If parent has the P_NOCLDWAIT
500 	 * flag set, notify init instead (and hope it will handle
501 	 * this situation).
502 	 */
503 	if (old_parent->p_flag & (PK_NOCLDWAIT|PK_CLDSIGIGN)) {
504 		proc_reparent(p, initproc);
505 		wakeinit = 1;
506 
507 		/*
508 		 * If this was the last child of our parent, notify
509 		 * parent, so in case he was wait(2)ing, he will
510 		 * continue.
511 		 */
512 		if (LIST_FIRST(&old_parent->p_children) == NULL)
513 			cv_broadcast(&old_parent->p_waitcv);
514 	}
515 
516 	/* Reload parent pointer, since p may have been reparented above */
517 	new_parent = p->p_pptr;
518 
519 	if (__predict_false(p->p_exitsig != 0)) {
520 		exit_psignal(p, new_parent, &ksi);
521 		kpsignal(new_parent, &ksi, NULL);
522 	}
523 
524 	/* Calculate the final rusage info.  */
525 	calcru(p, &p->p_stats->p_ru.ru_utime, &p->p_stats->p_ru.ru_stime,
526 	    NULL, NULL);
527 
528 	if (wakeinit)
529 		cv_broadcast(&initproc->p_waitcv);
530 
531 	callout_destroy(&l->l_timeout_ch);
532 
533 	/*
534 	 * Release any PCU resources before becoming a zombie.
535 	 */
536 	pcu_discard_all(l);
537 
538 	mutex_enter(p->p_lock);
539 	/* Free the linux lwp id */
540 	if ((l->l_pflag & LP_PIDLID) != 0 && l->l_lid != p->p_pid)
541 		proc_free_pid(l->l_lid);
542 	lwp_drainrefs(l);
543 	lwp_lock(l);
544 	l->l_prflag &= ~LPR_DETACHED;
545 	l->l_stat = LSZOMB;
546 	lwp_unlock(l);
547 	KASSERT(curlwp == l);
548 	KASSERT(p->p_nrlwps == 1);
549 	KASSERT(p->p_nlwps == 1);
550 	p->p_stat = SZOMB;
551 	p->p_nrlwps--;
552 	p->p_nzlwps++;
553 	p->p_ndlwps = 0;
554 	mutex_exit(p->p_lock);
555 
556 	/*
557 	 * Signal the parent to collect us, and drop the proclist lock.
558 	 * Drop debugger/procfs lock; no new references can be gained.
559 	 */
560 	cv_broadcast(&p->p_pptr->p_waitcv);
561 	rw_exit(&p->p_reflock);
562 	mutex_exit(proc_lock);
563 
564 	/* Verify that we hold no locks other than the kernel lock. */
565 	LOCKDEBUG_BARRIER(&kernel_lock, 0);
566 
567 	/*
568 	 * NOTE: WE ARE NO LONGER ALLOWED TO SLEEP!
569 	 */
570 
571 	/*
572 	 * Give machine-dependent code a chance to free any MD LWP
573 	 * resources.  This must be done before uvm_lwp_exit(), in
574 	 * case these resources are in the PCB.
575 	 */
576 	cpu_lwp_free(l, 1);
577 
578 	pmap_deactivate(l);
579 
580 	/* This process no longer needs to hold the kernel lock. */
581 #ifdef notyet
582 	/* XXXSMP hold in lwp_userret() */
583 	KERNEL_UNLOCK_LAST(l);
584 #else
585 	KERNEL_UNLOCK_ALL(l, NULL);
586 #endif
587 
588 	lwp_exit_switchaway(l);
589 }
590 
591 void
592 exit_lwps(struct lwp *l)
593 {
594 	proc_t *p = l->l_proc;
595 	lwp_t *l2;
596 	int nlocks;
597 
598 	KERNEL_UNLOCK_ALL(l, &nlocks);
599 retry:
600 	KASSERT(mutex_owned(p->p_lock));
601 
602 	/*
603 	 * Interrupt LWPs in interruptable sleep, unsuspend suspended
604 	 * LWPs and then wait for everyone else to finish.
605 	 */
606 	LIST_FOREACH(l2, &p->p_lwps, l_sibling) {
607 		if (l2 == l)
608 			continue;
609 		lwp_lock(l2);
610 		l2->l_flag |= LW_WEXIT;
611 		if ((l2->l_stat == LSSLEEP && (l2->l_flag & LW_SINTR)) ||
612 		    l2->l_stat == LSSUSPENDED || l2->l_stat == LSSTOP) {
613 		    	/* setrunnable() will release the lock. */
614 			setrunnable(l2);
615 			continue;
616 		}
617 		lwp_unlock(l2);
618 	}
619 
620 	/*
621 	 * Wait for every LWP to exit.  Note: LWPs can get suspended/slept
622 	 * behind us or there may even be new LWPs created.  Therefore, a
623 	 * full retry is required on error.
624 	 */
625 	while (p->p_nlwps > 1) {
626 		if (lwp_wait(l, 0, NULL, true)) {
627 			goto retry;
628 		}
629 	}
630 
631 	KERNEL_LOCK(nlocks, l);
632 	KASSERT(p->p_nlwps == 1);
633 }
634 
635 int
636 do_sys_waitid(idtype_t idtype, id_t id, int *pid, int *status, int options,
637     struct wrusage *wru, siginfo_t *si)
638 {
639 	proc_t *child;
640 	int error;
641 
642 
643 	if (wru != NULL)
644 		memset(wru, 0, sizeof(*wru));
645 	if (si != NULL)
646 		memset(si, 0, sizeof(*si));
647 
648 	mutex_enter(proc_lock);
649 	error = find_stopped_child(curproc, idtype, id, options, &child,
650 	    wru, si);
651 	if (child == NULL) {
652 		mutex_exit(proc_lock);
653 		*pid = 0;
654 		*status = 0;
655 		return error;
656 	}
657 	*pid = child->p_pid;
658 
659 	if (child->p_stat == SZOMB) {
660 		/* Child is exiting */
661 		*status = P_WAITSTATUS(child);
662 		/* proc_free() will release the proc_lock. */
663 		if (options & WNOWAIT) {
664 			mutex_exit(proc_lock);
665 		} else {
666 			proc_free(child, wru);
667 		}
668 	} else {
669 		/* Don't mark SIGCONT if we are being stopped */
670 		*status = (child->p_xsig == SIGCONT && child->p_stat != SSTOP) ?
671 		    W_CONTCODE() : W_STOPCODE(child->p_xsig);
672 		mutex_exit(proc_lock);
673 	}
674 	return 0;
675 }
676 
677 int
678 do_sys_wait(int *pid, int *status, int options, struct rusage *ru)
679 {
680 	idtype_t idtype;
681 	id_t id;
682 	int ret;
683 	struct wrusage wru;
684 
685 	/*
686 	 * Translate the special pid values into the (idtype, pid)
687 	 * pair for wait6. The WAIT_MYPGRP case is handled by
688 	 * find_stopped_child() on its own.
689 	 */
690 	if (*pid == WAIT_ANY) {
691 		idtype = P_ALL;
692 		id = 0;
693 	} else if (*pid < 0) {
694 		idtype = P_PGID;
695 		id = (id_t)-*pid;
696 	} else {
697 		idtype = P_PID;
698 		id = (id_t)*pid;
699 	}
700 	options |= WEXITED | WTRAPPED;
701 	ret = do_sys_waitid(idtype, id, pid, status, options, ru ? &wru : NULL,
702 	    NULL);
703 	if (ru)
704 		*ru = wru.wru_self;
705 	return ret;
706 }
707 
708 int
709 sys___wait450(struct lwp *l, const struct sys___wait450_args *uap,
710     register_t *retval)
711 {
712 	/* {
713 		syscallarg(int)			pid;
714 		syscallarg(int *)		status;
715 		syscallarg(int)			options;
716 		syscallarg(struct rusage *)	rusage;
717 	} */
718 	int error, status, pid = SCARG(uap, pid);
719 	struct rusage ru;
720 
721 	error = do_sys_wait(&pid, &status, SCARG(uap, options),
722 	    SCARG(uap, rusage) != NULL ? &ru : NULL);
723 
724 	retval[0] = pid;
725 	if (pid == 0) {
726 		return error;
727 	}
728 	if (SCARG(uap, status)) {
729 		error = copyout(&status, SCARG(uap, status), sizeof(status));
730 	}
731 	if (SCARG(uap, rusage) && error == 0) {
732 		error = copyout(&ru, SCARG(uap, rusage), sizeof(ru));
733 	}
734 	return error;
735 }
736 
737 int
738 sys_wait6(struct lwp *l, const struct sys_wait6_args *uap, register_t *retval)
739 {
740 	/* {
741 		syscallarg(idtype_t)		idtype;
742 		syscallarg(id_t)		id;
743 		syscallarg(int *)		status;
744 		syscallarg(int)			options;
745 		syscallarg(struct wrusage *)	wru;
746 		syscallarg(siginfo_t *)		si;
747 	} */
748 	struct wrusage wru, *wrup;
749 	siginfo_t si, *sip;
750 	idtype_t idtype;
751 	int pid;
752 	id_t id;
753 	int error, status;
754 
755 	idtype = SCARG(uap, idtype);
756 	id = SCARG(uap, id);
757 
758 	if (SCARG(uap, wru) != NULL)
759 		wrup = &wru;
760 	else
761 		wrup = NULL;
762 
763 	if (SCARG(uap, info) != NULL)
764 		sip = &si;
765 	else
766 		sip = NULL;
767 
768 	/*
769 	 *  We expect all callers of wait6() to know about WEXITED and
770 	 *  WTRAPPED.
771 	 */
772 	error = do_sys_waitid(idtype, id, &pid, &status, SCARG(uap, options),
773 	    wrup, sip);
774 
775 	retval[0] = pid; 	/* tell userland who it was */
776 
777 #if 0
778 	/*
779 	 * should we copyout if there was no process, hence no useful data?
780 	 * We don't for an old sytle wait4() (etc) but I believe
781 	 * FreeBSD does for wait6(), so a tossup...  Go with FreeBSD for now.
782 	 */
783 	if (pid == 0)
784 		return error;
785 #endif
786 
787 	if (SCARG(uap, status) != NULL && error == 0)
788 		error = copyout(&status, SCARG(uap, status), sizeof(status));
789 	if (SCARG(uap, wru) != NULL && error == 0)
790 		error = copyout(&wru, SCARG(uap, wru), sizeof(wru));
791 	if (SCARG(uap, info) != NULL && error == 0)
792 		error = copyout(&si, SCARG(uap, info), sizeof(si));
793 	return error;
794 }
795 
796 
797 /*
798  * Find a process that matches the provided criteria, and fill siginfo
799  * and resources if found.
800  * Returns:
801  *	-1: 	Not found, abort early
802  *	 0:	Not matched
803  *	 1:	Matched, there might be more matches
804  *	 2:	This is the only match
805  */
806 static int
807 match_process(const struct proc *pp, struct proc **q, idtype_t idtype, id_t id,
808     int options, struct wrusage *wrusage, siginfo_t *siginfo)
809 {
810 	struct rusage *rup;
811 	struct proc *p = *q;
812 	int rv = 1;
813 
814 	mutex_enter(p->p_lock);
815 	switch (idtype) {
816 	case P_ALL:
817 		break;
818 	case P_PID:
819 		if (p->p_pid != (pid_t)id) {
820 			mutex_exit(p->p_lock);
821 			p = *q = proc_find_raw((pid_t)id);
822 			if (p == NULL || p->p_stat == SIDL || p->p_pptr != pp) {
823 				*q = NULL;
824 				return -1;
825 			}
826 			mutex_enter(p->p_lock);
827 		}
828 		rv++;
829 		break;
830 	case P_PGID:
831 		if (p->p_pgid != (pid_t)id)
832 			goto out;
833 		break;
834 	case P_SID:
835 		if (p->p_session->s_sid != (pid_t)id)
836 			goto out;
837 		break;
838 	case P_UID:
839 		if (kauth_cred_geteuid(p->p_cred) != (uid_t)id)
840 			goto out;
841 		break;
842 	case P_GID:
843 		if (kauth_cred_getegid(p->p_cred) != (gid_t)id)
844 			goto out;
845 		break;
846 	case P_CID:
847 	case P_PSETID:
848 	case P_CPUID:
849 		/* XXX: Implement me */
850 	default:
851 	out:
852 		mutex_exit(p->p_lock);
853 		return 0;
854 	}
855 
856 	if ((options & WEXITED) == 0 && p->p_stat == SZOMB)
857 		goto out;
858 
859 	if (siginfo != NULL) {
860 		siginfo->si_errno = 0;
861 
862 		/*
863 		 * SUSv4 requires that the si_signo value is always
864 		 * SIGCHLD. Obey it despite the rfork(2) interface
865 		 * allows to request other signal for child exit
866 		 * notification.
867 		 */
868 		siginfo->si_signo = SIGCHLD;
869 
870 		/*
871 		 *  This is still a rough estimate.  We will fix the
872 		 *  cases TRAPPED, STOPPED, and CONTINUED later.
873 		 */
874 		if (p->p_sflag & PS_COREDUMP) {
875 			siginfo->si_code = CLD_DUMPED;
876 			siginfo->si_status = p->p_xsig;
877 		} else if (p->p_xsig) {
878 			siginfo->si_code = CLD_KILLED;
879 			siginfo->si_status = p->p_xsig;
880 		} else {
881 			siginfo->si_code = CLD_EXITED;
882 			siginfo->si_status = p->p_xexit;
883 		}
884 
885 		siginfo->si_pid = p->p_pid;
886 		siginfo->si_uid = kauth_cred_geteuid(p->p_cred);
887 		siginfo->si_utime = p->p_stats->p_ru.ru_utime.tv_sec;
888 		siginfo->si_stime = p->p_stats->p_ru.ru_stime.tv_sec;
889 	}
890 
891 	/*
892 	 * There should be no reason to limit resources usage info to
893 	 * exited processes only.  A snapshot about any resources used
894 	 * by a stopped process may be exactly what is needed.
895 	 */
896 	if (wrusage != NULL) {
897 		rup = &wrusage->wru_self;
898 		*rup = p->p_stats->p_ru;
899 		calcru(p, &rup->ru_utime, &rup->ru_stime, NULL, NULL);
900 
901 		rup = &wrusage->wru_children;
902 		*rup = p->p_stats->p_cru;
903 		calcru(p, &rup->ru_utime, &rup->ru_stime, NULL, NULL);
904 	}
905 
906 	mutex_exit(p->p_lock);
907 	return rv;
908 }
909 
910 /*
911  * Determine if there are existing processes being debugged
912  * that used to be (and sometime later will be again) children
913  * of a specific parent (while matching wait criteria)
914  */
915 static bool
916 debugged_child_exists(idtype_t idtype, id_t id, int options, siginfo_t *si,
917     const struct proc *parent)
918 {
919 	struct proc *pp;
920 
921 	/*
922 	 * If we are searching for a specific pid, we can optimise a little
923 	 */
924 	if (idtype == P_PID) {
925 		/*
926 		 * Check the specific process to see if its real parent is us
927 		 */
928 		pp = proc_find_raw((pid_t)id);
929 		if (pp != NULL && pp->p_stat != SIDL && pp->p_opptr == parent) {
930 			/*
931 			 * using P_ALL here avoids match_process() doing the
932 			 * same work that we just did, but incorrectly for
933 			 * this scenario.
934 			 */
935 			if (match_process(parent, &pp, P_ALL, id, options,
936 			    NULL, si))
937 				return true;
938 		}
939 		return false;
940 	}
941 
942 	/*
943 	 * For the hard cases, just look everywhere to see if some
944 	 * stolen (reparented) process is really our lost child.
945 	 * Then check if that process could satisfy the wait conditions.
946 	 */
947 
948 	/*
949 	 * XXX inefficient, but hopefully fairly rare.
950 	 * XXX should really use a list of reparented processes.
951 	 */
952 	PROCLIST_FOREACH(pp, &allproc) {
953 		if (pp->p_stat == SIDL)		/* XXX impossible ?? */
954 			continue;
955 		if (pp->p_opptr == parent &&
956 		    match_process(parent, &pp, idtype, id, options, NULL, si))
957 			return true;
958 	}
959 	PROCLIST_FOREACH(pp, &zombproc) {
960 		if (pp->p_stat == SIDL)		/* XXX impossible ?? */
961 			continue;
962 		if (pp->p_opptr == parent &&
963 		    match_process(parent, &pp, idtype, id, options, NULL, si))
964 			return true;
965 	}
966 
967 	return false;
968 }
969 
970 /*
971  * Scan list of child processes for a child process that has stopped or
972  * exited.  Used by sys_wait4 and 'compat' equivalents.
973  *
974  * Must be called with the proc_lock held, and may release while waiting.
975  */
976 static int
977 find_stopped_child(struct proc *parent, idtype_t idtype, id_t id, int options,
978     struct proc **child_p, struct wrusage *wru, siginfo_t *si)
979 {
980 	struct proc *child, *dead;
981 	int error;
982 
983 	KASSERT(mutex_owned(proc_lock));
984 
985 	if (options & ~WALLOPTS) {
986 		*child_p = NULL;
987 		return EINVAL;
988 	}
989 
990 	if ((options & WSELECTOPTS) == 0) {
991 		/*
992 		 * We will be unable to find any matching processes,
993 		 * because there are no known events to look for.
994 		 * Prefer to return error instead of blocking
995 		 * indefinitely.
996 		 */
997 		*child_p = NULL;
998 		return EINVAL;
999 	}
1000 
1001 	if ((pid_t)id == WAIT_MYPGRP && (idtype == P_PID || idtype == P_PGID)) {
1002 		mutex_enter(parent->p_lock);
1003 		id = (id_t)parent->p_pgid;
1004 		mutex_exit(parent->p_lock);
1005 		idtype = P_PGID;
1006 	}
1007 
1008 	for (;;) {
1009 		error = ECHILD;
1010 		dead = NULL;
1011 
1012 		LIST_FOREACH(child, &parent->p_children, p_sibling) {
1013 			int rv = match_process(parent, &child, idtype, id,
1014 			    options, wru, si);
1015 			if (rv == -1)
1016 				break;
1017 			if (rv == 0)
1018 				continue;
1019 
1020 			/*
1021 			 * Wait for processes with p_exitsig != SIGCHLD
1022 			 * processes only if WALTSIG is set; wait for
1023 			 * processes with p_exitsig == SIGCHLD only
1024 			 * if WALTSIG is clear.
1025 			 */
1026 			if (((options & WALLSIG) == 0) &&
1027 			    (options & WALTSIG ? child->p_exitsig == SIGCHLD
1028 						: P_EXITSIG(child) != SIGCHLD)){
1029 				if (rv == 2) {
1030 					child = NULL;
1031 					break;
1032 				}
1033 				continue;
1034 			}
1035 
1036 			error = 0;
1037 			if ((options & WNOZOMBIE) == 0) {
1038 				if (child->p_stat == SZOMB)
1039 					break;
1040 				if (child->p_stat == SDEAD) {
1041 					/*
1042 					 * We may occasionally arrive here
1043 					 * after receiving a signal, but
1044 					 * immediately before the child
1045 					 * process is zombified.  The wait
1046 					 * will be short, so avoid returning
1047 					 * to userspace.
1048 					 */
1049 					dead = child;
1050 				}
1051 			}
1052 
1053 			if ((options & WCONTINUED) != 0 &&
1054 			    child->p_xsig == SIGCONT &&
1055 			    (child->p_sflag & PS_CONTINUED)) {
1056 				if ((options & WNOWAIT) == 0) {
1057 					child->p_sflag &= ~PS_CONTINUED;
1058 					child->p_waited = 1;
1059 					parent->p_nstopchild--;
1060 				}
1061 				if (si) {
1062 					si->si_status = child->p_xsig;
1063 					si->si_code = CLD_CONTINUED;
1064 				}
1065 				break;
1066 			}
1067 
1068 			if ((options & (WTRAPPED|WSTOPPED)) != 0 &&
1069 			    child->p_stat == SSTOP &&
1070 			    child->p_waited == 0 &&
1071 			    ((child->p_slflag & PSL_TRACED) ||
1072 			    options & (WUNTRACED|WSTOPPED))) {
1073 				if ((options & WNOWAIT) == 0) {
1074 					child->p_waited = 1;
1075 					parent->p_nstopchild--;
1076 				}
1077 				if (si) {
1078 					si->si_status = child->p_xsig;
1079 					si->si_code =
1080 					    (child->p_slflag & PSL_TRACED) ?
1081 					    CLD_TRAPPED : CLD_STOPPED;
1082 				}
1083 				break;
1084 			}
1085 			if (parent->p_nstopchild == 0 || rv == 2) {
1086 				child = NULL;
1087 				break;
1088 			}
1089 		}
1090 
1091 		/*
1092 		 * If we found nothing, but we are the bereaved parent
1093 		 * of a stolen child, look and see if that child (or
1094 		 * one of them) meets our search criteria.   If so, then
1095 		 * we cannot succeed, but we can hang (wait...),
1096 		 * or if WNOHANG, return 0 instead of ECHILD
1097 		 */
1098 		if (child == NULL && error == ECHILD &&
1099 		    (parent->p_slflag & PSL_CHTRACED) &&
1100 		    debugged_child_exists(idtype, id, options, si, parent))
1101 			error = 0;
1102 
1103 		if (child != NULL || error != 0 ||
1104 		    ((options & WNOHANG) != 0 && dead == NULL)) {
1105 			*child_p = child;
1106 			return error;
1107 		}
1108 
1109 		/*
1110 		 * Wait for another child process to stop.
1111 		 */
1112 		error = cv_wait_sig(&parent->p_waitcv, proc_lock);
1113 
1114 		if (error != 0) {
1115 			*child_p = NULL;
1116 			return error;
1117 		}
1118 	}
1119 }
1120 
1121 /*
1122  * Free a process after parent has taken all the state info.  Must be called
1123  * with the proclist lock held, and will release before returning.
1124  *
1125  * *ru is returned to the caller, and must be freed by the caller.
1126  */
1127 static void
1128 proc_free(struct proc *p, struct wrusage *wru)
1129 {
1130 	struct proc *parent = p->p_pptr;
1131 	struct lwp *l;
1132 	ksiginfo_t ksi;
1133 	kauth_cred_t cred1, cred2;
1134 	uid_t uid;
1135 
1136 	KASSERT(mutex_owned(proc_lock));
1137 	KASSERT(p->p_nlwps == 1);
1138 	KASSERT(p->p_nzlwps == 1);
1139 	KASSERT(p->p_nrlwps == 0);
1140 	KASSERT(p->p_stat == SZOMB);
1141 
1142 	/*
1143 	 * If we got the child via ptrace(2) or procfs, and
1144 	 * the parent is different (meaning the process was
1145 	 * attached, rather than run as a child), then we need
1146 	 * to give it back to the old parent, and send the
1147 	 * parent the exit signal.  The rest of the cleanup
1148 	 * will be done when the old parent waits on the child.
1149 	 */
1150 	if ((p->p_slflag & PSL_TRACED) != 0 && p->p_opptr != parent) {
1151 		mutex_enter(p->p_lock);
1152 		p->p_slflag &= ~(PSL_TRACED|PSL_SYSCALL);
1153 		mutex_exit(p->p_lock);
1154 		parent = (p->p_opptr == NULL) ? initproc : p->p_opptr;
1155 		proc_reparent(p, parent);
1156 		p->p_opptr = NULL;
1157 		if (p->p_exitsig != 0) {
1158 			exit_psignal(p, parent, &ksi);
1159 			kpsignal(parent, &ksi, NULL);
1160 		}
1161 		cv_broadcast(&parent->p_waitcv);
1162 		mutex_exit(proc_lock);
1163 		return;
1164 	}
1165 
1166 	sched_proc_exit(parent, p);
1167 
1168 	/*
1169 	 * Add child times of exiting process onto its own times.
1170 	 * This cannot be done any earlier else it might get done twice.
1171 	 */
1172 	l = LIST_FIRST(&p->p_lwps);
1173 	p->p_stats->p_ru.ru_nvcsw += (l->l_ncsw - l->l_nivcsw);
1174 	p->p_stats->p_ru.ru_nivcsw += l->l_nivcsw;
1175 	ruadd(&p->p_stats->p_ru, &l->l_ru);
1176 	ruadd(&p->p_stats->p_ru, &p->p_stats->p_cru);
1177 	ruadd(&parent->p_stats->p_cru, &p->p_stats->p_ru);
1178 	if (wru != NULL) {
1179 		wru->wru_self = p->p_stats->p_ru;
1180 		wru->wru_children = p->p_stats->p_cru;
1181 	}
1182 	p->p_xsig = 0;
1183 	p->p_xexit = 0;
1184 
1185 	/*
1186 	 * At this point we are going to start freeing the final resources.
1187 	 * If anyone tries to access the proc structure after here they will
1188 	 * get a shock - bits are missing.  Attempt to make it hard!  We
1189 	 * don't bother with any further locking past this point.
1190 	 */
1191 	p->p_stat = SIDL;		/* not even a zombie any more */
1192 	LIST_REMOVE(p, p_list);	/* off zombproc */
1193 	parent->p_nstopchild--;
1194 	LIST_REMOVE(p, p_sibling);
1195 
1196 	/*
1197 	 * Let pid be reallocated.
1198 	 */
1199 	proc_free_pid(p->p_pid);
1200 
1201 	/*
1202 	 * Unlink process from its process group.
1203 	 * Releases the proc_lock.
1204 	 */
1205 	proc_leavepgrp(p);
1206 
1207 	/*
1208 	 * Delay release until after lwp_free.
1209 	 */
1210 	cred2 = l->l_cred;
1211 
1212 	/*
1213 	 * Free the last LWP's resources.
1214 	 *
1215 	 * lwp_free ensures the LWP is no longer running on another CPU.
1216 	 */
1217 	lwp_free(l, false, true);
1218 
1219 	/*
1220 	 * Now no one except us can reach the process p.
1221 	 */
1222 
1223 	/*
1224 	 * Decrement the count of procs running with this uid.
1225 	 */
1226 	cred1 = p->p_cred;
1227 	uid = kauth_cred_getuid(cred1);
1228 	(void)chgproccnt(uid, -1);
1229 
1230 	/*
1231 	 * Release substructures.
1232 	 */
1233 
1234 	lim_free(p->p_limit);
1235 	pstatsfree(p->p_stats);
1236 	kauth_cred_free(cred1);
1237 	kauth_cred_free(cred2);
1238 
1239 	/*
1240 	 * Release reference to text vnode
1241 	 */
1242 	if (p->p_textvp)
1243 		vrele(p->p_textvp);
1244 	kmem_strfree(p->p_path);
1245 
1246 	mutex_destroy(&p->p_auxlock);
1247 	mutex_obj_free(p->p_lock);
1248 	mutex_destroy(&p->p_stmutex);
1249 	cv_destroy(&p->p_waitcv);
1250 	cv_destroy(&p->p_lwpcv);
1251 	rw_destroy(&p->p_reflock);
1252 
1253 	proc_free_mem(p);
1254 }
1255 
1256 /*
1257  * Change the parent of a process for tracing purposes.
1258  */
1259 void
1260 proc_changeparent(struct proc *t, struct proc *p)
1261 {
1262 	SET(t->p_slflag, PSL_TRACED);
1263 	t->p_opptr = t->p_pptr;
1264 	if (t->p_pptr == p)
1265 		return;
1266 	struct proc *parent = t->p_pptr;
1267 
1268 	if (parent->p_lock < t->p_lock) {
1269 		if (!mutex_tryenter(parent->p_lock)) {
1270 			mutex_exit(t->p_lock);
1271 			mutex_enter(parent->p_lock);
1272 			mutex_enter(t->p_lock);
1273 		}
1274 	} else if (parent->p_lock > t->p_lock) {
1275 		mutex_enter(parent->p_lock);
1276 	}
1277 	parent->p_slflag |= PSL_CHTRACED;
1278 	proc_reparent(t, p);
1279 	if (parent->p_lock != t->p_lock)
1280 		mutex_exit(parent->p_lock);
1281 }
1282 
1283 /*
1284  * make process 'parent' the new parent of process 'child'.
1285  *
1286  * Must be called with proc_lock held.
1287  */
1288 void
1289 proc_reparent(struct proc *child, struct proc *parent)
1290 {
1291 
1292 	KASSERT(mutex_owned(proc_lock));
1293 
1294 	if (child->p_pptr == parent)
1295 		return;
1296 
1297 	if (child->p_stat == SZOMB || child->p_stat == SDEAD ||
1298 	    (child->p_stat == SSTOP && !child->p_waited)) {
1299 		child->p_pptr->p_nstopchild--;
1300 		parent->p_nstopchild++;
1301 	}
1302 	if (parent == initproc) {
1303 		child->p_exitsig = SIGCHLD;
1304 		child->p_ppid = parent->p_pid;
1305 	}
1306 
1307 	LIST_REMOVE(child, p_sibling);
1308 	LIST_INSERT_HEAD(&parent->p_children, child, p_sibling);
1309 	child->p_pptr = parent;
1310 }
1311