xref: /openbsd-src/sys/kern/kern_exit.c (revision 7c0ec4b8992567abb1e1536622dc789a9a39d9f1)
1 /*	$OpenBSD: kern_exit.c,v 1.233 2024/09/06 08:21:21 mpi Exp $	*/
2 /*	$NetBSD: kern_exit.c,v 1.39 1996/04/22 01:38:25 christos Exp $	*/
3 
4 /*
5  * Copyright (c) 1982, 1986, 1989, 1991, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  * (c) UNIX System Laboratories, Inc.
8  * All or some portions of this file are derived from material licensed
9  * to the University of California by American Telephone and Telegraph
10  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
11  * the permission of UNIX System Laboratories, Inc.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  * 3. Neither the name of the University nor the names of its contributors
22  *    may be used to endorse or promote products derived from this software
23  *    without specific prior written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
29  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35  * SUCH DAMAGE.
36  *
37  *	@(#)kern_exit.c	8.7 (Berkeley) 2/12/94
38  */
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/proc.h>
43 #include <sys/time.h>
44 #include <sys/resource.h>
45 #include <sys/wait.h>
46 #include <sys/vnode.h>
47 #include <sys/malloc.h>
48 #include <sys/resourcevar.h>
49 #include <sys/ptrace.h>
50 #include <sys/acct.h>
51 #include <sys/filedesc.h>
52 #include <sys/signalvar.h>
53 #include <sys/sched.h>
54 #include <sys/ktrace.h>
55 #include <sys/pool.h>
56 #include <sys/mutex.h>
57 #ifdef SYSVSEM
58 #include <sys/sem.h>
59 #endif
60 #include <sys/witness.h>
61 
62 #include <sys/mount.h>
63 #include <sys/syscallargs.h>
64 
65 #include <uvm/uvm_extern.h>
66 
67 #include "kcov.h"
68 #if NKCOV > 0
69 #include <sys/kcov.h>
70 #endif
71 
72 void	proc_finish_wait(struct proc *, struct process *);
73 void	process_clear_orphan(struct process *);
74 void	process_zap(struct process *);
75 void	proc_free(struct proc *);
76 void	unveil_destroy(struct process *ps);
77 
78 /*
79  * exit --
80  *	Death of process.
81  */
82 int
83 sys_exit(struct proc *p, void *v, register_t *retval)
84 {
85 	struct sys_exit_args /* {
86 		syscallarg(int) rval;
87 	} */ *uap = v;
88 
89 	exit1(p, SCARG(uap, rval), 0, EXIT_NORMAL);
90 	/* NOTREACHED */
91 	return (0);
92 }
93 
94 int
95 sys___threxit(struct proc *p, void *v, register_t *retval)
96 {
97 	struct sys___threxit_args /* {
98 		syscallarg(pid_t *) notdead;
99 	} */ *uap = v;
100 
101 	if (SCARG(uap, notdead) != NULL) {
102 		pid_t zero = 0;
103 		if (copyout(&zero, SCARG(uap, notdead), sizeof(zero)))
104 			psignal(p, SIGSEGV);
105 	}
106 	exit1(p, 0, 0, EXIT_THREAD);
107 
108 	return (0);
109 }
110 
111 /*
112  * Exit: deallocate address space and other resources, change proc state
113  * to zombie, and unlink proc from allproc and parent's lists.  Save exit
114  * status and rusage for wait().  Check for child processes and orphan them.
115  */
116 void
117 exit1(struct proc *p, int xexit, int xsig, int flags)
118 {
119 	struct process *pr, *qr, *nqr;
120 	struct rusage *rup;
121 	struct timespec ts, pts;
122 
123 	atomic_setbits_int(&p->p_flag, P_WEXIT);
124 
125 	pr = p->p_p;
126 
127 	/* single-threaded? */
128 	if (!P_HASSIBLING(p)) {
129 		flags = EXIT_NORMAL;
130 	} else {
131 		/* nope, multi-threaded */
132 		if (flags == EXIT_NORMAL)
133 			single_thread_set(p, SINGLE_EXIT);
134 	}
135 
136 	if (flags == EXIT_NORMAL && !(pr->ps_flags & PS_EXITING)) {
137 		if (pr->ps_pid == 1)
138 			panic("init died (signal %d, exit %d)", xsig, xexit);
139 
140 		atomic_setbits_int(&pr->ps_flags, PS_EXITING);
141 		pr->ps_xexit = xexit;
142 		pr->ps_xsig  = xsig;
143 
144 		/*
145 		 * If parent is waiting for us to exit or exec, PS_PPWAIT
146 		 * is set; we wake up the parent early to avoid deadlock.
147 		 */
148 		if (pr->ps_flags & PS_PPWAIT) {
149 			atomic_clearbits_int(&pr->ps_flags, PS_PPWAIT);
150 			atomic_clearbits_int(&pr->ps_pptr->ps_flags,
151 			    PS_ISPWAIT);
152 			wakeup(pr->ps_pptr);
153 		}
154 
155 		/* Wait for concurrent `allprocess' loops */
156 		refcnt_finalize(&pr->ps_refcnt, "psdtor");
157 	}
158 
159 	/* unlink ourselves from the active threads */
160 	mtx_enter(&pr->ps_mtx);
161 	TAILQ_REMOVE(&pr->ps_threads, p, p_thr_link);
162 	pr->ps_threadcnt--;
163 	pr->ps_exitcnt++;
164 
165 	/*
166 	 * if somebody else wants to take us to single threaded mode,
167 	 * count ourselves out.
168 	 */
169 	if (pr->ps_single) {
170 		if (--pr->ps_singlecnt == 0)
171 			wakeup(&pr->ps_singlecnt);
172 	}
173 
174 	/* proc is off ps_threads list so update accounting of process now */
175 	nanouptime(&ts);
176 	if (timespeccmp(&ts, &curcpu()->ci_schedstate.spc_runtime, <))
177 		timespecclear(&pts);
178 	else
179 		timespecsub(&ts, &curcpu()->ci_schedstate.spc_runtime, &pts);
180 	tu_enter(&p->p_tu);
181 	timespecadd(&p->p_tu.tu_runtime, &pts, &p->p_tu.tu_runtime);
182 	tu_leave(&p->p_tu);
183 	/* adjust spc_runtime to not double account the runtime from above */
184 	curcpu()->ci_schedstate.spc_runtime = ts;
185 	tuagg_add_process(p->p_p, p);
186 
187 	if ((p->p_flag & P_THREAD) == 0) {
188 		/* main thread gotta wait because it has the pid, et al */
189 		while (pr->ps_threadcnt + pr->ps_exitcnt > 1)
190 			msleep_nsec(&pr->ps_threads, &pr->ps_mtx, PWAIT,
191 			    "thrdeath", INFSLP);
192 	}
193 	mtx_leave(&pr->ps_mtx);
194 
195 	rup = pr->ps_ru;
196 	if (rup == NULL) {
197 		rup = pool_get(&rusage_pool, PR_WAITOK | PR_ZERO);
198 		if (pr->ps_ru == NULL) {
199 			pr->ps_ru = rup;
200 		} else {
201 			pool_put(&rusage_pool, rup);
202 			rup = pr->ps_ru;
203 		}
204 	}
205 	p->p_siglist = 0;
206 	if ((p->p_flag & P_THREAD) == 0)
207 		pr->ps_siglist = 0;
208 
209 	kqpoll_exit();
210 
211 #if NKCOV > 0
212 	kcov_exit(p);
213 #endif
214 
215 	if ((p->p_flag & P_THREAD) == 0) {
216 		if (pr->ps_flags & PS_PROFIL)
217 			stopprofclock(pr);
218 
219 		sigio_freelist(&pr->ps_sigiolst);
220 
221 		/* close open files and release open-file table */
222 		fdfree(p);
223 
224 		cancel_all_itimers();
225 
226 		timeout_del(&pr->ps_rucheck_to);
227 #ifdef SYSVSEM
228 		semexit(pr);
229 #endif
230 		killjobc(pr);
231 #ifdef ACCOUNTING
232 		acct_process(p);
233 #endif
234 
235 #ifdef KTRACE
236 		/* release trace file */
237 		if (pr->ps_tracevp)
238 			ktrcleartrace(pr);
239 #endif
240 
241 		unveil_destroy(pr);
242 
243 		free(pr->ps_pin.pn_pins, M_PINSYSCALL,
244 		    pr->ps_pin.pn_npins * sizeof(u_int));
245 		free(pr->ps_libcpin.pn_pins, M_PINSYSCALL,
246 		    pr->ps_libcpin.pn_npins * sizeof(u_int));
247 
248 		/*
249 		 * If parent has the SAS_NOCLDWAIT flag set, we're not
250 		 * going to become a zombie.
251 		 */
252 		if (pr->ps_pptr->ps_sigacts->ps_sigflags & SAS_NOCLDWAIT)
253 			atomic_setbits_int(&pr->ps_flags, PS_NOZOMBIE);
254 	}
255 
256 	p->p_fd = NULL;		/* zap the thread's copy */
257 
258 	/* Release the thread's read reference of resource limit structure. */
259 	if (p->p_limit != NULL) {
260 		struct plimit *limit;
261 
262 		limit = p->p_limit;
263 		p->p_limit = NULL;
264 		lim_free(limit);
265 	}
266 
267         /*
268 	 * Remove proc from pidhash chain and allproc so looking
269 	 * it up won't work.  We will put the proc on the
270 	 * deadproc list later (using the p_hash member), and
271 	 * wake up the reaper when we do.  If this is the last
272 	 * thread of a process that isn't PS_NOZOMBIE, we'll put
273 	 * the process on the zombprocess list below.
274 	 */
275 	/*
276 	 * NOTE: WE ARE NO LONGER ALLOWED TO SLEEP!
277 	 */
278 	p->p_stat = SDEAD;
279 
280 	LIST_REMOVE(p, p_hash);
281 	LIST_REMOVE(p, p_list);
282 
283 	if ((p->p_flag & P_THREAD) == 0) {
284 		LIST_REMOVE(pr, ps_hash);
285 		LIST_REMOVE(pr, ps_list);
286 
287 		if ((pr->ps_flags & PS_NOZOMBIE) == 0)
288 			LIST_INSERT_HEAD(&zombprocess, pr, ps_list);
289 		else {
290 			/*
291 			 * Not going to be a zombie, so it's now off all
292 			 * the lists scanned by ispidtaken(), so block
293 			 * fast reuse of the pid now.
294 			 */
295 			freepid(pr->ps_pid);
296 		}
297 
298 		/*
299 		 * Reparent children to their original parent, in case
300 		 * they were being traced, or to init(8).
301 		 */
302 		qr = LIST_FIRST(&pr->ps_children);
303 		if (qr)		/* only need this if any child is S_ZOMB */
304 			wakeup(initprocess);
305 		for (; qr != NULL; qr = nqr) {
306 			nqr = LIST_NEXT(qr, ps_sibling);
307 			/*
308 			 * Traced processes are killed since their
309 			 * existence means someone is screwing up.
310 			 */
311 			if (qr->ps_flags & PS_TRACED &&
312 			    !(qr->ps_flags & PS_EXITING)) {
313 				process_untrace(qr);
314 
315 				/*
316 				 * If single threading is active,
317 				 * direct the signal to the active
318 				 * thread to avoid deadlock.
319 				 */
320 				if (qr->ps_single)
321 					ptsignal(qr->ps_single, SIGKILL,
322 					    STHREAD);
323 				else
324 					prsignal(qr, SIGKILL);
325 			} else {
326 				process_reparent(qr, initprocess);
327 			}
328 		}
329 
330 		/*
331 		 * Make sure orphans won't remember the exiting process.
332 		 */
333 		while ((qr = LIST_FIRST(&pr->ps_orphans)) != NULL) {
334 			KASSERT(qr->ps_oppid == pr->ps_pid);
335 			qr->ps_oppid = 0;
336 			process_clear_orphan(qr);
337 		}
338 	}
339 
340 	/* add thread's accumulated rusage into the process's total */
341 	ruadd(rup, &p->p_ru);
342 
343 	/*
344 	 * clear %cpu usage during swap
345 	 */
346 	p->p_pctcpu = 0;
347 
348 	if ((p->p_flag & P_THREAD) == 0) {
349 		/*
350 		 * Final thread has died, so add on our children's rusage
351 		 * and calculate the total times.
352 		 */
353 		calcru(&pr->ps_tu, &rup->ru_utime, &rup->ru_stime, NULL);
354 		ruadd(rup, &pr->ps_cru);
355 
356 		/*
357 		 * Notify parent that we're gone.  If we're not going to
358 		 * become a zombie, reparent to process 1 (init) so that
359 		 * we can wake our original parent to possibly unblock
360 		 * wait4() to return ECHILD.
361 		 */
362 		if (pr->ps_flags & PS_NOZOMBIE) {
363 			struct process *ppr = pr->ps_pptr;
364 			process_reparent(pr, initprocess);
365 			wakeup(ppr);
366 		}
367 	}
368 
369 	/* just a thread? check if last one standing. */
370 	if (p->p_flag & P_THREAD) {
371 		/* scheduler_wait_hook(pr->ps_mainproc, p); XXX */
372 		mtx_enter(&pr->ps_mtx);
373 		pr->ps_exitcnt--;
374 		if (pr->ps_threadcnt + pr->ps_exitcnt == 1)
375 			wakeup(&pr->ps_threads);
376 		mtx_leave(&pr->ps_mtx);
377 	}
378 
379 	/*
380 	 * Other substructures are freed from reaper and wait().
381 	 */
382 
383 	/*
384 	 * Finally, call machine-dependent code to switch to a new
385 	 * context (possibly the idle context).  Once we are no longer
386 	 * using the dead process's vmspace and stack, exit2() will be
387 	 * called to schedule those resources to be released by the
388 	 * reaper thread.
389 	 *
390 	 * Note that cpu_exit() will end with a call equivalent to
391 	 * cpu_switch(), finishing our execution (pun intended).
392 	 */
393 	cpu_exit(p);
394 	panic("cpu_exit returned");
395 }
396 
397 /*
398  * Locking of this proclist is special; it's accessed in a
399  * critical section of process exit, and thus locking it can't
400  * modify interrupt state.  We use a simple spin lock for this
401  * proclist.  We use the p_hash member to linkup to deadproc.
402  */
403 struct mutex deadproc_mutex =
404     MUTEX_INITIALIZER_FLAGS(IPL_NONE, "deadproc", MTX_NOWITNESS);
405 struct proclist deadproc = LIST_HEAD_INITIALIZER(deadproc);
406 
407 /*
408  * We are called from sched_idle() once it is safe to schedule the
409  * dead process's resources to be freed. So this is not allowed to sleep.
410  *
411  * We lock the deadproc list, place the proc on that list (using
412  * the p_hash member), and wake up the reaper.
413  */
414 void
415 exit2(struct proc *p)
416 {
417 	/* account the remainder of time spent in exit1() */
418 	mtx_enter(&p->p_p->ps_mtx);
419 	tuagg_add_process(p->p_p, p);
420 	mtx_leave(&p->p_p->ps_mtx);
421 
422 	mtx_enter(&deadproc_mutex);
423 	LIST_INSERT_HEAD(&deadproc, p, p_hash);
424 	mtx_leave(&deadproc_mutex);
425 
426 	wakeup(&deadproc);
427 }
428 
429 void
430 proc_free(struct proc *p)
431 {
432 	crfree(p->p_ucred);
433 	pool_put(&proc_pool, p);
434 	atomic_dec_int(&nthreads);
435 }
436 
437 /*
438  * Process reaper.  This is run by a kernel thread to free the resources
439  * of a dead process.  Once the resources are free, the process becomes
440  * a zombie, and the parent is allowed to read the undead's status.
441  */
442 void
443 reaper(void *arg)
444 {
445 	struct proc *p;
446 
447 	KERNEL_UNLOCK();
448 
449 	SCHED_ASSERT_UNLOCKED();
450 
451 	for (;;) {
452 		mtx_enter(&deadproc_mutex);
453 		while ((p = LIST_FIRST(&deadproc)) == NULL)
454 			msleep_nsec(&deadproc, &deadproc_mutex, PVM, "reaper",
455 			    INFSLP);
456 
457 		/* Remove us from the deadproc list. */
458 		LIST_REMOVE(p, p_hash);
459 		mtx_leave(&deadproc_mutex);
460 
461 		WITNESS_THREAD_EXIT(p);
462 
463 		/*
464 		 * Free the VM resources we're still holding on to.
465 		 * We must do this from a valid thread because doing
466 		 * so may block.
467 		 */
468 		uvm_uarea_free(p);
469 		p->p_vmspace = NULL;		/* zap the thread's copy */
470 
471 		if (p->p_flag & P_THREAD) {
472 			/* Just a thread */
473 			proc_free(p);
474 		} else {
475 			struct process *pr = p->p_p;
476 
477 			/* Release the rest of the process's vmspace */
478 			uvm_exit(pr);
479 
480 			KERNEL_LOCK();
481 			if ((pr->ps_flags & PS_NOZOMBIE) == 0) {
482 				/* Process is now a true zombie. */
483 				atomic_setbits_int(&pr->ps_flags, PS_ZOMBIE);
484 			}
485 
486 			/* Notify listeners of our demise and clean up. */
487 			knote_processexit(pr);
488 
489 			if (pr->ps_flags & PS_ZOMBIE) {
490 				/* Post SIGCHLD and wake up parent. */
491 				prsignal(pr->ps_pptr, SIGCHLD);
492 				wakeup(pr->ps_pptr);
493 			} else {
494 				/* No one will wait for us, just zap it. */
495 				process_zap(pr);
496 			}
497 			KERNEL_UNLOCK();
498 		}
499 	}
500 }
501 
502 int
503 dowait6(struct proc *q, idtype_t idtype, id_t id, int *statusp, int options,
504     struct rusage *rusage, siginfo_t *info, register_t *retval)
505 {
506 	int nfound;
507 	struct process *pr;
508 	struct proc *p;
509 	int error;
510 
511 	if (info != NULL)
512 		memset(info, 0, sizeof(*info));
513 
514 loop:
515 	nfound = 0;
516 	LIST_FOREACH(pr, &q->p_p->ps_children, ps_sibling) {
517 		if ((pr->ps_flags & PS_NOZOMBIE) ||
518 		    (idtype == P_PID && id != pr->ps_pid) ||
519 		    (idtype == P_PGID && id != pr->ps_pgid))
520 			continue;
521 
522 		p = pr->ps_mainproc;
523 
524 		nfound++;
525 		if ((options & WEXITED) && (pr->ps_flags & PS_ZOMBIE)) {
526 			*retval = pr->ps_pid;
527 			if (info != NULL) {
528 				info->si_pid = pr->ps_pid;
529 				info->si_uid = pr->ps_ucred->cr_uid;
530 				info->si_signo = SIGCHLD;
531 				if (pr->ps_xsig == 0) {
532 					info->si_code = CLD_EXITED;
533 					info->si_status = pr->ps_xexit;
534 				} else if (WCOREDUMP(pr->ps_xsig)) {
535 					info->si_code = CLD_DUMPED;
536 					info->si_status = _WSTATUS(pr->ps_xsig);
537 				} else {
538 					info->si_code = CLD_KILLED;
539 					info->si_status = _WSTATUS(pr->ps_xsig);
540 				}
541 			}
542 
543 			if (statusp != NULL)
544 				*statusp = W_EXITCODE(pr->ps_xexit,
545 				    pr->ps_xsig);
546 			if (rusage != NULL)
547 				memcpy(rusage, pr->ps_ru, sizeof(*rusage));
548 			if ((options & WNOWAIT) == 0)
549 				proc_finish_wait(q, pr);
550 			return (0);
551 		}
552 		if ((options & WTRAPPED) &&
553 		    (pr->ps_flags & PS_TRACED) &&
554 		    (pr->ps_flags & PS_WAITED) == 0 && pr->ps_single &&
555 		    pr->ps_single->p_stat == SSTOP) {
556 			if (single_thread_wait(pr, 0))
557 				goto loop;
558 
559 			if ((options & WNOWAIT) == 0)
560 				atomic_setbits_int(&pr->ps_flags, PS_WAITED);
561 
562 			*retval = pr->ps_pid;
563 			if (info != NULL) {
564 				info->si_pid = pr->ps_pid;
565 				info->si_uid = pr->ps_ucred->cr_uid;
566 				info->si_signo = SIGCHLD;
567 				info->si_code = CLD_TRAPPED;
568 				info->si_status = pr->ps_xsig;
569 			}
570 
571 			if (statusp != NULL)
572 				*statusp = W_STOPCODE(pr->ps_xsig);
573 			if (rusage != NULL)
574 				memset(rusage, 0, sizeof(*rusage));
575 			return (0);
576 		}
577 		if (p->p_stat == SSTOP &&
578 		    (pr->ps_flags & PS_WAITED) == 0 &&
579 		    (p->p_flag & P_SUSPSINGLE) == 0 &&
580 		    ((pr->ps_flags & PS_TRACED) ||
581 		    (options & WUNTRACED))) {
582 			if ((options & WNOWAIT) == 0)
583 				atomic_setbits_int(&pr->ps_flags, PS_WAITED);
584 
585 			*retval = pr->ps_pid;
586 			if (info != 0) {
587 				info->si_pid = pr->ps_pid;
588 				info->si_uid = pr->ps_ucred->cr_uid;
589 				info->si_signo = SIGCHLD;
590 				info->si_code = CLD_STOPPED;
591 				info->si_status = pr->ps_xsig;
592 			}
593 
594 			if (statusp != NULL)
595 				*statusp = W_STOPCODE(pr->ps_xsig);
596 			if (rusage != NULL)
597 				memset(rusage, 0, sizeof(*rusage));
598 			return (0);
599 		}
600 		if ((options & WCONTINUED) && (pr->ps_flags & PS_CONTINUED)) {
601 			if ((options & WNOWAIT) == 0)
602 				atomic_clearbits_int(&pr->ps_flags,
603 				    PS_CONTINUED);
604 
605 			*retval = pr->ps_pid;
606 			if (info != NULL) {
607 				info->si_pid = pr->ps_pid;
608 				info->si_uid = pr->ps_ucred->cr_uid;
609 				info->si_signo = SIGCHLD;
610 				info->si_code = CLD_CONTINUED;
611 				info->si_status = SIGCONT;
612 			}
613 
614 			if (statusp != NULL)
615 				*statusp = _WCONTINUED;
616 			if (rusage != NULL)
617 				memset(rusage, 0, sizeof(*rusage));
618 			return (0);
619 		}
620 	}
621 	/*
622 	 * Look in the orphans list too, to allow the parent to
623 	 * collect its child's exit status even if child is being
624 	 * debugged.
625 	 *
626 	 * Debugger detaches from the parent upon successful
627 	 * switch-over from parent to child.  At this point due to
628 	 * re-parenting the parent loses the child to debugger and a
629 	 * wait4(2) call would report that it has no children to wait
630 	 * for.  By maintaining a list of orphans we allow the parent
631 	 * to successfully wait until the child becomes a zombie.
632 	 */
633 	if (nfound == 0) {
634 		LIST_FOREACH(pr, &q->p_p->ps_orphans, ps_orphan) {
635 			if ((pr->ps_flags & PS_NOZOMBIE) ||
636 			    (idtype == P_PID && id != pr->ps_pid) ||
637 			    (idtype == P_PGID && id != pr->ps_pgid))
638 				continue;
639 			nfound++;
640 			break;
641 		}
642 	}
643 	if (nfound == 0)
644 		return (ECHILD);
645 	if (options & WNOHANG) {
646 		*retval = 0;
647 		return (0);
648 	}
649 	if ((error = tsleep_nsec(q->p_p, PWAIT | PCATCH, "wait", INFSLP)) != 0)
650 		return (error);
651 	goto loop;
652 }
653 
654 int
655 sys_wait4(struct proc *q, void *v, register_t *retval)
656 {
657 	struct sys_wait4_args /* {
658 		syscallarg(pid_t) pid;
659 		syscallarg(int *) status;
660 		syscallarg(int) options;
661 		syscallarg(struct rusage *) rusage;
662 	} */ *uap = v;
663 	struct rusage ru;
664 	pid_t pid = SCARG(uap, pid);
665 	int options = SCARG(uap, options);
666 	int status, error;
667 	idtype_t idtype;
668 	id_t id;
669 
670 	if (SCARG(uap, options) &~ (WUNTRACED|WNOHANG|WCONTINUED))
671 		return (EINVAL);
672 	options |= WEXITED | WTRAPPED;
673 
674 	if (SCARG(uap, pid) == WAIT_MYPGRP) {
675 		idtype = P_PGID;
676 		id = q->p_p->ps_pgid;
677 	} else if (SCARG(uap, pid) == WAIT_ANY) {
678 		idtype = P_ALL;
679 		id = 0;
680 	} else if (pid < 0) {
681 		idtype = P_PGID;
682 		id = -pid;
683 	} else {
684 		idtype = P_PID;
685 		id = pid;
686 	}
687 
688 	error = dowait6(q, idtype, id,
689 	    SCARG(uap, status) ? &status : NULL, options,
690 	    SCARG(uap, rusage) ? &ru : NULL, NULL, retval);
691 	if (error == 0 && *retval > 0 && SCARG(uap, status)) {
692 		error = copyout(&status, SCARG(uap, status), sizeof(status));
693 	}
694 	if (error == 0 && *retval > 0 && SCARG(uap, rusage)) {
695 		error = copyout(&ru, SCARG(uap, rusage), sizeof(ru));
696 #ifdef KTRACE
697 		if (error == 0 && KTRPOINT(q, KTR_STRUCT))
698 			ktrrusage(q, &ru);
699 #endif
700 	}
701 	return (error);
702 }
703 
704 int
705 sys_waitid(struct proc *q, void *v, register_t *retval)
706 {
707 	struct sys_waitid_args /* {
708 		syscallarg(idtype_t) idtype;
709 		syscallarg(id_t) id;
710 		syscallarg(siginfo_t) info;
711 		syscallarg(int) options;
712 	} */ *uap = v;
713 	siginfo_t info;
714 	idtype_t idtype = SCARG(uap, idtype);
715 	int options = SCARG(uap, options);
716 	int error;
717 
718 	if (options &~ (WSTOPPED|WCONTINUED|WEXITED|WTRAPPED|WNOHANG|WNOWAIT))
719 		return (EINVAL);
720 	if ((options & (WSTOPPED|WCONTINUED|WEXITED|WTRAPPED)) == 0)
721 		return (EINVAL);
722 	if (idtype != P_ALL && idtype != P_PID && idtype != P_PGID)
723 		return (EINVAL);
724 
725 	error = dowait6(q, idtype, SCARG(uap, id), NULL,
726 	    options, NULL, &info, retval);
727 	if (error == 0) {
728 		error = copyout(&info, SCARG(uap, info), sizeof(info));
729 #ifdef KTRACE
730 		if (error == 0 && KTRPOINT(q, KTR_STRUCT))
731 			ktrsiginfo(q, &info);
732 #endif
733 	}
734 	if (error == 0)
735 		*retval = 0;
736 	return (error);
737 }
738 
739 void
740 proc_finish_wait(struct proc *waiter, struct process *pr)
741 {
742 	struct process *tr;
743 	struct rusage *rup;
744 
745 	/*
746 	 * If we got the child via a ptrace 'attach',
747 	 * we need to give it back to the old parent.
748 	 */
749 	if (pr->ps_oppid != 0 && (pr->ps_oppid != pr->ps_pptr->ps_pid) &&
750 	   (tr = prfind(pr->ps_oppid))) {
751 		pr->ps_oppid = 0;
752 		atomic_clearbits_int(&pr->ps_flags, PS_TRACED);
753 		process_reparent(pr, tr);
754 		prsignal(tr, SIGCHLD);
755 		wakeup(tr);
756 	} else {
757 		scheduler_wait_hook(waiter, pr->ps_mainproc);
758 		rup = &waiter->p_p->ps_cru;
759 		ruadd(rup, pr->ps_ru);
760 		LIST_REMOVE(pr, ps_list);	/* off zombprocess */
761 		freepid(pr->ps_pid);
762 		process_zap(pr);
763 	}
764 }
765 
766 /*
767  * give process back to original parent or init(8)
768  */
769 void
770 process_untrace(struct process *pr)
771 {
772 	struct process *ppr = NULL;
773 
774 	KASSERT(pr->ps_flags & PS_TRACED);
775 
776 	if (pr->ps_oppid != 0 &&
777 	    (pr->ps_oppid != pr->ps_pptr->ps_pid))
778 		ppr = prfind(pr->ps_oppid);
779 
780 	/* not being traced any more */
781 	pr->ps_oppid = 0;
782 	atomic_clearbits_int(&pr->ps_flags, PS_TRACED);
783 	process_reparent(pr, ppr ? ppr : initprocess);
784 }
785 
786 void
787 process_clear_orphan(struct process *pr)
788 {
789 	if (pr->ps_flags & PS_ORPHAN) {
790 		LIST_REMOVE(pr, ps_orphan);
791 		atomic_clearbits_int(&pr->ps_flags, PS_ORPHAN);
792 	}
793 }
794 
795 /*
796  * make process 'parent' the new parent of process 'child'.
797  */
798 void
799 process_reparent(struct process *child, struct process *parent)
800 {
801 
802 	if (child->ps_pptr == parent)
803 		return;
804 
805 	KASSERT(child->ps_oppid == 0 ||
806 		child->ps_oppid == child->ps_pptr->ps_pid);
807 
808 	LIST_REMOVE(child, ps_sibling);
809 	LIST_INSERT_HEAD(&parent->ps_children, child, ps_sibling);
810 
811 	process_clear_orphan(child);
812 	if (child->ps_flags & PS_TRACED) {
813 		atomic_setbits_int(&child->ps_flags, PS_ORPHAN);
814 		LIST_INSERT_HEAD(&child->ps_pptr->ps_orphans, child, ps_orphan);
815 	}
816 
817 	child->ps_pptr = parent;
818 	child->ps_ppid = parent->ps_pid;
819 }
820 
821 void
822 process_zap(struct process *pr)
823 {
824 	struct vnode *otvp;
825 	struct proc *p = pr->ps_mainproc;
826 
827 	/*
828 	 * Finally finished with old proc entry.
829 	 * Unlink it from its process group and free it.
830 	 */
831 	leavepgrp(pr);
832 	LIST_REMOVE(pr, ps_sibling);
833 	process_clear_orphan(pr);
834 
835 	/*
836 	 * Decrement the count of procs running with this uid.
837 	 */
838 	(void)chgproccnt(pr->ps_ucred->cr_ruid, -1);
839 
840 	/*
841 	 * Release reference to text vnode
842 	 */
843 	otvp = pr->ps_textvp;
844 	pr->ps_textvp = NULL;
845 	if (otvp)
846 		vrele(otvp);
847 
848 	KASSERT(pr->ps_threadcnt == 0);
849 	KASSERT(pr->ps_exitcnt == 1);
850 	if (pr->ps_ptstat != NULL)
851 		free(pr->ps_ptstat, M_SUBPROC, sizeof(*pr->ps_ptstat));
852 	pool_put(&rusage_pool, pr->ps_ru);
853 	KASSERT(TAILQ_EMPTY(&pr->ps_threads));
854 	sigactsfree(pr->ps_sigacts);
855 	lim_free(pr->ps_limit);
856 	crfree(pr->ps_ucred);
857 	pool_put(&process_pool, pr);
858 	nprocesses--;
859 
860 	proc_free(p);
861 }
862