xref: /freebsd/sys/kern/kern_exit.c (revision 924226fba12cc9a228c73b956e1b7fa24c60b055)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1982, 1986, 1989, 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  * (c) UNIX System Laboratories, Inc.
7  * All or some portions of this file are derived from material licensed
8  * to the University of California by American Telephone and Telegraph
9  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
10  * the permission of UNIX System Laboratories, Inc.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  *
36  *	@(#)kern_exit.c	8.7 (Berkeley) 2/12/94
37  */
38 
39 #include <sys/cdefs.h>
40 __FBSDID("$FreeBSD$");
41 
42 #include "opt_ddb.h"
43 #include "opt_ktrace.h"
44 
45 #include <sys/param.h>
46 #include <sys/systm.h>
47 #include <sys/sysproto.h>
48 #include <sys/capsicum.h>
49 #include <sys/eventhandler.h>
50 #include <sys/kernel.h>
51 #include <sys/ktr.h>
52 #include <sys/malloc.h>
53 #include <sys/lock.h>
54 #include <sys/mutex.h>
55 #include <sys/proc.h>
56 #include <sys/procdesc.h>
57 #include <sys/jail.h>
58 #include <sys/tty.h>
59 #include <sys/wait.h>
60 #include <sys/vmmeter.h>
61 #include <sys/vnode.h>
62 #include <sys/racct.h>
63 #include <sys/resourcevar.h>
64 #include <sys/sbuf.h>
65 #include <sys/signalvar.h>
66 #include <sys/sched.h>
67 #include <sys/sx.h>
68 #include <sys/syscallsubr.h>
69 #include <sys/sysctl.h>
70 #include <sys/syslog.h>
71 #include <sys/ptrace.h>
72 #include <sys/acct.h>		/* for acct_process() function prototype */
73 #include <sys/filedesc.h>
74 #include <sys/sdt.h>
75 #include <sys/shm.h>
76 #include <sys/sem.h>
77 #include <sys/sysent.h>
78 #include <sys/timers.h>
79 #include <sys/umtxvar.h>
80 #ifdef KTRACE
81 #include <sys/ktrace.h>
82 #endif
83 
84 #include <security/audit/audit.h>
85 #include <security/mac/mac_framework.h>
86 
87 #include <vm/vm.h>
88 #include <vm/vm_extern.h>
89 #include <vm/vm_param.h>
90 #include <vm/pmap.h>
91 #include <vm/vm_map.h>
92 #include <vm/vm_page.h>
93 #include <vm/uma.h>
94 
95 #ifdef KDTRACE_HOOKS
96 #include <sys/dtrace_bsd.h>
97 dtrace_execexit_func_t	dtrace_fasttrap_exit;
98 #endif
99 
100 SDT_PROVIDER_DECLARE(proc);
101 SDT_PROBE_DEFINE1(proc, , , exit, "int");
102 
103 static int kern_kill_on_dbg_exit = 1;
104 SYSCTL_INT(_kern, OID_AUTO, kill_on_debugger_exit, CTLFLAG_RWTUN,
105     &kern_kill_on_dbg_exit, 0,
106     "Kill ptraced processes when debugger exits");
107 
108 static bool kern_wait_dequeue_sigchld = 1;
109 SYSCTL_BOOL(_kern, OID_AUTO, wait_dequeue_sigchld, CTLFLAG_RWTUN,
110     &kern_wait_dequeue_sigchld, 0,
111     "Dequeue SIGCHLD on wait(2) for live process");
112 
113 struct proc *
114 proc_realparent(struct proc *child)
115 {
116 	struct proc *p, *parent;
117 
118 	sx_assert(&proctree_lock, SX_LOCKED);
119 	if ((child->p_treeflag & P_TREE_ORPHANED) == 0)
120 		return (child->p_pptr->p_pid == child->p_oppid ?
121 		    child->p_pptr : child->p_reaper);
122 	for (p = child; (p->p_treeflag & P_TREE_FIRST_ORPHAN) == 0;) {
123 		/* Cannot use LIST_PREV(), since the list head is not known. */
124 		p = __containerof(p->p_orphan.le_prev, struct proc,
125 		    p_orphan.le_next);
126 		KASSERT((p->p_treeflag & P_TREE_ORPHANED) != 0,
127 		    ("missing P_ORPHAN %p", p));
128 	}
129 	parent = __containerof(p->p_orphan.le_prev, struct proc,
130 	    p_orphans.lh_first);
131 	return (parent);
132 }
133 
134 void
135 reaper_abandon_children(struct proc *p, bool exiting)
136 {
137 	struct proc *p1, *p2, *ptmp;
138 
139 	sx_assert(&proctree_lock, SX_XLOCKED);
140 	KASSERT(p != initproc, ("reaper_abandon_children for initproc"));
141 	if ((p->p_treeflag & P_TREE_REAPER) == 0)
142 		return;
143 	p1 = p->p_reaper;
144 	LIST_FOREACH_SAFE(p2, &p->p_reaplist, p_reapsibling, ptmp) {
145 		LIST_REMOVE(p2, p_reapsibling);
146 		p2->p_reaper = p1;
147 		p2->p_reapsubtree = p->p_reapsubtree;
148 		LIST_INSERT_HEAD(&p1->p_reaplist, p2, p_reapsibling);
149 		if (exiting && p2->p_pptr == p) {
150 			PROC_LOCK(p2);
151 			proc_reparent(p2, p1, true);
152 			PROC_UNLOCK(p2);
153 		}
154 	}
155 	KASSERT(LIST_EMPTY(&p->p_reaplist), ("p_reaplist not empty"));
156 	p->p_treeflag &= ~P_TREE_REAPER;
157 }
158 
159 static void
160 reaper_clear(struct proc *p)
161 {
162 	struct proc *p1;
163 	bool clear;
164 
165 	sx_assert(&proctree_lock, SX_LOCKED);
166 	LIST_REMOVE(p, p_reapsibling);
167 	if (p->p_reapsubtree == 1)
168 		return;
169 	clear = true;
170 	LIST_FOREACH(p1, &p->p_reaper->p_reaplist, p_reapsibling) {
171 		if (p1->p_reapsubtree == p->p_reapsubtree) {
172 			clear = false;
173 			break;
174 		}
175 	}
176 	if (clear)
177 		proc_id_clear(PROC_ID_REAP, p->p_reapsubtree);
178 }
179 
180 void
181 proc_clear_orphan(struct proc *p)
182 {
183 	struct proc *p1;
184 
185 	sx_assert(&proctree_lock, SA_XLOCKED);
186 	if ((p->p_treeflag & P_TREE_ORPHANED) == 0)
187 		return;
188 	if ((p->p_treeflag & P_TREE_FIRST_ORPHAN) != 0) {
189 		p1 = LIST_NEXT(p, p_orphan);
190 		if (p1 != NULL)
191 			p1->p_treeflag |= P_TREE_FIRST_ORPHAN;
192 		p->p_treeflag &= ~P_TREE_FIRST_ORPHAN;
193 	}
194 	LIST_REMOVE(p, p_orphan);
195 	p->p_treeflag &= ~P_TREE_ORPHANED;
196 }
197 
198 void
199 exit_onexit(struct proc *p)
200 {
201 	MPASS(p->p_numthreads == 1);
202 	umtx_thread_exit(FIRST_THREAD_IN_PROC(p));
203 }
204 
205 /*
206  * exit -- death of process.
207  */
208 int
209 sys_exit(struct thread *td, struct exit_args *uap)
210 {
211 
212 	exit1(td, uap->rval, 0);
213 	__unreachable();
214 }
215 
216 void
217 proc_set_p2_wexit(struct proc *p)
218 {
219 	PROC_LOCK_ASSERT(p, MA_OWNED);
220 	p->p_flag2 |= P2_WEXIT;
221 	while (p->p_singlethr > 0)
222 		msleep(&p->p_singlethr, &p->p_mtx, PWAIT | PCATCH, "exit1t", 0);
223 }
224 
225 /*
226  * Exit: deallocate address space and other resources, change proc state to
227  * zombie, and unlink proc from allproc and parent's lists.  Save exit status
228  * and rusage for wait().  Check for child processes and orphan them.
229  */
230 void
231 exit1(struct thread *td, int rval, int signo)
232 {
233 	struct proc *p, *nq, *q, *t;
234 	struct thread *tdt;
235 	ksiginfo_t *ksi, *ksi1;
236 	int signal_parent;
237 
238 	mtx_assert(&Giant, MA_NOTOWNED);
239 	KASSERT(rval == 0 || signo == 0, ("exit1 rv %d sig %d", rval, signo));
240 	TSPROCEXIT(td->td_proc->p_pid);
241 
242 	p = td->td_proc;
243 	/*
244 	 * XXX in case we're rebooting we just let init die in order to
245 	 * work around an unsolved stack overflow seen very late during
246 	 * shutdown on sparc64 when the gmirror worker process exists.
247 	 * XXX what to do now that sparc64 is gone... remove if?
248 	 */
249 	if (p == initproc && rebooting == 0) {
250 		printf("init died (signal %d, exit %d)\n", signo, rval);
251 		panic("Going nowhere without my init!");
252 	}
253 
254 	/*
255 	 * Deref SU mp, since the thread does not return to userspace.
256 	 */
257 	td_softdep_cleanup(td);
258 
259 	/*
260 	 * MUST abort all other threads before proceeding past here.
261 	 */
262 	PROC_LOCK(p);
263 	proc_set_p2_wexit(p);
264 
265 	/*
266 	 * First check if some other thread or external request got
267 	 * here before us.  If so, act appropriately: exit or suspend.
268 	 * We must ensure that stop requests are handled before we set
269 	 * P_WEXIT.
270 	 */
271 	thread_suspend_check(0);
272 	while (p->p_flag & P_HADTHREADS) {
273 		/*
274 		 * Kill off the other threads. This requires
275 		 * some co-operation from other parts of the kernel
276 		 * so it may not be instantaneous.  With this state set
277 		 * any thread entering the kernel from userspace will
278 		 * thread_exit() in trap().  Any thread attempting to
279 		 * sleep will return immediately with EINTR or EWOULDBLOCK
280 		 * which will hopefully force them to back out to userland
281 		 * freeing resources as they go.  Any thread attempting
282 		 * to return to userland will thread_exit() from userret().
283 		 * thread_exit() will unsuspend us when the last of the
284 		 * other threads exits.
285 		 * If there is already a thread singler after resumption,
286 		 * calling thread_single will fail; in that case, we just
287 		 * re-check all suspension request, the thread should
288 		 * either be suspended there or exit.
289 		 */
290 		if (!thread_single(p, SINGLE_EXIT))
291 			/*
292 			 * All other activity in this process is now
293 			 * stopped.  Threading support has been turned
294 			 * off.
295 			 */
296 			break;
297 		/*
298 		 * Recheck for new stop or suspend requests which
299 		 * might appear while process lock was dropped in
300 		 * thread_single().
301 		 */
302 		thread_suspend_check(0);
303 	}
304 	KASSERT(p->p_numthreads == 1,
305 	    ("exit1: proc %p exiting with %d threads", p, p->p_numthreads));
306 	racct_sub(p, RACCT_NTHR, 1);
307 
308 	/* Let event handler change exit status */
309 	p->p_xexit = rval;
310 	p->p_xsig = signo;
311 
312 	/*
313 	 * Ignore any pending request to stop due to a stop signal.
314 	 * Once P_WEXIT is set, future requests will be ignored as
315 	 * well.
316 	 */
317 	p->p_flag &= ~P_STOPPED_SIG;
318 	KASSERT(!P_SHOULDSTOP(p), ("exiting process is stopped"));
319 
320 	/* Note that we are exiting. */
321 	p->p_flag |= P_WEXIT;
322 
323 	/*
324 	 * Wait for any processes that have a hold on our vmspace to
325 	 * release their reference.
326 	 */
327 	while (p->p_lock > 0)
328 		msleep(&p->p_lock, &p->p_mtx, PWAIT, "exithold", 0);
329 
330 	PROC_UNLOCK(p);
331 	/* Drain the limit callout while we don't have the proc locked */
332 	callout_drain(&p->p_limco);
333 
334 #ifdef AUDIT
335 	/*
336 	 * The Sun BSM exit token contains two components: an exit status as
337 	 * passed to exit(), and a return value to indicate what sort of exit
338 	 * it was.  The exit status is WEXITSTATUS(rv), but it's not clear
339 	 * what the return value is.
340 	 */
341 	AUDIT_ARG_EXIT(rval, 0);
342 	AUDIT_SYSCALL_EXIT(0, td);
343 #endif
344 
345 	/* Are we a task leader with peers? */
346 	if (p->p_peers != NULL && p == p->p_leader) {
347 		mtx_lock(&ppeers_lock);
348 		q = p->p_peers;
349 		while (q != NULL) {
350 			PROC_LOCK(q);
351 			kern_psignal(q, SIGKILL);
352 			PROC_UNLOCK(q);
353 			q = q->p_peers;
354 		}
355 		while (p->p_peers != NULL)
356 			msleep(p, &ppeers_lock, PWAIT, "exit1", 0);
357 		mtx_unlock(&ppeers_lock);
358 	}
359 
360 	itimers_exit(p);
361 
362 	/*
363 	 * Check if any loadable modules need anything done at process exit.
364 	 * E.g. SYSV IPC stuff.
365 	 * Event handler could change exit status.
366 	 * XXX what if one of these generates an error?
367 	 */
368 	EVENTHANDLER_DIRECT_INVOKE(process_exit, p);
369 
370 	/*
371 	 * If parent is waiting for us to exit or exec,
372 	 * P_PPWAIT is set; we will wakeup the parent below.
373 	 */
374 	PROC_LOCK(p);
375 	stopprofclock(p);
376 	p->p_ptevents = 0;
377 
378 	/*
379 	 * Stop the real interval timer.  If the handler is currently
380 	 * executing, prevent it from rearming itself and let it finish.
381 	 */
382 	if (timevalisset(&p->p_realtimer.it_value) &&
383 	    callout_stop(&p->p_itcallout) == 0) {
384 		timevalclear(&p->p_realtimer.it_interval);
385 		PROC_UNLOCK(p);
386 		callout_drain(&p->p_itcallout);
387 	} else {
388 		PROC_UNLOCK(p);
389 	}
390 
391 	if (p->p_sysent->sv_onexit != NULL)
392 		p->p_sysent->sv_onexit(p);
393 	seltdfini(td);
394 
395 	/*
396 	 * Reset any sigio structures pointing to us as a result of
397 	 * F_SETOWN with our pid.  The P_WEXIT flag interlocks with fsetown().
398 	 */
399 	funsetownlst(&p->p_sigiolst);
400 
401 	/*
402 	 * Close open files and release open-file table.
403 	 * This may block!
404 	 */
405 	pdescfree(td);
406 	fdescfree(td);
407 
408 	/*
409 	 * If this thread tickled GEOM, we need to wait for the giggling to
410 	 * stop before we return to userland
411 	 */
412 	if (td->td_pflags & TDP_GEOM)
413 		g_waitidle();
414 
415 	/*
416 	 * Remove ourself from our leader's peer list and wake our leader.
417 	 */
418 	if (p->p_leader->p_peers != NULL) {
419 		mtx_lock(&ppeers_lock);
420 		if (p->p_leader->p_peers != NULL) {
421 			q = p->p_leader;
422 			while (q->p_peers != p)
423 				q = q->p_peers;
424 			q->p_peers = p->p_peers;
425 			wakeup(p->p_leader);
426 		}
427 		mtx_unlock(&ppeers_lock);
428 	}
429 
430 	exec_free_abi_mappings(p);
431 	vmspace_exit(td);
432 	(void)acct_process(td);
433 
434 #ifdef KTRACE
435 	ktrprocexit(td);
436 #endif
437 	/*
438 	 * Release reference to text vnode etc
439 	 */
440 	if (p->p_textvp != NULL) {
441 		vrele(p->p_textvp);
442 		p->p_textvp = NULL;
443 	}
444 	if (p->p_textdvp != NULL) {
445 		vrele(p->p_textdvp);
446 		p->p_textdvp = NULL;
447 	}
448 	if (p->p_binname != NULL) {
449 		free(p->p_binname, M_PARGS);
450 		p->p_binname = NULL;
451 	}
452 
453 	/*
454 	 * Release our limits structure.
455 	 */
456 	lim_free(p->p_limit);
457 	p->p_limit = NULL;
458 
459 	tidhash_remove(td);
460 
461 	/*
462 	 * Call machine-dependent code to release any
463 	 * machine-dependent resources other than the address space.
464 	 * The address space is released by "vmspace_exitfree(p)" in
465 	 * vm_waitproc().
466 	 */
467 	cpu_exit(td);
468 
469 	WITNESS_WARN(WARN_PANIC, NULL, "process (pid %d) exiting", p->p_pid);
470 
471 	/*
472 	 * Remove from allproc. It still sits in the hash.
473 	 */
474 	sx_xlock(&allproc_lock);
475 	LIST_REMOVE(p, p_list);
476 
477 #ifdef DDB
478 	/*
479 	 * Used by ddb's 'ps' command to find this process via the
480 	 * pidhash.
481 	 */
482 	p->p_list.le_prev = NULL;
483 #endif
484 	sx_xunlock(&allproc_lock);
485 
486 	sx_xlock(&proctree_lock);
487 	PROC_LOCK(p);
488 	p->p_flag &= ~(P_TRACED | P_PPWAIT | P_PPTRACE);
489 	PROC_UNLOCK(p);
490 
491 	/*
492 	 * killjobc() might drop and re-acquire proctree_lock to
493 	 * revoke control tty if exiting process was a session leader.
494 	 */
495 	killjobc();
496 
497 	/*
498 	 * Reparent all children processes:
499 	 * - traced ones to the original parent (or init if we are that parent)
500 	 * - the rest to init
501 	 */
502 	q = LIST_FIRST(&p->p_children);
503 	if (q != NULL)		/* only need this if any child is S_ZOMB */
504 		wakeup(q->p_reaper);
505 	for (; q != NULL; q = nq) {
506 		nq = LIST_NEXT(q, p_sibling);
507 		ksi = ksiginfo_alloc(TRUE);
508 		PROC_LOCK(q);
509 		q->p_sigparent = SIGCHLD;
510 
511 		if ((q->p_flag & P_TRACED) == 0) {
512 			proc_reparent(q, q->p_reaper, true);
513 			if (q->p_state == PRS_ZOMBIE) {
514 				/*
515 				 * Inform reaper about the reparented
516 				 * zombie, since wait(2) has something
517 				 * new to report.  Guarantee queueing
518 				 * of the SIGCHLD signal, similar to
519 				 * the _exit() behaviour, by providing
520 				 * our ksiginfo.  Ksi is freed by the
521 				 * signal delivery.
522 				 */
523 				if (q->p_ksi == NULL) {
524 					ksi1 = NULL;
525 				} else {
526 					ksiginfo_copy(q->p_ksi, ksi);
527 					ksi->ksi_flags |= KSI_INS;
528 					ksi1 = ksi;
529 					ksi = NULL;
530 				}
531 				PROC_LOCK(q->p_reaper);
532 				pksignal(q->p_reaper, SIGCHLD, ksi1);
533 				PROC_UNLOCK(q->p_reaper);
534 			} else if (q->p_pdeathsig > 0) {
535 				/*
536 				 * The child asked to received a signal
537 				 * when we exit.
538 				 */
539 				kern_psignal(q, q->p_pdeathsig);
540 			}
541 		} else {
542 			/*
543 			 * Traced processes are killed by default
544 			 * since their existence means someone is
545 			 * screwing up.
546 			 */
547 			t = proc_realparent(q);
548 			if (t == p) {
549 				proc_reparent(q, q->p_reaper, true);
550 			} else {
551 				PROC_LOCK(t);
552 				proc_reparent(q, t, true);
553 				PROC_UNLOCK(t);
554 			}
555 			/*
556 			 * Since q was found on our children list, the
557 			 * proc_reparent() call moved q to the orphan
558 			 * list due to present P_TRACED flag. Clear
559 			 * orphan link for q now while q is locked.
560 			 */
561 			proc_clear_orphan(q);
562 			q->p_flag &= ~P_TRACED;
563 			q->p_flag2 &= ~P2_PTRACE_FSTP;
564 			q->p_ptevents = 0;
565 			p->p_xthread = NULL;
566 			FOREACH_THREAD_IN_PROC(q, tdt) {
567 				tdt->td_dbgflags &= ~(TDB_SUSPEND | TDB_XSIG |
568 				    TDB_FSTP);
569 				tdt->td_xsig = 0;
570 			}
571 			if (kern_kill_on_dbg_exit) {
572 				q->p_flag &= ~P_STOPPED_TRACE;
573 				kern_psignal(q, SIGKILL);
574 			} else if ((q->p_flag & (P_STOPPED_TRACE |
575 			    P_STOPPED_SIG)) != 0) {
576 				sigqueue_delete_proc(q, SIGTRAP);
577 				ptrace_unsuspend(q);
578 			}
579 		}
580 		PROC_UNLOCK(q);
581 		if (ksi != NULL)
582 			ksiginfo_free(ksi);
583 	}
584 
585 	/*
586 	 * Also get rid of our orphans.
587 	 */
588 	while ((q = LIST_FIRST(&p->p_orphans)) != NULL) {
589 		PROC_LOCK(q);
590 		KASSERT(q->p_oppid == p->p_pid,
591 		    ("orphan %p of %p has unexpected oppid %d", q, p,
592 		    q->p_oppid));
593 		q->p_oppid = q->p_reaper->p_pid;
594 
595 		/*
596 		 * If we are the real parent of this process
597 		 * but it has been reparented to a debugger, then
598 		 * check if it asked for a signal when we exit.
599 		 */
600 		if (q->p_pdeathsig > 0)
601 			kern_psignal(q, q->p_pdeathsig);
602 		CTR2(KTR_PTRACE, "exit: pid %d, clearing orphan %d", p->p_pid,
603 		    q->p_pid);
604 		proc_clear_orphan(q);
605 		PROC_UNLOCK(q);
606 	}
607 
608 #ifdef KDTRACE_HOOKS
609 	if (SDT_PROBES_ENABLED()) {
610 		int reason = CLD_EXITED;
611 		if (WCOREDUMP(signo))
612 			reason = CLD_DUMPED;
613 		else if (WIFSIGNALED(signo))
614 			reason = CLD_KILLED;
615 		SDT_PROBE1(proc, , , exit, reason);
616 	}
617 #endif
618 
619 	/* Save exit status. */
620 	PROC_LOCK(p);
621 	p->p_xthread = td;
622 
623 	if (p->p_sysent->sv_ontdexit != NULL)
624 		p->p_sysent->sv_ontdexit(td);
625 
626 #ifdef KDTRACE_HOOKS
627 	/*
628 	 * Tell the DTrace fasttrap provider about the exit if it
629 	 * has declared an interest.
630 	 */
631 	if (dtrace_fasttrap_exit)
632 		dtrace_fasttrap_exit(p);
633 #endif
634 
635 	/*
636 	 * Notify interested parties of our demise.
637 	 */
638 	KNOTE_LOCKED(p->p_klist, NOTE_EXIT);
639 
640 	/*
641 	 * If this is a process with a descriptor, we may not need to deliver
642 	 * a signal to the parent.  proctree_lock is held over
643 	 * procdesc_exit() to serialize concurrent calls to close() and
644 	 * exit().
645 	 */
646 	signal_parent = 0;
647 	if (p->p_procdesc == NULL || procdesc_exit(p)) {
648 		/*
649 		 * Notify parent that we're gone.  If parent has the
650 		 * PS_NOCLDWAIT flag set, or if the handler is set to SIG_IGN,
651 		 * notify process 1 instead (and hope it will handle this
652 		 * situation).
653 		 */
654 		PROC_LOCK(p->p_pptr);
655 		mtx_lock(&p->p_pptr->p_sigacts->ps_mtx);
656 		if (p->p_pptr->p_sigacts->ps_flag &
657 		    (PS_NOCLDWAIT | PS_CLDSIGIGN)) {
658 			struct proc *pp;
659 
660 			mtx_unlock(&p->p_pptr->p_sigacts->ps_mtx);
661 			pp = p->p_pptr;
662 			PROC_UNLOCK(pp);
663 			proc_reparent(p, p->p_reaper, true);
664 			p->p_sigparent = SIGCHLD;
665 			PROC_LOCK(p->p_pptr);
666 
667 			/*
668 			 * Notify parent, so in case he was wait(2)ing or
669 			 * executing waitpid(2) with our pid, he will
670 			 * continue.
671 			 */
672 			wakeup(pp);
673 		} else
674 			mtx_unlock(&p->p_pptr->p_sigacts->ps_mtx);
675 
676 		if (p->p_pptr == p->p_reaper || p->p_pptr == initproc) {
677 			signal_parent = 1;
678 		} else if (p->p_sigparent != 0) {
679 			if (p->p_sigparent == SIGCHLD) {
680 				signal_parent = 1;
681 			} else { /* LINUX thread */
682 				signal_parent = 2;
683 			}
684 		}
685 	} else
686 		PROC_LOCK(p->p_pptr);
687 	sx_xunlock(&proctree_lock);
688 
689 	if (signal_parent == 1) {
690 		childproc_exited(p);
691 	} else if (signal_parent == 2) {
692 		kern_psignal(p->p_pptr, p->p_sigparent);
693 	}
694 
695 	/* Tell the prison that we are gone. */
696 	prison_proc_free(p->p_ucred->cr_prison);
697 
698 	/*
699 	 * The state PRS_ZOMBIE prevents other proesses from sending
700 	 * signal to the process, to avoid memory leak, we free memory
701 	 * for signal queue at the time when the state is set.
702 	 */
703 	sigqueue_flush(&p->p_sigqueue);
704 	sigqueue_flush(&td->td_sigqueue);
705 
706 	/*
707 	 * We have to wait until after acquiring all locks before
708 	 * changing p_state.  We need to avoid all possible context
709 	 * switches (including ones from blocking on a mutex) while
710 	 * marked as a zombie.  We also have to set the zombie state
711 	 * before we release the parent process' proc lock to avoid
712 	 * a lost wakeup.  So, we first call wakeup, then we grab the
713 	 * sched lock, update the state, and release the parent process'
714 	 * proc lock.
715 	 */
716 	wakeup(p->p_pptr);
717 	cv_broadcast(&p->p_pwait);
718 	sched_exit(p->p_pptr, td);
719 	PROC_SLOCK(p);
720 	p->p_state = PRS_ZOMBIE;
721 	PROC_UNLOCK(p->p_pptr);
722 
723 	/*
724 	 * Save our children's rusage information in our exit rusage.
725 	 */
726 	PROC_STATLOCK(p);
727 	ruadd(&p->p_ru, &p->p_rux, &p->p_stats->p_cru, &p->p_crux);
728 	PROC_STATUNLOCK(p);
729 
730 	/*
731 	 * Make sure the scheduler takes this thread out of its tables etc.
732 	 * This will also release this thread's reference to the ucred.
733 	 * Other thread parts to release include pcb bits and such.
734 	 */
735 	thread_exit();
736 }
737 
738 #ifndef _SYS_SYSPROTO_H_
739 struct abort2_args {
740 	char *why;
741 	int nargs;
742 	void **args;
743 };
744 #endif
745 
746 int
747 sys_abort2(struct thread *td, struct abort2_args *uap)
748 {
749 	void *uargs[16];
750 	void **uargsp;
751 	int error, nargs;
752 
753 	nargs = uap->nargs;
754 	if (nargs < 0 || nargs > nitems(uargs))
755 		nargs = -1;
756 	uargsp = NULL;
757 	if (nargs > 0) {
758 		if (uap->args != NULL) {
759 			error = copyin(uap->args, uargs,
760 			    nargs * sizeof(void *));
761 			if (error != 0)
762 				nargs = -1;
763 			else
764 				uargsp = uargs;
765 		} else
766 			nargs = -1;
767 	}
768 	return (kern_abort2(td, uap->why, nargs, uargsp));
769 }
770 
771 /*
772  * kern_abort2()
773  * Arguments:
774  *  why - user pointer to why
775  *  nargs - number of arguments copied or -1 if an error occured in copying
776  *  args - pointer to an array of pointers in kernel format
777  */
778 int
779 kern_abort2(struct thread *td, const char *why, int nargs, void **uargs)
780 {
781 	struct proc *p = td->td_proc;
782 	struct sbuf *sb;
783 	int error, i, sig;
784 
785 	/*
786 	 * Do it right now so we can log either proper call of abort2(), or
787 	 * note, that invalid argument was passed. 512 is big enough to
788 	 * handle 16 arguments' descriptions with additional comments.
789 	 */
790 	sb = sbuf_new(NULL, NULL, 512, SBUF_FIXEDLEN);
791 	sbuf_clear(sb);
792 	sbuf_printf(sb, "%s(pid %d uid %d) aborted: ",
793 	    p->p_comm, p->p_pid, td->td_ucred->cr_uid);
794 	/*
795 	 * Since we can't return from abort2(), send SIGKILL in cases, where
796 	 * abort2() was called improperly
797 	 */
798 	sig = SIGKILL;
799 	/* Prevent from DoSes from user-space. */
800 	if (nargs == -1)
801 		goto out;
802 	KASSERT(nargs >= 0 && nargs <= 16, ("called with too many args (%d)",
803 	    nargs));
804 	/*
805 	 * Limit size of 'reason' string to 128. Will fit even when
806 	 * maximal number of arguments was chosen to be logged.
807 	 */
808 	if (why != NULL) {
809 		error = sbuf_copyin(sb, why, 128);
810 		if (error < 0)
811 			goto out;
812 	} else {
813 		sbuf_printf(sb, "(null)");
814 	}
815 	if (nargs > 0) {
816 		sbuf_printf(sb, "(");
817 		for (i = 0;i < nargs; i++)
818 			sbuf_printf(sb, "%s%p", i == 0 ? "" : ", ", uargs[i]);
819 		sbuf_printf(sb, ")");
820 	}
821 	/*
822 	 * Final stage: arguments were proper, string has been
823 	 * successfully copied from userspace, and copying pointers
824 	 * from user-space succeed.
825 	 */
826 	sig = SIGABRT;
827 out:
828 	if (sig == SIGKILL) {
829 		sbuf_trim(sb);
830 		sbuf_printf(sb, " (Reason text inaccessible)");
831 	}
832 	sbuf_cat(sb, "\n");
833 	sbuf_finish(sb);
834 	log(LOG_INFO, "%s", sbuf_data(sb));
835 	sbuf_delete(sb);
836 	exit1(td, 0, sig);
837 	return (0);
838 }
839 
840 #ifdef COMPAT_43
841 /*
842  * The dirty work is handled by kern_wait().
843  */
844 int
845 owait(struct thread *td, struct owait_args *uap __unused)
846 {
847 	int error, status;
848 
849 	error = kern_wait(td, WAIT_ANY, &status, 0, NULL);
850 	if (error == 0)
851 		td->td_retval[1] = status;
852 	return (error);
853 }
854 #endif /* COMPAT_43 */
855 
856 /*
857  * The dirty work is handled by kern_wait().
858  */
859 int
860 sys_wait4(struct thread *td, struct wait4_args *uap)
861 {
862 	struct rusage ru, *rup;
863 	int error, status;
864 
865 	if (uap->rusage != NULL)
866 		rup = &ru;
867 	else
868 		rup = NULL;
869 	error = kern_wait(td, uap->pid, &status, uap->options, rup);
870 	if (uap->status != NULL && error == 0 && td->td_retval[0] != 0)
871 		error = copyout(&status, uap->status, sizeof(status));
872 	if (uap->rusage != NULL && error == 0 && td->td_retval[0] != 0)
873 		error = copyout(&ru, uap->rusage, sizeof(struct rusage));
874 	return (error);
875 }
876 
877 int
878 sys_wait6(struct thread *td, struct wait6_args *uap)
879 {
880 	struct __wrusage wru, *wrup;
881 	siginfo_t si, *sip;
882 	idtype_t idtype;
883 	id_t id;
884 	int error, status;
885 
886 	idtype = uap->idtype;
887 	id = uap->id;
888 
889 	if (uap->wrusage != NULL)
890 		wrup = &wru;
891 	else
892 		wrup = NULL;
893 
894 	if (uap->info != NULL) {
895 		sip = &si;
896 		bzero(sip, sizeof(*sip));
897 	} else
898 		sip = NULL;
899 
900 	/*
901 	 *  We expect all callers of wait6() to know about WEXITED and
902 	 *  WTRAPPED.
903 	 */
904 	error = kern_wait6(td, idtype, id, &status, uap->options, wrup, sip);
905 
906 	if (uap->status != NULL && error == 0 && td->td_retval[0] != 0)
907 		error = copyout(&status, uap->status, sizeof(status));
908 	if (uap->wrusage != NULL && error == 0 && td->td_retval[0] != 0)
909 		error = copyout(&wru, uap->wrusage, sizeof(wru));
910 	if (uap->info != NULL && error == 0)
911 		error = copyout(&si, uap->info, sizeof(si));
912 	return (error);
913 }
914 
915 /*
916  * Reap the remains of a zombie process and optionally return status and
917  * rusage.  Asserts and will release both the proctree_lock and the process
918  * lock as part of its work.
919  */
920 void
921 proc_reap(struct thread *td, struct proc *p, int *status, int options)
922 {
923 	struct proc *q, *t;
924 
925 	sx_assert(&proctree_lock, SA_XLOCKED);
926 	PROC_LOCK_ASSERT(p, MA_OWNED);
927 	KASSERT(p->p_state == PRS_ZOMBIE, ("proc_reap: !PRS_ZOMBIE"));
928 
929 	mtx_spin_wait_unlocked(&p->p_slock);
930 
931 	q = td->td_proc;
932 
933 	if (status)
934 		*status = KW_EXITCODE(p->p_xexit, p->p_xsig);
935 	if (options & WNOWAIT) {
936 		/*
937 		 *  Only poll, returning the status.  Caller does not wish to
938 		 * release the proc struct just yet.
939 		 */
940 		PROC_UNLOCK(p);
941 		sx_xunlock(&proctree_lock);
942 		return;
943 	}
944 
945 	PROC_LOCK(q);
946 	sigqueue_take(p->p_ksi);
947 	PROC_UNLOCK(q);
948 
949 	/*
950 	 * If we got the child via a ptrace 'attach', we need to give it back
951 	 * to the old parent.
952 	 */
953 	if (p->p_oppid != p->p_pptr->p_pid) {
954 		PROC_UNLOCK(p);
955 		t = proc_realparent(p);
956 		PROC_LOCK(t);
957 		PROC_LOCK(p);
958 		CTR2(KTR_PTRACE,
959 		    "wait: traced child %d moved back to parent %d", p->p_pid,
960 		    t->p_pid);
961 		proc_reparent(p, t, false);
962 		PROC_UNLOCK(p);
963 		pksignal(t, SIGCHLD, p->p_ksi);
964 		wakeup(t);
965 		cv_broadcast(&p->p_pwait);
966 		PROC_UNLOCK(t);
967 		sx_xunlock(&proctree_lock);
968 		return;
969 	}
970 	PROC_UNLOCK(p);
971 
972 	/*
973 	 * Remove other references to this process to ensure we have an
974 	 * exclusive reference.
975 	 */
976 	sx_xlock(PIDHASHLOCK(p->p_pid));
977 	LIST_REMOVE(p, p_hash);
978 	sx_xunlock(PIDHASHLOCK(p->p_pid));
979 	LIST_REMOVE(p, p_sibling);
980 	reaper_abandon_children(p, true);
981 	reaper_clear(p);
982 	PROC_LOCK(p);
983 	proc_clear_orphan(p);
984 	PROC_UNLOCK(p);
985 	leavepgrp(p);
986 	if (p->p_procdesc != NULL)
987 		procdesc_reap(p);
988 	sx_xunlock(&proctree_lock);
989 
990 	proc_id_clear(PROC_ID_PID, p->p_pid);
991 
992 	PROC_LOCK(p);
993 	knlist_detach(p->p_klist);
994 	p->p_klist = NULL;
995 	PROC_UNLOCK(p);
996 
997 	/*
998 	 * Removal from allproc list and process group list paired with
999 	 * PROC_LOCK which was executed during that time should guarantee
1000 	 * nothing can reach this process anymore. As such further locking
1001 	 * is unnecessary.
1002 	 */
1003 	p->p_xexit = p->p_xsig = 0;		/* XXX: why? */
1004 
1005 	PROC_LOCK(q);
1006 	ruadd(&q->p_stats->p_cru, &q->p_crux, &p->p_ru, &p->p_rux);
1007 	PROC_UNLOCK(q);
1008 
1009 	/*
1010 	 * Decrement the count of procs running with this uid.
1011 	 */
1012 	(void)chgproccnt(p->p_ucred->cr_ruidinfo, -1, 0);
1013 
1014 	/*
1015 	 * Destroy resource accounting information associated with the process.
1016 	 */
1017 #ifdef RACCT
1018 	if (racct_enable) {
1019 		PROC_LOCK(p);
1020 		racct_sub(p, RACCT_NPROC, 1);
1021 		PROC_UNLOCK(p);
1022 	}
1023 #endif
1024 	racct_proc_exit(p);
1025 
1026 	/*
1027 	 * Free credentials, arguments, and sigacts.
1028 	 */
1029 	proc_unset_cred(p);
1030 	pargs_drop(p->p_args);
1031 	p->p_args = NULL;
1032 	sigacts_free(p->p_sigacts);
1033 	p->p_sigacts = NULL;
1034 
1035 	/*
1036 	 * Do any thread-system specific cleanups.
1037 	 */
1038 	thread_wait(p);
1039 
1040 	/*
1041 	 * Give vm and machine-dependent layer a chance to free anything that
1042 	 * cpu_exit couldn't release while still running in process context.
1043 	 */
1044 	vm_waitproc(p);
1045 #ifdef MAC
1046 	mac_proc_destroy(p);
1047 #endif
1048 
1049 	KASSERT(FIRST_THREAD_IN_PROC(p),
1050 	    ("proc_reap: no residual thread!"));
1051 	uma_zfree(proc_zone, p);
1052 	atomic_add_int(&nprocs, -1);
1053 }
1054 
1055 static int
1056 proc_to_reap(struct thread *td, struct proc *p, idtype_t idtype, id_t id,
1057     int *status, int options, struct __wrusage *wrusage, siginfo_t *siginfo,
1058     int check_only)
1059 {
1060 	struct rusage *rup;
1061 
1062 	sx_assert(&proctree_lock, SA_XLOCKED);
1063 
1064 	PROC_LOCK(p);
1065 
1066 	switch (idtype) {
1067 	case P_ALL:
1068 		if (p->p_procdesc == NULL ||
1069 		   (p->p_pptr == td->td_proc &&
1070 		   (p->p_flag & P_TRACED) != 0)) {
1071 			break;
1072 		}
1073 
1074 		PROC_UNLOCK(p);
1075 		return (0);
1076 	case P_PID:
1077 		if (p->p_pid != (pid_t)id) {
1078 			PROC_UNLOCK(p);
1079 			return (0);
1080 		}
1081 		break;
1082 	case P_PGID:
1083 		if (p->p_pgid != (pid_t)id) {
1084 			PROC_UNLOCK(p);
1085 			return (0);
1086 		}
1087 		break;
1088 	case P_SID:
1089 		if (p->p_session->s_sid != (pid_t)id) {
1090 			PROC_UNLOCK(p);
1091 			return (0);
1092 		}
1093 		break;
1094 	case P_UID:
1095 		if (p->p_ucred->cr_uid != (uid_t)id) {
1096 			PROC_UNLOCK(p);
1097 			return (0);
1098 		}
1099 		break;
1100 	case P_GID:
1101 		if (p->p_ucred->cr_gid != (gid_t)id) {
1102 			PROC_UNLOCK(p);
1103 			return (0);
1104 		}
1105 		break;
1106 	case P_JAILID:
1107 		if (p->p_ucred->cr_prison->pr_id != (int)id) {
1108 			PROC_UNLOCK(p);
1109 			return (0);
1110 		}
1111 		break;
1112 	/*
1113 	 * It seems that the thread structures get zeroed out
1114 	 * at process exit.  This makes it impossible to
1115 	 * support P_SETID, P_CID or P_CPUID.
1116 	 */
1117 	default:
1118 		PROC_UNLOCK(p);
1119 		return (0);
1120 	}
1121 
1122 	if (p_canwait(td, p)) {
1123 		PROC_UNLOCK(p);
1124 		return (0);
1125 	}
1126 
1127 	if (((options & WEXITED) == 0) && (p->p_state == PRS_ZOMBIE)) {
1128 		PROC_UNLOCK(p);
1129 		return (0);
1130 	}
1131 
1132 	/*
1133 	 * This special case handles a kthread spawned by linux_clone
1134 	 * (see linux_misc.c).  The linux_wait4 and linux_waitpid
1135 	 * functions need to be able to distinguish between waiting
1136 	 * on a process and waiting on a thread.  It is a thread if
1137 	 * p_sigparent is not SIGCHLD, and the WLINUXCLONE option
1138 	 * signifies we want to wait for threads and not processes.
1139 	 */
1140 	if ((p->p_sigparent != SIGCHLD) ^
1141 	    ((options & WLINUXCLONE) != 0)) {
1142 		PROC_UNLOCK(p);
1143 		return (0);
1144 	}
1145 
1146 	if (siginfo != NULL) {
1147 		bzero(siginfo, sizeof(*siginfo));
1148 		siginfo->si_errno = 0;
1149 
1150 		/*
1151 		 * SUSv4 requires that the si_signo value is always
1152 		 * SIGCHLD. Obey it despite the rfork(2) interface
1153 		 * allows to request other signal for child exit
1154 		 * notification.
1155 		 */
1156 		siginfo->si_signo = SIGCHLD;
1157 
1158 		/*
1159 		 *  This is still a rough estimate.  We will fix the
1160 		 *  cases TRAPPED, STOPPED, and CONTINUED later.
1161 		 */
1162 		if (WCOREDUMP(p->p_xsig)) {
1163 			siginfo->si_code = CLD_DUMPED;
1164 			siginfo->si_status = WTERMSIG(p->p_xsig);
1165 		} else if (WIFSIGNALED(p->p_xsig)) {
1166 			siginfo->si_code = CLD_KILLED;
1167 			siginfo->si_status = WTERMSIG(p->p_xsig);
1168 		} else {
1169 			siginfo->si_code = CLD_EXITED;
1170 			siginfo->si_status = p->p_xexit;
1171 		}
1172 
1173 		siginfo->si_pid = p->p_pid;
1174 		siginfo->si_uid = p->p_ucred->cr_uid;
1175 
1176 		/*
1177 		 * The si_addr field would be useful additional
1178 		 * detail, but apparently the PC value may be lost
1179 		 * when we reach this point.  bzero() above sets
1180 		 * siginfo->si_addr to NULL.
1181 		 */
1182 	}
1183 
1184 	/*
1185 	 * There should be no reason to limit resources usage info to
1186 	 * exited processes only.  A snapshot about any resources used
1187 	 * by a stopped process may be exactly what is needed.
1188 	 */
1189 	if (wrusage != NULL) {
1190 		rup = &wrusage->wru_self;
1191 		*rup = p->p_ru;
1192 		PROC_STATLOCK(p);
1193 		calcru(p, &rup->ru_utime, &rup->ru_stime);
1194 		PROC_STATUNLOCK(p);
1195 
1196 		rup = &wrusage->wru_children;
1197 		*rup = p->p_stats->p_cru;
1198 		calccru(p, &rup->ru_utime, &rup->ru_stime);
1199 	}
1200 
1201 	if (p->p_state == PRS_ZOMBIE && !check_only) {
1202 		proc_reap(td, p, status, options);
1203 		return (-1);
1204 	}
1205 	return (1);
1206 }
1207 
1208 int
1209 kern_wait(struct thread *td, pid_t pid, int *status, int options,
1210     struct rusage *rusage)
1211 {
1212 	struct __wrusage wru, *wrup;
1213 	idtype_t idtype;
1214 	id_t id;
1215 	int ret;
1216 
1217 	/*
1218 	 * Translate the special pid values into the (idtype, pid)
1219 	 * pair for kern_wait6.  The WAIT_MYPGRP case is handled by
1220 	 * kern_wait6() on its own.
1221 	 */
1222 	if (pid == WAIT_ANY) {
1223 		idtype = P_ALL;
1224 		id = 0;
1225 	} else if (pid < 0) {
1226 		idtype = P_PGID;
1227 		id = (id_t)-pid;
1228 	} else {
1229 		idtype = P_PID;
1230 		id = (id_t)pid;
1231 	}
1232 
1233 	if (rusage != NULL)
1234 		wrup = &wru;
1235 	else
1236 		wrup = NULL;
1237 
1238 	/*
1239 	 * For backward compatibility we implicitly add flags WEXITED
1240 	 * and WTRAPPED here.
1241 	 */
1242 	options |= WEXITED | WTRAPPED;
1243 	ret = kern_wait6(td, idtype, id, status, options, wrup, NULL);
1244 	if (rusage != NULL)
1245 		*rusage = wru.wru_self;
1246 	return (ret);
1247 }
1248 
1249 static void
1250 report_alive_proc(struct thread *td, struct proc *p, siginfo_t *siginfo,
1251     int *status, int options, int si_code)
1252 {
1253 	bool cont;
1254 
1255 	PROC_LOCK_ASSERT(p, MA_OWNED);
1256 	sx_assert(&proctree_lock, SA_XLOCKED);
1257 	MPASS(si_code == CLD_TRAPPED || si_code == CLD_STOPPED ||
1258 	    si_code == CLD_CONTINUED);
1259 
1260 	cont = si_code == CLD_CONTINUED;
1261 	if ((options & WNOWAIT) == 0) {
1262 		if (cont)
1263 			p->p_flag &= ~P_CONTINUED;
1264 		else
1265 			p->p_flag |= P_WAITED;
1266 		if (kern_wait_dequeue_sigchld &&
1267 		    (td->td_proc->p_sysent->sv_flags & SV_SIG_WAITNDQ) == 0) {
1268 			PROC_LOCK(td->td_proc);
1269 			sigqueue_take(p->p_ksi);
1270 			PROC_UNLOCK(td->td_proc);
1271 		}
1272 	}
1273 	sx_xunlock(&proctree_lock);
1274 	if (siginfo != NULL) {
1275 		siginfo->si_code = si_code;
1276 		siginfo->si_status = cont ? SIGCONT : p->p_xsig;
1277 	}
1278 	if (status != NULL)
1279 		*status = cont ? SIGCONT : W_STOPCODE(p->p_xsig);
1280 	PROC_UNLOCK(p);
1281 	td->td_retval[0] = p->p_pid;
1282 }
1283 
1284 int
1285 kern_wait6(struct thread *td, idtype_t idtype, id_t id, int *status,
1286     int options, struct __wrusage *wrusage, siginfo_t *siginfo)
1287 {
1288 	struct proc *p, *q;
1289 	pid_t pid;
1290 	int error, nfound, ret;
1291 	bool report;
1292 
1293 	AUDIT_ARG_VALUE((int)idtype);	/* XXX - This is likely wrong! */
1294 	AUDIT_ARG_PID((pid_t)id);	/* XXX - This may be wrong! */
1295 	AUDIT_ARG_VALUE(options);
1296 
1297 	q = td->td_proc;
1298 
1299 	if ((pid_t)id == WAIT_MYPGRP && (idtype == P_PID || idtype == P_PGID)) {
1300 		PROC_LOCK(q);
1301 		id = (id_t)q->p_pgid;
1302 		PROC_UNLOCK(q);
1303 		idtype = P_PGID;
1304 	}
1305 
1306 	/* If we don't know the option, just return. */
1307 	if ((options & ~(WUNTRACED | WNOHANG | WCONTINUED | WNOWAIT |
1308 	    WEXITED | WTRAPPED | WLINUXCLONE)) != 0)
1309 		return (EINVAL);
1310 	if ((options & (WEXITED | WUNTRACED | WCONTINUED | WTRAPPED)) == 0) {
1311 		/*
1312 		 * We will be unable to find any matching processes,
1313 		 * because there are no known events to look for.
1314 		 * Prefer to return error instead of blocking
1315 		 * indefinitely.
1316 		 */
1317 		return (EINVAL);
1318 	}
1319 
1320 loop:
1321 	if (q->p_flag & P_STATCHILD) {
1322 		PROC_LOCK(q);
1323 		q->p_flag &= ~P_STATCHILD;
1324 		PROC_UNLOCK(q);
1325 	}
1326 	sx_xlock(&proctree_lock);
1327 loop_locked:
1328 	nfound = 0;
1329 	LIST_FOREACH(p, &q->p_children, p_sibling) {
1330 		pid = p->p_pid;
1331 		ret = proc_to_reap(td, p, idtype, id, status, options,
1332 		    wrusage, siginfo, 0);
1333 		if (ret == 0)
1334 			continue;
1335 		else if (ret != 1) {
1336 			td->td_retval[0] = pid;
1337 			return (0);
1338 		}
1339 
1340 		nfound++;
1341 		PROC_LOCK_ASSERT(p, MA_OWNED);
1342 
1343 		if ((options & WTRAPPED) != 0 &&
1344 		    (p->p_flag & P_TRACED) != 0) {
1345 			PROC_SLOCK(p);
1346 			report =
1347 			    ((p->p_flag & (P_STOPPED_TRACE | P_STOPPED_SIG)) &&
1348 			    p->p_suspcount == p->p_numthreads &&
1349 			    (p->p_flag & P_WAITED) == 0);
1350 			PROC_SUNLOCK(p);
1351 			if (report) {
1352 			CTR4(KTR_PTRACE,
1353 			    "wait: returning trapped pid %d status %#x "
1354 			    "(xstat %d) xthread %d",
1355 			    p->p_pid, W_STOPCODE(p->p_xsig), p->p_xsig,
1356 			    p->p_xthread != NULL ?
1357 			    p->p_xthread->td_tid : -1);
1358 				report_alive_proc(td, p, siginfo, status,
1359 				    options, CLD_TRAPPED);
1360 				return (0);
1361 			}
1362 		}
1363 		if ((options & WUNTRACED) != 0 &&
1364 		    (p->p_flag & P_STOPPED_SIG) != 0) {
1365 			PROC_SLOCK(p);
1366 			report = (p->p_suspcount == p->p_numthreads &&
1367 			    ((p->p_flag & P_WAITED) == 0));
1368 			PROC_SUNLOCK(p);
1369 			if (report) {
1370 				report_alive_proc(td, p, siginfo, status,
1371 				    options, CLD_STOPPED);
1372 				return (0);
1373 			}
1374 		}
1375 		if ((options & WCONTINUED) != 0 &&
1376 		    (p->p_flag & P_CONTINUED) != 0) {
1377 			report_alive_proc(td, p, siginfo, status, options,
1378 			    CLD_CONTINUED);
1379 			return (0);
1380 		}
1381 		PROC_UNLOCK(p);
1382 	}
1383 
1384 	/*
1385 	 * Look in the orphans list too, to allow the parent to
1386 	 * collect it's child exit status even if child is being
1387 	 * debugged.
1388 	 *
1389 	 * Debugger detaches from the parent upon successful
1390 	 * switch-over from parent to child.  At this point due to
1391 	 * re-parenting the parent loses the child to debugger and a
1392 	 * wait4(2) call would report that it has no children to wait
1393 	 * for.  By maintaining a list of orphans we allow the parent
1394 	 * to successfully wait until the child becomes a zombie.
1395 	 */
1396 	if (nfound == 0) {
1397 		LIST_FOREACH(p, &q->p_orphans, p_orphan) {
1398 			ret = proc_to_reap(td, p, idtype, id, NULL, options,
1399 			    NULL, NULL, 1);
1400 			if (ret != 0) {
1401 				KASSERT(ret != -1, ("reaped an orphan (pid %d)",
1402 				    (int)td->td_retval[0]));
1403 				PROC_UNLOCK(p);
1404 				nfound++;
1405 				break;
1406 			}
1407 		}
1408 	}
1409 	if (nfound == 0) {
1410 		sx_xunlock(&proctree_lock);
1411 		return (ECHILD);
1412 	}
1413 	if (options & WNOHANG) {
1414 		sx_xunlock(&proctree_lock);
1415 		td->td_retval[0] = 0;
1416 		return (0);
1417 	}
1418 	PROC_LOCK(q);
1419 	if (q->p_flag & P_STATCHILD) {
1420 		q->p_flag &= ~P_STATCHILD;
1421 		PROC_UNLOCK(q);
1422 		goto loop_locked;
1423 	}
1424 	sx_xunlock(&proctree_lock);
1425 	error = msleep(q, &q->p_mtx, PWAIT | PCATCH | PDROP, "wait", 0);
1426 	if (error)
1427 		return (error);
1428 	goto loop;
1429 }
1430 
1431 void
1432 proc_add_orphan(struct proc *child, struct proc *parent)
1433 {
1434 
1435 	sx_assert(&proctree_lock, SX_XLOCKED);
1436 	KASSERT((child->p_flag & P_TRACED) != 0,
1437 	    ("proc_add_orphan: not traced"));
1438 
1439 	if (LIST_EMPTY(&parent->p_orphans)) {
1440 		child->p_treeflag |= P_TREE_FIRST_ORPHAN;
1441 		LIST_INSERT_HEAD(&parent->p_orphans, child, p_orphan);
1442 	} else {
1443 		LIST_INSERT_AFTER(LIST_FIRST(&parent->p_orphans),
1444 		    child, p_orphan);
1445 	}
1446 	child->p_treeflag |= P_TREE_ORPHANED;
1447 }
1448 
1449 /*
1450  * Make process 'parent' the new parent of process 'child'.
1451  * Must be called with an exclusive hold of proctree lock.
1452  */
1453 void
1454 proc_reparent(struct proc *child, struct proc *parent, bool set_oppid)
1455 {
1456 
1457 	sx_assert(&proctree_lock, SX_XLOCKED);
1458 	PROC_LOCK_ASSERT(child, MA_OWNED);
1459 	if (child->p_pptr == parent)
1460 		return;
1461 
1462 	PROC_LOCK(child->p_pptr);
1463 	sigqueue_take(child->p_ksi);
1464 	PROC_UNLOCK(child->p_pptr);
1465 	LIST_REMOVE(child, p_sibling);
1466 	LIST_INSERT_HEAD(&parent->p_children, child, p_sibling);
1467 
1468 	proc_clear_orphan(child);
1469 	if ((child->p_flag & P_TRACED) != 0) {
1470 		proc_add_orphan(child, child->p_pptr);
1471 	}
1472 
1473 	child->p_pptr = parent;
1474 	if (set_oppid)
1475 		child->p_oppid = parent->p_pid;
1476 }
1477