xref: /freebsd/sys/kern/kern_exit.c (revision a3e8fd0b7f663db7eafff527d5c3ca3bcfa8a537)
1 /*
2  * Copyright (c) 1982, 1986, 1989, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by the University of
21  *	California, Berkeley and its contributors.
22  * 4. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *	@(#)kern_exit.c	8.7 (Berkeley) 2/12/94
39  * $FreeBSD$
40  */
41 
42 #include "opt_compat.h"
43 #include "opt_ktrace.h"
44 
45 #include <sys/param.h>
46 #include <sys/systm.h>
47 #include <sys/sysproto.h>
48 #include <sys/kernel.h>
49 #include <sys/malloc.h>
50 #include <sys/lock.h>
51 #include <sys/mutex.h>
52 #include <sys/proc.h>
53 #include <sys/pioctl.h>
54 #include <sys/tty.h>
55 #include <sys/wait.h>
56 #include <sys/vmmeter.h>
57 #include <sys/vnode.h>
58 #include <sys/resourcevar.h>
59 #include <sys/signalvar.h>
60 #include <sys/sched.h>
61 #include <sys/sx.h>
62 #include <sys/ptrace.h>
63 #include <sys/acct.h>		/* for acct_process() function prototype */
64 #include <sys/filedesc.h>
65 #include <sys/shm.h>
66 #include <sys/sem.h>
67 #include <sys/jail.h>
68 #ifdef KTRACE
69 #include <sys/ktrace.h>
70 #endif
71 
72 #include <vm/vm.h>
73 #include <vm/vm_extern.h>
74 #include <vm/vm_param.h>
75 #include <vm/pmap.h>
76 #include <vm/vm_map.h>
77 #include <vm/uma.h>
78 #include <sys/user.h>
79 
80 /* Required to be non-static for SysVR4 emulator */
81 MALLOC_DEFINE(M_ZOMBIE, "zombie", "zombie proc status");
82 
83 static MALLOC_DEFINE(M_ATEXIT, "atexit", "atexit callback");
84 
85 static int wait1(struct thread *, struct wait_args *, int);
86 
87 /*
88  * callout list for things to do at exit time
89  */
90 struct exitlist {
91 	exitlist_fn function;
92 	TAILQ_ENTRY(exitlist) next;
93 };
94 
95 TAILQ_HEAD(exit_list_head, exitlist);
96 static struct exit_list_head exit_list = TAILQ_HEAD_INITIALIZER(exit_list);
97 
98 /*
99  * exit --
100  *	Death of process.
101  *
102  * MPSAFE
103  */
104 void
105 sys_exit(td, uap)
106 	struct thread *td;
107 	struct sys_exit_args /* {
108 		int	rval;
109 	} */ *uap;
110 {
111 
112 	mtx_lock(&Giant);
113 	exit1(td, W_EXITCODE(uap->rval, 0));
114 	/* NOTREACHED */
115 }
116 
117 /*
118  * Exit: deallocate address space and other resources, change proc state
119  * to zombie, and unlink proc from allproc and parent's lists.  Save exit
120  * status and rusage for wait().  Check for child processes and orphan them.
121  */
122 void
123 exit1(td, rv)
124 	register struct thread *td;
125 	int rv;
126 {
127 	struct exitlist *ep;
128 	struct proc *p, *nq, *q;
129 	struct tty *tp;
130 	struct vnode *ttyvp;
131 	register struct vmspace *vm;
132 	struct vnode *vtmp;
133 #ifdef KTRACE
134 	struct vnode *tracevp;
135 #endif
136 
137 	GIANT_REQUIRED;
138 
139 	p = td->td_proc;
140 	if (p == initproc) {
141 		printf("init died (signal %d, exit %d)\n",
142 		    WTERMSIG(rv), WEXITSTATUS(rv));
143 		panic("Going nowhere without my init!");
144 	}
145 
146 	/*
147 	 * XXXXKSE: MUST abort all other threads before proceeding past here.
148 	 */
149 	PROC_LOCK(p);
150 	if (p->p_flag & P_KSES) {
151 		/*
152 		 * First check if some other thread got here before us..
153 		 * if so, act apropriatly, (exit or suspend);
154 		 */
155 		thread_suspend_check(0);
156 		/*
157 		 * Here is a trick..
158 		 * We need to free up our KSE to process other threads
159 		 * so that we can safely set the UNBOUND flag
160 		 * (whether or not we have a mailbox) as we are NEVER
161 		 * going to return to the user.
162 		 * The flag will not be set yet if we are exiting
163 		 * because of a signal, pagefault, or similar
164 		 * (or even an exit(2) from the UTS).
165 		 */
166 		td->td_flags |= TDF_UNBOUND;
167 
168 		/*
169 		 * Kill off the other threads. This requires
170 		 * Some co-operation from other parts of the kernel
171 		 * so it may not be instant.
172 		 * With this state set:
173 		 * Any thread entering the kernel from userspace will
174 		 * thread_exit() in trap().  Any thread attempting to
175 		 * sleep will return immediatly
176 		 * with EINTR or EWOULDBLOCK, which will hopefully force them
177 		 * to back out to userland, freeing resources as they go, and
178 		 * anything attempting to return to userland will thread_exit()
179 		 * from userret().  thread_exit() will unsuspend us
180 		 * when the last other thread exits.
181 		 */
182 		if (thread_single(SINGLE_EXIT)) {
183 			panic ("Exit: Single threading fouled up");
184 		}
185 		/*
186 		 * All other activity in this process is now stopped.
187 		 * Remove excess KSEs and KSEGRPS. XXXKSE (when we have them)
188 		 * ...
189 		 * Turn off threading support.
190 		 */
191 		p->p_flag &= ~P_KSES;
192 		td->td_flags &= ~TDF_UNBOUND;
193 		thread_single_end(); 	/* Don't need this any more. */
194 	}
195 	/*
196 	 * With this state set:
197 	 * Any thread entering the kernel from userspace will thread_exit()
198 	 * in trap().  Any thread attempting to sleep will return immediatly
199 	 * with EINTR or EWOULDBLOCK, which will hopefully force them
200 	 * to back out to userland, freeing resources as they go, and
201 	 * anything attempting to return to userland will thread_exit()
202 	 * from userret().  thread_exit() will do a wakeup on p->p_numthreads
203 	 * if it transitions to 1.
204 	 */
205 
206 	p->p_flag |= P_WEXIT;
207 	PROC_UNLOCK(p);
208 
209 	/* Are we a task leader? */
210 	if (p == p->p_leader) {
211 		mtx_lock(&ppeers_lock);
212 		q = p->p_peers;
213 		while (q != NULL) {
214 			PROC_LOCK(q);
215 			psignal(q, SIGKILL);
216 			PROC_UNLOCK(q);
217 			q = q->p_peers;
218 		}
219 		while (p->p_peers != NULL)
220 			msleep(p, &ppeers_lock, PWAIT, "exit1", 0);
221 		mtx_unlock(&ppeers_lock);
222 	}
223 
224 #ifdef PGINPROF
225 	vmsizmon();
226 #endif
227 	STOPEVENT(p, S_EXIT, rv);
228 	wakeup(&p->p_stype);	/* Wakeup anyone in procfs' PIOCWAIT */
229 
230 	/*
231 	 * Check if any loadable modules need anything done at process exit.
232 	 * e.g. SYSV IPC stuff
233 	 * XXX what if one of these generates an error?
234 	 */
235 	TAILQ_FOREACH(ep, &exit_list, next)
236 		(*ep->function)(p);
237 
238 	stopprofclock(p);
239 
240 	MALLOC(p->p_ru, struct rusage *, sizeof(struct rusage),
241 		M_ZOMBIE, M_WAITOK);
242 	/*
243 	 * If parent is waiting for us to exit or exec,
244 	 * P_PPWAIT is set; we will wakeup the parent below.
245 	 */
246 	PROC_LOCK(p);
247 	p->p_flag &= ~(P_TRACED | P_PPWAIT);
248 	SIGEMPTYSET(p->p_siglist);
249 	PROC_UNLOCK(p);
250 	if (timevalisset(&p->p_realtimer.it_value))
251 		callout_stop(&p->p_itcallout);
252 
253 	/*
254 	 * Reset any sigio structures pointing to us as a result of
255 	 * F_SETOWN with our pid.
256 	 */
257 	funsetownlst(&p->p_sigiolst);
258 
259 	/*
260 	 * Close open files and release open-file table.
261 	 * This may block!
262 	 */
263 	fdfree(td); /* XXXKSE *//* may not be the one in proc */
264 
265 	/*
266 	 * Remove ourself from our leader's peer list and wake our leader.
267 	 */
268 	mtx_lock(&ppeers_lock);
269 	if (p->p_leader->p_peers) {
270 		q = p->p_leader;
271 		while (q->p_peers != p)
272 			q = q->p_peers;
273 		q->p_peers = p->p_peers;
274 		wakeup(p->p_leader);
275 	}
276 	mtx_unlock(&ppeers_lock);
277 
278 	/* The next two chunks should probably be moved to vmspace_exit. */
279 	vm = p->p_vmspace;
280 	/*
281 	 * Release user portion of address space.
282 	 * This releases references to vnodes,
283 	 * which could cause I/O if the file has been unlinked.
284 	 * Need to do this early enough that we can still sleep.
285 	 * Can't free the entire vmspace as the kernel stack
286 	 * may be mapped within that space also.
287 	 */
288 	if (--vm->vm_refcnt == 0) {
289 		if (vm->vm_shm)
290 			shmexit(p);
291 		pmap_remove_pages(vmspace_pmap(vm), vm_map_min(&vm->vm_map),
292 		    vm_map_max(&vm->vm_map));
293 		(void) vm_map_remove(&vm->vm_map, vm_map_min(&vm->vm_map),
294 		    vm_map_max(&vm->vm_map));
295 		vm->vm_freer = p;
296 	}
297 
298 	sx_xlock(&proctree_lock);
299 	if (SESS_LEADER(p)) {
300 		register struct session *sp;
301 
302 		sp = p->p_session;
303 		if (sp->s_ttyvp) {
304 			/*
305 			 * Controlling process.
306 			 * Signal foreground pgrp,
307 			 * drain controlling terminal
308 			 * and revoke access to controlling terminal.
309 			 */
310 			if (sp->s_ttyp && (sp->s_ttyp->t_session == sp)) {
311 				tp = sp->s_ttyp;
312 				if (sp->s_ttyp->t_pgrp) {
313 					PGRP_LOCK(sp->s_ttyp->t_pgrp);
314 					pgsignal(sp->s_ttyp->t_pgrp, SIGHUP, 1);
315 					PGRP_UNLOCK(sp->s_ttyp->t_pgrp);
316 				}
317 				/* XXX tp should be locked. */
318 				sx_xunlock(&proctree_lock);
319 				(void) ttywait(tp);
320 				sx_xlock(&proctree_lock);
321 				/*
322 				 * The tty could have been revoked
323 				 * if we blocked.
324 				 */
325 				if (sp->s_ttyvp) {
326 					ttyvp = sp->s_ttyvp;
327 					SESS_LOCK(p->p_session);
328 					sp->s_ttyvp = NULL;
329 					SESS_UNLOCK(p->p_session);
330 					sx_xunlock(&proctree_lock);
331 					VOP_REVOKE(ttyvp, REVOKEALL);
332 					vrele(ttyvp);
333 					sx_xlock(&proctree_lock);
334 				}
335 			}
336 			if (sp->s_ttyvp) {
337 				ttyvp = sp->s_ttyvp;
338 				SESS_LOCK(p->p_session);
339 				sp->s_ttyvp = NULL;
340 				SESS_UNLOCK(p->p_session);
341 				vrele(ttyvp);
342 			}
343 			/*
344 			 * s_ttyp is not zero'd; we use this to indicate
345 			 * that the session once had a controlling terminal.
346 			 * (for logging and informational purposes)
347 			 */
348 		}
349 		SESS_LOCK(p->p_session);
350 		sp->s_leader = NULL;
351 		SESS_UNLOCK(p->p_session);
352 	}
353 	fixjobc(p, p->p_pgrp, 0);
354 	sx_xunlock(&proctree_lock);
355 	(void)acct_process(td);
356 #ifdef KTRACE
357 	/*
358 	 * release trace file
359 	 */
360 	PROC_LOCK(p);
361 	mtx_lock(&ktrace_mtx);
362 	p->p_traceflag = 0;	/* don't trace the vrele() */
363 	tracevp = p->p_tracep;
364 	p->p_tracep = NULL;
365 	mtx_unlock(&ktrace_mtx);
366 	PROC_UNLOCK(p);
367 	if (tracevp != NULL)
368 		vrele(tracevp);
369 #endif
370 	/*
371 	 * Release reference to text vnode
372 	 */
373 	if ((vtmp = p->p_textvp) != NULL) {
374 		p->p_textvp = NULL;
375 		vrele(vtmp);
376 	}
377 
378 	/*
379 	 * Release our limits structure.
380 	 */
381 	mtx_assert(&Giant, MA_OWNED);
382 	if (--p->p_limit->p_refcnt == 0) {
383 		FREE(p->p_limit, M_SUBPROC);
384 		p->p_limit = NULL;
385 	}
386 
387 	/*
388 	 * Release this thread's reference to the ucred.  The actual proc
389 	 * reference will stay around until the proc is harvested by
390 	 * wait().  At this point the ucred is immutable (no other threads
391 	 * from this proc are around that can change it) so we leave the
392 	 * per-thread ucred pointer intact in case it is needed although
393 	 * in theory nothing should be using it at this point.
394 	 */
395 	crfree(td->td_ucred);
396 
397 	/*
398 	 * Remove proc from allproc queue and pidhash chain.
399 	 * Place onto zombproc.  Unlink from parent's child list.
400 	 */
401 	sx_xlock(&allproc_lock);
402 	LIST_REMOVE(p, p_list);
403 	LIST_INSERT_HEAD(&zombproc, p, p_list);
404 	LIST_REMOVE(p, p_hash);
405 	sx_xunlock(&allproc_lock);
406 
407 	sx_xlock(&proctree_lock);
408 	q = LIST_FIRST(&p->p_children);
409 	if (q != NULL)		/* only need this if any child is S_ZOMB */
410 		wakeup(initproc);
411 	for (; q != NULL; q = nq) {
412 		nq = LIST_NEXT(q, p_sibling);
413 		PROC_LOCK(q);
414 		proc_reparent(q, initproc);
415 		q->p_sigparent = SIGCHLD;
416 		/*
417 		 * Traced processes are killed
418 		 * since their existence means someone is screwing up.
419 		 */
420 		if (q->p_flag & P_TRACED) {
421 			q->p_flag &= ~P_TRACED;
422 			psignal(q, SIGKILL);
423 		}
424 		PROC_UNLOCK(q);
425 	}
426 
427 	/*
428 	 * Save exit status and final rusage info, adding in child rusage
429 	 * info and self times.
430 	 */
431 	PROC_LOCK(p);
432 	p->p_xstat = rv;
433 	*p->p_ru = p->p_stats->p_ru;
434 	mtx_lock_spin(&sched_lock);
435 	calcru(p, &p->p_ru->ru_utime, &p->p_ru->ru_stime, NULL);
436 	mtx_unlock_spin(&sched_lock);
437 	ruadd(p->p_ru, &p->p_stats->p_cru);
438 
439 	/*
440 	 * Notify interested parties of our demise.
441 	 */
442 	KNOTE(&p->p_klist, NOTE_EXIT);
443 
444 	/*
445 	 * Notify parent that we're gone.  If parent has the PS_NOCLDWAIT
446 	 * flag set, or if the handler is set to SIG_IGN, notify process
447 	 * 1 instead (and hope it will handle this situation).
448 	 */
449 	PROC_LOCK(p->p_pptr);
450 	if (p->p_pptr->p_procsig->ps_flag & (PS_NOCLDWAIT | PS_CLDSIGIGN)) {
451 		struct proc *pp;
452 
453 		pp = p->p_pptr;
454 		PROC_UNLOCK(pp);
455 		proc_reparent(p, initproc);
456 		PROC_LOCK(p->p_pptr);
457 		/*
458 		 * If this was the last child of our parent, notify
459 		 * parent, so in case he was wait(2)ing, he will
460 		 * continue.
461 		 */
462 		if (LIST_EMPTY(&pp->p_children))
463 			wakeup(pp);
464 	}
465 
466 	if (p->p_sigparent && p->p_pptr != initproc)
467 		psignal(p->p_pptr, p->p_sigparent);
468 	else
469 		psignal(p->p_pptr, SIGCHLD);
470 	PROC_UNLOCK(p->p_pptr);
471 
472 	/*
473 	 * If this is a kthread, then wakeup anyone waiting for it to exit.
474 	 */
475 	if (p->p_flag & P_KTHREAD)
476 		wakeup(p);
477 	PROC_UNLOCK(p);
478 
479 	/*
480 	 * Finally, call machine-dependent code to release the remaining
481 	 * resources including address space, the kernel stack and pcb.
482 	 * The address space is released by "vmspace_exitfree(p)" in
483 	 * vm_waitproc().
484 	 */
485 	cpu_exit(td);
486 
487 	PROC_LOCK(p);
488 	PROC_LOCK(p->p_pptr);
489 	sx_xunlock(&proctree_lock);
490 	mtx_lock_spin(&sched_lock);
491 	while (mtx_owned(&Giant))
492 		mtx_unlock(&Giant);
493 
494 	/*
495 	 * We have to wait until after releasing all locks before
496 	 * changing p_state.  If we block on a mutex then we will be
497 	 * back at SRUN when we resume and our parent will never
498 	 * harvest us.
499 	 */
500 	p->p_state = PRS_ZOMBIE;
501 
502 	wakeup(p->p_pptr);
503 	PROC_UNLOCK(p->p_pptr);
504 	cnt.v_swtch++;
505 	binuptime(PCPU_PTR(switchtime));
506 	PCPU_SET(switchticks, ticks);
507 
508 	cpu_sched_exit(td); /* XXXKSE check if this should be in thread_exit */
509 	/*
510 	 * Make sure this thread is discarded from the zombie.
511 	 * This will also release this thread's reference to the ucred.
512 	 */
513 	thread_exit();
514 	panic("exit1");
515 }
516 
517 #ifdef COMPAT_43
518 /*
519  * MPSAFE.  The dirty work is handled by wait1().
520  */
521 int
522 owait(td, uap)
523 	struct thread *td;
524 	register struct owait_args /* {
525 		int     dummy;
526 	} */ *uap;
527 {
528 	struct wait_args w;
529 
530 	w.options = 0;
531 	w.rusage = NULL;
532 	w.pid = WAIT_ANY;
533 	w.status = NULL;
534 	return (wait1(td, &w, 1));
535 }
536 #endif /* COMPAT_43 */
537 
538 /*
539  * MPSAFE.  The dirty work is handled by wait1().
540  */
541 int
542 wait4(td, uap)
543 	struct thread *td;
544 	struct wait_args *uap;
545 {
546 
547 	return (wait1(td, uap, 0));
548 }
549 
550 /*
551  * MPSAFE
552  */
553 static int
554 wait1(td, uap, compat)
555 	register struct thread *td;
556 	register struct wait_args /* {
557 		int pid;
558 		int *status;
559 		int options;
560 		struct rusage *rusage;
561 	} */ *uap;
562 	int compat;
563 {
564 	struct rusage ru;
565 	int nfound;
566 	struct proc *p, *q, *t;
567 	int status, error;
568 	struct thread *td2;
569 	struct kse *ke;
570 	struct ksegrp *kg;
571 
572 	q = td->td_proc;
573 	if (uap->pid == 0) {
574 		PROC_LOCK(q);
575 		uap->pid = -q->p_pgid;
576 		PROC_UNLOCK(q);
577 	}
578 	if (uap->options &~ (WUNTRACED|WNOHANG|WCONTINUED|WLINUXCLONE))
579 		return (EINVAL);
580 	mtx_lock(&Giant);
581 loop:
582 	nfound = 0;
583 	sx_xlock(&proctree_lock);
584 	LIST_FOREACH(p, &q->p_children, p_sibling) {
585 		PROC_LOCK(p);
586 		if (uap->pid != WAIT_ANY &&
587 		    p->p_pid != uap->pid && p->p_pgid != -uap->pid) {
588 			PROC_UNLOCK(p);
589 			continue;
590 		}
591 
592 		/*
593 		 * This special case handles a kthread spawned by linux_clone
594 		 * (see linux_misc.c).  The linux_wait4 and linux_waitpid
595 		 * functions need to be able to distinguish between waiting
596 		 * on a process and waiting on a thread.  It is a thread if
597 		 * p_sigparent is not SIGCHLD, and the WLINUXCLONE option
598 		 * signifies we want to wait for threads and not processes.
599 		 */
600 		if ((p->p_sigparent != SIGCHLD) ^
601 		    ((uap->options & WLINUXCLONE) != 0)) {
602 			PROC_UNLOCK(p);
603 			continue;
604 		}
605 
606 		nfound++;
607 		if (p->p_state == PRS_ZOMBIE) {
608 			/*
609 			 * Allow the scheduler to adjust the priority of the
610 			 * parent when a kseg is exiting.
611 			 */
612 			if (curthread->td_proc->p_pid != 1) {
613 				mtx_lock_spin(&sched_lock);
614 				sched_exit(curthread->td_ksegrp,
615 				    FIRST_KSEGRP_IN_PROC(p));
616 				mtx_unlock_spin(&sched_lock);
617 			}
618 
619 			td->td_retval[0] = p->p_pid;
620 #ifdef COMPAT_43
621 			if (compat)
622 				td->td_retval[1] = p->p_xstat;
623 			else
624 #endif
625 			if (uap->status) {
626 				status = p->p_xstat;	/* convert to int */
627 				PROC_UNLOCK(p);
628 				if ((error = copyout(&status,
629 				    uap->status, sizeof(status)))) {
630 					sx_xunlock(&proctree_lock);
631 					mtx_unlock(&Giant);
632 					return (error);
633 				}
634 				PROC_LOCK(p);
635 			}
636 			if (uap->rusage) {
637 				bcopy(p->p_ru, &ru, sizeof(ru));
638 				PROC_UNLOCK(p);
639 				if ((error = copyout(&ru,
640 				    uap->rusage, sizeof (struct rusage)))) {
641 					sx_xunlock(&proctree_lock);
642 					mtx_unlock(&Giant);
643 					return (error);
644 				}
645 			} else
646 				PROC_UNLOCK(p);
647 			/*
648 			 * If we got the child via a ptrace 'attach',
649 			 * we need to give it back to the old parent.
650 			 */
651 			if (p->p_oppid && (t = pfind(p->p_oppid)) != NULL) {
652 				PROC_LOCK(p);
653 				p->p_oppid = 0;
654 				proc_reparent(p, t);
655 				PROC_UNLOCK(p);
656 				psignal(t, SIGCHLD);
657 				wakeup(t);
658 				PROC_UNLOCK(t);
659 				sx_xunlock(&proctree_lock);
660 				mtx_unlock(&Giant);
661 				return (0);
662 			}
663 			/*
664 			 * Remove other references to this process to ensure
665 			 * we have an exclusive reference.
666 			 */
667 			leavepgrp(p);
668 
669 			sx_xlock(&allproc_lock);
670 			LIST_REMOVE(p, p_list);	/* off zombproc */
671 			sx_xunlock(&allproc_lock);
672 
673 			LIST_REMOVE(p, p_sibling);
674 			sx_xunlock(&proctree_lock);
675 
676 			/*
677 			 * As a side effect of this lock, we know that
678 			 * all other writes to this proc are visible now, so
679 			 * no more locking is needed for p.
680 			 */
681 			PROC_LOCK(p);
682 			p->p_xstat = 0;		/* XXX: why? */
683 			PROC_UNLOCK(p);
684 			PROC_LOCK(q);
685 			ruadd(&q->p_stats->p_cru, p->p_ru);
686 			PROC_UNLOCK(q);
687 			FREE(p->p_ru, M_ZOMBIE);
688 			p->p_ru = NULL;
689 
690 			/*
691 			 * Decrement the count of procs running with this uid.
692 			 */
693 			(void)chgproccnt(p->p_ucred->cr_ruidinfo, -1, 0);
694 
695 			/*
696 			 * Free up credentials.
697 			 */
698 			crfree(p->p_ucred);
699 			p->p_ucred = NULL;	/* XXX: why? */
700 
701 			/*
702 			 * Remove unused arguments
703 			 */
704 			pargs_drop(p->p_args);
705 			p->p_args = NULL;
706 
707 			if (--p->p_procsig->ps_refcnt == 0) {
708 				if (p->p_sigacts != &p->p_uarea->u_sigacts)
709 					FREE(p->p_sigacts, M_SUBPROC);
710 				FREE(p->p_procsig, M_SUBPROC);
711 				p->p_procsig = NULL;
712 			}
713 
714 			/*
715 			 * There should only be one
716 			 * but do it right anyhow.
717 			 */
718 			FOREACH_KSEGRP_IN_PROC(p, kg) {
719 				FOREACH_KSE_IN_GROUP(kg, ke) {
720 					/* Free the KSE spare thread. */
721 					if (ke->ke_tdspare != NULL) {
722 						thread_free(ke->ke_tdspare);
723 						ke->ke_tdspare = NULL;
724 					}
725 				}
726 			}
727 			FOREACH_THREAD_IN_PROC(p, td2) {
728 				if (td2->td_standin != NULL) {
729 					thread_free(td2->td_standin);
730 					td2->td_standin = NULL;
731 				}
732 			}
733 			thread_reap();	/* check for zombie threads */
734 
735 			/*
736 			 * Give vm and machine-dependent layer a chance
737 			 * to free anything that cpu_exit couldn't
738 			 * release while still running in process context.
739 			 */
740 			vm_waitproc(p);
741 			mtx_destroy(&p->p_mtx);
742 			KASSERT(FIRST_THREAD_IN_PROC(p),
743 			    ("wait1: no residual thread!"));
744 			uma_zfree(proc_zone, p);
745 			sx_xlock(&allproc_lock);
746 			nprocs--;
747 			sx_xunlock(&allproc_lock);
748 			mtx_unlock(&Giant);
749 			return (0);
750 		}
751 		if (P_SHOULDSTOP(p) && ((p->p_flag & P_WAITED) == 0) &&
752 		    (p->p_flag & P_TRACED || uap->options & WUNTRACED)) {
753 			p->p_flag |= P_WAITED;
754 			sx_xunlock(&proctree_lock);
755 			td->td_retval[0] = p->p_pid;
756 #ifdef COMPAT_43
757 			if (compat) {
758 				td->td_retval[1] = W_STOPCODE(p->p_xstat);
759 				PROC_UNLOCK(p);
760 				error = 0;
761 			} else
762 #endif
763 			if (uap->status) {
764 				status = W_STOPCODE(p->p_xstat);
765 				PROC_UNLOCK(p);
766 				error = copyout(&status,
767 					uap->status, sizeof(status));
768 			} else {
769 				PROC_UNLOCK(p);
770 				error = 0;
771 			}
772 			mtx_unlock(&Giant);
773 			return (error);
774 		}
775 		if (uap->options & WCONTINUED && (p->p_flag & P_CONTINUED)) {
776 			sx_xunlock(&proctree_lock);
777 			td->td_retval[0] = p->p_pid;
778 			p->p_flag &= ~P_CONTINUED;
779 			PROC_UNLOCK(p);
780 
781 			if (uap->status) {
782 				status = SIGCONT;
783 				error = copyout(&status,
784 				    uap->status, sizeof(status));
785 			} else
786 				error = 0;
787 
788 			mtx_unlock(&Giant);
789 			return (error);
790 		}
791 		PROC_UNLOCK(p);
792 	}
793 	if (nfound == 0) {
794 		sx_xunlock(&proctree_lock);
795 		mtx_unlock(&Giant);
796 		return (ECHILD);
797 	}
798 	if (uap->options & WNOHANG) {
799 		sx_xunlock(&proctree_lock);
800 		td->td_retval[0] = 0;
801 		mtx_unlock(&Giant);
802 		return (0);
803 	}
804 	PROC_LOCK(q);
805 	sx_xunlock(&proctree_lock);
806 	error = msleep(q, &q->p_mtx, PWAIT | PCATCH, "wait", 0);
807 	PROC_UNLOCK(q);
808 	if (error) {
809 		mtx_unlock(&Giant);
810 		return (error);
811 	}
812 	goto loop;
813 }
814 
815 /*
816  * Make process 'parent' the new parent of process 'child'.
817  * Must be called with an exclusive hold of proctree lock.
818  */
819 void
820 proc_reparent(child, parent)
821 	register struct proc *child;
822 	register struct proc *parent;
823 {
824 
825 	sx_assert(&proctree_lock, SX_XLOCKED);
826 	PROC_LOCK_ASSERT(child, MA_OWNED);
827 	if (child->p_pptr == parent)
828 		return;
829 
830 	LIST_REMOVE(child, p_sibling);
831 	LIST_INSERT_HEAD(&parent->p_children, child, p_sibling);
832 	child->p_pptr = parent;
833 }
834 
835 /*
836  * The next two functions are to handle adding/deleting items on the
837  * exit callout list
838  *
839  * at_exit():
840  * Take the arguments given and put them onto the exit callout list,
841  * However first make sure that it's not already there.
842  * returns 0 on success.
843  */
844 
845 int
846 at_exit(function)
847 	exitlist_fn function;
848 {
849 	struct exitlist *ep;
850 
851 #ifdef INVARIANTS
852 	/* Be noisy if the programmer has lost track of things */
853 	if (rm_at_exit(function))
854 		printf("WARNING: exit callout entry (%p) already present\n",
855 		    function);
856 #endif
857 	ep = malloc(sizeof(*ep), M_ATEXIT, M_NOWAIT);
858 	if (ep == NULL)
859 		return (ENOMEM);
860 	ep->function = function;
861 	TAILQ_INSERT_TAIL(&exit_list, ep, next);
862 	return (0);
863 }
864 
865 /*
866  * Scan the exit callout list for the given item and remove it.
867  * Returns the number of items removed (0 or 1)
868  */
869 int
870 rm_at_exit(function)
871 	exitlist_fn function;
872 {
873 	struct exitlist *ep;
874 
875 	TAILQ_FOREACH(ep, &exit_list, next) {
876 		if (ep->function == function) {
877 			TAILQ_REMOVE(&exit_list, ep, next);
878 			free(ep, M_ATEXIT);
879 			return (1);
880 		}
881 	}
882 	return (0);
883 }
884