do_exit——>exit_notify()

/* * Send signals to all our closest relatives so that they know * to properly mourn(悼念) us.. */static void exit_notify(struct task_struct *tsk, int group_dead){int signal;void *cookie;/* * This does two things: *   * A.  Make init inherit all the child processes * B.  Check to see if any process groups have become orphaned *as a result of our exiting, and if they have any stopped *jobs, send them a SIGHUP and then a SIGCONT.  (POSIX 3.2.2.2) */forget_original_parent(tsk);exit_task_namespaces(tsk);  //将task的namespace置为NULLwrite_lock_irq(&tasklist_lock);if (group_dead)kill_orphaned_pgrp(tsk->group_leader, NULL);/* Let father know we died * * Thread signals are configurable, but you aren't going to use * that to send signals to arbitrary processes. * That stops right now. * * If the parent exec id doesn't match the exec id we saved * when we started then we know the parent has changed security * domain. * * If our self_exec id doesn't match our parent_exec_id then * we have changed execution domain as these two values started * the same after a fork. */if (tsk->exit_signal != SIGCHLD && !task_detached(tsk) &&    (tsk->parent_exec_id != tsk->real_parent->self_exec_id ||     tsk->self_exec_id != tsk->parent_exec_id))tsk->exit_signal = SIGCHLD;signal = tracehook_notify_death(tsk, &cookie, group_dead);if (signal >= 0)signal = do_notify_parent(tsk, signal);tsk->exit_state = signal == DEATH_REAP ? EXIT_DEAD : EXIT_ZOMBIE;/* mt-exec, de_thread() is waiting for group leader */if (unlikely(tsk->signal->notify_count < 0))wake_up_process(tsk->signal->group_exit_task);write_unlock_irq(&tasklist_lock);tracehook_report_death(tsk, signal, cookie, group_dead);/* If the process is dead, release it - nobody will wait for it */if (signal == DEATH_REAP)release_task(tsk);}

如这个函数开头注释的，这个函数负责通知所有与这个进程相关的亲属，以便让他们做出相应的改变，或者“悼念”即将死去的进程。

我们碰到的第一个重要的函数就是:forget_original_parent()

注释中给出了这个函数的作用：（1）让init进程继承这个进程的所有子进程；（2）检查该进程所在的进程组在该进程死后是否会变为孤儿进程组，如果他们已经停止了工作，

则想他们先后发送SIGHUP信号和SIGCONT信号。

在这个函数中，关键要搞清楚进程的“养父”进程——p_pptr和“生父进程”——p_optr的关系，详细的解释可以看《情景分析》 P343。

static void forget_original_parent(struct task_struct *father){struct task_struct *p, *n, *reaper;LIST_HEAD(dead_children);write_lock_irq(&tasklist_lock);/* * Note that exit_ptrace() and find_new_reaper() might * drop tasklist_lock and reacquire it. */exit_ptrace(father);/* * Detach all tasks we were using ptrace on. Called with tasklist held * for writing, and returns with it held too. But note it can release * and reacquire the lock. */reaper = find_new_reaper(father); //为即将死去的进程的子进程寻找一个父进程。这个函数的代码还是比较简单的。/* * When we die, we re-parent all our children. * Try to give them to another thread in our thread * group, and if no such member exists, give it to * the child reaper process (ie "init") in our pid * space. */list_for_each_entry_safe(p, n, &father->children, sibling) { //逐个处理将死进程的子进程struct task_struct *t = p;do {t->real_parent = reaper;  //将将死进程的子进程的兄弟进程的real_parent指向reaper进程if (t->parent == father) {BUG_ON(task_ptrace(t));t->parent = t->real_parent;}if (t->pdeath_signal)group_send_sig_info(t->pdeath_signal,    SEND_SIG_NOINFO, t); //发送SEND_SIG_NOINFO信号，注意task_struct结构中的pdeath_dignal就是当父进程死亡的时候才会被设置，也就是这个时候。} while_each_thread(p, t); //逐个处理将死进程的子进程的兄弟进程reparent_leader(father, p, &dead_children);//Any that need to be release_task'd are put on the @dead list.见下文详解：}write_unlock_irq(&tasklist_lock);BUG_ON(!list_empty(&father->children));list_for_each_entry_safe(p, n, &dead_children, sibling) {list_del_init(&p->sibling);  //?????????????????????????????????将p从兄弟队列中摘除，但是兄弟关系是怎么产生的呢？release_task(p);//做一些收尾工作，但是并未将task_struct结构删除，因为后者是其新的父进程的任务。}}

在forget_original_parent函数里边，为什么是两个循环来处理其子进程呢？我是因为父进程的子进程不一定在同一个slibing队列中，比如我们前文讲到的，如果是因为杀死了某个

进程A，而将A进程的子进程C的父进程指向了进程B，但是，我们并没有看到B进程的子进程D的slibing队列有什么变化，因此，D的slibing队列应该是没有将C进程链接进去的，因此就出现了这样的情况，即父进程有多个子进程，但是这些某些子进程之间可能是相互独立的，因此需要两层循环来将要撤销的父进程的所有子进程的父进程指向reaper.

来看一下forget_original_parent()中一个重要的函数reparent_leader():

/** Any that need to be release_task'd are put on the @dead list. */static void reparent_leader(struct task_struct *father, struct task_struct *p,struct list_head *dead){list_move_tail(&p->sibling, &p->real_parent->children); //将进程p从其现有的兄弟队列中退出来，并将其挂到新的real_parent进程的children队列上。if (task_detached(p)) //如果进程已经脱离了，即p->exit_signal == -1，那么就直接返回。return;/* * If this is a threaded reparent there is no need to * notify anyone anything has happened. */if (same_thread_group(p->real_parent, father)) //如果将死进程的子进程的新的父进程和将死进程同数一个线程组，那么就返回。因为不需要杀死这个线程组。                                                       //有关进程组/线程组/会话的知识请参看《UNIX环境高级编程》相关章节return;/* We don't want people slaying init.  */p->exit_signal = SIGCHLD;/* If it has exited notify the new parent about this child's death. */if (!task_ptrace(p) &&    p->exit_state == EXIT_ZOMBIE && thread_group_empty(p)) { //如果将死进程的子进程没有被跟踪，且其状态是僵死状态并且所在线程组已经是空的了do_notify_parent(p, p->exit_signal); //则 Let a parent know about the death of a child. 下文将详述该函数。if (task_detached(p)) {p->exit_state = EXIT_DEAD;/* *EXIT_DEAD is the state after an appropriate wait system call has been issued and before the task *is completely removed from the system. This state is only of importance if multiple threads issue *wait calls for the same task. *EXIT_DEAD状态和EXIT_ZOMBIE状态的区别可以参看《深入Linux内核框架》*/list_move_tail(&p->sibling, dead); //将进程p从其sibling队列中删除并添加到dead队列中。子进程间的兄弟关系是怎么建立的呢？}}kill_orphaned_pgrp(p, father);  //一个重要的函数，下文详述：}

来看一下reparent_leader函数中的一个重要的函数do_notify_parent():如果在进程没有被跟踪，并且其状态已经是僵死状态，而且其所在的线程组已经是空的了，那就用这个函数向其父进程发送一个信号，让其知道子进程的生命已经结束，而来料理后事儿：

/* * Let a parent know about the death of a child. * For a stopped/continued status change, use do_notify_parent_cldstop instead. * * Returns -1 if our parent ignored us and so we've switched to * self-reaping, or else @sig. */int do_notify_parent(struct task_struct *tsk, int sig){struct siginfo info;unsigned long flags;struct sighand_struct *psig;int ret = sig;BUG_ON(sig == -1); /* do_notify_parent_cldstop should have been called instead.  */ BUG_ON(task_is_stopped_or_traced(tsk));BUG_ON(!task_ptrace(tsk) &&       (tsk->group_leader != tsk || !thread_group_empty(tsk)));info.si_signo = sig;info.si_errno = 0;/* * we are under tasklist_lock here so our parent is tied to * us and cannot exit and release its namespace. * * the only it can is to switch its nsproxy with sys_unshare, * bu uncharing pid namespaces is not allowed, so we'll always * see relevant namespace * * write_lock() currently calls preempt_disable() which is the * same as rcu_read_lock(), but according to Oleg, this is not * correct to rely on this */rcu_read_lock();info.si_pid = task_pid_nr_ns(tsk, tsk->parent->nsproxy->pid_ns);info.si_uid = __task_cred(tsk)->uid;rcu_read_unlock();info.si_utime = cputime_to_clock_t(cputime_add(tsk->utime,tsk->signal->utime));info.si_stime = cputime_to_clock_t(cputime_add(tsk->stime,tsk->signal->stime));info.si_status = tsk->exit_code & 0x7f;if (tsk->exit_code & 0x80)info.si_code = CLD_DUMPED;else if (tsk->exit_code & 0x7f)info.si_code = CLD_KILLED;else {info.si_code = CLD_EXITED;info.si_status = tsk->exit_code >> 8;}psig = tsk->parent->sighand;spin_lock_irqsave(&psig->siglock, flags);if (!task_ptrace(tsk) && sig == SIGCHLD &&    (psig->action[SIGCHLD-1].sa.sa_handler == SIG_IGN ||     (psig->action[SIGCHLD-1].sa.sa_flags & SA_NOCLDWAIT))) {/* * We are exiting and our parent doesn't care.  POSIX.1 * defines special semantics for setting SIGCHLD to SIG_IGN * or setting the SA_NOCLDWAIT flag: we should be reaped * automatically and not left for our parent's wait4 call. * Rather than having the parent do it as a magic kind of * signal handler, we just set this to tell do_exit that we * can be cleaned up without becoming a zombie.  Note that * we still call __wake_up_parent in this case, because a * blocked sys_wait4 might now return -ECHILD. * * Whether we send SIGCHLD or not for SA_NOCLDWAIT * is implementation-defined: we do (if you don't want * it, just use SIG_IGN instead). */ret = tsk->exit_signal = -1;if (psig->action[SIGCHLD-1].sa.sa_handler == SIG_IGN)sig = -1;}if (valid_signal(sig) && sig > 0)__group_send_sig_info(sig, &info, tsk->parent);__wake_up_parent(tsk, tsk->parent);spin_unlock_irqrestore(&psig->siglock, flags);return ret;}

看一下reparent_leader的最后调用的一个函数kill_orphanded_pgrp:

/* * Check to see if any process groups have become orphaned as * a result of our exiting, and if they have any stopped jobs, * send them a SIGHUP and then a SIGCONT. (POSIX 3.2.2.2) */static voidkill_orphaned_pgrp(struct task_struct *tsk, struct task_struct *parent){struct pid *pgrp = task_pgrp(tsk);struct task_struct *ignored_task = tsk;if (!parent) /* exit: our father is in a different pgrp than  * we are and we were the only connection outside.  */parent = tsk->real_parent;else/* reparent: our child is in a different pgrp than * we are, and it was the only connection outside. */ignored_task = NULL;if (task_pgrp(parent) != pgrp &&  //进程tsk和其父进程不属于同一个组    task_session(parent) == task_session(tsk) && //进程tsk和其父进程属于一个会话    will_become_orphaned_pgrp(pgrp, ignored_task) && //进程组将会成为孤儿******************I ask you, have you ever kown what it is to be an orphan?******************************    has_stopped_jobs(pgrp)) { //是否有被停止的job，被停止的原因可能是因为debugger，可以参看《深入Linux内核框架》__kill_pgrp_info(SIGHUP, SEND_SIG_PRIV, pgrp); //向进程组发送SIGHUP信号，干什么用呢？__kill_pgrp_info(SIGCONT, SEND_SIG_PRIV, pgrp);//向进程组发送SIGCONT信号，干什么用呢？}}

那么怎么判断进程组将变成孤儿呢？在kill_orphanded_pgrp中will_become_orphanded_pgrp完成了这项工作：

/* * Determine if a process group is "orphaned", according to the POSIX * definition in 2.2.2.52.  Orphaned process groups are not to be affected * by terminal-generated stop signals.  Newly orphaned process groups are * to receive a SIGHUP and a SIGCONT. * * "I ask you, have you ever known what it is to be an orphan?" */static int will_become_orphaned_pgrp(struct pid *pgrp, struct task_struct *ignored_task){struct task_struct *p;do_each_pid_task(pgrp, PIDTYPE_PGID, p) { //循环查询线程组中的每一个线程if ((p == ignored_task) ||  //如果p是pgrp中的一员？？    (p->exit_state && thread_group_empty(p)) || //如果pgrp中的p进程正处于退出状态而且其所在的线程组是空的了    is_global_init(p->real_parent)) //或者pgrp中p进程的父进程是init进程，说明在该线程组中已经没有其他线程了（即list_empty(&p->thread_group) == 1;）。continue;if (task_pgrp(p->real_parent) != pgrp && //如果p的父进程和p不再同一个组中    task_session(p->real_parent) == task_session(p)) //但是p的父进程和p进程功属于一个会话return 0; //返回0，不会变成孤儿} while_each_pid_task(pgrp, PIDTYPE_PGID, p);return 1; //返回1，会变成孤儿。}

现在，我们先来总结一下有关孤儿进程的东西，详细的解释可以看《情景分析》：

进程的“生父(p_opptr)”进程和“养父(p_pptr)”进程通常是一致的，但是如果进程被跟踪时，p_pptr就会指向跟踪进程，而p_opptr的指向不变。当一个进程在其子进程之前去世时，就要把他的子进程托付给某个进程。如果当前进程是一个线程，那就托付给同一线程组的下一个线程，是子进程的p_opptr指向这个线程。否则就只好托付给init进程了。如果当前进程和生父进程属于不同的session，不同的组，同时又是其所在组与其父进程之间的唯一纽带，那么一旦当前进程不存在了，这整个组就会变成孤儿。