do_exit——>exit_notify()

/*
 * Send signals to all our closest relatives so that they know
 * to properly mourn(悼念) us..
 */
static void exit_notify(struct task_struct *tsk, int group_dead)
{
	int signal;
	void *cookie;

	/*
	 * This does two things:
	 *
  	 * A.  Make init inherit all the child processes
	 * B.  Check to see if any process groups have become orphaned
	 *	as a result of our exiting, and if they have any stopped
	 *	jobs, send them a SIGHUP and then a SIGCONT.  (POSIX 3.2.2.2)
	 */
	forget_original_parent(tsk);
	exit_task_namespaces(tsk);  //将task的namespace置为NULL

	write_lock_irq(&tasklist_lock);
	if (group_dead)
		kill_orphaned_pgrp(tsk->group_leader, NULL);

	/* Let father know we died
	 *
	 * Thread signals are configurable, but you aren't going to use
	 * that to send signals to arbitrary processes.
	 * That stops right now.
	 *
	 * If the parent exec id doesn't match the exec id we saved
	 * when we started then we know the parent has changed security
	 * domain.
	 *
	 * If our self_exec id doesn't match our parent_exec_id then
	 * we have changed execution domain as these two values started
	 * the same after a fork.
	 */
	if (tsk->exit_signal != SIGCHLD && !task_detached(tsk) &&
	    (tsk->parent_exec_id != tsk->real_parent->self_exec_id ||
	     tsk->self_exec_id != tsk->parent_exec_id))
		tsk->exit_signal = SIGCHLD;

	signal = tracehook_notify_death(tsk, &cookie, group_dead);
	if (signal >= 0)
		signal = do_notify_parent(tsk, signal);

	tsk->exit_state = signal == DEATH_REAP ? EXIT_DEAD : EXIT_ZOMBIE;

	/* mt-exec, de_thread() is waiting for group leader */
	if (unlikely(tsk->signal->notify_count < 0))
		wake_up_process(tsk->signal->group_exit_task);
	write_unlock_irq(&tasklist_lock);

	tracehook_report_death(tsk, signal, cookie, group_dead);

	/* If the process is dead, release it - nobody will wait for it */
	if (signal == DEATH_REAP)
		release_task(tsk);
}

如这个函数开头注释的，这个函数负责通知所有与这个进程相关的亲属，以便让他们做出相应的改变，或者“悼念”即将死去的进程。

我们碰到的第一个重要的函数就是:forget_original_parent()

注释中给出了这个函数的作用：（1）让init进程继承这个进程的所有子进程；（2）检查该进程所在的进程组在该进程死后是否会变为孤儿进程组，如果他们已经停止了工作，

则想他们先后发送SIGHUP信号和SIGCONT信号。

在这个函数中，关键要搞清楚进程的“养父”进程——p_pptr和“生父进程”——p_optr的关系，详细的解释可以看《情景分析》 P343。

static void forget_original_parent(struct task_struct *father)
{
	struct task_struct *p, *n, *reaper;
	LIST_HEAD(dead_children);

	write_lock_irq(&tasklist_lock);
	/*
	 * Note that exit_ptrace() and find_new_reaper() might
	 * drop tasklist_lock and reacquire it.
	 */
	exit_ptrace(father);
/*
 * Detach all tasks we were using ptrace on. Called with tasklist held
 * for writing, and returns with it held too. But note it can release
 * and reacquire the lock.
 */
	reaper = find_new_reaper(father); //为即将死去的进程的子进程寻找一个父进程。这个函数的代码还是比较简单的。
/*
 * When we die, we re-parent all our children.
 * Try to give them to another thread in our thread
 * group, and if no such member exists, give it to
 * the child reaper process (ie "init") in our pid
 * space.
 */
	list_for_each_entry_safe(p, n, &father->children, sibling) { //逐个处理将死进程的子进程
		struct task_struct *t = p;
		do {
			t->real_parent = reaper;  //将将死进程的子进程的兄弟进程的real_parent指向reaper进程
			if (t->parent == father) {
				BUG_ON(task_ptrace(t));
				t->parent = t->real_parent;
			}
			if (t->pdeath_signal)
				group_send_sig_info(t->pdeath_signal,
						    SEND_SIG_NOINFO, t); //发送SEND_SIG_NOINFO信号，注意task_struct结构中的pdeath_dignal就是当父进程死亡的时候才会被设置，也就是这个时候。
		} while_each_thread(p, t); //逐个处理将死进程的子进程的兄弟进程
		reparent_leader(father, p, &dead_children);//Any that need to be release_task'd are put on the @dead list.见下文详解：
	}
	write_unlock_irq(&tasklist_lock);

	BUG_ON(!list_empty(&father->children));

	list_for_each_entry_safe(p, n, &dead_children, sibling) {
		list_del_init(&p->sibling);  //?????????????????????????????????将p从兄弟队列中摘除，但是兄弟关系是怎么产生的呢？
		release_task(p);//做一些收尾工作，但是并未将task_struct结构删除，因为后者是其新的父进程的任务。
	}
}

在forget_original_parent函数里边，为什么是两个循环来处理其子进程呢？我是因为父进程的子进程不一定在同一个slibing队列中，比如我们前文讲到的，如果是因为杀死了某个

进程A，而将A进程的子进程C的父进程指向了进程B，但是，我们并没有看到B进程的子进程D的slibing队列有什么变化，因此，D的slibing队列应该是没有将C进程链接进去的，因此就出现了这样的情况，即父进程有多个子进程，但是这些某些子进程之间可能是相互独立的，因此需要两层循环来将要撤销的父进程的所有子进程的父进程指向reaper.

来看一下forget_original_parent()中一个重要的函数reparent_leader():

/*
* Any that need to be release_task'd are put on the @dead list.
 */
static void reparent_leader(struct task_struct *father, struct task_struct *p,
				struct list_head *dead)
{
	list_move_tail(&p->sibling, &p->real_parent->children); //将进程p从其现有的兄弟队列中退出来，并将其挂到新的real_parent进程的children队列上。

	if (task_detached(p)) //如果进程已经脱离了，即p->exit_signal == -1，那么就直接返回。
		return;
	/*
	 * If this is a threaded reparent there is no need to
	 * notify anyone anything has happened.
	 */
	if (same_thread_group(p->real_parent, father)) //如果将死进程的子进程的新的父进程和将死进程同数一个线程组，那么就返回。因为不需要杀死这个线程组。
                                                       //有关进程组/线程组/会话的知识请参看《UNIX环境高级编程》相关章节
		return;

	/* We don't want people slaying init.  */
	p->exit_signal = SIGCHLD;

	/* If it has exited notify the new parent about this child's death. */
	if (!task_ptrace(p) &&
	    p->exit_state == EXIT_ZOMBIE && thread_group_empty(p)) { //如果将死进程的子进程没有被跟踪，且其状态是僵死状态并且所在线程组已经是空的了
		do_notify_parent(p, p->exit_signal); //则 Let a parent know about the death of a child. 下文将详述该函数。
		if (task_detached(p)) {
			p->exit_state = EXIT_DEAD;
/*
 *EXIT_DEAD is the state after an appropriate wait system call has been issued and before the task
 *is completely removed from the system. This state is only of importance if multiple threads issue
 *wait calls for the same task.
 *EXIT_DEAD状态和EXIT_ZOMBIE状态的区别可以参看《深入Linux内核框架》
*/
			list_move_tail(&p->sibling, dead); //将进程p从其sibling队列中删除并添加到dead队列中。子进程间的兄弟关系是怎么建立的呢？
		}
	}

	kill_orphaned_pgrp(p, father);  //一个重要的函数，下文详述：
}

来看一下reparent_leader函数中的一个重要的函数do_notify_parent():如果在进程没有被跟踪，并且其状态已经是僵死状态，而且其所在的线程组已经是空的了，那就用这个函数向其父进程发送一个信号，让其知道子进程的生命已经结束，而来料理后事儿：

/*
 * Let a parent know about the death of a child.
 * For a stopped/continued status change, use do_notify_parent_cldstop instead.
 *
 * Returns -1 if our parent ignored us and so we've switched to
 * self-reaping, or else @sig.
 */
int do_notify_parent(struct task_struct *tsk, int sig)
{
	struct siginfo info;
	unsigned long flags;
	struct sighand_struct *psig;
	int ret = sig;

	BUG_ON(sig == -1);

 	/* do_notify_parent_cldstop should have been called instead.  */
 	BUG_ON(task_is_stopped_or_traced(tsk));

	BUG_ON(!task_ptrace(tsk) &&
	       (tsk->group_leader != tsk || !thread_group_empty(tsk)));

	info.si_signo = sig;
	info.si_errno = 0;
	/*
	 * we are under tasklist_lock here so our parent is tied to
	 * us and cannot exit and release its namespace.
	 *
	 * the only it can is to switch its nsproxy with sys_unshare,
	 * bu uncharing pid namespaces is not allowed, so we'll always
	 * see relevant namespace
	 *
	 * write_lock() currently calls preempt_disable() which is the
	 * same as rcu_read_lock(), but according to Oleg, this is not
	 * correct to rely on this
	 */
	rcu_read_lock();
	info.si_pid = task_pid_nr_ns(tsk, tsk->parent->nsproxy->pid_ns);
	info.si_uid = __task_cred(tsk)->uid;
	rcu_read_unlock();

	info.si_utime = cputime_to_clock_t(cputime_add(tsk->utime,
				tsk->signal->utime));
	info.si_stime = cputime_to_clock_t(cputime_add(tsk->stime,
				tsk->signal->stime));

	info.si_status = tsk->exit_code & 0x7f;
	if (tsk->exit_code & 0x80)
		info.si_code = CLD_DUMPED;
	else if (tsk->exit_code & 0x7f)
		info.si_code = CLD_KILLED;
	else {
		info.si_code = CLD_EXITED;
		info.si_status = tsk->exit_code >> 8;
	}

	psig = tsk->parent->sighand;
	spin_lock_irqsave(&psig->siglock, flags);
	if (!task_ptrace(tsk) && sig == SIGCHLD &&
	    (psig->action[SIGCHLD-1].sa.sa_handler == SIG_IGN ||
	     (psig->action[SIGCHLD-1].sa.sa_flags & SA_NOCLDWAIT))) {
		/*
		 * We are exiting and our parent doesn't care.  POSIX.1
		 * defines special semantics for setting SIGCHLD to SIG_IGN
		 * or setting the SA_NOCLDWAIT flag: we should be reaped
		 * automatically and not left for our parent's wait4 call.
		 * Rather than having the parent do it as a magic kind of
		 * signal handler, we just set this to tell do_exit that we
		 * can be cleaned up without becoming a zombie.  Note that
		 * we still call __wake_up_parent in this case, because a
		 * blocked sys_wait4 might now return -ECHILD.
		 *
		 * Whether we send SIGCHLD or not for SA_NOCLDWAIT
		 * is implementation-defined: we do (if you don't want
		 * it, just use SIG_IGN instead).
		 */
		ret = tsk->exit_signal = -1;
		if (psig->action[SIGCHLD-1].sa.sa_handler == SIG_IGN)
			sig = -1;
	}
	if (valid_signal(sig) && sig > 0)
		__group_send_sig_info(sig, &info, tsk->parent);
	__wake_up_parent(tsk, tsk->parent);
	spin_unlock_irqrestore(&psig->siglock, flags);

	return ret;
}

看一下reparent_leader的最后调用的一个函数kill_orphanded_pgrp:

/*
 * Check to see if any process groups have become orphaned as
 * a result of our exiting, and if they have any stopped jobs,
 * send them a SIGHUP and then a SIGCONT. (POSIX 3.2.2.2)
 */
static void
kill_orphaned_pgrp(struct task_struct *tsk, struct task_struct *parent)
{
	struct pid *pgrp = task_pgrp(tsk);
	struct task_struct *ignored_task = tsk;

	if (!parent)
		 /* exit: our father is in a different pgrp than
		  * we are and we were the only connection outside.
		  */
		parent = tsk->real_parent;
	else
		/* reparent: our child is in a different pgrp than
		 * we are, and it was the only connection outside.
		 */
		ignored_task = NULL;

	if (task_pgrp(parent) != pgrp &&  //进程tsk和其父进程不属于同一个组
	    task_session(parent) == task_session(tsk) && //进程tsk和其父进程属于一个会话
	    will_become_orphaned_pgrp(pgrp, ignored_task) && //进程组将会成为孤儿******************I ask you, have you ever kown what it is to be an orphan?******************************
	    has_stopped_jobs(pgrp)) { //是否有被停止的job，被停止的原因可能是因为debugger，可以参看《深入Linux内核框架》
		__kill_pgrp_info(SIGHUP, SEND_SIG_PRIV, pgrp); //向进程组发送SIGHUP信号，干什么用呢？
		__kill_pgrp_info(SIGCONT, SEND_SIG_PRIV, pgrp);//向进程组发送SIGCONT信号，干什么用呢？
	}
}

那么怎么判断进程组将变成孤儿呢？在kill_orphanded_pgrp中will_become_orphanded_pgrp完成了这项工作：

/*
 * Determine if a process group is "orphaned", according to the POSIX
 * definition in 2.2.2.52.  Orphaned process groups are not to be affected
 * by terminal-generated stop signals.  Newly orphaned process groups are
 * to receive a SIGHUP and a SIGCONT.
 *
 * "I ask you, have you ever known what it is to be an orphan?"
 */
static int will_become_orphaned_pgrp(struct pid *pgrp, struct task_struct *ignored_task)
{
	struct task_struct *p;

	do_each_pid_task(pgrp, PIDTYPE_PGID, p) { //循环查询线程组中的每一个线程
		if ((p == ignored_task) ||  //如果p是pgrp中的一员？？
		    (p->exit_state && thread_group_empty(p)) || //如果pgrp中的p进程正处于退出状态而且其所在的线程组是空的了
		    is_global_init(p->real_parent)) //或者pgrp中p进程的父进程是init进程，说明在该线程组中已经没有其他线程了（即list_empty(&p->thread_group) == 1;）。
			continue;

		if (task_pgrp(p->real_parent) != pgrp && //如果p的父进程和p不再同一个组中
		    task_session(p->real_parent) == task_session(p)) //但是p的父进程和p进程功属于一个会话
			return 0; //返回0，不会变成孤儿
	} while_each_pid_task(pgrp, PIDTYPE_PGID, p);

	return 1; //返回1，会变成孤儿。
}

现在，我们先来总结一下有关孤儿进程的东西，详细的解释可以看《情景分析》：

进程的“生父(p_opptr)”进程和“养父(p_pptr)”进程通常是一致的，但是如果进程被跟踪时，p_pptr就会指向跟踪进程，而p_opptr的指向不变。当一个进程在其子进程之前去世时，就要把他的子进程托付给某个进程。如果当前进程是一个线程，那就托付给同一线程组的下一个线程，是子进程的p_opptr指向这个线程。否则就只好托付给init进程了。如果当前进程和生父进程属于不同的session，不同的组，同时又是其所在组与其父进程之间的唯一纽带，那么一旦当前进程不存在了，这整个组就会变成孤儿。