From: Matthew Dillon <dillon@apollo.backplane.com>
Date: Fri, 25 Oct 2013 01:51:24 +0000 (-0700)
Subject: kernel - proc_token removal pass stage 1/2
X-Git-Tag: v3.7.0~69
X-Git-Url: https://gitweb.dragonflybsd.org/dragonfly.git/commitdiff_plain/a8d3ab5322237ab812bfdf95c32e45fff302f339

kernel - proc_token removal pass stage 1/2

* Remove proc_token use from all subsystems except kern/kern_proc.c.

* The token had become mostly useless in these subsystems now that process
  locking is more fine-grained.  Do the final wipe of proc_token except for
  allproc/zombproc list use in kern_proc.c
---

diff --git a/sys/ddb/db_ps.c b/sys/ddb/db_ps.c
index f2021c9473..aaab223b81 100644
--- a/sys/ddb/db_ps.c
+++ b/sys/ddb/db_ps.c
@@ -43,11 +43,10 @@ db_ps(db_expr_t dummy1, boolean_t dummy2, db_expr_t dummy3, char *dummy4)
 	int np;
 	int cpuidx;
 	int nl = 0;
-	volatile struct proc *p, *pp;
-	struct lwp *lp;
 
 	np = nprocs;
 
+#if 0
 	if (allproc.lh_first != NULL)
 		p = allproc.lh_first;
 	else
@@ -97,6 +96,7 @@ db_ps(db_expr_t dummy1, boolean_t dummy2, db_expr_t dummy3, char *dummy4)
 
 		lp = lwp_rb_tree_RB_NEXT(lp);
     	}
+#endif
 
 	/*
 	 * Dump running threads
diff --git a/sys/dev/misc/syscons/syscons.c b/sys/dev/misc/syscons/syscons.c
index afc9bbca79..641929524b 100644
--- a/sys/dev/misc/syscons/syscons.c
+++ b/sys/dev/misc/syscons/syscons.c
@@ -970,14 +970,11 @@ scioctl(struct dev_ioctl_args *ap)
 	mode = (struct vt_mode *)data;
 	DPRINTF(5, ("sc%d: VT_SETMODE ", sc->unit));
 	if (scp->smode.mode == VT_PROCESS) {
-	    lwkt_gettoken(&proc_token);
 	    if (scp->proc == pfindn(scp->pid) && scp->proc != curproc) {
 		DPRINTF(5, ("error EPERM\n"));
-		lwkt_reltoken(&proc_token);
 		lwkt_reltoken(&tty_token);
 		return EPERM;
 	    }
-	    lwkt_reltoken(&proc_token);
 	}
 	syscons_lock();
 	if (mode->mode == VT_AUTO) {
@@ -1000,13 +997,9 @@ scioctl(struct dev_ioctl_args *ap)
 		return EINVAL;
 	    }
 	    DPRINTF(5, ("VT_PROCESS %d, ", curproc->p_pid));
-	    syscons_unlock();
-	    lwkt_gettoken(&proc_token);
-	    syscons_lock();
 	    bcopy(data, &scp->smode, sizeof(struct vt_mode));
 	    scp->proc = curproc;
 	    scp->pid = scp->proc->p_pid;
-	    lwkt_reltoken(&proc_token);
 	    if ((scp == sc->cur_scp) && (sc->unit == sc_console_unit))
 		cons_unavail = TRUE;
 	}
@@ -1139,24 +1132,20 @@ scioctl(struct dev_ioctl_args *ap)
 	    lwkt_reltoken(&tty_token);
 	    return EPERM;
 	}
-	lwkt_gettoken(&proc_token);
 #if defined(__i386__)
 	curthread->td_lwp->lwp_md.md_regs->tf_eflags |= PSL_IOPL;
 #elif defined(__x86_64__)
 	curthread->td_lwp->lwp_md.md_regs->tf_rflags |= PSL_IOPL;
 #endif
-        lwkt_reltoken(&proc_token);
 	lwkt_reltoken(&tty_token);
 	return 0;
 
     case KDDISABIO:     	/* disallow io operations (default) */
-        lwkt_gettoken(&proc_token);
 #if defined(__i386__)
 	curthread->td_lwp->lwp_md.md_regs->tf_eflags &= ~PSL_IOPL;
 #elif defined(__x86_64__)
 	curthread->td_lwp->lwp_md.md_regs->tf_rflags &= ~PSL_IOPL;
 #endif
-        lwkt_reltoken(&proc_token);
         lwkt_reltoken(&tty_token);
 	return 0;
 
@@ -2344,22 +2333,20 @@ sc_switch_scr(sc_softc_t *sc, u_int next_scr)
     /*
      * we are in the middle of the vty switching process...
      *
-     * This may be in the console path, we can only deal with this case
-     * if the proc_token is available non-blocking.
+     * This may be in the console path, be very careful.  pfindn() is
+     * still going to use a spinlock but it no longer uses tokens so
+     * we should be ok.
      */
     if (sc->switch_in_progress &&
 	(cur_scp->smode.mode == VT_PROCESS) &&
-	cur_scp->proc &&
-	lwkt_trytoken(&proc_token)) {
-
+	cur_scp->proc) {
 	if (cur_scp->proc != pfindn(cur_scp->pid)) {
 	    /* 
 	     * The controlling process has died!!.  Do some clean up.
 	     * NOTE:`cur_scp->proc' and `cur_scp->smode.mode' 
 	     * are not reset here yet; they will be cleared later.
 	     */
-	    DPRINTF(5, ("cur_scp controlling process %d died, ",
-	       cur_scp->pid));
+	    DPRINTF(5, ("cur_scp controlling process %d died, ", cur_scp->pid));
 	    if (cur_scp->status & SWITCH_WAIT_REL) {
 		/*
 		 * Force the previous switch to finish, but return now 
@@ -2369,7 +2356,6 @@ sc_switch_scr(sc_softc_t *sc, u_int next_scr)
 		DPRINTF(5, ("reset WAIT_REL, "));
 		finish_vt_rel(cur_scp, TRUE);
 		DPRINTF(5, ("finishing previous switch\n"));
-		lwkt_reltoken(&proc_token);
 		return EINVAL;
 	    } else if (cur_scp->status & SWITCH_WAIT_ACQ) {
 		/* let's assume screen switch has been completed. */
@@ -2410,7 +2396,6 @@ sc_switch_scr(sc_softc_t *sc, u_int next_scr)
 		    DPRINTF(5, ("force reset WAIT_REL, "));
 		    finish_vt_rel(cur_scp, FALSE);
 		    DPRINTF(5, ("act as if VT_FALSE was seen\n"));
-		    lwkt_reltoken(&proc_token);
 		    return EINVAL;
 		}
 	    } else if (cur_scp->status & SWITCH_WAIT_ACQ) {
@@ -2432,7 +2417,6 @@ sc_switch_scr(sc_softc_t *sc, u_int next_scr)
 		}
 	    }
 	}
-	lwkt_reltoken(&proc_token);
     }
 
     /*
@@ -2543,10 +2527,8 @@ static int
 vt_proc_alive(scr_stat *scp)
 {
     lwkt_gettoken(&tty_token);
-    lwkt_gettoken(&proc_token);
     if (scp->proc) {
 	if (scp->proc == pfindn(scp->pid)) {
-	    lwkt_reltoken(&proc_token);
 	    lwkt_reltoken(&tty_token);
 	    return TRUE;
 	}
@@ -2554,7 +2536,6 @@ vt_proc_alive(scr_stat *scp)
 	scp->smode.mode = VT_AUTO;
 	DPRINTF(5, ("vt controlling process %d died\n", scp->pid));
     }
-    lwkt_reltoken(&proc_token);
     lwkt_reltoken(&tty_token);
     return FALSE;
 }
@@ -2562,23 +2543,29 @@ vt_proc_alive(scr_stat *scp)
 static int
 signal_vt_rel(scr_stat *scp)
 {
+    struct proc *p;
+
     lwkt_gettoken(&tty_token);
     if (scp->smode.mode != VT_PROCESS) {
         lwkt_reltoken(&tty_token);
 	return FALSE;
     }
     scp->status |= SWITCH_WAIT_REL;
-    lwkt_gettoken(&proc_token);
-    ksignal(scp->proc, scp->smode.relsig);
-    lwkt_reltoken(&proc_token);
+    p = scp->proc;
+    PHOLD(p);
+    ksignal(p, scp->smode.relsig);
+    PRELE(p);
     DPRINTF(5, ("sending relsig to %d\n", scp->pid));
     lwkt_reltoken(&tty_token);
+
     return TRUE;
 }
 
 static int
 signal_vt_acq(scr_stat *scp)
 {
+    struct proc *p;
+
     lwkt_gettoken(&tty_token);
     if (scp->smode.mode != VT_PROCESS) {
         lwkt_reltoken(&tty_token);
@@ -2587,11 +2574,13 @@ signal_vt_acq(scr_stat *scp)
     if (scp->sc->unit == sc_console_unit)
 	cons_unavail = TRUE;
     scp->status |= SWITCH_WAIT_ACQ;
-    lwkt_gettoken(&proc_token);
-    ksignal(scp->proc, scp->smode.acqsig);
-    lwkt_reltoken(&proc_token);
+    p = scp->proc;
+    PHOLD(p);
+    ksignal(p, scp->smode.acqsig);
+    PRELE(p);
     DPRINTF(5, ("sending acqsig to %d\n", scp->pid));
     lwkt_reltoken(&tty_token);
+
     return TRUE;
 }
 
diff --git a/sys/dev/raid/mfi/mfi.c b/sys/dev/raid/mfi/mfi.c
index e2b0cd05cf..070b3acac1 100644
--- a/sys/dev/raid/mfi/mfi.c
+++ b/sys/dev/raid/mfi/mfi.c
@@ -1657,6 +1657,7 @@ mfi_aen_complete(struct mfi_command *cm)
 	struct mfi_softc *sc;
 	struct mfi_evt_detail *detail;
 	struct mfi_aen *mfi_aen_entry, *tmp;
+	struct proc *p;
 	int seq = 0, aborted = 0;
 
 	sc = cm->cm_sc;
@@ -1683,10 +1684,11 @@ mfi_aen_complete(struct mfi_command *cm)
 		TAILQ_FOREACH_MUTABLE(mfi_aen_entry, &sc->mfi_aen_pids,
 		    aen_link, tmp) {
 			TAILQ_REMOVE(&sc->mfi_aen_pids, mfi_aen_entry,
-			    aen_link);
-			lwkt_gettoken(&proc_token);
-			ksignal(mfi_aen_entry->p, SIGIO);
-			lwkt_reltoken(&proc_token);
+				     aen_link);
+			p = mfi_aen_entry->p;
+			PHOLD(p);
+			ksignal(p, SIGIO);
+			PRELE(p);
 			kfree(mfi_aen_entry, M_MFIBUF);
 		}
 	}
diff --git a/sys/emulation/linux/i386/linux_machdep.c b/sys/emulation/linux/i386/linux_machdep.c
index 78faf3c327..8df21ac0c6 100644
--- a/sys/emulation/linux/i386/linux_machdep.c
+++ b/sys/emulation/linux/i386/linux_machdep.c
@@ -394,6 +394,7 @@ int
 sys_linux_exit_group(struct linux_exit_group_args *args)
 {
 	struct linux_emuldata *em, *e;
+	struct proc *p;
 	int rval;
 
 	rval = args->rval;
@@ -420,10 +421,10 @@ sys_linux_exit_group(struct linux_exit_group_args *args)
 		LIST_INSERT_AFTER(e, em, threads);
 		if ((e->flags & EMUL_DIDKILL) == 0) {
 			e->flags |= EMUL_DIDKILL;
-			lwkt_gettoken(&proc_token);
-			KKASSERT(pfindn(e->proc->p_pid) == e->proc);
-			ksignal(e->proc, SIGKILL);
-			lwkt_reltoken(&proc_token);
+			p = e->proc;
+			PHOLD(p);
+			ksignal(p, SIGKILL);
+			PRELE(p);
 		}
 	}
 
diff --git a/sys/emulation/linux/linux_signal.c b/sys/emulation/linux/linux_signal.c
index 2f97b33eea..71c0cffbaf 100644
--- a/sys/emulation/linux/linux_signal.c
+++ b/sys/emulation/linux/linux_signal.c
@@ -408,7 +408,6 @@ linux_do_tkill(l_int tgid, l_int pid, l_int sig)
 	if (sig > 0 && sig <= LINUX_SIGTBLSZ)
 		sig = linux_to_bsd_signal[_SIG_IDX(sig)];
 
-	lwkt_gettoken(&proc_token);
 	if ((p = pfind(pid)) == NULL) {
 		if ((p = zpfind(pid)) == NULL) {
 			error = ESRCH;
@@ -437,8 +436,6 @@ linux_do_tkill(l_int tgid, l_int pid, l_int sig)
 done1:
 	PRELE(p);
 done2:
-	lwkt_reltoken(&proc_token);
-
 	return (error);
 }
 
diff --git a/sys/kern/init_main.c b/sys/kern/init_main.c
index c5f49ce4ca..7aeae4f355 100644
--- a/sys/kern/init_main.c
+++ b/sys/kern/init_main.c
@@ -371,7 +371,7 @@ proc0_init(void *dummy __unused)
 	/*
 	 * Create process 0 (the swapper).
 	 */
-	LIST_INSERT_HEAD(&allproc, p, p_list);
+	procinsertinit(p);
 	LIST_INSERT_HEAD(PGRPHASH(0), &pgrp0, pg_hash);
 	LIST_INIT(&pgrp0.pg_members);
 	lwkt_token_init(&pgrp0.pg_token, "pgrp0");
diff --git a/sys/kern/kern_descrip.c b/sys/kern/kern_descrip.c
index 831f24418d..5925185885 100644
--- a/sys/kern/kern_descrip.c
+++ b/sys/kern/kern_descrip.c
@@ -684,11 +684,11 @@ funsetown(struct sigio **sigiop)
 	struct sigio *sigio;
 
 	if ((sigio = *sigiop) != NULL) {
-		lwkt_gettoken(&proc_token);	/* protect sigio */
+		lwkt_gettoken(&sigio_token);	/* protect sigio */
 		KKASSERT(sigiop == sigio->sio_myref);
 		sigio = *sigiop;
 		*sigiop = NULL;
-		lwkt_reltoken(&proc_token);
+		lwkt_reltoken(&sigio_token);
 	}
 	if (sigio == NULL)
 		return;
@@ -810,11 +810,11 @@ fsetown(pid_t pgid, struct sigio **sigiop)
 	sigio->sio_ruid = sigio->sio_ucred->cr_ruid;
 	sigio->sio_myref = sigiop;
 
-	lwkt_gettoken(&proc_token);
+	lwkt_gettoken(&sigio_token);
 	while (*sigiop)
 		funsetown(sigiop);
 	*sigiop = sigio;
-	lwkt_reltoken(&proc_token);
+	lwkt_reltoken(&sigio_token);
 	error = 0;
 done:
 	if (pgrp)
@@ -835,10 +835,10 @@ fgetown(struct sigio **sigiop)
 	struct sigio *sigio;
 	pid_t own;
 
-	lwkt_gettoken(&proc_token);
+	lwkt_gettoken_shared(&sigio_token);
 	sigio = *sigiop;
 	own = (sigio != NULL ? sigio->sio_pgid : 0);
-	lwkt_reltoken(&proc_token);
+	lwkt_reltoken(&sigio_token);
 
 	return (own);
 }
diff --git a/sys/kern/kern_event.c b/sys/kern/kern_event.c
index 9fea201e16..f77e394655 100644
--- a/sys/kern/kern_event.c
+++ b/sys/kern/kern_event.c
@@ -267,7 +267,6 @@ filt_procdetach(struct knote *kn)
 
 	if (kn->kn_status & KN_DETACHED)
 		return;
-	/* XXX locking? take proc_token here? */
 	p = kn->kn_ptr.p_proc;
 	knote_remove(&p->p_klist, kn);
 }
diff --git a/sys/kern/kern_proc.c b/sys/kern/kern_proc.c
index ca8e58f95c..d7935628ec 100644
--- a/sys/kern/kern_proc.c
+++ b/sys/kern/kern_proc.c
@@ -85,9 +85,10 @@ static u_long pidhash;
 struct pgrphashhead *pgrphashtbl;
 u_long pgrphash;
 
-struct proclist allproc;
-struct proclist zombproc;
-struct spinlock pghash_spin = SPINLOCK_INITIALIZER(&pghash_spin);
+static struct proclist allproc;
+static struct proclist zombproc;
+static struct spinlock pghash_spin = SPINLOCK_INITIALIZER(&pghash_spin);
+static struct lwkt_token proc_token = LWKT_TOKEN_INITIALIZER(proc_token);
 
 /*
  * Random component to nextpid generation.  We mix in a random factor to make
@@ -147,6 +148,12 @@ procinit(void)
 	uihashinit();
 }
 
+void
+procinsertinit(struct proc *p)
+{
+	LIST_INSERT_HEAD(&allproc, p, p_list);
+}
+
 /*
  * Process hold/release support functions.  These functions must be MPSAFE.
  * Called via the PHOLD(), PRELE(), and PSTALL() macros.
@@ -333,20 +340,29 @@ prelezomb(struct proc *p)
  * Is p an inferior of the current process?
  *
  * No requirements.
- * The caller must hold proc_token if the caller wishes a stable result.
  */
 int
 inferior(struct proc *p)
 {
-	lwkt_gettoken_shared(&proc_token);
+	struct proc *p2;
+
+	PHOLD(p);
+	lwkt_gettoken_shared(&p->p_token);
 	while (p != curproc) {
 		if (p->p_pid == 0) {
-			lwkt_reltoken(&proc_token);
+			lwkt_reltoken(&p->p_token);
 			return (0);
 		}
-		p = p->p_pptr;
+		p2 = p->p_pptr;
+		PHOLD(p2);
+		lwkt_reltoken(&p->p_token);
+		PRELE(p);
+		lwkt_gettoken_shared(&p2->p_token);
+		p = p2;
 	}
-	lwkt_reltoken(&proc_token);
+	lwkt_reltoken(&p->p_token);
+	PRELE(p);
+
 	return (1);
 }
 
@@ -387,7 +403,8 @@ pfind(pid_t pid)
 
 /*
  * Locate a process by number.  The returned process is NOT referenced.
- * The caller should hold proc_token if the caller wishes a stable result.
+ * The result will not be stable and is typically only used to validate
+ * against a process that the caller has in-hand.
  *
  * No requirements.
  */
diff --git a/sys/kern/lwkt_token.c b/sys/kern/lwkt_token.c
index 907061b8b6..4a17614fc2 100644
--- a/sys/kern/lwkt_token.c
+++ b/sys/kern/lwkt_token.c
@@ -133,7 +133,7 @@ struct lwkt_token dev_token = LWKT_TOKEN_INITIALIZER(dev_token);
 struct lwkt_token vm_token = LWKT_TOKEN_INITIALIZER(vm_token);
 struct lwkt_token vmspace_token = LWKT_TOKEN_INITIALIZER(vmspace_token);
 struct lwkt_token kvm_token = LWKT_TOKEN_INITIALIZER(kvm_token);
-struct lwkt_token proc_token = LWKT_TOKEN_INITIALIZER(proc_token);
+struct lwkt_token sigio_token = LWKT_TOKEN_INITIALIZER(sigio_token);
 struct lwkt_token tty_token = LWKT_TOKEN_INITIALIZER(tty_token);
 struct lwkt_token vnode_token = LWKT_TOKEN_INITIALIZER(vnode_token);
 struct lwkt_token ifnet_token = LWKT_TOKEN_INITIALIZER(ifnet_token);
@@ -162,8 +162,8 @@ SYSCTL_LONG(_lwkt, OID_AUTO, vmspace_collisions, CTLFLAG_RW,
     &vmspace_token.t_collisions, 0, "Collision counter of vmspace_token");
 SYSCTL_LONG(_lwkt, OID_AUTO, kvm_collisions, CTLFLAG_RW,
     &kvm_token.t_collisions, 0, "Collision counter of kvm_token");
-SYSCTL_LONG(_lwkt, OID_AUTO, proc_collisions, CTLFLAG_RW,
-    &proc_token.t_collisions, 0, "Collision counter of proc_token");
+SYSCTL_LONG(_lwkt, OID_AUTO, sigio_collisions, CTLFLAG_RW,
+    &sigio_token.t_collisions, 0, "Collision counter of sigio_token");
 SYSCTL_LONG(_lwkt, OID_AUTO, tty_collisions, CTLFLAG_RW,
     &tty_token.t_collisions, 0, "Collision counter of tty_token");
 SYSCTL_LONG(_lwkt, OID_AUTO, vnode_collisions, CTLFLAG_RW,
@@ -948,7 +948,7 @@ DB_SHOW_COMMAND(tokens, db_tok_all)
 		&vm_token,
 		&vmspace_token,
 		&kvm_token,
-		&proc_token,
+		&sigio_token,
 		&tty_token,
 		&vnode_token,
 		NULL
diff --git a/sys/kern/sys_mqueue.c b/sys/kern/sys_mqueue.c
index 89aa990a0f..88c075d8d3 100644
--- a/sys/kern/sys_mqueue.c
+++ b/sys/kern/sys_mqueue.c
@@ -907,19 +907,22 @@ mq_send1(struct lwp *l, mqd_t mqdes, const char *msg_ptr, size_t msg_len,
 	/* Ready for receiving now */
 	KNOTE(&mq->mq_rkq.ki_note, 0);
 error:
-	lockmgr(&mq->mq_mtx, LK_RELEASE);
-	fdrop(fp);
-
 	if (error) {
+		lockmgr(&mq->mq_mtx, LK_RELEASE);
+		fdrop(fp);
 		mqueue_freemsg(msg, size);
 	} else if (notify) {
+		PHOLD(notify);
+		lockmgr(&mq->mq_mtx, LK_RELEASE);
+		fdrop(fp);
 		/* Send the notify, if needed */
-		lwkt_gettoken(&proc_token);
 		/*kpsignal(notify, &ksi, NULL);*/
 		ksignal(notify, mq->mq_sig_notify.sigev_signo);
-		lwkt_reltoken(&proc_token);
+		PRELE(notify);
+	} else {
+		lockmgr(&mq->mq_mtx, LK_RELEASE);
+		fdrop(fp);
 	}
-
 	return error;
 }
 
diff --git a/sys/kern/sys_pipe.c b/sys/kern/sys_pipe.c
index 020e624ed9..33804519ce 100644
--- a/sys/kern/sys_pipe.c
+++ b/sys/kern/sys_pipe.c
@@ -178,9 +178,9 @@ static __inline void
 pipewakeup(struct pipe *cpipe, int dosigio)
 {
 	if (dosigio && (cpipe->pipe_state & PIPE_ASYNC) && cpipe->pipe_sigio) {
-		lwkt_gettoken(&proc_token);
+		lwkt_gettoken(&sigio_token);
 		pgsigio(cpipe->pipe_sigio, SIGIO, 0);
-		lwkt_reltoken(&proc_token);
+		lwkt_reltoken(&sigio_token);
 	}
 	KNOTE(&cpipe->pipe_kq.ki_note, 0);
 }
diff --git a/sys/kern/sys_process.c b/sys/kern/sys_process.c
index 0c0d300295..b0f008992e 100644
--- a/sys/kern/sys_process.c
+++ b/sys/kern/sys_process.c
@@ -284,21 +284,16 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 	int write, tmp;
 	int t;
 
-	lwkt_gettoken(&proc_token);
-
 	write = 0;
 	if (req == PT_TRACE_ME) {
 		p = curp;
 		PHOLD(p);
 	} else {
-		if ((p = pfind(pid)) == NULL) {
-			lwkt_reltoken(&proc_token);
+		if ((p = pfind(pid)) == NULL)
 			return ESRCH;
-		}
 	}
 	if (!PRISON_CHECK(curp->p_ucred, p->p_ucred)) {
 		PRELE(p);
-		lwkt_reltoken(&proc_token);
 		return (ESRCH);
 	}
 
@@ -307,7 +302,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 	if ((p->p_flags & P_INEXEC) != 0) {
 		lwkt_reltoken(&p->p_token);
 		PRELE(p);
-		lwkt_reltoken(&proc_token);
 		return EAGAIN;
 	}
 
@@ -324,7 +318,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 		if (p->p_pid == curp->p_pid) {
 			lwkt_reltoken(&p->p_token);
 			PRELE(p);
-			lwkt_reltoken(&proc_token);
 			return EINVAL;
 		}
 
@@ -332,7 +325,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 		if (p->p_flags & P_TRACED) {
 			lwkt_reltoken(&p->p_token);
 			PRELE(p);
-			lwkt_reltoken(&proc_token);
 			return EBUSY;
 		}
 
@@ -341,7 +333,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 				if (pp == p) {
 					lwkt_reltoken(&p->p_token);
 					PRELE(p);
-					lwkt_reltoken(&proc_token);
 					return (EINVAL);
 				}
 
@@ -351,7 +342,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 			if ((error = priv_check_cred(curp->p_ucred, PRIV_ROOT, 0)) != 0) {
 				lwkt_reltoken(&p->p_token);
 				PRELE(p);
-				lwkt_reltoken(&proc_token);
 				return error;
 			}
 		}
@@ -360,7 +350,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 		if (securelevel > 0 && p->p_pid == 1) {
 			lwkt_reltoken(&p->p_token);
 			PRELE(p);
-			lwkt_reltoken(&proc_token);
 			return EPERM;
 		}
 
@@ -398,7 +387,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 		if ((p->p_flags & P_TRACED) == 0) {
 			lwkt_reltoken(&p->p_token);
 			PRELE(p);
-			lwkt_reltoken(&proc_token);
 			return EPERM;
 		}
 
@@ -406,7 +394,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 		if (p->p_pptr != curp) {
 			lwkt_reltoken(&p->p_token);
 			PRELE(p);
-			lwkt_reltoken(&proc_token);
 			return EBUSY;
 		}
 
@@ -415,7 +402,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 		    (p->p_flags & P_WAITED) == 0) {
 			lwkt_reltoken(&p->p_token);
 			PRELE(p);
-			lwkt_reltoken(&proc_token);
 			return EBUSY;
 		}
 
@@ -425,7 +411,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 	default:
 		lwkt_reltoken(&p->p_token);
 		PRELE(p);
-		lwkt_reltoken(&proc_token);
 		return EINVAL;
 	}
 
@@ -451,7 +436,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 		p->p_oppid = p->p_pptr->p_pid;
 		lwkt_reltoken(&p->p_token);
 		PRELE(p);
-		lwkt_reltoken(&proc_token);
 		return 0;
 
 	case PT_ATTACH:
@@ -469,7 +453,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 		if (data < 0 || data > _SIG_MAXSIG) {
 			lwkt_reltoken(&p->p_token);
 			PRELE(p);
-			lwkt_reltoken(&proc_token);
 			return EINVAL;
 		}
 
@@ -480,7 +463,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 				LWPRELE(lp);
 				lwkt_reltoken(&p->p_token);
 				PRELE(p);
-				lwkt_reltoken(&proc_token);
 				return error;
 			}
 		}
@@ -491,7 +473,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 				LWPRELE(lp);
 				lwkt_reltoken(&p->p_token);
 				PRELE(p);
-				lwkt_reltoken(&proc_token);
 				return error;
 			}
 		}
@@ -530,7 +511,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 		crit_exit();
 		lwkt_reltoken(&p->p_token);
 		PRELE(p);
-		lwkt_reltoken(&proc_token);
 		return 0;
 
 	case PT_WRITE_I:
@@ -575,7 +555,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 			*res = tmp;
 		lwkt_reltoken(&p->p_token);
 		PRELE(p);
-		lwkt_reltoken(&proc_token);
 		return (error);
 
 	case PT_IO:
@@ -606,14 +585,12 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 		default:
 			lwkt_reltoken(&p->p_token);
 			PRELE(p);
-			lwkt_reltoken(&proc_token);
 			return (EINVAL);
 		}
 		error = procfs_domem(curp, lp, NULL, &uio);
 		piod->piod_len -= uio.uio_resid;
 		lwkt_reltoken(&p->p_token);
 		PRELE(p);
-		lwkt_reltoken(&proc_token);
 		return (error);
 
 	case PT_KILL:
@@ -633,7 +610,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 		if (!procfs_validregs(lp)) {	/* no P_SYSTEM procs please */
 			lwkt_reltoken(&p->p_token);
 			PRELE(p);
-			lwkt_reltoken(&proc_token);
 			return EINVAL;
 		} else {
 			iov.iov_base = addr;
@@ -648,7 +624,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 			t = procfs_doregs(curp, lp, NULL, &uio);
 			lwkt_reltoken(&p->p_token);
 			PRELE(p);
-			lwkt_reltoken(&proc_token);
 			return t;
 		}
 #endif /* defined(PT_SETREGS) || defined(PT_GETREGS) */
@@ -666,7 +641,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 		if (!procfs_validfpregs(lp)) {	/* no P_SYSTEM procs please */
 			lwkt_reltoken(&p->p_token);
 			PRELE(p);
-			lwkt_reltoken(&proc_token);
 			return EINVAL;
 		} else {
 			iov.iov_base = addr;
@@ -681,7 +655,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 			t = procfs_dofpregs(curp, lp, NULL, &uio);
 			lwkt_reltoken(&p->p_token);
 			PRELE(p);
-			lwkt_reltoken(&proc_token);
 			return t;
 		}
 #endif /* defined(PT_SETFPREGS) || defined(PT_GETFPREGS) */
@@ -699,7 +672,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 		if (!procfs_validdbregs(lp)) {	/* no P_SYSTEM procs please */
 			lwkt_reltoken(&p->p_token);
 			PRELE(p);
-			lwkt_reltoken(&proc_token);
 			return EINVAL;
 		} else {
 			iov.iov_base = addr;
@@ -714,7 +686,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 			t = procfs_dodbregs(curp, lp, NULL, &uio);
 			lwkt_reltoken(&p->p_token);
 			PRELE(p);
-			lwkt_reltoken(&proc_token);
 			return t;
 		}
 #endif /* defined(PT_SETDBREGS) || defined(PT_GETDBREGS) */
@@ -725,7 +696,6 @@ kern_ptrace(struct proc *curp, int req, pid_t pid, void *addr,
 
 	lwkt_reltoken(&p->p_token);
 	PRELE(p);
-	lwkt_reltoken(&proc_token);
 
 	return 0;
 }
diff --git a/sys/kern/tty.c b/sys/kern/tty.c
index 9eeb207175..786bd2a29e 100644
--- a/sys/kern/tty.c
+++ b/sys/kern/tty.c
@@ -854,7 +854,6 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 
 	KKASSERT(p);
 	lwkt_gettoken(&tty_token);
-	lwkt_gettoken(&proc_token);
 	lwkt_gettoken(&p->p_token);
 
 	/* If the ioctl involves modification, hang if in the background. */
@@ -896,7 +895,6 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 		    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
 			if (p->p_pgrp->pg_jobc == 0) {
 				lwkt_reltoken(&p->p_token);
-				lwkt_reltoken(&proc_token);
 				lwkt_reltoken(&tty_token);
 				return (EIO);
 			}
@@ -905,7 +903,6 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 					 0);
 			if (error) {
 				lwkt_reltoken(&p->p_token);
-				lwkt_reltoken(&proc_token);
 				lwkt_reltoken(&tty_token);
 				return (error);
 			}
@@ -935,7 +932,6 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 		 */
 		if (tp->t_session != NULL && !isctty(p, tp)) {
 			lwkt_reltoken(&p->p_token);
-			lwkt_reltoken(&proc_token);
 			lwkt_reltoken(&tty_token);
 			return (ENOTTY);
 		}
@@ -943,7 +939,6 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 		error = fsetown(*(int *)data, &tp->t_sigio);
 		if (error) {
 			lwkt_reltoken(&p->p_token);
-			lwkt_reltoken(&proc_token);
 			lwkt_reltoken(&tty_token);
 			return (error);
 		}
@@ -951,7 +946,6 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 	case FIOGETOWN:
 		if (tp->t_session != NULL && !isctty(p, tp)) {
 			lwkt_reltoken(&p->p_token);
-			lwkt_reltoken(&proc_token);
 			lwkt_reltoken(&tty_token);
 			return (ENOTTY);
 		}
@@ -978,14 +972,12 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 			if (constty && constty != tp &&
 			    ISSET(constty->t_state, TS_CONNECTED)) {
 				lwkt_reltoken(&p->p_token);
-				lwkt_reltoken(&proc_token);
 				lwkt_reltoken(&tty_token);
 				return (EBUSY);
 			}
 #ifndef	UCONSOLE
 			if ((error = priv_check(td, PRIV_ROOT)) != 0) {
 				lwkt_reltoken(&p->p_token);
-				lwkt_reltoken(&proc_token);
 				lwkt_reltoken(&tty_token);
 				return (error);
 			}
@@ -998,7 +990,6 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 		error = ttywait(tp);
 		if (error) {
 			lwkt_reltoken(&p->p_token);
-			lwkt_reltoken(&proc_token);
 			lwkt_reltoken(&tty_token);
 			return (error);
 		}
@@ -1018,7 +1009,6 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 	case TIOCGPGRP:			/* get pgrp of tty */
 		if (!isctty(p, tp)) {
 			lwkt_reltoken(&p->p_token);
-			lwkt_reltoken(&proc_token);
 			lwkt_reltoken(&tty_token);
 			return (ENOTTY);
 		}
@@ -1027,7 +1017,6 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 	case TIOCGSID:                  /* get sid of tty */
 		if (!isctty(p, tp)) {
 			lwkt_reltoken(&p->p_token);
-			lwkt_reltoken(&proc_token);
 			lwkt_reltoken(&tty_token);
 			return (ENOTTY);
 		}
@@ -1059,7 +1048,6 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 			t->c_ispeed = tp->t_ospeed;
 		if (t->c_ispeed == 0) {
 			lwkt_reltoken(&p->p_token);
-			lwkt_reltoken(&proc_token);
 			lwkt_reltoken(&tty_token);
 			return (EINVAL);
 		}
@@ -1069,7 +1057,6 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 			if (error) {
 				crit_exit();
 				lwkt_reltoken(&p->p_token);
-				lwkt_reltoken(&proc_token);
 				lwkt_reltoken(&tty_token);
 				return (error);
 			}
@@ -1083,7 +1070,6 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 			if (tp->t_param && (error = (*tp->t_param)(tp, t))) {
 				crit_exit();
 				lwkt_reltoken(&p->p_token);
-				lwkt_reltoken(&proc_token);
 				lwkt_reltoken(&tty_token);
 				return (error);
 			}
@@ -1161,7 +1147,6 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 
 		if ((u_int)t >= nlinesw) {
 			lwkt_reltoken(&p->p_token);
-			lwkt_reltoken(&proc_token);
 			lwkt_reltoken(&tty_token);
 			return (ENXIO);
 		}
@@ -1173,7 +1158,6 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 				(void)(*linesw[tp->t_line].l_open)(device, tp);
 				crit_exit();
 				lwkt_reltoken(&p->p_token);
-				lwkt_reltoken(&proc_token);
 				lwkt_reltoken(&tty_token);
 				return (error);
 			}
@@ -1195,13 +1179,11 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 	case TIOCSTI:			/* simulate terminal input */
 		if ((flag & FREAD) == 0 && priv_check(td, PRIV_ROOT)) {
 			lwkt_reltoken(&p->p_token);
-			lwkt_reltoken(&proc_token);
 			lwkt_reltoken(&tty_token);
 			return (EPERM);
 		}
 		if (!isctty(p, tp) && priv_check(td, PRIV_ROOT)) {
 			lwkt_reltoken(&p->p_token);
-			lwkt_reltoken(&proc_token);
 			lwkt_reltoken(&tty_token);
 			return (EACCES);
 		}
@@ -1223,7 +1205,6 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 		    ((p->p_session->s_ttyvp || tp->t_session) &&
 		    (tp->t_session != p->p_session))) {
 			lwkt_reltoken(&p->p_token);
-			lwkt_reltoken(&proc_token);
 			lwkt_reltoken(&tty_token);
 			return (EPERM);
 		}
@@ -1247,13 +1228,11 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 
 		if (!isctty(p, tp)) {
 			lwkt_reltoken(&p->p_token);
-			lwkt_reltoken(&proc_token);
 			lwkt_reltoken(&tty_token);
 			return (ENOTTY);
 		}
 		else if (pgid < 1 || pgid > PID_MAX) {
 			lwkt_reltoken(&p->p_token);
-			lwkt_reltoken(&proc_token);
 			lwkt_reltoken(&tty_token);
 			return (EINVAL);
 		} else {
@@ -1262,7 +1241,6 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 				if (pgrp)
 					pgrel(pgrp);
 				lwkt_reltoken(&p->p_token);
-				lwkt_reltoken(&proc_token);
 				lwkt_reltoken(&tty_token);
 				return (EPERM);
 			}
@@ -1291,7 +1269,6 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 		error = priv_check(td, PRIV_ROOT);
 		if (error) {
 			lwkt_reltoken(&p->p_token);
-			lwkt_reltoken(&proc_token);
 			lwkt_reltoken(&tty_token);
 			return (error);
 		}
@@ -1304,7 +1281,6 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 		break;
 	default:
 		lwkt_reltoken(&p->p_token);
-		lwkt_reltoken(&proc_token);
 		lwkt_reltoken(&tty_token);
 #if defined(COMPAT_43)
 		return (ttcompat(tp, cmd, data, flag));
@@ -1313,7 +1289,6 @@ ttioctl(struct tty *tp, u_long cmd, void *data, int flag)
 #endif
 	}
 	lwkt_reltoken(&p->p_token);
-	lwkt_reltoken(&proc_token);
 	lwkt_reltoken(&tty_token);
 	return (0);
 }
@@ -1783,27 +1758,29 @@ loop:
 	/*
 	 * Hang process if it's in the background.
 	 */
-	lwkt_gettoken(&proc_token);
-	if ((pp = curproc) && isbackground(pp, tp)) {
+	if ((pp = curproc) != NULL)
+		lwkt_gettoken(&pp->p_token);
+	if (pp && isbackground(pp, tp)) {
 		crit_exit();
 		if (SIGISMEMBER(pp->p_sigignore, SIGTTIN) ||
 		    SIGISMEMBER(lp->lwp_sigmask, SIGTTIN) ||
 		    (pp->p_flags & P_PPWAIT) || pp->p_pgrp->pg_jobc == 0) {
-			lwkt_reltoken(&proc_token);
+			lwkt_reltoken(&pp->p_token);
 			lwkt_reltoken(&tty_token);
 			return (EIO);
 		}
 		pgsignal(pp->p_pgrp, SIGTTIN, 1);
 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg2", 0);
 		if (error) {
-			lwkt_reltoken(&proc_token);
+			lwkt_reltoken(&pp->p_token);
 			lwkt_reltoken(&tty_token);
 			return (error);
 		}
-		lwkt_reltoken(&proc_token);
+		lwkt_reltoken(&pp->p_token);
 		goto loop;
 	}
-	lwkt_reltoken(&proc_token);
+	if (pp)
+		lwkt_reltoken(&pp->p_token);
 
 	if (ISSET(tp->t_state, TS_ZOMBIE)) {
 		crit_exit();
@@ -2115,24 +2092,26 @@ loop:
 	/*
 	 * Hang the process if it's in the background.
 	 */
-	lwkt_gettoken(&proc_token);
-	if ((pp = curproc) && isbackground(pp, tp) &&
+	if ((pp = curproc) != NULL)
+		lwkt_gettoken(&pp->p_token);
+	if (pp && isbackground(pp, tp) &&
 	    ISSET(tp->t_lflag, TOSTOP) && !(pp->p_flags & P_PPWAIT) &&
 	    !SIGISMEMBER(pp->p_sigignore, SIGTTOU) &&
 	    !SIGISMEMBER(lp->lwp_sigmask, SIGTTOU)) {
 		if (pp->p_pgrp->pg_jobc == 0) {
 			error = EIO;
-			lwkt_reltoken(&proc_token);
+			lwkt_reltoken(&pp->p_token);
 			goto out;
 		}
 		pgsignal(pp->p_pgrp, SIGTTOU, 1);
-		lwkt_reltoken(&proc_token);
+		lwkt_reltoken(&pp->p_token);
 		error = ttysleep(tp, &lbolt, PCATCH, "ttybg4", 0);
 		if (error)
 			goto out;
 		goto loop;
 	}
-	lwkt_reltoken(&proc_token);
+	if (pp)
+		lwkt_reltoken(&pp->p_token);
 	/*
 	 * Process the user's data in at most OBUFSIZ chunks.  Perform any
 	 * output translation.  Keep track of high water mark, sleep on
@@ -2586,7 +2565,7 @@ ttyinfo(struct tty *tp)
 		return;
 
 	lwkt_gettoken(&tty_token);
-	lwkt_gettoken(&proc_token);
+
 	/*
 	 * We always print the load average, then figure out what else to
 	 * print based on the state of the current process group.
@@ -2617,8 +2596,14 @@ ttyinfo(struct tty *tp)
 	for (p = LIST_FIRST(&pgrp->pg_members);
 	     p != NULL;
 	     p = LIST_NEXT(p, p_pglist)) {
-		if (proc_compare(pick, p))
+		PHOLD(p);
+		if (proc_compare(pick, p)) {
+			if (pick)
+				PRELE(pick);
 			pick = p;
+		} else {
+			PRELE(p);
+		}
 	}
 	if (pick == NULL) {
 		ttyprintf(tp, "empty foreground process group\n");
@@ -2627,8 +2612,9 @@ ttyinfo(struct tty *tp)
 
 	/*
 	 * Pick an interesting LWP (XXX)
+	 *
+	 * pick is held.
 	 */
-	PHOLD(pick);
 	lp = FIRST_LWP_IN_PROC(pick);
 	if (lp == NULL) {
 		PRELE(pick);
@@ -2699,7 +2685,6 @@ done1:
 	pgrel(pgrp);
 done2:
 	tp->t_rocount = 0;	/* so pending input will be retyped if BS */
-	lwkt_reltoken(&proc_token);
 	lwkt_reltoken(&tty_token);
 }
 
@@ -2716,7 +2701,7 @@ done2:
  *	   we pick out just "short-term" sleepers (LWP_SINTR == 0).
  *	4) Further ties are broken by picking the highest pid.
  *
- * NOTE: must be called with proc_token held.
+ * NOTE: must be called with p1 and p2 held.
  */
 #define ISRUN(lp)	((lp)->lwp_stat == LSRUN)
 #define TESTAB(a, b)    ((a)<<1 | (b))
@@ -2730,8 +2715,6 @@ proc_compare(struct proc *p1, struct proc *p2)
 	struct lwp *lp1, *lp2;
 	int res;
 
-	ASSERT_LWKT_TOKEN_HELD(&proc_token);
-
 	if (p1 == NULL)
 		return (1);
 	if (lwkt_trytoken(&p1->p_token) == 0)
diff --git a/sys/kern/tty_tty.c b/sys/kern/tty_tty.c
index aca9919656..c23cb29c03 100644
--- a/sys/kern/tty_tty.c
+++ b/sys/kern/tty_tty.c
@@ -232,10 +232,8 @@ cttyioctl(struct dev_ioctl_args *ap)
 
 	KKASSERT(p);
 	lwkt_gettoken(&p->p_token);
-	lwkt_gettoken(&proc_token);
 	ttyvp = cttyvp(p);
 	if (ttyvp == NULL) {
-		lwkt_reltoken(&proc_token);
 		lwkt_reltoken(&p->p_token);
 		return (EIO);
 	}
@@ -244,23 +242,19 @@ cttyioctl(struct dev_ioctl_args *ap)
 	 * (infinite recursion).
 	 */
 	if (ap->a_cmd == TIOCSCTTY) {
-		lwkt_reltoken(&proc_token);
 		lwkt_reltoken(&p->p_token);
 		return EINVAL;
 	}
 	if (ap->a_cmd == TIOCNOTTY) {
 		if (!SESS_LEADER(p)) {
 			p->p_flags &= ~P_CONTROLT;
-			lwkt_reltoken(&proc_token);
 			lwkt_reltoken(&p->p_token);
 			return (0);
 		} else {
-			lwkt_reltoken(&proc_token);
 			lwkt_reltoken(&p->p_token);
 			return (EINVAL);
 		}
 	}
-	lwkt_reltoken(&proc_token);
 	lwkt_reltoken(&p->p_token);
 
 	return (VOP_IOCTL(ttyvp, ap->a_cmd, ap->a_data, ap->a_fflag,
diff --git a/sys/net/sl/if_sl.c b/sys/net/sl/if_sl.c
index e672993f81..f082cad46b 100644
--- a/sys/net/sl/if_sl.c
+++ b/sys/net/sl/if_sl.c
@@ -1028,20 +1028,25 @@ static void
 sl_keepalive(void *chan)
 {
 	struct sl_softc *sc = chan;
+	struct pgrp *pg;
 
 	lwkt_gettoken(&tty_token);
-	lwkt_gettoken(&proc_token);
 	if (sc->sc_keepalive) {
-		if (sc->sc_flags & SC_KEEPALIVE)
-			pgsignal (sc->sc_ttyp->t_pgrp, SIGURG, 1);
-		else
+		if (sc->sc_flags & SC_KEEPALIVE) {
+			pg = sc->sc_ttyp->t_pgrp;
+			if (pg) {
+				pgref(pg);
+				pgsignal (pg, SIGURG, 1);
+				pgrel(pg);
+			}
+		} else {
 			sc->sc_flags |= SC_KEEPALIVE;
+		}
 		callout_reset(&sc->sc_katimeout, sc->sc_keepalive,
 				sl_keepalive, sc);
 	} else {
 		sc->sc_flags &= ~SC_KEEPALIVE;
 	}
-	lwkt_reltoken(&proc_token);
 	lwkt_reltoken(&tty_token);
 }
 
diff --git a/sys/sys/proc.h b/sys/sys/proc.h
index f5b1a437ec..f25b87d55e 100644
--- a/sys/sys/proc.h
+++ b/sys/sys/proc.h
@@ -503,8 +503,6 @@ extern int nprocs, maxproc;		/* Current and max number of procs. */
 extern int maxprocperuid;		/* Max procs per uid. */
 extern int sched_quantum;		/* Scheduling quantum in ticks */
 
-extern struct proclist allproc;		/* List of all processes. */
-extern struct proclist zombproc;	/* List of zombie processes. */
 extern struct proc *initproc;		/* Process slot for init */
 extern struct thread *pagethread, *updatethread;
 
@@ -543,6 +541,7 @@ int	leavepgrp (struct proc *p);
 void	sess_hold(struct session *sp);
 void	sess_rele(struct session *sp);
 void	procinit (void);
+void	procinsertinit(struct proc *p);
 void	relscurproc(struct proc *curp);
 int	p_trespass (struct ucred *cr1, struct ucred *cr2);
 void	setrunnable (struct lwp *);
diff --git a/sys/sys/thread.h b/sys/sys/thread.h
index d6e18f0cfc..2cae0a73ec 100644
--- a/sys/sys/thread.h
+++ b/sys/sys/thread.h
@@ -424,7 +424,7 @@ extern struct lwkt_token dev_token;
 extern struct lwkt_token vm_token;
 extern struct lwkt_token vmspace_token;
 extern struct lwkt_token kvm_token;
-extern struct lwkt_token proc_token;
+extern struct lwkt_token sigio_token;
 extern struct lwkt_token tty_token;
 extern struct lwkt_token vnode_token;
 extern struct lwkt_token ifnet_token;
diff --git a/sys/vfs/procfs/procfs_ctl.c b/sys/vfs/procfs/procfs_ctl.c
index d7eb33765a..588b05d59d 100644
--- a/sys/vfs/procfs/procfs_ctl.c
+++ b/sys/vfs/procfs/procfs_ctl.c
@@ -112,7 +112,6 @@ procfs_control(struct proc *curp, struct lwp *lp, int op)
 	int error;
 
 	ASSERT_LWKT_TOKEN_HELD(&p->p_token);
-	ASSERT_LWKT_TOKEN_HELD(&proc_token);
 
 	/* Can't trace a process that's currently exec'ing. */ 
 	if ((p->p_flags & P_INEXEC) != 0)
@@ -297,7 +296,6 @@ procfs_doctl(struct proc *curp, struct lwp *lp, struct pfsnode *pfs,
 	vfs_namemap_t *nm;
 
 	ASSERT_LWKT_TOKEN_HELD(&p->p_token);
-	ASSERT_LWKT_TOKEN_HELD(&proc_token);
 
 	if (uio->uio_rw != UIO_WRITE)
 		return (EOPNOTSUPP);
diff --git a/sys/vfs/procfs/procfs_subr.c b/sys/vfs/procfs/procfs_subr.c
index c4b3c43e0c..60f4b29d92 100644
--- a/sys/vfs/procfs/procfs_subr.c
+++ b/sys/vfs/procfs/procfs_subr.c
@@ -344,7 +344,6 @@ procfs_rw(struct vop_read_args *ap)
 	if ((curp = curtd->td_proc) == NULL)	/* XXX */
 		return (EINVAL);
 
-	lwkt_gettoken(&proc_token);
 	p = pfs_pfind(pfs->pfs_pid);
 	if (p == NULL) {
 		rtval = EINVAL;
@@ -420,7 +419,6 @@ procfs_rw(struct vop_read_args *ap)
 
 out:
 	pfs_pdone(p);
-	lwkt_reltoken(&proc_token);
 
 	return rtval;
 }
diff --git a/sys/vm/vm_glue.c b/sys/vm/vm_glue.c
index 9ba3553ccd..4ff06ea95a 100644
--- a/sys/vm/vm_glue.c
+++ b/sys/vm/vm_glue.c
@@ -381,18 +381,15 @@ loop:
 	 * XXX we need a heuristic to get a measure of system stress and
 	 * then adjust our stagger wakeup delay accordingly.
 	 */
-	lwkt_gettoken(&proc_token);
+	lwkt_gettoken(&p->p_token);
 	faultin(p);
 	p->p_swtime = 0;
+	lwkt_reltoken(&p->p_token);
 	PRELE(p);
-	lwkt_reltoken(&proc_token);
 	tsleep(&proc0, 0, "swapin", hz / 10);
 	goto loop;
 }
 
-/*
- * The caller must hold proc_token.
- */
 static int
 scheduler_callback(struct proc *p, void *data)
 {
@@ -498,9 +495,6 @@ swapout_procs(int action)
 	allproc_scan(swapout_procs_callback, &action);
 }
 
-/*
- * The caller must hold proc_token
- */
 static int
 swapout_procs_callback(struct proc *p, void *data)
 {
@@ -573,7 +567,7 @@ swapout_procs_callback(struct proc *p, void *data)
 }
 
 /*
- * The caller must hold proc_token and p->p_token
+ * The caller must hold p->p_token
  */
 static void
 swapout(struct proc *p)
diff --git a/sys/vm/vm_meter.c b/sys/vm/vm_meter.c
index bd5fd17b21..9fa9e26cf8 100644
--- a/sys/vm/vm_meter.c
+++ b/sys/vm/vm_meter.c
@@ -131,9 +131,6 @@ do_vmtotal(SYSCTL_HANDLER_ARGS)
 	return (sysctl_handle_opaque(oidp, &total, sizeof(total), req));
 }
 
-/*
- * The caller must hold proc_token.
- */
 static int
 do_vmtotal_callback(struct proc *p, void *data)
 {
@@ -143,6 +140,8 @@ do_vmtotal_callback(struct proc *p, void *data)
 	if (p->p_flags & P_SYSTEM)
 		return(0);
 
+	lwkt_gettoken(&p->p_token);
+
 	FOREACH_LWP_IN_PROC(lp, p) {
 		switch (lp->lwp_stat) {
 		case LSSTOP:
@@ -156,7 +155,7 @@ do_vmtotal_callback(struct proc *p, void *data)
 				totalp->t_sw++;
 			}
 			if (lp->lwp_slptime >= maxslp)
-				return(0);
+				goto out;
 			break;
 
 		case LSRUN:
@@ -165,11 +164,11 @@ do_vmtotal_callback(struct proc *p, void *data)
 			else
 				totalp->t_rq++;
 			if (p->p_stat == SIDL)
-				return(0);
+				goto out;
 			break;
 
 		default:
-			return (0);
+			goto out;
 		}
 
 		/*
@@ -178,6 +177,8 @@ do_vmtotal_callback(struct proc *p, void *data)
 		if (lp->lwp_flags & LWP_PAGING)
 			totalp->t_pw++;
 	}
+out:
+	lwkt_reltoken(&p->p_token);
 	return(0);
 }
 
diff --git a/sys/vm/vm_pageout.c b/sys/vm/vm_pageout.c
index fcfd763435..7fabf132dd 100644
--- a/sys/vm/vm_pageout.c
+++ b/sys/vm/vm_pageout.c
@@ -1517,9 +1517,6 @@ vm_pageout_scan_cache(int avail_shortage, int vnodes_skipped, int recycle_count)
 	}
 }
 
-/*
- * The caller must hold proc_token.
- */
 static int
 vm_pageout_scan_callback(struct proc *p, void *data)
 {
@@ -1535,12 +1532,16 @@ vm_pageout_scan_callback(struct proc *p, void *data)
 		return (0);
 	}
 
+	lwkt_gettoken(&p->p_token);
+
 	/*
 	 * if the process is in a non-running type state,
 	 * don't touch it.
 	 */
-	if (p->p_stat != SACTIVE && p->p_stat != SSTOP)
+	if (p->p_stat != SACTIVE && p->p_stat != SSTOP) {
+		lwkt_reltoken(&p->p_token);
 		return (0);
+	}
 
 	/*
 	 * Get the approximate process size.  Note that anonymous pages
@@ -1562,7 +1563,9 @@ vm_pageout_scan_callback(struct proc *p, void *data)
 		info->bigproc = p;
 		info->bigsize = size;
 	}
+	lwkt_reltoken(&p->p_token);
 	lwkt_yield();
+
 	return(0);
 }
 
@@ -2103,9 +2106,6 @@ vm_daemon(void)
 	}
 }
 
-/*
- * Caller must hold proc_token.
- */
 static int
 vm_daemon_callback(struct proc *p, void *data __unused)
 {
@@ -2116,15 +2116,21 @@ vm_daemon_callback(struct proc *p, void *data __unused)
 	 * if this is a system process or if we have already
 	 * looked at this process, skip it.
 	 */
-	if (p->p_flags & (P_SYSTEM | P_WEXIT))
+	lwkt_gettoken(&p->p_token);
+
+	if (p->p_flags & (P_SYSTEM | P_WEXIT)) {
+		lwkt_reltoken(&p->p_token);
 		return (0);
+	}
 
 	/*
 	 * if the process is in a non-running type state,
 	 * don't touch it.
 	 */
-	if (p->p_stat != SACTIVE && p->p_stat != SSTOP)
+	if (p->p_stat != SACTIVE && p->p_stat != SSTOP) {
+		lwkt_reltoken(&p->p_token);
 		return (0);
+	}
 
 	/*
 	 * get a limit
@@ -2147,6 +2153,9 @@ vm_daemon_callback(struct proc *p, void *data __unused)
 		vm_pageout_map_deactivate_pages(&vm->vm_map, limit);
 	}
 	vmspace_drop(vm);
+
+	lwkt_reltoken(&p->p_token);
+
 	return (0);
 }
 
diff --git a/sys/vm/vm_vmspace.c b/sys/vm/vm_vmspace.c
index bc80f2e5f5..5e97e238be 100644
--- a/sys/vm/vm_vmspace.c
+++ b/sys/vm/vm_vmspace.c
@@ -94,7 +94,7 @@ sys_vmspace_create(struct vmspace_create_args *uap)
 	 */
 	if ((vkp = p->p_vkernel) == NULL) {
 		vkp = kmalloc(sizeof(*vkp), M_VKERNEL, M_WAITOK|M_ZERO);
-		lwkt_gettoken(&proc_token);
+		lwkt_gettoken(&p->p_token);
 		if (p->p_vkernel == NULL) {
 			vkp->refs = 1;
 			lwkt_token_init(&vkp->token, "vkernel");
@@ -104,7 +104,7 @@ sys_vmspace_create(struct vmspace_create_args *uap)
 			kfree(vkp, M_VKERNEL);
 			vkp = p->p_vkernel;
 		}
-		lwkt_reltoken(&proc_token);
+		lwkt_reltoken(&p->p_token);
 	}
 
 	if (curthread->td_vmm)