Home | History | Annotate | Line # | Download | only in kern
kern_exec.c revision 1.263
      1 /*	$NetBSD: kern_exec.c,v 1.263 2007/12/31 15:32:10 ad Exp $	*/
      2 
      3 /*-
      4  * Copyright (C) 1993, 1994, 1996 Christopher G. Demetriou
      5  * Copyright (C) 1992 Wolfgang Solfrank.
      6  * Copyright (C) 1992 TooLs GmbH.
      7  * All rights reserved.
      8  *
      9  * Redistribution and use in source and binary forms, with or without
     10  * modification, are permitted provided that the following conditions
     11  * are met:
     12  * 1. Redistributions of source code must retain the above copyright
     13  *    notice, this list of conditions and the following disclaimer.
     14  * 2. Redistributions in binary form must reproduce the above copyright
     15  *    notice, this list of conditions and the following disclaimer in the
     16  *    documentation and/or other materials provided with the distribution.
     17  * 3. All advertising materials mentioning features or use of this software
     18  *    must display the following acknowledgement:
     19  *	This product includes software developed by TooLs GmbH.
     20  * 4. The name of TooLs GmbH may not be used to endorse or promote products
     21  *    derived from this software without specific prior written permission.
     22  *
     23  * THIS SOFTWARE IS PROVIDED BY TOOLS GMBH ``AS IS'' AND ANY EXPRESS OR
     24  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     25  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     26  * IN NO EVENT SHALL TOOLS GMBH BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
     27  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
     28  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
     29  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
     30  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
     31  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
     32  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     33  */
     34 
     35 #include <sys/cdefs.h>
     36 __KERNEL_RCSID(0, "$NetBSD: kern_exec.c,v 1.263 2007/12/31 15:32:10 ad Exp $");
     37 
     38 #include "opt_ktrace.h"
     39 #include "opt_syscall_debug.h"
     40 #include "opt_compat_netbsd.h"
     41 #include "veriexec.h"
     42 #include "opt_pax.h"
     43 
     44 #include <sys/param.h>
     45 #include <sys/systm.h>
     46 #include <sys/filedesc.h>
     47 #include <sys/kernel.h>
     48 #include <sys/proc.h>
     49 #include <sys/mount.h>
     50 #include <sys/malloc.h>
     51 #include <sys/namei.h>
     52 #include <sys/vnode.h>
     53 #include <sys/file.h>
     54 #include <sys/acct.h>
     55 #include <sys/exec.h>
     56 #include <sys/ktrace.h>
     57 #include <sys/resourcevar.h>
     58 #include <sys/wait.h>
     59 #include <sys/mman.h>
     60 #include <sys/ras.h>
     61 #include <sys/signalvar.h>
     62 #include <sys/stat.h>
     63 #include <sys/syscall.h>
     64 #include <sys/kauth.h>
     65 #include <sys/lwpctl.h>
     66 #include <sys/pax.h>
     67 #include <sys/cpu.h>
     68 
     69 #include <sys/syscallargs.h>
     70 #if NVERIEXEC > 0
     71 #include <sys/verified_exec.h>
     72 #endif /* NVERIEXEC > 0 */
     73 
     74 #include <uvm/uvm_extern.h>
     75 
     76 #include <machine/reg.h>
     77 
     78 #include <compat/common/compat_util.h>
     79 
     80 static int exec_sigcode_map(struct proc *, const struct emul *);
     81 
     82 #ifdef DEBUG_EXEC
     83 #define DPRINTF(a) uprintf a
     84 #else
     85 #define DPRINTF(a)
     86 #endif /* DEBUG_EXEC */
     87 
     88 MALLOC_DEFINE(M_EXEC, "exec", "argument lists & other mem used by exec");
     89 
     90 /*
     91  * Exec function switch:
     92  *
     93  * Note that each makecmds function is responsible for loading the
     94  * exec package with the necessary functions for any exec-type-specific
     95  * handling.
     96  *
     97  * Functions for specific exec types should be defined in their own
     98  * header file.
     99  */
    100 extern const struct execsw	execsw_builtin[];
    101 extern int			nexecs_builtin;
    102 static const struct execsw	**execsw = NULL;
    103 static int			nexecs;
    104 
    105 u_int	exec_maxhdrsz;		/* must not be static - netbsd32 needs it */
    106 
    107 #ifdef LKM
    108 /* list of supported emulations */
    109 static
    110 LIST_HEAD(emlist_head, emul_entry) el_head = LIST_HEAD_INITIALIZER(el_head);
    111 struct emul_entry {
    112 	LIST_ENTRY(emul_entry)	el_list;
    113 	const struct emul	*el_emul;
    114 	int			ro_entry;
    115 };
    116 
    117 /* list of dynamically loaded execsw entries */
    118 static
    119 LIST_HEAD(execlist_head, exec_entry) ex_head = LIST_HEAD_INITIALIZER(ex_head);
    120 struct exec_entry {
    121 	LIST_ENTRY(exec_entry)	ex_list;
    122 	const struct execsw	*es;
    123 };
    124 
    125 /* structure used for building execw[] */
    126 struct execsw_entry {
    127 	struct execsw_entry	*next;
    128 	const struct execsw	*es;
    129 };
    130 #endif /* LKM */
    131 
    132 #ifdef SYSCALL_DEBUG
    133 extern const char * const syscallnames[];
    134 #endif
    135 
    136 #ifdef COMPAT_16
    137 extern char	sigcode[], esigcode[];
    138 struct uvm_object *emul_netbsd_object;
    139 #endif
    140 
    141 #ifndef __HAVE_SYSCALL_INTERN
    142 void	syscall(void);
    143 #endif
    144 
    145 /* NetBSD emul struct */
    146 const struct emul emul_netbsd = {
    147 	"netbsd",
    148 	NULL,		/* emulation path */
    149 #ifndef __HAVE_MINIMAL_EMUL
    150 	EMUL_HAS_SYS___syscall,
    151 	NULL,
    152 	SYS_syscall,
    153 	SYS_NSYSENT,
    154 #endif
    155 	sysent,
    156 #ifdef SYSCALL_DEBUG
    157 	syscallnames,
    158 #else
    159 	NULL,
    160 #endif
    161 	sendsig,
    162 	trapsignal,
    163 	NULL,
    164 #ifdef COMPAT_16
    165 	sigcode,
    166 	esigcode,
    167 	&emul_netbsd_object,
    168 #else
    169 	NULL,
    170 	NULL,
    171 	NULL,
    172 #endif
    173 	setregs,
    174 	NULL,
    175 	NULL,
    176 	NULL,
    177 	NULL,
    178 	NULL,
    179 #ifdef __HAVE_SYSCALL_INTERN
    180 	syscall_intern,
    181 #else
    182 	syscall,
    183 #endif
    184 	NULL,
    185 	NULL,
    186 
    187 	uvm_default_mapaddr,
    188 	NULL,
    189 	sizeof(ucontext_t),
    190 	startlwp,
    191 };
    192 
    193 #ifdef LKM
    194 /*
    195  * Exec lock. Used to control access to execsw[] structures.
    196  * This must not be static so that netbsd32 can access it, too.
    197  */
    198 krwlock_t exec_lock;
    199 
    200 static void link_es(struct execsw_entry **, const struct execsw *);
    201 #endif /* LKM */
    202 
    203 static kmutex_t sigobject_lock;
    204 
    205 /*
    206  * check exec:
    207  * given an "executable" described in the exec package's namei info,
    208  * see what we can do with it.
    209  *
    210  * ON ENTRY:
    211  *	exec package with appropriate namei info
    212  *	lwp pointer of exec'ing lwp
    213  *	NO SELF-LOCKED VNODES
    214  *
    215  * ON EXIT:
    216  *	error:	nothing held, etc.  exec header still allocated.
    217  *	ok:	filled exec package, executable's vnode (unlocked).
    218  *
    219  * EXEC SWITCH ENTRY:
    220  * 	Locked vnode to check, exec package, proc.
    221  *
    222  * EXEC SWITCH EXIT:
    223  *	ok:	return 0, filled exec package, executable's vnode (unlocked).
    224  *	error:	destructive:
    225  *			everything deallocated execept exec header.
    226  *		non-destructive:
    227  *			error code, executable's vnode (unlocked),
    228  *			exec header unmodified.
    229  */
    230 int
    231 /*ARGSUSED*/
    232 check_exec(struct lwp *l, struct exec_package *epp)
    233 {
    234 	int		error, i;
    235 	struct vnode	*vp;
    236 	struct nameidata *ndp;
    237 	size_t		resid;
    238 
    239 	ndp = epp->ep_ndp;
    240 	ndp->ni_cnd.cn_nameiop = LOOKUP;
    241 	ndp->ni_cnd.cn_flags = FOLLOW | LOCKLEAF | SAVENAME | TRYEMULROOT;
    242 	/* first get the vnode */
    243 	if ((error = namei(ndp)) != 0)
    244 		return error;
    245 	epp->ep_vp = vp = ndp->ni_vp;
    246 
    247 	/* check access and type */
    248 	if (vp->v_type != VREG) {
    249 		error = EACCES;
    250 		goto bad1;
    251 	}
    252 	if ((error = VOP_ACCESS(vp, VEXEC, l->l_cred)) != 0)
    253 		goto bad1;
    254 
    255 	/* get attributes */
    256 	if ((error = VOP_GETATTR(vp, epp->ep_vap, l->l_cred)) != 0)
    257 		goto bad1;
    258 
    259 	/* Check mount point */
    260 	if (vp->v_mount->mnt_flag & MNT_NOEXEC) {
    261 		error = EACCES;
    262 		goto bad1;
    263 	}
    264 	if (vp->v_mount->mnt_flag & MNT_NOSUID)
    265 		epp->ep_vap->va_mode &= ~(S_ISUID | S_ISGID);
    266 
    267 	/* try to open it */
    268 	if ((error = VOP_OPEN(vp, FREAD, l->l_cred)) != 0)
    269 		goto bad1;
    270 
    271 	/* unlock vp, since we need it unlocked from here on out. */
    272 	VOP_UNLOCK(vp, 0);
    273 
    274 #if NVERIEXEC > 0
    275 	error = veriexec_verify(l, vp, ndp->ni_cnd.cn_pnbuf,
    276 	    epp->ep_flags & EXEC_INDIR ? VERIEXEC_INDIRECT : VERIEXEC_DIRECT,
    277 	    NULL);
    278 	if (error)
    279 		goto bad2;
    280 #endif /* NVERIEXEC > 0 */
    281 
    282 #ifdef PAX_SEGVGUARD
    283 	error = pax_segvguard(l, vp, ndp->ni_cnd.cn_pnbuf, false);
    284 	if (error)
    285 		goto bad2;
    286 #endif /* PAX_SEGVGUARD */
    287 
    288 	/* now we have the file, get the exec header */
    289 	error = vn_rdwr(UIO_READ, vp, epp->ep_hdr, epp->ep_hdrlen, 0,
    290 			UIO_SYSSPACE, 0, l->l_cred, &resid, NULL);
    291 	if (error)
    292 		goto bad2;
    293 	epp->ep_hdrvalid = epp->ep_hdrlen - resid;
    294 
    295 	/*
    296 	 * Set up default address space limits.  Can be overridden
    297 	 * by individual exec packages.
    298 	 *
    299 	 * XXX probably should be all done in the exec packages.
    300 	 */
    301 	epp->ep_vm_minaddr = VM_MIN_ADDRESS;
    302 	epp->ep_vm_maxaddr = VM_MAXUSER_ADDRESS;
    303 	/*
    304 	 * set up the vmcmds for creation of the process
    305 	 * address space
    306 	 */
    307 	error = ENOEXEC;
    308 	for (i = 0; i < nexecs; i++) {
    309 		int newerror;
    310 
    311 		epp->ep_esch = execsw[i];
    312 		newerror = (*execsw[i]->es_makecmds)(l, epp);
    313 
    314 		if (!newerror) {
    315 			/* Seems ok: check that entry point is sane */
    316 			if (epp->ep_entry > VM_MAXUSER_ADDRESS) {
    317 				error = ENOEXEC;
    318 				break;
    319 			}
    320 
    321 			/* check limits */
    322 			if ((epp->ep_tsize > MAXTSIZ) ||
    323 			    (epp->ep_dsize > (u_quad_t)l->l_proc->p_rlimit
    324 						    [RLIMIT_DATA].rlim_cur)) {
    325 				error = ENOMEM;
    326 				break;
    327 			}
    328 			return 0;
    329 		}
    330 
    331 		if (epp->ep_emul_root != NULL) {
    332 			vrele(epp->ep_emul_root);
    333 			epp->ep_emul_root = NULL;
    334 		}
    335 		if (epp->ep_interp != NULL) {
    336 			vrele(epp->ep_interp);
    337 			epp->ep_interp = NULL;
    338 		}
    339 
    340 		/* make sure the first "interesting" error code is saved. */
    341 		if (error == ENOEXEC)
    342 			error = newerror;
    343 
    344 		if (epp->ep_flags & EXEC_DESTR)
    345 			/* Error from "#!" code, tidied up by recursive call */
    346 			return error;
    347 	}
    348 
    349 	/* not found, error */
    350 
    351 	/*
    352 	 * free any vmspace-creation commands,
    353 	 * and release their references
    354 	 */
    355 	kill_vmcmds(&epp->ep_vmcmds);
    356 
    357 bad2:
    358 	/*
    359 	 * close and release the vnode, restore the old one, free the
    360 	 * pathname buf, and punt.
    361 	 */
    362 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
    363 	VOP_CLOSE(vp, FREAD, l->l_cred);
    364 	vput(vp);
    365 	PNBUF_PUT(ndp->ni_cnd.cn_pnbuf);
    366 	return error;
    367 
    368 bad1:
    369 	/*
    370 	 * free the namei pathname buffer, and put the vnode
    371 	 * (which we don't yet have open).
    372 	 */
    373 	vput(vp);				/* was still locked */
    374 	PNBUF_PUT(ndp->ni_cnd.cn_pnbuf);
    375 	return error;
    376 }
    377 
    378 #ifdef __MACHINE_STACK_GROWS_UP
    379 #define STACK_PTHREADSPACE NBPG
    380 #else
    381 #define STACK_PTHREADSPACE 0
    382 #endif
    383 
    384 static int
    385 execve_fetch_element(char * const *array, size_t index, char **value)
    386 {
    387 	return copyin(array + index, value, sizeof(*value));
    388 }
    389 
    390 /*
    391  * exec system call
    392  */
    393 /* ARGSUSED */
    394 int
    395 sys_execve(struct lwp *l, const struct sys_execve_args *uap, register_t *retval)
    396 {
    397 	/* {
    398 		syscallarg(const char *)	path;
    399 		syscallarg(char * const *)	argp;
    400 		syscallarg(char * const *)	envp;
    401 	} */
    402 
    403 	return execve1(l, SCARG(uap, path), SCARG(uap, argp),
    404 	    SCARG(uap, envp), execve_fetch_element);
    405 }
    406 
    407 int
    408 execve1(struct lwp *l, const char *path, char * const *args,
    409     char * const *envs, execve_fetch_element_t fetch_element)
    410 {
    411 	int			error;
    412 	struct exec_package	pack;
    413 	struct nameidata	nid;
    414 	struct vattr		attr;
    415 	struct proc		*p;
    416 	char			*argp;
    417 	char			*dp, *sp;
    418 	long			argc, envc;
    419 	size_t			i, len;
    420 	char			*stack;
    421 	struct ps_strings	arginfo;
    422 	struct ps_strings	*aip = &arginfo;
    423 	struct vmspace		*vm;
    424 	char			**tmpfap;
    425 	int			szsigcode;
    426 	struct exec_vmcmd	*base_vcp;
    427 	ksiginfo_t		ksi;
    428 	ksiginfoq_t		kq;
    429 	char			*pathbuf;
    430 	size_t			pathbuflen;
    431 
    432 	p = l->l_proc;
    433 
    434 	/*
    435 	 * Drain existing references and forbid new ones.  The process
    436 	 * should be left alone until we're done here.  This is necessary
    437 	 * to avoid race conditions - e.g. in ptrace() - that might allow
    438 	 * a local user to illicitly obtain elevated privileges.
    439 	 */
    440 	rw_enter(&p->p_reflock, RW_WRITER);
    441 
    442 	base_vcp = NULL;
    443 	/*
    444 	 * Init the namei data to point the file user's program name.
    445 	 * This is done here rather than in check_exec(), so that it's
    446 	 * possible to override this settings if any of makecmd/probe
    447 	 * functions call check_exec() recursively - for example,
    448 	 * see exec_script_makecmds().
    449 	 */
    450 	pathbuf = PNBUF_GET();
    451 	error = copyinstr(path, pathbuf, MAXPATHLEN, &pathbuflen);
    452 	if (error) {
    453 		DPRINTF(("execve: copyinstr path %d", error));
    454 		goto clrflg;
    455 	}
    456 
    457 	NDINIT(&nid, LOOKUP, NOFOLLOW | TRYEMULROOT, UIO_SYSSPACE, pathbuf);
    458 
    459 	/*
    460 	 * initialize the fields of the exec package.
    461 	 */
    462 	pack.ep_name = path;
    463 	pack.ep_hdr = malloc(exec_maxhdrsz, M_EXEC, M_WAITOK);
    464 	pack.ep_hdrlen = exec_maxhdrsz;
    465 	pack.ep_hdrvalid = 0;
    466 	pack.ep_ndp = &nid;
    467 	pack.ep_emul_arg = NULL;
    468 	pack.ep_vmcmds.evs_cnt = 0;
    469 	pack.ep_vmcmds.evs_used = 0;
    470 	pack.ep_vap = &attr;
    471 	pack.ep_flags = 0;
    472 	pack.ep_emul_root = NULL;
    473 	pack.ep_interp = NULL;
    474 	pack.ep_esch = NULL;
    475 
    476 #ifdef LKM
    477 	rw_enter(&exec_lock, RW_READER);
    478 #endif
    479 
    480 	/* see if we can run it. */
    481 	if ((error = check_exec(l, &pack)) != 0) {
    482 		if (error != ENOENT) {
    483 			DPRINTF(("execve: check exec failed %d\n", error));
    484 		}
    485 		goto freehdr;
    486 	}
    487 
    488 	/* XXX -- THE FOLLOWING SECTION NEEDS MAJOR CLEANUP */
    489 
    490 	/* allocate an argument buffer */
    491 	argp = (char *) uvm_km_alloc(exec_map, NCARGS, 0,
    492 	    UVM_KMF_PAGEABLE|UVM_KMF_WAITVA);
    493 #ifdef DIAGNOSTIC
    494 	if (argp == NULL)
    495 		panic("execve: argp == NULL");
    496 #endif
    497 	dp = argp;
    498 	argc = 0;
    499 
    500 	/* copy the fake args list, if there's one, freeing it as we go */
    501 	if (pack.ep_flags & EXEC_HASARGL) {
    502 		tmpfap = pack.ep_fa;
    503 		while (*tmpfap != NULL) {
    504 			char *cp;
    505 
    506 			cp = *tmpfap;
    507 			while (*cp)
    508 				*dp++ = *cp++;
    509 			dp++;
    510 
    511 			FREE(*tmpfap, M_EXEC);
    512 			tmpfap++; argc++;
    513 		}
    514 		FREE(pack.ep_fa, M_EXEC);
    515 		pack.ep_flags &= ~EXEC_HASARGL;
    516 	}
    517 
    518 	/* Now get argv & environment */
    519 	if (args == NULL) {
    520 		DPRINTF(("execve: null args\n"));
    521 		error = EINVAL;
    522 		goto bad;
    523 	}
    524 	/* 'i' will index the argp/envp element to be retrieved */
    525 	i = 0;
    526 	if (pack.ep_flags & EXEC_SKIPARG)
    527 		i++;
    528 
    529 	while (1) {
    530 		len = argp + ARG_MAX - dp;
    531 		if ((error = (*fetch_element)(args, i, &sp)) != 0) {
    532 			DPRINTF(("execve: fetch_element args %d\n", error));
    533 			goto bad;
    534 		}
    535 		if (!sp)
    536 			break;
    537 		if ((error = copyinstr(sp, dp, len, &len)) != 0) {
    538 			DPRINTF(("execve: copyinstr args %d\n", error));
    539 			if (error == ENAMETOOLONG)
    540 				error = E2BIG;
    541 			goto bad;
    542 		}
    543 		ktrexecarg(dp, len - 1);
    544 		dp += len;
    545 		i++;
    546 		argc++;
    547 	}
    548 
    549 	envc = 0;
    550 	/* environment need not be there */
    551 	if (envs != NULL) {
    552 		i = 0;
    553 		while (1) {
    554 			len = argp + ARG_MAX - dp;
    555 			if ((error = (*fetch_element)(envs, i, &sp)) != 0) {
    556 				DPRINTF(("execve: fetch_element env %d\n", error));
    557 				goto bad;
    558 			}
    559 			if (!sp)
    560 				break;
    561 			if ((error = copyinstr(sp, dp, len, &len)) != 0) {
    562 				DPRINTF(("execve: copyinstr env %d\n", error));
    563 				if (error == ENAMETOOLONG)
    564 					error = E2BIG;
    565 				goto bad;
    566 			}
    567 			ktrexecenv(dp, len - 1);
    568 			dp += len;
    569 			i++;
    570 			envc++;
    571 		}
    572 	}
    573 
    574 	dp = (char *) ALIGN(dp);
    575 
    576 	szsigcode = pack.ep_esch->es_emul->e_esigcode -
    577 	    pack.ep_esch->es_emul->e_sigcode;
    578 
    579 	/* Now check if args & environ fit into new stack */
    580 	if (pack.ep_flags & EXEC_32)
    581 		len = ((argc + envc + 2 + pack.ep_esch->es_arglen) *
    582 		    sizeof(int) + sizeof(int) + dp + STACKGAPLEN +
    583 		    szsigcode + sizeof(struct ps_strings) + STACK_PTHREADSPACE)
    584 		    - argp;
    585 	else
    586 		len = ((argc + envc + 2 + pack.ep_esch->es_arglen) *
    587 		    sizeof(char *) + sizeof(int) + dp + STACKGAPLEN +
    588 		    szsigcode + sizeof(struct ps_strings) + STACK_PTHREADSPACE)
    589 		    - argp;
    590 
    591 #ifdef PAX_ASLR
    592 	if (pax_aslr_active(l))
    593 		len += (arc4random() % PAGE_SIZE);
    594 #endif /* PAX_ASLR */
    595 
    596 #ifdef STACKLALIGN	/* arm, etc. */
    597 	len = STACKALIGN(len);	/* make the stack "safely" aligned */
    598 #else
    599 	len = ALIGN(len);	/* make the stack "safely" aligned */
    600 #endif
    601 
    602 	if (len > pack.ep_ssize) { /* in effect, compare to initial limit */
    603 		DPRINTF(("execve: stack limit exceeded %zu\n", len));
    604 		error = ENOMEM;
    605 		goto bad;
    606 	}
    607 
    608 	/* Get rid of other LWPs. */
    609 	if (p->p_nlwps > 1) {
    610 		mutex_enter(&p->p_smutex);
    611 		exit_lwps(l);
    612 		mutex_exit(&p->p_smutex);
    613 	}
    614 	KDASSERT(p->p_nlwps == 1);
    615 
    616 	/* Destroy any lwpctl info. */
    617 	if (p->p_lwpctl != NULL)
    618 		lwp_ctl_exit();
    619 
    620 	/* This is now LWP 1 */
    621 	l->l_lid = 1;
    622 	p->p_nlwpid = 1;
    623 
    624 	/* Remove POSIX timers */
    625 	timers_free(p, TIMERS_POSIX);
    626 
    627 	/* adjust "active stack depth" for process VSZ */
    628 	pack.ep_ssize = len;	/* maybe should go elsewhere, but... */
    629 
    630 	/*
    631 	 * Do whatever is necessary to prepare the address space
    632 	 * for remapping.  Note that this might replace the current
    633 	 * vmspace with another!
    634 	 */
    635 	uvmspace_exec(l, pack.ep_vm_minaddr, pack.ep_vm_maxaddr);
    636 
    637 	/* record proc's vnode, for use by procfs and others */
    638         if (p->p_textvp)
    639                 vrele(p->p_textvp);
    640 	VREF(pack.ep_vp);
    641 	p->p_textvp = pack.ep_vp;
    642 
    643 	/* Now map address space */
    644 	vm = p->p_vmspace;
    645 	vm->vm_taddr = (void *)pack.ep_taddr;
    646 	vm->vm_tsize = btoc(pack.ep_tsize);
    647 	vm->vm_daddr = (void*)pack.ep_daddr;
    648 	vm->vm_dsize = btoc(pack.ep_dsize);
    649 	vm->vm_ssize = btoc(pack.ep_ssize);
    650 	vm->vm_maxsaddr = (void *)pack.ep_maxsaddr;
    651 	vm->vm_minsaddr = (void *)pack.ep_minsaddr;
    652 
    653 #ifdef PAX_ASLR
    654 	pax_aslr_init(l, vm);
    655 #endif /* PAX_ASLR */
    656 
    657 	/* create the new process's VM space by running the vmcmds */
    658 #ifdef DIAGNOSTIC
    659 	if (pack.ep_vmcmds.evs_used == 0)
    660 		panic("execve: no vmcmds");
    661 #endif
    662 	for (i = 0; i < pack.ep_vmcmds.evs_used && !error; i++) {
    663 		struct exec_vmcmd *vcp;
    664 
    665 		vcp = &pack.ep_vmcmds.evs_cmds[i];
    666 		if (vcp->ev_flags & VMCMD_RELATIVE) {
    667 #ifdef DIAGNOSTIC
    668 			if (base_vcp == NULL)
    669 				panic("execve: relative vmcmd with no base");
    670 			if (vcp->ev_flags & VMCMD_BASE)
    671 				panic("execve: illegal base & relative vmcmd");
    672 #endif
    673 			vcp->ev_addr += base_vcp->ev_addr;
    674 		}
    675 		error = (*vcp->ev_proc)(l, vcp);
    676 #ifdef DEBUG_EXEC
    677 		if (error) {
    678 			size_t j;
    679 			struct exec_vmcmd *vp = &pack.ep_vmcmds.evs_cmds[0];
    680 			for (j = 0; j <= i; j++)
    681 				uprintf(
    682 			"vmcmd[%zu] = %#lx/%#lx fd@%#lx prot=0%o flags=%d\n",
    683 				    j, vp[j].ev_addr, vp[j].ev_len,
    684 				    vp[j].ev_offset, vp[j].ev_prot,
    685 				    vp[j].ev_flags);
    686 		}
    687 #endif /* DEBUG_EXEC */
    688 		if (vcp->ev_flags & VMCMD_BASE)
    689 			base_vcp = vcp;
    690 	}
    691 
    692 	/* free the vmspace-creation commands, and release their references */
    693 	kill_vmcmds(&pack.ep_vmcmds);
    694 
    695 	vn_lock(pack.ep_vp, LK_EXCLUSIVE | LK_RETRY);
    696 	VOP_CLOSE(pack.ep_vp, FREAD, l->l_cred);
    697 	vput(pack.ep_vp);
    698 
    699 	/* if an error happened, deallocate and punt */
    700 	if (error) {
    701 		DPRINTF(("execve: vmcmd %zu failed: %d\n", i - 1, error));
    702 		goto exec_abort;
    703 	}
    704 
    705 	/* remember information about the process */
    706 	arginfo.ps_nargvstr = argc;
    707 	arginfo.ps_nenvstr = envc;
    708 
    709 	/* set command name & other accounting info */
    710 	i = min(nid.ni_cnd.cn_namelen, MAXCOMLEN);
    711 	(void)memcpy(p->p_comm, nid.ni_cnd.cn_nameptr, i);
    712 	p->p_comm[i] = '\0';
    713 
    714 	dp = PNBUF_GET();
    715 	/*
    716 	 * If the path starts with /, we don't need to do any work.
    717 	 * This handles the majority of the cases.
    718 	 * In the future perhaps we could canonicalize it?
    719 	 */
    720 	if (pathbuf[0] == '/')
    721 		(void)strlcpy(pack.ep_path = dp, pathbuf, MAXPATHLEN);
    722 #ifdef notyet
    723 	/*
    724 	 * Although this works most of the time [since the entry was just
    725 	 * entered in the cache] we don't use it because it theoretically
    726 	 * can fail and it is not the cleanest interface, because there
    727 	 * could be races. When the namei cache is re-written, this can
    728 	 * be changed to use the appropriate function.
    729 	 */
    730 	else if (!(error = vnode_to_path(dp, MAXPATHLEN, p->p_textvp, l, p)))
    731 		pack.ep_path = dp;
    732 #endif
    733 	else {
    734 #ifdef notyet
    735 		printf("Cannot get path for pid %d [%s] (error %d)",
    736 		    (int)p->p_pid, p->p_comm, error);
    737 #endif
    738 		pack.ep_path = NULL;
    739 		PNBUF_PUT(dp);
    740 	}
    741 
    742 	stack = (char *)STACK_ALLOC(STACK_GROW(vm->vm_minsaddr,
    743 		STACK_PTHREADSPACE + sizeof(struct ps_strings) + szsigcode),
    744 		len - (sizeof(struct ps_strings) + szsigcode));
    745 #ifdef __MACHINE_STACK_GROWS_UP
    746 	/*
    747 	 * The copyargs call always copies into lower addresses
    748 	 * first, moving towards higher addresses, starting with
    749 	 * the stack pointer that we give.  When the stack grows
    750 	 * down, this puts argc/argv/envp very shallow on the
    751 	 * stack, right at the first user stack pointer, and puts
    752 	 * STACKGAPLEN very deep in the stack.  When the stack
    753 	 * grows up, the situation is reversed.
    754 	 *
    755 	 * Normally, this is no big deal.  But the ld_elf.so _rtld()
    756 	 * function expects to be called with a single pointer to
    757 	 * a region that has a few words it can stash values into,
    758 	 * followed by argc/argv/envp.  When the stack grows down,
    759 	 * it's easy to decrement the stack pointer a little bit to
    760 	 * allocate the space for these few words and pass the new
    761 	 * stack pointer to _rtld.  When the stack grows up, however,
    762 	 * a few words before argc is part of the signal trampoline, XXX
    763 	 * so we have a problem.
    764 	 *
    765 	 * Instead of changing how _rtld works, we take the easy way
    766 	 * out and steal 32 bytes before we call copyargs.  This
    767 	 * space is effectively stolen from STACKGAPLEN.
    768 	 */
    769 	stack += 32;
    770 #endif /* __MACHINE_STACK_GROWS_UP */
    771 
    772 	/* Now copy argc, args & environ to new stack */
    773 	error = (*pack.ep_esch->es_copyargs)(l, &pack, &arginfo, &stack, argp);
    774 	if (pack.ep_path) {
    775 		PNBUF_PUT(pack.ep_path);
    776 		pack.ep_path = NULL;
    777 	}
    778 	if (error) {
    779 		DPRINTF(("execve: copyargs failed %d\n", error));
    780 		goto exec_abort;
    781 	}
    782 	/* Move the stack back to original point */
    783 	stack = (char *)STACK_GROW(vm->vm_minsaddr, len);
    784 
    785 	/* fill process ps_strings info */
    786 	p->p_psstr = (struct ps_strings *)
    787 	    STACK_ALLOC(STACK_GROW(vm->vm_minsaddr, STACK_PTHREADSPACE),
    788 	    sizeof(struct ps_strings));
    789 	p->p_psargv = offsetof(struct ps_strings, ps_argvstr);
    790 	p->p_psnargv = offsetof(struct ps_strings, ps_nargvstr);
    791 	p->p_psenv = offsetof(struct ps_strings, ps_envstr);
    792 	p->p_psnenv = offsetof(struct ps_strings, ps_nenvstr);
    793 
    794 	/* copy out the process's ps_strings structure */
    795 	if ((error = copyout(aip, (char *)p->p_psstr,
    796 	    sizeof(arginfo))) != 0) {
    797 		DPRINTF(("execve: ps_strings copyout %p->%p size %ld failed\n",
    798 		       aip, (char *)p->p_psstr, (long)sizeof(arginfo)));
    799 		goto exec_abort;
    800 	}
    801 
    802 	fdcloseexec(l);		/* handle close on exec */
    803 	execsigs(p);		/* reset catched signals */
    804 
    805 	l->l_ctxlink = NULL;	/* reset ucontext link */
    806 
    807 
    808 	p->p_acflag &= ~AFORK;
    809 	mutex_enter(&p->p_mutex);
    810 	p->p_flag |= PK_EXEC;
    811 	mutex_exit(&p->p_mutex);
    812 
    813 	/*
    814 	 * Stop profiling.
    815 	 */
    816 	if ((p->p_stflag & PST_PROFIL) != 0) {
    817 		mutex_spin_enter(&p->p_stmutex);
    818 		stopprofclock(p);
    819 		mutex_spin_exit(&p->p_stmutex);
    820 	}
    821 
    822 	/*
    823 	 * It's OK to test PS_PPWAIT unlocked here, as other LWPs have
    824 	 * exited and exec()/exit() are the only places it will be cleared.
    825 	 */
    826 	if ((p->p_sflag & PS_PPWAIT) != 0) {
    827 		mutex_enter(&proclist_lock);
    828 		mutex_enter(&p->p_smutex);
    829 		p->p_sflag &= ~PS_PPWAIT;
    830 		cv_broadcast(&p->p_pptr->p_waitcv);
    831 		mutex_exit(&p->p_smutex);
    832 		mutex_exit(&proclist_lock);
    833 	}
    834 
    835 	/*
    836 	 * Deal with set[ug]id.  MNT_NOSUID has already been used to disable
    837 	 * s[ug]id.  It's OK to check for PSL_TRACED here as we have blocked
    838 	 * out additional references on the process for the moment.
    839 	 */
    840 	if ((p->p_slflag & PSL_TRACED) == 0 &&
    841 
    842 	    (((attr.va_mode & S_ISUID) != 0 &&
    843 	      kauth_cred_geteuid(l->l_cred) != attr.va_uid) ||
    844 
    845 	     ((attr.va_mode & S_ISGID) != 0 &&
    846 	      kauth_cred_getegid(l->l_cred) != attr.va_gid))) {
    847 		/*
    848 		 * Mark the process as SUGID before we do
    849 		 * anything that might block.
    850 		 */
    851 		proc_crmod_enter();
    852 		proc_crmod_leave(NULL, NULL, true);
    853 
    854 		/* Make sure file descriptors 0..2 are in use. */
    855 		if ((error = fdcheckstd(l)) != 0) {
    856 			DPRINTF(("execve: fdcheckstd failed %d\n", error));
    857 			goto exec_abort;
    858 		}
    859 
    860 		/*
    861 		 * Copy the credential so other references don't see our
    862 		 * changes.
    863 		 */
    864 		l->l_cred = kauth_cred_copy(l->l_cred);
    865 #ifdef KTRACE
    866 		/*
    867 		 * If process is being ktraced, turn off - unless
    868 		 * root set it.
    869 		 */
    870 		if (p->p_tracep) {
    871 			mutex_enter(&ktrace_lock);
    872 			if (!(p->p_traceflag & KTRFAC_ROOT))
    873 				ktrderef(p);
    874 			mutex_exit(&ktrace_lock);
    875 		}
    876 #endif
    877 		if (attr.va_mode & S_ISUID)
    878 			kauth_cred_seteuid(l->l_cred, attr.va_uid);
    879 		if (attr.va_mode & S_ISGID)
    880 			kauth_cred_setegid(l->l_cred, attr.va_gid);
    881 	} else {
    882 		if (kauth_cred_geteuid(l->l_cred) ==
    883 		    kauth_cred_getuid(l->l_cred) &&
    884 		    kauth_cred_getegid(l->l_cred) ==
    885 		    kauth_cred_getgid(l->l_cred))
    886 			p->p_flag &= ~PK_SUGID;
    887 	}
    888 
    889 	/*
    890 	 * Copy the credential so other references don't see our changes.
    891 	 * Test to see if this is necessary first, since in the common case
    892 	 * we won't need a private reference.
    893 	 */
    894 	if (kauth_cred_geteuid(l->l_cred) != kauth_cred_getsvuid(l->l_cred) ||
    895 	    kauth_cred_getegid(l->l_cred) != kauth_cred_getsvgid(l->l_cred)) {
    896 		l->l_cred = kauth_cred_copy(l->l_cred);
    897 		kauth_cred_setsvuid(l->l_cred, kauth_cred_geteuid(l->l_cred));
    898 		kauth_cred_setsvgid(l->l_cred, kauth_cred_getegid(l->l_cred));
    899 	}
    900 
    901 	/* Update the master credentials. */
    902 	if (l->l_cred != p->p_cred) {
    903 		kauth_cred_t ocred;
    904 
    905 		kauth_cred_hold(l->l_cred);
    906 		mutex_enter(&p->p_mutex);
    907 		ocred = p->p_cred;
    908 		p->p_cred = l->l_cred;
    909 		mutex_exit(&p->p_mutex);
    910 		kauth_cred_free(ocred);
    911 	}
    912 
    913 #if defined(__HAVE_RAS)
    914 	/*
    915 	 * Remove all RASs from the address space.
    916 	 */
    917 	ras_purgeall();
    918 #endif
    919 
    920 	doexechooks(p);
    921 
    922 	uvm_km_free(exec_map, (vaddr_t) argp, NCARGS, UVM_KMF_PAGEABLE);
    923 
    924 	PNBUF_PUT(nid.ni_cnd.cn_pnbuf);
    925 
    926 	/* notify others that we exec'd */
    927 	KNOTE(&p->p_klist, NOTE_EXEC);
    928 
    929 	/* setup new registers and do misc. setup. */
    930 	(*pack.ep_esch->es_emul->e_setregs)(l, &pack, (u_long) stack);
    931 	if (pack.ep_esch->es_setregs)
    932 		(*pack.ep_esch->es_setregs)(l, &pack, (u_long) stack);
    933 
    934 	/* map the process's signal trampoline code */
    935 	if (exec_sigcode_map(p, pack.ep_esch->es_emul)) {
    936 		DPRINTF(("execve: map sigcode failed %d\n", error));
    937 		goto exec_abort;
    938 	}
    939 
    940 	free(pack.ep_hdr, M_EXEC);
    941 
    942 	/* The emulation root will usually have been found when we looked
    943 	 * for the elf interpreter (or similar), if not look now. */
    944 	if (pack.ep_esch->es_emul->e_path != NULL && pack.ep_emul_root == NULL)
    945 		emul_find_root(l, &pack);
    946 
    947 	/* Any old emulation root got removed by fdcloseexec */
    948 	rw_enter(&p->p_cwdi->cwdi_lock, RW_WRITER);
    949 	p->p_cwdi->cwdi_edir = pack.ep_emul_root;
    950 	rw_exit(&p->p_cwdi->cwdi_lock);
    951 	pack.ep_emul_root = NULL;
    952 	if (pack.ep_interp != NULL)
    953 		vrele(pack.ep_interp);
    954 
    955 	/*
    956 	 * Call emulation specific exec hook. This can setup per-process
    957 	 * p->p_emuldata or do any other per-process stuff an emulation needs.
    958 	 *
    959 	 * If we are executing process of different emulation than the
    960 	 * original forked process, call e_proc_exit() of the old emulation
    961 	 * first, then e_proc_exec() of new emulation. If the emulation is
    962 	 * same, the exec hook code should deallocate any old emulation
    963 	 * resources held previously by this process.
    964 	 */
    965 	if (p->p_emul && p->p_emul->e_proc_exit
    966 	    && p->p_emul != pack.ep_esch->es_emul)
    967 		(*p->p_emul->e_proc_exit)(p);
    968 
    969 	/*
    970 	 * Call exec hook. Emulation code may NOT store reference to anything
    971 	 * from &pack.
    972 	 */
    973         if (pack.ep_esch->es_emul->e_proc_exec)
    974                 (*pack.ep_esch->es_emul->e_proc_exec)(p, &pack);
    975 
    976 	/* update p_emul, the old value is no longer needed */
    977 	p->p_emul = pack.ep_esch->es_emul;
    978 
    979 	/* ...and the same for p_execsw */
    980 	p->p_execsw = pack.ep_esch;
    981 
    982 #ifdef __HAVE_SYSCALL_INTERN
    983 	(*p->p_emul->e_syscall_intern)(p);
    984 #endif
    985 	ktremul();
    986 
    987 	/* Allow new references from the debugger/procfs. */
    988 	rw_exit(&p->p_reflock);
    989 #ifdef LKM
    990 	rw_exit(&exec_lock);
    991 #endif
    992 
    993 	mutex_enter(&proclist_mutex);
    994 
    995 	if ((p->p_slflag & (PSL_TRACED|PSL_SYSCALL)) == PSL_TRACED) {
    996 		KSI_INIT_EMPTY(&ksi);
    997 		ksi.ksi_signo = SIGTRAP;
    998 		ksi.ksi_lid = l->l_lid;
    999 		kpsignal(p, &ksi, NULL);
   1000 	}
   1001 
   1002 	if (p->p_sflag & PS_STOPEXEC) {
   1003 		KERNEL_UNLOCK_ALL(l, &l->l_biglocks);
   1004 		p->p_pptr->p_nstopchild++;
   1005 		p->p_pptr->p_waited = 0;
   1006 		mutex_enter(&p->p_smutex);
   1007 		ksiginfo_queue_init(&kq);
   1008 		sigclearall(p, &contsigmask, &kq);
   1009 		lwp_lock(l);
   1010 		l->l_stat = LSSTOP;
   1011 		p->p_stat = SSTOP;
   1012 		p->p_nrlwps--;
   1013 		mutex_exit(&p->p_smutex);
   1014 		mutex_exit(&proclist_mutex);
   1015 		mi_switch(l);
   1016 		ksiginfo_queue_drain(&kq);
   1017 		KERNEL_LOCK(l->l_biglocks, l);
   1018 	} else {
   1019 		mutex_exit(&proclist_mutex);
   1020 	}
   1021 
   1022 	PNBUF_PUT(pathbuf);
   1023 	return (EJUSTRETURN);
   1024 
   1025  bad:
   1026 	/* free the vmspace-creation commands, and release their references */
   1027 	kill_vmcmds(&pack.ep_vmcmds);
   1028 	/* kill any opened file descriptor, if necessary */
   1029 	if (pack.ep_flags & EXEC_HASFD) {
   1030 		pack.ep_flags &= ~EXEC_HASFD;
   1031 		(void) fdrelease(l, pack.ep_fd);
   1032 	}
   1033 	/* close and put the exec'd file */
   1034 	vn_lock(pack.ep_vp, LK_EXCLUSIVE | LK_RETRY);
   1035 	VOP_CLOSE(pack.ep_vp, FREAD, l->l_cred);
   1036 	vput(pack.ep_vp);
   1037 	PNBUF_PUT(nid.ni_cnd.cn_pnbuf);
   1038 	uvm_km_free(exec_map, (vaddr_t) argp, NCARGS, UVM_KMF_PAGEABLE);
   1039 
   1040  freehdr:
   1041 	free(pack.ep_hdr, M_EXEC);
   1042 	if (pack.ep_emul_root != NULL)
   1043 		vrele(pack.ep_emul_root);
   1044 	if (pack.ep_interp != NULL)
   1045 		vrele(pack.ep_interp);
   1046 
   1047  clrflg:
   1048 	PNBUF_PUT(pathbuf);
   1049 	rw_exit(&p->p_reflock);
   1050 #ifdef LKM
   1051 	rw_exit(&exec_lock);
   1052 #endif
   1053 
   1054 	return error;
   1055 
   1056  exec_abort:
   1057 	PNBUF_PUT(pathbuf);
   1058 	rw_exit(&p->p_reflock);
   1059 #ifdef LKM
   1060 	rw_exit(&exec_lock);
   1061 #endif
   1062 
   1063 	/*
   1064 	 * the old process doesn't exist anymore.  exit gracefully.
   1065 	 * get rid of the (new) address space we have created, if any, get rid
   1066 	 * of our namei data and vnode, and exit noting failure
   1067 	 */
   1068 	uvm_deallocate(&vm->vm_map, VM_MIN_ADDRESS,
   1069 		VM_MAXUSER_ADDRESS - VM_MIN_ADDRESS);
   1070 	if (pack.ep_emul_arg)
   1071 		FREE(pack.ep_emul_arg, M_TEMP);
   1072 	PNBUF_PUT(nid.ni_cnd.cn_pnbuf);
   1073 	uvm_km_free(exec_map, (vaddr_t) argp, NCARGS, UVM_KMF_PAGEABLE);
   1074 	free(pack.ep_hdr, M_EXEC);
   1075 	if (pack.ep_emul_root != NULL)
   1076 		vrele(pack.ep_emul_root);
   1077 	if (pack.ep_interp != NULL)
   1078 		vrele(pack.ep_interp);
   1079 
   1080 	/* Acquire the sched-state mutex (exit1() will release it). */
   1081 	mutex_enter(&p->p_smutex);
   1082 	exit1(l, W_EXITCODE(error, SIGABRT));
   1083 
   1084 	/* NOTREACHED */
   1085 	return 0;
   1086 }
   1087 
   1088 
   1089 int
   1090 copyargs(struct lwp *l, struct exec_package *pack, struct ps_strings *arginfo,
   1091     char **stackp, void *argp)
   1092 {
   1093 	char	**cpp, *dp, *sp;
   1094 	size_t	len;
   1095 	void	*nullp;
   1096 	long	argc, envc;
   1097 	int	error;
   1098 
   1099 	cpp = (char **)*stackp;
   1100 	nullp = NULL;
   1101 	argc = arginfo->ps_nargvstr;
   1102 	envc = arginfo->ps_nenvstr;
   1103 	if ((error = copyout(&argc, cpp++, sizeof(argc))) != 0)
   1104 		return error;
   1105 
   1106 	dp = (char *) (cpp + argc + envc + 2 + pack->ep_esch->es_arglen);
   1107 	sp = argp;
   1108 
   1109 	/* XXX don't copy them out, remap them! */
   1110 	arginfo->ps_argvstr = cpp; /* remember location of argv for later */
   1111 
   1112 	for (; --argc >= 0; sp += len, dp += len)
   1113 		if ((error = copyout(&dp, cpp++, sizeof(dp))) != 0 ||
   1114 		    (error = copyoutstr(sp, dp, ARG_MAX, &len)) != 0)
   1115 			return error;
   1116 
   1117 	if ((error = copyout(&nullp, cpp++, sizeof(nullp))) != 0)
   1118 		return error;
   1119 
   1120 	arginfo->ps_envstr = cpp; /* remember location of envp for later */
   1121 
   1122 	for (; --envc >= 0; sp += len, dp += len)
   1123 		if ((error = copyout(&dp, cpp++, sizeof(dp))) != 0 ||
   1124 		    (error = copyoutstr(sp, dp, ARG_MAX, &len)) != 0)
   1125 			return error;
   1126 
   1127 	if ((error = copyout(&nullp, cpp++, sizeof(nullp))) != 0)
   1128 		return error;
   1129 
   1130 	*stackp = (char *)cpp;
   1131 	return 0;
   1132 }
   1133 
   1134 #ifdef LKM
   1135 /*
   1136  * Find an emulation of given name in list of emulations.
   1137  * Needs to be called with the exec_lock held.
   1138  */
   1139 const struct emul *
   1140 emul_search(const char *name)
   1141 {
   1142 	struct emul_entry *it;
   1143 
   1144 	LIST_FOREACH(it, &el_head, el_list) {
   1145 		if (strcmp(name, it->el_emul->e_name) == 0)
   1146 			return it->el_emul;
   1147 	}
   1148 
   1149 	return NULL;
   1150 }
   1151 
   1152 /*
   1153  * Add an emulation to list, if it's not there already.
   1154  */
   1155 int
   1156 emul_register(const struct emul *emul, int ro_entry)
   1157 {
   1158 	struct emul_entry	*ee;
   1159 	int			error;
   1160 
   1161 	error = 0;
   1162 	rw_enter(&exec_lock, RW_WRITER);
   1163 
   1164 	if (emul_search(emul->e_name)) {
   1165 		error = EEXIST;
   1166 		goto out;
   1167 	}
   1168 
   1169 	MALLOC(ee, struct emul_entry *, sizeof(struct emul_entry),
   1170 		M_EXEC, M_WAITOK);
   1171 	ee->el_emul = emul;
   1172 	ee->ro_entry = ro_entry;
   1173 	LIST_INSERT_HEAD(&el_head, ee, el_list);
   1174 
   1175  out:
   1176 	rw_exit(&exec_lock);
   1177 	return error;
   1178 }
   1179 
   1180 /*
   1181  * Remove emulation with name 'name' from list of supported emulations.
   1182  */
   1183 int
   1184 emul_unregister(const char *name)
   1185 {
   1186 	const struct proclist_desc *pd;
   1187 	struct emul_entry	*it;
   1188 	int			i, error;
   1189 	struct proc		*ptmp;
   1190 
   1191 	error = 0;
   1192 	rw_enter(&exec_lock, RW_WRITER);
   1193 
   1194 	LIST_FOREACH(it, &el_head, el_list) {
   1195 		if (strcmp(it->el_emul->e_name, name) == 0)
   1196 			break;
   1197 	}
   1198 
   1199 	if (!it) {
   1200 		error = ENOENT;
   1201 		goto out;
   1202 	}
   1203 
   1204 	if (it->ro_entry) {
   1205 		error = EBUSY;
   1206 		goto out;
   1207 	}
   1208 
   1209 	/* test if any execw[] entry is still using this */
   1210 	for(i=0; i < nexecs; i++) {
   1211 		if (execsw[i]->es_emul == it->el_emul) {
   1212 			error = EBUSY;
   1213 			goto out;
   1214 		}
   1215 	}
   1216 
   1217 	/*
   1218 	 * Test if any process is running under this emulation - since
   1219 	 * emul_unregister() is running quite sendomly, it's better
   1220 	 * to do expensive check here than to use any locking.
   1221 	 */
   1222 	mutex_enter(&proclist_lock);
   1223 	for (pd = proclists; pd->pd_list != NULL && !error; pd++) {
   1224 		PROCLIST_FOREACH(ptmp, pd->pd_list) {
   1225 			if (ptmp->p_emul == it->el_emul) {
   1226 				error = EBUSY;
   1227 				break;
   1228 			}
   1229 		}
   1230 	}
   1231 	mutex_exit(&proclist_lock);
   1232 
   1233 	if (error)
   1234 		goto out;
   1235 
   1236 
   1237 	/* entry is not used, remove it */
   1238 	LIST_REMOVE(it, el_list);
   1239 	FREE(it, M_EXEC);
   1240 
   1241  out:
   1242 	rw_exit(&exec_lock);
   1243 	return error;
   1244 }
   1245 
   1246 /*
   1247  * Add execsw[] entry.
   1248  */
   1249 int
   1250 exec_add(struct execsw *esp, const char *e_name)
   1251 {
   1252 	struct exec_entry	*it;
   1253 	int			error;
   1254 
   1255 	error = 0;
   1256 	rw_enter(&exec_lock, RW_WRITER);
   1257 
   1258 	if (!esp->es_emul) {
   1259 		esp->es_emul = emul_search(e_name);
   1260 		if (!esp->es_emul) {
   1261 			error = ENOENT;
   1262 			goto out;
   1263 		}
   1264 	}
   1265 
   1266 	LIST_FOREACH(it, &ex_head, ex_list) {
   1267 		/* assume tuple (makecmds, probe_func, emulation) is unique */
   1268 		if (it->es->es_makecmds == esp->es_makecmds
   1269 		    && it->es->u.elf_probe_func == esp->u.elf_probe_func
   1270 		    && it->es->es_emul == esp->es_emul) {
   1271 			error = EEXIST;
   1272 			goto out;
   1273 		}
   1274 	}
   1275 
   1276 	/* if we got here, the entry doesn't exist yet */
   1277 	MALLOC(it, struct exec_entry *, sizeof(struct exec_entry),
   1278 		M_EXEC, M_WAITOK);
   1279 	it->es = esp;
   1280 	LIST_INSERT_HEAD(&ex_head, it, ex_list);
   1281 
   1282 	/* update execsw[] */
   1283 	exec_init(0);
   1284 
   1285  out:
   1286 	rw_exit(&exec_lock);
   1287 	return error;
   1288 }
   1289 
   1290 /*
   1291  * Remove execsw[] entry.
   1292  */
   1293 int
   1294 exec_remove(const struct execsw *esp)
   1295 {
   1296 	struct exec_entry	*it;
   1297 	int			error;
   1298 
   1299 	error = 0;
   1300 	rw_enter(&exec_lock, RW_WRITER);
   1301 
   1302 	LIST_FOREACH(it, &ex_head, ex_list) {
   1303 		/* assume tuple (makecmds, probe_func, emulation) is unique */
   1304 		if (it->es->es_makecmds == esp->es_makecmds
   1305 		    && it->es->u.elf_probe_func == esp->u.elf_probe_func
   1306 		    && it->es->es_emul == esp->es_emul)
   1307 			break;
   1308 	}
   1309 	if (!it) {
   1310 		error = ENOENT;
   1311 		goto out;
   1312 	}
   1313 
   1314 	/* remove item from list and free resources */
   1315 	LIST_REMOVE(it, ex_list);
   1316 	FREE(it, M_EXEC);
   1317 
   1318 	/* update execsw[] */
   1319 	exec_init(0);
   1320 
   1321  out:
   1322 	rw_exit(&exec_lock);
   1323 	return error;
   1324 }
   1325 
   1326 static void
   1327 link_es(struct execsw_entry **listp, const struct execsw *esp)
   1328 {
   1329 	struct execsw_entry *et, *e1;
   1330 
   1331 	et = (struct execsw_entry *) malloc(sizeof(struct execsw_entry),
   1332 			M_TEMP, M_WAITOK);
   1333 	et->next = NULL;
   1334 	et->es = esp;
   1335 	if (*listp == NULL) {
   1336 		*listp = et;
   1337 		return;
   1338 	}
   1339 
   1340 	switch(et->es->es_prio) {
   1341 	case EXECSW_PRIO_FIRST:
   1342 		/* put new entry as the first */
   1343 		et->next = *listp;
   1344 		*listp = et;
   1345 		break;
   1346 	case EXECSW_PRIO_ANY:
   1347 		/* put new entry after all *_FIRST and *_ANY entries */
   1348 		for(e1 = *listp; e1->next
   1349 			&& e1->next->es->es_prio != EXECSW_PRIO_LAST;
   1350 			e1 = e1->next);
   1351 		et->next = e1->next;
   1352 		e1->next = et;
   1353 		break;
   1354 	case EXECSW_PRIO_LAST:
   1355 		/* put new entry as the last one */
   1356 		for(e1 = *listp; e1->next; e1 = e1->next);
   1357 		e1->next = et;
   1358 		break;
   1359 	default:
   1360 #ifdef DIAGNOSTIC
   1361 		panic("execw[] entry with unknown priority %d found",
   1362 			et->es->es_prio);
   1363 #else
   1364 		free(et, M_TEMP);
   1365 #endif
   1366 		break;
   1367 	}
   1368 }
   1369 
   1370 /*
   1371  * Initialize exec structures. If init_boot is true, also does necessary
   1372  * one-time initialization (it's called from main() that way).
   1373  * Once system is multiuser, this should be called with exec_lock held,
   1374  * i.e. via exec_{add|remove}().
   1375  */
   1376 int
   1377 exec_init(int init_boot)
   1378 {
   1379 	const struct execsw	**new_es, * const *old_es;
   1380 	struct execsw_entry	*list, *e1;
   1381 	struct exec_entry	*e2;
   1382 	int			i, es_sz;
   1383 
   1384 	if (init_boot) {
   1385 		/* do one-time initializations */
   1386 		rw_init(&exec_lock);
   1387 		mutex_init(&sigobject_lock, MUTEX_DEFAULT, IPL_NONE);
   1388 
   1389 		/* register compiled-in emulations */
   1390 		for(i=0; i < nexecs_builtin; i++) {
   1391 			if (execsw_builtin[i].es_emul)
   1392 				emul_register(execsw_builtin[i].es_emul, 1);
   1393 		}
   1394 #ifdef DIAGNOSTIC
   1395 		if (i == 0)
   1396 			panic("no emulations found in execsw_builtin[]");
   1397 #endif
   1398 	}
   1399 
   1400 	/*
   1401 	 * Build execsw[] array from builtin entries and entries added
   1402 	 * at runtime.
   1403 	 */
   1404 	list = NULL;
   1405 	for(i=0; i < nexecs_builtin; i++)
   1406 		link_es(&list, &execsw_builtin[i]);
   1407 
   1408 	/* Add dynamically loaded entries */
   1409 	es_sz = nexecs_builtin;
   1410 	LIST_FOREACH(e2, &ex_head, ex_list) {
   1411 		link_es(&list, e2->es);
   1412 		es_sz++;
   1413 	}
   1414 
   1415 	/*
   1416 	 * Now that we have sorted all execw entries, create new execsw[]
   1417 	 * and free no longer needed memory in the process.
   1418 	 */
   1419 	new_es = malloc(es_sz * sizeof(struct execsw *), M_EXEC, M_WAITOK);
   1420 	for(i=0; list; i++) {
   1421 		new_es[i] = list->es;
   1422 		e1 = list->next;
   1423 		free(list, M_TEMP);
   1424 		list = e1;
   1425 	}
   1426 
   1427 	/*
   1428 	 * New execsw[] array built, now replace old execsw[] and free
   1429 	 * used memory.
   1430 	 */
   1431 	old_es = execsw;
   1432 	execsw = new_es;
   1433 	nexecs = es_sz;
   1434 	if (old_es)
   1435 		/*XXXUNCONST*/
   1436 		free(__UNCONST(old_es), M_EXEC);
   1437 
   1438 	/*
   1439 	 * Figure out the maximum size of an exec header.
   1440 	 */
   1441 	exec_maxhdrsz = 0;
   1442 	for (i = 0; i < nexecs; i++) {
   1443 		if (execsw[i]->es_hdrsz > exec_maxhdrsz)
   1444 			exec_maxhdrsz = execsw[i]->es_hdrsz;
   1445 	}
   1446 
   1447 	return 0;
   1448 }
   1449 #endif
   1450 
   1451 #ifndef LKM
   1452 /*
   1453  * Simplified exec_init() for kernels without LKMs. Only initialize
   1454  * exec_maxhdrsz and execsw[].
   1455  */
   1456 int
   1457 exec_init(int init_boot)
   1458 {
   1459 	int i;
   1460 
   1461 #ifdef DIAGNOSTIC
   1462 	if (!init_boot)
   1463 		panic("exec_init(): called with init_boot == 0");
   1464 #endif
   1465 
   1466 	/* do one-time initializations */
   1467 	nexecs = nexecs_builtin;
   1468 	execsw = malloc(nexecs*sizeof(struct execsw *), M_EXEC, M_WAITOK);
   1469 
   1470 	/*
   1471 	 * Fill in execsw[] and figure out the maximum size of an exec header.
   1472 	 */
   1473 	exec_maxhdrsz = 0;
   1474 	for(i=0; i < nexecs; i++) {
   1475 		execsw[i] = &execsw_builtin[i];
   1476 		if (execsw_builtin[i].es_hdrsz > exec_maxhdrsz)
   1477 			exec_maxhdrsz = execsw_builtin[i].es_hdrsz;
   1478 	}
   1479 
   1480 	return 0;
   1481 
   1482 }
   1483 #endif /* !LKM */
   1484 
   1485 static int
   1486 exec_sigcode_map(struct proc *p, const struct emul *e)
   1487 {
   1488 	vaddr_t va;
   1489 	vsize_t sz;
   1490 	int error;
   1491 	struct uvm_object *uobj;
   1492 
   1493 	sz = (vaddr_t)e->e_esigcode - (vaddr_t)e->e_sigcode;
   1494 
   1495 	if (e->e_sigobject == NULL || sz == 0) {
   1496 		return 0;
   1497 	}
   1498 
   1499 	/*
   1500 	 * If we don't have a sigobject for this emulation, create one.
   1501 	 *
   1502 	 * sigobject is an anonymous memory object (just like SYSV shared
   1503 	 * memory) that we keep a permanent reference to and that we map
   1504 	 * in all processes that need this sigcode. The creation is simple,
   1505 	 * we create an object, add a permanent reference to it, map it in
   1506 	 * kernel space, copy out the sigcode to it and unmap it.
   1507 	 * We map it with PROT_READ|PROT_EXEC into the process just
   1508 	 * the way sys_mmap() would map it.
   1509 	 */
   1510 
   1511 	uobj = *e->e_sigobject;
   1512 	if (uobj == NULL) {
   1513 		mutex_enter(&sigobject_lock);
   1514 		if ((uobj = *e->e_sigobject) == NULL) {
   1515 			uobj = uao_create(sz, 0);
   1516 			(*uobj->pgops->pgo_reference)(uobj);
   1517 			va = vm_map_min(kernel_map);
   1518 			if ((error = uvm_map(kernel_map, &va, round_page(sz),
   1519 			    uobj, 0, 0,
   1520 			    UVM_MAPFLAG(UVM_PROT_RW, UVM_PROT_RW,
   1521 			    UVM_INH_SHARE, UVM_ADV_RANDOM, 0)))) {
   1522 				printf("kernel mapping failed %d\n", error);
   1523 				(*uobj->pgops->pgo_detach)(uobj);
   1524 				mutex_exit(&sigobject_lock);
   1525 				return (error);
   1526 			}
   1527 			memcpy((void *)va, e->e_sigcode, sz);
   1528 #ifdef PMAP_NEED_PROCWR
   1529 			pmap_procwr(&proc0, va, sz);
   1530 #endif
   1531 			uvm_unmap(kernel_map, va, va + round_page(sz));
   1532 			*e->e_sigobject = uobj;
   1533 		}
   1534 		mutex_exit(&sigobject_lock);
   1535 	}
   1536 
   1537 	/* Just a hint to uvm_map where to put it. */
   1538 	va = e->e_vm_default_addr(p, (vaddr_t)p->p_vmspace->vm_daddr,
   1539 	    round_page(sz));
   1540 
   1541 #ifdef __alpha__
   1542 	/*
   1543 	 * Tru64 puts /sbin/loader at the end of user virtual memory,
   1544 	 * which causes the above calculation to put the sigcode at
   1545 	 * an invalid address.  Put it just below the text instead.
   1546 	 */
   1547 	if (va == (vaddr_t)vm_map_max(&p->p_vmspace->vm_map)) {
   1548 		va = (vaddr_t)p->p_vmspace->vm_taddr - round_page(sz);
   1549 	}
   1550 #endif
   1551 
   1552 	(*uobj->pgops->pgo_reference)(uobj);
   1553 	error = uvm_map(&p->p_vmspace->vm_map, &va, round_page(sz),
   1554 			uobj, 0, 0,
   1555 			UVM_MAPFLAG(UVM_PROT_RX, UVM_PROT_RX, UVM_INH_SHARE,
   1556 				    UVM_ADV_RANDOM, 0));
   1557 	if (error) {
   1558 		(*uobj->pgops->pgo_detach)(uobj);
   1559 		return (error);
   1560 	}
   1561 	p->p_sigctx.ps_sigcode = (void *)va;
   1562 	return (0);
   1563 }
   1564