Home | History | Annotate | Line # | Download | only in kern
kern_exec.c revision 1.362
      1 /*	$NetBSD: kern_exec.c,v 1.362 2013/09/10 21:30:21 matt Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2008 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  *
     16  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     17  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     18  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     19  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     20  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     21  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     22  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     23  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     24  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     25  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     26  * POSSIBILITY OF SUCH DAMAGE.
     27  */
     28 
     29 /*-
     30  * Copyright (C) 1993, 1994, 1996 Christopher G. Demetriou
     31  * Copyright (C) 1992 Wolfgang Solfrank.
     32  * Copyright (C) 1992 TooLs GmbH.
     33  * All rights reserved.
     34  *
     35  * Redistribution and use in source and binary forms, with or without
     36  * modification, are permitted provided that the following conditions
     37  * are met:
     38  * 1. Redistributions of source code must retain the above copyright
     39  *    notice, this list of conditions and the following disclaimer.
     40  * 2. Redistributions in binary form must reproduce the above copyright
     41  *    notice, this list of conditions and the following disclaimer in the
     42  *    documentation and/or other materials provided with the distribution.
     43  * 3. All advertising materials mentioning features or use of this software
     44  *    must display the following acknowledgement:
     45  *	This product includes software developed by TooLs GmbH.
     46  * 4. The name of TooLs GmbH may not be used to endorse or promote products
     47  *    derived from this software without specific prior written permission.
     48  *
     49  * THIS SOFTWARE IS PROVIDED BY TOOLS GMBH ``AS IS'' AND ANY EXPRESS OR
     50  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     51  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     52  * IN NO EVENT SHALL TOOLS GMBH BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
     53  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
     54  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
     55  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
     56  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
     57  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
     58  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     59  */
     60 
     61 #include <sys/cdefs.h>
     62 __KERNEL_RCSID(0, "$NetBSD: kern_exec.c,v 1.362 2013/09/10 21:30:21 matt Exp $");
     63 
     64 #include "opt_exec.h"
     65 #include "opt_execfmt.h"
     66 #include "opt_ktrace.h"
     67 #include "opt_modular.h"
     68 #include "opt_syscall_debug.h"
     69 #include "veriexec.h"
     70 #include "opt_pax.h"
     71 
     72 #include <sys/param.h>
     73 #include <sys/systm.h>
     74 #include <sys/filedesc.h>
     75 #include <sys/kernel.h>
     76 #include <sys/proc.h>
     77 #include <sys/mount.h>
     78 #include <sys/malloc.h>
     79 #include <sys/kmem.h>
     80 #include <sys/namei.h>
     81 #include <sys/vnode.h>
     82 #include <sys/file.h>
     83 #include <sys/acct.h>
     84 #include <sys/atomic.h>
     85 #include <sys/exec.h>
     86 #include <sys/ktrace.h>
     87 #include <sys/uidinfo.h>
     88 #include <sys/wait.h>
     89 #include <sys/mman.h>
     90 #include <sys/ras.h>
     91 #include <sys/signalvar.h>
     92 #include <sys/stat.h>
     93 #include <sys/syscall.h>
     94 #include <sys/kauth.h>
     95 #include <sys/lwpctl.h>
     96 #include <sys/pax.h>
     97 #include <sys/cpu.h>
     98 #include <sys/module.h>
     99 #include <sys/syscallvar.h>
    100 #include <sys/syscallargs.h>
    101 #if NVERIEXEC > 0
    102 #include <sys/verified_exec.h>
    103 #endif /* NVERIEXEC > 0 */
    104 #include <sys/sdt.h>
    105 #include <sys/spawn.h>
    106 #include <sys/prot.h>
    107 #include <sys/cprng.h>
    108 
    109 #include <uvm/uvm_extern.h>
    110 
    111 #include <machine/reg.h>
    112 
    113 #include <compat/common/compat_util.h>
    114 
    115 static int exec_sigcode_map(struct proc *, const struct emul *);
    116 
    117 #ifdef DEBUG_EXEC
    118 #define DPRINTF(a) printf a
    119 #define COPYPRINTF(s, a, b) printf("%s, %d: copyout%s @%p %zu\n", __func__, \
    120     __LINE__, (s), (a), (b))
    121 #else
    122 #define DPRINTF(a)
    123 #define COPYPRINTF(s, a, b)
    124 #endif /* DEBUG_EXEC */
    125 
    126 /*
    127  * DTrace SDT provider definitions
    128  */
    129 SDT_PROBE_DEFINE(proc,,,exec,exec,
    130 	    "char *", NULL,
    131 	    NULL, NULL, NULL, NULL,
    132 	    NULL, NULL, NULL, NULL);
    133 SDT_PROBE_DEFINE(proc,,,exec_success,exec-success,
    134 	    "char *", NULL,
    135 	    NULL, NULL, NULL, NULL,
    136 	    NULL, NULL, NULL, NULL);
    137 SDT_PROBE_DEFINE(proc,,,exec_failure,exec-failure,
    138 	    "int", NULL,
    139 	    NULL, NULL, NULL, NULL,
    140 	    NULL, NULL, NULL, NULL);
    141 
    142 /*
    143  * Exec function switch:
    144  *
    145  * Note that each makecmds function is responsible for loading the
    146  * exec package with the necessary functions for any exec-type-specific
    147  * handling.
    148  *
    149  * Functions for specific exec types should be defined in their own
    150  * header file.
    151  */
    152 static const struct execsw	**execsw = NULL;
    153 static int			nexecs;
    154 
    155 u_int	exec_maxhdrsz;	 /* must not be static - used by netbsd32 */
    156 
    157 /* list of dynamically loaded execsw entries */
    158 static LIST_HEAD(execlist_head, exec_entry) ex_head =
    159     LIST_HEAD_INITIALIZER(ex_head);
    160 struct exec_entry {
    161 	LIST_ENTRY(exec_entry)	ex_list;
    162 	SLIST_ENTRY(exec_entry)	ex_slist;
    163 	const struct execsw	*ex_sw;
    164 };
    165 
    166 #ifndef __HAVE_SYSCALL_INTERN
    167 void	syscall(void);
    168 #endif
    169 
    170 /* NetBSD emul struct */
    171 struct emul emul_netbsd = {
    172 	.e_name =		"netbsd",
    173 	.e_path =		NULL,
    174 #ifndef __HAVE_MINIMAL_EMUL
    175 	.e_flags =		EMUL_HAS_SYS___syscall,
    176 	.e_errno =		NULL,
    177 	.e_nosys =		SYS_syscall,
    178 	.e_nsysent =		SYS_NSYSENT,
    179 #endif
    180 	.e_sysent =		sysent,
    181 #ifdef SYSCALL_DEBUG
    182 	.e_syscallnames =	syscallnames,
    183 #else
    184 	.e_syscallnames =	NULL,
    185 #endif
    186 	.e_sendsig =		sendsig,
    187 	.e_trapsignal =		trapsignal,
    188 	.e_tracesig =		NULL,
    189 	.e_sigcode =		NULL,
    190 	.e_esigcode =		NULL,
    191 	.e_sigobject =		NULL,
    192 	.e_setregs =		setregs,
    193 	.e_proc_exec =		NULL,
    194 	.e_proc_fork =		NULL,
    195 	.e_proc_exit =		NULL,
    196 	.e_lwp_fork =		NULL,
    197 	.e_lwp_exit =		NULL,
    198 #ifdef __HAVE_SYSCALL_INTERN
    199 	.e_syscall_intern =	syscall_intern,
    200 #else
    201 	.e_syscall =		syscall,
    202 #endif
    203 	.e_sysctlovly =		NULL,
    204 	.e_fault =		NULL,
    205 	.e_vm_default_addr =	uvm_default_mapaddr,
    206 	.e_usertrap =		NULL,
    207 	.e_ucsize =		sizeof(ucontext_t),
    208 	.e_startlwp =		startlwp
    209 };
    210 
    211 /*
    212  * Exec lock. Used to control access to execsw[] structures.
    213  * This must not be static so that netbsd32 can access it, too.
    214  */
    215 krwlock_t exec_lock;
    216 
    217 static kmutex_t sigobject_lock;
    218 
    219 /*
    220  * Data used between a loadvm and execve part of an "exec" operation
    221  */
    222 struct execve_data {
    223 	struct exec_package	ed_pack;
    224 	struct pathbuf		*ed_pathbuf;
    225 	struct vattr		ed_attr;
    226 	struct ps_strings	ed_arginfo;
    227 	char			*ed_argp;
    228 	const char		*ed_pathstring;
    229 	char			*ed_resolvedpathbuf;
    230 	size_t			ed_ps_strings_sz;
    231 	int			ed_szsigcode;
    232 	long			ed_argc;
    233 	long			ed_envc;
    234 };
    235 
    236 /*
    237  * data passed from parent lwp to child during a posix_spawn()
    238  */
    239 struct spawn_exec_data {
    240 	struct execve_data	sed_exec;
    241 	struct posix_spawn_file_actions
    242 				*sed_actions;
    243 	struct posix_spawnattr	*sed_attrs;
    244 	struct proc		*sed_parent;
    245 	kcondvar_t		sed_cv_child_ready;
    246 	kmutex_t		sed_mtx_child;
    247 	int			sed_error;
    248 	volatile uint32_t	sed_refcnt;
    249 };
    250 
    251 static void *
    252 exec_pool_alloc(struct pool *pp, int flags)
    253 {
    254 
    255 	return (void *)uvm_km_alloc(kernel_map, NCARGS, 0,
    256 	    UVM_KMF_PAGEABLE | UVM_KMF_WAITVA);
    257 }
    258 
    259 static void
    260 exec_pool_free(struct pool *pp, void *addr)
    261 {
    262 
    263 	uvm_km_free(kernel_map, (vaddr_t)addr, NCARGS, UVM_KMF_PAGEABLE);
    264 }
    265 
    266 static struct pool exec_pool;
    267 
    268 static struct pool_allocator exec_palloc = {
    269 	.pa_alloc = exec_pool_alloc,
    270 	.pa_free = exec_pool_free,
    271 	.pa_pagesz = NCARGS
    272 };
    273 
    274 /*
    275  * check exec:
    276  * given an "executable" described in the exec package's namei info,
    277  * see what we can do with it.
    278  *
    279  * ON ENTRY:
    280  *	exec package with appropriate namei info
    281  *	lwp pointer of exec'ing lwp
    282  *	NO SELF-LOCKED VNODES
    283  *
    284  * ON EXIT:
    285  *	error:	nothing held, etc.  exec header still allocated.
    286  *	ok:	filled exec package, executable's vnode (unlocked).
    287  *
    288  * EXEC SWITCH ENTRY:
    289  * 	Locked vnode to check, exec package, proc.
    290  *
    291  * EXEC SWITCH EXIT:
    292  *	ok:	return 0, filled exec package, executable's vnode (unlocked).
    293  *	error:	destructive:
    294  *			everything deallocated execept exec header.
    295  *		non-destructive:
    296  *			error code, executable's vnode (unlocked),
    297  *			exec header unmodified.
    298  */
    299 int
    300 /*ARGSUSED*/
    301 check_exec(struct lwp *l, struct exec_package *epp, struct pathbuf *pb)
    302 {
    303 	int		error, i;
    304 	struct vnode	*vp;
    305 	struct nameidata nd;
    306 	size_t		resid;
    307 
    308 	NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | TRYEMULROOT, pb);
    309 
    310 	/* first get the vnode */
    311 	if ((error = namei(&nd)) != 0)
    312 		return error;
    313 	epp->ep_vp = vp = nd.ni_vp;
    314 	/* this cannot overflow as both are size PATH_MAX */
    315 	strcpy(epp->ep_resolvedname, nd.ni_pnbuf);
    316 
    317 #ifdef DIAGNOSTIC
    318 	/* paranoia (take this out once namei stuff stabilizes) */
    319 	memset(nd.ni_pnbuf, '~', PATH_MAX);
    320 #endif
    321 
    322 	/* check access and type */
    323 	if (vp->v_type != VREG) {
    324 		error = EACCES;
    325 		goto bad1;
    326 	}
    327 	if ((error = VOP_ACCESS(vp, VEXEC, l->l_cred)) != 0)
    328 		goto bad1;
    329 
    330 	/* get attributes */
    331 	if ((error = VOP_GETATTR(vp, epp->ep_vap, l->l_cred)) != 0)
    332 		goto bad1;
    333 
    334 	/* Check mount point */
    335 	if (vp->v_mount->mnt_flag & MNT_NOEXEC) {
    336 		error = EACCES;
    337 		goto bad1;
    338 	}
    339 	if (vp->v_mount->mnt_flag & MNT_NOSUID)
    340 		epp->ep_vap->va_mode &= ~(S_ISUID | S_ISGID);
    341 
    342 	/* try to open it */
    343 	if ((error = VOP_OPEN(vp, FREAD, l->l_cred)) != 0)
    344 		goto bad1;
    345 
    346 	/* unlock vp, since we need it unlocked from here on out. */
    347 	VOP_UNLOCK(vp);
    348 
    349 #if NVERIEXEC > 0
    350 	error = veriexec_verify(l, vp, epp->ep_resolvedname,
    351 	    epp->ep_flags & EXEC_INDIR ? VERIEXEC_INDIRECT : VERIEXEC_DIRECT,
    352 	    NULL);
    353 	if (error)
    354 		goto bad2;
    355 #endif /* NVERIEXEC > 0 */
    356 
    357 #ifdef PAX_SEGVGUARD
    358 	error = pax_segvguard(l, vp, epp->ep_resolvedname, false);
    359 	if (error)
    360 		goto bad2;
    361 #endif /* PAX_SEGVGUARD */
    362 
    363 	/* now we have the file, get the exec header */
    364 	error = vn_rdwr(UIO_READ, vp, epp->ep_hdr, epp->ep_hdrlen, 0,
    365 			UIO_SYSSPACE, 0, l->l_cred, &resid, NULL);
    366 	if (error)
    367 		goto bad2;
    368 	epp->ep_hdrvalid = epp->ep_hdrlen - resid;
    369 
    370 	/*
    371 	 * Set up default address space limits.  Can be overridden
    372 	 * by individual exec packages.
    373 	 *
    374 	 * XXX probably should be all done in the exec packages.
    375 	 */
    376 	epp->ep_vm_minaddr = VM_MIN_ADDRESS;
    377 	epp->ep_vm_maxaddr = VM_MAXUSER_ADDRESS;
    378 	/*
    379 	 * set up the vmcmds for creation of the process
    380 	 * address space
    381 	 */
    382 	error = ENOEXEC;
    383 	for (i = 0; i < nexecs; i++) {
    384 		int newerror;
    385 
    386 		epp->ep_esch = execsw[i];
    387 		newerror = (*execsw[i]->es_makecmds)(l, epp);
    388 
    389 		if (!newerror) {
    390 			/* Seems ok: check that entry point is not too high */
    391 			if (epp->ep_entry > epp->ep_vm_maxaddr) {
    392 #ifdef DIAGNOSTIC
    393 				printf("%s: rejecting %p due to "
    394 				    "too high entry address (> %p)\n",
    395 					 __func__, (void *)epp->ep_entry,
    396 					 (void *)epp->ep_vm_maxaddr);
    397 #endif
    398 				error = ENOEXEC;
    399 				break;
    400 			}
    401 			/* Seems ok: check that entry point is not too low */
    402 			if (epp->ep_entry < epp->ep_vm_minaddr) {
    403 #ifdef DIAGNOSTIC
    404 				printf("%s: rejecting %p due to "
    405 				    "too low entry address (< %p)\n",
    406 				     __func__, (void *)epp->ep_entry,
    407 				     (void *)epp->ep_vm_minaddr);
    408 #endif
    409 				error = ENOEXEC;
    410 				break;
    411 			}
    412 
    413 			/* check limits */
    414 			if ((epp->ep_tsize > MAXTSIZ) ||
    415 			    (epp->ep_dsize > (u_quad_t)l->l_proc->p_rlimit
    416 						    [RLIMIT_DATA].rlim_cur)) {
    417 #ifdef DIAGNOSTIC
    418 				printf("%s: rejecting due to "
    419 				    "limits (t=%llu > %llu || d=%llu > %llu)\n",
    420 				    __func__,
    421 				    (unsigned long long)epp->ep_tsize,
    422 				    (unsigned long long)MAXTSIZ,
    423 				    (unsigned long long)epp->ep_dsize,
    424 				    (unsigned long long)
    425 				    l->l_proc->p_rlimit[RLIMIT_DATA].rlim_cur);
    426 #endif
    427 				error = ENOMEM;
    428 				break;
    429 			}
    430 			return 0;
    431 		}
    432 
    433 		if (epp->ep_emul_root != NULL) {
    434 			vrele(epp->ep_emul_root);
    435 			epp->ep_emul_root = NULL;
    436 		}
    437 		if (epp->ep_interp != NULL) {
    438 			vrele(epp->ep_interp);
    439 			epp->ep_interp = NULL;
    440 		}
    441 
    442 		/* make sure the first "interesting" error code is saved. */
    443 		if (error == ENOEXEC)
    444 			error = newerror;
    445 
    446 		if (epp->ep_flags & EXEC_DESTR)
    447 			/* Error from "#!" code, tidied up by recursive call */
    448 			return error;
    449 	}
    450 
    451 	/* not found, error */
    452 
    453 	/*
    454 	 * free any vmspace-creation commands,
    455 	 * and release their references
    456 	 */
    457 	kill_vmcmds(&epp->ep_vmcmds);
    458 
    459 bad2:
    460 	/*
    461 	 * close and release the vnode, restore the old one, free the
    462 	 * pathname buf, and punt.
    463 	 */
    464 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
    465 	VOP_CLOSE(vp, FREAD, l->l_cred);
    466 	vput(vp);
    467 	return error;
    468 
    469 bad1:
    470 	/*
    471 	 * free the namei pathname buffer, and put the vnode
    472 	 * (which we don't yet have open).
    473 	 */
    474 	vput(vp);				/* was still locked */
    475 	return error;
    476 }
    477 
    478 #ifdef __MACHINE_STACK_GROWS_UP
    479 #define STACK_PTHREADSPACE NBPG
    480 #else
    481 #define STACK_PTHREADSPACE 0
    482 #endif
    483 
    484 static int
    485 execve_fetch_element(char * const *array, size_t index, char **value)
    486 {
    487 	return copyin(array + index, value, sizeof(*value));
    488 }
    489 
    490 /*
    491  * exec system call
    492  */
    493 int
    494 sys_execve(struct lwp *l, const struct sys_execve_args *uap, register_t *retval)
    495 {
    496 	/* {
    497 		syscallarg(const char *)	path;
    498 		syscallarg(char * const *)	argp;
    499 		syscallarg(char * const *)	envp;
    500 	} */
    501 
    502 	return execve1(l, SCARG(uap, path), SCARG(uap, argp),
    503 	    SCARG(uap, envp), execve_fetch_element);
    504 }
    505 
    506 int
    507 sys_fexecve(struct lwp *l, const struct sys_fexecve_args *uap,
    508     register_t *retval)
    509 {
    510 	/* {
    511 		syscallarg(int)			fd;
    512 		syscallarg(char * const *)	argp;
    513 		syscallarg(char * const *)	envp;
    514 	} */
    515 
    516 	return ENOSYS;
    517 }
    518 
    519 /*
    520  * Load modules to try and execute an image that we do not understand.
    521  * If no execsw entries are present, we load those likely to be needed
    522  * in order to run native images only.  Otherwise, we autoload all
    523  * possible modules that could let us run the binary.  XXX lame
    524  */
    525 static void
    526 exec_autoload(void)
    527 {
    528 #ifdef MODULAR
    529 	static const char * const native[] = {
    530 		"exec_elf32",
    531 		"exec_elf64",
    532 		"exec_script",
    533 		NULL
    534 	};
    535 	static const char * const compat[] = {
    536 		"exec_elf32",
    537 		"exec_elf64",
    538 		"exec_script",
    539 		"exec_aout",
    540 		"exec_coff",
    541 		"exec_ecoff",
    542 		"compat_aoutm68k",
    543 		"compat_freebsd",
    544 		"compat_ibcs2",
    545 		"compat_linux",
    546 		"compat_linux32",
    547 		"compat_netbsd32",
    548 		"compat_sunos",
    549 		"compat_sunos32",
    550 		"compat_svr4",
    551 		"compat_svr4_32",
    552 		"compat_ultrix",
    553 		NULL
    554 	};
    555 	char const * const *list;
    556 	int i;
    557 
    558 	list = (nexecs == 0 ? native : compat);
    559 	for (i = 0; list[i] != NULL; i++) {
    560 		if (module_autoload(list[i], MODULE_CLASS_MISC) != 0) {
    561 		    	continue;
    562 		}
    563 	   	yield();
    564 	}
    565 #endif
    566 }
    567 
    568 static int
    569 execve_loadvm(struct lwp *l, const char *path, char * const *args,
    570 	char * const *envs, execve_fetch_element_t fetch_element,
    571 	struct execve_data * restrict data)
    572 {
    573 	int			error;
    574 	struct proc		*p;
    575 	char			*dp, *sp;
    576 	size_t			i, len;
    577 	struct exec_fakearg	*tmpfap;
    578 	u_int			modgen;
    579 
    580 	KASSERT(data != NULL);
    581 
    582 	p = l->l_proc;
    583  	modgen = 0;
    584 
    585 	SDT_PROBE(proc,,,exec, path, 0, 0, 0, 0);
    586 
    587 	/*
    588 	 * Check if we have exceeded our number of processes limit.
    589 	 * This is so that we handle the case where a root daemon
    590 	 * forked, ran setuid to become the desired user and is trying
    591 	 * to exec. The obvious place to do the reference counting check
    592 	 * is setuid(), but we don't do the reference counting check there
    593 	 * like other OS's do because then all the programs that use setuid()
    594 	 * must be modified to check the return code of setuid() and exit().
    595 	 * It is dangerous to make setuid() fail, because it fails open and
    596 	 * the program will continue to run as root. If we make it succeed
    597 	 * and return an error code, again we are not enforcing the limit.
    598 	 * The best place to enforce the limit is here, when the process tries
    599 	 * to execute a new image, because eventually the process will need
    600 	 * to call exec in order to do something useful.
    601 	 */
    602  retry:
    603 	if (p->p_flag & PK_SUGID) {
    604 		if (kauth_authorize_process(l->l_cred, KAUTH_PROCESS_RLIMIT,
    605 		     p, KAUTH_ARG(KAUTH_REQ_PROCESS_RLIMIT_BYPASS),
    606 		     &p->p_rlimit[RLIMIT_NPROC],
    607 		     KAUTH_ARG(RLIMIT_NPROC)) != 0 &&
    608 		    chgproccnt(kauth_cred_getuid(l->l_cred), 0) >
    609 		     p->p_rlimit[RLIMIT_NPROC].rlim_cur)
    610 		return EAGAIN;
    611 	}
    612 
    613 	/*
    614 	 * Drain existing references and forbid new ones.  The process
    615 	 * should be left alone until we're done here.  This is necessary
    616 	 * to avoid race conditions - e.g. in ptrace() - that might allow
    617 	 * a local user to illicitly obtain elevated privileges.
    618 	 */
    619 	rw_enter(&p->p_reflock, RW_WRITER);
    620 
    621 	/*
    622 	 * Init the namei data to point the file user's program name.
    623 	 * This is done here rather than in check_exec(), so that it's
    624 	 * possible to override this settings if any of makecmd/probe
    625 	 * functions call check_exec() recursively - for example,
    626 	 * see exec_script_makecmds().
    627 	 */
    628 	error = pathbuf_copyin(path, &data->ed_pathbuf);
    629 	if (error) {
    630 		DPRINTF(("%s: pathbuf_copyin path @%p %d\n", __func__,
    631 		    path, error));
    632 		goto clrflg;
    633 	}
    634 	data->ed_pathstring = pathbuf_stringcopy_get(data->ed_pathbuf);
    635 
    636 	data->ed_resolvedpathbuf = PNBUF_GET();
    637 #ifdef DIAGNOSTIC
    638 	strcpy(data->ed_resolvedpathbuf, "/wrong");
    639 #endif
    640 
    641 	/*
    642 	 * initialize the fields of the exec package.
    643 	 */
    644 	data->ed_pack.ep_name = path;
    645 	data->ed_pack.ep_kname = data->ed_pathstring;
    646 	data->ed_pack.ep_resolvedname = data->ed_resolvedpathbuf;
    647 	data->ed_pack.ep_hdr = kmem_alloc(exec_maxhdrsz, KM_SLEEP);
    648 	data->ed_pack.ep_hdrlen = exec_maxhdrsz;
    649 	data->ed_pack.ep_hdrvalid = 0;
    650 	data->ed_pack.ep_emul_arg = NULL;
    651 	data->ed_pack.ep_emul_arg_free = NULL;
    652 	data->ed_pack.ep_vmcmds.evs_cnt = 0;
    653 	data->ed_pack.ep_vmcmds.evs_used = 0;
    654 	data->ed_pack.ep_vap = &data->ed_attr;
    655 	data->ed_pack.ep_flags = 0;
    656 	data->ed_pack.ep_emul_root = NULL;
    657 	data->ed_pack.ep_interp = NULL;
    658 	data->ed_pack.ep_esch = NULL;
    659 	data->ed_pack.ep_pax_flags = 0;
    660 	memset(data->ed_pack.ep_machine_arch, 0,
    661 	    sizeof(data->ed_pack.ep_machine_arch));
    662 
    663 	rw_enter(&exec_lock, RW_READER);
    664 
    665 	/* see if we can run it. */
    666 	if ((error = check_exec(l, &data->ed_pack, data->ed_pathbuf)) != 0) {
    667 		if (error != ENOENT) {
    668 			DPRINTF(("%s: check exec failed %d\n",
    669 			    __func__, error));
    670 		}
    671 		goto freehdr;
    672 	}
    673 
    674 	/* XXX -- THE FOLLOWING SECTION NEEDS MAJOR CLEANUP */
    675 
    676 	/* allocate an argument buffer */
    677 	data->ed_argp = pool_get(&exec_pool, PR_WAITOK);
    678 	KASSERT(data->ed_argp != NULL);
    679 	dp = data->ed_argp;
    680 	data->ed_argc = 0;
    681 
    682 	/* copy the fake args list, if there's one, freeing it as we go */
    683 	if (data->ed_pack.ep_flags & EXEC_HASARGL) {
    684 		tmpfap = data->ed_pack.ep_fa;
    685 		while (tmpfap->fa_arg != NULL) {
    686 			const char *cp;
    687 
    688 			cp = tmpfap->fa_arg;
    689 			while (*cp)
    690 				*dp++ = *cp++;
    691 			*dp++ = '\0';
    692 			ktrexecarg(tmpfap->fa_arg, cp - tmpfap->fa_arg);
    693 
    694 			kmem_free(tmpfap->fa_arg, tmpfap->fa_len);
    695 			tmpfap++; data->ed_argc++;
    696 		}
    697 		kmem_free(data->ed_pack.ep_fa, data->ed_pack.ep_fa_len);
    698 		data->ed_pack.ep_flags &= ~EXEC_HASARGL;
    699 	}
    700 
    701 	/* Now get argv & environment */
    702 	if (args == NULL) {
    703 		DPRINTF(("%s: null args\n", __func__));
    704 		error = EINVAL;
    705 		goto bad;
    706 	}
    707 	/* 'i' will index the argp/envp element to be retrieved */
    708 	i = 0;
    709 	if (data->ed_pack.ep_flags & EXEC_SKIPARG)
    710 		i++;
    711 
    712 	while (1) {
    713 		len = data->ed_argp + ARG_MAX - dp;
    714 		if ((error = (*fetch_element)(args, i, &sp)) != 0) {
    715 			DPRINTF(("%s: fetch_element args %d\n",
    716 			    __func__, error));
    717 			goto bad;
    718 		}
    719 		if (!sp)
    720 			break;
    721 		if ((error = copyinstr(sp, dp, len, &len)) != 0) {
    722 			DPRINTF(("%s: copyinstr args %d\n", __func__, error));
    723 			if (error == ENAMETOOLONG)
    724 				error = E2BIG;
    725 			goto bad;
    726 		}
    727 		ktrexecarg(dp, len - 1);
    728 		dp += len;
    729 		i++;
    730 		data->ed_argc++;
    731 	}
    732 
    733 	data->ed_envc = 0;
    734 	/* environment need not be there */
    735 	if (envs != NULL) {
    736 		i = 0;
    737 		while (1) {
    738 			len = data->ed_argp + ARG_MAX - dp;
    739 			if ((error = (*fetch_element)(envs, i, &sp)) != 0) {
    740 				DPRINTF(("%s: fetch_element env %d\n",
    741 				    __func__, error));
    742 				goto bad;
    743 			}
    744 			if (!sp)
    745 				break;
    746 			if ((error = copyinstr(sp, dp, len, &len)) != 0) {
    747 				DPRINTF(("%s: copyinstr env %d\n",
    748 				    __func__, error));
    749 				if (error == ENAMETOOLONG)
    750 					error = E2BIG;
    751 				goto bad;
    752 			}
    753 
    754 			ktrexecenv(dp, len - 1);
    755 			dp += len;
    756 			i++;
    757 			data->ed_envc++;
    758 		}
    759 	}
    760 
    761 	dp = (char *) ALIGN(dp);
    762 
    763 	data->ed_szsigcode = data->ed_pack.ep_esch->es_emul->e_esigcode -
    764 	    data->ed_pack.ep_esch->es_emul->e_sigcode;
    765 
    766 #ifdef __MACHINE_STACK_GROWS_UP
    767 /* See big comment lower down */
    768 #define	RTLD_GAP	32
    769 #else
    770 #define	RTLD_GAP	0
    771 #endif
    772 
    773 	/* Now check if args & environ fit into new stack */
    774 	if (data->ed_pack.ep_flags & EXEC_32) {
    775 		data->ed_ps_strings_sz = sizeof(struct ps_strings32);
    776 		len = ((data->ed_argc + data->ed_envc + 2 +
    777 		    data->ed_pack.ep_esch->es_arglen) *
    778 		    sizeof(int) + sizeof(int) + dp + RTLD_GAP +
    779 		    data->ed_szsigcode + data->ed_ps_strings_sz + STACK_PTHREADSPACE)
    780 		    - data->ed_argp;
    781 	} else {
    782 		data->ed_ps_strings_sz = sizeof(struct ps_strings);
    783 		len = ((data->ed_argc + data->ed_envc + 2 +
    784 		    data->ed_pack.ep_esch->es_arglen) *
    785 		    sizeof(char *) + sizeof(int) + dp + RTLD_GAP +
    786 		    data->ed_szsigcode + data->ed_ps_strings_sz + STACK_PTHREADSPACE)
    787 		    - data->ed_argp;
    788 	}
    789 
    790 #ifdef PAX_ASLR
    791 	if (pax_aslr_active(l))
    792 		len += (cprng_fast32() % PAGE_SIZE);
    793 #endif /* PAX_ASLR */
    794 
    795 	/* make the stack "safely" aligned */
    796 	len = STACK_LEN_ALIGN(len, STACK_ALIGNBYTES);
    797 
    798 	if (len > data->ed_pack.ep_ssize) {
    799 		/* in effect, compare to initial limit */
    800 		DPRINTF(("%s: stack limit exceeded %zu\n", __func__, len));
    801 		goto bad;
    802 	}
    803 	/* adjust "active stack depth" for process VSZ */
    804 	data->ed_pack.ep_ssize = len;
    805 
    806 	return 0;
    807 
    808  bad:
    809 	/* free the vmspace-creation commands, and release their references */
    810 	kill_vmcmds(&data->ed_pack.ep_vmcmds);
    811 	/* kill any opened file descriptor, if necessary */
    812 	if (data->ed_pack.ep_flags & EXEC_HASFD) {
    813 		data->ed_pack.ep_flags &= ~EXEC_HASFD;
    814 		fd_close(data->ed_pack.ep_fd);
    815 	}
    816 	/* close and put the exec'd file */
    817 	vn_lock(data->ed_pack.ep_vp, LK_EXCLUSIVE | LK_RETRY);
    818 	VOP_CLOSE(data->ed_pack.ep_vp, FREAD, l->l_cred);
    819 	vput(data->ed_pack.ep_vp);
    820 	pool_put(&exec_pool, data->ed_argp);
    821 
    822  freehdr:
    823 	kmem_free(data->ed_pack.ep_hdr, data->ed_pack.ep_hdrlen);
    824 	if (data->ed_pack.ep_emul_root != NULL)
    825 		vrele(data->ed_pack.ep_emul_root);
    826 	if (data->ed_pack.ep_interp != NULL)
    827 		vrele(data->ed_pack.ep_interp);
    828 
    829 	rw_exit(&exec_lock);
    830 
    831 	pathbuf_stringcopy_put(data->ed_pathbuf, data->ed_pathstring);
    832 	pathbuf_destroy(data->ed_pathbuf);
    833 	PNBUF_PUT(data->ed_resolvedpathbuf);
    834 
    835  clrflg:
    836 	rw_exit(&p->p_reflock);
    837 
    838 	if (modgen != module_gen && error == ENOEXEC) {
    839 		modgen = module_gen;
    840 		exec_autoload();
    841 		goto retry;
    842 	}
    843 
    844 	SDT_PROBE(proc,,,exec_failure, error, 0, 0, 0, 0);
    845 	return error;
    846 }
    847 
    848 static void
    849 execve_free_data(struct execve_data *data)
    850 {
    851 
    852 	/* free the vmspace-creation commands, and release their references */
    853 	kill_vmcmds(&data->ed_pack.ep_vmcmds);
    854 	/* kill any opened file descriptor, if necessary */
    855 	if (data->ed_pack.ep_flags & EXEC_HASFD) {
    856 		data->ed_pack.ep_flags &= ~EXEC_HASFD;
    857 		fd_close(data->ed_pack.ep_fd);
    858 	}
    859 
    860 	/* close and put the exec'd file */
    861 	vn_lock(data->ed_pack.ep_vp, LK_EXCLUSIVE | LK_RETRY);
    862 	VOP_CLOSE(data->ed_pack.ep_vp, FREAD, curlwp->l_cred);
    863 	vput(data->ed_pack.ep_vp);
    864 	pool_put(&exec_pool, data->ed_argp);
    865 
    866 	kmem_free(data->ed_pack.ep_hdr, data->ed_pack.ep_hdrlen);
    867 	if (data->ed_pack.ep_emul_root != NULL)
    868 		vrele(data->ed_pack.ep_emul_root);
    869 	if (data->ed_pack.ep_interp != NULL)
    870 		vrele(data->ed_pack.ep_interp);
    871 
    872 	pathbuf_stringcopy_put(data->ed_pathbuf, data->ed_pathstring);
    873 	pathbuf_destroy(data->ed_pathbuf);
    874 	PNBUF_PUT(data->ed_resolvedpathbuf);
    875 }
    876 
    877 static int
    878 execve_runproc(struct lwp *l, struct execve_data * restrict data,
    879 	bool no_local_exec_lock, bool is_spawn)
    880 {
    881 	int error = 0;
    882 	struct proc		*p;
    883 	size_t			i;
    884 	char			*stack, *dp;
    885 	const char		*commandname;
    886 	struct ps_strings32	arginfo32;
    887 	struct exec_vmcmd	*base_vcp;
    888 	void			*aip;
    889 	struct vmspace		*vm;
    890 	ksiginfo_t		ksi;
    891 	ksiginfoq_t		kq;
    892 
    893 	/*
    894 	 * In case of a posix_spawn operation, the child doing the exec
    895 	 * might not hold the reader lock on exec_lock, but the parent
    896 	 * will do this instead.
    897 	 */
    898 	KASSERT(no_local_exec_lock || rw_lock_held(&exec_lock));
    899 	KASSERT(data != NULL);
    900 	if (data == NULL)
    901 		return (EINVAL);
    902 
    903 	p = l->l_proc;
    904 	if (no_local_exec_lock)
    905 		KASSERT(is_spawn);
    906 
    907 	base_vcp = NULL;
    908 
    909 	if (data->ed_pack.ep_flags & EXEC_32)
    910 		aip = &arginfo32;
    911 	else
    912 		aip = &data->ed_arginfo;
    913 
    914 	/* Get rid of other LWPs. */
    915 	if (p->p_nlwps > 1) {
    916 		mutex_enter(p->p_lock);
    917 		exit_lwps(l);
    918 		mutex_exit(p->p_lock);
    919 	}
    920 	KDASSERT(p->p_nlwps == 1);
    921 
    922 	/* Destroy any lwpctl info. */
    923 	if (p->p_lwpctl != NULL)
    924 		lwp_ctl_exit();
    925 
    926 	/* Remove POSIX timers */
    927 	timers_free(p, TIMERS_POSIX);
    928 
    929 	/*
    930 	 * Do whatever is necessary to prepare the address space
    931 	 * for remapping.  Note that this might replace the current
    932 	 * vmspace with another!
    933 	 */
    934 	if (is_spawn)
    935 		uvmspace_spawn(l, data->ed_pack.ep_vm_minaddr,
    936 		    data->ed_pack.ep_vm_maxaddr);
    937 	else
    938 		uvmspace_exec(l, data->ed_pack.ep_vm_minaddr,
    939 		    data->ed_pack.ep_vm_maxaddr);
    940 
    941 	/* record proc's vnode, for use by procfs and others */
    942         if (p->p_textvp)
    943                 vrele(p->p_textvp);
    944 	vref(data->ed_pack.ep_vp);
    945 	p->p_textvp = data->ed_pack.ep_vp;
    946 
    947 	/* Now map address space */
    948 	vm = p->p_vmspace;
    949 	vm->vm_taddr = (void *)data->ed_pack.ep_taddr;
    950 	vm->vm_tsize = btoc(data->ed_pack.ep_tsize);
    951 	vm->vm_daddr = (void*)data->ed_pack.ep_daddr;
    952 	vm->vm_dsize = btoc(data->ed_pack.ep_dsize);
    953 	vm->vm_ssize = btoc(data->ed_pack.ep_ssize);
    954 	vm->vm_issize = 0;
    955 	vm->vm_maxsaddr = (void *)data->ed_pack.ep_maxsaddr;
    956 	vm->vm_minsaddr = (void *)data->ed_pack.ep_minsaddr;
    957 
    958 #ifdef PAX_ASLR
    959 	pax_aslr_init(l, vm);
    960 #endif /* PAX_ASLR */
    961 
    962 	/* create the new process's VM space by running the vmcmds */
    963 #ifdef DIAGNOSTIC
    964 	if (data->ed_pack.ep_vmcmds.evs_used == 0)
    965 		panic("%s: no vmcmds", __func__);
    966 #endif
    967 
    968 #ifdef DEBUG_EXEC
    969 	{
    970 		size_t j;
    971 		struct exec_vmcmd *vp = &data->ed_pack.ep_vmcmds.evs_cmds[0];
    972 		DPRINTF(("vmcmds %u\n", data->ed_pack.ep_vmcmds.evs_used));
    973 		for (j = 0; j < data->ed_pack.ep_vmcmds.evs_used; j++) {
    974 			DPRINTF(("vmcmd[%zu] = vmcmd_map_%s %#"
    975 			    PRIxVADDR"/%#"PRIxVSIZE" fd@%#"
    976 			    PRIxVSIZE" prot=0%o flags=%d\n", j,
    977 			    vp[j].ev_proc == vmcmd_map_pagedvn ?
    978 			    "pagedvn" :
    979 			    vp[j].ev_proc == vmcmd_map_readvn ?
    980 			    "readvn" :
    981 			    vp[j].ev_proc == vmcmd_map_zero ?
    982 			    "zero" : "*unknown*",
    983 			    vp[j].ev_addr, vp[j].ev_len,
    984 			    vp[j].ev_offset, vp[j].ev_prot,
    985 			    vp[j].ev_flags));
    986 		}
    987 	}
    988 #endif	/* DEBUG_EXEC */
    989 
    990 	for (i = 0; i < data->ed_pack.ep_vmcmds.evs_used && !error; i++) {
    991 		struct exec_vmcmd *vcp;
    992 
    993 		vcp = &data->ed_pack.ep_vmcmds.evs_cmds[i];
    994 		if (vcp->ev_flags & VMCMD_RELATIVE) {
    995 #ifdef DIAGNOSTIC
    996 			if (base_vcp == NULL)
    997 				panic("%s: relative vmcmd with no base",
    998 				    __func__);
    999 			if (vcp->ev_flags & VMCMD_BASE)
   1000 				panic("%s: illegal base & relative vmcmd",
   1001 				    __func__);
   1002 #endif
   1003 			vcp->ev_addr += base_vcp->ev_addr;
   1004 		}
   1005 		error = (*vcp->ev_proc)(l, vcp);
   1006 #ifdef DEBUG_EXEC
   1007 		if (error) {
   1008 			size_t j;
   1009 			struct exec_vmcmd *vp =
   1010 			    &data->ed_pack.ep_vmcmds.evs_cmds[0];
   1011 			DPRINTF(("vmcmds %zu/%u, error %d\n", i,
   1012 			    data->ed_pack.ep_vmcmds.evs_used, error));
   1013 			for (j = 0; j < data->ed_pack.ep_vmcmds.evs_used; j++) {
   1014 				DPRINTF(("vmcmd[%zu] = vmcmd_map_%s %#"
   1015 				    PRIxVADDR"/%#"PRIxVSIZE" fd@%#"
   1016 				    PRIxVSIZE" prot=0%o flags=%d\n", j,
   1017 				    vp[j].ev_proc == vmcmd_map_pagedvn ?
   1018 				    "pagedvn" :
   1019 				    vp[j].ev_proc == vmcmd_map_readvn ?
   1020 				    "readvn" :
   1021 				    vp[j].ev_proc == vmcmd_map_zero ?
   1022 				    "zero" : "*unknown*",
   1023 				    vp[j].ev_addr, vp[j].ev_len,
   1024 				    vp[j].ev_offset, vp[j].ev_prot,
   1025 				    vp[j].ev_flags));
   1026 				if (j == i)
   1027 					DPRINTF(("     ^--- failed\n"));
   1028 			}
   1029 		}
   1030 #endif /* DEBUG_EXEC */
   1031 		if (vcp->ev_flags & VMCMD_BASE)
   1032 			base_vcp = vcp;
   1033 	}
   1034 
   1035 	/* free the vmspace-creation commands, and release their references */
   1036 	kill_vmcmds(&data->ed_pack.ep_vmcmds);
   1037 
   1038 	vn_lock(data->ed_pack.ep_vp, LK_EXCLUSIVE | LK_RETRY);
   1039 	VOP_CLOSE(data->ed_pack.ep_vp, FREAD, l->l_cred);
   1040 	vput(data->ed_pack.ep_vp);
   1041 
   1042 	/* if an error happened, deallocate and punt */
   1043 	if (error) {
   1044 		DPRINTF(("%s: vmcmd %zu failed: %d\n", __func__, i - 1, error));
   1045 		goto exec_abort;
   1046 	}
   1047 
   1048 	/* remember information about the process */
   1049 	data->ed_arginfo.ps_nargvstr = data->ed_argc;
   1050 	data->ed_arginfo.ps_nenvstr = data->ed_envc;
   1051 
   1052 	/* set command name & other accounting info */
   1053 	commandname = strrchr(data->ed_pack.ep_resolvedname, '/');
   1054 	if (commandname != NULL) {
   1055 		commandname++;
   1056 	} else {
   1057 		commandname = data->ed_pack.ep_resolvedname;
   1058 	}
   1059 	i = min(strlen(commandname), MAXCOMLEN);
   1060 	(void)memcpy(p->p_comm, commandname, i);
   1061 	p->p_comm[i] = '\0';
   1062 
   1063 	dp = PNBUF_GET();
   1064 	/*
   1065 	 * If the path starts with /, we don't need to do any work.
   1066 	 * This handles the majority of the cases.
   1067 	 * In the future perhaps we could canonicalize it?
   1068 	 */
   1069 	if (data->ed_pathstring[0] == '/')
   1070 		(void)strlcpy(data->ed_pack.ep_path = dp, data->ed_pathstring,
   1071 		    MAXPATHLEN);
   1072 #ifdef notyet
   1073 	/*
   1074 	 * Although this works most of the time [since the entry was just
   1075 	 * entered in the cache] we don't use it because it theoretically
   1076 	 * can fail and it is not the cleanest interface, because there
   1077 	 * could be races. When the namei cache is re-written, this can
   1078 	 * be changed to use the appropriate function.
   1079 	 */
   1080 	else if (!(error = vnode_to_path(dp, MAXPATHLEN, p->p_textvp, l, p)))
   1081 		data->ed_pack.ep_path = dp;
   1082 #endif
   1083 	else {
   1084 #ifdef notyet
   1085 		printf("Cannot get path for pid %d [%s] (error %d)\n",
   1086 		    (int)p->p_pid, p->p_comm, error);
   1087 #endif
   1088 		data->ed_pack.ep_path = NULL;
   1089 		PNBUF_PUT(dp);
   1090 	}
   1091 
   1092 	stack = (char *)STACK_ALLOC(STACK_GROW(vm->vm_minsaddr,
   1093 		STACK_PTHREADSPACE + data->ed_ps_strings_sz + data->ed_szsigcode),
   1094 		data->ed_pack.ep_ssize - (data->ed_ps_strings_sz + data->ed_szsigcode));
   1095 
   1096 #ifdef __MACHINE_STACK_GROWS_UP
   1097 	/*
   1098 	 * The copyargs call always copies into lower addresses
   1099 	 * first, moving towards higher addresses, starting with
   1100 	 * the stack pointer that we give.  When the stack grows
   1101 	 * down, this puts argc/argv/envp very shallow on the
   1102 	 * stack, right at the first user stack pointer.
   1103 	 * When the stack grows up, the situation is reversed.
   1104 	 *
   1105 	 * Normally, this is no big deal.  But the ld_elf.so _rtld()
   1106 	 * function expects to be called with a single pointer to
   1107 	 * a region that has a few words it can stash values into,
   1108 	 * followed by argc/argv/envp.  When the stack grows down,
   1109 	 * it's easy to decrement the stack pointer a little bit to
   1110 	 * allocate the space for these few words and pass the new
   1111 	 * stack pointer to _rtld.  When the stack grows up, however,
   1112 	 * a few words before argc is part of the signal trampoline, XXX
   1113 	 * so we have a problem.
   1114 	 *
   1115 	 * Instead of changing how _rtld works, we take the easy way
   1116 	 * out and steal 32 bytes before we call copyargs.
   1117 	 * This extra space was allowed for when 'pack.ep_ssize' was calculated.
   1118 	 */
   1119 	stack += RTLD_GAP;
   1120 #endif /* __MACHINE_STACK_GROWS_UP */
   1121 
   1122 	/* Now copy argc, args & environ to new stack */
   1123 	error = (*data->ed_pack.ep_esch->es_copyargs)(l, &data->ed_pack,
   1124 	    &data->ed_arginfo, &stack, data->ed_argp);
   1125 
   1126 	if (data->ed_pack.ep_path) {
   1127 		PNBUF_PUT(data->ed_pack.ep_path);
   1128 		data->ed_pack.ep_path = NULL;
   1129 	}
   1130 	if (error) {
   1131 		DPRINTF(("%s: copyargs failed %d\n", __func__, error));
   1132 		goto exec_abort;
   1133 	}
   1134 	/* Move the stack back to original point */
   1135 	stack = (char *)STACK_GROW(vm->vm_minsaddr, data->ed_pack.ep_ssize);
   1136 
   1137 	/* fill process ps_strings info */
   1138 	p->p_psstrp = (vaddr_t)STACK_ALLOC(STACK_GROW(vm->vm_minsaddr,
   1139 	    STACK_PTHREADSPACE), data->ed_ps_strings_sz);
   1140 
   1141 	if (data->ed_pack.ep_flags & EXEC_32) {
   1142 		arginfo32.ps_argvstr = (vaddr_t)data->ed_arginfo.ps_argvstr;
   1143 		arginfo32.ps_nargvstr = data->ed_arginfo.ps_nargvstr;
   1144 		arginfo32.ps_envstr = (vaddr_t)data->ed_arginfo.ps_envstr;
   1145 		arginfo32.ps_nenvstr = data->ed_arginfo.ps_nenvstr;
   1146 	}
   1147 
   1148 	/* copy out the process's ps_strings structure */
   1149 	if ((error = copyout(aip, (void *)p->p_psstrp, data->ed_ps_strings_sz))
   1150 	    != 0) {
   1151 		DPRINTF(("%s: ps_strings copyout %p->%p size %zu failed\n",
   1152 		    __func__, aip, (void *)p->p_psstrp, data->ed_ps_strings_sz));
   1153 		goto exec_abort;
   1154 	}
   1155 
   1156 	cwdexec(p);
   1157 	fd_closeexec();		/* handle close on exec */
   1158 
   1159 	if (__predict_false(ktrace_on))
   1160 		fd_ktrexecfd();
   1161 
   1162 	execsigs(p);		/* reset catched signals */
   1163 
   1164 	l->l_ctxlink = NULL;	/* reset ucontext link */
   1165 
   1166 
   1167 	p->p_acflag &= ~AFORK;
   1168 	mutex_enter(p->p_lock);
   1169 	p->p_flag |= PK_EXEC;
   1170 	mutex_exit(p->p_lock);
   1171 
   1172 	/*
   1173 	 * Stop profiling.
   1174 	 */
   1175 	if ((p->p_stflag & PST_PROFIL) != 0) {
   1176 		mutex_spin_enter(&p->p_stmutex);
   1177 		stopprofclock(p);
   1178 		mutex_spin_exit(&p->p_stmutex);
   1179 	}
   1180 
   1181 	/*
   1182 	 * It's OK to test PL_PPWAIT unlocked here, as other LWPs have
   1183 	 * exited and exec()/exit() are the only places it will be cleared.
   1184 	 */
   1185 	if ((p->p_lflag & PL_PPWAIT) != 0) {
   1186 #if 0
   1187 		lwp_t *lp;
   1188 
   1189 		mutex_enter(proc_lock);
   1190 		lp = p->p_vforklwp;
   1191 		p->p_vforklwp = NULL;
   1192 
   1193 		l->l_lwpctl = NULL; /* was on loan from blocked parent */
   1194 		p->p_lflag &= ~PL_PPWAIT;
   1195 
   1196 		lp->l_pflag &= ~LP_VFORKWAIT; /* XXX */
   1197 		cv_broadcast(&lp->l_waitcv);
   1198 		mutex_exit(proc_lock);
   1199 #else
   1200 		mutex_enter(proc_lock);
   1201 		l->l_lwpctl = NULL; /* was on loan from blocked parent */
   1202 		p->p_lflag &= ~PL_PPWAIT;
   1203 		cv_broadcast(&p->p_pptr->p_waitcv);
   1204 		mutex_exit(proc_lock);
   1205 #endif
   1206 	}
   1207 
   1208 	/*
   1209 	 * Deal with set[ug]id.  MNT_NOSUID has already been used to disable
   1210 	 * s[ug]id.  It's OK to check for PSL_TRACED here as we have blocked
   1211 	 * out additional references on the process for the moment.
   1212 	 */
   1213 	if ((p->p_slflag & PSL_TRACED) == 0 &&
   1214 
   1215 	    (((data->ed_attr.va_mode & S_ISUID) != 0 &&
   1216 	      kauth_cred_geteuid(l->l_cred) != data->ed_attr.va_uid) ||
   1217 
   1218 	     ((data->ed_attr.va_mode & S_ISGID) != 0 &&
   1219 	      kauth_cred_getegid(l->l_cred) != data->ed_attr.va_gid))) {
   1220 		/*
   1221 		 * Mark the process as SUGID before we do
   1222 		 * anything that might block.
   1223 		 */
   1224 		proc_crmod_enter();
   1225 		proc_crmod_leave(NULL, NULL, true);
   1226 
   1227 		/* Make sure file descriptors 0..2 are in use. */
   1228 		if ((error = fd_checkstd()) != 0) {
   1229 			DPRINTF(("%s: fdcheckstd failed %d\n",
   1230 			    __func__, error));
   1231 			goto exec_abort;
   1232 		}
   1233 
   1234 		/*
   1235 		 * Copy the credential so other references don't see our
   1236 		 * changes.
   1237 		 */
   1238 		l->l_cred = kauth_cred_copy(l->l_cred);
   1239 #ifdef KTRACE
   1240 		/*
   1241 		 * If the persistent trace flag isn't set, turn off.
   1242 		 */
   1243 		if (p->p_tracep) {
   1244 			mutex_enter(&ktrace_lock);
   1245 			if (!(p->p_traceflag & KTRFAC_PERSISTENT))
   1246 				ktrderef(p);
   1247 			mutex_exit(&ktrace_lock);
   1248 		}
   1249 #endif
   1250 		if (data->ed_attr.va_mode & S_ISUID)
   1251 			kauth_cred_seteuid(l->l_cred, data->ed_attr.va_uid);
   1252 		if (data->ed_attr.va_mode & S_ISGID)
   1253 			kauth_cred_setegid(l->l_cred, data->ed_attr.va_gid);
   1254 	} else {
   1255 		if (kauth_cred_geteuid(l->l_cred) ==
   1256 		    kauth_cred_getuid(l->l_cred) &&
   1257 		    kauth_cred_getegid(l->l_cred) ==
   1258 		    kauth_cred_getgid(l->l_cred))
   1259 			p->p_flag &= ~PK_SUGID;
   1260 	}
   1261 
   1262 	/*
   1263 	 * Copy the credential so other references don't see our changes.
   1264 	 * Test to see if this is necessary first, since in the common case
   1265 	 * we won't need a private reference.
   1266 	 */
   1267 	if (kauth_cred_geteuid(l->l_cred) != kauth_cred_getsvuid(l->l_cred) ||
   1268 	    kauth_cred_getegid(l->l_cred) != kauth_cred_getsvgid(l->l_cred)) {
   1269 		l->l_cred = kauth_cred_copy(l->l_cred);
   1270 		kauth_cred_setsvuid(l->l_cred, kauth_cred_geteuid(l->l_cred));
   1271 		kauth_cred_setsvgid(l->l_cred, kauth_cred_getegid(l->l_cred));
   1272 	}
   1273 
   1274 	/* Update the master credentials. */
   1275 	if (l->l_cred != p->p_cred) {
   1276 		kauth_cred_t ocred;
   1277 
   1278 		kauth_cred_hold(l->l_cred);
   1279 		mutex_enter(p->p_lock);
   1280 		ocred = p->p_cred;
   1281 		p->p_cred = l->l_cred;
   1282 		mutex_exit(p->p_lock);
   1283 		kauth_cred_free(ocred);
   1284 	}
   1285 
   1286 #if defined(__HAVE_RAS)
   1287 	/*
   1288 	 * Remove all RASs from the address space.
   1289 	 */
   1290 	ras_purgeall();
   1291 #endif
   1292 
   1293 	doexechooks(p);
   1294 
   1295 	/* setup new registers and do misc. setup. */
   1296 	(*data->ed_pack.ep_esch->es_emul->e_setregs)(l, &data->ed_pack,
   1297 	     (vaddr_t)stack);
   1298 	if (data->ed_pack.ep_esch->es_setregs)
   1299 		(*data->ed_pack.ep_esch->es_setregs)(l, &data->ed_pack,
   1300 		    (vaddr_t)stack);
   1301 
   1302 	/* Provide a consistent LWP private setting */
   1303 	(void)lwp_setprivate(l, NULL);
   1304 
   1305 	/* Discard all PCU state; need to start fresh */
   1306 	pcu_discard_all(l);
   1307 
   1308 	/* map the process's signal trampoline code */
   1309 	if ((error = exec_sigcode_map(p, data->ed_pack.ep_esch->es_emul)) != 0) {
   1310 		DPRINTF(("%s: map sigcode failed %d\n", __func__, error));
   1311 		goto exec_abort;
   1312 	}
   1313 
   1314 	pool_put(&exec_pool, data->ed_argp);
   1315 
   1316 	/* notify others that we exec'd */
   1317 	KNOTE(&p->p_klist, NOTE_EXEC);
   1318 
   1319 	kmem_free(data->ed_pack.ep_hdr, data->ed_pack.ep_hdrlen);
   1320 
   1321 	SDT_PROBE(proc,,,exec_success, data->ed_pack.ep_name, 0, 0, 0, 0);
   1322 
   1323 	/* The emulation root will usually have been found when we looked
   1324 	 * for the elf interpreter (or similar), if not look now. */
   1325 	if (data->ed_pack.ep_esch->es_emul->e_path != NULL &&
   1326 	    data->ed_pack.ep_emul_root == NULL)
   1327 		emul_find_root(l, &data->ed_pack);
   1328 
   1329 	/* Any old emulation root got removed by fdcloseexec */
   1330 	rw_enter(&p->p_cwdi->cwdi_lock, RW_WRITER);
   1331 	p->p_cwdi->cwdi_edir = data->ed_pack.ep_emul_root;
   1332 	rw_exit(&p->p_cwdi->cwdi_lock);
   1333 	data->ed_pack.ep_emul_root = NULL;
   1334 	if (data->ed_pack.ep_interp != NULL)
   1335 		vrele(data->ed_pack.ep_interp);
   1336 
   1337 	/*
   1338 	 * Call emulation specific exec hook. This can setup per-process
   1339 	 * p->p_emuldata or do any other per-process stuff an emulation needs.
   1340 	 *
   1341 	 * If we are executing process of different emulation than the
   1342 	 * original forked process, call e_proc_exit() of the old emulation
   1343 	 * first, then e_proc_exec() of new emulation. If the emulation is
   1344 	 * same, the exec hook code should deallocate any old emulation
   1345 	 * resources held previously by this process.
   1346 	 */
   1347 	if (p->p_emul && p->p_emul->e_proc_exit
   1348 	    && p->p_emul != data->ed_pack.ep_esch->es_emul)
   1349 		(*p->p_emul->e_proc_exit)(p);
   1350 
   1351 	/*
   1352 	 * This is now LWP 1.
   1353 	 */
   1354 	mutex_enter(p->p_lock);
   1355 	p->p_nlwpid = 1;
   1356 	l->l_lid = 1;
   1357 	mutex_exit(p->p_lock);
   1358 
   1359 	/*
   1360 	 * Call exec hook. Emulation code may NOT store reference to anything
   1361 	 * from &pack.
   1362 	 */
   1363 	if (data->ed_pack.ep_esch->es_emul->e_proc_exec)
   1364 		(*data->ed_pack.ep_esch->es_emul->e_proc_exec)(p, &data->ed_pack);
   1365 
   1366 	/* update p_emul, the old value is no longer needed */
   1367 	p->p_emul = data->ed_pack.ep_esch->es_emul;
   1368 
   1369 	/* ...and the same for p_execsw */
   1370 	p->p_execsw = data->ed_pack.ep_esch;
   1371 
   1372 #ifdef __HAVE_SYSCALL_INTERN
   1373 	(*p->p_emul->e_syscall_intern)(p);
   1374 #endif
   1375 	ktremul();
   1376 
   1377 	/* Allow new references from the debugger/procfs. */
   1378 	rw_exit(&p->p_reflock);
   1379 	if (!no_local_exec_lock)
   1380 		rw_exit(&exec_lock);
   1381 
   1382 	mutex_enter(proc_lock);
   1383 
   1384 	if ((p->p_slflag & (PSL_TRACED|PSL_SYSCALL)) == PSL_TRACED) {
   1385 		KSI_INIT_EMPTY(&ksi);
   1386 		ksi.ksi_signo = SIGTRAP;
   1387 		ksi.ksi_lid = l->l_lid;
   1388 		kpsignal(p, &ksi, NULL);
   1389 	}
   1390 
   1391 	if (p->p_sflag & PS_STOPEXEC) {
   1392 		KERNEL_UNLOCK_ALL(l, &l->l_biglocks);
   1393 		p->p_pptr->p_nstopchild++;
   1394 		p->p_pptr->p_waited = 0;
   1395 		mutex_enter(p->p_lock);
   1396 		ksiginfo_queue_init(&kq);
   1397 		sigclearall(p, &contsigmask, &kq);
   1398 		lwp_lock(l);
   1399 		l->l_stat = LSSTOP;
   1400 		p->p_stat = SSTOP;
   1401 		p->p_nrlwps--;
   1402 		lwp_unlock(l);
   1403 		mutex_exit(p->p_lock);
   1404 		mutex_exit(proc_lock);
   1405 		lwp_lock(l);
   1406 		mi_switch(l);
   1407 		ksiginfo_queue_drain(&kq);
   1408 		KERNEL_LOCK(l->l_biglocks, l);
   1409 	} else {
   1410 		mutex_exit(proc_lock);
   1411 	}
   1412 
   1413 	pathbuf_stringcopy_put(data->ed_pathbuf, data->ed_pathstring);
   1414 	pathbuf_destroy(data->ed_pathbuf);
   1415 	PNBUF_PUT(data->ed_resolvedpathbuf);
   1416 	DPRINTF(("%s finished\n", __func__));
   1417 	return (EJUSTRETURN);
   1418 
   1419  exec_abort:
   1420 	SDT_PROBE(proc,,,exec_failure, error, 0, 0, 0, 0);
   1421 	rw_exit(&p->p_reflock);
   1422 	if (!no_local_exec_lock)
   1423 		rw_exit(&exec_lock);
   1424 
   1425 	pathbuf_stringcopy_put(data->ed_pathbuf, data->ed_pathstring);
   1426 	pathbuf_destroy(data->ed_pathbuf);
   1427 	PNBUF_PUT(data->ed_resolvedpathbuf);
   1428 
   1429 	/*
   1430 	 * the old process doesn't exist anymore.  exit gracefully.
   1431 	 * get rid of the (new) address space we have created, if any, get rid
   1432 	 * of our namei data and vnode, and exit noting failure
   1433 	 */
   1434 	uvm_deallocate(&vm->vm_map, VM_MIN_ADDRESS,
   1435 		VM_MAXUSER_ADDRESS - VM_MIN_ADDRESS);
   1436 
   1437 	exec_free_emul_arg(&data->ed_pack);
   1438 	pool_put(&exec_pool, data->ed_argp);
   1439 	kmem_free(data->ed_pack.ep_hdr, data->ed_pack.ep_hdrlen);
   1440 	if (data->ed_pack.ep_emul_root != NULL)
   1441 		vrele(data->ed_pack.ep_emul_root);
   1442 	if (data->ed_pack.ep_interp != NULL)
   1443 		vrele(data->ed_pack.ep_interp);
   1444 
   1445 	/* Acquire the sched-state mutex (exit1() will release it). */
   1446 	if (!is_spawn) {
   1447 		mutex_enter(p->p_lock);
   1448 		exit1(l, W_EXITCODE(error, SIGABRT));
   1449 	}
   1450 
   1451 	return error;
   1452 }
   1453 
   1454 int
   1455 execve1(struct lwp *l, const char *path, char * const *args,
   1456     char * const *envs, execve_fetch_element_t fetch_element)
   1457 {
   1458 	struct execve_data data;
   1459 	int error;
   1460 
   1461 	error = execve_loadvm(l, path, args, envs, fetch_element, &data);
   1462 	if (error)
   1463 		return error;
   1464 	error = execve_runproc(l, &data, false, false);
   1465 	return error;
   1466 }
   1467 
   1468 int
   1469 copyargs(struct lwp *l, struct exec_package *pack, struct ps_strings *arginfo,
   1470     char **stackp, void *argp)
   1471 {
   1472 	char	**cpp, *dp, *sp;
   1473 	size_t	len;
   1474 	void	*nullp;
   1475 	long	argc, envc;
   1476 	int	error;
   1477 
   1478 	cpp = (char **)*stackp;
   1479 	nullp = NULL;
   1480 	argc = arginfo->ps_nargvstr;
   1481 	envc = arginfo->ps_nenvstr;
   1482 	if ((error = copyout(&argc, cpp++, sizeof(argc))) != 0) {
   1483 		COPYPRINTF("", cpp - 1, sizeof(argc));
   1484 		return error;
   1485 	}
   1486 
   1487 	dp = (char *) (cpp + argc + envc + 2 + pack->ep_esch->es_arglen);
   1488 	sp = argp;
   1489 
   1490 	/* XXX don't copy them out, remap them! */
   1491 	arginfo->ps_argvstr = cpp; /* remember location of argv for later */
   1492 
   1493 	for (; --argc >= 0; sp += len, dp += len) {
   1494 		if ((error = copyout(&dp, cpp++, sizeof(dp))) != 0) {
   1495 			COPYPRINTF("", cpp - 1, sizeof(dp));
   1496 			return error;
   1497 		}
   1498 		if ((error = copyoutstr(sp, dp, ARG_MAX, &len)) != 0) {
   1499 			COPYPRINTF("str", dp, (size_t)ARG_MAX);
   1500 			return error;
   1501 		}
   1502 	}
   1503 
   1504 	if ((error = copyout(&nullp, cpp++, sizeof(nullp))) != 0) {
   1505 		COPYPRINTF("", cpp - 1, sizeof(nullp));
   1506 		return error;
   1507 	}
   1508 
   1509 	arginfo->ps_envstr = cpp; /* remember location of envp for later */
   1510 
   1511 	for (; --envc >= 0; sp += len, dp += len) {
   1512 		if ((error = copyout(&dp, cpp++, sizeof(dp))) != 0) {
   1513 			COPYPRINTF("", cpp - 1, sizeof(dp));
   1514 			return error;
   1515 		}
   1516 		if ((error = copyoutstr(sp, dp, ARG_MAX, &len)) != 0) {
   1517 			COPYPRINTF("str", dp, (size_t)ARG_MAX);
   1518 			return error;
   1519 		}
   1520 
   1521 	}
   1522 
   1523 	if ((error = copyout(&nullp, cpp++, sizeof(nullp))) != 0) {
   1524 		COPYPRINTF("", cpp - 1, sizeof(nullp));
   1525 		return error;
   1526 	}
   1527 
   1528 	*stackp = (char *)cpp;
   1529 	return 0;
   1530 }
   1531 
   1532 
   1533 /*
   1534  * Add execsw[] entries.
   1535  */
   1536 int
   1537 exec_add(struct execsw *esp, int count)
   1538 {
   1539 	struct exec_entry	*it;
   1540 	int			i;
   1541 
   1542 	if (count == 0) {
   1543 		return 0;
   1544 	}
   1545 
   1546 	/* Check for duplicates. */
   1547 	rw_enter(&exec_lock, RW_WRITER);
   1548 	for (i = 0; i < count; i++) {
   1549 		LIST_FOREACH(it, &ex_head, ex_list) {
   1550 			/* assume unique (makecmds, probe_func, emulation) */
   1551 			if (it->ex_sw->es_makecmds == esp[i].es_makecmds &&
   1552 			    it->ex_sw->u.elf_probe_func ==
   1553 			    esp[i].u.elf_probe_func &&
   1554 			    it->ex_sw->es_emul == esp[i].es_emul) {
   1555 				rw_exit(&exec_lock);
   1556 				return EEXIST;
   1557 			}
   1558 		}
   1559 	}
   1560 
   1561 	/* Allocate new entries. */
   1562 	for (i = 0; i < count; i++) {
   1563 		it = kmem_alloc(sizeof(*it), KM_SLEEP);
   1564 		it->ex_sw = &esp[i];
   1565 		LIST_INSERT_HEAD(&ex_head, it, ex_list);
   1566 	}
   1567 
   1568 	/* update execsw[] */
   1569 	exec_init(0);
   1570 	rw_exit(&exec_lock);
   1571 	return 0;
   1572 }
   1573 
   1574 /*
   1575  * Remove execsw[] entry.
   1576  */
   1577 int
   1578 exec_remove(struct execsw *esp, int count)
   1579 {
   1580 	struct exec_entry	*it, *next;
   1581 	int			i;
   1582 	const struct proclist_desc *pd;
   1583 	proc_t			*p;
   1584 
   1585 	if (count == 0) {
   1586 		return 0;
   1587 	}
   1588 
   1589 	/* Abort if any are busy. */
   1590 	rw_enter(&exec_lock, RW_WRITER);
   1591 	for (i = 0; i < count; i++) {
   1592 		mutex_enter(proc_lock);
   1593 		for (pd = proclists; pd->pd_list != NULL; pd++) {
   1594 			PROCLIST_FOREACH(p, pd->pd_list) {
   1595 				if (p->p_execsw == &esp[i]) {
   1596 					mutex_exit(proc_lock);
   1597 					rw_exit(&exec_lock);
   1598 					return EBUSY;
   1599 				}
   1600 			}
   1601 		}
   1602 		mutex_exit(proc_lock);
   1603 	}
   1604 
   1605 	/* None are busy, so remove them all. */
   1606 	for (i = 0; i < count; i++) {
   1607 		for (it = LIST_FIRST(&ex_head); it != NULL; it = next) {
   1608 			next = LIST_NEXT(it, ex_list);
   1609 			if (it->ex_sw == &esp[i]) {
   1610 				LIST_REMOVE(it, ex_list);
   1611 				kmem_free(it, sizeof(*it));
   1612 				break;
   1613 			}
   1614 		}
   1615 	}
   1616 
   1617 	/* update execsw[] */
   1618 	exec_init(0);
   1619 	rw_exit(&exec_lock);
   1620 	return 0;
   1621 }
   1622 
   1623 /*
   1624  * Initialize exec structures. If init_boot is true, also does necessary
   1625  * one-time initialization (it's called from main() that way).
   1626  * Once system is multiuser, this should be called with exec_lock held,
   1627  * i.e. via exec_{add|remove}().
   1628  */
   1629 int
   1630 exec_init(int init_boot)
   1631 {
   1632 	const struct execsw 	**sw;
   1633 	struct exec_entry	*ex;
   1634 	SLIST_HEAD(,exec_entry)	first;
   1635 	SLIST_HEAD(,exec_entry)	any;
   1636 	SLIST_HEAD(,exec_entry)	last;
   1637 	int			i, sz;
   1638 
   1639 	if (init_boot) {
   1640 		/* do one-time initializations */
   1641 		rw_init(&exec_lock);
   1642 		mutex_init(&sigobject_lock, MUTEX_DEFAULT, IPL_NONE);
   1643 		pool_init(&exec_pool, NCARGS, 0, 0, PR_NOALIGN|PR_NOTOUCH,
   1644 		    "execargs", &exec_palloc, IPL_NONE);
   1645 		pool_sethardlimit(&exec_pool, maxexec, "should not happen", 0);
   1646 	} else {
   1647 		KASSERT(rw_write_held(&exec_lock));
   1648 	}
   1649 
   1650 	/* Sort each entry onto the appropriate queue. */
   1651 	SLIST_INIT(&first);
   1652 	SLIST_INIT(&any);
   1653 	SLIST_INIT(&last);
   1654 	sz = 0;
   1655 	LIST_FOREACH(ex, &ex_head, ex_list) {
   1656 		switch(ex->ex_sw->es_prio) {
   1657 		case EXECSW_PRIO_FIRST:
   1658 			SLIST_INSERT_HEAD(&first, ex, ex_slist);
   1659 			break;
   1660 		case EXECSW_PRIO_ANY:
   1661 			SLIST_INSERT_HEAD(&any, ex, ex_slist);
   1662 			break;
   1663 		case EXECSW_PRIO_LAST:
   1664 			SLIST_INSERT_HEAD(&last, ex, ex_slist);
   1665 			break;
   1666 		default:
   1667 			panic("%s", __func__);
   1668 			break;
   1669 		}
   1670 		sz++;
   1671 	}
   1672 
   1673 	/*
   1674 	 * Create new execsw[].  Ensure we do not try a zero-sized
   1675 	 * allocation.
   1676 	 */
   1677 	sw = kmem_alloc(sz * sizeof(struct execsw *) + 1, KM_SLEEP);
   1678 	i = 0;
   1679 	SLIST_FOREACH(ex, &first, ex_slist) {
   1680 		sw[i++] = ex->ex_sw;
   1681 	}
   1682 	SLIST_FOREACH(ex, &any, ex_slist) {
   1683 		sw[i++] = ex->ex_sw;
   1684 	}
   1685 	SLIST_FOREACH(ex, &last, ex_slist) {
   1686 		sw[i++] = ex->ex_sw;
   1687 	}
   1688 
   1689 	/* Replace old execsw[] and free used memory. */
   1690 	if (execsw != NULL) {
   1691 		kmem_free(__UNCONST(execsw),
   1692 		    nexecs * sizeof(struct execsw *) + 1);
   1693 	}
   1694 	execsw = sw;
   1695 	nexecs = sz;
   1696 
   1697 	/* Figure out the maximum size of an exec header. */
   1698 	exec_maxhdrsz = sizeof(int);
   1699 	for (i = 0; i < nexecs; i++) {
   1700 		if (execsw[i]->es_hdrsz > exec_maxhdrsz)
   1701 			exec_maxhdrsz = execsw[i]->es_hdrsz;
   1702 	}
   1703 
   1704 	return 0;
   1705 }
   1706 
   1707 static int
   1708 exec_sigcode_map(struct proc *p, const struct emul *e)
   1709 {
   1710 	vaddr_t va;
   1711 	vsize_t sz;
   1712 	int error;
   1713 	struct uvm_object *uobj;
   1714 
   1715 	sz = (vaddr_t)e->e_esigcode - (vaddr_t)e->e_sigcode;
   1716 
   1717 	if (e->e_sigobject == NULL || sz == 0) {
   1718 		return 0;
   1719 	}
   1720 
   1721 	/*
   1722 	 * If we don't have a sigobject for this emulation, create one.
   1723 	 *
   1724 	 * sigobject is an anonymous memory object (just like SYSV shared
   1725 	 * memory) that we keep a permanent reference to and that we map
   1726 	 * in all processes that need this sigcode. The creation is simple,
   1727 	 * we create an object, add a permanent reference to it, map it in
   1728 	 * kernel space, copy out the sigcode to it and unmap it.
   1729 	 * We map it with PROT_READ|PROT_EXEC into the process just
   1730 	 * the way sys_mmap() would map it.
   1731 	 */
   1732 
   1733 	uobj = *e->e_sigobject;
   1734 	if (uobj == NULL) {
   1735 		mutex_enter(&sigobject_lock);
   1736 		if ((uobj = *e->e_sigobject) == NULL) {
   1737 			uobj = uao_create(sz, 0);
   1738 			(*uobj->pgops->pgo_reference)(uobj);
   1739 			va = vm_map_min(kernel_map);
   1740 			if ((error = uvm_map(kernel_map, &va, round_page(sz),
   1741 			    uobj, 0, 0,
   1742 			    UVM_MAPFLAG(UVM_PROT_RW, UVM_PROT_RW,
   1743 			    UVM_INH_SHARE, UVM_ADV_RANDOM, 0)))) {
   1744 				printf("kernel mapping failed %d\n", error);
   1745 				(*uobj->pgops->pgo_detach)(uobj);
   1746 				mutex_exit(&sigobject_lock);
   1747 				return (error);
   1748 			}
   1749 			memcpy((void *)va, e->e_sigcode, sz);
   1750 #ifdef PMAP_NEED_PROCWR
   1751 			pmap_procwr(&proc0, va, sz);
   1752 #endif
   1753 			uvm_unmap(kernel_map, va, va + round_page(sz));
   1754 			*e->e_sigobject = uobj;
   1755 		}
   1756 		mutex_exit(&sigobject_lock);
   1757 	}
   1758 
   1759 	/* Just a hint to uvm_map where to put it. */
   1760 	va = e->e_vm_default_addr(p, (vaddr_t)p->p_vmspace->vm_daddr,
   1761 	    round_page(sz));
   1762 
   1763 #ifdef __alpha__
   1764 	/*
   1765 	 * Tru64 puts /sbin/loader at the end of user virtual memory,
   1766 	 * which causes the above calculation to put the sigcode at
   1767 	 * an invalid address.  Put it just below the text instead.
   1768 	 */
   1769 	if (va == (vaddr_t)vm_map_max(&p->p_vmspace->vm_map)) {
   1770 		va = (vaddr_t)p->p_vmspace->vm_taddr - round_page(sz);
   1771 	}
   1772 #endif
   1773 
   1774 	(*uobj->pgops->pgo_reference)(uobj);
   1775 	error = uvm_map(&p->p_vmspace->vm_map, &va, round_page(sz),
   1776 			uobj, 0, 0,
   1777 			UVM_MAPFLAG(UVM_PROT_RX, UVM_PROT_RX, UVM_INH_SHARE,
   1778 				    UVM_ADV_RANDOM, 0));
   1779 	if (error) {
   1780 		DPRINTF(("%s, %d: map %p "
   1781 		    "uvm_map %#"PRIxVSIZE"@%#"PRIxVADDR" failed %d\n",
   1782 		    __func__, __LINE__, &p->p_vmspace->vm_map, round_page(sz),
   1783 		    va, error));
   1784 		(*uobj->pgops->pgo_detach)(uobj);
   1785 		return (error);
   1786 	}
   1787 	p->p_sigctx.ps_sigcode = (void *)va;
   1788 	return (0);
   1789 }
   1790 
   1791 /*
   1792  * Release a refcount on spawn_exec_data and destroy memory, if this
   1793  * was the last one.
   1794  */
   1795 static void
   1796 spawn_exec_data_release(struct spawn_exec_data *data)
   1797 {
   1798 	if (atomic_dec_32_nv(&data->sed_refcnt) != 0)
   1799 		return;
   1800 
   1801 	cv_destroy(&data->sed_cv_child_ready);
   1802 	mutex_destroy(&data->sed_mtx_child);
   1803 
   1804 	if (data->sed_actions)
   1805 		posix_spawn_fa_free(data->sed_actions,
   1806 		    data->sed_actions->len);
   1807 	if (data->sed_attrs)
   1808 		kmem_free(data->sed_attrs,
   1809 		    sizeof(*data->sed_attrs));
   1810 	kmem_free(data, sizeof(*data));
   1811 }
   1812 
   1813 /*
   1814  * A child lwp of a posix_spawn operation starts here and ends up in
   1815  * cpu_spawn_return, dealing with all filedescriptor and scheduler
   1816  * manipulations in between.
   1817  * The parent waits for the child, as it is not clear wether the child
   1818  * will be able to aquire its own exec_lock. If it can, the parent can
   1819  * be released early and continue running in parallel. If not (or if the
   1820  * magic debug flag is passed in the scheduler attribute struct), the
   1821  * child rides on the parent's exec lock untill it is ready to return to
   1822  * to userland - and only then releases the parent. This method loses
   1823  * concurrency, but improves error reporting.
   1824  */
   1825 static void
   1826 spawn_return(void *arg)
   1827 {
   1828 	struct spawn_exec_data *spawn_data = arg;
   1829 	struct lwp *l = curlwp;
   1830 	int error, newfd;
   1831 	size_t i;
   1832 	const struct posix_spawn_file_actions_entry *fae;
   1833 	pid_t ppid;
   1834 	register_t retval;
   1835 	bool have_reflock;
   1836 	bool parent_is_waiting = true;
   1837 
   1838 	/*
   1839 	 * Check if we can release parent early.
   1840 	 * We either need to have no sed_attrs, or sed_attrs does not
   1841 	 * have POSIX_SPAWN_RETURNERROR or one of the flags, that require
   1842 	 * safe access to the parent proc (passed in sed_parent).
   1843 	 * We then try to get the exec_lock, and only if that works, we can
   1844 	 * release the parent here already.
   1845 	 */
   1846 	ppid = spawn_data->sed_parent->p_pid;
   1847 	if ((!spawn_data->sed_attrs
   1848 	    || (spawn_data->sed_attrs->sa_flags
   1849 	        & (POSIX_SPAWN_RETURNERROR|POSIX_SPAWN_SETPGROUP)) == 0)
   1850 	    && rw_tryenter(&exec_lock, RW_READER)) {
   1851 		parent_is_waiting = false;
   1852 		mutex_enter(&spawn_data->sed_mtx_child);
   1853 		cv_signal(&spawn_data->sed_cv_child_ready);
   1854 		mutex_exit(&spawn_data->sed_mtx_child);
   1855 	}
   1856 
   1857 	/* don't allow debugger access yet */
   1858 	rw_enter(&l->l_proc->p_reflock, RW_WRITER);
   1859 	have_reflock = true;
   1860 
   1861 	error = 0;
   1862 	/* handle posix_spawn_file_actions */
   1863 	if (spawn_data->sed_actions != NULL) {
   1864 		for (i = 0; i < spawn_data->sed_actions->len; i++) {
   1865 			fae = &spawn_data->sed_actions->fae[i];
   1866 			switch (fae->fae_action) {
   1867 			case FAE_OPEN:
   1868 				if (fd_getfile(fae->fae_fildes) != NULL) {
   1869 					error = fd_close(fae->fae_fildes);
   1870 					if (error)
   1871 						break;
   1872 				}
   1873 				error = fd_open(fae->fae_path, fae->fae_oflag,
   1874 				    fae->fae_mode, &newfd);
   1875  				if (error)
   1876  					break;
   1877 				if (newfd != fae->fae_fildes) {
   1878 					error = dodup(l, newfd,
   1879 					    fae->fae_fildes, 0, &retval);
   1880 					if (fd_getfile(newfd) != NULL)
   1881 						fd_close(newfd);
   1882 				}
   1883 				break;
   1884 			case FAE_DUP2:
   1885 				error = dodup(l, fae->fae_fildes,
   1886 				    fae->fae_newfildes, 0, &retval);
   1887 				break;
   1888 			case FAE_CLOSE:
   1889 				if (fd_getfile(fae->fae_fildes) == NULL) {
   1890 					error = EBADF;
   1891 					break;
   1892 				}
   1893 				error = fd_close(fae->fae_fildes);
   1894 				break;
   1895 			}
   1896 			if (error)
   1897 				goto report_error;
   1898 		}
   1899 	}
   1900 
   1901 	/* handle posix_spawnattr */
   1902 	if (spawn_data->sed_attrs != NULL) {
   1903 		int ostat;
   1904 		struct sigaction sigact;
   1905 		sigact._sa_u._sa_handler = SIG_DFL;
   1906 		sigact.sa_flags = 0;
   1907 
   1908 		/*
   1909 		 * set state to SSTOP so that this proc can be found by pid.
   1910 		 * see proc_enterprp, do_sched_setparam below
   1911 		 */
   1912 		ostat = l->l_proc->p_stat;
   1913 		l->l_proc->p_stat = SSTOP;
   1914 
   1915 		/* Set process group */
   1916 		if (spawn_data->sed_attrs->sa_flags & POSIX_SPAWN_SETPGROUP) {
   1917 			pid_t mypid = l->l_proc->p_pid,
   1918 			     pgrp = spawn_data->sed_attrs->sa_pgroup;
   1919 
   1920 			if (pgrp == 0)
   1921 				pgrp = mypid;
   1922 
   1923 			error = proc_enterpgrp(spawn_data->sed_parent,
   1924 			    mypid, pgrp, false);
   1925 			if (error)
   1926 				goto report_error;
   1927 		}
   1928 
   1929 		/* Set scheduler policy */
   1930 		if (spawn_data->sed_attrs->sa_flags & POSIX_SPAWN_SETSCHEDULER)
   1931 			error = do_sched_setparam(l->l_proc->p_pid, 0,
   1932 			    spawn_data->sed_attrs->sa_schedpolicy,
   1933 			    &spawn_data->sed_attrs->sa_schedparam);
   1934 		else if (spawn_data->sed_attrs->sa_flags
   1935 		    & POSIX_SPAWN_SETSCHEDPARAM) {
   1936 			error = do_sched_setparam(ppid, 0,
   1937 			    SCHED_NONE, &spawn_data->sed_attrs->sa_schedparam);
   1938 		}
   1939 		if (error)
   1940 			goto report_error;
   1941 
   1942 		/* Reset user ID's */
   1943 		if (spawn_data->sed_attrs->sa_flags & POSIX_SPAWN_RESETIDS) {
   1944 			error = do_setresuid(l, -1,
   1945 			     kauth_cred_getgid(l->l_cred), -1,
   1946 			     ID_E_EQ_R | ID_E_EQ_S);
   1947 			if (error)
   1948 				goto report_error;
   1949 			error = do_setresuid(l, -1,
   1950 			    kauth_cred_getuid(l->l_cred), -1,
   1951 			    ID_E_EQ_R | ID_E_EQ_S);
   1952 			if (error)
   1953 				goto report_error;
   1954 		}
   1955 
   1956 		/* Set signal masks/defaults */
   1957 		if (spawn_data->sed_attrs->sa_flags & POSIX_SPAWN_SETSIGMASK) {
   1958 			mutex_enter(l->l_proc->p_lock);
   1959 			error = sigprocmask1(l, SIG_SETMASK,
   1960 			    &spawn_data->sed_attrs->sa_sigmask, NULL);
   1961 			mutex_exit(l->l_proc->p_lock);
   1962 			if (error)
   1963 				goto report_error;
   1964 		}
   1965 
   1966 		if (spawn_data->sed_attrs->sa_flags & POSIX_SPAWN_SETSIGDEF) {
   1967 			for (i = 1; i <= NSIG; i++) {
   1968 				if (sigismember(
   1969 				    &spawn_data->sed_attrs->sa_sigdefault, i))
   1970 					sigaction1(l, i, &sigact, NULL, NULL,
   1971 					    0);
   1972 			}
   1973 		}
   1974 		l->l_proc->p_stat = ostat;
   1975 	}
   1976 
   1977 	/* now do the real exec */
   1978 	error = execve_runproc(l, &spawn_data->sed_exec, parent_is_waiting,
   1979 	    true);
   1980 	have_reflock = false;
   1981 	if (error == EJUSTRETURN)
   1982 		error = 0;
   1983 	else if (error)
   1984 		goto report_error;
   1985 
   1986 	if (parent_is_waiting) {
   1987 		mutex_enter(&spawn_data->sed_mtx_child);
   1988 		cv_signal(&spawn_data->sed_cv_child_ready);
   1989 		mutex_exit(&spawn_data->sed_mtx_child);
   1990 	}
   1991 
   1992 	/* release our refcount on the data */
   1993 	spawn_exec_data_release(spawn_data);
   1994 
   1995 	/* and finaly: leave to userland for the first time */
   1996 	cpu_spawn_return(l);
   1997 
   1998 	/* NOTREACHED */
   1999 	return;
   2000 
   2001  report_error:
   2002  	if (have_reflock) {
   2003  		/*
   2004 		 * We have not passed through execve_runproc(),
   2005 		 * which would have released the p_reflock and also
   2006 		 * taken ownership of the sed_exec part of spawn_data,
   2007 		 * so release/free both here.
   2008 		 */
   2009 		rw_exit(&l->l_proc->p_reflock);
   2010 		execve_free_data(&spawn_data->sed_exec);
   2011 	}
   2012 
   2013 	if (parent_is_waiting) {
   2014 		/* pass error to parent */
   2015 		mutex_enter(&spawn_data->sed_mtx_child);
   2016 		spawn_data->sed_error = error;
   2017 		cv_signal(&spawn_data->sed_cv_child_ready);
   2018 		mutex_exit(&spawn_data->sed_mtx_child);
   2019 	} else {
   2020 		rw_exit(&exec_lock);
   2021 	}
   2022 
   2023 	/* release our refcount on the data */
   2024 	spawn_exec_data_release(spawn_data);
   2025 
   2026 	/* done, exit */
   2027 	mutex_enter(l->l_proc->p_lock);
   2028 	/*
   2029 	 * Posix explicitly asks for an exit code of 127 if we report
   2030 	 * errors from the child process - so, unfortunately, there
   2031 	 * is no way to report a more exact error code.
   2032 	 * A NetBSD specific workaround is POSIX_SPAWN_RETURNERROR as
   2033 	 * flag bit in the attrp argument to posix_spawn(2), see above.
   2034 	 */
   2035 	exit1(l, W_EXITCODE(127, 0));
   2036 }
   2037 
   2038 void
   2039 posix_spawn_fa_free(struct posix_spawn_file_actions *fa, size_t len)
   2040 {
   2041 
   2042 	for (size_t i = 0; i < len; i++) {
   2043 		struct posix_spawn_file_actions_entry *fae = &fa->fae[i];
   2044 		if (fae->fae_action != FAE_OPEN)
   2045 			continue;
   2046 		kmem_free(fae->fae_path, strlen(fae->fae_path) + 1);
   2047 	}
   2048 	if (fa->len > 0)
   2049 		kmem_free(fa->fae, sizeof(*fa->fae) * fa->len);
   2050 	kmem_free(fa, sizeof(*fa));
   2051 }
   2052 
   2053 static int
   2054 posix_spawn_fa_alloc(struct posix_spawn_file_actions **fap,
   2055     const struct posix_spawn_file_actions *ufa)
   2056 {
   2057 	struct posix_spawn_file_actions *fa;
   2058 	struct posix_spawn_file_actions_entry *fae;
   2059 	char *pbuf = NULL;
   2060 	int error;
   2061 	size_t i = 0;
   2062 
   2063 	fa = kmem_alloc(sizeof(*fa), KM_SLEEP);
   2064 	error = copyin(ufa, fa, sizeof(*fa));
   2065 	if (error) {
   2066 		fa->fae = NULL;
   2067 		fa->len = 0;
   2068 		goto out;
   2069 	}
   2070 
   2071 	if (fa->len == 0) {
   2072 		kmem_free(fa, sizeof(*fa));
   2073 		return 0;
   2074 	}
   2075 
   2076 	fa->size = fa->len;
   2077 	size_t fal = fa->len * sizeof(*fae);
   2078 	fae = fa->fae;
   2079 	fa->fae = kmem_alloc(fal, KM_SLEEP);
   2080 	error = copyin(fae, fa->fae, fal);
   2081 	if (error)
   2082 		goto out;
   2083 
   2084 	pbuf = PNBUF_GET();
   2085 	for (; i < fa->len; i++) {
   2086 		fae = &fa->fae[i];
   2087 		if (fae->fae_action != FAE_OPEN)
   2088 			continue;
   2089 		error = copyinstr(fae->fae_path, pbuf, MAXPATHLEN, &fal);
   2090 		if (error)
   2091 			goto out;
   2092 		fae->fae_path = kmem_alloc(fal, KM_SLEEP);
   2093 		memcpy(fae->fae_path, pbuf, fal);
   2094 	}
   2095 	PNBUF_PUT(pbuf);
   2096 
   2097 	*fap = fa;
   2098 	return 0;
   2099 out:
   2100 	if (pbuf)
   2101 		PNBUF_PUT(pbuf);
   2102 	posix_spawn_fa_free(fa, i);
   2103 	return error;
   2104 }
   2105 
   2106 int
   2107 check_posix_spawn(struct lwp *l1)
   2108 {
   2109 	int error, tnprocs, count;
   2110 	uid_t uid;
   2111 	struct proc *p1;
   2112 
   2113 	p1 = l1->l_proc;
   2114 	uid = kauth_cred_getuid(l1->l_cred);
   2115 	tnprocs = atomic_inc_uint_nv(&nprocs);
   2116 
   2117 	/*
   2118 	 * Although process entries are dynamically created, we still keep
   2119 	 * a global limit on the maximum number we will create.
   2120 	 */
   2121 	if (__predict_false(tnprocs >= maxproc))
   2122 		error = -1;
   2123 	else
   2124 		error = kauth_authorize_process(l1->l_cred,
   2125 		    KAUTH_PROCESS_FORK, p1, KAUTH_ARG(tnprocs), NULL, NULL);
   2126 
   2127 	if (error) {
   2128 		atomic_dec_uint(&nprocs);
   2129 		return EAGAIN;
   2130 	}
   2131 
   2132 	/*
   2133 	 * Enforce limits.
   2134 	 */
   2135 	count = chgproccnt(uid, 1);
   2136 	if (kauth_authorize_process(l1->l_cred, KAUTH_PROCESS_RLIMIT,
   2137 	     p1, KAUTH_ARG(KAUTH_REQ_PROCESS_RLIMIT_BYPASS),
   2138 	     &p1->p_rlimit[RLIMIT_NPROC], KAUTH_ARG(RLIMIT_NPROC)) != 0 &&
   2139 	    __predict_false(count > p1->p_rlimit[RLIMIT_NPROC].rlim_cur)) {
   2140 		(void)chgproccnt(uid, -1);
   2141 		atomic_dec_uint(&nprocs);
   2142 		return EAGAIN;
   2143 	}
   2144 
   2145 	return 0;
   2146 }
   2147 
   2148 int
   2149 do_posix_spawn(struct lwp *l1, pid_t *pid_res, bool *child_ok, const char *path,
   2150 	struct posix_spawn_file_actions *fa,
   2151 	struct posix_spawnattr *sa,
   2152 	char *const *argv, char *const *envp,
   2153 	execve_fetch_element_t fetch)
   2154 {
   2155 
   2156 	struct proc *p1, *p2;
   2157 	struct lwp *l2;
   2158 	int error;
   2159 	struct spawn_exec_data *spawn_data;
   2160 	vaddr_t uaddr;
   2161 	pid_t pid;
   2162 	bool have_exec_lock = false;
   2163 
   2164 	p1 = l1->l_proc;
   2165 
   2166 	/* Allocate and init spawn_data */
   2167 	spawn_data = kmem_zalloc(sizeof(*spawn_data), KM_SLEEP);
   2168 	spawn_data->sed_refcnt = 1; /* only parent so far */
   2169 	cv_init(&spawn_data->sed_cv_child_ready, "pspawn");
   2170 	mutex_init(&spawn_data->sed_mtx_child, MUTEX_DEFAULT, IPL_NONE);
   2171 	mutex_enter(&spawn_data->sed_mtx_child);
   2172 
   2173 	/*
   2174 	 * Do the first part of the exec now, collect state
   2175 	 * in spawn_data.
   2176 	 */
   2177 	error = execve_loadvm(l1, path, argv,
   2178 	    envp, fetch, &spawn_data->sed_exec);
   2179 	if (error == EJUSTRETURN)
   2180 		error = 0;
   2181 	else if (error)
   2182 		goto error_exit;
   2183 
   2184 	have_exec_lock = true;
   2185 
   2186 	/*
   2187 	 * Allocate virtual address space for the U-area now, while it
   2188 	 * is still easy to abort the fork operation if we're out of
   2189 	 * kernel virtual address space.
   2190 	 */
   2191 	uaddr = uvm_uarea_alloc();
   2192 	if (__predict_false(uaddr == 0)) {
   2193 		error = ENOMEM;
   2194 		goto error_exit;
   2195 	}
   2196 
   2197 	/*
   2198 	 * Allocate new proc. Borrow proc0 vmspace for it, we will
   2199 	 * replace it with its own before returning to userland
   2200 	 * in the child.
   2201 	 * This is a point of no return, we will have to go through
   2202 	 * the child proc to properly clean it up past this point.
   2203 	 */
   2204 	p2 = proc_alloc();
   2205 	pid = p2->p_pid;
   2206 
   2207 	/*
   2208 	 * Make a proc table entry for the new process.
   2209 	 * Start by zeroing the section of proc that is zero-initialized,
   2210 	 * then copy the section that is copied directly from the parent.
   2211 	 */
   2212 	memset(&p2->p_startzero, 0,
   2213 	    (unsigned) ((char *)&p2->p_endzero - (char *)&p2->p_startzero));
   2214 	memcpy(&p2->p_startcopy, &p1->p_startcopy,
   2215 	    (unsigned) ((char *)&p2->p_endcopy - (char *)&p2->p_startcopy));
   2216 	p2->p_vmspace = proc0.p_vmspace;
   2217 
   2218 	CIRCLEQ_INIT(&p2->p_sigpend.sp_info);
   2219 
   2220 	LIST_INIT(&p2->p_lwps);
   2221 	LIST_INIT(&p2->p_sigwaiters);
   2222 
   2223 	/*
   2224 	 * Duplicate sub-structures as needed.
   2225 	 * Increase reference counts on shared objects.
   2226 	 * Inherit flags we want to keep.  The flags related to SIGCHLD
   2227 	 * handling are important in order to keep a consistent behaviour
   2228 	 * for the child after the fork.  If we are a 32-bit process, the
   2229 	 * child will be too.
   2230 	 */
   2231 	p2->p_flag =
   2232 	    p1->p_flag & (PK_SUGID | PK_NOCLDWAIT | PK_CLDSIGIGN | PK_32);
   2233 	p2->p_emul = p1->p_emul;
   2234 	p2->p_execsw = p1->p_execsw;
   2235 
   2236 	mutex_init(&p2->p_stmutex, MUTEX_DEFAULT, IPL_HIGH);
   2237 	mutex_init(&p2->p_auxlock, MUTEX_DEFAULT, IPL_NONE);
   2238 	rw_init(&p2->p_reflock);
   2239 	cv_init(&p2->p_waitcv, "wait");
   2240 	cv_init(&p2->p_lwpcv, "lwpwait");
   2241 
   2242 	p2->p_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_NONE);
   2243 
   2244 	kauth_proc_fork(p1, p2);
   2245 
   2246 	p2->p_raslist = NULL;
   2247 	p2->p_fd = fd_copy();
   2248 
   2249 	/* XXX racy */
   2250 	p2->p_mqueue_cnt = p1->p_mqueue_cnt;
   2251 
   2252 	p2->p_cwdi = cwdinit();
   2253 
   2254 	/*
   2255 	 * Note: p_limit (rlimit stuff) is copy-on-write, so normally
   2256 	 * we just need increase pl_refcnt.
   2257 	 */
   2258 	if (!p1->p_limit->pl_writeable) {
   2259 		lim_addref(p1->p_limit);
   2260 		p2->p_limit = p1->p_limit;
   2261 	} else {
   2262 		p2->p_limit = lim_copy(p1->p_limit);
   2263 	}
   2264 
   2265 	p2->p_lflag = 0;
   2266 	p2->p_sflag = 0;
   2267 	p2->p_slflag = 0;
   2268 	p2->p_pptr = p1;
   2269 	p2->p_ppid = p1->p_pid;
   2270 	LIST_INIT(&p2->p_children);
   2271 
   2272 	p2->p_aio = NULL;
   2273 
   2274 #ifdef KTRACE
   2275 	/*
   2276 	 * Copy traceflag and tracefile if enabled.
   2277 	 * If not inherited, these were zeroed above.
   2278 	 */
   2279 	if (p1->p_traceflag & KTRFAC_INHERIT) {
   2280 		mutex_enter(&ktrace_lock);
   2281 		p2->p_traceflag = p1->p_traceflag;
   2282 		if ((p2->p_tracep = p1->p_tracep) != NULL)
   2283 			ktradref(p2);
   2284 		mutex_exit(&ktrace_lock);
   2285 	}
   2286 #endif
   2287 
   2288 	/*
   2289 	 * Create signal actions for the child process.
   2290 	 */
   2291 	p2->p_sigacts = sigactsinit(p1, 0);
   2292 	mutex_enter(p1->p_lock);
   2293 	p2->p_sflag |=
   2294 	    (p1->p_sflag & (PS_STOPFORK | PS_STOPEXEC | PS_NOCLDSTOP));
   2295 	sched_proc_fork(p1, p2);
   2296 	mutex_exit(p1->p_lock);
   2297 
   2298 	p2->p_stflag = p1->p_stflag;
   2299 
   2300 	/*
   2301 	 * p_stats.
   2302 	 * Copy parts of p_stats, and zero out the rest.
   2303 	 */
   2304 	p2->p_stats = pstatscopy(p1->p_stats);
   2305 
   2306 	/* copy over machdep flags to the new proc */
   2307 	cpu_proc_fork(p1, p2);
   2308 
   2309 	/*
   2310 	 * Prepare remaining parts of spawn data
   2311 	 */
   2312 	spawn_data->sed_actions = fa;
   2313 	spawn_data->sed_attrs = sa;
   2314 
   2315 	spawn_data->sed_parent = p1;
   2316 
   2317 	/* create LWP */
   2318 	lwp_create(l1, p2, uaddr, 0, NULL, 0, spawn_return, spawn_data,
   2319 	    &l2, l1->l_class);
   2320 	l2->l_ctxlink = NULL;	/* reset ucontext link */
   2321 
   2322 	/*
   2323 	 * Copy the credential so other references don't see our changes.
   2324 	 * Test to see if this is necessary first, since in the common case
   2325 	 * we won't need a private reference.
   2326 	 */
   2327 	if (kauth_cred_geteuid(l2->l_cred) != kauth_cred_getsvuid(l2->l_cred) ||
   2328 	    kauth_cred_getegid(l2->l_cred) != kauth_cred_getsvgid(l2->l_cred)) {
   2329 		l2->l_cred = kauth_cred_copy(l2->l_cred);
   2330 		kauth_cred_setsvuid(l2->l_cred, kauth_cred_geteuid(l2->l_cred));
   2331 		kauth_cred_setsvgid(l2->l_cred, kauth_cred_getegid(l2->l_cred));
   2332 	}
   2333 
   2334 	/* Update the master credentials. */
   2335 	if (l2->l_cred != p2->p_cred) {
   2336 		kauth_cred_t ocred;
   2337 
   2338 		kauth_cred_hold(l2->l_cred);
   2339 		mutex_enter(p2->p_lock);
   2340 		ocred = p2->p_cred;
   2341 		p2->p_cred = l2->l_cred;
   2342 		mutex_exit(p2->p_lock);
   2343 		kauth_cred_free(ocred);
   2344 	}
   2345 
   2346 	*child_ok = true;
   2347 	spawn_data->sed_refcnt = 2;	/* child gets it as well */
   2348 #if 0
   2349 	l2->l_nopreempt = 1; /* start it non-preemptable */
   2350 #endif
   2351 
   2352 	/*
   2353 	 * It's now safe for the scheduler and other processes to see the
   2354 	 * child process.
   2355 	 */
   2356 	mutex_enter(proc_lock);
   2357 
   2358 	if (p1->p_session->s_ttyvp != NULL && p1->p_lflag & PL_CONTROLT)
   2359 		p2->p_lflag |= PL_CONTROLT;
   2360 
   2361 	LIST_INSERT_HEAD(&p1->p_children, p2, p_sibling);
   2362 	p2->p_exitsig = SIGCHLD;	/* signal for parent on exit */
   2363 
   2364 	LIST_INSERT_AFTER(p1, p2, p_pglist);
   2365 	LIST_INSERT_HEAD(&allproc, p2, p_list);
   2366 
   2367 	p2->p_trace_enabled = trace_is_enabled(p2);
   2368 #ifdef __HAVE_SYSCALL_INTERN
   2369 	(*p2->p_emul->e_syscall_intern)(p2);
   2370 #endif
   2371 
   2372 	/*
   2373 	 * Make child runnable, set start time, and add to run queue except
   2374 	 * if the parent requested the child to start in SSTOP state.
   2375 	 */
   2376 	mutex_enter(p2->p_lock);
   2377 
   2378 	getmicrotime(&p2->p_stats->p_start);
   2379 
   2380 	lwp_lock(l2);
   2381 	KASSERT(p2->p_nrlwps == 1);
   2382 	p2->p_nrlwps = 1;
   2383 	p2->p_stat = SACTIVE;
   2384 	l2->l_stat = LSRUN;
   2385 	sched_enqueue(l2, false);
   2386 	lwp_unlock(l2);
   2387 
   2388 	mutex_exit(p2->p_lock);
   2389 	mutex_exit(proc_lock);
   2390 
   2391 	cv_wait(&spawn_data->sed_cv_child_ready, &spawn_data->sed_mtx_child);
   2392 	error = spawn_data->sed_error;
   2393 	mutex_exit(&spawn_data->sed_mtx_child);
   2394 	spawn_exec_data_release(spawn_data);
   2395 
   2396 	rw_exit(&p1->p_reflock);
   2397 	rw_exit(&exec_lock);
   2398 	have_exec_lock = false;
   2399 
   2400 	*pid_res = pid;
   2401 	return error;
   2402 
   2403  error_exit:
   2404  	if (have_exec_lock) {
   2405 		execve_free_data(&spawn_data->sed_exec);
   2406 		rw_exit(&p1->p_reflock);
   2407  		rw_exit(&exec_lock);
   2408 	}
   2409 	mutex_exit(&spawn_data->sed_mtx_child);
   2410 	spawn_exec_data_release(spawn_data);
   2411 
   2412 	return error;
   2413 }
   2414 
   2415 int
   2416 sys_posix_spawn(struct lwp *l1, const struct sys_posix_spawn_args *uap,
   2417     register_t *retval)
   2418 {
   2419 	/* {
   2420 		syscallarg(pid_t *) pid;
   2421 		syscallarg(const char *) path;
   2422 		syscallarg(const struct posix_spawn_file_actions *) file_actions;
   2423 		syscallarg(const struct posix_spawnattr *) attrp;
   2424 		syscallarg(char *const *) argv;
   2425 		syscallarg(char *const *) envp;
   2426 	} */
   2427 
   2428 	int error;
   2429 	struct posix_spawn_file_actions *fa = NULL;
   2430 	struct posix_spawnattr *sa = NULL;
   2431 	pid_t pid;
   2432 	bool child_ok = false;
   2433 
   2434 	error = check_posix_spawn(l1);
   2435 	if (error) {
   2436 		*retval = error;
   2437 		return 0;
   2438 	}
   2439 
   2440 	/* copy in file_actions struct */
   2441 	if (SCARG(uap, file_actions) != NULL) {
   2442 		error = posix_spawn_fa_alloc(&fa, SCARG(uap, file_actions));
   2443 		if (error)
   2444 			goto error_exit;
   2445 	}
   2446 
   2447 	/* copyin posix_spawnattr struct */
   2448 	if (SCARG(uap, attrp) != NULL) {
   2449 		sa = kmem_alloc(sizeof(*sa), KM_SLEEP);
   2450 		error = copyin(SCARG(uap, attrp), sa, sizeof(*sa));
   2451 		if (error)
   2452 			goto error_exit;
   2453 	}
   2454 
   2455 	/*
   2456 	 * Do the spawn
   2457 	 */
   2458 	error = do_posix_spawn(l1, &pid, &child_ok, SCARG(uap, path), fa, sa,
   2459 	    SCARG(uap, argv), SCARG(uap, envp), execve_fetch_element);
   2460 	if (error)
   2461 		goto error_exit;
   2462 
   2463 	if (error == 0 && SCARG(uap, pid) != NULL)
   2464 		error = copyout(&pid, SCARG(uap, pid), sizeof(pid));
   2465 
   2466 	*retval = error;
   2467 	return 0;
   2468 
   2469  error_exit:
   2470 	if (!child_ok) {
   2471 		(void)chgproccnt(kauth_cred_getuid(l1->l_cred), -1);
   2472 		atomic_dec_uint(&nprocs);
   2473 
   2474 		if (sa)
   2475 			kmem_free(sa, sizeof(*sa));
   2476 		if (fa)
   2477 			posix_spawn_fa_free(fa, fa->len);
   2478 	}
   2479 
   2480 	*retval = error;
   2481 	return 0;
   2482 }
   2483 
   2484 void
   2485 exec_free_emul_arg(struct exec_package *epp)
   2486 {
   2487 	if (epp->ep_emul_arg_free != NULL) {
   2488 		KASSERT(epp->ep_emul_arg != NULL);
   2489 		(*epp->ep_emul_arg_free)(epp->ep_emul_arg);
   2490 		epp->ep_emul_arg_free = NULL;
   2491 		epp->ep_emul_arg = NULL;
   2492 	} else {
   2493 		KASSERT(epp->ep_emul_arg == NULL);
   2494 	}
   2495 }
   2496