xref: /netbsd-src/sys/kern/kern_exec.c (revision a536ee5124e62c9a0051a252f7833dc8f50f44c9)
1 /*	$NetBSD: kern_exec.c,v 1.358 2012/11/08 17:40:46 christos Exp $	*/
2 
3 /*-
4  * Copyright (c) 2008 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26  * POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 /*-
30  * Copyright (C) 1993, 1994, 1996 Christopher G. Demetriou
31  * Copyright (C) 1992 Wolfgang Solfrank.
32  * Copyright (C) 1992 TooLs GmbH.
33  * All rights reserved.
34  *
35  * Redistribution and use in source and binary forms, with or without
36  * modification, are permitted provided that the following conditions
37  * are met:
38  * 1. Redistributions of source code must retain the above copyright
39  *    notice, this list of conditions and the following disclaimer.
40  * 2. Redistributions in binary form must reproduce the above copyright
41  *    notice, this list of conditions and the following disclaimer in the
42  *    documentation and/or other materials provided with the distribution.
43  * 3. All advertising materials mentioning features or use of this software
44  *    must display the following acknowledgement:
45  *	This product includes software developed by TooLs GmbH.
46  * 4. The name of TooLs GmbH may not be used to endorse or promote products
47  *    derived from this software without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY TOOLS GMBH ``AS IS'' AND ANY EXPRESS OR
50  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
51  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
52  * IN NO EVENT SHALL TOOLS GMBH BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
53  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
54  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
55  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
56  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
57  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
58  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
59  */
60 
61 #include <sys/cdefs.h>
62 __KERNEL_RCSID(0, "$NetBSD: kern_exec.c,v 1.358 2012/11/08 17:40:46 christos Exp $");
63 
64 #include "opt_exec.h"
65 #include "opt_ktrace.h"
66 #include "opt_modular.h"
67 #include "opt_syscall_debug.h"
68 #include "veriexec.h"
69 #include "opt_pax.h"
70 
71 #include <sys/param.h>
72 #include <sys/systm.h>
73 #include <sys/filedesc.h>
74 #include <sys/kernel.h>
75 #include <sys/proc.h>
76 #include <sys/mount.h>
77 #include <sys/malloc.h>
78 #include <sys/kmem.h>
79 #include <sys/namei.h>
80 #include <sys/vnode.h>
81 #include <sys/file.h>
82 #include <sys/acct.h>
83 #include <sys/atomic.h>
84 #include <sys/exec.h>
85 #include <sys/ktrace.h>
86 #include <sys/uidinfo.h>
87 #include <sys/wait.h>
88 #include <sys/mman.h>
89 #include <sys/ras.h>
90 #include <sys/signalvar.h>
91 #include <sys/stat.h>
92 #include <sys/syscall.h>
93 #include <sys/kauth.h>
94 #include <sys/lwpctl.h>
95 #include <sys/pax.h>
96 #include <sys/cpu.h>
97 #include <sys/module.h>
98 #include <sys/syscallvar.h>
99 #include <sys/syscallargs.h>
100 #if NVERIEXEC > 0
101 #include <sys/verified_exec.h>
102 #endif /* NVERIEXEC > 0 */
103 #include <sys/sdt.h>
104 #include <sys/spawn.h>
105 #include <sys/prot.h>
106 #include <sys/cprng.h>
107 
108 #include <uvm/uvm_extern.h>
109 
110 #include <machine/reg.h>
111 
112 #include <compat/common/compat_util.h>
113 
114 static int exec_sigcode_map(struct proc *, const struct emul *);
115 
116 #ifdef DEBUG_EXEC
117 #define DPRINTF(a) printf a
118 #define COPYPRINTF(s, a, b) printf("%s, %d: copyout%s @%p %zu\n", __func__, \
119     __LINE__, (s), (a), (b))
120 #else
121 #define DPRINTF(a)
122 #define COPYPRINTF(s, a, b)
123 #endif /* DEBUG_EXEC */
124 
125 /*
126  * DTrace SDT provider definitions
127  */
128 SDT_PROBE_DEFINE(proc,,,exec,
129 	    "char *", NULL,
130 	    NULL, NULL, NULL, NULL,
131 	    NULL, NULL, NULL, NULL);
132 SDT_PROBE_DEFINE(proc,,,exec_success,
133 	    "char *", NULL,
134 	    NULL, NULL, NULL, NULL,
135 	    NULL, NULL, NULL, NULL);
136 SDT_PROBE_DEFINE(proc,,,exec_failure,
137 	    "int", NULL,
138 	    NULL, NULL, NULL, NULL,
139 	    NULL, NULL, NULL, NULL);
140 
141 /*
142  * Exec function switch:
143  *
144  * Note that each makecmds function is responsible for loading the
145  * exec package with the necessary functions for any exec-type-specific
146  * handling.
147  *
148  * Functions for specific exec types should be defined in their own
149  * header file.
150  */
151 static const struct execsw	**execsw = NULL;
152 static int			nexecs;
153 
154 u_int	exec_maxhdrsz;	 /* must not be static - used by netbsd32 */
155 
156 /* list of dynamically loaded execsw entries */
157 static LIST_HEAD(execlist_head, exec_entry) ex_head =
158     LIST_HEAD_INITIALIZER(ex_head);
159 struct exec_entry {
160 	LIST_ENTRY(exec_entry)	ex_list;
161 	SLIST_ENTRY(exec_entry)	ex_slist;
162 	const struct execsw	*ex_sw;
163 };
164 
165 #ifndef __HAVE_SYSCALL_INTERN
166 void	syscall(void);
167 #endif
168 
169 /* NetBSD emul struct */
170 struct emul emul_netbsd = {
171 	.e_name =		"netbsd",
172 	.e_path =		NULL,
173 #ifndef __HAVE_MINIMAL_EMUL
174 	.e_flags =		EMUL_HAS_SYS___syscall,
175 	.e_errno =		NULL,
176 	.e_nosys =		SYS_syscall,
177 	.e_nsysent =		SYS_NSYSENT,
178 #endif
179 	.e_sysent =		sysent,
180 #ifdef SYSCALL_DEBUG
181 	.e_syscallnames =	syscallnames,
182 #else
183 	.e_syscallnames =	NULL,
184 #endif
185 	.e_sendsig =		sendsig,
186 	.e_trapsignal =		trapsignal,
187 	.e_tracesig =		NULL,
188 	.e_sigcode =		NULL,
189 	.e_esigcode =		NULL,
190 	.e_sigobject =		NULL,
191 	.e_setregs =		setregs,
192 	.e_proc_exec =		NULL,
193 	.e_proc_fork =		NULL,
194 	.e_proc_exit =		NULL,
195 	.e_lwp_fork =		NULL,
196 	.e_lwp_exit =		NULL,
197 #ifdef __HAVE_SYSCALL_INTERN
198 	.e_syscall_intern =	syscall_intern,
199 #else
200 	.e_syscall =		syscall,
201 #endif
202 	.e_sysctlovly =		NULL,
203 	.e_fault =		NULL,
204 	.e_vm_default_addr =	uvm_default_mapaddr,
205 	.e_usertrap =		NULL,
206 	.e_ucsize =		sizeof(ucontext_t),
207 	.e_startlwp =		startlwp
208 };
209 
210 /*
211  * Exec lock. Used to control access to execsw[] structures.
212  * This must not be static so that netbsd32 can access it, too.
213  */
214 krwlock_t exec_lock;
215 
216 static kmutex_t sigobject_lock;
217 
218 /*
219  * Data used between a loadvm and execve part of an "exec" operation
220  */
221 struct execve_data {
222 	struct exec_package	ed_pack;
223 	struct pathbuf		*ed_pathbuf;
224 	struct vattr		ed_attr;
225 	struct ps_strings	ed_arginfo;
226 	char			*ed_argp;
227 	const char		*ed_pathstring;
228 	char			*ed_resolvedpathbuf;
229 	size_t			ed_ps_strings_sz;
230 	int			ed_szsigcode;
231 	long			ed_argc;
232 	long			ed_envc;
233 };
234 
235 /*
236  * data passed from parent lwp to child during a posix_spawn()
237  */
238 struct spawn_exec_data {
239 	struct execve_data	sed_exec;
240 	struct posix_spawn_file_actions
241 				*sed_actions;
242 	struct posix_spawnattr	*sed_attrs;
243 	struct proc		*sed_parent;
244 	kcondvar_t		sed_cv_child_ready;
245 	kmutex_t		sed_mtx_child;
246 	int			sed_error;
247 	volatile uint32_t	sed_refcnt;
248 };
249 
250 static void *
251 exec_pool_alloc(struct pool *pp, int flags)
252 {
253 
254 	return (void *)uvm_km_alloc(kernel_map, NCARGS, 0,
255 	    UVM_KMF_PAGEABLE | UVM_KMF_WAITVA);
256 }
257 
258 static void
259 exec_pool_free(struct pool *pp, void *addr)
260 {
261 
262 	uvm_km_free(kernel_map, (vaddr_t)addr, NCARGS, UVM_KMF_PAGEABLE);
263 }
264 
265 static struct pool exec_pool;
266 
267 static struct pool_allocator exec_palloc = {
268 	.pa_alloc = exec_pool_alloc,
269 	.pa_free = exec_pool_free,
270 	.pa_pagesz = NCARGS
271 };
272 
273 /*
274  * check exec:
275  * given an "executable" described in the exec package's namei info,
276  * see what we can do with it.
277  *
278  * ON ENTRY:
279  *	exec package with appropriate namei info
280  *	lwp pointer of exec'ing lwp
281  *	NO SELF-LOCKED VNODES
282  *
283  * ON EXIT:
284  *	error:	nothing held, etc.  exec header still allocated.
285  *	ok:	filled exec package, executable's vnode (unlocked).
286  *
287  * EXEC SWITCH ENTRY:
288  * 	Locked vnode to check, exec package, proc.
289  *
290  * EXEC SWITCH EXIT:
291  *	ok:	return 0, filled exec package, executable's vnode (unlocked).
292  *	error:	destructive:
293  *			everything deallocated execept exec header.
294  *		non-destructive:
295  *			error code, executable's vnode (unlocked),
296  *			exec header unmodified.
297  */
298 int
299 /*ARGSUSED*/
300 check_exec(struct lwp *l, struct exec_package *epp, struct pathbuf *pb)
301 {
302 	int		error, i;
303 	struct vnode	*vp;
304 	struct nameidata nd;
305 	size_t		resid;
306 
307 	NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | TRYEMULROOT, pb);
308 
309 	/* first get the vnode */
310 	if ((error = namei(&nd)) != 0)
311 		return error;
312 	epp->ep_vp = vp = nd.ni_vp;
313 	/* this cannot overflow as both are size PATH_MAX */
314 	strcpy(epp->ep_resolvedname, nd.ni_pnbuf);
315 
316 #ifdef DIAGNOSTIC
317 	/* paranoia (take this out once namei stuff stabilizes) */
318 	memset(nd.ni_pnbuf, '~', PATH_MAX);
319 #endif
320 
321 	/* check access and type */
322 	if (vp->v_type != VREG) {
323 		error = EACCES;
324 		goto bad1;
325 	}
326 	if ((error = VOP_ACCESS(vp, VEXEC, l->l_cred)) != 0)
327 		goto bad1;
328 
329 	/* get attributes */
330 	if ((error = VOP_GETATTR(vp, epp->ep_vap, l->l_cred)) != 0)
331 		goto bad1;
332 
333 	/* Check mount point */
334 	if (vp->v_mount->mnt_flag & MNT_NOEXEC) {
335 		error = EACCES;
336 		goto bad1;
337 	}
338 	if (vp->v_mount->mnt_flag & MNT_NOSUID)
339 		epp->ep_vap->va_mode &= ~(S_ISUID | S_ISGID);
340 
341 	/* try to open it */
342 	if ((error = VOP_OPEN(vp, FREAD, l->l_cred)) != 0)
343 		goto bad1;
344 
345 	/* unlock vp, since we need it unlocked from here on out. */
346 	VOP_UNLOCK(vp);
347 
348 #if NVERIEXEC > 0
349 	error = veriexec_verify(l, vp, epp->ep_resolvedname,
350 	    epp->ep_flags & EXEC_INDIR ? VERIEXEC_INDIRECT : VERIEXEC_DIRECT,
351 	    NULL);
352 	if (error)
353 		goto bad2;
354 #endif /* NVERIEXEC > 0 */
355 
356 #ifdef PAX_SEGVGUARD
357 	error = pax_segvguard(l, vp, epp->ep_resolvedname, false);
358 	if (error)
359 		goto bad2;
360 #endif /* PAX_SEGVGUARD */
361 
362 	/* now we have the file, get the exec header */
363 	error = vn_rdwr(UIO_READ, vp, epp->ep_hdr, epp->ep_hdrlen, 0,
364 			UIO_SYSSPACE, 0, l->l_cred, &resid, NULL);
365 	if (error)
366 		goto bad2;
367 	epp->ep_hdrvalid = epp->ep_hdrlen - resid;
368 
369 	/*
370 	 * Set up default address space limits.  Can be overridden
371 	 * by individual exec packages.
372 	 *
373 	 * XXX probably should be all done in the exec packages.
374 	 */
375 	epp->ep_vm_minaddr = VM_MIN_ADDRESS;
376 	epp->ep_vm_maxaddr = VM_MAXUSER_ADDRESS;
377 	/*
378 	 * set up the vmcmds for creation of the process
379 	 * address space
380 	 */
381 	error = ENOEXEC;
382 	for (i = 0; i < nexecs; i++) {
383 		int newerror;
384 
385 		epp->ep_esch = execsw[i];
386 		newerror = (*execsw[i]->es_makecmds)(l, epp);
387 
388 		if (!newerror) {
389 			/* Seems ok: check that entry point is not too high */
390 			if (epp->ep_entry > epp->ep_vm_maxaddr) {
391 #ifdef DIAGNOSTIC
392 				printf("%s: rejecting %p due to "
393 				    "too high entry address (> %p)\n",
394 					 __func__, (void *)epp->ep_entry,
395 					 (void *)epp->ep_vm_maxaddr);
396 #endif
397 				error = ENOEXEC;
398 				break;
399 			}
400 			/* Seems ok: check that entry point is not too low */
401 			if (epp->ep_entry < epp->ep_vm_minaddr) {
402 #ifdef DIAGNOSTIC
403 				printf("%s: rejecting %p due to "
404 				    "too low entry address (< %p)\n",
405 				     __func__, (void *)epp->ep_entry,
406 				     (void *)epp->ep_vm_minaddr);
407 #endif
408 				error = ENOEXEC;
409 				break;
410 			}
411 
412 			/* check limits */
413 			if ((epp->ep_tsize > MAXTSIZ) ||
414 			    (epp->ep_dsize > (u_quad_t)l->l_proc->p_rlimit
415 						    [RLIMIT_DATA].rlim_cur)) {
416 #ifdef DIAGNOSTIC
417 				printf("%s: rejecting due to "
418 				    "limits (t=%llu > %llu || d=%llu > %llu)\n",
419 				    __func__,
420 				    (unsigned long long)epp->ep_tsize,
421 				    (unsigned long long)MAXTSIZ,
422 				    (unsigned long long)epp->ep_dsize,
423 				    (unsigned long long)
424 				    l->l_proc->p_rlimit[RLIMIT_DATA].rlim_cur);
425 #endif
426 				error = ENOMEM;
427 				break;
428 			}
429 			return 0;
430 		}
431 
432 		if (epp->ep_emul_root != NULL) {
433 			vrele(epp->ep_emul_root);
434 			epp->ep_emul_root = NULL;
435 		}
436 		if (epp->ep_interp != NULL) {
437 			vrele(epp->ep_interp);
438 			epp->ep_interp = NULL;
439 		}
440 
441 		/* make sure the first "interesting" error code is saved. */
442 		if (error == ENOEXEC)
443 			error = newerror;
444 
445 		if (epp->ep_flags & EXEC_DESTR)
446 			/* Error from "#!" code, tidied up by recursive call */
447 			return error;
448 	}
449 
450 	/* not found, error */
451 
452 	/*
453 	 * free any vmspace-creation commands,
454 	 * and release their references
455 	 */
456 	kill_vmcmds(&epp->ep_vmcmds);
457 
458 bad2:
459 	/*
460 	 * close and release the vnode, restore the old one, free the
461 	 * pathname buf, and punt.
462 	 */
463 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
464 	VOP_CLOSE(vp, FREAD, l->l_cred);
465 	vput(vp);
466 	return error;
467 
468 bad1:
469 	/*
470 	 * free the namei pathname buffer, and put the vnode
471 	 * (which we don't yet have open).
472 	 */
473 	vput(vp);				/* was still locked */
474 	return error;
475 }
476 
477 #ifdef __MACHINE_STACK_GROWS_UP
478 #define STACK_PTHREADSPACE NBPG
479 #else
480 #define STACK_PTHREADSPACE 0
481 #endif
482 
483 static int
484 execve_fetch_element(char * const *array, size_t index, char **value)
485 {
486 	return copyin(array + index, value, sizeof(*value));
487 }
488 
489 /*
490  * exec system call
491  */
492 int
493 sys_execve(struct lwp *l, const struct sys_execve_args *uap, register_t *retval)
494 {
495 	/* {
496 		syscallarg(const char *)	path;
497 		syscallarg(char * const *)	argp;
498 		syscallarg(char * const *)	envp;
499 	} */
500 
501 	return execve1(l, SCARG(uap, path), SCARG(uap, argp),
502 	    SCARG(uap, envp), execve_fetch_element);
503 }
504 
505 int
506 sys_fexecve(struct lwp *l, const struct sys_fexecve_args *uap,
507     register_t *retval)
508 {
509 	/* {
510 		syscallarg(int)			fd;
511 		syscallarg(char * const *)	argp;
512 		syscallarg(char * const *)	envp;
513 	} */
514 
515 	return ENOSYS;
516 }
517 
518 /*
519  * Load modules to try and execute an image that we do not understand.
520  * If no execsw entries are present, we load those likely to be needed
521  * in order to run native images only.  Otherwise, we autoload all
522  * possible modules that could let us run the binary.  XXX lame
523  */
524 static void
525 exec_autoload(void)
526 {
527 #ifdef MODULAR
528 	static const char * const native[] = {
529 		"exec_elf32",
530 		"exec_elf64",
531 		"exec_script",
532 		NULL
533 	};
534 	static const char * const compat[] = {
535 		"exec_elf32",
536 		"exec_elf64",
537 		"exec_script",
538 		"exec_aout",
539 		"exec_coff",
540 		"exec_ecoff",
541 		"compat_aoutm68k",
542 		"compat_freebsd",
543 		"compat_ibcs2",
544 		"compat_linux",
545 		"compat_linux32",
546 		"compat_netbsd32",
547 		"compat_sunos",
548 		"compat_sunos32",
549 		"compat_svr4",
550 		"compat_svr4_32",
551 		"compat_ultrix",
552 		NULL
553 	};
554 	char const * const *list;
555 	int i;
556 
557 	list = (nexecs == 0 ? native : compat);
558 	for (i = 0; list[i] != NULL; i++) {
559 		if (module_autoload(list[i], MODULE_CLASS_MISC) != 0) {
560 		    	continue;
561 		}
562 	   	yield();
563 	}
564 #endif
565 }
566 
567 static int
568 execve_loadvm(struct lwp *l, const char *path, char * const *args,
569 	char * const *envs, execve_fetch_element_t fetch_element,
570 	struct execve_data * restrict data)
571 {
572 	int			error;
573 	struct proc		*p;
574 	char			*dp, *sp;
575 	size_t			i, len;
576 	struct exec_fakearg	*tmpfap;
577 	u_int			modgen;
578 
579 	KASSERT(data != NULL);
580 
581 	p = l->l_proc;
582  	modgen = 0;
583 
584 	SDT_PROBE(proc,,,exec, path, 0, 0, 0, 0);
585 
586 	/*
587 	 * Check if we have exceeded our number of processes limit.
588 	 * This is so that we handle the case where a root daemon
589 	 * forked, ran setuid to become the desired user and is trying
590 	 * to exec. The obvious place to do the reference counting check
591 	 * is setuid(), but we don't do the reference counting check there
592 	 * like other OS's do because then all the programs that use setuid()
593 	 * must be modified to check the return code of setuid() and exit().
594 	 * It is dangerous to make setuid() fail, because it fails open and
595 	 * the program will continue to run as root. If we make it succeed
596 	 * and return an error code, again we are not enforcing the limit.
597 	 * The best place to enforce the limit is here, when the process tries
598 	 * to execute a new image, because eventually the process will need
599 	 * to call exec in order to do something useful.
600 	 */
601  retry:
602 	if (p->p_flag & PK_SUGID) {
603 		if (kauth_authorize_process(l->l_cred, KAUTH_PROCESS_RLIMIT,
604 		     p, KAUTH_ARG(KAUTH_REQ_PROCESS_RLIMIT_BYPASS),
605 		     &p->p_rlimit[RLIMIT_NPROC],
606 		     KAUTH_ARG(RLIMIT_NPROC)) != 0 &&
607 		    chgproccnt(kauth_cred_getuid(l->l_cred), 0) >
608 		     p->p_rlimit[RLIMIT_NPROC].rlim_cur)
609 		return EAGAIN;
610 	}
611 
612 	/*
613 	 * Drain existing references and forbid new ones.  The process
614 	 * should be left alone until we're done here.  This is necessary
615 	 * to avoid race conditions - e.g. in ptrace() - that might allow
616 	 * a local user to illicitly obtain elevated privileges.
617 	 */
618 	rw_enter(&p->p_reflock, RW_WRITER);
619 
620 	/*
621 	 * Init the namei data to point the file user's program name.
622 	 * This is done here rather than in check_exec(), so that it's
623 	 * possible to override this settings if any of makecmd/probe
624 	 * functions call check_exec() recursively - for example,
625 	 * see exec_script_makecmds().
626 	 */
627 	error = pathbuf_copyin(path, &data->ed_pathbuf);
628 	if (error) {
629 		DPRINTF(("%s: pathbuf_copyin path @%p %d\n", __func__,
630 		    path, error));
631 		goto clrflg;
632 	}
633 	data->ed_pathstring = pathbuf_stringcopy_get(data->ed_pathbuf);
634 
635 	data->ed_resolvedpathbuf = PNBUF_GET();
636 #ifdef DIAGNOSTIC
637 	strcpy(data->ed_resolvedpathbuf, "/wrong");
638 #endif
639 
640 	/*
641 	 * initialize the fields of the exec package.
642 	 */
643 	data->ed_pack.ep_name = path;
644 	data->ed_pack.ep_kname = data->ed_pathstring;
645 	data->ed_pack.ep_resolvedname = data->ed_resolvedpathbuf;
646 	data->ed_pack.ep_hdr = kmem_alloc(exec_maxhdrsz, KM_SLEEP);
647 	data->ed_pack.ep_hdrlen = exec_maxhdrsz;
648 	data->ed_pack.ep_hdrvalid = 0;
649 	data->ed_pack.ep_emul_arg = NULL;
650 	data->ed_pack.ep_emul_arg_free = NULL;
651 	data->ed_pack.ep_vmcmds.evs_cnt = 0;
652 	data->ed_pack.ep_vmcmds.evs_used = 0;
653 	data->ed_pack.ep_vap = &data->ed_attr;
654 	data->ed_pack.ep_flags = 0;
655 	data->ed_pack.ep_emul_root = NULL;
656 	data->ed_pack.ep_interp = NULL;
657 	data->ed_pack.ep_esch = NULL;
658 	data->ed_pack.ep_pax_flags = 0;
659 
660 	rw_enter(&exec_lock, RW_READER);
661 
662 	/* see if we can run it. */
663 	if ((error = check_exec(l, &data->ed_pack, data->ed_pathbuf)) != 0) {
664 		if (error != ENOENT) {
665 			DPRINTF(("%s: check exec failed %d\n",
666 			    __func__, error));
667 		}
668 		goto freehdr;
669 	}
670 
671 	/* XXX -- THE FOLLOWING SECTION NEEDS MAJOR CLEANUP */
672 
673 	/* allocate an argument buffer */
674 	data->ed_argp = pool_get(&exec_pool, PR_WAITOK);
675 	KASSERT(data->ed_argp != NULL);
676 	dp = data->ed_argp;
677 	data->ed_argc = 0;
678 
679 	/* copy the fake args list, if there's one, freeing it as we go */
680 	if (data->ed_pack.ep_flags & EXEC_HASARGL) {
681 		tmpfap = data->ed_pack.ep_fa;
682 		while (tmpfap->fa_arg != NULL) {
683 			const char *cp;
684 
685 			cp = tmpfap->fa_arg;
686 			while (*cp)
687 				*dp++ = *cp++;
688 			*dp++ = '\0';
689 			ktrexecarg(tmpfap->fa_arg, cp - tmpfap->fa_arg);
690 
691 			kmem_free(tmpfap->fa_arg, tmpfap->fa_len);
692 			tmpfap++; data->ed_argc++;
693 		}
694 		kmem_free(data->ed_pack.ep_fa, data->ed_pack.ep_fa_len);
695 		data->ed_pack.ep_flags &= ~EXEC_HASARGL;
696 	}
697 
698 	/* Now get argv & environment */
699 	if (args == NULL) {
700 		DPRINTF(("%s: null args\n", __func__));
701 		error = EINVAL;
702 		goto bad;
703 	}
704 	/* 'i' will index the argp/envp element to be retrieved */
705 	i = 0;
706 	if (data->ed_pack.ep_flags & EXEC_SKIPARG)
707 		i++;
708 
709 	while (1) {
710 		len = data->ed_argp + ARG_MAX - dp;
711 		if ((error = (*fetch_element)(args, i, &sp)) != 0) {
712 			DPRINTF(("%s: fetch_element args %d\n",
713 			    __func__, error));
714 			goto bad;
715 		}
716 		if (!sp)
717 			break;
718 		if ((error = copyinstr(sp, dp, len, &len)) != 0) {
719 			DPRINTF(("%s: copyinstr args %d\n", __func__, error));
720 			if (error == ENAMETOOLONG)
721 				error = E2BIG;
722 			goto bad;
723 		}
724 		ktrexecarg(dp, len - 1);
725 		dp += len;
726 		i++;
727 		data->ed_argc++;
728 	}
729 
730 	data->ed_envc = 0;
731 	/* environment need not be there */
732 	if (envs != NULL) {
733 		i = 0;
734 		while (1) {
735 			len = data->ed_argp + ARG_MAX - dp;
736 			if ((error = (*fetch_element)(envs, i, &sp)) != 0) {
737 				DPRINTF(("%s: fetch_element env %d\n",
738 				    __func__, error));
739 				goto bad;
740 			}
741 			if (!sp)
742 				break;
743 			if ((error = copyinstr(sp, dp, len, &len)) != 0) {
744 				DPRINTF(("%s: copyinstr env %d\n",
745 				    __func__, error));
746 				if (error == ENAMETOOLONG)
747 					error = E2BIG;
748 				goto bad;
749 			}
750 
751 			ktrexecenv(dp, len - 1);
752 			dp += len;
753 			i++;
754 			data->ed_envc++;
755 		}
756 	}
757 
758 	dp = (char *) ALIGN(dp);
759 
760 	data->ed_szsigcode = data->ed_pack.ep_esch->es_emul->e_esigcode -
761 	    data->ed_pack.ep_esch->es_emul->e_sigcode;
762 
763 #ifdef __MACHINE_STACK_GROWS_UP
764 /* See big comment lower down */
765 #define	RTLD_GAP	32
766 #else
767 #define	RTLD_GAP	0
768 #endif
769 
770 	/* Now check if args & environ fit into new stack */
771 	if (data->ed_pack.ep_flags & EXEC_32) {
772 		data->ed_ps_strings_sz = sizeof(struct ps_strings32);
773 		len = ((data->ed_argc + data->ed_envc + 2 +
774 		    data->ed_pack.ep_esch->es_arglen) *
775 		    sizeof(int) + sizeof(int) + dp + RTLD_GAP +
776 		    data->ed_szsigcode + data->ed_ps_strings_sz + STACK_PTHREADSPACE)
777 		    - data->ed_argp;
778 	} else {
779 		data->ed_ps_strings_sz = sizeof(struct ps_strings);
780 		len = ((data->ed_argc + data->ed_envc + 2 +
781 		    data->ed_pack.ep_esch->es_arglen) *
782 		    sizeof(char *) + sizeof(int) + dp + RTLD_GAP +
783 		    data->ed_szsigcode + data->ed_ps_strings_sz + STACK_PTHREADSPACE)
784 		    - data->ed_argp;
785 	}
786 
787 #ifdef PAX_ASLR
788 	if (pax_aslr_active(l))
789 		len += (cprng_fast32() % PAGE_SIZE);
790 #endif /* PAX_ASLR */
791 
792 	/* make the stack "safely" aligned */
793 	len = STACK_LEN_ALIGN(len, STACK_ALIGNBYTES);
794 
795 	if (len > data->ed_pack.ep_ssize) {
796 		/* in effect, compare to initial limit */
797 		DPRINTF(("%s: stack limit exceeded %zu\n", __func__, len));
798 		goto bad;
799 	}
800 	/* adjust "active stack depth" for process VSZ */
801 	data->ed_pack.ep_ssize = len;
802 
803 	return 0;
804 
805  bad:
806 	/* free the vmspace-creation commands, and release their references */
807 	kill_vmcmds(&data->ed_pack.ep_vmcmds);
808 	/* kill any opened file descriptor, if necessary */
809 	if (data->ed_pack.ep_flags & EXEC_HASFD) {
810 		data->ed_pack.ep_flags &= ~EXEC_HASFD;
811 		fd_close(data->ed_pack.ep_fd);
812 	}
813 	/* close and put the exec'd file */
814 	vn_lock(data->ed_pack.ep_vp, LK_EXCLUSIVE | LK_RETRY);
815 	VOP_CLOSE(data->ed_pack.ep_vp, FREAD, l->l_cred);
816 	vput(data->ed_pack.ep_vp);
817 	pool_put(&exec_pool, data->ed_argp);
818 
819  freehdr:
820 	kmem_free(data->ed_pack.ep_hdr, data->ed_pack.ep_hdrlen);
821 	if (data->ed_pack.ep_emul_root != NULL)
822 		vrele(data->ed_pack.ep_emul_root);
823 	if (data->ed_pack.ep_interp != NULL)
824 		vrele(data->ed_pack.ep_interp);
825 
826 	rw_exit(&exec_lock);
827 
828 	pathbuf_stringcopy_put(data->ed_pathbuf, data->ed_pathstring);
829 	pathbuf_destroy(data->ed_pathbuf);
830 	PNBUF_PUT(data->ed_resolvedpathbuf);
831 
832  clrflg:
833 	rw_exit(&p->p_reflock);
834 
835 	if (modgen != module_gen && error == ENOEXEC) {
836 		modgen = module_gen;
837 		exec_autoload();
838 		goto retry;
839 	}
840 
841 	SDT_PROBE(proc,,,exec_failure, error, 0, 0, 0, 0);
842 	return error;
843 }
844 
845 static void
846 execve_free_data(struct execve_data *data)
847 {
848 
849 	/* free the vmspace-creation commands, and release their references */
850 	kill_vmcmds(&data->ed_pack.ep_vmcmds);
851 	/* kill any opened file descriptor, if necessary */
852 	if (data->ed_pack.ep_flags & EXEC_HASFD) {
853 		data->ed_pack.ep_flags &= ~EXEC_HASFD;
854 		fd_close(data->ed_pack.ep_fd);
855 	}
856 
857 	/* close and put the exec'd file */
858 	vn_lock(data->ed_pack.ep_vp, LK_EXCLUSIVE | LK_RETRY);
859 	VOP_CLOSE(data->ed_pack.ep_vp, FREAD, curlwp->l_cred);
860 	vput(data->ed_pack.ep_vp);
861 	pool_put(&exec_pool, data->ed_argp);
862 
863 	kmem_free(data->ed_pack.ep_hdr, data->ed_pack.ep_hdrlen);
864 	if (data->ed_pack.ep_emul_root != NULL)
865 		vrele(data->ed_pack.ep_emul_root);
866 	if (data->ed_pack.ep_interp != NULL)
867 		vrele(data->ed_pack.ep_interp);
868 
869 	pathbuf_stringcopy_put(data->ed_pathbuf, data->ed_pathstring);
870 	pathbuf_destroy(data->ed_pathbuf);
871 	PNBUF_PUT(data->ed_resolvedpathbuf);
872 }
873 
874 static int
875 execve_runproc(struct lwp *l, struct execve_data * restrict data,
876 	bool no_local_exec_lock, bool is_spawn)
877 {
878 	int error = 0;
879 	struct proc		*p;
880 	size_t			i;
881 	char			*stack, *dp;
882 	const char		*commandname;
883 	struct ps_strings32	arginfo32;
884 	struct exec_vmcmd	*base_vcp;
885 	void			*aip;
886 	struct vmspace		*vm;
887 	ksiginfo_t		ksi;
888 	ksiginfoq_t		kq;
889 
890 	/*
891 	 * In case of a posix_spawn operation, the child doing the exec
892 	 * might not hold the reader lock on exec_lock, but the parent
893 	 * will do this instead.
894 	 */
895 	KASSERT(no_local_exec_lock || rw_lock_held(&exec_lock));
896 	KASSERT(data != NULL);
897 	if (data == NULL)
898 		return (EINVAL);
899 
900 	p = l->l_proc;
901 	if (no_local_exec_lock)
902 		KASSERT(is_spawn);
903 
904 	base_vcp = NULL;
905 
906 	if (data->ed_pack.ep_flags & EXEC_32)
907 		aip = &arginfo32;
908 	else
909 		aip = &data->ed_arginfo;
910 
911 	/* Get rid of other LWPs. */
912 	if (p->p_nlwps > 1) {
913 		mutex_enter(p->p_lock);
914 		exit_lwps(l);
915 		mutex_exit(p->p_lock);
916 	}
917 	KDASSERT(p->p_nlwps == 1);
918 
919 	/* Destroy any lwpctl info. */
920 	if (p->p_lwpctl != NULL)
921 		lwp_ctl_exit();
922 
923 	/* Remove POSIX timers */
924 	timers_free(p, TIMERS_POSIX);
925 
926 	/*
927 	 * Do whatever is necessary to prepare the address space
928 	 * for remapping.  Note that this might replace the current
929 	 * vmspace with another!
930 	 */
931 	if (is_spawn)
932 		uvmspace_spawn(l, data->ed_pack.ep_vm_minaddr,
933 		    data->ed_pack.ep_vm_maxaddr);
934 	else
935 		uvmspace_exec(l, data->ed_pack.ep_vm_minaddr,
936 		    data->ed_pack.ep_vm_maxaddr);
937 
938 	/* record proc's vnode, for use by procfs and others */
939         if (p->p_textvp)
940                 vrele(p->p_textvp);
941 	vref(data->ed_pack.ep_vp);
942 	p->p_textvp = data->ed_pack.ep_vp;
943 
944 	/* Now map address space */
945 	vm = p->p_vmspace;
946 	vm->vm_taddr = (void *)data->ed_pack.ep_taddr;
947 	vm->vm_tsize = btoc(data->ed_pack.ep_tsize);
948 	vm->vm_daddr = (void*)data->ed_pack.ep_daddr;
949 	vm->vm_dsize = btoc(data->ed_pack.ep_dsize);
950 	vm->vm_ssize = btoc(data->ed_pack.ep_ssize);
951 	vm->vm_issize = 0;
952 	vm->vm_maxsaddr = (void *)data->ed_pack.ep_maxsaddr;
953 	vm->vm_minsaddr = (void *)data->ed_pack.ep_minsaddr;
954 
955 #ifdef PAX_ASLR
956 	pax_aslr_init(l, vm);
957 #endif /* PAX_ASLR */
958 
959 	/* create the new process's VM space by running the vmcmds */
960 #ifdef DIAGNOSTIC
961 	if (data->ed_pack.ep_vmcmds.evs_used == 0)
962 		panic("%s: no vmcmds", __func__);
963 #endif
964 
965 #ifdef DEBUG_EXEC
966 	{
967 		size_t j;
968 		struct exec_vmcmd *vp = &data->ed_pack.ep_vmcmds.evs_cmds[0];
969 		DPRINTF(("vmcmds %u\n", data->ed_pack.ep_vmcmds.evs_used));
970 		for (j = 0; j < data->ed_pack.ep_vmcmds.evs_used; j++) {
971 			DPRINTF(("vmcmd[%zu] = vmcmd_map_%s %#"
972 			    PRIxVADDR"/%#"PRIxVSIZE" fd@%#"
973 			    PRIxVSIZE" prot=0%o flags=%d\n", j,
974 			    vp[j].ev_proc == vmcmd_map_pagedvn ?
975 			    "pagedvn" :
976 			    vp[j].ev_proc == vmcmd_map_readvn ?
977 			    "readvn" :
978 			    vp[j].ev_proc == vmcmd_map_zero ?
979 			    "zero" : "*unknown*",
980 			    vp[j].ev_addr, vp[j].ev_len,
981 			    vp[j].ev_offset, vp[j].ev_prot,
982 			    vp[j].ev_flags));
983 		}
984 	}
985 #endif	/* DEBUG_EXEC */
986 
987 	for (i = 0; i < data->ed_pack.ep_vmcmds.evs_used && !error; i++) {
988 		struct exec_vmcmd *vcp;
989 
990 		vcp = &data->ed_pack.ep_vmcmds.evs_cmds[i];
991 		if (vcp->ev_flags & VMCMD_RELATIVE) {
992 #ifdef DIAGNOSTIC
993 			if (base_vcp == NULL)
994 				panic("%s: relative vmcmd with no base",
995 				    __func__);
996 			if (vcp->ev_flags & VMCMD_BASE)
997 				panic("%s: illegal base & relative vmcmd",
998 				    __func__);
999 #endif
1000 			vcp->ev_addr += base_vcp->ev_addr;
1001 		}
1002 		error = (*vcp->ev_proc)(l, vcp);
1003 #ifdef DEBUG_EXEC
1004 		if (error) {
1005 			size_t j;
1006 			struct exec_vmcmd *vp =
1007 			    &data->ed_pack.ep_vmcmds.evs_cmds[0];
1008 			DPRINTF(("vmcmds %zu/%u, error %d\n", i,
1009 			    data->ed_pack.ep_vmcmds.evs_used, error));
1010 			for (j = 0; j < data->ed_pack.ep_vmcmds.evs_used; j++) {
1011 				DPRINTF(("vmcmd[%zu] = vmcmd_map_%s %#"
1012 				    PRIxVADDR"/%#"PRIxVSIZE" fd@%#"
1013 				    PRIxVSIZE" prot=0%o flags=%d\n", j,
1014 				    vp[j].ev_proc == vmcmd_map_pagedvn ?
1015 				    "pagedvn" :
1016 				    vp[j].ev_proc == vmcmd_map_readvn ?
1017 				    "readvn" :
1018 				    vp[j].ev_proc == vmcmd_map_zero ?
1019 				    "zero" : "*unknown*",
1020 				    vp[j].ev_addr, vp[j].ev_len,
1021 				    vp[j].ev_offset, vp[j].ev_prot,
1022 				    vp[j].ev_flags));
1023 				if (j == i)
1024 					DPRINTF(("     ^--- failed\n"));
1025 			}
1026 		}
1027 #endif /* DEBUG_EXEC */
1028 		if (vcp->ev_flags & VMCMD_BASE)
1029 			base_vcp = vcp;
1030 	}
1031 
1032 	/* free the vmspace-creation commands, and release their references */
1033 	kill_vmcmds(&data->ed_pack.ep_vmcmds);
1034 
1035 	vn_lock(data->ed_pack.ep_vp, LK_EXCLUSIVE | LK_RETRY);
1036 	VOP_CLOSE(data->ed_pack.ep_vp, FREAD, l->l_cred);
1037 	vput(data->ed_pack.ep_vp);
1038 
1039 	/* if an error happened, deallocate and punt */
1040 	if (error) {
1041 		DPRINTF(("%s: vmcmd %zu failed: %d\n", __func__, i - 1, error));
1042 		goto exec_abort;
1043 	}
1044 
1045 	/* remember information about the process */
1046 	data->ed_arginfo.ps_nargvstr = data->ed_argc;
1047 	data->ed_arginfo.ps_nenvstr = data->ed_envc;
1048 
1049 	/* set command name & other accounting info */
1050 	commandname = strrchr(data->ed_pack.ep_resolvedname, '/');
1051 	if (commandname != NULL) {
1052 		commandname++;
1053 	} else {
1054 		commandname = data->ed_pack.ep_resolvedname;
1055 	}
1056 	i = min(strlen(commandname), MAXCOMLEN);
1057 	(void)memcpy(p->p_comm, commandname, i);
1058 	p->p_comm[i] = '\0';
1059 
1060 	dp = PNBUF_GET();
1061 	/*
1062 	 * If the path starts with /, we don't need to do any work.
1063 	 * This handles the majority of the cases.
1064 	 * In the future perhaps we could canonicalize it?
1065 	 */
1066 	if (data->ed_pathstring[0] == '/')
1067 		(void)strlcpy(data->ed_pack.ep_path = dp, data->ed_pathstring,
1068 		    MAXPATHLEN);
1069 #ifdef notyet
1070 	/*
1071 	 * Although this works most of the time [since the entry was just
1072 	 * entered in the cache] we don't use it because it theoretically
1073 	 * can fail and it is not the cleanest interface, because there
1074 	 * could be races. When the namei cache is re-written, this can
1075 	 * be changed to use the appropriate function.
1076 	 */
1077 	else if (!(error = vnode_to_path(dp, MAXPATHLEN, p->p_textvp, l, p)))
1078 		data->ed_pack.ep_path = dp;
1079 #endif
1080 	else {
1081 #ifdef notyet
1082 		printf("Cannot get path for pid %d [%s] (error %d)\n",
1083 		    (int)p->p_pid, p->p_comm, error);
1084 #endif
1085 		data->ed_pack.ep_path = NULL;
1086 		PNBUF_PUT(dp);
1087 	}
1088 
1089 	stack = (char *)STACK_ALLOC(STACK_GROW(vm->vm_minsaddr,
1090 		STACK_PTHREADSPACE + data->ed_ps_strings_sz + data->ed_szsigcode),
1091 		data->ed_pack.ep_ssize - (data->ed_ps_strings_sz + data->ed_szsigcode));
1092 
1093 #ifdef __MACHINE_STACK_GROWS_UP
1094 	/*
1095 	 * The copyargs call always copies into lower addresses
1096 	 * first, moving towards higher addresses, starting with
1097 	 * the stack pointer that we give.  When the stack grows
1098 	 * down, this puts argc/argv/envp very shallow on the
1099 	 * stack, right at the first user stack pointer.
1100 	 * When the stack grows up, the situation is reversed.
1101 	 *
1102 	 * Normally, this is no big deal.  But the ld_elf.so _rtld()
1103 	 * function expects to be called with a single pointer to
1104 	 * a region that has a few words it can stash values into,
1105 	 * followed by argc/argv/envp.  When the stack grows down,
1106 	 * it's easy to decrement the stack pointer a little bit to
1107 	 * allocate the space for these few words and pass the new
1108 	 * stack pointer to _rtld.  When the stack grows up, however,
1109 	 * a few words before argc is part of the signal trampoline, XXX
1110 	 * so we have a problem.
1111 	 *
1112 	 * Instead of changing how _rtld works, we take the easy way
1113 	 * out and steal 32 bytes before we call copyargs.
1114 	 * This extra space was allowed for when 'pack.ep_ssize' was calculated.
1115 	 */
1116 	stack += RTLD_GAP;
1117 #endif /* __MACHINE_STACK_GROWS_UP */
1118 
1119 	/* Now copy argc, args & environ to new stack */
1120 	error = (*data->ed_pack.ep_esch->es_copyargs)(l, &data->ed_pack,
1121 	    &data->ed_arginfo, &stack, data->ed_argp);
1122 
1123 	if (data->ed_pack.ep_path) {
1124 		PNBUF_PUT(data->ed_pack.ep_path);
1125 		data->ed_pack.ep_path = NULL;
1126 	}
1127 	if (error) {
1128 		DPRINTF(("%s: copyargs failed %d\n", __func__, error));
1129 		goto exec_abort;
1130 	}
1131 	/* Move the stack back to original point */
1132 	stack = (char *)STACK_GROW(vm->vm_minsaddr, data->ed_pack.ep_ssize);
1133 
1134 	/* fill process ps_strings info */
1135 	p->p_psstrp = (vaddr_t)STACK_ALLOC(STACK_GROW(vm->vm_minsaddr,
1136 	    STACK_PTHREADSPACE), data->ed_ps_strings_sz);
1137 
1138 	if (data->ed_pack.ep_flags & EXEC_32) {
1139 		arginfo32.ps_argvstr = (vaddr_t)data->ed_arginfo.ps_argvstr;
1140 		arginfo32.ps_nargvstr = data->ed_arginfo.ps_nargvstr;
1141 		arginfo32.ps_envstr = (vaddr_t)data->ed_arginfo.ps_envstr;
1142 		arginfo32.ps_nenvstr = data->ed_arginfo.ps_nenvstr;
1143 	}
1144 
1145 	/* copy out the process's ps_strings structure */
1146 	if ((error = copyout(aip, (void *)p->p_psstrp, data->ed_ps_strings_sz))
1147 	    != 0) {
1148 		DPRINTF(("%s: ps_strings copyout %p->%p size %zu failed\n",
1149 		    __func__, aip, (void *)p->p_psstrp, data->ed_ps_strings_sz));
1150 		goto exec_abort;
1151 	}
1152 
1153 	cwdexec(p);
1154 	fd_closeexec();		/* handle close on exec */
1155 
1156 	if (__predict_false(ktrace_on))
1157 		fd_ktrexecfd();
1158 
1159 	execsigs(p);		/* reset catched signals */
1160 
1161 	l->l_ctxlink = NULL;	/* reset ucontext link */
1162 
1163 
1164 	p->p_acflag &= ~AFORK;
1165 	mutex_enter(p->p_lock);
1166 	p->p_flag |= PK_EXEC;
1167 	mutex_exit(p->p_lock);
1168 
1169 	/*
1170 	 * Stop profiling.
1171 	 */
1172 	if ((p->p_stflag & PST_PROFIL) != 0) {
1173 		mutex_spin_enter(&p->p_stmutex);
1174 		stopprofclock(p);
1175 		mutex_spin_exit(&p->p_stmutex);
1176 	}
1177 
1178 	/*
1179 	 * It's OK to test PL_PPWAIT unlocked here, as other LWPs have
1180 	 * exited and exec()/exit() are the only places it will be cleared.
1181 	 */
1182 	if ((p->p_lflag & PL_PPWAIT) != 0) {
1183 #if 0
1184 		lwp_t *lp;
1185 
1186 		mutex_enter(proc_lock);
1187 		lp = p->p_vforklwp;
1188 		p->p_vforklwp = NULL;
1189 
1190 		l->l_lwpctl = NULL; /* was on loan from blocked parent */
1191 		p->p_lflag &= ~PL_PPWAIT;
1192 
1193 		lp->l_pflag &= ~LP_VFORKWAIT; /* XXX */
1194 		cv_broadcast(&lp->l_waitcv);
1195 		mutex_exit(proc_lock);
1196 #else
1197 		mutex_enter(proc_lock);
1198 		l->l_lwpctl = NULL; /* was on loan from blocked parent */
1199 		p->p_lflag &= ~PL_PPWAIT;
1200 		cv_broadcast(&p->p_pptr->p_waitcv);
1201 		mutex_exit(proc_lock);
1202 #endif
1203 	}
1204 
1205 	/*
1206 	 * Deal with set[ug]id.  MNT_NOSUID has already been used to disable
1207 	 * s[ug]id.  It's OK to check for PSL_TRACED here as we have blocked
1208 	 * out additional references on the process for the moment.
1209 	 */
1210 	if ((p->p_slflag & PSL_TRACED) == 0 &&
1211 
1212 	    (((data->ed_attr.va_mode & S_ISUID) != 0 &&
1213 	      kauth_cred_geteuid(l->l_cred) != data->ed_attr.va_uid) ||
1214 
1215 	     ((data->ed_attr.va_mode & S_ISGID) != 0 &&
1216 	      kauth_cred_getegid(l->l_cred) != data->ed_attr.va_gid))) {
1217 		/*
1218 		 * Mark the process as SUGID before we do
1219 		 * anything that might block.
1220 		 */
1221 		proc_crmod_enter();
1222 		proc_crmod_leave(NULL, NULL, true);
1223 
1224 		/* Make sure file descriptors 0..2 are in use. */
1225 		if ((error = fd_checkstd()) != 0) {
1226 			DPRINTF(("%s: fdcheckstd failed %d\n",
1227 			    __func__, error));
1228 			goto exec_abort;
1229 		}
1230 
1231 		/*
1232 		 * Copy the credential so other references don't see our
1233 		 * changes.
1234 		 */
1235 		l->l_cred = kauth_cred_copy(l->l_cred);
1236 #ifdef KTRACE
1237 		/*
1238 		 * If the persistent trace flag isn't set, turn off.
1239 		 */
1240 		if (p->p_tracep) {
1241 			mutex_enter(&ktrace_lock);
1242 			if (!(p->p_traceflag & KTRFAC_PERSISTENT))
1243 				ktrderef(p);
1244 			mutex_exit(&ktrace_lock);
1245 		}
1246 #endif
1247 		if (data->ed_attr.va_mode & S_ISUID)
1248 			kauth_cred_seteuid(l->l_cred, data->ed_attr.va_uid);
1249 		if (data->ed_attr.va_mode & S_ISGID)
1250 			kauth_cred_setegid(l->l_cred, data->ed_attr.va_gid);
1251 	} else {
1252 		if (kauth_cred_geteuid(l->l_cred) ==
1253 		    kauth_cred_getuid(l->l_cred) &&
1254 		    kauth_cred_getegid(l->l_cred) ==
1255 		    kauth_cred_getgid(l->l_cred))
1256 			p->p_flag &= ~PK_SUGID;
1257 	}
1258 
1259 	/*
1260 	 * Copy the credential so other references don't see our changes.
1261 	 * Test to see if this is necessary first, since in the common case
1262 	 * we won't need a private reference.
1263 	 */
1264 	if (kauth_cred_geteuid(l->l_cred) != kauth_cred_getsvuid(l->l_cred) ||
1265 	    kauth_cred_getegid(l->l_cred) != kauth_cred_getsvgid(l->l_cred)) {
1266 		l->l_cred = kauth_cred_copy(l->l_cred);
1267 		kauth_cred_setsvuid(l->l_cred, kauth_cred_geteuid(l->l_cred));
1268 		kauth_cred_setsvgid(l->l_cred, kauth_cred_getegid(l->l_cred));
1269 	}
1270 
1271 	/* Update the master credentials. */
1272 	if (l->l_cred != p->p_cred) {
1273 		kauth_cred_t ocred;
1274 
1275 		kauth_cred_hold(l->l_cred);
1276 		mutex_enter(p->p_lock);
1277 		ocred = p->p_cred;
1278 		p->p_cred = l->l_cred;
1279 		mutex_exit(p->p_lock);
1280 		kauth_cred_free(ocred);
1281 	}
1282 
1283 #if defined(__HAVE_RAS)
1284 	/*
1285 	 * Remove all RASs from the address space.
1286 	 */
1287 	ras_purgeall();
1288 #endif
1289 
1290 	doexechooks(p);
1291 
1292 	/* setup new registers and do misc. setup. */
1293 	(*data->ed_pack.ep_esch->es_emul->e_setregs)(l, &data->ed_pack,
1294 	     (vaddr_t)stack);
1295 	if (data->ed_pack.ep_esch->es_setregs)
1296 		(*data->ed_pack.ep_esch->es_setregs)(l, &data->ed_pack,
1297 		    (vaddr_t)stack);
1298 
1299 	/* Provide a consistent LWP private setting */
1300 	(void)lwp_setprivate(l, NULL);
1301 
1302 	/* Discard all PCU state; need to start fresh */
1303 	pcu_discard_all(l);
1304 
1305 	/* map the process's signal trampoline code */
1306 	if ((error = exec_sigcode_map(p, data->ed_pack.ep_esch->es_emul)) != 0) {
1307 		DPRINTF(("%s: map sigcode failed %d\n", __func__, error));
1308 		goto exec_abort;
1309 	}
1310 
1311 	pool_put(&exec_pool, data->ed_argp);
1312 
1313 	/* notify others that we exec'd */
1314 	KNOTE(&p->p_klist, NOTE_EXEC);
1315 
1316 	kmem_free(data->ed_pack.ep_hdr, data->ed_pack.ep_hdrlen);
1317 
1318 	SDT_PROBE(proc,,,exec_success, data->ed_pack.ep_name, 0, 0, 0, 0);
1319 
1320 	/* The emulation root will usually have been found when we looked
1321 	 * for the elf interpreter (or similar), if not look now. */
1322 	if (data->ed_pack.ep_esch->es_emul->e_path != NULL &&
1323 	    data->ed_pack.ep_emul_root == NULL)
1324 		emul_find_root(l, &data->ed_pack);
1325 
1326 	/* Any old emulation root got removed by fdcloseexec */
1327 	rw_enter(&p->p_cwdi->cwdi_lock, RW_WRITER);
1328 	p->p_cwdi->cwdi_edir = data->ed_pack.ep_emul_root;
1329 	rw_exit(&p->p_cwdi->cwdi_lock);
1330 	data->ed_pack.ep_emul_root = NULL;
1331 	if (data->ed_pack.ep_interp != NULL)
1332 		vrele(data->ed_pack.ep_interp);
1333 
1334 	/*
1335 	 * Call emulation specific exec hook. This can setup per-process
1336 	 * p->p_emuldata or do any other per-process stuff an emulation needs.
1337 	 *
1338 	 * If we are executing process of different emulation than the
1339 	 * original forked process, call e_proc_exit() of the old emulation
1340 	 * first, then e_proc_exec() of new emulation. If the emulation is
1341 	 * same, the exec hook code should deallocate any old emulation
1342 	 * resources held previously by this process.
1343 	 */
1344 	if (p->p_emul && p->p_emul->e_proc_exit
1345 	    && p->p_emul != data->ed_pack.ep_esch->es_emul)
1346 		(*p->p_emul->e_proc_exit)(p);
1347 
1348 	/*
1349 	 * This is now LWP 1.
1350 	 */
1351 	mutex_enter(p->p_lock);
1352 	p->p_nlwpid = 1;
1353 	l->l_lid = 1;
1354 	mutex_exit(p->p_lock);
1355 
1356 	/*
1357 	 * Call exec hook. Emulation code may NOT store reference to anything
1358 	 * from &pack.
1359 	 */
1360 	if (data->ed_pack.ep_esch->es_emul->e_proc_exec)
1361 		(*data->ed_pack.ep_esch->es_emul->e_proc_exec)(p, &data->ed_pack);
1362 
1363 	/* update p_emul, the old value is no longer needed */
1364 	p->p_emul = data->ed_pack.ep_esch->es_emul;
1365 
1366 	/* ...and the same for p_execsw */
1367 	p->p_execsw = data->ed_pack.ep_esch;
1368 
1369 #ifdef __HAVE_SYSCALL_INTERN
1370 	(*p->p_emul->e_syscall_intern)(p);
1371 #endif
1372 	ktremul();
1373 
1374 	/* Allow new references from the debugger/procfs. */
1375 	rw_exit(&p->p_reflock);
1376 	if (!no_local_exec_lock)
1377 		rw_exit(&exec_lock);
1378 
1379 	mutex_enter(proc_lock);
1380 
1381 	if ((p->p_slflag & (PSL_TRACED|PSL_SYSCALL)) == PSL_TRACED) {
1382 		KSI_INIT_EMPTY(&ksi);
1383 		ksi.ksi_signo = SIGTRAP;
1384 		ksi.ksi_lid = l->l_lid;
1385 		kpsignal(p, &ksi, NULL);
1386 	}
1387 
1388 	if (p->p_sflag & PS_STOPEXEC) {
1389 		KERNEL_UNLOCK_ALL(l, &l->l_biglocks);
1390 		p->p_pptr->p_nstopchild++;
1391 		p->p_pptr->p_waited = 0;
1392 		mutex_enter(p->p_lock);
1393 		ksiginfo_queue_init(&kq);
1394 		sigclearall(p, &contsigmask, &kq);
1395 		lwp_lock(l);
1396 		l->l_stat = LSSTOP;
1397 		p->p_stat = SSTOP;
1398 		p->p_nrlwps--;
1399 		lwp_unlock(l);
1400 		mutex_exit(p->p_lock);
1401 		mutex_exit(proc_lock);
1402 		lwp_lock(l);
1403 		mi_switch(l);
1404 		ksiginfo_queue_drain(&kq);
1405 		KERNEL_LOCK(l->l_biglocks, l);
1406 	} else {
1407 		mutex_exit(proc_lock);
1408 	}
1409 
1410 	pathbuf_stringcopy_put(data->ed_pathbuf, data->ed_pathstring);
1411 	pathbuf_destroy(data->ed_pathbuf);
1412 	PNBUF_PUT(data->ed_resolvedpathbuf);
1413 	DPRINTF(("%s finished\n", __func__));
1414 	return (EJUSTRETURN);
1415 
1416  exec_abort:
1417 	SDT_PROBE(proc,,,exec_failure, error, 0, 0, 0, 0);
1418 	rw_exit(&p->p_reflock);
1419 	if (!no_local_exec_lock)
1420 		rw_exit(&exec_lock);
1421 
1422 	pathbuf_stringcopy_put(data->ed_pathbuf, data->ed_pathstring);
1423 	pathbuf_destroy(data->ed_pathbuf);
1424 	PNBUF_PUT(data->ed_resolvedpathbuf);
1425 
1426 	/*
1427 	 * the old process doesn't exist anymore.  exit gracefully.
1428 	 * get rid of the (new) address space we have created, if any, get rid
1429 	 * of our namei data and vnode, and exit noting failure
1430 	 */
1431 	uvm_deallocate(&vm->vm_map, VM_MIN_ADDRESS,
1432 		VM_MAXUSER_ADDRESS - VM_MIN_ADDRESS);
1433 
1434 	exec_free_emul_arg(&data->ed_pack);
1435 	pool_put(&exec_pool, data->ed_argp);
1436 	kmem_free(data->ed_pack.ep_hdr, data->ed_pack.ep_hdrlen);
1437 	if (data->ed_pack.ep_emul_root != NULL)
1438 		vrele(data->ed_pack.ep_emul_root);
1439 	if (data->ed_pack.ep_interp != NULL)
1440 		vrele(data->ed_pack.ep_interp);
1441 
1442 	/* Acquire the sched-state mutex (exit1() will release it). */
1443 	if (!is_spawn) {
1444 		mutex_enter(p->p_lock);
1445 		exit1(l, W_EXITCODE(error, SIGABRT));
1446 	}
1447 
1448 	return error;
1449 }
1450 
1451 int
1452 execve1(struct lwp *l, const char *path, char * const *args,
1453     char * const *envs, execve_fetch_element_t fetch_element)
1454 {
1455 	struct execve_data data;
1456 	int error;
1457 
1458 	error = execve_loadvm(l, path, args, envs, fetch_element, &data);
1459 	if (error)
1460 		return error;
1461 	error = execve_runproc(l, &data, false, false);
1462 	return error;
1463 }
1464 
1465 int
1466 copyargs(struct lwp *l, struct exec_package *pack, struct ps_strings *arginfo,
1467     char **stackp, void *argp)
1468 {
1469 	char	**cpp, *dp, *sp;
1470 	size_t	len;
1471 	void	*nullp;
1472 	long	argc, envc;
1473 	int	error;
1474 
1475 	cpp = (char **)*stackp;
1476 	nullp = NULL;
1477 	argc = arginfo->ps_nargvstr;
1478 	envc = arginfo->ps_nenvstr;
1479 	if ((error = copyout(&argc, cpp++, sizeof(argc))) != 0) {
1480 		COPYPRINTF("", cpp - 1, sizeof(argc));
1481 		return error;
1482 	}
1483 
1484 	dp = (char *) (cpp + argc + envc + 2 + pack->ep_esch->es_arglen);
1485 	sp = argp;
1486 
1487 	/* XXX don't copy them out, remap them! */
1488 	arginfo->ps_argvstr = cpp; /* remember location of argv for later */
1489 
1490 	for (; --argc >= 0; sp += len, dp += len) {
1491 		if ((error = copyout(&dp, cpp++, sizeof(dp))) != 0) {
1492 			COPYPRINTF("", cpp - 1, sizeof(dp));
1493 			return error;
1494 		}
1495 		if ((error = copyoutstr(sp, dp, ARG_MAX, &len)) != 0) {
1496 			COPYPRINTF("str", dp, (size_t)ARG_MAX);
1497 			return error;
1498 		}
1499 	}
1500 
1501 	if ((error = copyout(&nullp, cpp++, sizeof(nullp))) != 0) {
1502 		COPYPRINTF("", cpp - 1, sizeof(nullp));
1503 		return error;
1504 	}
1505 
1506 	arginfo->ps_envstr = cpp; /* remember location of envp for later */
1507 
1508 	for (; --envc >= 0; sp += len, dp += len) {
1509 		if ((error = copyout(&dp, cpp++, sizeof(dp))) != 0) {
1510 			COPYPRINTF("", cpp - 1, sizeof(dp));
1511 			return error;
1512 		}
1513 		if ((error = copyoutstr(sp, dp, ARG_MAX, &len)) != 0) {
1514 			COPYPRINTF("str", dp, (size_t)ARG_MAX);
1515 			return error;
1516 		}
1517 
1518 	}
1519 
1520 	if ((error = copyout(&nullp, cpp++, sizeof(nullp))) != 0) {
1521 		COPYPRINTF("", cpp - 1, sizeof(nullp));
1522 		return error;
1523 	}
1524 
1525 	*stackp = (char *)cpp;
1526 	return 0;
1527 }
1528 
1529 
1530 /*
1531  * Add execsw[] entries.
1532  */
1533 int
1534 exec_add(struct execsw *esp, int count)
1535 {
1536 	struct exec_entry	*it;
1537 	int			i;
1538 
1539 	if (count == 0) {
1540 		return 0;
1541 	}
1542 
1543 	/* Check for duplicates. */
1544 	rw_enter(&exec_lock, RW_WRITER);
1545 	for (i = 0; i < count; i++) {
1546 		LIST_FOREACH(it, &ex_head, ex_list) {
1547 			/* assume unique (makecmds, probe_func, emulation) */
1548 			if (it->ex_sw->es_makecmds == esp[i].es_makecmds &&
1549 			    it->ex_sw->u.elf_probe_func ==
1550 			    esp[i].u.elf_probe_func &&
1551 			    it->ex_sw->es_emul == esp[i].es_emul) {
1552 				rw_exit(&exec_lock);
1553 				return EEXIST;
1554 			}
1555 		}
1556 	}
1557 
1558 	/* Allocate new entries. */
1559 	for (i = 0; i < count; i++) {
1560 		it = kmem_alloc(sizeof(*it), KM_SLEEP);
1561 		it->ex_sw = &esp[i];
1562 		LIST_INSERT_HEAD(&ex_head, it, ex_list);
1563 	}
1564 
1565 	/* update execsw[] */
1566 	exec_init(0);
1567 	rw_exit(&exec_lock);
1568 	return 0;
1569 }
1570 
1571 /*
1572  * Remove execsw[] entry.
1573  */
1574 int
1575 exec_remove(struct execsw *esp, int count)
1576 {
1577 	struct exec_entry	*it, *next;
1578 	int			i;
1579 	const struct proclist_desc *pd;
1580 	proc_t			*p;
1581 
1582 	if (count == 0) {
1583 		return 0;
1584 	}
1585 
1586 	/* Abort if any are busy. */
1587 	rw_enter(&exec_lock, RW_WRITER);
1588 	for (i = 0; i < count; i++) {
1589 		mutex_enter(proc_lock);
1590 		for (pd = proclists; pd->pd_list != NULL; pd++) {
1591 			PROCLIST_FOREACH(p, pd->pd_list) {
1592 				if (p->p_execsw == &esp[i]) {
1593 					mutex_exit(proc_lock);
1594 					rw_exit(&exec_lock);
1595 					return EBUSY;
1596 				}
1597 			}
1598 		}
1599 		mutex_exit(proc_lock);
1600 	}
1601 
1602 	/* None are busy, so remove them all. */
1603 	for (i = 0; i < count; i++) {
1604 		for (it = LIST_FIRST(&ex_head); it != NULL; it = next) {
1605 			next = LIST_NEXT(it, ex_list);
1606 			if (it->ex_sw == &esp[i]) {
1607 				LIST_REMOVE(it, ex_list);
1608 				kmem_free(it, sizeof(*it));
1609 				break;
1610 			}
1611 		}
1612 	}
1613 
1614 	/* update execsw[] */
1615 	exec_init(0);
1616 	rw_exit(&exec_lock);
1617 	return 0;
1618 }
1619 
1620 /*
1621  * Initialize exec structures. If init_boot is true, also does necessary
1622  * one-time initialization (it's called from main() that way).
1623  * Once system is multiuser, this should be called with exec_lock held,
1624  * i.e. via exec_{add|remove}().
1625  */
1626 int
1627 exec_init(int init_boot)
1628 {
1629 	const struct execsw 	**sw;
1630 	struct exec_entry	*ex;
1631 	SLIST_HEAD(,exec_entry)	first;
1632 	SLIST_HEAD(,exec_entry)	any;
1633 	SLIST_HEAD(,exec_entry)	last;
1634 	int			i, sz;
1635 
1636 	if (init_boot) {
1637 		/* do one-time initializations */
1638 		rw_init(&exec_lock);
1639 		mutex_init(&sigobject_lock, MUTEX_DEFAULT, IPL_NONE);
1640 		pool_init(&exec_pool, NCARGS, 0, 0, PR_NOALIGN|PR_NOTOUCH,
1641 		    "execargs", &exec_palloc, IPL_NONE);
1642 		pool_sethardlimit(&exec_pool, maxexec, "should not happen", 0);
1643 	} else {
1644 		KASSERT(rw_write_held(&exec_lock));
1645 	}
1646 
1647 	/* Sort each entry onto the appropriate queue. */
1648 	SLIST_INIT(&first);
1649 	SLIST_INIT(&any);
1650 	SLIST_INIT(&last);
1651 	sz = 0;
1652 	LIST_FOREACH(ex, &ex_head, ex_list) {
1653 		switch(ex->ex_sw->es_prio) {
1654 		case EXECSW_PRIO_FIRST:
1655 			SLIST_INSERT_HEAD(&first, ex, ex_slist);
1656 			break;
1657 		case EXECSW_PRIO_ANY:
1658 			SLIST_INSERT_HEAD(&any, ex, ex_slist);
1659 			break;
1660 		case EXECSW_PRIO_LAST:
1661 			SLIST_INSERT_HEAD(&last, ex, ex_slist);
1662 			break;
1663 		default:
1664 			panic("%s", __func__);
1665 			break;
1666 		}
1667 		sz++;
1668 	}
1669 
1670 	/*
1671 	 * Create new execsw[].  Ensure we do not try a zero-sized
1672 	 * allocation.
1673 	 */
1674 	sw = kmem_alloc(sz * sizeof(struct execsw *) + 1, KM_SLEEP);
1675 	i = 0;
1676 	SLIST_FOREACH(ex, &first, ex_slist) {
1677 		sw[i++] = ex->ex_sw;
1678 	}
1679 	SLIST_FOREACH(ex, &any, ex_slist) {
1680 		sw[i++] = ex->ex_sw;
1681 	}
1682 	SLIST_FOREACH(ex, &last, ex_slist) {
1683 		sw[i++] = ex->ex_sw;
1684 	}
1685 
1686 	/* Replace old execsw[] and free used memory. */
1687 	if (execsw != NULL) {
1688 		kmem_free(__UNCONST(execsw),
1689 		    nexecs * sizeof(struct execsw *) + 1);
1690 	}
1691 	execsw = sw;
1692 	nexecs = sz;
1693 
1694 	/* Figure out the maximum size of an exec header. */
1695 	exec_maxhdrsz = sizeof(int);
1696 	for (i = 0; i < nexecs; i++) {
1697 		if (execsw[i]->es_hdrsz > exec_maxhdrsz)
1698 			exec_maxhdrsz = execsw[i]->es_hdrsz;
1699 	}
1700 
1701 	return 0;
1702 }
1703 
1704 static int
1705 exec_sigcode_map(struct proc *p, const struct emul *e)
1706 {
1707 	vaddr_t va;
1708 	vsize_t sz;
1709 	int error;
1710 	struct uvm_object *uobj;
1711 
1712 	sz = (vaddr_t)e->e_esigcode - (vaddr_t)e->e_sigcode;
1713 
1714 	if (e->e_sigobject == NULL || sz == 0) {
1715 		return 0;
1716 	}
1717 
1718 	/*
1719 	 * If we don't have a sigobject for this emulation, create one.
1720 	 *
1721 	 * sigobject is an anonymous memory object (just like SYSV shared
1722 	 * memory) that we keep a permanent reference to and that we map
1723 	 * in all processes that need this sigcode. The creation is simple,
1724 	 * we create an object, add a permanent reference to it, map it in
1725 	 * kernel space, copy out the sigcode to it and unmap it.
1726 	 * We map it with PROT_READ|PROT_EXEC into the process just
1727 	 * the way sys_mmap() would map it.
1728 	 */
1729 
1730 	uobj = *e->e_sigobject;
1731 	if (uobj == NULL) {
1732 		mutex_enter(&sigobject_lock);
1733 		if ((uobj = *e->e_sigobject) == NULL) {
1734 			uobj = uao_create(sz, 0);
1735 			(*uobj->pgops->pgo_reference)(uobj);
1736 			va = vm_map_min(kernel_map);
1737 			if ((error = uvm_map(kernel_map, &va, round_page(sz),
1738 			    uobj, 0, 0,
1739 			    UVM_MAPFLAG(UVM_PROT_RW, UVM_PROT_RW,
1740 			    UVM_INH_SHARE, UVM_ADV_RANDOM, 0)))) {
1741 				printf("kernel mapping failed %d\n", error);
1742 				(*uobj->pgops->pgo_detach)(uobj);
1743 				mutex_exit(&sigobject_lock);
1744 				return (error);
1745 			}
1746 			memcpy((void *)va, e->e_sigcode, sz);
1747 #ifdef PMAP_NEED_PROCWR
1748 			pmap_procwr(&proc0, va, sz);
1749 #endif
1750 			uvm_unmap(kernel_map, va, va + round_page(sz));
1751 			*e->e_sigobject = uobj;
1752 		}
1753 		mutex_exit(&sigobject_lock);
1754 	}
1755 
1756 	/* Just a hint to uvm_map where to put it. */
1757 	va = e->e_vm_default_addr(p, (vaddr_t)p->p_vmspace->vm_daddr,
1758 	    round_page(sz));
1759 
1760 #ifdef __alpha__
1761 	/*
1762 	 * Tru64 puts /sbin/loader at the end of user virtual memory,
1763 	 * which causes the above calculation to put the sigcode at
1764 	 * an invalid address.  Put it just below the text instead.
1765 	 */
1766 	if (va == (vaddr_t)vm_map_max(&p->p_vmspace->vm_map)) {
1767 		va = (vaddr_t)p->p_vmspace->vm_taddr - round_page(sz);
1768 	}
1769 #endif
1770 
1771 	(*uobj->pgops->pgo_reference)(uobj);
1772 	error = uvm_map(&p->p_vmspace->vm_map, &va, round_page(sz),
1773 			uobj, 0, 0,
1774 			UVM_MAPFLAG(UVM_PROT_RX, UVM_PROT_RX, UVM_INH_SHARE,
1775 				    UVM_ADV_RANDOM, 0));
1776 	if (error) {
1777 		DPRINTF(("%s, %d: map %p "
1778 		    "uvm_map %#"PRIxVSIZE"@%#"PRIxVADDR" failed %d\n",
1779 		    __func__, __LINE__, &p->p_vmspace->vm_map, round_page(sz),
1780 		    va, error));
1781 		(*uobj->pgops->pgo_detach)(uobj);
1782 		return (error);
1783 	}
1784 	p->p_sigctx.ps_sigcode = (void *)va;
1785 	return (0);
1786 }
1787 
1788 /*
1789  * Release a refcount on spawn_exec_data and destroy memory, if this
1790  * was the last one.
1791  */
1792 static void
1793 spawn_exec_data_release(struct spawn_exec_data *data)
1794 {
1795 	if (atomic_dec_32_nv(&data->sed_refcnt) != 0)
1796 		return;
1797 
1798 	cv_destroy(&data->sed_cv_child_ready);
1799 	mutex_destroy(&data->sed_mtx_child);
1800 
1801 	if (data->sed_actions)
1802 		posix_spawn_fa_free(data->sed_actions,
1803 		    data->sed_actions->len);
1804 	if (data->sed_attrs)
1805 		kmem_free(data->sed_attrs,
1806 		    sizeof(*data->sed_attrs));
1807 	kmem_free(data, sizeof(*data));
1808 }
1809 
1810 /*
1811  * A child lwp of a posix_spawn operation starts here and ends up in
1812  * cpu_spawn_return, dealing with all filedescriptor and scheduler
1813  * manipulations in between.
1814  * The parent waits for the child, as it is not clear wether the child
1815  * will be able to aquire its own exec_lock. If it can, the parent can
1816  * be released early and continue running in parallel. If not (or if the
1817  * magic debug flag is passed in the scheduler attribute struct), the
1818  * child rides on the parent's exec lock untill it is ready to return to
1819  * to userland - and only then releases the parent. This method loses
1820  * concurrency, but improves error reporting.
1821  */
1822 static void
1823 spawn_return(void *arg)
1824 {
1825 	struct spawn_exec_data *spawn_data = arg;
1826 	struct lwp *l = curlwp;
1827 	int error, newfd;
1828 	size_t i;
1829 	const struct posix_spawn_file_actions_entry *fae;
1830 	pid_t ppid;
1831 	register_t retval;
1832 	bool have_reflock;
1833 	bool parent_is_waiting = true;
1834 
1835 	/*
1836 	 * Check if we can release parent early.
1837 	 * We either need to have no sed_attrs, or sed_attrs does not
1838 	 * have POSIX_SPAWN_RETURNERROR or one of the flags, that require
1839 	 * safe access to the parent proc (passed in sed_parent).
1840 	 * We then try to get the exec_lock, and only if that works, we can
1841 	 * release the parent here already.
1842 	 */
1843 	ppid = spawn_data->sed_parent->p_pid;
1844 	if ((!spawn_data->sed_attrs
1845 	    || (spawn_data->sed_attrs->sa_flags
1846 	        & (POSIX_SPAWN_RETURNERROR|POSIX_SPAWN_SETPGROUP)) == 0)
1847 	    && rw_tryenter(&exec_lock, RW_READER)) {
1848 		parent_is_waiting = false;
1849 		mutex_enter(&spawn_data->sed_mtx_child);
1850 		cv_signal(&spawn_data->sed_cv_child_ready);
1851 		mutex_exit(&spawn_data->sed_mtx_child);
1852 	}
1853 
1854 	/* don't allow debugger access yet */
1855 	rw_enter(&l->l_proc->p_reflock, RW_WRITER);
1856 	have_reflock = true;
1857 
1858 	error = 0;
1859 	/* handle posix_spawn_file_actions */
1860 	if (spawn_data->sed_actions != NULL) {
1861 		for (i = 0; i < spawn_data->sed_actions->len; i++) {
1862 			fae = &spawn_data->sed_actions->fae[i];
1863 			switch (fae->fae_action) {
1864 			case FAE_OPEN:
1865 				if (fd_getfile(fae->fae_fildes) != NULL) {
1866 					error = fd_close(fae->fae_fildes);
1867 					if (error)
1868 						break;
1869 				}
1870 				error = fd_open(fae->fae_path, fae->fae_oflag,
1871 				    fae->fae_mode, &newfd);
1872  				if (error)
1873  					break;
1874 				if (newfd != fae->fae_fildes) {
1875 					error = dodup(l, newfd,
1876 					    fae->fae_fildes, 0, &retval);
1877 					if (fd_getfile(newfd) != NULL)
1878 						fd_close(newfd);
1879 				}
1880 				break;
1881 			case FAE_DUP2:
1882 				error = dodup(l, fae->fae_fildes,
1883 				    fae->fae_newfildes, 0, &retval);
1884 				break;
1885 			case FAE_CLOSE:
1886 				if (fd_getfile(fae->fae_fildes) == NULL) {
1887 					error = EBADF;
1888 					break;
1889 				}
1890 				error = fd_close(fae->fae_fildes);
1891 				break;
1892 			}
1893 			if (error)
1894 				goto report_error;
1895 		}
1896 	}
1897 
1898 	/* handle posix_spawnattr */
1899 	if (spawn_data->sed_attrs != NULL) {
1900 		int ostat;
1901 		struct sigaction sigact;
1902 		sigact._sa_u._sa_handler = SIG_DFL;
1903 		sigact.sa_flags = 0;
1904 
1905 		/*
1906 		 * set state to SSTOP so that this proc can be found by pid.
1907 		 * see proc_enterprp, do_sched_setparam below
1908 		 */
1909 		ostat = l->l_proc->p_stat;
1910 		l->l_proc->p_stat = SSTOP;
1911 
1912 		/* Set process group */
1913 		if (spawn_data->sed_attrs->sa_flags & POSIX_SPAWN_SETPGROUP) {
1914 			pid_t mypid = l->l_proc->p_pid,
1915 			     pgrp = spawn_data->sed_attrs->sa_pgroup;
1916 
1917 			if (pgrp == 0)
1918 				pgrp = mypid;
1919 
1920 			error = proc_enterpgrp(spawn_data->sed_parent,
1921 			    mypid, pgrp, false);
1922 			if (error)
1923 				goto report_error;
1924 		}
1925 
1926 		/* Set scheduler policy */
1927 		if (spawn_data->sed_attrs->sa_flags & POSIX_SPAWN_SETSCHEDULER)
1928 			error = do_sched_setparam(l->l_proc->p_pid, 0,
1929 			    spawn_data->sed_attrs->sa_schedpolicy,
1930 			    &spawn_data->sed_attrs->sa_schedparam);
1931 		else if (spawn_data->sed_attrs->sa_flags
1932 		    & POSIX_SPAWN_SETSCHEDPARAM) {
1933 			error = do_sched_setparam(ppid, 0,
1934 			    SCHED_NONE, &spawn_data->sed_attrs->sa_schedparam);
1935 		}
1936 		if (error)
1937 			goto report_error;
1938 
1939 		/* Reset user ID's */
1940 		if (spawn_data->sed_attrs->sa_flags & POSIX_SPAWN_RESETIDS) {
1941 			error = do_setresuid(l, -1,
1942 			     kauth_cred_getgid(l->l_cred), -1,
1943 			     ID_E_EQ_R | ID_E_EQ_S);
1944 			if (error)
1945 				goto report_error;
1946 			error = do_setresuid(l, -1,
1947 			    kauth_cred_getuid(l->l_cred), -1,
1948 			    ID_E_EQ_R | ID_E_EQ_S);
1949 			if (error)
1950 				goto report_error;
1951 		}
1952 
1953 		/* Set signal masks/defaults */
1954 		if (spawn_data->sed_attrs->sa_flags & POSIX_SPAWN_SETSIGMASK) {
1955 			mutex_enter(l->l_proc->p_lock);
1956 			error = sigprocmask1(l, SIG_SETMASK,
1957 			    &spawn_data->sed_attrs->sa_sigmask, NULL);
1958 			mutex_exit(l->l_proc->p_lock);
1959 			if (error)
1960 				goto report_error;
1961 		}
1962 
1963 		if (spawn_data->sed_attrs->sa_flags & POSIX_SPAWN_SETSIGDEF) {
1964 			for (i = 1; i <= NSIG; i++) {
1965 				if (sigismember(
1966 				    &spawn_data->sed_attrs->sa_sigdefault, i))
1967 					sigaction1(l, i, &sigact, NULL, NULL,
1968 					    0);
1969 			}
1970 		}
1971 		l->l_proc->p_stat = ostat;
1972 	}
1973 
1974 	/* now do the real exec */
1975 	error = execve_runproc(l, &spawn_data->sed_exec, parent_is_waiting,
1976 	    true);
1977 	have_reflock = false;
1978 	if (error == EJUSTRETURN)
1979 		error = 0;
1980 	else if (error)
1981 		goto report_error;
1982 
1983 	if (parent_is_waiting) {
1984 		mutex_enter(&spawn_data->sed_mtx_child);
1985 		cv_signal(&spawn_data->sed_cv_child_ready);
1986 		mutex_exit(&spawn_data->sed_mtx_child);
1987 	}
1988 
1989 	/* release our refcount on the data */
1990 	spawn_exec_data_release(spawn_data);
1991 
1992 	/* and finaly: leave to userland for the first time */
1993 	cpu_spawn_return(l);
1994 
1995 	/* NOTREACHED */
1996 	return;
1997 
1998  report_error:
1999  	if (have_reflock) {
2000  		/*
2001 		 * We have not passed through execve_runproc(),
2002 		 * which would have released the p_reflock and also
2003 		 * taken ownership of the sed_exec part of spawn_data,
2004 		 * so release/free both here.
2005 		 */
2006 		rw_exit(&l->l_proc->p_reflock);
2007 		execve_free_data(&spawn_data->sed_exec);
2008 	}
2009 
2010 	if (parent_is_waiting) {
2011 		/* pass error to parent */
2012 		mutex_enter(&spawn_data->sed_mtx_child);
2013 		spawn_data->sed_error = error;
2014 		cv_signal(&spawn_data->sed_cv_child_ready);
2015 		mutex_exit(&spawn_data->sed_mtx_child);
2016 	} else {
2017 		rw_exit(&exec_lock);
2018 	}
2019 
2020 	/* release our refcount on the data */
2021 	spawn_exec_data_release(spawn_data);
2022 
2023 	/* done, exit */
2024 	mutex_enter(l->l_proc->p_lock);
2025 	/*
2026 	 * Posix explicitly asks for an exit code of 127 if we report
2027 	 * errors from the child process - so, unfortunately, there
2028 	 * is no way to report a more exact error code.
2029 	 * A NetBSD specific workaround is POSIX_SPAWN_RETURNERROR as
2030 	 * flag bit in the attrp argument to posix_spawn(2), see above.
2031 	 */
2032 	exit1(l, W_EXITCODE(127, 0));
2033 }
2034 
2035 void
2036 posix_spawn_fa_free(struct posix_spawn_file_actions *fa, size_t len)
2037 {
2038 
2039 	for (size_t i = 0; i < len; i++) {
2040 		struct posix_spawn_file_actions_entry *fae = &fa->fae[i];
2041 		if (fae->fae_action != FAE_OPEN)
2042 			continue;
2043 		kmem_free(fae->fae_path, strlen(fae->fae_path) + 1);
2044 	}
2045 	if (fa->len > 0)
2046 		kmem_free(fa->fae, sizeof(*fa->fae) * fa->len);
2047 	kmem_free(fa, sizeof(*fa));
2048 }
2049 
2050 static int
2051 posix_spawn_fa_alloc(struct posix_spawn_file_actions **fap,
2052     const struct posix_spawn_file_actions *ufa)
2053 {
2054 	struct posix_spawn_file_actions *fa;
2055 	struct posix_spawn_file_actions_entry *fae;
2056 	char *pbuf = NULL;
2057 	int error;
2058 	size_t i = 0;
2059 
2060 	fa = kmem_alloc(sizeof(*fa), KM_SLEEP);
2061 	error = copyin(ufa, fa, sizeof(*fa));
2062 	if (error) {
2063 		fa->fae = NULL;
2064 		fa->len = 0;
2065 		goto out;
2066 	}
2067 
2068 	if (fa->len == 0) {
2069 		kmem_free(fa, sizeof(*fa));
2070 		return 0;
2071 	}
2072 
2073 	fa->size = fa->len;
2074 	size_t fal = fa->len * sizeof(*fae);
2075 	fae = fa->fae;
2076 	fa->fae = kmem_alloc(fal, KM_SLEEP);
2077 	error = copyin(fae, fa->fae, fal);
2078 	if (error)
2079 		goto out;
2080 
2081 	pbuf = PNBUF_GET();
2082 	for (; i < fa->len; i++) {
2083 		fae = &fa->fae[i];
2084 		if (fae->fae_action != FAE_OPEN)
2085 			continue;
2086 		error = copyinstr(fae->fae_path, pbuf, MAXPATHLEN, &fal);
2087 		if (error)
2088 			goto out;
2089 		fae->fae_path = kmem_alloc(fal, KM_SLEEP);
2090 		memcpy(fae->fae_path, pbuf, fal);
2091 	}
2092 	PNBUF_PUT(pbuf);
2093 
2094 	*fap = fa;
2095 	return 0;
2096 out:
2097 	if (pbuf)
2098 		PNBUF_PUT(pbuf);
2099 	posix_spawn_fa_free(fa, i);
2100 	return error;
2101 }
2102 
2103 int
2104 check_posix_spawn(struct lwp *l1)
2105 {
2106 	int error, tnprocs, count;
2107 	uid_t uid;
2108 	struct proc *p1;
2109 
2110 	p1 = l1->l_proc;
2111 	uid = kauth_cred_getuid(l1->l_cred);
2112 	tnprocs = atomic_inc_uint_nv(&nprocs);
2113 
2114 	/*
2115 	 * Although process entries are dynamically created, we still keep
2116 	 * a global limit on the maximum number we will create.
2117 	 */
2118 	if (__predict_false(tnprocs >= maxproc))
2119 		error = -1;
2120 	else
2121 		error = kauth_authorize_process(l1->l_cred,
2122 		    KAUTH_PROCESS_FORK, p1, KAUTH_ARG(tnprocs), NULL, NULL);
2123 
2124 	if (error) {
2125 		atomic_dec_uint(&nprocs);
2126 		return EAGAIN;
2127 	}
2128 
2129 	/*
2130 	 * Enforce limits.
2131 	 */
2132 	count = chgproccnt(uid, 1);
2133 	if (kauth_authorize_process(l1->l_cred, KAUTH_PROCESS_RLIMIT,
2134 	     p1, KAUTH_ARG(KAUTH_REQ_PROCESS_RLIMIT_BYPASS),
2135 	     &p1->p_rlimit[RLIMIT_NPROC], KAUTH_ARG(RLIMIT_NPROC)) != 0 &&
2136 	    __predict_false(count > p1->p_rlimit[RLIMIT_NPROC].rlim_cur)) {
2137 		(void)chgproccnt(uid, -1);
2138 		atomic_dec_uint(&nprocs);
2139 		return EAGAIN;
2140 	}
2141 
2142 	return 0;
2143 }
2144 
2145 int
2146 do_posix_spawn(struct lwp *l1, pid_t *pid_res, bool *child_ok, const char *path,
2147 	struct posix_spawn_file_actions *fa,
2148 	struct posix_spawnattr *sa,
2149 	char *const *argv, char *const *envp,
2150 	execve_fetch_element_t fetch)
2151 {
2152 
2153 	struct proc *p1, *p2;
2154 	struct lwp *l2;
2155 	int error;
2156 	struct spawn_exec_data *spawn_data;
2157 	vaddr_t uaddr;
2158 	pid_t pid;
2159 	bool have_exec_lock = false;
2160 
2161 	p1 = l1->l_proc;
2162 
2163 	/* Allocate and init spawn_data */
2164 	spawn_data = kmem_zalloc(sizeof(*spawn_data), KM_SLEEP);
2165 	spawn_data->sed_refcnt = 1; /* only parent so far */
2166 	cv_init(&spawn_data->sed_cv_child_ready, "pspawn");
2167 	mutex_init(&spawn_data->sed_mtx_child, MUTEX_DEFAULT, IPL_NONE);
2168 	mutex_enter(&spawn_data->sed_mtx_child);
2169 
2170 	/*
2171 	 * Do the first part of the exec now, collect state
2172 	 * in spawn_data.
2173 	 */
2174 	error = execve_loadvm(l1, path, argv,
2175 	    envp, fetch, &spawn_data->sed_exec);
2176 	if (error == EJUSTRETURN)
2177 		error = 0;
2178 	else if (error)
2179 		goto error_exit;
2180 
2181 	have_exec_lock = true;
2182 
2183 	/*
2184 	 * Allocate virtual address space for the U-area now, while it
2185 	 * is still easy to abort the fork operation if we're out of
2186 	 * kernel virtual address space.
2187 	 */
2188 	uaddr = uvm_uarea_alloc();
2189 	if (__predict_false(uaddr == 0)) {
2190 		error = ENOMEM;
2191 		goto error_exit;
2192 	}
2193 
2194 	/*
2195 	 * Allocate new proc. Borrow proc0 vmspace for it, we will
2196 	 * replace it with its own before returning to userland
2197 	 * in the child.
2198 	 * This is a point of no return, we will have to go through
2199 	 * the child proc to properly clean it up past this point.
2200 	 */
2201 	p2 = proc_alloc();
2202 	pid = p2->p_pid;
2203 
2204 	/*
2205 	 * Make a proc table entry for the new process.
2206 	 * Start by zeroing the section of proc that is zero-initialized,
2207 	 * then copy the section that is copied directly from the parent.
2208 	 */
2209 	memset(&p2->p_startzero, 0,
2210 	    (unsigned) ((char *)&p2->p_endzero - (char *)&p2->p_startzero));
2211 	memcpy(&p2->p_startcopy, &p1->p_startcopy,
2212 	    (unsigned) ((char *)&p2->p_endcopy - (char *)&p2->p_startcopy));
2213 	p2->p_vmspace = proc0.p_vmspace;
2214 
2215 	CIRCLEQ_INIT(&p2->p_sigpend.sp_info);
2216 
2217 	LIST_INIT(&p2->p_lwps);
2218 	LIST_INIT(&p2->p_sigwaiters);
2219 
2220 	/*
2221 	 * Duplicate sub-structures as needed.
2222 	 * Increase reference counts on shared objects.
2223 	 * Inherit flags we want to keep.  The flags related to SIGCHLD
2224 	 * handling are important in order to keep a consistent behaviour
2225 	 * for the child after the fork.  If we are a 32-bit process, the
2226 	 * child will be too.
2227 	 */
2228 	p2->p_flag =
2229 	    p1->p_flag & (PK_SUGID | PK_NOCLDWAIT | PK_CLDSIGIGN | PK_32);
2230 	p2->p_emul = p1->p_emul;
2231 	p2->p_execsw = p1->p_execsw;
2232 
2233 	mutex_init(&p2->p_stmutex, MUTEX_DEFAULT, IPL_HIGH);
2234 	mutex_init(&p2->p_auxlock, MUTEX_DEFAULT, IPL_NONE);
2235 	rw_init(&p2->p_reflock);
2236 	cv_init(&p2->p_waitcv, "wait");
2237 	cv_init(&p2->p_lwpcv, "lwpwait");
2238 
2239 	p2->p_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_NONE);
2240 
2241 	kauth_proc_fork(p1, p2);
2242 
2243 	p2->p_raslist = NULL;
2244 	p2->p_fd = fd_copy();
2245 
2246 	/* XXX racy */
2247 	p2->p_mqueue_cnt = p1->p_mqueue_cnt;
2248 
2249 	p2->p_cwdi = cwdinit();
2250 
2251 	/*
2252 	 * Note: p_limit (rlimit stuff) is copy-on-write, so normally
2253 	 * we just need increase pl_refcnt.
2254 	 */
2255 	if (!p1->p_limit->pl_writeable) {
2256 		lim_addref(p1->p_limit);
2257 		p2->p_limit = p1->p_limit;
2258 	} else {
2259 		p2->p_limit = lim_copy(p1->p_limit);
2260 	}
2261 
2262 	p2->p_lflag = 0;
2263 	p2->p_sflag = 0;
2264 	p2->p_slflag = 0;
2265 	p2->p_pptr = p1;
2266 	p2->p_ppid = p1->p_pid;
2267 	LIST_INIT(&p2->p_children);
2268 
2269 	p2->p_aio = NULL;
2270 
2271 #ifdef KTRACE
2272 	/*
2273 	 * Copy traceflag and tracefile if enabled.
2274 	 * If not inherited, these were zeroed above.
2275 	 */
2276 	if (p1->p_traceflag & KTRFAC_INHERIT) {
2277 		mutex_enter(&ktrace_lock);
2278 		p2->p_traceflag = p1->p_traceflag;
2279 		if ((p2->p_tracep = p1->p_tracep) != NULL)
2280 			ktradref(p2);
2281 		mutex_exit(&ktrace_lock);
2282 	}
2283 #endif
2284 
2285 	/*
2286 	 * Create signal actions for the child process.
2287 	 */
2288 	p2->p_sigacts = sigactsinit(p1, 0);
2289 	mutex_enter(p1->p_lock);
2290 	p2->p_sflag |=
2291 	    (p1->p_sflag & (PS_STOPFORK | PS_STOPEXEC | PS_NOCLDSTOP));
2292 	sched_proc_fork(p1, p2);
2293 	mutex_exit(p1->p_lock);
2294 
2295 	p2->p_stflag = p1->p_stflag;
2296 
2297 	/*
2298 	 * p_stats.
2299 	 * Copy parts of p_stats, and zero out the rest.
2300 	 */
2301 	p2->p_stats = pstatscopy(p1->p_stats);
2302 
2303 	/* copy over machdep flags to the new proc */
2304 	cpu_proc_fork(p1, p2);
2305 
2306 	/*
2307 	 * Prepare remaining parts of spawn data
2308 	 */
2309 	spawn_data->sed_actions = fa;
2310 	spawn_data->sed_attrs = sa;
2311 
2312 	spawn_data->sed_parent = p1;
2313 
2314 	/* create LWP */
2315 	lwp_create(l1, p2, uaddr, 0, NULL, 0, spawn_return, spawn_data,
2316 	    &l2, l1->l_class);
2317 	l2->l_ctxlink = NULL;	/* reset ucontext link */
2318 
2319 	/*
2320 	 * Copy the credential so other references don't see our changes.
2321 	 * Test to see if this is necessary first, since in the common case
2322 	 * we won't need a private reference.
2323 	 */
2324 	if (kauth_cred_geteuid(l2->l_cred) != kauth_cred_getsvuid(l2->l_cred) ||
2325 	    kauth_cred_getegid(l2->l_cred) != kauth_cred_getsvgid(l2->l_cred)) {
2326 		l2->l_cred = kauth_cred_copy(l2->l_cred);
2327 		kauth_cred_setsvuid(l2->l_cred, kauth_cred_geteuid(l2->l_cred));
2328 		kauth_cred_setsvgid(l2->l_cred, kauth_cred_getegid(l2->l_cred));
2329 	}
2330 
2331 	/* Update the master credentials. */
2332 	if (l2->l_cred != p2->p_cred) {
2333 		kauth_cred_t ocred;
2334 
2335 		kauth_cred_hold(l2->l_cred);
2336 		mutex_enter(p2->p_lock);
2337 		ocred = p2->p_cred;
2338 		p2->p_cred = l2->l_cred;
2339 		mutex_exit(p2->p_lock);
2340 		kauth_cred_free(ocred);
2341 	}
2342 
2343 	*child_ok = true;
2344 	spawn_data->sed_refcnt = 2;	/* child gets it as well */
2345 #if 0
2346 	l2->l_nopreempt = 1; /* start it non-preemptable */
2347 #endif
2348 
2349 	/*
2350 	 * It's now safe for the scheduler and other processes to see the
2351 	 * child process.
2352 	 */
2353 	mutex_enter(proc_lock);
2354 
2355 	if (p1->p_session->s_ttyvp != NULL && p1->p_lflag & PL_CONTROLT)
2356 		p2->p_lflag |= PL_CONTROLT;
2357 
2358 	LIST_INSERT_HEAD(&p1->p_children, p2, p_sibling);
2359 	p2->p_exitsig = SIGCHLD;	/* signal for parent on exit */
2360 
2361 	LIST_INSERT_AFTER(p1, p2, p_pglist);
2362 	LIST_INSERT_HEAD(&allproc, p2, p_list);
2363 
2364 	p2->p_trace_enabled = trace_is_enabled(p2);
2365 #ifdef __HAVE_SYSCALL_INTERN
2366 	(*p2->p_emul->e_syscall_intern)(p2);
2367 #endif
2368 
2369 	/*
2370 	 * Make child runnable, set start time, and add to run queue except
2371 	 * if the parent requested the child to start in SSTOP state.
2372 	 */
2373 	mutex_enter(p2->p_lock);
2374 
2375 	getmicrotime(&p2->p_stats->p_start);
2376 
2377 	lwp_lock(l2);
2378 	KASSERT(p2->p_nrlwps == 1);
2379 	p2->p_nrlwps = 1;
2380 	p2->p_stat = SACTIVE;
2381 	l2->l_stat = LSRUN;
2382 	sched_enqueue(l2, false);
2383 	lwp_unlock(l2);
2384 
2385 	mutex_exit(p2->p_lock);
2386 	mutex_exit(proc_lock);
2387 
2388 	cv_wait(&spawn_data->sed_cv_child_ready, &spawn_data->sed_mtx_child);
2389 	error = spawn_data->sed_error;
2390 	mutex_exit(&spawn_data->sed_mtx_child);
2391 	spawn_exec_data_release(spawn_data);
2392 
2393 	rw_exit(&p1->p_reflock);
2394 	rw_exit(&exec_lock);
2395 	have_exec_lock = false;
2396 
2397 	*pid_res = pid;
2398 	return error;
2399 
2400  error_exit:
2401  	if (have_exec_lock) {
2402 		execve_free_data(&spawn_data->sed_exec);
2403 		rw_exit(&p1->p_reflock);
2404  		rw_exit(&exec_lock);
2405 	}
2406 	mutex_exit(&spawn_data->sed_mtx_child);
2407 	spawn_exec_data_release(spawn_data);
2408 
2409 	return error;
2410 }
2411 
2412 int
2413 sys_posix_spawn(struct lwp *l1, const struct sys_posix_spawn_args *uap,
2414     register_t *retval)
2415 {
2416 	/* {
2417 		syscallarg(pid_t *) pid;
2418 		syscallarg(const char *) path;
2419 		syscallarg(const struct posix_spawn_file_actions *) file_actions;
2420 		syscallarg(const struct posix_spawnattr *) attrp;
2421 		syscallarg(char *const *) argv;
2422 		syscallarg(char *const *) envp;
2423 	} */
2424 
2425 	int error;
2426 	struct posix_spawn_file_actions *fa = NULL;
2427 	struct posix_spawnattr *sa = NULL;
2428 	pid_t pid;
2429 	bool child_ok = false;
2430 
2431 	error = check_posix_spawn(l1);
2432 	if (error) {
2433 		*retval = error;
2434 		return 0;
2435 	}
2436 
2437 	/* copy in file_actions struct */
2438 	if (SCARG(uap, file_actions) != NULL) {
2439 		error = posix_spawn_fa_alloc(&fa, SCARG(uap, file_actions));
2440 		if (error)
2441 			goto error_exit;
2442 	}
2443 
2444 	/* copyin posix_spawnattr struct */
2445 	if (SCARG(uap, attrp) != NULL) {
2446 		sa = kmem_alloc(sizeof(*sa), KM_SLEEP);
2447 		error = copyin(SCARG(uap, attrp), sa, sizeof(*sa));
2448 		if (error)
2449 			goto error_exit;
2450 	}
2451 
2452 	/*
2453 	 * Do the spawn
2454 	 */
2455 	error = do_posix_spawn(l1, &pid, &child_ok, SCARG(uap, path), fa, sa,
2456 	    SCARG(uap, argv), SCARG(uap, envp), execve_fetch_element);
2457 	if (error)
2458 		goto error_exit;
2459 
2460 	if (error == 0 && SCARG(uap, pid) != NULL)
2461 		error = copyout(&pid, SCARG(uap, pid), sizeof(pid));
2462 
2463 	*retval = error;
2464 	return 0;
2465 
2466  error_exit:
2467 	if (!child_ok) {
2468 		(void)chgproccnt(kauth_cred_getuid(l1->l_cred), -1);
2469 		atomic_dec_uint(&nprocs);
2470 
2471 		if (sa)
2472 			kmem_free(sa, sizeof(*sa));
2473 		if (fa)
2474 			posix_spawn_fa_free(fa, fa->len);
2475 	}
2476 
2477 	*retval = error;
2478 	return 0;
2479 }
2480 
2481 void
2482 exec_free_emul_arg(struct exec_package *epp)
2483 {
2484 	if (epp->ep_emul_arg_free != NULL) {
2485 		KASSERT(epp->ep_emul_arg != NULL);
2486 		(*epp->ep_emul_arg_free)(epp->ep_emul_arg);
2487 		epp->ep_emul_arg_free = NULL;
2488 		epp->ep_emul_arg = NULL;
2489 	} else {
2490 		KASSERT(epp->ep_emul_arg == NULL);
2491 	}
2492 }
2493