xref: /netbsd-src/sys/kern/kern_exec.c (revision c71562d660be5e4ad22016bce45e96f08af190cc)
1 /*	$NetBSD: kern_exec.c,v 1.217 2006/04/14 23:54:21 elad Exp $	*/
2 
3 /*-
4  * Copyright (C) 1993, 1994, 1996 Christopher G. Demetriou
5  * Copyright (C) 1992 Wolfgang Solfrank.
6  * Copyright (C) 1992 TooLs GmbH.
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. All advertising materials mentioning features or use of this software
18  *    must display the following acknowledgement:
19  *	This product includes software developed by TooLs GmbH.
20  * 4. The name of TooLs GmbH may not be used to endorse or promote products
21  *    derived from this software without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY TOOLS GMBH ``AS IS'' AND ANY EXPRESS OR
24  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
25  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
26  * IN NO EVENT SHALL TOOLS GMBH BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
28  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
29  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
30  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
31  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
32  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #include <sys/cdefs.h>
36 __KERNEL_RCSID(0, "$NetBSD: kern_exec.c,v 1.217 2006/04/14 23:54:21 elad Exp $");
37 
38 #include "opt_ktrace.h"
39 #include "opt_syscall_debug.h"
40 #include "opt_compat_netbsd.h"
41 #include "opt_verified_exec.h"
42 
43 #include <sys/param.h>
44 #include <sys/systm.h>
45 #include <sys/filedesc.h>
46 #include <sys/kernel.h>
47 #include <sys/proc.h>
48 #include <sys/mount.h>
49 #include <sys/malloc.h>
50 #include <sys/namei.h>
51 #include <sys/vnode.h>
52 #include <sys/file.h>
53 #include <sys/acct.h>
54 #include <sys/exec.h>
55 #include <sys/ktrace.h>
56 #include <sys/resourcevar.h>
57 #include <sys/wait.h>
58 #include <sys/mman.h>
59 #include <sys/ras.h>
60 #include <sys/signalvar.h>
61 #include <sys/stat.h>
62 #include <sys/syscall.h>
63 
64 #include <sys/sa.h>
65 #include <sys/savar.h>
66 #include <sys/syscallargs.h>
67 #ifdef VERIFIED_EXEC
68 #include <sys/verified_exec.h>
69 #endif
70 
71 #ifdef SYSTRACE
72 #include <sys/systrace.h>
73 #endif /* SYSTRACE */
74 
75 #include <uvm/uvm_extern.h>
76 
77 #include <machine/cpu.h>
78 #include <machine/reg.h>
79 
80 static int exec_sigcode_map(struct proc *, const struct emul *);
81 
82 #ifdef DEBUG_EXEC
83 #define DPRINTF(a) uprintf a
84 #else
85 #define DPRINTF(a)
86 #endif /* DEBUG_EXEC */
87 
88 MALLOC_DEFINE(M_EXEC, "exec", "argument lists & other mem used by exec");
89 
90 /*
91  * Exec function switch:
92  *
93  * Note that each makecmds function is responsible for loading the
94  * exec package with the necessary functions for any exec-type-specific
95  * handling.
96  *
97  * Functions for specific exec types should be defined in their own
98  * header file.
99  */
100 extern const struct execsw	execsw_builtin[];
101 extern int			nexecs_builtin;
102 static const struct execsw	**execsw = NULL;
103 static int			nexecs;
104 
105 u_int	exec_maxhdrsz;		/* must not be static - netbsd32 needs it */
106 
107 #ifdef LKM
108 /* list of supported emulations */
109 static
110 LIST_HEAD(emlist_head, emul_entry) el_head = LIST_HEAD_INITIALIZER(el_head);
111 struct emul_entry {
112 	LIST_ENTRY(emul_entry)	el_list;
113 	const struct emul	*el_emul;
114 	int			ro_entry;
115 };
116 
117 /* list of dynamically loaded execsw entries */
118 static
119 LIST_HEAD(execlist_head, exec_entry) ex_head = LIST_HEAD_INITIALIZER(ex_head);
120 struct exec_entry {
121 	LIST_ENTRY(exec_entry)	ex_list;
122 	const struct execsw	*es;
123 };
124 
125 /* structure used for building execw[] */
126 struct execsw_entry {
127 	struct execsw_entry	*next;
128 	const struct execsw	*es;
129 };
130 #endif /* LKM */
131 
132 #ifdef SYSCALL_DEBUG
133 extern const char * const syscallnames[];
134 #endif
135 
136 #ifdef COMPAT_16
137 extern char	sigcode[], esigcode[];
138 struct uvm_object *emul_netbsd_object;
139 #endif
140 
141 #ifndef __HAVE_SYSCALL_INTERN
142 void	syscall(void);
143 #endif
144 
145 static const struct sa_emul saemul_netbsd = {
146 	sizeof(ucontext_t),
147 	sizeof(struct sa_t),
148 	sizeof(struct sa_t *),
149 	NULL,
150 	NULL,
151 	cpu_upcall,
152 	(void (*)(struct lwp *, void *))getucontext,
153 	sa_ucsp
154 };
155 
156 /* NetBSD emul struct */
157 const struct emul emul_netbsd = {
158 	"netbsd",
159 	NULL,		/* emulation path */
160 #ifndef __HAVE_MINIMAL_EMUL
161 	EMUL_HAS_SYS___syscall,
162 	NULL,
163 	SYS_syscall,
164 	SYS_NSYSENT,
165 #endif
166 	sysent,
167 #ifdef SYSCALL_DEBUG
168 	syscallnames,
169 #else
170 	NULL,
171 #endif
172 	sendsig,
173 	trapsignal,
174 	NULL,
175 #ifdef COMPAT_16
176 	sigcode,
177 	esigcode,
178 	&emul_netbsd_object,
179 #else
180 	NULL,
181 	NULL,
182 	NULL,
183 #endif
184 	setregs,
185 	NULL,
186 	NULL,
187 	NULL,
188 	NULL,
189 	NULL,
190 #ifdef __HAVE_SYSCALL_INTERN
191 	syscall_intern,
192 #else
193 	syscall,
194 #endif
195 	NULL,
196 	NULL,
197 
198 	uvm_default_mapaddr,
199 	NULL,
200 	&saemul_netbsd,
201 };
202 
203 #ifdef LKM
204 /*
205  * Exec lock. Used to control access to execsw[] structures.
206  * This must not be static so that netbsd32 can access it, too.
207  */
208 struct lock exec_lock;
209 
210 static void link_es(struct execsw_entry **, const struct execsw *);
211 #endif /* LKM */
212 
213 /*
214  * check exec:
215  * given an "executable" described in the exec package's namei info,
216  * see what we can do with it.
217  *
218  * ON ENTRY:
219  *	exec package with appropriate namei info
220  *	lwp pointer of exec'ing lwp
221  *      if verified exec enabled then flag indicating a direct exec or
222  *        an indirect exec (i.e. for a shell script interpreter)
223  *	NO SELF-LOCKED VNODES
224  *
225  * ON EXIT:
226  *	error:	nothing held, etc.  exec header still allocated.
227  *	ok:	filled exec package, executable's vnode (unlocked).
228  *
229  * EXEC SWITCH ENTRY:
230  * 	Locked vnode to check, exec package, proc.
231  *
232  * EXEC SWITCH EXIT:
233  *	ok:	return 0, filled exec package, executable's vnode (unlocked).
234  *	error:	destructive:
235  *			everything deallocated execept exec header.
236  *		non-destructive:
237  *			error code, executable's vnode (unlocked),
238  *			exec header unmodified.
239  */
240 int
241 /*ARGSUSED*/
242 check_exec(struct lwp *l, struct exec_package *epp, int flag)
243 {
244 	int		error, i;
245 	struct vnode	*vp;
246 	struct nameidata *ndp;
247 	size_t		resid;
248 	struct proc	*p;
249 
250 	p = l->l_proc;
251 	ndp = epp->ep_ndp;
252 	ndp->ni_cnd.cn_nameiop = LOOKUP;
253 	ndp->ni_cnd.cn_flags = FOLLOW | LOCKLEAF | SAVENAME;
254 	/* first get the vnode */
255 	if ((error = namei(ndp)) != 0)
256 		return error;
257 	epp->ep_vp = vp = ndp->ni_vp;
258 
259 	/* check access and type */
260 	if (vp->v_type != VREG) {
261 		error = EACCES;
262 		goto bad1;
263 	}
264 	if ((error = VOP_ACCESS(vp, VEXEC, p->p_ucred, l)) != 0)
265 		goto bad1;
266 
267 	/* get attributes */
268 	if ((error = VOP_GETATTR(vp, epp->ep_vap, p->p_ucred, l)) != 0)
269 		goto bad1;
270 
271 	/* Check mount point */
272 	if (vp->v_mount->mnt_flag & MNT_NOEXEC) {
273 		error = EACCES;
274 		goto bad1;
275 	}
276 	if (vp->v_mount->mnt_flag & MNT_NOSUID)
277 		epp->ep_vap->va_mode &= ~(S_ISUID | S_ISGID);
278 
279 	/* try to open it */
280 	if ((error = VOP_OPEN(vp, FREAD, p->p_ucred, l)) != 0)
281 		goto bad1;
282 
283 	/* unlock vp, since we need it unlocked from here on out. */
284 	VOP_UNLOCK(vp, 0);
285 
286 
287 #ifdef VERIFIED_EXEC
288         if ((error = veriexec_verify(l, vp, epp->ep_vap, epp->ep_ndp->ni_dirp,
289 				     flag, NULL)) != 0)
290                 goto bad2;
291 #endif
292 
293 	/* now we have the file, get the exec header */
294 	uvn_attach(vp, VM_PROT_READ);
295 	error = vn_rdwr(UIO_READ, vp, epp->ep_hdr, epp->ep_hdrlen, 0,
296 			UIO_SYSSPACE, 0, p->p_ucred, &resid, NULL);
297 	if (error)
298 		goto bad2;
299 	epp->ep_hdrvalid = epp->ep_hdrlen - resid;
300 
301 	/*
302 	 * Set up default address space limits.  Can be overridden
303 	 * by individual exec packages.
304 	 *
305 	 * XXX probably should be all done in the exec pakages.
306 	 */
307 	epp->ep_vm_minaddr = VM_MIN_ADDRESS;
308 	epp->ep_vm_maxaddr = VM_MAXUSER_ADDRESS;
309 	/*
310 	 * set up the vmcmds for creation of the process
311 	 * address space
312 	 */
313 	error = ENOEXEC;
314 	for (i = 0; i < nexecs && error != 0; i++) {
315 		int newerror;
316 
317 		epp->ep_esch = execsw[i];
318 		newerror = (*execsw[i]->es_makecmds)(l, epp);
319 		/* make sure the first "interesting" error code is saved. */
320 		if (!newerror || error == ENOEXEC)
321 			error = newerror;
322 
323 		/* if es_makecmds call was successful, update epp->ep_es */
324 		if (!newerror && (epp->ep_flags & EXEC_HASES) == 0)
325 			epp->ep_es = execsw[i];
326 
327 		if (epp->ep_flags & EXEC_DESTR && error != 0)
328 			return error;
329 	}
330 	if (!error) {
331 		/* check that entry point is sane */
332 		if (epp->ep_entry > VM_MAXUSER_ADDRESS)
333 			error = ENOEXEC;
334 
335 		/* check limits */
336 		if ((epp->ep_tsize > MAXTSIZ) ||
337 		    (epp->ep_dsize >
338 		     (u_quad_t)p->p_rlimit[RLIMIT_DATA].rlim_cur))
339 			error = ENOMEM;
340 
341 		if (!error)
342 			return (0);
343 	}
344 
345 	/*
346 	 * free any vmspace-creation commands,
347 	 * and release their references
348 	 */
349 	kill_vmcmds(&epp->ep_vmcmds);
350 
351 bad2:
352 	/*
353 	 * close and release the vnode, restore the old one, free the
354 	 * pathname buf, and punt.
355 	 */
356 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
357 	VOP_CLOSE(vp, FREAD, p->p_ucred, l);
358 	vput(vp);
359 	PNBUF_PUT(ndp->ni_cnd.cn_pnbuf);
360 	return error;
361 
362 bad1:
363 	/*
364 	 * free the namei pathname buffer, and put the vnode
365 	 * (which we don't yet have open).
366 	 */
367 	vput(vp);				/* was still locked */
368 	PNBUF_PUT(ndp->ni_cnd.cn_pnbuf);
369 	return error;
370 }
371 
372 #ifdef __MACHINE_STACK_GROWS_UP
373 #define STACK_PTHREADSPACE NBPG
374 #else
375 #define STACK_PTHREADSPACE 0
376 #endif
377 
378 static int
379 execve_fetch_element(char * const *array, size_t index, char **value)
380 {
381 	return copyin(array + index, value, sizeof(*value));
382 }
383 
384 /*
385  * exec system call
386  */
387 /* ARGSUSED */
388 int
389 sys_execve(struct lwp *l, void *v, register_t *retval)
390 {
391 	struct sys_execve_args /* {
392 		syscallarg(const char *)	path;
393 		syscallarg(char * const *)	argp;
394 		syscallarg(char * const *)	envp;
395 	} */ *uap = v;
396 
397 	return execve1(l, SCARG(uap, path), SCARG(uap, argp),
398 	    SCARG(uap, envp), execve_fetch_element);
399 }
400 
401 int
402 execve1(struct lwp *l, const char *path, char * const *args,
403     char * const *envs, execve_fetch_element_t fetch_element)
404 {
405 	int			error;
406 	u_int			i;
407 	struct exec_package	pack;
408 	struct nameidata	nid;
409 	struct vattr		attr;
410 	struct proc		*p;
411 	struct ucred		*cred;
412 	char			*argp;
413 	char			*dp, *sp;
414 	long			argc, envc;
415 	size_t			len;
416 	char			*stack;
417 	struct ps_strings	arginfo;
418 	struct ps_strings	*aip = &arginfo;
419 	struct vmspace		*vm;
420 	char			**tmpfap;
421 	int			szsigcode;
422 	struct exec_vmcmd	*base_vcp;
423 	int			oldlwpflags;
424 #ifdef SYSTRACE
425 	int			wassugid = ISSET(p->p_flag, P_SUGID);
426 	char			pathbuf[MAXPATHLEN];
427 	size_t			pathbuflen;
428 #endif /* SYSTRACE */
429 
430 	/* Disable scheduler activation upcalls. */
431 	oldlwpflags = l->l_flag & (L_SA | L_SA_UPCALL);
432 	if (l->l_flag & L_SA)
433 		l->l_flag &= ~(L_SA | L_SA_UPCALL);
434 
435 	p = l->l_proc;
436 	/*
437 	 * Lock the process and set the P_INEXEC flag to indicate that
438 	 * it should be left alone until we're done here.  This is
439 	 * necessary to avoid race conditions - e.g. in ptrace() -
440 	 * that might allow a local user to illicitly obtain elevated
441 	 * privileges.
442 	 */
443 	p->p_flag |= P_INEXEC;
444 
445 	cred = p->p_ucred;
446 	base_vcp = NULL;
447 	/*
448 	 * Init the namei data to point the file user's program name.
449 	 * This is done here rather than in check_exec(), so that it's
450 	 * possible to override this settings if any of makecmd/probe
451 	 * functions call check_exec() recursively - for example,
452 	 * see exec_script_makecmds().
453 	 */
454 #ifdef SYSTRACE
455 	if (ISSET(p->p_flag, P_SYSTRACE))
456 		systrace_execve0(p);
457 
458 	error = copyinstr(path, pathbuf, sizeof(pathbuf),
459 			  &pathbuflen);
460 	if (error)
461 		goto clrflg;
462 
463 	NDINIT(&nid, LOOKUP, NOFOLLOW, UIO_SYSSPACE, pathbuf, l);
464 #else
465 	NDINIT(&nid, LOOKUP, NOFOLLOW, UIO_USERSPACE, path, l);
466 #endif /* SYSTRACE */
467 
468 	/*
469 	 * initialize the fields of the exec package.
470 	 */
471 #ifdef SYSTRACE
472 	pack.ep_name = pathbuf;
473 #else
474 	pack.ep_name = path;
475 #endif /* SYSTRACE */
476 	pack.ep_hdr = malloc(exec_maxhdrsz, M_EXEC, M_WAITOK);
477 	pack.ep_hdrlen = exec_maxhdrsz;
478 	pack.ep_hdrvalid = 0;
479 	pack.ep_ndp = &nid;
480 	pack.ep_emul_arg = NULL;
481 	pack.ep_vmcmds.evs_cnt = 0;
482 	pack.ep_vmcmds.evs_used = 0;
483 	pack.ep_vap = &attr;
484 	pack.ep_flags = 0;
485 
486 #ifdef LKM
487 	lockmgr(&exec_lock, LK_SHARED, NULL);
488 #endif
489 
490 	/* see if we can run it. */
491 #ifdef VERIFIED_EXEC
492         if ((error = check_exec(l, &pack, VERIEXEC_DIRECT)) != 0)
493 #else
494         if ((error = check_exec(l, &pack, 0)) != 0)
495 #endif
496 		goto freehdr;
497 
498 	/* XXX -- THE FOLLOWING SECTION NEEDS MAJOR CLEANUP */
499 
500 	/* allocate an argument buffer */
501 	argp = (char *) uvm_km_alloc(exec_map, NCARGS, 0,
502 	    UVM_KMF_PAGEABLE|UVM_KMF_WAITVA);
503 #ifdef DIAGNOSTIC
504 	if (argp == NULL)
505 		panic("execve: argp == NULL");
506 #endif
507 	dp = argp;
508 	argc = 0;
509 
510 	/* copy the fake args list, if there's one, freeing it as we go */
511 	if (pack.ep_flags & EXEC_HASARGL) {
512 		tmpfap = pack.ep_fa;
513 		while (*tmpfap != NULL) {
514 			char *cp;
515 
516 			cp = *tmpfap;
517 			while (*cp)
518 				*dp++ = *cp++;
519 			dp++;
520 
521 			FREE(*tmpfap, M_EXEC);
522 			tmpfap++; argc++;
523 		}
524 		FREE(pack.ep_fa, M_EXEC);
525 		pack.ep_flags &= ~EXEC_HASARGL;
526 	}
527 
528 	/* Now get argv & environment */
529 	if (args == NULL) {
530 		error = EINVAL;
531 		goto bad;
532 	}
533 	/* 'i' will index the argp/envp element to be retrieved */
534 	i = 0;
535 	if (pack.ep_flags & EXEC_SKIPARG)
536 		i++;
537 
538 	while (1) {
539 		len = argp + ARG_MAX - dp;
540 		if ((error = (*fetch_element)(args, i, &sp)) != 0)
541 			goto bad;
542 		if (!sp)
543 			break;
544 		if ((error = copyinstr(sp, dp, len, &len)) != 0) {
545 			if (error == ENAMETOOLONG)
546 				error = E2BIG;
547 			goto bad;
548 		}
549 #ifdef KTRACE
550 		if (KTRPOINT(p, KTR_EXEC_ARG))
551 			ktrkmem(l, KTR_EXEC_ARG, dp, len - 1);
552 #endif
553 		dp += len;
554 		i++;
555 		argc++;
556 	}
557 
558 	envc = 0;
559 	/* environment need not be there */
560 	if (envs != NULL) {
561 		i = 0;
562 		while (1) {
563 			len = argp + ARG_MAX - dp;
564 			if ((error = (*fetch_element)(envs, i, &sp)) != 0)
565 				goto bad;
566 			if (!sp)
567 				break;
568 			if ((error = copyinstr(sp, dp, len, &len)) != 0) {
569 				if (error == ENAMETOOLONG)
570 					error = E2BIG;
571 				goto bad;
572 			}
573 #ifdef KTRACE
574 			if (KTRPOINT(p, KTR_EXEC_ENV))
575 				ktrkmem(l, KTR_EXEC_ENV, dp, len - 1);
576 #endif
577 			dp += len;
578 			i++;
579 			envc++;
580 		}
581 	}
582 
583 	dp = (char *) ALIGN(dp);
584 
585 	szsigcode = pack.ep_es->es_emul->e_esigcode -
586 	    pack.ep_es->es_emul->e_sigcode;
587 
588 	/* Now check if args & environ fit into new stack */
589 	if (pack.ep_flags & EXEC_32)
590 		len = ((argc + envc + 2 + pack.ep_es->es_arglen) *
591 		    sizeof(int) + sizeof(int) + dp + STACKGAPLEN +
592 		    szsigcode + sizeof(struct ps_strings) + STACK_PTHREADSPACE)
593 		    - argp;
594 	else
595 		len = ((argc + envc + 2 + pack.ep_es->es_arglen) *
596 		    sizeof(char *) + sizeof(int) + dp + STACKGAPLEN +
597 		    szsigcode + sizeof(struct ps_strings) + STACK_PTHREADSPACE)
598 		    - argp;
599 
600 	len = ALIGN(len);	/* make the stack "safely" aligned */
601 
602 	if (len > pack.ep_ssize) { /* in effect, compare to initial limit */
603 		error = ENOMEM;
604 		goto bad;
605 	}
606 
607 	/* Get rid of other LWPs/ */
608 	p->p_flag |= P_WEXIT; /* XXX hack. lwp-exit stuff wants to see it. */
609 	exit_lwps(l);
610 	p->p_flag &= ~P_WEXIT;
611 	KDASSERT(p->p_nlwps == 1);
612 
613 	/* This is now LWP 1 */
614 	l->l_lid = 1;
615 	p->p_nlwpid = 1;
616 
617 	/* Release any SA state. */
618 	if (p->p_sa)
619 		sa_release(p);
620 
621 	/* Remove POSIX timers */
622 	timers_free(p, TIMERS_POSIX);
623 
624 	/* adjust "active stack depth" for process VSZ */
625 	pack.ep_ssize = len;	/* maybe should go elsewhere, but... */
626 
627 	/*
628 	 * Do whatever is necessary to prepare the address space
629 	 * for remapping.  Note that this might replace the current
630 	 * vmspace with another!
631 	 */
632 	uvmspace_exec(l, pack.ep_vm_minaddr, pack.ep_vm_maxaddr);
633 
634 	/* record proc's vnode, for use by procfs and others */
635         if (p->p_textvp)
636                 vrele(p->p_textvp);
637 	VREF(pack.ep_vp);
638 	p->p_textvp = pack.ep_vp;
639 
640 	/* Now map address space */
641 	vm = p->p_vmspace;
642 	vm->vm_taddr = (caddr_t) pack.ep_taddr;
643 	vm->vm_tsize = btoc(pack.ep_tsize);
644 	vm->vm_daddr = (caddr_t) pack.ep_daddr;
645 	vm->vm_dsize = btoc(pack.ep_dsize);
646 	vm->vm_ssize = btoc(pack.ep_ssize);
647 	vm->vm_maxsaddr = (caddr_t) pack.ep_maxsaddr;
648 	vm->vm_minsaddr = (caddr_t) pack.ep_minsaddr;
649 
650 	/* create the new process's VM space by running the vmcmds */
651 #ifdef DIAGNOSTIC
652 	if (pack.ep_vmcmds.evs_used == 0)
653 		panic("execve: no vmcmds");
654 #endif
655 	for (i = 0; i < pack.ep_vmcmds.evs_used && !error; i++) {
656 		struct exec_vmcmd *vcp;
657 
658 		vcp = &pack.ep_vmcmds.evs_cmds[i];
659 		if (vcp->ev_flags & VMCMD_RELATIVE) {
660 #ifdef DIAGNOSTIC
661 			if (base_vcp == NULL)
662 				panic("execve: relative vmcmd with no base");
663 			if (vcp->ev_flags & VMCMD_BASE)
664 				panic("execve: illegal base & relative vmcmd");
665 #endif
666 			vcp->ev_addr += base_vcp->ev_addr;
667 		}
668 		error = (*vcp->ev_proc)(l, vcp);
669 #ifdef DEBUG_EXEC
670 		if (error) {
671 			int j;
672 			struct exec_vmcmd *vp = &pack.ep_vmcmds.evs_cmds[0];
673 			for (j = 0; j <= i; j++)
674 				uprintf(
675 			    "vmcmd[%d] = %#lx/%#lx fd@%#lx prot=0%o flags=%d\n",
676 				    j, vp[j].ev_addr, vp[j].ev_len,
677 				    vp[j].ev_offset, vp[j].ev_prot,
678 				    vp[j].ev_flags);
679 		}
680 #endif /* DEBUG_EXEC */
681 		if (vcp->ev_flags & VMCMD_BASE)
682 			base_vcp = vcp;
683 	}
684 
685 	/* free the vmspace-creation commands, and release their references */
686 	kill_vmcmds(&pack.ep_vmcmds);
687 
688 	vn_lock(pack.ep_vp, LK_EXCLUSIVE | LK_RETRY);
689 	VOP_CLOSE(pack.ep_vp, FREAD, cred, l);
690 	vput(pack.ep_vp);
691 
692 	/* if an error happened, deallocate and punt */
693 	if (error) {
694 		DPRINTF(("execve: vmcmd %i failed: %d\n", i - 1, error));
695 		goto exec_abort;
696 	}
697 
698 	/* remember information about the process */
699 	arginfo.ps_nargvstr = argc;
700 	arginfo.ps_nenvstr = envc;
701 
702 	stack = (char *)STACK_ALLOC(STACK_GROW(vm->vm_minsaddr,
703 		STACK_PTHREADSPACE + sizeof(struct ps_strings) + szsigcode),
704 		len - (sizeof(struct ps_strings) + szsigcode));
705 #ifdef __MACHINE_STACK_GROWS_UP
706 	/*
707 	 * The copyargs call always copies into lower addresses
708 	 * first, moving towards higher addresses, starting with
709 	 * the stack pointer that we give.  When the stack grows
710 	 * down, this puts argc/argv/envp very shallow on the
711 	 * stack, right at the first user stack pointer, and puts
712 	 * STACKGAPLEN very deep in the stack.  When the stack
713 	 * grows up, the situation is reversed.
714 	 *
715 	 * Normally, this is no big deal.  But the ld_elf.so _rtld()
716 	 * function expects to be called with a single pointer to
717 	 * a region that has a few words it can stash values into,
718 	 * followed by argc/argv/envp.  When the stack grows down,
719 	 * it's easy to decrement the stack pointer a little bit to
720 	 * allocate the space for these few words and pass the new
721 	 * stack pointer to _rtld.  When the stack grows up, however,
722 	 * a few words before argc is part of the signal trampoline, XXX
723 	 * so we have a problem.
724 	 *
725 	 * Instead of changing how _rtld works, we take the easy way
726 	 * out and steal 32 bytes before we call copyargs.  This
727 	 * space is effectively stolen from STACKGAPLEN.
728 	 */
729 	stack += 32;
730 #endif /* __MACHINE_STACK_GROWS_UP */
731 
732 	/* Now copy argc, args & environ to new stack */
733 	error = (*pack.ep_es->es_copyargs)(l, &pack, &arginfo, &stack, argp);
734 	if (error) {
735 		DPRINTF(("execve: copyargs failed %d\n", error));
736 		goto exec_abort;
737 	}
738 	/* Move the stack back to original point */
739 	stack = (char *)STACK_GROW(vm->vm_minsaddr, len);
740 
741 	/* fill process ps_strings info */
742 	p->p_psstr = (struct ps_strings *)
743 	    STACK_ALLOC(STACK_GROW(vm->vm_minsaddr, STACK_PTHREADSPACE),
744 	    sizeof(struct ps_strings));
745 	p->p_psargv = offsetof(struct ps_strings, ps_argvstr);
746 	p->p_psnargv = offsetof(struct ps_strings, ps_nargvstr);
747 	p->p_psenv = offsetof(struct ps_strings, ps_envstr);
748 	p->p_psnenv = offsetof(struct ps_strings, ps_nenvstr);
749 
750 	/* copy out the process's ps_strings structure */
751 	if ((error = copyout(aip, (char *)p->p_psstr,
752 	    sizeof(arginfo))) != 0) {
753 		DPRINTF(("execve: ps_strings copyout %p->%p size %ld failed\n",
754 		       aip, (char *)p->p_psstr, (long)sizeof(arginfo)));
755 		goto exec_abort;
756 	}
757 
758 	stopprofclock(p);	/* stop profiling */
759 	fdcloseexec(l);		/* handle close on exec */
760 	execsigs(p);		/* reset catched signals */
761 
762 	l->l_ctxlink = NULL;	/* reset ucontext link */
763 
764 	/* set command name & other accounting info */
765 	len = min(nid.ni_cnd.cn_namelen, MAXCOMLEN);
766 	memcpy(p->p_comm, nid.ni_cnd.cn_nameptr, len);
767 	p->p_comm[len] = 0;
768 	p->p_acflag &= ~AFORK;
769 
770 	p->p_flag |= P_EXEC;
771 	if (p->p_flag & P_PPWAIT) {
772 		p->p_flag &= ~P_PPWAIT;
773 		wakeup((caddr_t) p->p_pptr);
774 	}
775 
776 	/*
777 	 * deal with set[ug]id.
778 	 * MNT_NOSUID has already been used to disable s[ug]id.
779 	 */
780 	if ((p->p_flag & P_TRACED) == 0 &&
781 
782 	    (((attr.va_mode & S_ISUID) != 0 &&
783 	      p->p_ucred->cr_uid != attr.va_uid) ||
784 
785 	     ((attr.va_mode & S_ISGID) != 0 &&
786 	      p->p_ucred->cr_gid != attr.va_gid))) {
787 		/*
788 		 * Mark the process as SUGID before we do
789 		 * anything that might block.
790 		 */
791 		p_sugid(p);
792 
793 		/* Make sure file descriptors 0..2 are in use. */
794 		if ((error = fdcheckstd(l)) != 0) {
795 			DPRINTF(("execve: fdcheckstd failed %d\n", error));
796 			goto exec_abort;
797 		}
798 
799 		p->p_ucred = crcopy(cred);
800 #ifdef KTRACE
801 		/*
802 		 * If process is being ktraced, turn off - unless
803 		 * root set it.
804 		 */
805 		if (p->p_tracep && !(p->p_traceflag & KTRFAC_ROOT))
806 			ktrderef(p);
807 #endif
808 		if (attr.va_mode & S_ISUID)
809 			p->p_ucred->cr_uid = attr.va_uid;
810 		if (attr.va_mode & S_ISGID)
811 			p->p_ucred->cr_gid = attr.va_gid;
812 	} else {
813 		if (p->p_ucred->cr_uid == p->p_cred->p_ruid &&
814 		    p->p_ucred->cr_gid == p->p_cred->p_rgid)
815 			p->p_flag &= ~P_SUGID;
816 	}
817 	p->p_cred->p_svuid = p->p_ucred->cr_uid;
818 	p->p_cred->p_svgid = p->p_ucred->cr_gid;
819 
820 #if defined(__HAVE_RAS)
821 	/*
822 	 * Remove all RASs from the address space.
823 	 */
824 	ras_purgeall(p);
825 #endif
826 
827 	doexechooks(p);
828 
829 	uvm_km_free(exec_map, (vaddr_t) argp, NCARGS, UVM_KMF_PAGEABLE);
830 
831 	PNBUF_PUT(nid.ni_cnd.cn_pnbuf);
832 
833 	/* notify others that we exec'd */
834 	KNOTE(&p->p_klist, NOTE_EXEC);
835 
836 	/* setup new registers and do misc. setup. */
837 	(*pack.ep_es->es_emul->e_setregs)(l, &pack, (u_long) stack);
838 	if (pack.ep_es->es_setregs)
839 		(*pack.ep_es->es_setregs)(l, &pack, (u_long) stack);
840 
841 	/* map the process's signal trampoline code */
842 	if (exec_sigcode_map(p, pack.ep_es->es_emul)) {
843 		DPRINTF(("execve: map sigcode failed %d\n", error));
844 		goto exec_abort;
845 	}
846 
847 	if ((p->p_flag & (P_TRACED|P_SYSCALL)) == P_TRACED)
848 		psignal(p, SIGTRAP);
849 
850 	free(pack.ep_hdr, M_EXEC);
851 
852 	/*
853 	 * Call emulation specific exec hook. This can setup per-process
854 	 * p->p_emuldata or do any other per-process stuff an emulation needs.
855 	 *
856 	 * If we are executing process of different emulation than the
857 	 * original forked process, call e_proc_exit() of the old emulation
858 	 * first, then e_proc_exec() of new emulation. If the emulation is
859 	 * same, the exec hook code should deallocate any old emulation
860 	 * resources held previously by this process.
861 	 */
862 	if (p->p_emul && p->p_emul->e_proc_exit
863 	    && p->p_emul != pack.ep_es->es_emul)
864 		(*p->p_emul->e_proc_exit)(p);
865 
866 	/*
867 	 * Call exec hook. Emulation code may NOT store reference to anything
868 	 * from &pack.
869 	 */
870         if (pack.ep_es->es_emul->e_proc_exec)
871                 (*pack.ep_es->es_emul->e_proc_exec)(p, &pack);
872 
873 	/* update p_emul, the old value is no longer needed */
874 	p->p_emul = pack.ep_es->es_emul;
875 
876 	/* ...and the same for p_execsw */
877 	p->p_execsw = pack.ep_es;
878 
879 #ifdef __HAVE_SYSCALL_INTERN
880 	(*p->p_emul->e_syscall_intern)(p);
881 #endif
882 #ifdef KTRACE
883 	if (KTRPOINT(p, KTR_EMUL))
884 		ktremul(l);
885 #endif
886 
887 #ifdef LKM
888 	lockmgr(&exec_lock, LK_RELEASE, NULL);
889 #endif
890 	p->p_flag &= ~P_INEXEC;
891 
892 	if (p->p_flag & P_STOPEXEC) {
893 		int s;
894 
895 		sigminusset(&contsigmask, &p->p_sigctx.ps_siglist);
896 		SCHED_LOCK(s);
897 		p->p_pptr->p_nstopchild++;
898 		p->p_stat = SSTOP;
899 		l->l_stat = LSSTOP;
900 		p->p_nrlwps--;
901 		mi_switch(l, NULL);
902 		SCHED_ASSERT_UNLOCKED();
903 		splx(s);
904 	}
905 
906 #ifdef SYSTRACE
907 	if (ISSET(p->p_flag, P_SYSTRACE) &&
908 	    wassugid && !ISSET(p->p_flag, P_SUGID))
909 		systrace_execve1(pathbuf, p);
910 #endif /* SYSTRACE */
911 
912 	return (EJUSTRETURN);
913 
914  bad:
915 	p->p_flag &= ~P_INEXEC;
916 	/* free the vmspace-creation commands, and release their references */
917 	kill_vmcmds(&pack.ep_vmcmds);
918 	/* kill any opened file descriptor, if necessary */
919 	if (pack.ep_flags & EXEC_HASFD) {
920 		pack.ep_flags &= ~EXEC_HASFD;
921 		(void) fdrelease(l, pack.ep_fd);
922 	}
923 	/* close and put the exec'd file */
924 	vn_lock(pack.ep_vp, LK_EXCLUSIVE | LK_RETRY);
925 	VOP_CLOSE(pack.ep_vp, FREAD, cred, l);
926 	vput(pack.ep_vp);
927 	PNBUF_PUT(nid.ni_cnd.cn_pnbuf);
928 	uvm_km_free(exec_map, (vaddr_t) argp, NCARGS, UVM_KMF_PAGEABLE);
929 
930  freehdr:
931 	free(pack.ep_hdr, M_EXEC);
932 
933 #ifdef SYSTRACE
934  clrflg:
935 #endif /* SYSTRACE */
936 	l->l_flag |= oldlwpflags;
937 	p->p_flag &= ~P_INEXEC;
938 #ifdef LKM
939 	lockmgr(&exec_lock, LK_RELEASE, NULL);
940 #endif
941 
942 	return error;
943 
944  exec_abort:
945 	p->p_flag &= ~P_INEXEC;
946 #ifdef LKM
947 	lockmgr(&exec_lock, LK_RELEASE, NULL);
948 #endif
949 
950 	/*
951 	 * the old process doesn't exist anymore.  exit gracefully.
952 	 * get rid of the (new) address space we have created, if any, get rid
953 	 * of our namei data and vnode, and exit noting failure
954 	 */
955 	uvm_deallocate(&vm->vm_map, VM_MIN_ADDRESS,
956 		VM_MAXUSER_ADDRESS - VM_MIN_ADDRESS);
957 	if (pack.ep_emul_arg)
958 		FREE(pack.ep_emul_arg, M_TEMP);
959 	PNBUF_PUT(nid.ni_cnd.cn_pnbuf);
960 	uvm_km_free(exec_map, (vaddr_t) argp, NCARGS, UVM_KMF_PAGEABLE);
961 	free(pack.ep_hdr, M_EXEC);
962 	exit1(l, W_EXITCODE(error, SIGABRT));
963 
964 	/* NOTREACHED */
965 	return 0;
966 }
967 
968 
969 int
970 copyargs(struct lwp *l, struct exec_package *pack, struct ps_strings *arginfo,
971     char **stackp, void *argp)
972 {
973 	char	**cpp, *dp, *sp;
974 	size_t	len;
975 	void	*nullp;
976 	long	argc, envc;
977 	int	error;
978 
979 	cpp = (char **)*stackp;
980 	nullp = NULL;
981 	argc = arginfo->ps_nargvstr;
982 	envc = arginfo->ps_nenvstr;
983 	if ((error = copyout(&argc, cpp++, sizeof(argc))) != 0)
984 		return error;
985 
986 	dp = (char *) (cpp + argc + envc + 2 + pack->ep_es->es_arglen);
987 	sp = argp;
988 
989 	/* XXX don't copy them out, remap them! */
990 	arginfo->ps_argvstr = cpp; /* remember location of argv for later */
991 
992 	for (; --argc >= 0; sp += len, dp += len)
993 		if ((error = copyout(&dp, cpp++, sizeof(dp))) != 0 ||
994 		    (error = copyoutstr(sp, dp, ARG_MAX, &len)) != 0)
995 			return error;
996 
997 	if ((error = copyout(&nullp, cpp++, sizeof(nullp))) != 0)
998 		return error;
999 
1000 	arginfo->ps_envstr = cpp; /* remember location of envp for later */
1001 
1002 	for (; --envc >= 0; sp += len, dp += len)
1003 		if ((error = copyout(&dp, cpp++, sizeof(dp))) != 0 ||
1004 		    (error = copyoutstr(sp, dp, ARG_MAX, &len)) != 0)
1005 			return error;
1006 
1007 	if ((error = copyout(&nullp, cpp++, sizeof(nullp))) != 0)
1008 		return error;
1009 
1010 	*stackp = (char *)cpp;
1011 	return 0;
1012 }
1013 
1014 #ifdef LKM
1015 /*
1016  * Find an emulation of given name in list of emulations.
1017  * Needs to be called with the exec_lock held.
1018  */
1019 const struct emul *
1020 emul_search(const char *name)
1021 {
1022 	struct emul_entry *it;
1023 
1024 	LIST_FOREACH(it, &el_head, el_list) {
1025 		if (strcmp(name, it->el_emul->e_name) == 0)
1026 			return it->el_emul;
1027 	}
1028 
1029 	return NULL;
1030 }
1031 
1032 /*
1033  * Add an emulation to list, if it's not there already.
1034  */
1035 int
1036 emul_register(const struct emul *emul, int ro_entry)
1037 {
1038 	struct emul_entry	*ee;
1039 	int			error;
1040 
1041 	error = 0;
1042 	lockmgr(&exec_lock, LK_SHARED, NULL);
1043 
1044 	if (emul_search(emul->e_name)) {
1045 		error = EEXIST;
1046 		goto out;
1047 	}
1048 
1049 	MALLOC(ee, struct emul_entry *, sizeof(struct emul_entry),
1050 		M_EXEC, M_WAITOK);
1051 	ee->el_emul = emul;
1052 	ee->ro_entry = ro_entry;
1053 	LIST_INSERT_HEAD(&el_head, ee, el_list);
1054 
1055  out:
1056 	lockmgr(&exec_lock, LK_RELEASE, NULL);
1057 	return error;
1058 }
1059 
1060 /*
1061  * Remove emulation with name 'name' from list of supported emulations.
1062  */
1063 int
1064 emul_unregister(const char *name)
1065 {
1066 	const struct proclist_desc *pd;
1067 	struct emul_entry	*it;
1068 	int			i, error;
1069 	struct proc		*ptmp;
1070 
1071 	error = 0;
1072 	lockmgr(&exec_lock, LK_SHARED, NULL);
1073 
1074 	LIST_FOREACH(it, &el_head, el_list) {
1075 		if (strcmp(it->el_emul->e_name, name) == 0)
1076 			break;
1077 	}
1078 
1079 	if (!it) {
1080 		error = ENOENT;
1081 		goto out;
1082 	}
1083 
1084 	if (it->ro_entry) {
1085 		error = EBUSY;
1086 		goto out;
1087 	}
1088 
1089 	/* test if any execw[] entry is still using this */
1090 	for(i=0; i < nexecs; i++) {
1091 		if (execsw[i]->es_emul == it->el_emul) {
1092 			error = EBUSY;
1093 			goto out;
1094 		}
1095 	}
1096 
1097 	/*
1098 	 * Test if any process is running under this emulation - since
1099 	 * emul_unregister() is running quite sendomly, it's better
1100 	 * to do expensive check here than to use any locking.
1101 	 */
1102 	proclist_lock_read();
1103 	for (pd = proclists; pd->pd_list != NULL && !error; pd++) {
1104 		PROCLIST_FOREACH(ptmp, pd->pd_list) {
1105 			if (ptmp->p_emul == it->el_emul) {
1106 				error = EBUSY;
1107 				break;
1108 			}
1109 		}
1110 	}
1111 	proclist_unlock_read();
1112 
1113 	if (error)
1114 		goto out;
1115 
1116 
1117 	/* entry is not used, remove it */
1118 	LIST_REMOVE(it, el_list);
1119 	FREE(it, M_EXEC);
1120 
1121  out:
1122 	lockmgr(&exec_lock, LK_RELEASE, NULL);
1123 	return error;
1124 }
1125 
1126 /*
1127  * Add execsw[] entry.
1128  */
1129 int
1130 exec_add(struct execsw *esp, const char *e_name)
1131 {
1132 	struct exec_entry	*it;
1133 	int			error;
1134 
1135 	error = 0;
1136 	lockmgr(&exec_lock, LK_EXCLUSIVE, NULL);
1137 
1138 	if (!esp->es_emul) {
1139 		esp->es_emul = emul_search(e_name);
1140 		if (!esp->es_emul) {
1141 			error = ENOENT;
1142 			goto out;
1143 		}
1144 	}
1145 
1146 	LIST_FOREACH(it, &ex_head, ex_list) {
1147 		/* assume tuple (makecmds, probe_func, emulation) is unique */
1148 		if (it->es->es_makecmds == esp->es_makecmds
1149 		    && it->es->u.elf_probe_func == esp->u.elf_probe_func
1150 		    && it->es->es_emul == esp->es_emul) {
1151 			error = EEXIST;
1152 			goto out;
1153 		}
1154 	}
1155 
1156 	/* if we got here, the entry doesn't exist yet */
1157 	MALLOC(it, struct exec_entry *, sizeof(struct exec_entry),
1158 		M_EXEC, M_WAITOK);
1159 	it->es = esp;
1160 	LIST_INSERT_HEAD(&ex_head, it, ex_list);
1161 
1162 	/* update execsw[] */
1163 	exec_init(0);
1164 
1165  out:
1166 	lockmgr(&exec_lock, LK_RELEASE, NULL);
1167 	return error;
1168 }
1169 
1170 /*
1171  * Remove execsw[] entry.
1172  */
1173 int
1174 exec_remove(const struct execsw *esp)
1175 {
1176 	struct exec_entry	*it;
1177 	int			error;
1178 
1179 	error = 0;
1180 	lockmgr(&exec_lock, LK_EXCLUSIVE, NULL);
1181 
1182 	LIST_FOREACH(it, &ex_head, ex_list) {
1183 		/* assume tuple (makecmds, probe_func, emulation) is unique */
1184 		if (it->es->es_makecmds == esp->es_makecmds
1185 		    && it->es->u.elf_probe_func == esp->u.elf_probe_func
1186 		    && it->es->es_emul == esp->es_emul)
1187 			break;
1188 	}
1189 	if (!it) {
1190 		error = ENOENT;
1191 		goto out;
1192 	}
1193 
1194 	/* remove item from list and free resources */
1195 	LIST_REMOVE(it, ex_list);
1196 	FREE(it, M_EXEC);
1197 
1198 	/* update execsw[] */
1199 	exec_init(0);
1200 
1201  out:
1202 	lockmgr(&exec_lock, LK_RELEASE, NULL);
1203 	return error;
1204 }
1205 
1206 static void
1207 link_es(struct execsw_entry **listp, const struct execsw *esp)
1208 {
1209 	struct execsw_entry *et, *e1;
1210 
1211 	et = (struct execsw_entry *) malloc(sizeof(struct execsw_entry),
1212 			M_TEMP, M_WAITOK);
1213 	et->next = NULL;
1214 	et->es = esp;
1215 	if (*listp == NULL) {
1216 		*listp = et;
1217 		return;
1218 	}
1219 
1220 	switch(et->es->es_prio) {
1221 	case EXECSW_PRIO_FIRST:
1222 		/* put new entry as the first */
1223 		et->next = *listp;
1224 		*listp = et;
1225 		break;
1226 	case EXECSW_PRIO_ANY:
1227 		/* put new entry after all *_FIRST and *_ANY entries */
1228 		for(e1 = *listp; e1->next
1229 			&& e1->next->es->es_prio != EXECSW_PRIO_LAST;
1230 			e1 = e1->next);
1231 		et->next = e1->next;
1232 		e1->next = et;
1233 		break;
1234 	case EXECSW_PRIO_LAST:
1235 		/* put new entry as the last one */
1236 		for(e1 = *listp; e1->next; e1 = e1->next);
1237 		e1->next = et;
1238 		break;
1239 	default:
1240 #ifdef DIAGNOSTIC
1241 		panic("execw[] entry with unknown priority %d found",
1242 			et->es->es_prio);
1243 #else
1244 		free(et, M_TEMP);
1245 #endif
1246 		break;
1247 	}
1248 }
1249 
1250 /*
1251  * Initialize exec structures. If init_boot is true, also does necessary
1252  * one-time initialization (it's called from main() that way).
1253  * Once system is multiuser, this should be called with exec_lock held,
1254  * i.e. via exec_{add|remove}().
1255  */
1256 int
1257 exec_init(int init_boot)
1258 {
1259 	const struct execsw	**new_es, * const *old_es;
1260 	struct execsw_entry	*list, *e1;
1261 	struct exec_entry	*e2;
1262 	int			i, es_sz;
1263 
1264 	if (init_boot) {
1265 		/* do one-time initializations */
1266 		lockinit(&exec_lock, PWAIT, "execlck", 0, 0);
1267 
1268 		/* register compiled-in emulations */
1269 		for(i=0; i < nexecs_builtin; i++) {
1270 			if (execsw_builtin[i].es_emul)
1271 				emul_register(execsw_builtin[i].es_emul, 1);
1272 		}
1273 #ifdef DIAGNOSTIC
1274 		if (i == 0)
1275 			panic("no emulations found in execsw_builtin[]");
1276 #endif
1277 	}
1278 
1279 	/*
1280 	 * Build execsw[] array from builtin entries and entries added
1281 	 * at runtime.
1282 	 */
1283 	list = NULL;
1284 	for(i=0; i < nexecs_builtin; i++)
1285 		link_es(&list, &execsw_builtin[i]);
1286 
1287 	/* Add dynamically loaded entries */
1288 	es_sz = nexecs_builtin;
1289 	LIST_FOREACH(e2, &ex_head, ex_list) {
1290 		link_es(&list, e2->es);
1291 		es_sz++;
1292 	}
1293 
1294 	/*
1295 	 * Now that we have sorted all execw entries, create new execsw[]
1296 	 * and free no longer needed memory in the process.
1297 	 */
1298 	new_es = malloc(es_sz * sizeof(struct execsw *), M_EXEC, M_WAITOK);
1299 	for(i=0; list; i++) {
1300 		new_es[i] = list->es;
1301 		e1 = list->next;
1302 		free(list, M_TEMP);
1303 		list = e1;
1304 	}
1305 
1306 	/*
1307 	 * New execsw[] array built, now replace old execsw[] and free
1308 	 * used memory.
1309 	 */
1310 	old_es = execsw;
1311 	execsw = new_es;
1312 	nexecs = es_sz;
1313 	if (old_es)
1314 		/*XXXUNCONST*/
1315 		free(__UNCONST(old_es), M_EXEC);
1316 
1317 	/*
1318 	 * Figure out the maximum size of an exec header.
1319 	 */
1320 	exec_maxhdrsz = 0;
1321 	for (i = 0; i < nexecs; i++) {
1322 		if (execsw[i]->es_hdrsz > exec_maxhdrsz)
1323 			exec_maxhdrsz = execsw[i]->es_hdrsz;
1324 	}
1325 
1326 	return 0;
1327 }
1328 #endif
1329 
1330 #ifndef LKM
1331 /*
1332  * Simplified exec_init() for kernels without LKMs. Only initialize
1333  * exec_maxhdrsz and execsw[].
1334  */
1335 int
1336 exec_init(int init_boot)
1337 {
1338 	int i;
1339 
1340 #ifdef DIAGNOSTIC
1341 	if (!init_boot)
1342 		panic("exec_init(): called with init_boot == 0");
1343 #endif
1344 
1345 	/* do one-time initializations */
1346 	nexecs = nexecs_builtin;
1347 	execsw = malloc(nexecs*sizeof(struct execsw *), M_EXEC, M_WAITOK);
1348 
1349 	/*
1350 	 * Fill in execsw[] and figure out the maximum size of an exec header.
1351 	 */
1352 	exec_maxhdrsz = 0;
1353 	for(i=0; i < nexecs; i++) {
1354 		execsw[i] = &execsw_builtin[i];
1355 		if (execsw_builtin[i].es_hdrsz > exec_maxhdrsz)
1356 			exec_maxhdrsz = execsw_builtin[i].es_hdrsz;
1357 	}
1358 
1359 	return 0;
1360 
1361 }
1362 #endif /* !LKM */
1363 
1364 static int
1365 exec_sigcode_map(struct proc *p, const struct emul *e)
1366 {
1367 	vaddr_t va;
1368 	vsize_t sz;
1369 	int error;
1370 	struct uvm_object *uobj;
1371 
1372 	sz = (vaddr_t)e->e_esigcode - (vaddr_t)e->e_sigcode;
1373 
1374 	if (e->e_sigobject == NULL || sz == 0) {
1375 		return 0;
1376 	}
1377 
1378 	/*
1379 	 * If we don't have a sigobject for this emulation, create one.
1380 	 *
1381 	 * sigobject is an anonymous memory object (just like SYSV shared
1382 	 * memory) that we keep a permanent reference to and that we map
1383 	 * in all processes that need this sigcode. The creation is simple,
1384 	 * we create an object, add a permanent reference to it, map it in
1385 	 * kernel space, copy out the sigcode to it and unmap it.
1386 	 * We map it with PROT_READ|PROT_EXEC into the process just
1387 	 * the way sys_mmap() would map it.
1388 	 */
1389 
1390 	uobj = *e->e_sigobject;
1391 	if (uobj == NULL) {
1392 		uobj = uao_create(sz, 0);
1393 		(*uobj->pgops->pgo_reference)(uobj);
1394 		va = vm_map_min(kernel_map);
1395 		if ((error = uvm_map(kernel_map, &va, round_page(sz),
1396 		    uobj, 0, 0,
1397 		    UVM_MAPFLAG(UVM_PROT_RW, UVM_PROT_RW,
1398 		    UVM_INH_SHARE, UVM_ADV_RANDOM, 0)))) {
1399 			printf("kernel mapping failed %d\n", error);
1400 			(*uobj->pgops->pgo_detach)(uobj);
1401 			return (error);
1402 		}
1403 		memcpy((void *)va, e->e_sigcode, sz);
1404 #ifdef PMAP_NEED_PROCWR
1405 		pmap_procwr(&proc0, va, sz);
1406 #endif
1407 		uvm_unmap(kernel_map, va, va + round_page(sz));
1408 		*e->e_sigobject = uobj;
1409 	}
1410 
1411 	/* Just a hint to uvm_map where to put it. */
1412 	va = e->e_vm_default_addr(p, (vaddr_t)p->p_vmspace->vm_daddr,
1413 	    round_page(sz));
1414 
1415 #ifdef __alpha__
1416 	/*
1417 	 * Tru64 puts /sbin/loader at the end of user virtual memory,
1418 	 * which causes the above calculation to put the sigcode at
1419 	 * an invalid address.  Put it just below the text instead.
1420 	 */
1421 	if (va == (vaddr_t)vm_map_max(&p->p_vmspace->vm_map)) {
1422 		va = (vaddr_t)p->p_vmspace->vm_taddr - round_page(sz);
1423 	}
1424 #endif
1425 
1426 	(*uobj->pgops->pgo_reference)(uobj);
1427 	error = uvm_map(&p->p_vmspace->vm_map, &va, round_page(sz),
1428 			uobj, 0, 0,
1429 			UVM_MAPFLAG(UVM_PROT_RX, UVM_PROT_RX, UVM_INH_SHARE,
1430 				    UVM_ADV_RANDOM, 0));
1431 	if (error) {
1432 		(*uobj->pgops->pgo_detach)(uobj);
1433 		return (error);
1434 	}
1435 	p->p_sigctx.ps_sigcode = (void *)va;
1436 	return (0);
1437 }
1438