xref: /netbsd-src/sys/kern/kern_exec.c (revision 0df165c04d0a9ca1adde9ed2b890344c937954a6)
1 /*	$NetBSD: kern_exec.c,v 1.254 2007/11/26 19:02:01 pooka Exp $	*/
2 
3 /*-
4  * Copyright (C) 1993, 1994, 1996 Christopher G. Demetriou
5  * Copyright (C) 1992 Wolfgang Solfrank.
6  * Copyright (C) 1992 TooLs GmbH.
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. All advertising materials mentioning features or use of this software
18  *    must display the following acknowledgement:
19  *	This product includes software developed by TooLs GmbH.
20  * 4. The name of TooLs GmbH may not be used to endorse or promote products
21  *    derived from this software without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY TOOLS GMBH ``AS IS'' AND ANY EXPRESS OR
24  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
25  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
26  * IN NO EVENT SHALL TOOLS GMBH BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
28  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
29  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
30  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
31  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
32  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #include <sys/cdefs.h>
36 __KERNEL_RCSID(0, "$NetBSD: kern_exec.c,v 1.254 2007/11/26 19:02:01 pooka Exp $");
37 
38 #include "opt_ktrace.h"
39 #include "opt_syscall_debug.h"
40 #include "opt_compat_netbsd.h"
41 #include "veriexec.h"
42 #include "opt_pax.h"
43 
44 #include <sys/param.h>
45 #include <sys/systm.h>
46 #include <sys/filedesc.h>
47 #include <sys/kernel.h>
48 #include <sys/proc.h>
49 #include <sys/mount.h>
50 #include <sys/malloc.h>
51 #include <sys/namei.h>
52 #include <sys/vnode.h>
53 #include <sys/file.h>
54 #include <sys/acct.h>
55 #include <sys/exec.h>
56 #include <sys/ktrace.h>
57 #include <sys/resourcevar.h>
58 #include <sys/wait.h>
59 #include <sys/mman.h>
60 #include <sys/ras.h>
61 #include <sys/signalvar.h>
62 #include <sys/stat.h>
63 #include <sys/syscall.h>
64 #include <sys/kauth.h>
65 #include <sys/lwpctl.h>
66 
67 #include <sys/syscallargs.h>
68 #if NVERIEXEC > 0
69 #include <sys/verified_exec.h>
70 #endif /* NVERIEXEC > 0 */
71 
72 #ifdef SYSTRACE
73 #include <sys/systrace.h>
74 #endif /* SYSTRACE */
75 
76 #ifdef PAX_SEGVGUARD
77 #include <sys/pax.h>
78 #endif /* PAX_SEGVGUARD */
79 
80 #include <uvm/uvm_extern.h>
81 
82 #include <sys/cpu.h>
83 #include <machine/reg.h>
84 
85 #include <compat/common/compat_util.h>
86 
87 static int exec_sigcode_map(struct proc *, const struct emul *);
88 
89 #ifdef DEBUG_EXEC
90 #define DPRINTF(a) uprintf a
91 #else
92 #define DPRINTF(a)
93 #endif /* DEBUG_EXEC */
94 
95 MALLOC_DEFINE(M_EXEC, "exec", "argument lists & other mem used by exec");
96 
97 /*
98  * Exec function switch:
99  *
100  * Note that each makecmds function is responsible for loading the
101  * exec package with the necessary functions for any exec-type-specific
102  * handling.
103  *
104  * Functions for specific exec types should be defined in their own
105  * header file.
106  */
107 extern const struct execsw	execsw_builtin[];
108 extern int			nexecs_builtin;
109 static const struct execsw	**execsw = NULL;
110 static int			nexecs;
111 
112 u_int	exec_maxhdrsz;		/* must not be static - netbsd32 needs it */
113 
114 #ifdef LKM
115 /* list of supported emulations */
116 static
117 LIST_HEAD(emlist_head, emul_entry) el_head = LIST_HEAD_INITIALIZER(el_head);
118 struct emul_entry {
119 	LIST_ENTRY(emul_entry)	el_list;
120 	const struct emul	*el_emul;
121 	int			ro_entry;
122 };
123 
124 /* list of dynamically loaded execsw entries */
125 static
126 LIST_HEAD(execlist_head, exec_entry) ex_head = LIST_HEAD_INITIALIZER(ex_head);
127 struct exec_entry {
128 	LIST_ENTRY(exec_entry)	ex_list;
129 	const struct execsw	*es;
130 };
131 
132 /* structure used for building execw[] */
133 struct execsw_entry {
134 	struct execsw_entry	*next;
135 	const struct execsw	*es;
136 };
137 #endif /* LKM */
138 
139 #ifdef SYSCALL_DEBUG
140 extern const char * const syscallnames[];
141 #endif
142 
143 #ifdef COMPAT_16
144 extern char	sigcode[], esigcode[];
145 struct uvm_object *emul_netbsd_object;
146 #endif
147 
148 #ifndef __HAVE_SYSCALL_INTERN
149 void	syscall(void);
150 #endif
151 
152 /* NetBSD emul struct */
153 const struct emul emul_netbsd = {
154 	"netbsd",
155 	NULL,		/* emulation path */
156 #ifndef __HAVE_MINIMAL_EMUL
157 	EMUL_HAS_SYS___syscall,
158 	NULL,
159 	SYS_syscall,
160 	SYS_NSYSENT,
161 #endif
162 	sysent,
163 #ifdef SYSCALL_DEBUG
164 	syscallnames,
165 #else
166 	NULL,
167 #endif
168 	sendsig,
169 	trapsignal,
170 	NULL,
171 #ifdef COMPAT_16
172 	sigcode,
173 	esigcode,
174 	&emul_netbsd_object,
175 #else
176 	NULL,
177 	NULL,
178 	NULL,
179 #endif
180 	setregs,
181 	NULL,
182 	NULL,
183 	NULL,
184 	NULL,
185 	NULL,
186 #ifdef __HAVE_SYSCALL_INTERN
187 	syscall_intern,
188 #else
189 	syscall,
190 #endif
191 	NULL,
192 	NULL,
193 
194 	uvm_default_mapaddr,
195 	NULL,
196 	sizeof(ucontext_t),
197 	startlwp,
198 };
199 
200 #ifdef LKM
201 /*
202  * Exec lock. Used to control access to execsw[] structures.
203  * This must not be static so that netbsd32 can access it, too.
204  */
205 krwlock_t exec_lock;
206 
207 static void link_es(struct execsw_entry **, const struct execsw *);
208 #endif /* LKM */
209 
210 /*
211  * check exec:
212  * given an "executable" described in the exec package's namei info,
213  * see what we can do with it.
214  *
215  * ON ENTRY:
216  *	exec package with appropriate namei info
217  *	lwp pointer of exec'ing lwp
218  *	NO SELF-LOCKED VNODES
219  *
220  * ON EXIT:
221  *	error:	nothing held, etc.  exec header still allocated.
222  *	ok:	filled exec package, executable's vnode (unlocked).
223  *
224  * EXEC SWITCH ENTRY:
225  * 	Locked vnode to check, exec package, proc.
226  *
227  * EXEC SWITCH EXIT:
228  *	ok:	return 0, filled exec package, executable's vnode (unlocked).
229  *	error:	destructive:
230  *			everything deallocated execept exec header.
231  *		non-destructive:
232  *			error code, executable's vnode (unlocked),
233  *			exec header unmodified.
234  */
235 int
236 /*ARGSUSED*/
237 check_exec(struct lwp *l, struct exec_package *epp)
238 {
239 	int		error, i;
240 	struct vnode	*vp;
241 	struct nameidata *ndp;
242 	size_t		resid;
243 
244 	ndp = epp->ep_ndp;
245 	ndp->ni_cnd.cn_nameiop = LOOKUP;
246 	ndp->ni_cnd.cn_flags = FOLLOW | LOCKLEAF | SAVENAME | TRYEMULROOT;
247 	/* first get the vnode */
248 	if ((error = namei(ndp)) != 0)
249 		return error;
250 	epp->ep_vp = vp = ndp->ni_vp;
251 
252 	/* check access and type */
253 	if (vp->v_type != VREG) {
254 		error = EACCES;
255 		goto bad1;
256 	}
257 	if ((error = VOP_ACCESS(vp, VEXEC, l->l_cred)) != 0)
258 		goto bad1;
259 
260 	/* get attributes */
261 	if ((error = VOP_GETATTR(vp, epp->ep_vap, l->l_cred)) != 0)
262 		goto bad1;
263 
264 	/* Check mount point */
265 	if (vp->v_mount->mnt_flag & MNT_NOEXEC) {
266 		error = EACCES;
267 		goto bad1;
268 	}
269 	if (vp->v_mount->mnt_flag & MNT_NOSUID)
270 		epp->ep_vap->va_mode &= ~(S_ISUID | S_ISGID);
271 
272 	/* try to open it */
273 	if ((error = VOP_OPEN(vp, FREAD, l->l_cred)) != 0)
274 		goto bad1;
275 
276 	/* unlock vp, since we need it unlocked from here on out. */
277 	VOP_UNLOCK(vp, 0);
278 
279 #if NVERIEXEC > 0
280 	error = veriexec_verify(l, vp, ndp->ni_cnd.cn_pnbuf,
281 	    epp->ep_flags & EXEC_INDIR ? VERIEXEC_INDIRECT : VERIEXEC_DIRECT,
282 	    NULL);
283 	if (error)
284 		goto bad2;
285 #endif /* NVERIEXEC > 0 */
286 
287 #ifdef PAX_SEGVGUARD
288 	error = pax_segvguard(l, vp, ndp->ni_cnd.cn_pnbuf, false);
289 	if (error)
290 		goto bad2;
291 #endif /* PAX_SEGVGUARD */
292 
293 	/* now we have the file, get the exec header */
294 	error = vn_rdwr(UIO_READ, vp, epp->ep_hdr, epp->ep_hdrlen, 0,
295 			UIO_SYSSPACE, 0, l->l_cred, &resid, NULL);
296 	if (error)
297 		goto bad2;
298 	epp->ep_hdrvalid = epp->ep_hdrlen - resid;
299 
300 	/*
301 	 * Set up default address space limits.  Can be overridden
302 	 * by individual exec packages.
303 	 *
304 	 * XXX probably should be all done in the exec packages.
305 	 */
306 	epp->ep_vm_minaddr = VM_MIN_ADDRESS;
307 	epp->ep_vm_maxaddr = VM_MAXUSER_ADDRESS;
308 	/*
309 	 * set up the vmcmds for creation of the process
310 	 * address space
311 	 */
312 	error = ENOEXEC;
313 	for (i = 0; i < nexecs; i++) {
314 		int newerror;
315 
316 		epp->ep_esch = execsw[i];
317 		newerror = (*execsw[i]->es_makecmds)(l, epp);
318 
319 		if (!newerror) {
320 			/* Seems ok: check that entry point is sane */
321 			if (epp->ep_entry > VM_MAXUSER_ADDRESS) {
322 				error = ENOEXEC;
323 				break;
324 			}
325 
326 			/* check limits */
327 			if ((epp->ep_tsize > MAXTSIZ) ||
328 			    (epp->ep_dsize > (u_quad_t)l->l_proc->p_rlimit
329 						    [RLIMIT_DATA].rlim_cur)) {
330 				error = ENOMEM;
331 				break;
332 			}
333 			return 0;
334 		}
335 
336 		if (epp->ep_emul_root != NULL) {
337 			vrele(epp->ep_emul_root);
338 			epp->ep_emul_root = NULL;
339 		}
340 		if (epp->ep_interp != NULL) {
341 			vrele(epp->ep_interp);
342 			epp->ep_interp = NULL;
343 		}
344 
345 		/* make sure the first "interesting" error code is saved. */
346 		if (error == ENOEXEC)
347 			error = newerror;
348 
349 		if (epp->ep_flags & EXEC_DESTR)
350 			/* Error from "#!" code, tidied up by recursive call */
351 			return error;
352 	}
353 
354 	/* not found, error */
355 
356 	/*
357 	 * free any vmspace-creation commands,
358 	 * and release their references
359 	 */
360 	kill_vmcmds(&epp->ep_vmcmds);
361 
362 bad2:
363 	/*
364 	 * close and release the vnode, restore the old one, free the
365 	 * pathname buf, and punt.
366 	 */
367 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
368 	VOP_CLOSE(vp, FREAD, l->l_cred);
369 	vput(vp);
370 	PNBUF_PUT(ndp->ni_cnd.cn_pnbuf);
371 	return error;
372 
373 bad1:
374 	/*
375 	 * free the namei pathname buffer, and put the vnode
376 	 * (which we don't yet have open).
377 	 */
378 	vput(vp);				/* was still locked */
379 	PNBUF_PUT(ndp->ni_cnd.cn_pnbuf);
380 	return error;
381 }
382 
383 #ifdef __MACHINE_STACK_GROWS_UP
384 #define STACK_PTHREADSPACE NBPG
385 #else
386 #define STACK_PTHREADSPACE 0
387 #endif
388 
389 static int
390 execve_fetch_element(char * const *array, size_t index, char **value)
391 {
392 	return copyin(array + index, value, sizeof(*value));
393 }
394 
395 /*
396  * exec system call
397  */
398 /* ARGSUSED */
399 int
400 sys_execve(struct lwp *l, void *v, register_t *retval)
401 {
402 	struct sys_execve_args /* {
403 		syscallarg(const char *)	path;
404 		syscallarg(char * const *)	argp;
405 		syscallarg(char * const *)	envp;
406 	} */ *uap = v;
407 
408 	return execve1(l, SCARG(uap, path), SCARG(uap, argp),
409 	    SCARG(uap, envp), execve_fetch_element);
410 }
411 
412 int
413 execve1(struct lwp *l, const char *path, char * const *args,
414     char * const *envs, execve_fetch_element_t fetch_element)
415 {
416 	int			error;
417 	struct exec_package	pack;
418 	struct nameidata	nid;
419 	struct vattr		attr;
420 	struct proc		*p;
421 	char			*argp;
422 	char			*dp, *sp;
423 	long			argc, envc;
424 	size_t			i, len;
425 	char			*stack;
426 	struct ps_strings	arginfo;
427 	struct ps_strings	*aip = &arginfo;
428 	struct vmspace		*vm;
429 	char			**tmpfap;
430 	int			szsigcode;
431 	struct exec_vmcmd	*base_vcp;
432 	ksiginfo_t		ksi;
433 	ksiginfoq_t		kq;
434 #ifdef SYSTRACE
435 	int			wassugid = ISSET(p->p_flag, PK_SUGID);
436 	char			pathbuf[MAXPATHLEN];
437 	size_t			pathbuflen;
438 #endif /* SYSTRACE */
439 
440 	p = l->l_proc;
441 
442 	/*
443 	 * Drain existing references and forbid new ones.  The process
444 	 * should be left alone until we're done here.  This is necessary
445 	 * to avoid race conditions - e.g. in ptrace() - that might allow
446 	 * a local user to illicitly obtain elevated privileges.
447 	 */
448 	rw_enter(&p->p_reflock, RW_WRITER);
449 
450 	base_vcp = NULL;
451 	/*
452 	 * Init the namei data to point the file user's program name.
453 	 * This is done here rather than in check_exec(), so that it's
454 	 * possible to override this settings if any of makecmd/probe
455 	 * functions call check_exec() recursively - for example,
456 	 * see exec_script_makecmds().
457 	 */
458 #ifdef SYSTRACE
459 	if (ISSET(p->p_flag, PK_SYSTRACE))
460 		systrace_execve0(p);
461 
462 	error = copyinstr(path, pathbuf, sizeof(pathbuf), &pathbuflen);
463 	if (error) {
464 		DPRINTF(("execve: copyinstr path %d", error));
465 		goto clrflg;
466 	}
467 
468 	NDINIT(&nid, LOOKUP, NOFOLLOW | TRYEMULROOT, UIO_SYSSPACE, pathbuf, l);
469 #else
470 	NDINIT(&nid, LOOKUP, NOFOLLOW | TRYEMULROOT, UIO_USERSPACE, path, l);
471 #endif /* SYSTRACE */
472 
473 	/*
474 	 * initialize the fields of the exec package.
475 	 */
476 #ifdef SYSTRACE
477 	pack.ep_name = pathbuf;
478 #else
479 	pack.ep_name = path;
480 #endif /* SYSTRACE */
481 	pack.ep_hdr = malloc(exec_maxhdrsz, M_EXEC, M_WAITOK);
482 	pack.ep_hdrlen = exec_maxhdrsz;
483 	pack.ep_hdrvalid = 0;
484 	pack.ep_ndp = &nid;
485 	pack.ep_emul_arg = NULL;
486 	pack.ep_vmcmds.evs_cnt = 0;
487 	pack.ep_vmcmds.evs_used = 0;
488 	pack.ep_vap = &attr;
489 	pack.ep_flags = 0;
490 	pack.ep_emul_root = NULL;
491 	pack.ep_interp = NULL;
492 	pack.ep_esch = NULL;
493 
494 #ifdef LKM
495 	rw_enter(&exec_lock, RW_READER);
496 #endif
497 
498 	/* see if we can run it. */
499 	if ((error = check_exec(l, &pack)) != 0) {
500 		DPRINTF(("execve: check exec failed %d\n", error));
501 		goto freehdr;
502 	}
503 
504 	/* XXX -- THE FOLLOWING SECTION NEEDS MAJOR CLEANUP */
505 
506 	/* allocate an argument buffer */
507 	argp = (char *) uvm_km_alloc(exec_map, NCARGS, 0,
508 	    UVM_KMF_PAGEABLE|UVM_KMF_WAITVA);
509 #ifdef DIAGNOSTIC
510 	if (argp == NULL)
511 		panic("execve: argp == NULL");
512 #endif
513 	dp = argp;
514 	argc = 0;
515 
516 	/* copy the fake args list, if there's one, freeing it as we go */
517 	if (pack.ep_flags & EXEC_HASARGL) {
518 		tmpfap = pack.ep_fa;
519 		while (*tmpfap != NULL) {
520 			char *cp;
521 
522 			cp = *tmpfap;
523 			while (*cp)
524 				*dp++ = *cp++;
525 			dp++;
526 
527 			FREE(*tmpfap, M_EXEC);
528 			tmpfap++; argc++;
529 		}
530 		FREE(pack.ep_fa, M_EXEC);
531 		pack.ep_flags &= ~EXEC_HASARGL;
532 	}
533 
534 	/* Now get argv & environment */
535 	if (args == NULL) {
536 		DPRINTF(("execve: null args\n"));
537 		error = EINVAL;
538 		goto bad;
539 	}
540 	/* 'i' will index the argp/envp element to be retrieved */
541 	i = 0;
542 	if (pack.ep_flags & EXEC_SKIPARG)
543 		i++;
544 
545 	while (1) {
546 		len = argp + ARG_MAX - dp;
547 		if ((error = (*fetch_element)(args, i, &sp)) != 0) {
548 			DPRINTF(("execve: fetch_element args %d\n", error));
549 			goto bad;
550 		}
551 		if (!sp)
552 			break;
553 		if ((error = copyinstr(sp, dp, len, &len)) != 0) {
554 			DPRINTF(("execve: copyinstr args %d\n", error));
555 			if (error == ENAMETOOLONG)
556 				error = E2BIG;
557 			goto bad;
558 		}
559 		ktrexecarg(dp, len - 1);
560 		dp += len;
561 		i++;
562 		argc++;
563 	}
564 
565 	envc = 0;
566 	/* environment need not be there */
567 	if (envs != NULL) {
568 		i = 0;
569 		while (1) {
570 			len = argp + ARG_MAX - dp;
571 			if ((error = (*fetch_element)(envs, i, &sp)) != 0) {
572 				DPRINTF(("execve: fetch_element env %d\n", error));
573 				goto bad;
574 			}
575 			if (!sp)
576 				break;
577 			if ((error = copyinstr(sp, dp, len, &len)) != 0) {
578 				DPRINTF(("execve: copyinstr env %d\n", error));
579 				if (error == ENAMETOOLONG)
580 					error = E2BIG;
581 				goto bad;
582 			}
583 			ktrexecenv(dp, len - 1);
584 			dp += len;
585 			i++;
586 			envc++;
587 		}
588 	}
589 
590 	dp = (char *) ALIGN(dp);
591 
592 	szsigcode = pack.ep_esch->es_emul->e_esigcode -
593 	    pack.ep_esch->es_emul->e_sigcode;
594 
595 	/* Now check if args & environ fit into new stack */
596 	if (pack.ep_flags & EXEC_32)
597 		len = ((argc + envc + 2 + pack.ep_esch->es_arglen) *
598 		    sizeof(int) + sizeof(int) + dp + STACKGAPLEN +
599 		    szsigcode + sizeof(struct ps_strings) + STACK_PTHREADSPACE)
600 		    - argp;
601 	else
602 		len = ((argc + envc + 2 + pack.ep_esch->es_arglen) *
603 		    sizeof(char *) + sizeof(int) + dp + STACKGAPLEN +
604 		    szsigcode + sizeof(struct ps_strings) + STACK_PTHREADSPACE)
605 		    - argp;
606 
607 #ifdef STACKLALIGN	/* arm, etc. */
608 	len = STACKALIGN(len);	/* make the stack "safely" aligned */
609 #else
610 	len = ALIGN(len);	/* make the stack "safely" aligned */
611 #endif
612 
613 	if (len > pack.ep_ssize) { /* in effect, compare to initial limit */
614 		DPRINTF(("execve: stack limit exceeded %zu\n", len));
615 		error = ENOMEM;
616 		goto bad;
617 	}
618 
619 	/* Get rid of other LWPs. */
620 	if (p->p_nlwps > 1) {
621 		mutex_enter(&p->p_smutex);
622 		exit_lwps(l);
623 		mutex_exit(&p->p_smutex);
624 	}
625 	KDASSERT(p->p_nlwps == 1);
626 
627 	/* Destroy any lwpctl info. */
628 	if (p->p_lwpctl != NULL)
629 		lwp_ctl_exit();
630 
631 	/* This is now LWP 1 */
632 	l->l_lid = 1;
633 	p->p_nlwpid = 1;
634 
635 	/* Remove POSIX timers */
636 	timers_free(p, TIMERS_POSIX);
637 
638 	/* adjust "active stack depth" for process VSZ */
639 	pack.ep_ssize = len;	/* maybe should go elsewhere, but... */
640 
641 	/*
642 	 * Do whatever is necessary to prepare the address space
643 	 * for remapping.  Note that this might replace the current
644 	 * vmspace with another!
645 	 */
646 	uvmspace_exec(l, pack.ep_vm_minaddr, pack.ep_vm_maxaddr);
647 
648 	/* record proc's vnode, for use by procfs and others */
649         if (p->p_textvp)
650                 vrele(p->p_textvp);
651 	VREF(pack.ep_vp);
652 	p->p_textvp = pack.ep_vp;
653 
654 	/* Now map address space */
655 	vm = p->p_vmspace;
656 	vm->vm_taddr = (void *)pack.ep_taddr;
657 	vm->vm_tsize = btoc(pack.ep_tsize);
658 	vm->vm_daddr = (void*)pack.ep_daddr;
659 	vm->vm_dsize = btoc(pack.ep_dsize);
660 	vm->vm_ssize = btoc(pack.ep_ssize);
661 	vm->vm_maxsaddr = (void *)pack.ep_maxsaddr;
662 	vm->vm_minsaddr = (void *)pack.ep_minsaddr;
663 
664 	/* create the new process's VM space by running the vmcmds */
665 #ifdef DIAGNOSTIC
666 	if (pack.ep_vmcmds.evs_used == 0)
667 		panic("execve: no vmcmds");
668 #endif
669 	for (i = 0; i < pack.ep_vmcmds.evs_used && !error; i++) {
670 		struct exec_vmcmd *vcp;
671 
672 		vcp = &pack.ep_vmcmds.evs_cmds[i];
673 		if (vcp->ev_flags & VMCMD_RELATIVE) {
674 #ifdef DIAGNOSTIC
675 			if (base_vcp == NULL)
676 				panic("execve: relative vmcmd with no base");
677 			if (vcp->ev_flags & VMCMD_BASE)
678 				panic("execve: illegal base & relative vmcmd");
679 #endif
680 			vcp->ev_addr += base_vcp->ev_addr;
681 		}
682 		error = (*vcp->ev_proc)(l, vcp);
683 #ifdef DEBUG_EXEC
684 		if (error) {
685 			size_t j;
686 			struct exec_vmcmd *vp = &pack.ep_vmcmds.evs_cmds[0];
687 			for (j = 0; j <= i; j++)
688 				uprintf(
689 			"vmcmd[%zu] = %#lx/%#lx fd@%#lx prot=0%o flags=%d\n",
690 				    j, vp[j].ev_addr, vp[j].ev_len,
691 				    vp[j].ev_offset, vp[j].ev_prot,
692 				    vp[j].ev_flags);
693 		}
694 #endif /* DEBUG_EXEC */
695 		if (vcp->ev_flags & VMCMD_BASE)
696 			base_vcp = vcp;
697 	}
698 
699 	/* free the vmspace-creation commands, and release their references */
700 	kill_vmcmds(&pack.ep_vmcmds);
701 
702 	vn_lock(pack.ep_vp, LK_EXCLUSIVE | LK_RETRY);
703 	VOP_CLOSE(pack.ep_vp, FREAD, l->l_cred);
704 	vput(pack.ep_vp);
705 
706 	/* if an error happened, deallocate and punt */
707 	if (error) {
708 		DPRINTF(("execve: vmcmd %zu failed: %d\n", i - 1, error));
709 		goto exec_abort;
710 	}
711 
712 	/* remember information about the process */
713 	arginfo.ps_nargvstr = argc;
714 	arginfo.ps_nenvstr = envc;
715 
716 	stack = (char *)STACK_ALLOC(STACK_GROW(vm->vm_minsaddr,
717 		STACK_PTHREADSPACE + sizeof(struct ps_strings) + szsigcode),
718 		len - (sizeof(struct ps_strings) + szsigcode));
719 #ifdef __MACHINE_STACK_GROWS_UP
720 	/*
721 	 * The copyargs call always copies into lower addresses
722 	 * first, moving towards higher addresses, starting with
723 	 * the stack pointer that we give.  When the stack grows
724 	 * down, this puts argc/argv/envp very shallow on the
725 	 * stack, right at the first user stack pointer, and puts
726 	 * STACKGAPLEN very deep in the stack.  When the stack
727 	 * grows up, the situation is reversed.
728 	 *
729 	 * Normally, this is no big deal.  But the ld_elf.so _rtld()
730 	 * function expects to be called with a single pointer to
731 	 * a region that has a few words it can stash values into,
732 	 * followed by argc/argv/envp.  When the stack grows down,
733 	 * it's easy to decrement the stack pointer a little bit to
734 	 * allocate the space for these few words and pass the new
735 	 * stack pointer to _rtld.  When the stack grows up, however,
736 	 * a few words before argc is part of the signal trampoline, XXX
737 	 * so we have a problem.
738 	 *
739 	 * Instead of changing how _rtld works, we take the easy way
740 	 * out and steal 32 bytes before we call copyargs.  This
741 	 * space is effectively stolen from STACKGAPLEN.
742 	 */
743 	stack += 32;
744 #endif /* __MACHINE_STACK_GROWS_UP */
745 
746 	/* Now copy argc, args & environ to new stack */
747 	error = (*pack.ep_esch->es_copyargs)(l, &pack, &arginfo, &stack, argp);
748 	if (error) {
749 		DPRINTF(("execve: copyargs failed %d\n", error));
750 		goto exec_abort;
751 	}
752 	/* Move the stack back to original point */
753 	stack = (char *)STACK_GROW(vm->vm_minsaddr, len);
754 
755 	/* fill process ps_strings info */
756 	p->p_psstr = (struct ps_strings *)
757 	    STACK_ALLOC(STACK_GROW(vm->vm_minsaddr, STACK_PTHREADSPACE),
758 	    sizeof(struct ps_strings));
759 	p->p_psargv = offsetof(struct ps_strings, ps_argvstr);
760 	p->p_psnargv = offsetof(struct ps_strings, ps_nargvstr);
761 	p->p_psenv = offsetof(struct ps_strings, ps_envstr);
762 	p->p_psnenv = offsetof(struct ps_strings, ps_nenvstr);
763 
764 	/* copy out the process's ps_strings structure */
765 	if ((error = copyout(aip, (char *)p->p_psstr,
766 	    sizeof(arginfo))) != 0) {
767 		DPRINTF(("execve: ps_strings copyout %p->%p size %ld failed\n",
768 		       aip, (char *)p->p_psstr, (long)sizeof(arginfo)));
769 		goto exec_abort;
770 	}
771 
772 	fdcloseexec(l);		/* handle close on exec */
773 	execsigs(p);		/* reset catched signals */
774 
775 	l->l_ctxlink = NULL;	/* reset ucontext link */
776 
777 	/* set command name & other accounting info */
778 	i = min(nid.ni_cnd.cn_namelen, MAXCOMLEN);
779 	memcpy(p->p_comm, nid.ni_cnd.cn_nameptr, i);
780 	p->p_comm[i] = '\0';
781 	p->p_acflag &= ~AFORK;
782 
783 	p->p_flag |= PK_EXEC;
784 
785 	/*
786 	 * Stop profiling.
787 	 */
788 	if ((p->p_stflag & PST_PROFIL) != 0) {
789 		mutex_spin_enter(&p->p_stmutex);
790 		stopprofclock(p);
791 		mutex_spin_exit(&p->p_stmutex);
792 	}
793 
794 	/*
795 	 * It's OK to test PS_PPWAIT unlocked here, as other LWPs have
796 	 * exited and exec()/exit() are the only places it will be cleared.
797 	 */
798 	if ((p->p_sflag & PS_PPWAIT) != 0) {
799 		mutex_enter(&proclist_lock);
800 		mutex_enter(&p->p_smutex);
801 		p->p_sflag &= ~PS_PPWAIT;
802 		cv_broadcast(&p->p_pptr->p_waitcv);
803 		mutex_exit(&p->p_smutex);
804 		mutex_exit(&proclist_lock);
805 	}
806 
807 	/*
808 	 * Deal with set[ug]id.  MNT_NOSUID has already been used to disable
809 	 * s[ug]id.  It's OK to check for PSL_TRACED here as we have blocked
810 	 * out additional references on the process for the moment.
811 	 */
812 	if ((p->p_slflag & PSL_TRACED) == 0 &&
813 
814 	    (((attr.va_mode & S_ISUID) != 0 &&
815 	      kauth_cred_geteuid(l->l_cred) != attr.va_uid) ||
816 
817 	     ((attr.va_mode & S_ISGID) != 0 &&
818 	      kauth_cred_getegid(l->l_cred) != attr.va_gid))) {
819 		/*
820 		 * Mark the process as SUGID before we do
821 		 * anything that might block.
822 		 */
823 		proc_crmod_enter();
824 		proc_crmod_leave(NULL, NULL, true);
825 
826 		/* Make sure file descriptors 0..2 are in use. */
827 		if ((error = fdcheckstd(l)) != 0) {
828 			DPRINTF(("execve: fdcheckstd failed %d\n", error));
829 			goto exec_abort;
830 		}
831 
832 		/*
833 		 * Copy the credential so other references don't see our
834 		 * changes.
835 		 */
836 		l->l_cred = kauth_cred_copy(l->l_cred);
837 #ifdef KTRACE
838 		/*
839 		 * If process is being ktraced, turn off - unless
840 		 * root set it.
841 		 */
842 		if (p->p_tracep) {
843 			mutex_enter(&ktrace_lock);
844 			if (!(p->p_traceflag & KTRFAC_ROOT))
845 				ktrderef(p);
846 			mutex_exit(&ktrace_lock);
847 		}
848 #endif
849 		if (attr.va_mode & S_ISUID)
850 			kauth_cred_seteuid(l->l_cred, attr.va_uid);
851 		if (attr.va_mode & S_ISGID)
852 			kauth_cred_setegid(l->l_cred, attr.va_gid);
853 	} else {
854 		if (kauth_cred_geteuid(l->l_cred) ==
855 		    kauth_cred_getuid(l->l_cred) &&
856 		    kauth_cred_getegid(l->l_cred) ==
857 		    kauth_cred_getgid(l->l_cred))
858 			p->p_flag &= ~PK_SUGID;
859 	}
860 
861 	/*
862 	 * Copy the credential so other references don't see our changes.
863 	 * Test to see if this is necessary first, since in the common case
864 	 * we won't need a private reference.
865 	 */
866 	if (kauth_cred_geteuid(l->l_cred) != kauth_cred_getsvuid(l->l_cred) ||
867 	    kauth_cred_getegid(l->l_cred) != kauth_cred_getsvgid(l->l_cred)) {
868 		l->l_cred = kauth_cred_copy(l->l_cred);
869 		kauth_cred_setsvuid(l->l_cred, kauth_cred_geteuid(l->l_cred));
870 		kauth_cred_setsvgid(l->l_cred, kauth_cred_getegid(l->l_cred));
871 	}
872 
873 	/* Update the master credentials. */
874 	if (l->l_cred != p->p_cred) {
875 		kauth_cred_t ocred;
876 
877 		kauth_cred_hold(l->l_cred);
878 		mutex_enter(&p->p_mutex);
879 		ocred = p->p_cred;
880 		p->p_cred = l->l_cred;
881 		mutex_exit(&p->p_mutex);
882 		kauth_cred_free(ocred);
883 	}
884 
885 #if defined(__HAVE_RAS)
886 	/*
887 	 * Remove all RASs from the address space.
888 	 */
889 	ras_purgeall();
890 #endif
891 
892 	doexechooks(p);
893 
894 	uvm_km_free(exec_map, (vaddr_t) argp, NCARGS, UVM_KMF_PAGEABLE);
895 
896 	PNBUF_PUT(nid.ni_cnd.cn_pnbuf);
897 
898 	/* notify others that we exec'd */
899 	KNOTE(&p->p_klist, NOTE_EXEC);
900 
901 	/* setup new registers and do misc. setup. */
902 	(*pack.ep_esch->es_emul->e_setregs)(l, &pack, (u_long) stack);
903 	if (pack.ep_esch->es_setregs)
904 		(*pack.ep_esch->es_setregs)(l, &pack, (u_long) stack);
905 
906 	/* map the process's signal trampoline code */
907 	if (exec_sigcode_map(p, pack.ep_esch->es_emul)) {
908 		DPRINTF(("execve: map sigcode failed %d\n", error));
909 		goto exec_abort;
910 	}
911 
912 	free(pack.ep_hdr, M_EXEC);
913 
914 	/* The emulation root will usually have been found when we looked
915 	 * for the elf interpreter (or similar), if not look now. */
916 	if (pack.ep_esch->es_emul->e_path != NULL && pack.ep_emul_root == NULL)
917 		emul_find_root(l, &pack);
918 
919 	/* Any old emulation root got removed by fdcloseexec */
920 	p->p_cwdi->cwdi_edir = pack.ep_emul_root;
921 	pack.ep_emul_root = NULL;
922 	if (pack.ep_interp != NULL)
923 		vrele(pack.ep_interp);
924 
925 	/*
926 	 * Call emulation specific exec hook. This can setup per-process
927 	 * p->p_emuldata or do any other per-process stuff an emulation needs.
928 	 *
929 	 * If we are executing process of different emulation than the
930 	 * original forked process, call e_proc_exit() of the old emulation
931 	 * first, then e_proc_exec() of new emulation. If the emulation is
932 	 * same, the exec hook code should deallocate any old emulation
933 	 * resources held previously by this process.
934 	 */
935 	if (p->p_emul && p->p_emul->e_proc_exit
936 	    && p->p_emul != pack.ep_esch->es_emul)
937 		(*p->p_emul->e_proc_exit)(p);
938 
939 	/*
940 	 * Call exec hook. Emulation code may NOT store reference to anything
941 	 * from &pack.
942 	 */
943         if (pack.ep_esch->es_emul->e_proc_exec)
944                 (*pack.ep_esch->es_emul->e_proc_exec)(p, &pack);
945 
946 	/* update p_emul, the old value is no longer needed */
947 	p->p_emul = pack.ep_esch->es_emul;
948 
949 	/* ...and the same for p_execsw */
950 	p->p_execsw = pack.ep_esch;
951 
952 #ifdef __HAVE_SYSCALL_INTERN
953 	(*p->p_emul->e_syscall_intern)(p);
954 #endif
955 	ktremul();
956 
957 	/* Allow new references from the debugger/procfs. */
958 	rw_exit(&p->p_reflock);
959 #ifdef LKM
960 	rw_exit(&exec_lock);
961 #endif
962 
963 	mutex_enter(&proclist_mutex);
964 
965 	if ((p->p_slflag & (PSL_TRACED|PSL_SYSCALL)) == PSL_TRACED) {
966 		KSI_INIT_EMPTY(&ksi);
967 		ksi.ksi_signo = SIGTRAP;
968 		ksi.ksi_lid = l->l_lid;
969 		kpsignal(p, &ksi, NULL);
970 	}
971 
972 	if (p->p_sflag & PS_STOPEXEC) {
973 		KERNEL_UNLOCK_ALL(l, &l->l_biglocks);
974 		p->p_pptr->p_nstopchild++;
975 		p->p_pptr->p_waited = 0;
976 		mutex_enter(&p->p_smutex);
977 		ksiginfo_queue_init(&kq);
978 		sigclearall(p, &contsigmask, &kq);
979 		lwp_lock(l);
980 		l->l_stat = LSSTOP;
981 		p->p_stat = SSTOP;
982 		p->p_nrlwps--;
983 		mutex_exit(&p->p_smutex);
984 		mutex_exit(&proclist_mutex);
985 		mi_switch(l);
986 		ksiginfo_queue_drain(&kq);
987 		KERNEL_LOCK(l->l_biglocks, l);
988 	} else {
989 		mutex_exit(&proclist_mutex);
990 	}
991 
992 #ifdef SYSTRACE
993 	/* XXXSMP */
994 	if (ISSET(p->p_flag, PK_SYSTRACE) &&
995 	    wassugid && !ISSET(p->p_flag, PK_SUGID))
996 		systrace_execve1(pathbuf, p);
997 #endif /* SYSTRACE */
998 
999 	return (EJUSTRETURN);
1000 
1001  bad:
1002 	/* free the vmspace-creation commands, and release their references */
1003 	kill_vmcmds(&pack.ep_vmcmds);
1004 	/* kill any opened file descriptor, if necessary */
1005 	if (pack.ep_flags & EXEC_HASFD) {
1006 		pack.ep_flags &= ~EXEC_HASFD;
1007 		(void) fdrelease(l, pack.ep_fd);
1008 	}
1009 	/* close and put the exec'd file */
1010 	vn_lock(pack.ep_vp, LK_EXCLUSIVE | LK_RETRY);
1011 	VOP_CLOSE(pack.ep_vp, FREAD, l->l_cred);
1012 	vput(pack.ep_vp);
1013 	PNBUF_PUT(nid.ni_cnd.cn_pnbuf);
1014 	uvm_km_free(exec_map, (vaddr_t) argp, NCARGS, UVM_KMF_PAGEABLE);
1015 
1016  freehdr:
1017 	free(pack.ep_hdr, M_EXEC);
1018 	if (pack.ep_emul_root != NULL)
1019 		vrele(pack.ep_emul_root);
1020 	if (pack.ep_interp != NULL)
1021 		vrele(pack.ep_interp);
1022 
1023 #ifdef SYSTRACE
1024  clrflg:
1025 #endif /* SYSTRACE */
1026 	rw_exit(&p->p_reflock);
1027 #ifdef LKM
1028 	rw_exit(&exec_lock);
1029 #endif
1030 
1031 	return error;
1032 
1033  exec_abort:
1034 	rw_exit(&p->p_reflock);
1035 #ifdef LKM
1036 	rw_exit(&exec_lock);
1037 #endif
1038 
1039 	/*
1040 	 * the old process doesn't exist anymore.  exit gracefully.
1041 	 * get rid of the (new) address space we have created, if any, get rid
1042 	 * of our namei data and vnode, and exit noting failure
1043 	 */
1044 	uvm_deallocate(&vm->vm_map, VM_MIN_ADDRESS,
1045 		VM_MAXUSER_ADDRESS - VM_MIN_ADDRESS);
1046 	if (pack.ep_emul_arg)
1047 		FREE(pack.ep_emul_arg, M_TEMP);
1048 	PNBUF_PUT(nid.ni_cnd.cn_pnbuf);
1049 	uvm_km_free(exec_map, (vaddr_t) argp, NCARGS, UVM_KMF_PAGEABLE);
1050 	free(pack.ep_hdr, M_EXEC);
1051 	if (pack.ep_emul_root != NULL)
1052 		vrele(pack.ep_emul_root);
1053 	if (pack.ep_interp != NULL)
1054 		vrele(pack.ep_interp);
1055 
1056 	/* Acquire the sched-state mutex (exit1() will release it). */
1057 	mutex_enter(&p->p_smutex);
1058 	exit1(l, W_EXITCODE(error, SIGABRT));
1059 
1060 	/* NOTREACHED */
1061 	return 0;
1062 }
1063 
1064 
1065 int
1066 copyargs(struct lwp *l, struct exec_package *pack, struct ps_strings *arginfo,
1067     char **stackp, void *argp)
1068 {
1069 	char	**cpp, *dp, *sp;
1070 	size_t	len;
1071 	void	*nullp;
1072 	long	argc, envc;
1073 	int	error;
1074 
1075 	cpp = (char **)*stackp;
1076 	nullp = NULL;
1077 	argc = arginfo->ps_nargvstr;
1078 	envc = arginfo->ps_nenvstr;
1079 	if ((error = copyout(&argc, cpp++, sizeof(argc))) != 0)
1080 		return error;
1081 
1082 	dp = (char *) (cpp + argc + envc + 2 + pack->ep_esch->es_arglen);
1083 	sp = argp;
1084 
1085 	/* XXX don't copy them out, remap them! */
1086 	arginfo->ps_argvstr = cpp; /* remember location of argv for later */
1087 
1088 	for (; --argc >= 0; sp += len, dp += len)
1089 		if ((error = copyout(&dp, cpp++, sizeof(dp))) != 0 ||
1090 		    (error = copyoutstr(sp, dp, ARG_MAX, &len)) != 0)
1091 			return error;
1092 
1093 	if ((error = copyout(&nullp, cpp++, sizeof(nullp))) != 0)
1094 		return error;
1095 
1096 	arginfo->ps_envstr = cpp; /* remember location of envp for later */
1097 
1098 	for (; --envc >= 0; sp += len, dp += len)
1099 		if ((error = copyout(&dp, cpp++, sizeof(dp))) != 0 ||
1100 		    (error = copyoutstr(sp, dp, ARG_MAX, &len)) != 0)
1101 			return error;
1102 
1103 	if ((error = copyout(&nullp, cpp++, sizeof(nullp))) != 0)
1104 		return error;
1105 
1106 	*stackp = (char *)cpp;
1107 	return 0;
1108 }
1109 
1110 #ifdef LKM
1111 /*
1112  * Find an emulation of given name in list of emulations.
1113  * Needs to be called with the exec_lock held.
1114  */
1115 const struct emul *
1116 emul_search(const char *name)
1117 {
1118 	struct emul_entry *it;
1119 
1120 	LIST_FOREACH(it, &el_head, el_list) {
1121 		if (strcmp(name, it->el_emul->e_name) == 0)
1122 			return it->el_emul;
1123 	}
1124 
1125 	return NULL;
1126 }
1127 
1128 /*
1129  * Add an emulation to list, if it's not there already.
1130  */
1131 int
1132 emul_register(const struct emul *emul, int ro_entry)
1133 {
1134 	struct emul_entry	*ee;
1135 	int			error;
1136 
1137 	error = 0;
1138 	rw_enter(&exec_lock, RW_WRITER);
1139 
1140 	if (emul_search(emul->e_name)) {
1141 		error = EEXIST;
1142 		goto out;
1143 	}
1144 
1145 	MALLOC(ee, struct emul_entry *, sizeof(struct emul_entry),
1146 		M_EXEC, M_WAITOK);
1147 	ee->el_emul = emul;
1148 	ee->ro_entry = ro_entry;
1149 	LIST_INSERT_HEAD(&el_head, ee, el_list);
1150 
1151  out:
1152 	rw_exit(&exec_lock);
1153 	return error;
1154 }
1155 
1156 /*
1157  * Remove emulation with name 'name' from list of supported emulations.
1158  */
1159 int
1160 emul_unregister(const char *name)
1161 {
1162 	const struct proclist_desc *pd;
1163 	struct emul_entry	*it;
1164 	int			i, error;
1165 	struct proc		*ptmp;
1166 
1167 	error = 0;
1168 	rw_enter(&exec_lock, RW_WRITER);
1169 
1170 	LIST_FOREACH(it, &el_head, el_list) {
1171 		if (strcmp(it->el_emul->e_name, name) == 0)
1172 			break;
1173 	}
1174 
1175 	if (!it) {
1176 		error = ENOENT;
1177 		goto out;
1178 	}
1179 
1180 	if (it->ro_entry) {
1181 		error = EBUSY;
1182 		goto out;
1183 	}
1184 
1185 	/* test if any execw[] entry is still using this */
1186 	for(i=0; i < nexecs; i++) {
1187 		if (execsw[i]->es_emul == it->el_emul) {
1188 			error = EBUSY;
1189 			goto out;
1190 		}
1191 	}
1192 
1193 	/*
1194 	 * Test if any process is running under this emulation - since
1195 	 * emul_unregister() is running quite sendomly, it's better
1196 	 * to do expensive check here than to use any locking.
1197 	 */
1198 	mutex_enter(&proclist_lock);
1199 	for (pd = proclists; pd->pd_list != NULL && !error; pd++) {
1200 		PROCLIST_FOREACH(ptmp, pd->pd_list) {
1201 			if (ptmp->p_emul == it->el_emul) {
1202 				error = EBUSY;
1203 				break;
1204 			}
1205 		}
1206 	}
1207 	mutex_exit(&proclist_lock);
1208 
1209 	if (error)
1210 		goto out;
1211 
1212 
1213 	/* entry is not used, remove it */
1214 	LIST_REMOVE(it, el_list);
1215 	FREE(it, M_EXEC);
1216 
1217  out:
1218 	rw_exit(&exec_lock);
1219 	return error;
1220 }
1221 
1222 /*
1223  * Add execsw[] entry.
1224  */
1225 int
1226 exec_add(struct execsw *esp, const char *e_name)
1227 {
1228 	struct exec_entry	*it;
1229 	int			error;
1230 
1231 	error = 0;
1232 	rw_enter(&exec_lock, RW_WRITER);
1233 
1234 	if (!esp->es_emul) {
1235 		esp->es_emul = emul_search(e_name);
1236 		if (!esp->es_emul) {
1237 			error = ENOENT;
1238 			goto out;
1239 		}
1240 	}
1241 
1242 	LIST_FOREACH(it, &ex_head, ex_list) {
1243 		/* assume tuple (makecmds, probe_func, emulation) is unique */
1244 		if (it->es->es_makecmds == esp->es_makecmds
1245 		    && it->es->u.elf_probe_func == esp->u.elf_probe_func
1246 		    && it->es->es_emul == esp->es_emul) {
1247 			error = EEXIST;
1248 			goto out;
1249 		}
1250 	}
1251 
1252 	/* if we got here, the entry doesn't exist yet */
1253 	MALLOC(it, struct exec_entry *, sizeof(struct exec_entry),
1254 		M_EXEC, M_WAITOK);
1255 	it->es = esp;
1256 	LIST_INSERT_HEAD(&ex_head, it, ex_list);
1257 
1258 	/* update execsw[] */
1259 	exec_init(0);
1260 
1261  out:
1262 	rw_exit(&exec_lock);
1263 	return error;
1264 }
1265 
1266 /*
1267  * Remove execsw[] entry.
1268  */
1269 int
1270 exec_remove(const struct execsw *esp)
1271 {
1272 	struct exec_entry	*it;
1273 	int			error;
1274 
1275 	error = 0;
1276 	rw_enter(&exec_lock, RW_WRITER);
1277 
1278 	LIST_FOREACH(it, &ex_head, ex_list) {
1279 		/* assume tuple (makecmds, probe_func, emulation) is unique */
1280 		if (it->es->es_makecmds == esp->es_makecmds
1281 		    && it->es->u.elf_probe_func == esp->u.elf_probe_func
1282 		    && it->es->es_emul == esp->es_emul)
1283 			break;
1284 	}
1285 	if (!it) {
1286 		error = ENOENT;
1287 		goto out;
1288 	}
1289 
1290 	/* remove item from list and free resources */
1291 	LIST_REMOVE(it, ex_list);
1292 	FREE(it, M_EXEC);
1293 
1294 	/* update execsw[] */
1295 	exec_init(0);
1296 
1297  out:
1298 	rw_exit(&exec_lock);
1299 	return error;
1300 }
1301 
1302 static void
1303 link_es(struct execsw_entry **listp, const struct execsw *esp)
1304 {
1305 	struct execsw_entry *et, *e1;
1306 
1307 	et = (struct execsw_entry *) malloc(sizeof(struct execsw_entry),
1308 			M_TEMP, M_WAITOK);
1309 	et->next = NULL;
1310 	et->es = esp;
1311 	if (*listp == NULL) {
1312 		*listp = et;
1313 		return;
1314 	}
1315 
1316 	switch(et->es->es_prio) {
1317 	case EXECSW_PRIO_FIRST:
1318 		/* put new entry as the first */
1319 		et->next = *listp;
1320 		*listp = et;
1321 		break;
1322 	case EXECSW_PRIO_ANY:
1323 		/* put new entry after all *_FIRST and *_ANY entries */
1324 		for(e1 = *listp; e1->next
1325 			&& e1->next->es->es_prio != EXECSW_PRIO_LAST;
1326 			e1 = e1->next);
1327 		et->next = e1->next;
1328 		e1->next = et;
1329 		break;
1330 	case EXECSW_PRIO_LAST:
1331 		/* put new entry as the last one */
1332 		for(e1 = *listp; e1->next; e1 = e1->next);
1333 		e1->next = et;
1334 		break;
1335 	default:
1336 #ifdef DIAGNOSTIC
1337 		panic("execw[] entry with unknown priority %d found",
1338 			et->es->es_prio);
1339 #else
1340 		free(et, M_TEMP);
1341 #endif
1342 		break;
1343 	}
1344 }
1345 
1346 /*
1347  * Initialize exec structures. If init_boot is true, also does necessary
1348  * one-time initialization (it's called from main() that way).
1349  * Once system is multiuser, this should be called with exec_lock held,
1350  * i.e. via exec_{add|remove}().
1351  */
1352 int
1353 exec_init(int init_boot)
1354 {
1355 	const struct execsw	**new_es, * const *old_es;
1356 	struct execsw_entry	*list, *e1;
1357 	struct exec_entry	*e2;
1358 	int			i, es_sz;
1359 
1360 	if (init_boot) {
1361 		/* do one-time initializations */
1362 		rw_init(&exec_lock);
1363 
1364 		/* register compiled-in emulations */
1365 		for(i=0; i < nexecs_builtin; i++) {
1366 			if (execsw_builtin[i].es_emul)
1367 				emul_register(execsw_builtin[i].es_emul, 1);
1368 		}
1369 #ifdef DIAGNOSTIC
1370 		if (i == 0)
1371 			panic("no emulations found in execsw_builtin[]");
1372 #endif
1373 	}
1374 
1375 	/*
1376 	 * Build execsw[] array from builtin entries and entries added
1377 	 * at runtime.
1378 	 */
1379 	list = NULL;
1380 	for(i=0; i < nexecs_builtin; i++)
1381 		link_es(&list, &execsw_builtin[i]);
1382 
1383 	/* Add dynamically loaded entries */
1384 	es_sz = nexecs_builtin;
1385 	LIST_FOREACH(e2, &ex_head, ex_list) {
1386 		link_es(&list, e2->es);
1387 		es_sz++;
1388 	}
1389 
1390 	/*
1391 	 * Now that we have sorted all execw entries, create new execsw[]
1392 	 * and free no longer needed memory in the process.
1393 	 */
1394 	new_es = malloc(es_sz * sizeof(struct execsw *), M_EXEC, M_WAITOK);
1395 	for(i=0; list; i++) {
1396 		new_es[i] = list->es;
1397 		e1 = list->next;
1398 		free(list, M_TEMP);
1399 		list = e1;
1400 	}
1401 
1402 	/*
1403 	 * New execsw[] array built, now replace old execsw[] and free
1404 	 * used memory.
1405 	 */
1406 	old_es = execsw;
1407 	execsw = new_es;
1408 	nexecs = es_sz;
1409 	if (old_es)
1410 		/*XXXUNCONST*/
1411 		free(__UNCONST(old_es), M_EXEC);
1412 
1413 	/*
1414 	 * Figure out the maximum size of an exec header.
1415 	 */
1416 	exec_maxhdrsz = 0;
1417 	for (i = 0; i < nexecs; i++) {
1418 		if (execsw[i]->es_hdrsz > exec_maxhdrsz)
1419 			exec_maxhdrsz = execsw[i]->es_hdrsz;
1420 	}
1421 
1422 	return 0;
1423 }
1424 #endif
1425 
1426 #ifndef LKM
1427 /*
1428  * Simplified exec_init() for kernels without LKMs. Only initialize
1429  * exec_maxhdrsz and execsw[].
1430  */
1431 int
1432 exec_init(int init_boot)
1433 {
1434 	int i;
1435 
1436 #ifdef DIAGNOSTIC
1437 	if (!init_boot)
1438 		panic("exec_init(): called with init_boot == 0");
1439 #endif
1440 
1441 	/* do one-time initializations */
1442 	nexecs = nexecs_builtin;
1443 	execsw = malloc(nexecs*sizeof(struct execsw *), M_EXEC, M_WAITOK);
1444 
1445 	/*
1446 	 * Fill in execsw[] and figure out the maximum size of an exec header.
1447 	 */
1448 	exec_maxhdrsz = 0;
1449 	for(i=0; i < nexecs; i++) {
1450 		execsw[i] = &execsw_builtin[i];
1451 		if (execsw_builtin[i].es_hdrsz > exec_maxhdrsz)
1452 			exec_maxhdrsz = execsw_builtin[i].es_hdrsz;
1453 	}
1454 
1455 	return 0;
1456 
1457 }
1458 #endif /* !LKM */
1459 
1460 static int
1461 exec_sigcode_map(struct proc *p, const struct emul *e)
1462 {
1463 	vaddr_t va;
1464 	vsize_t sz;
1465 	int error;
1466 	struct uvm_object *uobj;
1467 
1468 	sz = (vaddr_t)e->e_esigcode - (vaddr_t)e->e_sigcode;
1469 
1470 	if (e->e_sigobject == NULL || sz == 0) {
1471 		return 0;
1472 	}
1473 
1474 	/*
1475 	 * If we don't have a sigobject for this emulation, create one.
1476 	 *
1477 	 * sigobject is an anonymous memory object (just like SYSV shared
1478 	 * memory) that we keep a permanent reference to and that we map
1479 	 * in all processes that need this sigcode. The creation is simple,
1480 	 * we create an object, add a permanent reference to it, map it in
1481 	 * kernel space, copy out the sigcode to it and unmap it.
1482 	 * We map it with PROT_READ|PROT_EXEC into the process just
1483 	 * the way sys_mmap() would map it.
1484 	 */
1485 
1486 	uobj = *e->e_sigobject;
1487 	if (uobj == NULL) {
1488 		uobj = uao_create(sz, 0);
1489 		(*uobj->pgops->pgo_reference)(uobj);
1490 		va = vm_map_min(kernel_map);
1491 		if ((error = uvm_map(kernel_map, &va, round_page(sz),
1492 		    uobj, 0, 0,
1493 		    UVM_MAPFLAG(UVM_PROT_RW, UVM_PROT_RW,
1494 		    UVM_INH_SHARE, UVM_ADV_RANDOM, 0)))) {
1495 			printf("kernel mapping failed %d\n", error);
1496 			(*uobj->pgops->pgo_detach)(uobj);
1497 			return (error);
1498 		}
1499 		memcpy((void *)va, e->e_sigcode, sz);
1500 #ifdef PMAP_NEED_PROCWR
1501 		pmap_procwr(&proc0, va, sz);
1502 #endif
1503 		uvm_unmap(kernel_map, va, va + round_page(sz));
1504 		*e->e_sigobject = uobj;
1505 	}
1506 
1507 	/* Just a hint to uvm_map where to put it. */
1508 	va = e->e_vm_default_addr(p, (vaddr_t)p->p_vmspace->vm_daddr,
1509 	    round_page(sz));
1510 
1511 #ifdef __alpha__
1512 	/*
1513 	 * Tru64 puts /sbin/loader at the end of user virtual memory,
1514 	 * which causes the above calculation to put the sigcode at
1515 	 * an invalid address.  Put it just below the text instead.
1516 	 */
1517 	if (va == (vaddr_t)vm_map_max(&p->p_vmspace->vm_map)) {
1518 		va = (vaddr_t)p->p_vmspace->vm_taddr - round_page(sz);
1519 	}
1520 #endif
1521 
1522 	(*uobj->pgops->pgo_reference)(uobj);
1523 	error = uvm_map(&p->p_vmspace->vm_map, &va, round_page(sz),
1524 			uobj, 0, 0,
1525 			UVM_MAPFLAG(UVM_PROT_RX, UVM_PROT_RX, UVM_INH_SHARE,
1526 				    UVM_ADV_RANDOM, 0));
1527 	if (error) {
1528 		(*uobj->pgops->pgo_detach)(uobj);
1529 		return (error);
1530 	}
1531 	p->p_sigctx.ps_sigcode = (void *)va;
1532 	return (0);
1533 }
1534