xref: /netbsd-src/sys/kern/kern_exec.c (revision d48f14661dda8638fee055ba15d35bdfb29b9fa8)
1 /*	$NetBSD: kern_exec.c,v 1.218 2006/05/14 21:15:11 elad Exp $	*/
2 
3 /*-
4  * Copyright (C) 1993, 1994, 1996 Christopher G. Demetriou
5  * Copyright (C) 1992 Wolfgang Solfrank.
6  * Copyright (C) 1992 TooLs GmbH.
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. All advertising materials mentioning features or use of this software
18  *    must display the following acknowledgement:
19  *	This product includes software developed by TooLs GmbH.
20  * 4. The name of TooLs GmbH may not be used to endorse or promote products
21  *    derived from this software without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY TOOLS GMBH ``AS IS'' AND ANY EXPRESS OR
24  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
25  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
26  * IN NO EVENT SHALL TOOLS GMBH BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
28  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
29  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
30  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
31  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
32  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #include <sys/cdefs.h>
36 __KERNEL_RCSID(0, "$NetBSD: kern_exec.c,v 1.218 2006/05/14 21:15:11 elad Exp $");
37 
38 #include "opt_ktrace.h"
39 #include "opt_syscall_debug.h"
40 #include "opt_compat_netbsd.h"
41 #include "opt_verified_exec.h"
42 
43 #include <sys/param.h>
44 #include <sys/systm.h>
45 #include <sys/filedesc.h>
46 #include <sys/kernel.h>
47 #include <sys/proc.h>
48 #include <sys/mount.h>
49 #include <sys/malloc.h>
50 #include <sys/namei.h>
51 #include <sys/vnode.h>
52 #include <sys/file.h>
53 #include <sys/acct.h>
54 #include <sys/exec.h>
55 #include <sys/ktrace.h>
56 #include <sys/resourcevar.h>
57 #include <sys/wait.h>
58 #include <sys/mman.h>
59 #include <sys/ras.h>
60 #include <sys/signalvar.h>
61 #include <sys/stat.h>
62 #include <sys/syscall.h>
63 #include <sys/kauth.h>
64 
65 #include <sys/sa.h>
66 #include <sys/savar.h>
67 #include <sys/syscallargs.h>
68 #ifdef VERIFIED_EXEC
69 #include <sys/verified_exec.h>
70 #endif
71 
72 #ifdef SYSTRACE
73 #include <sys/systrace.h>
74 #endif /* SYSTRACE */
75 
76 #include <uvm/uvm_extern.h>
77 
78 #include <machine/cpu.h>
79 #include <machine/reg.h>
80 
81 static int exec_sigcode_map(struct proc *, const struct emul *);
82 
83 #ifdef DEBUG_EXEC
84 #define DPRINTF(a) uprintf a
85 #else
86 #define DPRINTF(a)
87 #endif /* DEBUG_EXEC */
88 
89 MALLOC_DEFINE(M_EXEC, "exec", "argument lists & other mem used by exec");
90 
91 /*
92  * Exec function switch:
93  *
94  * Note that each makecmds function is responsible for loading the
95  * exec package with the necessary functions for any exec-type-specific
96  * handling.
97  *
98  * Functions for specific exec types should be defined in their own
99  * header file.
100  */
101 extern const struct execsw	execsw_builtin[];
102 extern int			nexecs_builtin;
103 static const struct execsw	**execsw = NULL;
104 static int			nexecs;
105 
106 u_int	exec_maxhdrsz;		/* must not be static - netbsd32 needs it */
107 
108 #ifdef LKM
109 /* list of supported emulations */
110 static
111 LIST_HEAD(emlist_head, emul_entry) el_head = LIST_HEAD_INITIALIZER(el_head);
112 struct emul_entry {
113 	LIST_ENTRY(emul_entry)	el_list;
114 	const struct emul	*el_emul;
115 	int			ro_entry;
116 };
117 
118 /* list of dynamically loaded execsw entries */
119 static
120 LIST_HEAD(execlist_head, exec_entry) ex_head = LIST_HEAD_INITIALIZER(ex_head);
121 struct exec_entry {
122 	LIST_ENTRY(exec_entry)	ex_list;
123 	const struct execsw	*es;
124 };
125 
126 /* structure used for building execw[] */
127 struct execsw_entry {
128 	struct execsw_entry	*next;
129 	const struct execsw	*es;
130 };
131 #endif /* LKM */
132 
133 #ifdef SYSCALL_DEBUG
134 extern const char * const syscallnames[];
135 #endif
136 
137 #ifdef COMPAT_16
138 extern char	sigcode[], esigcode[];
139 struct uvm_object *emul_netbsd_object;
140 #endif
141 
142 #ifndef __HAVE_SYSCALL_INTERN
143 void	syscall(void);
144 #endif
145 
146 static const struct sa_emul saemul_netbsd = {
147 	sizeof(ucontext_t),
148 	sizeof(struct sa_t),
149 	sizeof(struct sa_t *),
150 	NULL,
151 	NULL,
152 	cpu_upcall,
153 	(void (*)(struct lwp *, void *))getucontext,
154 	sa_ucsp
155 };
156 
157 /* NetBSD emul struct */
158 const struct emul emul_netbsd = {
159 	"netbsd",
160 	NULL,		/* emulation path */
161 #ifndef __HAVE_MINIMAL_EMUL
162 	EMUL_HAS_SYS___syscall,
163 	NULL,
164 	SYS_syscall,
165 	SYS_NSYSENT,
166 #endif
167 	sysent,
168 #ifdef SYSCALL_DEBUG
169 	syscallnames,
170 #else
171 	NULL,
172 #endif
173 	sendsig,
174 	trapsignal,
175 	NULL,
176 #ifdef COMPAT_16
177 	sigcode,
178 	esigcode,
179 	&emul_netbsd_object,
180 #else
181 	NULL,
182 	NULL,
183 	NULL,
184 #endif
185 	setregs,
186 	NULL,
187 	NULL,
188 	NULL,
189 	NULL,
190 	NULL,
191 #ifdef __HAVE_SYSCALL_INTERN
192 	syscall_intern,
193 #else
194 	syscall,
195 #endif
196 	NULL,
197 	NULL,
198 
199 	uvm_default_mapaddr,
200 	NULL,
201 	&saemul_netbsd,
202 };
203 
204 #ifdef LKM
205 /*
206  * Exec lock. Used to control access to execsw[] structures.
207  * This must not be static so that netbsd32 can access it, too.
208  */
209 struct lock exec_lock;
210 
211 static void link_es(struct execsw_entry **, const struct execsw *);
212 #endif /* LKM */
213 
214 /*
215  * check exec:
216  * given an "executable" described in the exec package's namei info,
217  * see what we can do with it.
218  *
219  * ON ENTRY:
220  *	exec package with appropriate namei info
221  *	lwp pointer of exec'ing lwp
222  *      if verified exec enabled then flag indicating a direct exec or
223  *        an indirect exec (i.e. for a shell script interpreter)
224  *	NO SELF-LOCKED VNODES
225  *
226  * ON EXIT:
227  *	error:	nothing held, etc.  exec header still allocated.
228  *	ok:	filled exec package, executable's vnode (unlocked).
229  *
230  * EXEC SWITCH ENTRY:
231  * 	Locked vnode to check, exec package, proc.
232  *
233  * EXEC SWITCH EXIT:
234  *	ok:	return 0, filled exec package, executable's vnode (unlocked).
235  *	error:	destructive:
236  *			everything deallocated execept exec header.
237  *		non-destructive:
238  *			error code, executable's vnode (unlocked),
239  *			exec header unmodified.
240  */
241 int
242 /*ARGSUSED*/
243 check_exec(struct lwp *l, struct exec_package *epp, int flag)
244 {
245 	int		error, i;
246 	struct vnode	*vp;
247 	struct nameidata *ndp;
248 	size_t		resid;
249 	struct proc	*p;
250 
251 	p = l->l_proc;
252 	ndp = epp->ep_ndp;
253 	ndp->ni_cnd.cn_nameiop = LOOKUP;
254 	ndp->ni_cnd.cn_flags = FOLLOW | LOCKLEAF | SAVENAME;
255 	/* first get the vnode */
256 	if ((error = namei(ndp)) != 0)
257 		return error;
258 	epp->ep_vp = vp = ndp->ni_vp;
259 
260 	/* check access and type */
261 	if (vp->v_type != VREG) {
262 		error = EACCES;
263 		goto bad1;
264 	}
265 	if ((error = VOP_ACCESS(vp, VEXEC, p->p_cred, l)) != 0)
266 		goto bad1;
267 
268 	/* get attributes */
269 	if ((error = VOP_GETATTR(vp, epp->ep_vap, p->p_cred, l)) != 0)
270 		goto bad1;
271 
272 	/* Check mount point */
273 	if (vp->v_mount->mnt_flag & MNT_NOEXEC) {
274 		error = EACCES;
275 		goto bad1;
276 	}
277 	if (vp->v_mount->mnt_flag & MNT_NOSUID)
278 		epp->ep_vap->va_mode &= ~(S_ISUID | S_ISGID);
279 
280 	/* try to open it */
281 	if ((error = VOP_OPEN(vp, FREAD, p->p_cred, l)) != 0)
282 		goto bad1;
283 
284 	/* unlock vp, since we need it unlocked from here on out. */
285 	VOP_UNLOCK(vp, 0);
286 
287 
288 #ifdef VERIFIED_EXEC
289         if ((error = veriexec_verify(l, vp, epp->ep_vap, epp->ep_ndp->ni_dirp,
290 				     flag, NULL)) != 0)
291                 goto bad2;
292 #endif
293 
294 	/* now we have the file, get the exec header */
295 	uvn_attach(vp, VM_PROT_READ);
296 	error = vn_rdwr(UIO_READ, vp, epp->ep_hdr, epp->ep_hdrlen, 0,
297 			UIO_SYSSPACE, 0, p->p_cred, &resid, NULL);
298 	if (error)
299 		goto bad2;
300 	epp->ep_hdrvalid = epp->ep_hdrlen - resid;
301 
302 	/*
303 	 * Set up default address space limits.  Can be overridden
304 	 * by individual exec packages.
305 	 *
306 	 * XXX probably should be all done in the exec pakages.
307 	 */
308 	epp->ep_vm_minaddr = VM_MIN_ADDRESS;
309 	epp->ep_vm_maxaddr = VM_MAXUSER_ADDRESS;
310 	/*
311 	 * set up the vmcmds for creation of the process
312 	 * address space
313 	 */
314 	error = ENOEXEC;
315 	for (i = 0; i < nexecs && error != 0; i++) {
316 		int newerror;
317 
318 		epp->ep_esch = execsw[i];
319 		newerror = (*execsw[i]->es_makecmds)(l, epp);
320 		/* make sure the first "interesting" error code is saved. */
321 		if (!newerror || error == ENOEXEC)
322 			error = newerror;
323 
324 		/* if es_makecmds call was successful, update epp->ep_es */
325 		if (!newerror && (epp->ep_flags & EXEC_HASES) == 0)
326 			epp->ep_es = execsw[i];
327 
328 		if (epp->ep_flags & EXEC_DESTR && error != 0)
329 			return error;
330 	}
331 	if (!error) {
332 		/* check that entry point is sane */
333 		if (epp->ep_entry > VM_MAXUSER_ADDRESS)
334 			error = ENOEXEC;
335 
336 		/* check limits */
337 		if ((epp->ep_tsize > MAXTSIZ) ||
338 		    (epp->ep_dsize >
339 		     (u_quad_t)p->p_rlimit[RLIMIT_DATA].rlim_cur))
340 			error = ENOMEM;
341 
342 		if (!error)
343 			return (0);
344 	}
345 
346 	/*
347 	 * free any vmspace-creation commands,
348 	 * and release their references
349 	 */
350 	kill_vmcmds(&epp->ep_vmcmds);
351 
352 bad2:
353 	/*
354 	 * close and release the vnode, restore the old one, free the
355 	 * pathname buf, and punt.
356 	 */
357 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
358 	VOP_CLOSE(vp, FREAD, p->p_cred, l);
359 	vput(vp);
360 	PNBUF_PUT(ndp->ni_cnd.cn_pnbuf);
361 	return error;
362 
363 bad1:
364 	/*
365 	 * free the namei pathname buffer, and put the vnode
366 	 * (which we don't yet have open).
367 	 */
368 	vput(vp);				/* was still locked */
369 	PNBUF_PUT(ndp->ni_cnd.cn_pnbuf);
370 	return error;
371 }
372 
373 #ifdef __MACHINE_STACK_GROWS_UP
374 #define STACK_PTHREADSPACE NBPG
375 #else
376 #define STACK_PTHREADSPACE 0
377 #endif
378 
379 static int
380 execve_fetch_element(char * const *array, size_t index, char **value)
381 {
382 	return copyin(array + index, value, sizeof(*value));
383 }
384 
385 /*
386  * exec system call
387  */
388 /* ARGSUSED */
389 int
390 sys_execve(struct lwp *l, void *v, register_t *retval)
391 {
392 	struct sys_execve_args /* {
393 		syscallarg(const char *)	path;
394 		syscallarg(char * const *)	argp;
395 		syscallarg(char * const *)	envp;
396 	} */ *uap = v;
397 
398 	return execve1(l, SCARG(uap, path), SCARG(uap, argp),
399 	    SCARG(uap, envp), execve_fetch_element);
400 }
401 
402 int
403 execve1(struct lwp *l, const char *path, char * const *args,
404     char * const *envs, execve_fetch_element_t fetch_element)
405 {
406 	int			error;
407 	u_int			i;
408 	struct exec_package	pack;
409 	struct nameidata	nid;
410 	struct vattr		attr;
411 	struct proc		*p;
412 	kauth_cred_t		cred;
413 	char			*argp;
414 	char			*dp, *sp;
415 	long			argc, envc;
416 	size_t			len;
417 	char			*stack;
418 	struct ps_strings	arginfo;
419 	struct ps_strings	*aip = &arginfo;
420 	struct vmspace		*vm;
421 	char			**tmpfap;
422 	int			szsigcode;
423 	struct exec_vmcmd	*base_vcp;
424 	int			oldlwpflags;
425 #ifdef SYSTRACE
426 	int			wassugid = ISSET(p->p_flag, P_SUGID);
427 	char			pathbuf[MAXPATHLEN];
428 	size_t			pathbuflen;
429 #endif /* SYSTRACE */
430 
431 	/* Disable scheduler activation upcalls. */
432 	oldlwpflags = l->l_flag & (L_SA | L_SA_UPCALL);
433 	if (l->l_flag & L_SA)
434 		l->l_flag &= ~(L_SA | L_SA_UPCALL);
435 
436 	p = l->l_proc;
437 	/*
438 	 * Lock the process and set the P_INEXEC flag to indicate that
439 	 * it should be left alone until we're done here.  This is
440 	 * necessary to avoid race conditions - e.g. in ptrace() -
441 	 * that might allow a local user to illicitly obtain elevated
442 	 * privileges.
443 	 */
444 	p->p_flag |= P_INEXEC;
445 
446 	cred = p->p_cred;
447 	base_vcp = NULL;
448 	/*
449 	 * Init the namei data to point the file user's program name.
450 	 * This is done here rather than in check_exec(), so that it's
451 	 * possible to override this settings if any of makecmd/probe
452 	 * functions call check_exec() recursively - for example,
453 	 * see exec_script_makecmds().
454 	 */
455 #ifdef SYSTRACE
456 	if (ISSET(p->p_flag, P_SYSTRACE))
457 		systrace_execve0(p);
458 
459 	error = copyinstr(path, pathbuf, sizeof(pathbuf),
460 			  &pathbuflen);
461 	if (error)
462 		goto clrflg;
463 
464 	NDINIT(&nid, LOOKUP, NOFOLLOW, UIO_SYSSPACE, pathbuf, l);
465 #else
466 	NDINIT(&nid, LOOKUP, NOFOLLOW, UIO_USERSPACE, path, l);
467 #endif /* SYSTRACE */
468 
469 	/*
470 	 * initialize the fields of the exec package.
471 	 */
472 #ifdef SYSTRACE
473 	pack.ep_name = pathbuf;
474 #else
475 	pack.ep_name = path;
476 #endif /* SYSTRACE */
477 	pack.ep_hdr = malloc(exec_maxhdrsz, M_EXEC, M_WAITOK);
478 	pack.ep_hdrlen = exec_maxhdrsz;
479 	pack.ep_hdrvalid = 0;
480 	pack.ep_ndp = &nid;
481 	pack.ep_emul_arg = NULL;
482 	pack.ep_vmcmds.evs_cnt = 0;
483 	pack.ep_vmcmds.evs_used = 0;
484 	pack.ep_vap = &attr;
485 	pack.ep_flags = 0;
486 
487 #ifdef LKM
488 	lockmgr(&exec_lock, LK_SHARED, NULL);
489 #endif
490 
491 	/* see if we can run it. */
492 #ifdef VERIFIED_EXEC
493         if ((error = check_exec(l, &pack, VERIEXEC_DIRECT)) != 0)
494 #else
495         if ((error = check_exec(l, &pack, 0)) != 0)
496 #endif
497 		goto freehdr;
498 
499 	/* XXX -- THE FOLLOWING SECTION NEEDS MAJOR CLEANUP */
500 
501 	/* allocate an argument buffer */
502 	argp = (char *) uvm_km_alloc(exec_map, NCARGS, 0,
503 	    UVM_KMF_PAGEABLE|UVM_KMF_WAITVA);
504 #ifdef DIAGNOSTIC
505 	if (argp == NULL)
506 		panic("execve: argp == NULL");
507 #endif
508 	dp = argp;
509 	argc = 0;
510 
511 	/* copy the fake args list, if there's one, freeing it as we go */
512 	if (pack.ep_flags & EXEC_HASARGL) {
513 		tmpfap = pack.ep_fa;
514 		while (*tmpfap != NULL) {
515 			char *cp;
516 
517 			cp = *tmpfap;
518 			while (*cp)
519 				*dp++ = *cp++;
520 			dp++;
521 
522 			FREE(*tmpfap, M_EXEC);
523 			tmpfap++; argc++;
524 		}
525 		FREE(pack.ep_fa, M_EXEC);
526 		pack.ep_flags &= ~EXEC_HASARGL;
527 	}
528 
529 	/* Now get argv & environment */
530 	if (args == NULL) {
531 		error = EINVAL;
532 		goto bad;
533 	}
534 	/* 'i' will index the argp/envp element to be retrieved */
535 	i = 0;
536 	if (pack.ep_flags & EXEC_SKIPARG)
537 		i++;
538 
539 	while (1) {
540 		len = argp + ARG_MAX - dp;
541 		if ((error = (*fetch_element)(args, i, &sp)) != 0)
542 			goto bad;
543 		if (!sp)
544 			break;
545 		if ((error = copyinstr(sp, dp, len, &len)) != 0) {
546 			if (error == ENAMETOOLONG)
547 				error = E2BIG;
548 			goto bad;
549 		}
550 #ifdef KTRACE
551 		if (KTRPOINT(p, KTR_EXEC_ARG))
552 			ktrkmem(l, KTR_EXEC_ARG, dp, len - 1);
553 #endif
554 		dp += len;
555 		i++;
556 		argc++;
557 	}
558 
559 	envc = 0;
560 	/* environment need not be there */
561 	if (envs != NULL) {
562 		i = 0;
563 		while (1) {
564 			len = argp + ARG_MAX - dp;
565 			if ((error = (*fetch_element)(envs, i, &sp)) != 0)
566 				goto bad;
567 			if (!sp)
568 				break;
569 			if ((error = copyinstr(sp, dp, len, &len)) != 0) {
570 				if (error == ENAMETOOLONG)
571 					error = E2BIG;
572 				goto bad;
573 			}
574 #ifdef KTRACE
575 			if (KTRPOINT(p, KTR_EXEC_ENV))
576 				ktrkmem(l, KTR_EXEC_ENV, dp, len - 1);
577 #endif
578 			dp += len;
579 			i++;
580 			envc++;
581 		}
582 	}
583 
584 	dp = (char *) ALIGN(dp);
585 
586 	szsigcode = pack.ep_es->es_emul->e_esigcode -
587 	    pack.ep_es->es_emul->e_sigcode;
588 
589 	/* Now check if args & environ fit into new stack */
590 	if (pack.ep_flags & EXEC_32)
591 		len = ((argc + envc + 2 + pack.ep_es->es_arglen) *
592 		    sizeof(int) + sizeof(int) + dp + STACKGAPLEN +
593 		    szsigcode + sizeof(struct ps_strings) + STACK_PTHREADSPACE)
594 		    - argp;
595 	else
596 		len = ((argc + envc + 2 + pack.ep_es->es_arglen) *
597 		    sizeof(char *) + sizeof(int) + dp + STACKGAPLEN +
598 		    szsigcode + sizeof(struct ps_strings) + STACK_PTHREADSPACE)
599 		    - argp;
600 
601 	len = ALIGN(len);	/* make the stack "safely" aligned */
602 
603 	if (len > pack.ep_ssize) { /* in effect, compare to initial limit */
604 		error = ENOMEM;
605 		goto bad;
606 	}
607 
608 	/* Get rid of other LWPs/ */
609 	p->p_flag |= P_WEXIT; /* XXX hack. lwp-exit stuff wants to see it. */
610 	exit_lwps(l);
611 	p->p_flag &= ~P_WEXIT;
612 	KDASSERT(p->p_nlwps == 1);
613 
614 	/* This is now LWP 1 */
615 	l->l_lid = 1;
616 	p->p_nlwpid = 1;
617 
618 	/* Release any SA state. */
619 	if (p->p_sa)
620 		sa_release(p);
621 
622 	/* Remove POSIX timers */
623 	timers_free(p, TIMERS_POSIX);
624 
625 	/* adjust "active stack depth" for process VSZ */
626 	pack.ep_ssize = len;	/* maybe should go elsewhere, but... */
627 
628 	/*
629 	 * Do whatever is necessary to prepare the address space
630 	 * for remapping.  Note that this might replace the current
631 	 * vmspace with another!
632 	 */
633 	uvmspace_exec(l, pack.ep_vm_minaddr, pack.ep_vm_maxaddr);
634 
635 	/* record proc's vnode, for use by procfs and others */
636         if (p->p_textvp)
637                 vrele(p->p_textvp);
638 	VREF(pack.ep_vp);
639 	p->p_textvp = pack.ep_vp;
640 
641 	/* Now map address space */
642 	vm = p->p_vmspace;
643 	vm->vm_taddr = (caddr_t) pack.ep_taddr;
644 	vm->vm_tsize = btoc(pack.ep_tsize);
645 	vm->vm_daddr = (caddr_t) pack.ep_daddr;
646 	vm->vm_dsize = btoc(pack.ep_dsize);
647 	vm->vm_ssize = btoc(pack.ep_ssize);
648 	vm->vm_maxsaddr = (caddr_t) pack.ep_maxsaddr;
649 	vm->vm_minsaddr = (caddr_t) pack.ep_minsaddr;
650 
651 	/* create the new process's VM space by running the vmcmds */
652 #ifdef DIAGNOSTIC
653 	if (pack.ep_vmcmds.evs_used == 0)
654 		panic("execve: no vmcmds");
655 #endif
656 	for (i = 0; i < pack.ep_vmcmds.evs_used && !error; i++) {
657 		struct exec_vmcmd *vcp;
658 
659 		vcp = &pack.ep_vmcmds.evs_cmds[i];
660 		if (vcp->ev_flags & VMCMD_RELATIVE) {
661 #ifdef DIAGNOSTIC
662 			if (base_vcp == NULL)
663 				panic("execve: relative vmcmd with no base");
664 			if (vcp->ev_flags & VMCMD_BASE)
665 				panic("execve: illegal base & relative vmcmd");
666 #endif
667 			vcp->ev_addr += base_vcp->ev_addr;
668 		}
669 		error = (*vcp->ev_proc)(l, vcp);
670 #ifdef DEBUG_EXEC
671 		if (error) {
672 			int j;
673 			struct exec_vmcmd *vp = &pack.ep_vmcmds.evs_cmds[0];
674 			for (j = 0; j <= i; j++)
675 				uprintf(
676 			    "vmcmd[%d] = %#lx/%#lx fd@%#lx prot=0%o flags=%d\n",
677 				    j, vp[j].ev_addr, vp[j].ev_len,
678 				    vp[j].ev_offset, vp[j].ev_prot,
679 				    vp[j].ev_flags);
680 		}
681 #endif /* DEBUG_EXEC */
682 		if (vcp->ev_flags & VMCMD_BASE)
683 			base_vcp = vcp;
684 	}
685 
686 	/* free the vmspace-creation commands, and release their references */
687 	kill_vmcmds(&pack.ep_vmcmds);
688 
689 	vn_lock(pack.ep_vp, LK_EXCLUSIVE | LK_RETRY);
690 	VOP_CLOSE(pack.ep_vp, FREAD, cred, l);
691 	vput(pack.ep_vp);
692 
693 	/* if an error happened, deallocate and punt */
694 	if (error) {
695 		DPRINTF(("execve: vmcmd %i failed: %d\n", i - 1, error));
696 		goto exec_abort;
697 	}
698 
699 	/* remember information about the process */
700 	arginfo.ps_nargvstr = argc;
701 	arginfo.ps_nenvstr = envc;
702 
703 	stack = (char *)STACK_ALLOC(STACK_GROW(vm->vm_minsaddr,
704 		STACK_PTHREADSPACE + sizeof(struct ps_strings) + szsigcode),
705 		len - (sizeof(struct ps_strings) + szsigcode));
706 #ifdef __MACHINE_STACK_GROWS_UP
707 	/*
708 	 * The copyargs call always copies into lower addresses
709 	 * first, moving towards higher addresses, starting with
710 	 * the stack pointer that we give.  When the stack grows
711 	 * down, this puts argc/argv/envp very shallow on the
712 	 * stack, right at the first user stack pointer, and puts
713 	 * STACKGAPLEN very deep in the stack.  When the stack
714 	 * grows up, the situation is reversed.
715 	 *
716 	 * Normally, this is no big deal.  But the ld_elf.so _rtld()
717 	 * function expects to be called with a single pointer to
718 	 * a region that has a few words it can stash values into,
719 	 * followed by argc/argv/envp.  When the stack grows down,
720 	 * it's easy to decrement the stack pointer a little bit to
721 	 * allocate the space for these few words and pass the new
722 	 * stack pointer to _rtld.  When the stack grows up, however,
723 	 * a few words before argc is part of the signal trampoline, XXX
724 	 * so we have a problem.
725 	 *
726 	 * Instead of changing how _rtld works, we take the easy way
727 	 * out and steal 32 bytes before we call copyargs.  This
728 	 * space is effectively stolen from STACKGAPLEN.
729 	 */
730 	stack += 32;
731 #endif /* __MACHINE_STACK_GROWS_UP */
732 
733 	/* Now copy argc, args & environ to new stack */
734 	error = (*pack.ep_es->es_copyargs)(l, &pack, &arginfo, &stack, argp);
735 	if (error) {
736 		DPRINTF(("execve: copyargs failed %d\n", error));
737 		goto exec_abort;
738 	}
739 	/* Move the stack back to original point */
740 	stack = (char *)STACK_GROW(vm->vm_minsaddr, len);
741 
742 	/* fill process ps_strings info */
743 	p->p_psstr = (struct ps_strings *)
744 	    STACK_ALLOC(STACK_GROW(vm->vm_minsaddr, STACK_PTHREADSPACE),
745 	    sizeof(struct ps_strings));
746 	p->p_psargv = offsetof(struct ps_strings, ps_argvstr);
747 	p->p_psnargv = offsetof(struct ps_strings, ps_nargvstr);
748 	p->p_psenv = offsetof(struct ps_strings, ps_envstr);
749 	p->p_psnenv = offsetof(struct ps_strings, ps_nenvstr);
750 
751 	/* copy out the process's ps_strings structure */
752 	if ((error = copyout(aip, (char *)p->p_psstr,
753 	    sizeof(arginfo))) != 0) {
754 		DPRINTF(("execve: ps_strings copyout %p->%p size %ld failed\n",
755 		       aip, (char *)p->p_psstr, (long)sizeof(arginfo)));
756 		goto exec_abort;
757 	}
758 
759 	stopprofclock(p);	/* stop profiling */
760 	fdcloseexec(l);		/* handle close on exec */
761 	execsigs(p);		/* reset catched signals */
762 
763 	l->l_ctxlink = NULL;	/* reset ucontext link */
764 
765 	/* set command name & other accounting info */
766 	len = min(nid.ni_cnd.cn_namelen, MAXCOMLEN);
767 	memcpy(p->p_comm, nid.ni_cnd.cn_nameptr, len);
768 	p->p_comm[len] = 0;
769 	p->p_acflag &= ~AFORK;
770 
771 	p->p_flag |= P_EXEC;
772 	if (p->p_flag & P_PPWAIT) {
773 		p->p_flag &= ~P_PPWAIT;
774 		wakeup((caddr_t) p->p_pptr);
775 	}
776 
777 	/*
778 	 * deal with set[ug]id.
779 	 * MNT_NOSUID has already been used to disable s[ug]id.
780 	 */
781 	if ((p->p_flag & P_TRACED) == 0 &&
782 
783 	    (((attr.va_mode & S_ISUID) != 0 &&
784 	      kauth_cred_geteuid(p->p_cred) != attr.va_uid) ||
785 
786 	     ((attr.va_mode & S_ISGID) != 0 &&
787 	      kauth_cred_getegid(p->p_cred) != attr.va_gid))) {
788 		/*
789 		 * Mark the process as SUGID before we do
790 		 * anything that might block.
791 		 */
792 		p_sugid(p);
793 
794 		/* Make sure file descriptors 0..2 are in use. */
795 		if ((error = fdcheckstd(l)) != 0) {
796 			DPRINTF(("execve: fdcheckstd failed %d\n", error));
797 			goto exec_abort;
798 		}
799 
800 		p->p_cred = kauth_cred_copy(cred);
801 		cred = p->p_cred;
802 #ifdef KTRACE
803 		/*
804 		 * If process is being ktraced, turn off - unless
805 		 * root set it.
806 		 */
807 		if (p->p_tracep && !(p->p_traceflag & KTRFAC_ROOT))
808 			ktrderef(p);
809 #endif
810 		if (attr.va_mode & S_ISUID)
811 			kauth_cred_seteuid(p->p_cred, attr.va_uid);
812 		if (attr.va_mode & S_ISGID)
813 			kauth_cred_setegid(p->p_cred, attr.va_gid);
814 	} else {
815 		if (kauth_cred_geteuid(p->p_cred) == kauth_cred_getuid(p->p_cred) &&
816 		    kauth_cred_getegid(p->p_cred) == kauth_cred_getgid(p->p_cred))
817 			p->p_flag &= ~P_SUGID;
818 	}
819 	kauth_cred_setsvuid(p->p_cred, kauth_cred_geteuid(p->p_cred));
820 	kauth_cred_setsvgid(p->p_cred, kauth_cred_getegid(p->p_cred));
821 
822 #if defined(__HAVE_RAS)
823 	/*
824 	 * Remove all RASs from the address space.
825 	 */
826 	ras_purgeall(p);
827 #endif
828 
829 	doexechooks(p);
830 
831 	uvm_km_free(exec_map, (vaddr_t) argp, NCARGS, UVM_KMF_PAGEABLE);
832 
833 	PNBUF_PUT(nid.ni_cnd.cn_pnbuf);
834 
835 	/* notify others that we exec'd */
836 	KNOTE(&p->p_klist, NOTE_EXEC);
837 
838 	/* setup new registers and do misc. setup. */
839 	(*pack.ep_es->es_emul->e_setregs)(l, &pack, (u_long) stack);
840 	if (pack.ep_es->es_setregs)
841 		(*pack.ep_es->es_setregs)(l, &pack, (u_long) stack);
842 
843 	/* map the process's signal trampoline code */
844 	if (exec_sigcode_map(p, pack.ep_es->es_emul)) {
845 		DPRINTF(("execve: map sigcode failed %d\n", error));
846 		goto exec_abort;
847 	}
848 
849 	if ((p->p_flag & (P_TRACED|P_SYSCALL)) == P_TRACED)
850 		psignal(p, SIGTRAP);
851 
852 	free(pack.ep_hdr, M_EXEC);
853 
854 	/*
855 	 * Call emulation specific exec hook. This can setup per-process
856 	 * p->p_emuldata or do any other per-process stuff an emulation needs.
857 	 *
858 	 * If we are executing process of different emulation than the
859 	 * original forked process, call e_proc_exit() of the old emulation
860 	 * first, then e_proc_exec() of new emulation. If the emulation is
861 	 * same, the exec hook code should deallocate any old emulation
862 	 * resources held previously by this process.
863 	 */
864 	if (p->p_emul && p->p_emul->e_proc_exit
865 	    && p->p_emul != pack.ep_es->es_emul)
866 		(*p->p_emul->e_proc_exit)(p);
867 
868 	/*
869 	 * Call exec hook. Emulation code may NOT store reference to anything
870 	 * from &pack.
871 	 */
872         if (pack.ep_es->es_emul->e_proc_exec)
873                 (*pack.ep_es->es_emul->e_proc_exec)(p, &pack);
874 
875 	/* update p_emul, the old value is no longer needed */
876 	p->p_emul = pack.ep_es->es_emul;
877 
878 	/* ...and the same for p_execsw */
879 	p->p_execsw = pack.ep_es;
880 
881 #ifdef __HAVE_SYSCALL_INTERN
882 	(*p->p_emul->e_syscall_intern)(p);
883 #endif
884 #ifdef KTRACE
885 	if (KTRPOINT(p, KTR_EMUL))
886 		ktremul(l);
887 #endif
888 
889 #ifdef LKM
890 	lockmgr(&exec_lock, LK_RELEASE, NULL);
891 #endif
892 	p->p_flag &= ~P_INEXEC;
893 
894 	if (p->p_flag & P_STOPEXEC) {
895 		int s;
896 
897 		sigminusset(&contsigmask, &p->p_sigctx.ps_siglist);
898 		SCHED_LOCK(s);
899 		p->p_pptr->p_nstopchild++;
900 		p->p_stat = SSTOP;
901 		l->l_stat = LSSTOP;
902 		p->p_nrlwps--;
903 		mi_switch(l, NULL);
904 		SCHED_ASSERT_UNLOCKED();
905 		splx(s);
906 	}
907 
908 #ifdef SYSTRACE
909 	if (ISSET(p->p_flag, P_SYSTRACE) &&
910 	    wassugid && !ISSET(p->p_flag, P_SUGID))
911 		systrace_execve1(pathbuf, p);
912 #endif /* SYSTRACE */
913 
914 	return (EJUSTRETURN);
915 
916  bad:
917 	p->p_flag &= ~P_INEXEC;
918 	/* free the vmspace-creation commands, and release their references */
919 	kill_vmcmds(&pack.ep_vmcmds);
920 	/* kill any opened file descriptor, if necessary */
921 	if (pack.ep_flags & EXEC_HASFD) {
922 		pack.ep_flags &= ~EXEC_HASFD;
923 		(void) fdrelease(l, pack.ep_fd);
924 	}
925 	/* close and put the exec'd file */
926 	vn_lock(pack.ep_vp, LK_EXCLUSIVE | LK_RETRY);
927 	VOP_CLOSE(pack.ep_vp, FREAD, cred, l);
928 	vput(pack.ep_vp);
929 	PNBUF_PUT(nid.ni_cnd.cn_pnbuf);
930 	uvm_km_free(exec_map, (vaddr_t) argp, NCARGS, UVM_KMF_PAGEABLE);
931 
932  freehdr:
933 	free(pack.ep_hdr, M_EXEC);
934 
935 #ifdef SYSTRACE
936  clrflg:
937 #endif /* SYSTRACE */
938 	l->l_flag |= oldlwpflags;
939 	p->p_flag &= ~P_INEXEC;
940 #ifdef LKM
941 	lockmgr(&exec_lock, LK_RELEASE, NULL);
942 #endif
943 
944 	return error;
945 
946  exec_abort:
947 	p->p_flag &= ~P_INEXEC;
948 #ifdef LKM
949 	lockmgr(&exec_lock, LK_RELEASE, NULL);
950 #endif
951 
952 	/*
953 	 * the old process doesn't exist anymore.  exit gracefully.
954 	 * get rid of the (new) address space we have created, if any, get rid
955 	 * of our namei data and vnode, and exit noting failure
956 	 */
957 	uvm_deallocate(&vm->vm_map, VM_MIN_ADDRESS,
958 		VM_MAXUSER_ADDRESS - VM_MIN_ADDRESS);
959 	if (pack.ep_emul_arg)
960 		FREE(pack.ep_emul_arg, M_TEMP);
961 	PNBUF_PUT(nid.ni_cnd.cn_pnbuf);
962 	uvm_km_free(exec_map, (vaddr_t) argp, NCARGS, UVM_KMF_PAGEABLE);
963 	free(pack.ep_hdr, M_EXEC);
964 	exit1(l, W_EXITCODE(error, SIGABRT));
965 
966 	/* NOTREACHED */
967 	return 0;
968 }
969 
970 
971 int
972 copyargs(struct lwp *l, struct exec_package *pack, struct ps_strings *arginfo,
973     char **stackp, void *argp)
974 {
975 	char	**cpp, *dp, *sp;
976 	size_t	len;
977 	void	*nullp;
978 	long	argc, envc;
979 	int	error;
980 
981 	cpp = (char **)*stackp;
982 	nullp = NULL;
983 	argc = arginfo->ps_nargvstr;
984 	envc = arginfo->ps_nenvstr;
985 	if ((error = copyout(&argc, cpp++, sizeof(argc))) != 0)
986 		return error;
987 
988 	dp = (char *) (cpp + argc + envc + 2 + pack->ep_es->es_arglen);
989 	sp = argp;
990 
991 	/* XXX don't copy them out, remap them! */
992 	arginfo->ps_argvstr = cpp; /* remember location of argv for later */
993 
994 	for (; --argc >= 0; sp += len, dp += len)
995 		if ((error = copyout(&dp, cpp++, sizeof(dp))) != 0 ||
996 		    (error = copyoutstr(sp, dp, ARG_MAX, &len)) != 0)
997 			return error;
998 
999 	if ((error = copyout(&nullp, cpp++, sizeof(nullp))) != 0)
1000 		return error;
1001 
1002 	arginfo->ps_envstr = cpp; /* remember location of envp for later */
1003 
1004 	for (; --envc >= 0; sp += len, dp += len)
1005 		if ((error = copyout(&dp, cpp++, sizeof(dp))) != 0 ||
1006 		    (error = copyoutstr(sp, dp, ARG_MAX, &len)) != 0)
1007 			return error;
1008 
1009 	if ((error = copyout(&nullp, cpp++, sizeof(nullp))) != 0)
1010 		return error;
1011 
1012 	*stackp = (char *)cpp;
1013 	return 0;
1014 }
1015 
1016 #ifdef LKM
1017 /*
1018  * Find an emulation of given name in list of emulations.
1019  * Needs to be called with the exec_lock held.
1020  */
1021 const struct emul *
1022 emul_search(const char *name)
1023 {
1024 	struct emul_entry *it;
1025 
1026 	LIST_FOREACH(it, &el_head, el_list) {
1027 		if (strcmp(name, it->el_emul->e_name) == 0)
1028 			return it->el_emul;
1029 	}
1030 
1031 	return NULL;
1032 }
1033 
1034 /*
1035  * Add an emulation to list, if it's not there already.
1036  */
1037 int
1038 emul_register(const struct emul *emul, int ro_entry)
1039 {
1040 	struct emul_entry	*ee;
1041 	int			error;
1042 
1043 	error = 0;
1044 	lockmgr(&exec_lock, LK_SHARED, NULL);
1045 
1046 	if (emul_search(emul->e_name)) {
1047 		error = EEXIST;
1048 		goto out;
1049 	}
1050 
1051 	MALLOC(ee, struct emul_entry *, sizeof(struct emul_entry),
1052 		M_EXEC, M_WAITOK);
1053 	ee->el_emul = emul;
1054 	ee->ro_entry = ro_entry;
1055 	LIST_INSERT_HEAD(&el_head, ee, el_list);
1056 
1057  out:
1058 	lockmgr(&exec_lock, LK_RELEASE, NULL);
1059 	return error;
1060 }
1061 
1062 /*
1063  * Remove emulation with name 'name' from list of supported emulations.
1064  */
1065 int
1066 emul_unregister(const char *name)
1067 {
1068 	const struct proclist_desc *pd;
1069 	struct emul_entry	*it;
1070 	int			i, error;
1071 	struct proc		*ptmp;
1072 
1073 	error = 0;
1074 	lockmgr(&exec_lock, LK_SHARED, NULL);
1075 
1076 	LIST_FOREACH(it, &el_head, el_list) {
1077 		if (strcmp(it->el_emul->e_name, name) == 0)
1078 			break;
1079 	}
1080 
1081 	if (!it) {
1082 		error = ENOENT;
1083 		goto out;
1084 	}
1085 
1086 	if (it->ro_entry) {
1087 		error = EBUSY;
1088 		goto out;
1089 	}
1090 
1091 	/* test if any execw[] entry is still using this */
1092 	for(i=0; i < nexecs; i++) {
1093 		if (execsw[i]->es_emul == it->el_emul) {
1094 			error = EBUSY;
1095 			goto out;
1096 		}
1097 	}
1098 
1099 	/*
1100 	 * Test if any process is running under this emulation - since
1101 	 * emul_unregister() is running quite sendomly, it's better
1102 	 * to do expensive check here than to use any locking.
1103 	 */
1104 	proclist_lock_read();
1105 	for (pd = proclists; pd->pd_list != NULL && !error; pd++) {
1106 		PROCLIST_FOREACH(ptmp, pd->pd_list) {
1107 			if (ptmp->p_emul == it->el_emul) {
1108 				error = EBUSY;
1109 				break;
1110 			}
1111 		}
1112 	}
1113 	proclist_unlock_read();
1114 
1115 	if (error)
1116 		goto out;
1117 
1118 
1119 	/* entry is not used, remove it */
1120 	LIST_REMOVE(it, el_list);
1121 	FREE(it, M_EXEC);
1122 
1123  out:
1124 	lockmgr(&exec_lock, LK_RELEASE, NULL);
1125 	return error;
1126 }
1127 
1128 /*
1129  * Add execsw[] entry.
1130  */
1131 int
1132 exec_add(struct execsw *esp, const char *e_name)
1133 {
1134 	struct exec_entry	*it;
1135 	int			error;
1136 
1137 	error = 0;
1138 	lockmgr(&exec_lock, LK_EXCLUSIVE, NULL);
1139 
1140 	if (!esp->es_emul) {
1141 		esp->es_emul = emul_search(e_name);
1142 		if (!esp->es_emul) {
1143 			error = ENOENT;
1144 			goto out;
1145 		}
1146 	}
1147 
1148 	LIST_FOREACH(it, &ex_head, ex_list) {
1149 		/* assume tuple (makecmds, probe_func, emulation) is unique */
1150 		if (it->es->es_makecmds == esp->es_makecmds
1151 		    && it->es->u.elf_probe_func == esp->u.elf_probe_func
1152 		    && it->es->es_emul == esp->es_emul) {
1153 			error = EEXIST;
1154 			goto out;
1155 		}
1156 	}
1157 
1158 	/* if we got here, the entry doesn't exist yet */
1159 	MALLOC(it, struct exec_entry *, sizeof(struct exec_entry),
1160 		M_EXEC, M_WAITOK);
1161 	it->es = esp;
1162 	LIST_INSERT_HEAD(&ex_head, it, ex_list);
1163 
1164 	/* update execsw[] */
1165 	exec_init(0);
1166 
1167  out:
1168 	lockmgr(&exec_lock, LK_RELEASE, NULL);
1169 	return error;
1170 }
1171 
1172 /*
1173  * Remove execsw[] entry.
1174  */
1175 int
1176 exec_remove(const struct execsw *esp)
1177 {
1178 	struct exec_entry	*it;
1179 	int			error;
1180 
1181 	error = 0;
1182 	lockmgr(&exec_lock, LK_EXCLUSIVE, NULL);
1183 
1184 	LIST_FOREACH(it, &ex_head, ex_list) {
1185 		/* assume tuple (makecmds, probe_func, emulation) is unique */
1186 		if (it->es->es_makecmds == esp->es_makecmds
1187 		    && it->es->u.elf_probe_func == esp->u.elf_probe_func
1188 		    && it->es->es_emul == esp->es_emul)
1189 			break;
1190 	}
1191 	if (!it) {
1192 		error = ENOENT;
1193 		goto out;
1194 	}
1195 
1196 	/* remove item from list and free resources */
1197 	LIST_REMOVE(it, ex_list);
1198 	FREE(it, M_EXEC);
1199 
1200 	/* update execsw[] */
1201 	exec_init(0);
1202 
1203  out:
1204 	lockmgr(&exec_lock, LK_RELEASE, NULL);
1205 	return error;
1206 }
1207 
1208 static void
1209 link_es(struct execsw_entry **listp, const struct execsw *esp)
1210 {
1211 	struct execsw_entry *et, *e1;
1212 
1213 	et = (struct execsw_entry *) malloc(sizeof(struct execsw_entry),
1214 			M_TEMP, M_WAITOK);
1215 	et->next = NULL;
1216 	et->es = esp;
1217 	if (*listp == NULL) {
1218 		*listp = et;
1219 		return;
1220 	}
1221 
1222 	switch(et->es->es_prio) {
1223 	case EXECSW_PRIO_FIRST:
1224 		/* put new entry as the first */
1225 		et->next = *listp;
1226 		*listp = et;
1227 		break;
1228 	case EXECSW_PRIO_ANY:
1229 		/* put new entry after all *_FIRST and *_ANY entries */
1230 		for(e1 = *listp; e1->next
1231 			&& e1->next->es->es_prio != EXECSW_PRIO_LAST;
1232 			e1 = e1->next);
1233 		et->next = e1->next;
1234 		e1->next = et;
1235 		break;
1236 	case EXECSW_PRIO_LAST:
1237 		/* put new entry as the last one */
1238 		for(e1 = *listp; e1->next; e1 = e1->next);
1239 		e1->next = et;
1240 		break;
1241 	default:
1242 #ifdef DIAGNOSTIC
1243 		panic("execw[] entry with unknown priority %d found",
1244 			et->es->es_prio);
1245 #else
1246 		free(et, M_TEMP);
1247 #endif
1248 		break;
1249 	}
1250 }
1251 
1252 /*
1253  * Initialize exec structures. If init_boot is true, also does necessary
1254  * one-time initialization (it's called from main() that way).
1255  * Once system is multiuser, this should be called with exec_lock held,
1256  * i.e. via exec_{add|remove}().
1257  */
1258 int
1259 exec_init(int init_boot)
1260 {
1261 	const struct execsw	**new_es, * const *old_es;
1262 	struct execsw_entry	*list, *e1;
1263 	struct exec_entry	*e2;
1264 	int			i, es_sz;
1265 
1266 	if (init_boot) {
1267 		/* do one-time initializations */
1268 		lockinit(&exec_lock, PWAIT, "execlck", 0, 0);
1269 
1270 		/* register compiled-in emulations */
1271 		for(i=0; i < nexecs_builtin; i++) {
1272 			if (execsw_builtin[i].es_emul)
1273 				emul_register(execsw_builtin[i].es_emul, 1);
1274 		}
1275 #ifdef DIAGNOSTIC
1276 		if (i == 0)
1277 			panic("no emulations found in execsw_builtin[]");
1278 #endif
1279 	}
1280 
1281 	/*
1282 	 * Build execsw[] array from builtin entries and entries added
1283 	 * at runtime.
1284 	 */
1285 	list = NULL;
1286 	for(i=0; i < nexecs_builtin; i++)
1287 		link_es(&list, &execsw_builtin[i]);
1288 
1289 	/* Add dynamically loaded entries */
1290 	es_sz = nexecs_builtin;
1291 	LIST_FOREACH(e2, &ex_head, ex_list) {
1292 		link_es(&list, e2->es);
1293 		es_sz++;
1294 	}
1295 
1296 	/*
1297 	 * Now that we have sorted all execw entries, create new execsw[]
1298 	 * and free no longer needed memory in the process.
1299 	 */
1300 	new_es = malloc(es_sz * sizeof(struct execsw *), M_EXEC, M_WAITOK);
1301 	for(i=0; list; i++) {
1302 		new_es[i] = list->es;
1303 		e1 = list->next;
1304 		free(list, M_TEMP);
1305 		list = e1;
1306 	}
1307 
1308 	/*
1309 	 * New execsw[] array built, now replace old execsw[] and free
1310 	 * used memory.
1311 	 */
1312 	old_es = execsw;
1313 	execsw = new_es;
1314 	nexecs = es_sz;
1315 	if (old_es)
1316 		/*XXXUNCONST*/
1317 		free(__UNCONST(old_es), M_EXEC);
1318 
1319 	/*
1320 	 * Figure out the maximum size of an exec header.
1321 	 */
1322 	exec_maxhdrsz = 0;
1323 	for (i = 0; i < nexecs; i++) {
1324 		if (execsw[i]->es_hdrsz > exec_maxhdrsz)
1325 			exec_maxhdrsz = execsw[i]->es_hdrsz;
1326 	}
1327 
1328 	return 0;
1329 }
1330 #endif
1331 
1332 #ifndef LKM
1333 /*
1334  * Simplified exec_init() for kernels without LKMs. Only initialize
1335  * exec_maxhdrsz and execsw[].
1336  */
1337 int
1338 exec_init(int init_boot)
1339 {
1340 	int i;
1341 
1342 #ifdef DIAGNOSTIC
1343 	if (!init_boot)
1344 		panic("exec_init(): called with init_boot == 0");
1345 #endif
1346 
1347 	/* do one-time initializations */
1348 	nexecs = nexecs_builtin;
1349 	execsw = malloc(nexecs*sizeof(struct execsw *), M_EXEC, M_WAITOK);
1350 
1351 	/*
1352 	 * Fill in execsw[] and figure out the maximum size of an exec header.
1353 	 */
1354 	exec_maxhdrsz = 0;
1355 	for(i=0; i < nexecs; i++) {
1356 		execsw[i] = &execsw_builtin[i];
1357 		if (execsw_builtin[i].es_hdrsz > exec_maxhdrsz)
1358 			exec_maxhdrsz = execsw_builtin[i].es_hdrsz;
1359 	}
1360 
1361 	return 0;
1362 
1363 }
1364 #endif /* !LKM */
1365 
1366 static int
1367 exec_sigcode_map(struct proc *p, const struct emul *e)
1368 {
1369 	vaddr_t va;
1370 	vsize_t sz;
1371 	int error;
1372 	struct uvm_object *uobj;
1373 
1374 	sz = (vaddr_t)e->e_esigcode - (vaddr_t)e->e_sigcode;
1375 
1376 	if (e->e_sigobject == NULL || sz == 0) {
1377 		return 0;
1378 	}
1379 
1380 	/*
1381 	 * If we don't have a sigobject for this emulation, create one.
1382 	 *
1383 	 * sigobject is an anonymous memory object (just like SYSV shared
1384 	 * memory) that we keep a permanent reference to and that we map
1385 	 * in all processes that need this sigcode. The creation is simple,
1386 	 * we create an object, add a permanent reference to it, map it in
1387 	 * kernel space, copy out the sigcode to it and unmap it.
1388 	 * We map it with PROT_READ|PROT_EXEC into the process just
1389 	 * the way sys_mmap() would map it.
1390 	 */
1391 
1392 	uobj = *e->e_sigobject;
1393 	if (uobj == NULL) {
1394 		uobj = uao_create(sz, 0);
1395 		(*uobj->pgops->pgo_reference)(uobj);
1396 		va = vm_map_min(kernel_map);
1397 		if ((error = uvm_map(kernel_map, &va, round_page(sz),
1398 		    uobj, 0, 0,
1399 		    UVM_MAPFLAG(UVM_PROT_RW, UVM_PROT_RW,
1400 		    UVM_INH_SHARE, UVM_ADV_RANDOM, 0)))) {
1401 			printf("kernel mapping failed %d\n", error);
1402 			(*uobj->pgops->pgo_detach)(uobj);
1403 			return (error);
1404 		}
1405 		memcpy((void *)va, e->e_sigcode, sz);
1406 #ifdef PMAP_NEED_PROCWR
1407 		pmap_procwr(&proc0, va, sz);
1408 #endif
1409 		uvm_unmap(kernel_map, va, va + round_page(sz));
1410 		*e->e_sigobject = uobj;
1411 	}
1412 
1413 	/* Just a hint to uvm_map where to put it. */
1414 	va = e->e_vm_default_addr(p, (vaddr_t)p->p_vmspace->vm_daddr,
1415 	    round_page(sz));
1416 
1417 #ifdef __alpha__
1418 	/*
1419 	 * Tru64 puts /sbin/loader at the end of user virtual memory,
1420 	 * which causes the above calculation to put the sigcode at
1421 	 * an invalid address.  Put it just below the text instead.
1422 	 */
1423 	if (va == (vaddr_t)vm_map_max(&p->p_vmspace->vm_map)) {
1424 		va = (vaddr_t)p->p_vmspace->vm_taddr - round_page(sz);
1425 	}
1426 #endif
1427 
1428 	(*uobj->pgops->pgo_reference)(uobj);
1429 	error = uvm_map(&p->p_vmspace->vm_map, &va, round_page(sz),
1430 			uobj, 0, 0,
1431 			UVM_MAPFLAG(UVM_PROT_RX, UVM_PROT_RX, UVM_INH_SHARE,
1432 				    UVM_ADV_RANDOM, 0));
1433 	if (error) {
1434 		(*uobj->pgops->pgo_detach)(uobj);
1435 		return (error);
1436 	}
1437 	p->p_sigctx.ps_sigcode = (void *)va;
1438 	return (0);
1439 }
1440