xref: /openbsd-src/sys/kern/kern_exec.c (revision 48950c12d106c85f315112191a0228d7b83b9510)
1 /*	$OpenBSD: kern_exec.c,v 1.132 2012/08/02 03:18:48 guenther Exp $	*/
2 /*	$NetBSD: kern_exec.c,v 1.75 1996/02/09 18:59:28 christos Exp $	*/
3 
4 /*-
5  * Copyright (C) 1993, 1994 Christopher G. Demetriou
6  * Copyright (C) 1992 Wolfgang Solfrank.
7  * Copyright (C) 1992 TooLs GmbH.
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by TooLs GmbH.
21  * 4. The name of TooLs GmbH may not be used to endorse or promote products
22  *    derived from this software without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY TOOLS GMBH ``AS IS'' AND ANY EXPRESS OR
25  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
26  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
27  * IN NO EVENT SHALL TOOLS GMBH BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
29  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
30  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
31  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
32  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
33  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 #include <sys/param.h>
37 #include <sys/systm.h>
38 #include <sys/filedesc.h>
39 #include <sys/kernel.h>
40 #include <sys/proc.h>
41 #include <sys/mount.h>
42 #include <sys/malloc.h>
43 #include <sys/pool.h>
44 #include <sys/namei.h>
45 #include <sys/vnode.h>
46 #include <sys/file.h>
47 #include <sys/acct.h>
48 #include <sys/exec.h>
49 #include <sys/ktrace.h>
50 #include <sys/resourcevar.h>
51 #include <sys/wait.h>
52 #include <sys/mman.h>
53 #include <sys/signalvar.h>
54 #include <sys/stat.h>
55 #include <sys/conf.h>
56 #ifdef SYSVSHM
57 #include <sys/shm.h>
58 #endif
59 
60 #include <sys/syscallargs.h>
61 
62 #include <uvm/uvm_extern.h>
63 
64 #include <machine/cpu.h>
65 #include <machine/reg.h>
66 
67 #ifdef __HAVE_MD_TCB
68 # include <machine/tcb.h>
69 #endif
70 
71 #include <dev/rndvar.h>
72 
73 #include "systrace.h"
74 
75 #if NSYSTRACE > 0
76 #include <dev/systrace.h>
77 #endif
78 
79 /*
80  * Map the shared signal code.
81  */
82 int exec_sigcode_map(struct proc *, struct emul *);
83 
84 /*
85  * stackgap_random specifies if the stackgap should have a random size added
86  * to it. Must be a n^2. If non-zero, the stack gap will be calculated as:
87  * (arc4random() * ALIGNBYTES) & (stackgap_random - 1) + STACKGAPLEN.
88  */
89 int stackgap_random = STACKGAP_RANDOM;
90 
91 /*
92  * check exec:
93  * given an "executable" described in the exec package's namei info,
94  * see what we can do with it.
95  *
96  * ON ENTRY:
97  *	exec package with appropriate namei info
98  *	proc pointer of exec'ing proc
99  *	NO SELF-LOCKED VNODES
100  *
101  * ON EXIT:
102  *	error:	nothing held, etc.  exec header still allocated.
103  *	ok:	filled exec package, one locked vnode.
104  *
105  * EXEC SWITCH ENTRY:
106  * 	Locked vnode to check, exec package, proc.
107  *
108  * EXEC SWITCH EXIT:
109  *	ok:	return 0, filled exec package, one locked vnode.
110  *	error:	destructive:
111  *			everything deallocated except exec header.
112  *		non-destructive:
113  *			error code, locked vnode, exec header unmodified
114  */
115 int
116 check_exec(struct proc *p, struct exec_package *epp)
117 {
118 	int error, i;
119 	struct vnode *vp;
120 	struct nameidata *ndp;
121 	size_t resid;
122 
123 	ndp = epp->ep_ndp;
124 	ndp->ni_cnd.cn_nameiop = LOOKUP;
125 	ndp->ni_cnd.cn_flags = FOLLOW | LOCKLEAF | SAVENAME;
126 	/* first get the vnode */
127 	if ((error = namei(ndp)) != 0)
128 		return (error);
129 	epp->ep_vp = vp = ndp->ni_vp;
130 
131 	/* check for regular file */
132 	if (vp->v_type == VDIR) {
133 		error = EISDIR;
134 		goto bad1;
135 	}
136 	if (vp->v_type != VREG) {
137 		error = EACCES;
138 		goto bad1;
139 	}
140 
141 	/* get attributes */
142 	if ((error = VOP_GETATTR(vp, epp->ep_vap, p->p_ucred, p)) != 0)
143 		goto bad1;
144 
145 	/* Check mount point */
146 	if (vp->v_mount->mnt_flag & MNT_NOEXEC) {
147 		error = EACCES;
148 		goto bad1;
149 	}
150 
151 	if ((vp->v_mount->mnt_flag & MNT_NOSUID))
152 		epp->ep_vap->va_mode &= ~(VSUID | VSGID);
153 
154 	/* check access.  for root we have to see if any exec bit on */
155 	if ((error = VOP_ACCESS(vp, VEXEC, p->p_ucred, p)) != 0)
156 		goto bad1;
157 	if ((epp->ep_vap->va_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0) {
158 		error = EACCES;
159 		goto bad1;
160 	}
161 
162 	/* try to open it */
163 	if ((error = VOP_OPEN(vp, FREAD, p->p_ucred, p)) != 0)
164 		goto bad1;
165 
166 	/* unlock vp, we need it unlocked from here */
167 	VOP_UNLOCK(vp, 0, p);
168 
169 	/* now we have the file, get the exec header */
170 	error = vn_rdwr(UIO_READ, vp, epp->ep_hdr, epp->ep_hdrlen, 0,
171 	    UIO_SYSSPACE, 0, p->p_ucred, &resid, p);
172 	if (error)
173 		goto bad2;
174 	epp->ep_hdrvalid = epp->ep_hdrlen - resid;
175 
176 	/*
177 	 * set up the vmcmds for creation of the process
178 	 * address space
179 	 */
180 	error = ENOEXEC;
181 	for (i = 0; i < nexecs && error != 0; i++) {
182 		int newerror;
183 
184 		if (execsw[i].es_check == NULL)
185 			continue;
186 		newerror = (*execsw[i].es_check)(p, epp);
187 		if (!newerror && !(epp->ep_emul->e_flags & EMUL_ENABLED))
188 			newerror = EPERM;
189 		/* make sure the first "interesting" error code is saved. */
190 		if (!newerror || error == ENOEXEC)
191 			error = newerror;
192 		if (epp->ep_flags & EXEC_DESTR && error != 0)
193 			return (error);
194 	}
195 	if (!error) {
196 		/* check that entry point is sane */
197 		if (epp->ep_entry > VM_MAXUSER_ADDRESS) {
198 			error = ENOEXEC;
199 		}
200 
201 		/* check limits */
202 		if ((epp->ep_tsize > MAXTSIZ) ||
203 		    (epp->ep_dsize > p->p_rlimit[RLIMIT_DATA].rlim_cur))
204 			error = ENOMEM;
205 
206 		if (!error)
207 			return (0);
208 	}
209 
210 	/*
211 	 * free any vmspace-creation commands,
212 	 * and release their references
213 	 */
214 	kill_vmcmds(&epp->ep_vmcmds);
215 
216 bad2:
217 	/*
218 	 * close the vnode, free the pathname buf, and punt.
219 	 */
220 	vn_close(vp, FREAD, p->p_ucred, p);
221 	pool_put(&namei_pool, ndp->ni_cnd.cn_pnbuf);
222 	return (error);
223 
224 bad1:
225 	/*
226 	 * free the namei pathname buffer, and put the vnode
227 	 * (which we don't yet have open).
228 	 */
229 	pool_put(&namei_pool, ndp->ni_cnd.cn_pnbuf);
230 	vput(vp);
231 	return (error);
232 }
233 
234 /*
235  * exec system call
236  */
237 /* ARGSUSED */
238 int
239 sys_execve(struct proc *p, void *v, register_t *retval)
240 {
241 	struct sys_execve_args /* {
242 		syscallarg(const char *) path;
243 		syscallarg(char *const *) argp;
244 		syscallarg(char *const *) envp;
245 	} */ *uap = v;
246 	int error;
247 	struct exec_package pack;
248 	struct nameidata nid;
249 	struct vattr attr;
250 	struct ucred *cred = p->p_ucred;
251 	char *argp;
252 	char * const *cpp, *dp, *sp;
253 	struct process *pr = p->p_p;
254 	long argc, envc;
255 	size_t len, sgap;
256 #ifdef MACHINE_STACK_GROWS_UP
257 	size_t slen;
258 #endif
259 	char *stack;
260 	struct ps_strings arginfo;
261 	struct vmspace *vm = p->p_vmspace;
262 	char **tmpfap;
263 	extern struct emul emul_native;
264 #if NSYSTRACE > 0
265 	int wassugid = ISSET(pr->ps_flags, PS_SUGID | PS_SUGIDEXEC);
266 	size_t pathbuflen;
267 #endif
268 	char *pathbuf = NULL;
269 
270 	/* get other threads to stop */
271 	if ((error = single_thread_set(p, SINGLE_UNWIND, 1)))
272 		return (error);
273 
274 	/*
275 	 * Cheap solution to complicated problems.
276 	 * Mark this process as "leave me alone, I'm execing".
277 	 */
278 	atomic_setbits_int(&pr->ps_flags, PS_INEXEC);
279 
280 #if NSYSTRACE > 0
281 	if (ISSET(p->p_flag, P_SYSTRACE)) {
282 		systrace_execve0(p);
283 		pathbuf = pool_get(&namei_pool, PR_WAITOK);
284 		error = copyinstr(SCARG(uap, path), pathbuf, MAXPATHLEN,
285 		    &pathbuflen);
286 		if (error != 0)
287 			goto clrflag;
288 	}
289 #endif
290 	if (pathbuf != NULL) {
291 		NDINIT(&nid, LOOKUP, NOFOLLOW, UIO_SYSSPACE, pathbuf, p);
292 	} else {
293 		NDINIT(&nid, LOOKUP, NOFOLLOW, UIO_USERSPACE,
294 		    SCARG(uap, path), p);
295 	}
296 
297 	/*
298 	 * initialize the fields of the exec package.
299 	 */
300 	if (pathbuf != NULL)
301 		pack.ep_name = pathbuf;
302 	else
303 		pack.ep_name = (char *)SCARG(uap, path);
304 	pack.ep_hdr = malloc(exec_maxhdrsz, M_EXEC, M_WAITOK);
305 	pack.ep_hdrlen = exec_maxhdrsz;
306 	pack.ep_hdrvalid = 0;
307 	pack.ep_ndp = &nid;
308 	pack.ep_interp = NULL;
309 	pack.ep_emul_arg = NULL;
310 	VMCMDSET_INIT(&pack.ep_vmcmds);
311 	pack.ep_vap = &attr;
312 	pack.ep_emul = &emul_native;
313 	pack.ep_flags = 0;
314 
315 	/* see if we can run it. */
316 	if ((error = check_exec(p, &pack)) != 0) {
317 		goto freehdr;
318 	}
319 
320 	/* XXX -- THE FOLLOWING SECTION NEEDS MAJOR CLEANUP */
321 
322 	/* allocate an argument buffer */
323 	argp = (char *) uvm_km_valloc_wait(exec_map, NCARGS);
324 #ifdef DIAGNOSTIC
325 	if (argp == NULL)
326 		panic("execve: argp == NULL");
327 #endif
328 	dp = argp;
329 	argc = 0;
330 
331 	/* copy the fake args list, if there's one, freeing it as we go */
332 	if (pack.ep_flags & EXEC_HASARGL) {
333 		tmpfap = pack.ep_fa;
334 		while (*tmpfap != NULL) {
335 			char *cp;
336 
337 			cp = *tmpfap;
338 			while (*cp)
339 				*dp++ = *cp++;
340 			*dp++ = '\0';
341 
342 			free(*tmpfap, M_EXEC);
343 			tmpfap++; argc++;
344 		}
345 		free(pack.ep_fa, M_EXEC);
346 		pack.ep_flags &= ~EXEC_HASARGL;
347 	}
348 
349 	/* Now get argv & environment */
350 	if (!(cpp = SCARG(uap, argp))) {
351 		error = EFAULT;
352 		goto bad;
353 	}
354 
355 	if (pack.ep_flags & EXEC_SKIPARG)
356 		cpp++;
357 
358 	while (1) {
359 		len = argp + ARG_MAX - dp;
360 		if ((error = copyin(cpp, &sp, sizeof(sp))) != 0)
361 			goto bad;
362 		if (!sp)
363 			break;
364 		if ((error = copyinstr(sp, dp, len, &len)) != 0) {
365 			if (error == ENAMETOOLONG)
366 				error = E2BIG;
367 			goto bad;
368 		}
369 		dp += len;
370 		cpp++;
371 		argc++;
372 	}
373 
374 	envc = 0;
375 	/* environment does not need to be there */
376 	if ((cpp = SCARG(uap, envp)) != NULL ) {
377 		while (1) {
378 			len = argp + ARG_MAX - dp;
379 			if ((error = copyin(cpp, &sp, sizeof(sp))) != 0)
380 				goto bad;
381 			if (!sp)
382 				break;
383 			if ((error = copyinstr(sp, dp, len, &len)) != 0) {
384 				if (error == ENAMETOOLONG)
385 					error = E2BIG;
386 				goto bad;
387 			}
388 			dp += len;
389 			cpp++;
390 			envc++;
391 		}
392 	}
393 
394 	dp = (char *)ALIGN(dp);
395 
396 	sgap = STACKGAPLEN;
397 	if (stackgap_random != 0)
398 		sgap += (arc4random() * ALIGNBYTES) & (stackgap_random - 1);
399 #ifdef MACHINE_STACK_GROWS_UP
400 	sgap = ALIGN(sgap);
401 #endif
402 	/* Now check if args & environ fit into new stack */
403 	len = ((argc + envc + 2 + pack.ep_emul->e_arglen) * sizeof(char *) +
404 	    sizeof(long) + dp + sgap + sizeof(struct ps_strings)) - argp;
405 
406 	len = ALIGN(len);	/* make the stack "safely" aligned */
407 
408 	if (len > pack.ep_ssize) { /* in effect, compare to initial limit */
409 		error = ENOMEM;
410 		goto bad;
411 	}
412 
413 	/* adjust "active stack depth" for process VSZ */
414 	pack.ep_ssize = len;	/* maybe should go elsewhere, but... */
415 
416 	/*
417 	 * we're committed: any further errors will kill the process, so
418 	 * kill the other threads now.
419 	 * XXX wait until threads are reaped to make uvmspace_exec() cheaper?
420 	 */
421 	single_thread_set(p, SINGLE_EXIT, 0);
422 
423 	/*
424 	 * Prepare vmspace for remapping. Note that uvmspace_exec can replace
425 	 * p_vmspace!
426 	 */
427 	uvmspace_exec(p, VM_MIN_ADDRESS, VM_MAXUSER_ADDRESS);
428 
429 	vm = p->p_vmspace;
430 	/* Now map address space */
431 	vm->vm_taddr = (char *)pack.ep_taddr;
432 	vm->vm_tsize = atop(round_page(pack.ep_tsize));
433 	vm->vm_daddr = (char *)pack.ep_daddr;
434 	vm->vm_dsize = atop(round_page(pack.ep_dsize));
435 	vm->vm_dused = 0;
436 	vm->vm_ssize = atop(round_page(pack.ep_ssize));
437 	vm->vm_maxsaddr = (char *)pack.ep_maxsaddr;
438 	vm->vm_minsaddr = (char *)pack.ep_minsaddr;
439 
440 	/* create the new process's VM space by running the vmcmds */
441 #ifdef DIAGNOSTIC
442 	if (pack.ep_vmcmds.evs_used == 0)
443 		panic("execve: no vmcmds");
444 #endif
445 	error = exec_process_vmcmds(p, &pack);
446 
447 	/* if an error happened, deallocate and punt */
448 	if (error)
449 		goto exec_abort;
450 
451 	/* remember information about the process */
452 	arginfo.ps_nargvstr = argc;
453 	arginfo.ps_nenvstr = envc;
454 
455 #ifdef MACHINE_STACK_GROWS_UP
456 	stack = (char *)USRSTACK + sizeof(arginfo) + sgap;
457 	slen = len - sizeof(arginfo) - sgap;
458 #else
459 	stack = (char *)(USRSTACK - len);
460 #endif
461 	/* Now copy argc, args & environ to new stack */
462 	if (!(*pack.ep_emul->e_copyargs)(&pack, &arginfo, stack, argp))
463 		goto exec_abort;
464 
465 	/* copy out the process's ps_strings structure */
466 	if (copyout(&arginfo, (char *)PS_STRINGS, sizeof(arginfo)))
467 		goto exec_abort;
468 
469 	stopprofclock(pr);	/* stop profiling */
470 	fdcloseexec(p);		/* handle close on exec */
471 	execsigs(p);		/* reset caught signals */
472 	TCB_SET(p, NULL);	/* reset the TCB address */
473 
474 	/* set command name & other accounting info */
475 	bzero(p->p_comm, sizeof(p->p_comm));
476 	len = min(nid.ni_cnd.cn_namelen, MAXCOMLEN);
477 	bcopy(nid.ni_cnd.cn_nameptr, p->p_comm, len);
478 	pr->ps_acflag &= ~AFORK;
479 
480 	/* record proc's vnode, for use by procfs and others */
481 	if (p->p_textvp)
482 		vrele(p->p_textvp);
483 	vref(pack.ep_vp);
484 	p->p_textvp = pack.ep_vp;
485 
486 	atomic_setbits_int(&pr->ps_flags, PS_EXEC);
487 	if (pr->ps_flags & PS_PPWAIT) {
488 		atomic_clearbits_int(&pr->ps_flags, PS_PPWAIT);
489 		atomic_clearbits_int(&pr->ps_pptr->ps_flags, PS_ISPWAIT);
490 		wakeup(pr->ps_pptr);
491 	}
492 
493 	/*
494 	 * If process does execve() while it has a mismatched real,
495 	 * effective, or saved uid/gid, we set PS_SUGIDEXEC.
496 	 */
497 	if (p->p_ucred->cr_uid != p->p_cred->p_ruid ||
498 	    p->p_ucred->cr_uid != p->p_cred->p_svuid ||
499 	    p->p_ucred->cr_gid != p->p_cred->p_rgid ||
500 	    p->p_ucred->cr_gid != p->p_cred->p_svgid)
501 		atomic_setbits_int(&pr->ps_flags, PS_SUGIDEXEC);
502 	else
503 		atomic_clearbits_int(&pr->ps_flags, PS_SUGIDEXEC);
504 
505 	/*
506 	 * deal with set[ug]id.
507 	 * MNT_NOEXEC has already been used to disable s[ug]id.
508 	 */
509 	if ((attr.va_mode & (VSUID | VSGID)) && proc_cansugid(p)) {
510 		int i;
511 
512 		atomic_setbits_int(&pr->ps_flags, PS_SUGID|PS_SUGIDEXEC);
513 
514 #ifdef KTRACE
515 		/*
516 		 * If process is being ktraced, turn off - unless
517 		 * root set it.
518 		 */
519 		if (pr->ps_tracevp && !(pr->ps_traceflag & KTRFAC_ROOT))
520 			ktrcleartrace(pr);
521 #endif
522 		p->p_ucred = crcopy(cred);
523 		if (attr.va_mode & VSUID)
524 			p->p_ucred->cr_uid = attr.va_uid;
525 		if (attr.va_mode & VSGID)
526 			p->p_ucred->cr_gid = attr.va_gid;
527 
528 		/*
529 		 * For set[ug]id processes, a few caveats apply to
530 		 * stdin, stdout, and stderr.
531 		 */
532 		error = 0;
533 		fdplock(p->p_fd);
534 		for (i = 0; i < 3; i++) {
535 			struct file *fp = NULL;
536 
537 			/*
538 			 * NOTE - This will never return NULL because of
539 			 * immature fds. The file descriptor table is not
540 			 * shared because we're suid.
541 			 */
542 			fp = fd_getfile(p->p_fd, i);
543 #ifdef PROCFS
544 			/*
545 			 * Close descriptors that are writing to procfs.
546 			 */
547 			if (fp && fp->f_type == DTYPE_VNODE &&
548 			    ((struct vnode *)(fp->f_data))->v_tag == VT_PROCFS &&
549 			    (fp->f_flag & FWRITE)) {
550 				fdrelease(p, i);
551 				fp = NULL;
552 			}
553 #endif
554 
555 			/*
556 			 * Ensure that stdin, stdout, and stderr are already
557 			 * allocated.  We do not want userland to accidentally
558 			 * allocate descriptors in this range which has implied
559 			 * meaning to libc.
560 			 */
561 			if (fp == NULL) {
562 				short flags = FREAD | (i == 0 ? 0 : FWRITE);
563 				struct vnode *vp;
564 				int indx;
565 
566 				if ((error = falloc(p, &fp, &indx)) != 0)
567 					break;
568 #ifdef DIAGNOSTIC
569 				if (indx != i)
570 					panic("sys_execve: falloc indx != i");
571 #endif
572 				if ((error = cdevvp(getnulldev(), &vp)) != 0) {
573 					fdremove(p->p_fd, indx);
574 					closef(fp, p);
575 					break;
576 				}
577 				if ((error = VOP_OPEN(vp, flags, p->p_ucred, p)) != 0) {
578 					fdremove(p->p_fd, indx);
579 					closef(fp, p);
580 					vrele(vp);
581 					break;
582 				}
583 				if (flags & FWRITE)
584 					vp->v_writecount++;
585 				fp->f_flag = flags;
586 				fp->f_type = DTYPE_VNODE;
587 				fp->f_ops = &vnops;
588 				fp->f_data = (caddr_t)vp;
589 				FILE_SET_MATURE(fp, p);
590 			}
591 		}
592 		fdpunlock(p->p_fd);
593 		if (error)
594 			goto exec_abort;
595 	} else
596 		atomic_clearbits_int(&pr->ps_flags, PS_SUGID);
597 	p->p_cred->p_svuid = p->p_ucred->cr_uid;
598 	p->p_cred->p_svgid = p->p_ucred->cr_gid;
599 
600 	if (pr->ps_flags & PS_SUGIDEXEC) {
601 		int i, s = splclock();
602 
603 		timeout_del(&pr->ps_realit_to);
604 		for (i = 0; i < nitems(pr->ps_timer); i++) {
605 			timerclear(&pr->ps_timer[i].it_interval);
606 			timerclear(&pr->ps_timer[i].it_value);
607 		}
608 		splx(s);
609 	}
610 
611 	uvm_km_free_wakeup(exec_map, (vaddr_t) argp, NCARGS);
612 
613 	pool_put(&namei_pool, nid.ni_cnd.cn_pnbuf);
614 	vn_close(pack.ep_vp, FREAD, cred, p);
615 
616 	/*
617 	 * notify others that we exec'd
618 	 */
619 	KNOTE(&pr->ps_klist, NOTE_EXEC);
620 
621 	/* setup new registers and do misc. setup. */
622 	if (pack.ep_emul->e_fixup != NULL) {
623 		if ((*pack.ep_emul->e_fixup)(p, &pack) != 0)
624 			goto free_pack_abort;
625 	}
626 #ifdef MACHINE_STACK_GROWS_UP
627 	(*pack.ep_emul->e_setregs)(p, &pack, (u_long)stack + slen, retval);
628 #else
629 	(*pack.ep_emul->e_setregs)(p, &pack, (u_long)stack, retval);
630 #endif
631 
632 	/* map the process's signal trampoline code */
633 	if (exec_sigcode_map(p, pack.ep_emul))
634 		goto free_pack_abort;
635 
636 #ifdef __HAVE_EXEC_MD_MAP
637 	/* perform md specific mappings that process might need */
638 	if (exec_md_map(p, &pack))
639 		goto free_pack_abort;
640 #endif
641 
642 	if (pr->ps_flags & PS_TRACED)
643 		psignal(p, SIGTRAP);
644 
645 	free(pack.ep_hdr, M_EXEC);
646 
647 	/*
648 	 * Call emulation specific exec hook. This can setup per-process
649 	 * p->p_emuldata or do any other per-process stuff an emulation needs.
650 	 *
651 	 * If we are executing process of different emulation than the
652 	 * original forked process, call e_proc_exit() of the old emulation
653 	 * first, then e_proc_exec() of new emulation. If the emulation is
654 	 * same, the exec hook code should deallocate any old emulation
655 	 * resources held previously by this process.
656 	 */
657 	if (p->p_emul && p->p_emul->e_proc_exit &&
658 	    p->p_emul != pack.ep_emul)
659 		(*p->p_emul->e_proc_exit)(p);
660 
661 	p->p_descfd = 255;
662 	if ((pack.ep_flags & EXEC_HASFD) && pack.ep_fd < 255)
663 		p->p_descfd = pack.ep_fd;
664 
665 	/*
666 	 * Call exec hook. Emulation code may NOT store reference to anything
667 	 * from &pack.
668 	 */
669 	if (pack.ep_emul->e_proc_exec)
670 		(*pack.ep_emul->e_proc_exec)(p, &pack);
671 
672 	/* update p_emul, the old value is no longer needed */
673 	p->p_emul = pack.ep_emul;
674 
675 #ifdef KTRACE
676 	if (KTRPOINT(p, KTR_EMUL))
677 		ktremul(p, p->p_emul->e_name);
678 #endif
679 
680 	atomic_clearbits_int(&pr->ps_flags, PS_INEXEC);
681 	single_thread_clear(p, P_SUSPSIG);
682 
683 #if NSYSTRACE > 0
684 	if (ISSET(p->p_flag, P_SYSTRACE) &&
685 	    wassugid && !ISSET(pr->ps_flags, PS_SUGID | PS_SUGIDEXEC))
686 		systrace_execve1(pathbuf, p);
687 #endif
688 
689 	if (pathbuf != NULL)
690 		pool_put(&namei_pool, pathbuf);
691 
692 	return (0);
693 
694 bad:
695 	/* free the vmspace-creation commands, and release their references */
696 	kill_vmcmds(&pack.ep_vmcmds);
697 	/* kill any opened file descriptor, if necessary */
698 	if (pack.ep_flags & EXEC_HASFD) {
699 		pack.ep_flags &= ~EXEC_HASFD;
700 		fdplock(p->p_fd);
701 		(void) fdrelease(p, pack.ep_fd);
702 		fdpunlock(p->p_fd);
703 	}
704 	if (pack.ep_interp != NULL)
705 		pool_put(&namei_pool, pack.ep_interp);
706 	if (pack.ep_emul_arg != NULL)
707 		free(pack.ep_emul_arg, M_TEMP);
708 	/* close and put the exec'd file */
709 	vn_close(pack.ep_vp, FREAD, cred, p);
710 	pool_put(&namei_pool, nid.ni_cnd.cn_pnbuf);
711 	uvm_km_free_wakeup(exec_map, (vaddr_t) argp, NCARGS);
712 
713  freehdr:
714 	free(pack.ep_hdr, M_EXEC);
715 #if NSYSTRACE > 0
716  clrflag:
717 #endif
718 	atomic_clearbits_int(&pr->ps_flags, PS_INEXEC);
719 	single_thread_clear(p, P_SUSPSIG);
720 
721 	if (pathbuf != NULL)
722 		pool_put(&namei_pool, pathbuf);
723 
724 	return (error);
725 
726 exec_abort:
727 	/*
728 	 * the old process doesn't exist anymore.  exit gracefully.
729 	 * get rid of the (new) address space we have created, if any, get rid
730 	 * of our namei data and vnode, and exit noting failure
731 	 */
732 	uvm_deallocate(&vm->vm_map, VM_MIN_ADDRESS,
733 		VM_MAXUSER_ADDRESS - VM_MIN_ADDRESS);
734 	if (pack.ep_interp != NULL)
735 		pool_put(&namei_pool, pack.ep_interp);
736 	if (pack.ep_emul_arg != NULL)
737 		free(pack.ep_emul_arg, M_TEMP);
738 	pool_put(&namei_pool, nid.ni_cnd.cn_pnbuf);
739 	vn_close(pack.ep_vp, FREAD, cred, p);
740 	uvm_km_free_wakeup(exec_map, (vaddr_t) argp, NCARGS);
741 
742 free_pack_abort:
743 	free(pack.ep_hdr, M_EXEC);
744 	exit1(p, W_EXITCODE(0, SIGABRT), EXIT_NORMAL);
745 
746 	/* NOTREACHED */
747 	atomic_clearbits_int(&pr->ps_flags, PS_INEXEC);
748 	if (pathbuf != NULL)
749 		pool_put(&namei_pool, pathbuf);
750 
751 	return (0);
752 }
753 
754 
755 void *
756 copyargs(struct exec_package *pack, struct ps_strings *arginfo, void *stack,
757     void *argp)
758 {
759 	char **cpp = stack;
760 	char *dp, *sp;
761 	size_t len;
762 	void *nullp = NULL;
763 	long argc = arginfo->ps_nargvstr;
764 	int envc = arginfo->ps_nenvstr;
765 
766 	if (copyout(&argc, cpp++, sizeof(argc)))
767 		return (NULL);
768 
769 	dp = (char *) (cpp + argc + envc + 2 + pack->ep_emul->e_arglen);
770 	sp = argp;
771 
772 	/* XXX don't copy them out, remap them! */
773 	arginfo->ps_argvstr = cpp; /* remember location of argv for later */
774 
775 	for (; --argc >= 0; sp += len, dp += len)
776 		if (copyout(&dp, cpp++, sizeof(dp)) ||
777 		    copyoutstr(sp, dp, ARG_MAX, &len))
778 			return (NULL);
779 
780 	if (copyout(&nullp, cpp++, sizeof(nullp)))
781 		return (NULL);
782 
783 	arginfo->ps_envstr = cpp; /* remember location of envp for later */
784 
785 	for (; --envc >= 0; sp += len, dp += len)
786 		if (copyout(&dp, cpp++, sizeof(dp)) ||
787 		    copyoutstr(sp, dp, ARG_MAX, &len))
788 			return (NULL);
789 
790 	if (copyout(&nullp, cpp++, sizeof(nullp)))
791 		return (NULL);
792 
793 	return (cpp);
794 }
795 
796 int
797 exec_sigcode_map(struct proc *p, struct emul *e)
798 {
799 	vsize_t sz;
800 
801 	sz = (vaddr_t)e->e_esigcode - (vaddr_t)e->e_sigcode;
802 
803 	/*
804 	 * If we don't have a sigobject for this emulation, create one.
805 	 *
806 	 * sigobject is an anonymous memory object (just like SYSV shared
807 	 * memory) that we keep a permanent reference to and that we map
808 	 * in all processes that need this sigcode. The creation is simple,
809 	 * we create an object, add a permanent reference to it, map it in
810 	 * kernel space, copy out the sigcode to it and unmap it.
811 	 * Then we map it with PROT_READ|PROT_EXEC into the process just
812 	 * the way sys_mmap would map it.
813 	 */
814 	if (e->e_sigobject == NULL) {
815 		vaddr_t va;
816 		int r;
817 
818 		e->e_sigobject = uao_create(sz, 0);
819 		uao_reference(e->e_sigobject);	/* permanent reference */
820 
821 		if ((r = uvm_map(kernel_map, &va, round_page(sz), e->e_sigobject,
822 		    0, 0, UVM_MAPFLAG(UVM_PROT_RW, UVM_PROT_RW,
823 		    UVM_INH_SHARE, UVM_ADV_RANDOM, 0)))) {
824 			uao_detach(e->e_sigobject);
825 			return (ENOMEM);
826 		}
827 		memcpy((void *)va, e->e_sigcode, sz);
828 		uvm_unmap(kernel_map, va, va + round_page(sz));
829 	}
830 
831 	p->p_sigcode = 0; /* no hint */
832 	uao_reference(e->e_sigobject);
833 	if (uvm_map(&p->p_vmspace->vm_map, &p->p_sigcode, round_page(sz),
834 	    e->e_sigobject, 0, 0, UVM_MAPFLAG(UVM_PROT_RX, UVM_PROT_RX,
835 	    UVM_INH_SHARE, UVM_ADV_RANDOM, 0))) {
836 		uao_detach(e->e_sigobject);
837 		return (ENOMEM);
838 	}
839 
840 	return (0);
841 }
842