xref: /freebsd/sys/kern/kern_exec.c (revision 1762f674ccb571e6b03c009906dd1af3c6343f9b)
19454b2d8SWarner Losh /*-
28a36da99SPedro F. Giffuni  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
38a36da99SPedro F. Giffuni  *
426f9a767SRodney W. Grimes  * Copyright (c) 1993, David Greenman
526f9a767SRodney W. Grimes  * All rights reserved.
6df8bae1dSRodney W. Grimes  *
7df8bae1dSRodney W. Grimes  * Redistribution and use in source and binary forms, with or without
8df8bae1dSRodney W. Grimes  * modification, are permitted provided that the following conditions
9df8bae1dSRodney W. Grimes  * are met:
10df8bae1dSRodney W. Grimes  * 1. Redistributions of source code must retain the above copyright
11df8bae1dSRodney W. Grimes  *    notice, this list of conditions and the following disclaimer.
12df8bae1dSRodney W. Grimes  * 2. Redistributions in binary form must reproduce the above copyright
13df8bae1dSRodney W. Grimes  *    notice, this list of conditions and the following disclaimer in the
14df8bae1dSRodney W. Grimes  *    documentation and/or other materials provided with the distribution.
15df8bae1dSRodney W. Grimes  *
1626f9a767SRodney W. Grimes  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17df8bae1dSRodney W. Grimes  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18df8bae1dSRodney W. Grimes  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
1926f9a767SRodney W. Grimes  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20df8bae1dSRodney W. Grimes  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21df8bae1dSRodney W. Grimes  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22df8bae1dSRodney W. Grimes  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23df8bae1dSRodney W. Grimes  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24df8bae1dSRodney W. Grimes  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25df8bae1dSRodney W. Grimes  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26df8bae1dSRodney W. Grimes  * SUCH DAMAGE.
27df8bae1dSRodney W. Grimes  */
28df8bae1dSRodney W. Grimes 
29677b542eSDavid E. O'Brien #include <sys/cdefs.h>
30677b542eSDavid E. O'Brien __FBSDID("$FreeBSD$");
31677b542eSDavid E. O'Brien 
3212bc222eSJonathan Anderson #include "opt_capsicum.h"
334da0d332SPeter Wemm #include "opt_hwpmc_hooks.h"
341e9b3d91SPeter Wemm #include "opt_ktrace.h"
35f8a47341SAlan Cox #include "opt_vm.h"
361e9b3d91SPeter Wemm 
37df8bae1dSRodney W. Grimes #include <sys/param.h>
3826f9a767SRodney W. Grimes #include <sys/systm.h>
3926f9a767SRodney W. Grimes #include <sys/acct.h>
40f1c3adefSMark Johnston #include <sys/asan.h>
41eeeaa7baSMark Johnston #include <sys/capsicum.h>
4233621dfcSEdward Tomasz Napierala #include <sys/compressor.h>
43eeeaa7baSMark Johnston #include <sys/eventhandler.h>
4426f9a767SRodney W. Grimes #include <sys/exec.h>
45eeeaa7baSMark Johnston #include <sys/fcntl.h>
46eeeaa7baSMark Johnston #include <sys/filedesc.h>
4726f9a767SRodney W. Grimes #include <sys/imgact.h>
48e1743d02SSøren Schmidt #include <sys/imgact_elf.h>
49eeeaa7baSMark Johnston #include <sys/kernel.h>
50eeeaa7baSMark Johnston #include <sys/lock.h>
51333ea485SGuido van Rooij #include <sys/malloc.h>
52ec492b13SMark Johnston #include <sys/mman.h>
53eeeaa7baSMark Johnston #include <sys/mount.h>
54eeeaa7baSMark Johnston #include <sys/mutex.h>
55eeeaa7baSMark Johnston #include <sys/namei.h>
56acd3428bSRobert Watson #include <sys/priv.h>
57a794e791SBruce Evans #include <sys/proc.h>
588d570f64SJohn Baldwin #include <sys/ptrace.h>
596004362eSDavid Schultz #include <sys/resourcevar.h>
6089f6b863SAttilio Rao #include <sys/rwlock.h>
6144ad5475SJohn Baldwin #include <sys/sched.h>
625d217f17SJohn Birrell #include <sys/sdt.h>
6359c8bc40SAlan Cox #include <sys/sf_buf.h>
64797f2d22SPoul-Henning Kamp #include <sys/shm.h>
65eeeaa7baSMark Johnston #include <sys/signalvar.h>
66ec492b13SMark Johnston #include <sys/smp.h>
67dfa7fd1dSEdward Tomasz Napierala #include <sys/stat.h>
68eeeaa7baSMark Johnston #include <sys/syscallsubr.h>
69eeeaa7baSMark Johnston #include <sys/sysctl.h>
70eeeaa7baSMark Johnston #include <sys/sysent.h>
71eeeaa7baSMark Johnston #include <sys/sysproto.h>
72e68c6191SKonstantin Belousov #include <sys/timers.h>
7374a093ebSKonstantin Belousov #include <sys/umtx.h>
74eeeaa7baSMark Johnston #include <sys/vnode.h>
75eeeaa7baSMark Johnston #include <sys/wait.h>
76c781aea8SPeter Wemm #ifdef KTRACE
77c781aea8SPeter Wemm #include <sys/ktrace.h>
78c781aea8SPeter Wemm #endif
7926f9a767SRodney W. Grimes 
8026f9a767SRodney W. Grimes #include <vm/vm.h>
81efeaf95aSDavid Greenman #include <vm/vm_param.h>
82efeaf95aSDavid Greenman #include <vm/pmap.h>
831616db3cSJohn Dyson #include <vm/vm_page.h>
84efeaf95aSDavid Greenman #include <vm/vm_map.h>
8526f9a767SRodney W. Grimes #include <vm/vm_kern.h>
86efeaf95aSDavid Greenman #include <vm/vm_extern.h>
871ebd0c59SDavid Greenman #include <vm/vm_object.h>
881616db3cSJohn Dyson #include <vm/vm_pager.h>
8926f9a767SRodney W. Grimes 
90ebccf1e3SJoseph Koshy #ifdef	HWPMC_HOOKS
91ebccf1e3SJoseph Koshy #include <sys/pmckern.h>
92ebccf1e3SJoseph Koshy #endif
93ebccf1e3SJoseph Koshy 
9426f9a767SRodney W. Grimes #include <machine/reg.h>
9526f9a767SRodney W. Grimes 
96ae1078d6SWayne Salamon #include <security/audit/audit.h>
97aed55708SRobert Watson #include <security/mac/mac_framework.h>
98ae1078d6SWayne Salamon 
995d217f17SJohn Birrell #ifdef KDTRACE_HOOKS
1005d217f17SJohn Birrell #include <sys/dtrace_bsd.h>
1015d217f17SJohn Birrell dtrace_execexit_func_t	dtrace_fasttrap_exec;
1025d217f17SJohn Birrell #endif
1035d217f17SJohn Birrell 
1045d217f17SJohn Birrell SDT_PROVIDER_DECLARE(proc);
10536160958SMark Johnston SDT_PROBE_DEFINE1(proc, , , exec, "char *");
10636160958SMark Johnston SDT_PROBE_DEFINE1(proc, , , exec__failure, "int");
10736160958SMark Johnston SDT_PROBE_DEFINE1(proc, , , exec__success, "char *");
1085d217f17SJohn Birrell 
109b9df5231SPoul-Henning Kamp MALLOC_DEFINE(M_PARGS, "proc-args", "Process arguments");
110b9df5231SPoul-Henning Kamp 
111bcb60d52SConrad Meyer int coredump_pack_fileinfo = 1;
112bcb60d52SConrad Meyer SYSCTL_INT(_kern, OID_AUTO, coredump_pack_fileinfo, CTLFLAG_RWTUN,
113bcb60d52SConrad Meyer     &coredump_pack_fileinfo, 0,
114bcb60d52SConrad Meyer     "Enable file path packing in 'procstat -f' coredump notes");
115bcb60d52SConrad Meyer 
116e6b95927SConrad Meyer int coredump_pack_vmmapinfo = 1;
117e6b95927SConrad Meyer SYSCTL_INT(_kern, OID_AUTO, coredump_pack_vmmapinfo, CTLFLAG_RWTUN,
118e6b95927SConrad Meyer     &coredump_pack_vmmapinfo, 0,
119e6b95927SConrad Meyer     "Enable file path packing in 'procstat -v' coredump notes");
120e6b95927SConrad Meyer 
12105ba50f5SJake Burkholder static int sysctl_kern_ps_strings(SYSCTL_HANDLER_ARGS);
12205ba50f5SJake Burkholder static int sysctl_kern_usrstack(SYSCTL_HANDLER_ARGS);
1235dadd17bSJake Burkholder static int sysctl_kern_stackprot(SYSCTL_HANDLER_ARGS);
124610ecfe0SMaxim Sobolev static int do_execve(struct thread *td, struct image_args *args,
125aaf78c16SKonstantin Belousov     struct mac *mac_p, struct vmspace *oldvmspace);
12605ba50f5SJake Burkholder 
1279701cd40SJohn Baldwin /* XXX This should be vm_size_t. */
12853dc58f2SMateusz Guzik SYSCTL_PROC(_kern, KERN_PS_STRINGS, ps_strings, CTLTYPE_ULONG|CTLFLAG_RD|
129b05ca429SPawel Biernacki     CTLFLAG_CAPRD|CTLFLAG_MPSAFE, NULL, 0, sysctl_kern_ps_strings, "LU",
130b05ca429SPawel Biernacki     "Location of process' ps_strings structure");
131486bddb0SDoug Rabson 
1329701cd40SJohn Baldwin /* XXX This should be vm_size_t. */
133ff66f6a4SRobert Watson SYSCTL_PROC(_kern, KERN_USRSTACK, usrstack, CTLTYPE_ULONG|CTLFLAG_RD|
134b05ca429SPawel Biernacki     CTLFLAG_CAPRD|CTLFLAG_MPSAFE, NULL, 0, sysctl_kern_usrstack, "LU",
135b05ca429SPawel Biernacki     "Top of process stack");
13699ac3bc8SPeter Wemm 
13753dc58f2SMateusz Guzik SYSCTL_PROC(_kern, OID_AUTO, stackprot, CTLTYPE_INT|CTLFLAG_RD|CTLFLAG_MPSAFE,
138b05ca429SPawel Biernacki     NULL, 0, sysctl_kern_stackprot, "I",
139b05ca429SPawel Biernacki     "Stack memory permissions");
1405dadd17bSJake Burkholder 
141b9df5231SPoul-Henning Kamp u_long ps_arg_cache_limit = PAGE_SIZE / 16;
142c3699b5fSPeter Wemm SYSCTL_ULONG(_kern, OID_AUTO, ps_arg_cache_limit, CTLFLAG_RW,
143b05ca429SPawel Biernacki     &ps_arg_cache_limit, 0,
144b05ca429SPawel Biernacki     "Process' command line characters cache limit");
145b9df5231SPoul-Henning Kamp 
146eda6009cSKonstantin Belousov static int disallow_high_osrel;
147eda6009cSKonstantin Belousov SYSCTL_INT(_kern, OID_AUTO, disallow_high_osrel, CTLFLAG_RW,
148eda6009cSKonstantin Belousov     &disallow_high_osrel, 0,
149eda6009cSKonstantin Belousov     "Disallow execution of binaries built for higher version of the world");
150eda6009cSKonstantin Belousov 
151878adb85SBjoern A. Zeeb static int map_at_zero = 0;
152af3b2549SHans Petter Selasky SYSCTL_INT(_security_bsd, OID_AUTO, map_at_zero, CTLFLAG_RWTUN, &map_at_zero, 0,
153878adb85SBjoern A. Zeeb     "Permit processes to map an object at virtual address 0.");
154878adb85SBjoern A. Zeeb 
15505ba50f5SJake Burkholder static int
15605ba50f5SJake Burkholder sysctl_kern_ps_strings(SYSCTL_HANDLER_ARGS)
15705ba50f5SJake Burkholder {
15805ba50f5SJake Burkholder 	struct proc *p;
159df7c361eSPeter Wemm 	int error;
16005ba50f5SJake Burkholder 
16105ba50f5SJake Burkholder 	p = curproc;
162a7bc3102SPeter Wemm #ifdef SCTL_MASK32
163a7bc3102SPeter Wemm 	if (req->flags & SCTL_MASK32) {
164df7c361eSPeter Wemm 		unsigned int val;
165df7c361eSPeter Wemm 		val = (unsigned int)p->p_sysent->sv_psstrings;
166df7c361eSPeter Wemm 		error = SYSCTL_OUT(req, &val, sizeof(val));
167df7c361eSPeter Wemm 	} else
168df7c361eSPeter Wemm #endif
169df7c361eSPeter Wemm 		error = SYSCTL_OUT(req, &p->p_sysent->sv_psstrings,
170df7c361eSPeter Wemm 		   sizeof(p->p_sysent->sv_psstrings));
171df7c361eSPeter Wemm 	return error;
17205ba50f5SJake Burkholder }
17305ba50f5SJake Burkholder 
17405ba50f5SJake Burkholder static int
17505ba50f5SJake Burkholder sysctl_kern_usrstack(SYSCTL_HANDLER_ARGS)
17605ba50f5SJake Burkholder {
17705ba50f5SJake Burkholder 	struct proc *p;
178df7c361eSPeter Wemm 	int error;
17905ba50f5SJake Burkholder 
18005ba50f5SJake Burkholder 	p = curproc;
181a7bc3102SPeter Wemm #ifdef SCTL_MASK32
182a7bc3102SPeter Wemm 	if (req->flags & SCTL_MASK32) {
183df7c361eSPeter Wemm 		unsigned int val;
184df7c361eSPeter Wemm 		val = (unsigned int)p->p_sysent->sv_usrstack;
185df7c361eSPeter Wemm 		error = SYSCTL_OUT(req, &val, sizeof(val));
186df7c361eSPeter Wemm 	} else
187df7c361eSPeter Wemm #endif
188df7c361eSPeter Wemm 		error = SYSCTL_OUT(req, &p->p_sysent->sv_usrstack,
189df7c361eSPeter Wemm 		    sizeof(p->p_sysent->sv_usrstack));
190df7c361eSPeter Wemm 	return error;
19105ba50f5SJake Burkholder }
19205ba50f5SJake Burkholder 
1935dadd17bSJake Burkholder static int
1945dadd17bSJake Burkholder sysctl_kern_stackprot(SYSCTL_HANDLER_ARGS)
1955dadd17bSJake Burkholder {
1965dadd17bSJake Burkholder 	struct proc *p;
1975dadd17bSJake Burkholder 
1985dadd17bSJake Burkholder 	p = curproc;
1995dadd17bSJake Burkholder 	return (SYSCTL_OUT(req, &p->p_sysent->sv_stackprot,
2005dadd17bSJake Burkholder 	    sizeof(p->p_sysent->sv_stackprot)));
2015dadd17bSJake Burkholder }
2025dadd17bSJake Burkholder 
20399ac3bc8SPeter Wemm /*
204aa855a59SPeter Wemm  * Each of the items is a pointer to a `const struct execsw', hence the
205aa855a59SPeter Wemm  * double pointer here.
206df8bae1dSRodney W. Grimes  */
207aa855a59SPeter Wemm static const struct execsw **execsw;
20826f9a767SRodney W. Grimes 
209ca46e90eSBruce Evans #ifndef _SYS_SYSPROTO_H_
210ca46e90eSBruce Evans struct execve_args {
211ca46e90eSBruce Evans 	char    *fname;
212ca46e90eSBruce Evans 	char    **argv;
213ca46e90eSBruce Evans 	char    **envv;
214ca46e90eSBruce Evans };
215ca46e90eSBruce Evans #endif
216ca46e90eSBruce Evans 
217ca46e90eSBruce Evans int
2187b445033SKonstantin Belousov sys_execve(struct thread *td, struct execve_args *uap)
219ca46e90eSBruce Evans {
220610ecfe0SMaxim Sobolev 	struct image_args args;
2217b445033SKonstantin Belousov 	struct vmspace *oldvmspace;
2227b445033SKonstantin Belousov 	int error;
223ca46e90eSBruce Evans 
2247b445033SKonstantin Belousov 	error = pre_execve(td, &oldvmspace);
2257b445033SKonstantin Belousov 	if (error != 0)
2267b445033SKonstantin Belousov 		return (error);
227610ecfe0SMaxim Sobolev 	error = exec_copyin_args(&args, uap->fname, UIO_USERSPACE,
228610ecfe0SMaxim Sobolev 	    uap->argv, uap->envv);
229610ecfe0SMaxim Sobolev 	if (error == 0)
230aaf78c16SKonstantin Belousov 		error = kern_execve(td, &args, NULL, oldvmspace);
2317b445033SKonstantin Belousov 	post_execve(td, error, oldvmspace);
232275c821dSKyle Evans 	AUDIT_SYSCALL_EXIT(error == EJUSTRETURN ? 0 : error, td);
233610ecfe0SMaxim Sobolev 	return (error);
234ca46e90eSBruce Evans }
235ca46e90eSBruce Evans 
236ca46e90eSBruce Evans #ifndef _SYS_SYSPROTO_H_
237632dbc19SKonstantin Belousov struct fexecve_args {
238632dbc19SKonstantin Belousov 	int	fd;
239632dbc19SKonstantin Belousov 	char	**argv;
240632dbc19SKonstantin Belousov 	char	**envv;
241698dda67SConrad Meyer };
242632dbc19SKonstantin Belousov #endif
243632dbc19SKonstantin Belousov int
2448451d0ddSKip Macy sys_fexecve(struct thread *td, struct fexecve_args *uap)
245632dbc19SKonstantin Belousov {
246632dbc19SKonstantin Belousov 	struct image_args args;
2477b445033SKonstantin Belousov 	struct vmspace *oldvmspace;
2487b445033SKonstantin Belousov 	int error;
249632dbc19SKonstantin Belousov 
2507b445033SKonstantin Belousov 	error = pre_execve(td, &oldvmspace);
2517b445033SKonstantin Belousov 	if (error != 0)
2527b445033SKonstantin Belousov 		return (error);
253632dbc19SKonstantin Belousov 	error = exec_copyin_args(&args, NULL, UIO_SYSSPACE,
254632dbc19SKonstantin Belousov 	    uap->argv, uap->envv);
255632dbc19SKonstantin Belousov 	if (error == 0) {
256632dbc19SKonstantin Belousov 		args.fd = uap->fd;
257aaf78c16SKonstantin Belousov 		error = kern_execve(td, &args, NULL, oldvmspace);
258632dbc19SKonstantin Belousov 	}
2597b445033SKonstantin Belousov 	post_execve(td, error, oldvmspace);
260275c821dSKyle Evans 	AUDIT_SYSCALL_EXIT(error == EJUSTRETURN ? 0 : error, td);
261632dbc19SKonstantin Belousov 	return (error);
262632dbc19SKonstantin Belousov }
263632dbc19SKonstantin Belousov 
264632dbc19SKonstantin Belousov #ifndef _SYS_SYSPROTO_H_
265ca46e90eSBruce Evans struct __mac_execve_args {
266ca46e90eSBruce Evans 	char	*fname;
267ca46e90eSBruce Evans 	char	**argv;
268ca46e90eSBruce Evans 	char	**envv;
269ca46e90eSBruce Evans 	struct mac	*mac_p;
270ca46e90eSBruce Evans };
271ca46e90eSBruce Evans #endif
272ca46e90eSBruce Evans 
273ca46e90eSBruce Evans int
2747b445033SKonstantin Belousov sys___mac_execve(struct thread *td, struct __mac_execve_args *uap)
275ca46e90eSBruce Evans {
276ca46e90eSBruce Evans #ifdef MAC
277610ecfe0SMaxim Sobolev 	struct image_args args;
2787b445033SKonstantin Belousov 	struct vmspace *oldvmspace;
2797b445033SKonstantin Belousov 	int error;
280610ecfe0SMaxim Sobolev 
2817b445033SKonstantin Belousov 	error = pre_execve(td, &oldvmspace);
2827b445033SKonstantin Belousov 	if (error != 0)
2837b445033SKonstantin Belousov 		return (error);
284610ecfe0SMaxim Sobolev 	error = exec_copyin_args(&args, uap->fname, UIO_USERSPACE,
285610ecfe0SMaxim Sobolev 	    uap->argv, uap->envv);
286610ecfe0SMaxim Sobolev 	if (error == 0)
287aaf78c16SKonstantin Belousov 		error = kern_execve(td, &args, uap->mac_p, oldvmspace);
2887b445033SKonstantin Belousov 	post_execve(td, error, oldvmspace);
289275c821dSKyle Evans 	AUDIT_SYSCALL_EXIT(error == EJUSTRETURN ? 0 : error, td);
290610ecfe0SMaxim Sobolev 	return (error);
291ca46e90eSBruce Evans #else
292ca46e90eSBruce Evans 	return (ENOSYS);
293ca46e90eSBruce Evans #endif
294ca46e90eSBruce Evans }
295ca46e90eSBruce Evans 
29684e0b075SDavid Xu int
2977b445033SKonstantin Belousov pre_execve(struct thread *td, struct vmspace **oldvmspace)
298906ac69dSDavid Xu {
2997b445033SKonstantin Belousov 	struct proc *p;
300906ac69dSDavid Xu 	int error;
301906ac69dSDavid Xu 
3027b445033SKonstantin Belousov 	KASSERT(td == curthread, ("non-current thread %p", td));
3037b445033SKonstantin Belousov 	error = 0;
3047b445033SKonstantin Belousov 	p = td->td_proc;
3057b445033SKonstantin Belousov 	if ((p->p_flag & P_HADTHREADS) != 0) {
306906ac69dSDavid Xu 		PROC_LOCK(p);
3077b445033SKonstantin Belousov 		if (thread_single(p, SINGLE_BOUNDARY) != 0)
3087b445033SKonstantin Belousov 			error = ERESTART;
309906ac69dSDavid Xu 		PROC_UNLOCK(p);
310906ac69dSDavid Xu 	}
3117b445033SKonstantin Belousov 	KASSERT(error != 0 || (td->td_pflags & TDP_EXECVMSPC) == 0,
3127b445033SKonstantin Belousov 	    ("nested execve"));
3137b445033SKonstantin Belousov 	*oldvmspace = p->p_vmspace;
3147b445033SKonstantin Belousov 	return (error);
3157b445033SKonstantin Belousov }
316906ac69dSDavid Xu 
3177b445033SKonstantin Belousov void
3187b445033SKonstantin Belousov post_execve(struct thread *td, int error, struct vmspace *oldvmspace)
3197b445033SKonstantin Belousov {
3207b445033SKonstantin Belousov 	struct proc *p;
321906ac69dSDavid Xu 
3227b445033SKonstantin Belousov 	KASSERT(td == curthread, ("non-current thread %p", td));
3237b445033SKonstantin Belousov 	p = td->td_proc;
3247b445033SKonstantin Belousov 	if ((p->p_flag & P_HADTHREADS) != 0) {
325906ac69dSDavid Xu 		PROC_LOCK(p);
326906ac69dSDavid Xu 		/*
327906ac69dSDavid Xu 		 * If success, we upgrade to SINGLE_EXIT state to
328906ac69dSDavid Xu 		 * force other threads to suicide.
329906ac69dSDavid Xu 		 */
330814629ddSEd Schouten 		if (error == EJUSTRETURN)
3316ddcc233SKonstantin Belousov 			thread_single(p, SINGLE_EXIT);
332906ac69dSDavid Xu 		else
3336ddcc233SKonstantin Belousov 			thread_single_end(p, SINGLE_BOUNDARY);
334906ac69dSDavid Xu 		PROC_UNLOCK(p);
335906ac69dSDavid Xu 	}
336aaf78c16SKonstantin Belousov 	exec_cleanup(td, oldvmspace);
3377b445033SKonstantin Belousov }
338906ac69dSDavid Xu 
3397b445033SKonstantin Belousov /*
340aaf78c16SKonstantin Belousov  * kern_execve() has the astonishing property of not always returning to
3417b445033SKonstantin Belousov  * the caller.  If sufficiently bad things happen during the call to
3427b445033SKonstantin Belousov  * do_execve(), it can end up calling exit1(); as a result, callers must
3437b445033SKonstantin Belousov  * avoid doing anything which they might need to undo (e.g., allocating
3447b445033SKonstantin Belousov  * memory).
3457b445033SKonstantin Belousov  */
3467b445033SKonstantin Belousov int
347aaf78c16SKonstantin Belousov kern_execve(struct thread *td, struct image_args *args, struct mac *mac_p,
348aaf78c16SKonstantin Belousov     struct vmspace *oldvmspace)
3497b445033SKonstantin Belousov {
3507b445033SKonstantin Belousov 
3517b445033SKonstantin Belousov 	AUDIT_ARG_ARGV(args->begin_argv, args->argc,
352f373437aSBrooks Davis 	    exec_args_get_begin_envv(args) - args->begin_argv);
353f373437aSBrooks Davis 	AUDIT_ARG_ENVV(exec_args_get_begin_envv(args), args->envc,
354f373437aSBrooks Davis 	    args->endp - exec_args_get_begin_envv(args));
355aaf78c16SKonstantin Belousov 	return (do_execve(td, args, mac_p, oldvmspace));
356906ac69dSDavid Xu }
357906ac69dSDavid Xu 
35826f9a767SRodney W. Grimes /*
359450ffb44SRobert Watson  * In-kernel implementation of execve().  All arguments are assumed to be
360450ffb44SRobert Watson  * userspace pointers from the passed thread.
36126f9a767SRodney W. Grimes  */
362450ffb44SRobert Watson static int
363aaf78c16SKonstantin Belousov do_execve(struct thread *td, struct image_args *args, struct mac *mac_p,
364aaf78c16SKonstantin Belousov     struct vmspace *oldvmspace)
365df8bae1dSRodney W. Grimes {
366b40ce416SJulian Elischer 	struct proc *p = td->td_proc;
36769c9eff8SEd Schouten 	struct nameidata nd;
368881010f0SBryan Drewery 	struct ucred *oldcred;
369350d5181SMateusz Guzik 	struct uidinfo *euip = NULL;
37031174518SJohn Baldwin 	uintptr_t stack_base;
371c52007c2SDavid Greenman 	struct image_params image_params, *imgp;
3729f5c1d19SDiomidis Spinellis 	struct vattr attr;
3734d77a549SAlfred Perlstein 	int (*img_first)(struct image_params *);
37469be5db9SAlfred Perlstein 	struct pargs *oldargs = NULL, *newargs = NULL;
375cda68844SMateusz Guzik 	struct sigacts *oldsigacts = NULL, *newsigacts = NULL;
3766c84de02SJohn Baldwin #ifdef KTRACE
377*1762f674SKonstantin Belousov 	struct ktr_io_params *kiop;
3786c84de02SJohn Baldwin #endif
37961617058SMateusz Guzik 	struct vnode *oldtextvp = NULL, *newtextvp;
380d06c0d4dSRobert Watson 	int credential_changing;
381ccafe7ebSRobert Watson #ifdef MAC
3826356dba0SRobert Watson 	struct label *interpvplabel = NULL;
383eca8a663SRobert Watson 	int will_transition;
384ccafe7ebSRobert Watson #endif
38515139246SJoseph Koshy #ifdef HWPMC_HOOKS
38615139246SJoseph Koshy 	struct pmckern_procexec pe;
38715139246SJoseph Koshy #endif
38801a2b567SKonstantin Belousov 	int error, i, orig_osrel;
38901a2b567SKonstantin Belousov 	uint32_t orig_fctl0;
390632dbc19SKonstantin Belousov 	static const char fexecv_proc_title[] = "(fexecv)";
39126f9a767SRodney W. Grimes 
392c52007c2SDavid Greenman 	imgp = &image_params;
393*1762f674SKonstantin Belousov 	kiop = NULL;
394df8bae1dSRodney W. Grimes 
3959ca45e81SDag-Erling Smørgrav 	/*
3969ca45e81SDag-Erling Smørgrav 	 * Lock the process and set the P_INEXEC flag to indicate that
3979ca45e81SDag-Erling Smørgrav 	 * it should be left alone until we're done here.  This is
3989ca45e81SDag-Erling Smørgrav 	 * necessary to avoid race conditions - e.g. in ptrace() -
3999ca45e81SDag-Erling Smørgrav 	 * that might allow a local user to illicitly obtain elevated
4009ca45e81SDag-Erling Smørgrav 	 * privileges.
4019ca45e81SDag-Erling Smørgrav 	 */
4029ca45e81SDag-Erling Smørgrav 	PROC_LOCK(p);
4039ca45e81SDag-Erling Smørgrav 	KASSERT((p->p_flag & P_INEXEC) == 0,
40491f91617SDavid E. O'Brien 	    ("%s(): process already has P_INEXEC flag", __func__));
4059ca45e81SDag-Erling Smørgrav 	p->p_flag |= P_INEXEC;
4069ca45e81SDag-Erling Smørgrav 	PROC_UNLOCK(p);
4079ca45e81SDag-Erling Smørgrav 
408df8bae1dSRodney W. Grimes 	/*
409c52007c2SDavid Greenman 	 * Initialize part of the common data
410df8bae1dSRodney W. Grimes 	 */
4118e572983SMateusz Guzik 	bzero(imgp, sizeof(*imgp));
412c52007c2SDavid Greenman 	imgp->proc = p;
413c52007c2SDavid Greenman 	imgp->attr = &attr;
414610ecfe0SMaxim Sobolev 	imgp->args = args;
415881010f0SBryan Drewery 	oldcred = p->p_ucred;
41601a2b567SKonstantin Belousov 	orig_osrel = p->p_osrel;
41701a2b567SKonstantin Belousov 	orig_fctl0 = p->p_fctl0;
41826f9a767SRodney W. Grimes 
419670cb89bSRobert Watson #ifdef MAC
420eca8a663SRobert Watson 	error = mac_execve_enter(imgp, mac_p);
421532c491bSJeff Roberson 	if (error)
422670cb89bSRobert Watson 		goto exec_fail;
423670cb89bSRobert Watson #endif
424670cb89bSRobert Watson 
42526f9a767SRodney W. Grimes 	/*
42626f9a767SRodney W. Grimes 	 * Translate the file name. namei() returns a vnode pointer
427e3043798SPedro F. Giffuni 	 *	in ni_vp among other things.
428ae1078d6SWayne Salamon 	 *
429ae1078d6SWayne Salamon 	 * XXXAUDIT: It would be desirable to also audit the name of the
430ae1078d6SWayne Salamon 	 * interpreter if this is an interpreted binary.
43126f9a767SRodney W. Grimes 	 */
432632dbc19SKonstantin Belousov 	if (args->fname != NULL) {
43378022527SKonstantin Belousov 		NDINIT(&nd, LOOKUP, ISOPEN | LOCKLEAF | LOCKSHARED | FOLLOW |
43478022527SKonstantin Belousov 		    SAVENAME | AUDITVNODE1, UIO_SYSSPACE, args->fname, td);
435632dbc19SKonstantin Belousov 	}
43626f9a767SRodney W. Grimes 
43736160958SMark Johnston 	SDT_PROBE1(proc, , , exec, args->fname);
438e506f34bSCraig Rodrigues 
43926f9a767SRodney W. Grimes interpret:
440632dbc19SKonstantin Belousov 	if (args->fname != NULL) {
44112bc222eSJonathan Anderson #ifdef CAPABILITY_MODE
44212bc222eSJonathan Anderson 		/*
44312bc222eSJonathan Anderson 		 * While capability mode can't reach this point via direct
44412bc222eSJonathan Anderson 		 * path arguments to execve(), we also don't allow
44512bc222eSJonathan Anderson 		 * interpreters to be used in capability mode (for now).
44612bc222eSJonathan Anderson 		 * Catch indirect lookups and return a permissions error.
44712bc222eSJonathan Anderson 		 */
44812bc222eSJonathan Anderson 		if (IN_CAPABILITY_MODE(td)) {
44912bc222eSJonathan Anderson 			error = ECAPMODE;
45012bc222eSJonathan Anderson 			goto exec_fail;
45112bc222eSJonathan Anderson 		}
45212bc222eSJonathan Anderson #endif
45369c9eff8SEd Schouten 		error = namei(&nd);
454610ecfe0SMaxim Sobolev 		if (error)
45526f9a767SRodney W. Grimes 			goto exec_fail;
45626f9a767SRodney W. Grimes 
45761617058SMateusz Guzik 		newtextvp = nd.ni_vp;
45861617058SMateusz Guzik 		imgp->vp = newtextvp;
459632dbc19SKonstantin Belousov 	} else {
46014961ba7SRobert Watson 		AUDIT_ARG_FD(args->fd);
461a9d2f8d8SRobert Watson 		/*
462c8e781f6SPawel Jakub Dawidek 		 * Descriptors opened only with O_EXEC or O_RDONLY are allowed.
463a9d2f8d8SRobert Watson 		 */
464cbd92ce6SMatt Macy 		error = fgetvp_exec(td, args->fd, &cap_fexecve_rights, &newtextvp);
465632dbc19SKonstantin Belousov 		if (error)
466632dbc19SKonstantin Belousov 			goto exec_fail;
46778022527SKonstantin Belousov 		vn_lock(newtextvp, LK_SHARED | LK_RETRY);
46861617058SMateusz Guzik 		AUDIT_ARG_VNODE1(newtextvp);
46961617058SMateusz Guzik 		imgp->vp = newtextvp;
470632dbc19SKonstantin Belousov 	}
47126f9a767SRodney W. Grimes 
47226f9a767SRodney W. Grimes 	/*
47378022527SKonstantin Belousov 	 * Check file permissions.  Also 'opens' file and sets its vnode to
47478022527SKonstantin Belousov 	 * text mode.
4759022e4adSDavid Greenman 	 */
476c52007c2SDavid Greenman 	error = exec_check_permissions(imgp);
477619eb6e5SJeff Roberson 	if (error)
47826f9a767SRodney W. Grimes 		goto exec_fail_dealloc;
479619eb6e5SJeff Roberson 
4808516dd18SPoul-Henning Kamp 	imgp->object = imgp->vp->v_object;
4818516dd18SPoul-Henning Kamp 	if (imgp->object != NULL)
4820b2ed1aeSJeff Roberson 		vm_object_reference(imgp->object);
48326f9a767SRodney W. Grimes 
4841616db3cSJohn Dyson 	error = exec_map_first_page(imgp);
4856d5a0a8cSDavid Greenman 	if (error)
48626f9a767SRodney W. Grimes 		goto exec_fail_dealloc;
48726f9a767SRodney W. Grimes 
488f231de47SKonstantin Belousov 	imgp->proc->p_osrel = 0;
489f5cf7589SKonstantin Belousov 	imgp->proc->p_fctl0 = 0;
490881010f0SBryan Drewery 
491881010f0SBryan Drewery 	/*
492881010f0SBryan Drewery 	 * Implement image setuid/setgid.
493881010f0SBryan Drewery 	 *
494881010f0SBryan Drewery 	 * Determine new credentials before attempting image activators
495881010f0SBryan Drewery 	 * so that it can be used by process_exec handlers to determine
496881010f0SBryan Drewery 	 * credential/setid changes.
497881010f0SBryan Drewery 	 *
498881010f0SBryan Drewery 	 * Don't honor setuid/setgid if the filesystem prohibits it or if
499881010f0SBryan Drewery 	 * the process is being traced.
500881010f0SBryan Drewery 	 *
501881010f0SBryan Drewery 	 * We disable setuid/setgid/etc in capability mode on the basis
502881010f0SBryan Drewery 	 * that most setugid applications are not written with that
503881010f0SBryan Drewery 	 * environment in mind, and will therefore almost certainly operate
504881010f0SBryan Drewery 	 * incorrectly. In principle there's no reason that setugid
505881010f0SBryan Drewery 	 * applications might not be useful in capability mode, so we may want
506881010f0SBryan Drewery 	 * to reconsider this conservative design choice in the future.
507881010f0SBryan Drewery 	 *
508881010f0SBryan Drewery 	 * XXXMAC: For the time being, use NOSUID to also prohibit
509881010f0SBryan Drewery 	 * transitions on the file system.
510881010f0SBryan Drewery 	 */
511881010f0SBryan Drewery 	credential_changing = 0;
512881010f0SBryan Drewery 	credential_changing |= (attr.va_mode & S_ISUID) &&
513881010f0SBryan Drewery 	    oldcred->cr_uid != attr.va_uid;
514881010f0SBryan Drewery 	credential_changing |= (attr.va_mode & S_ISGID) &&
515881010f0SBryan Drewery 	    oldcred->cr_gid != attr.va_gid;
516881010f0SBryan Drewery #ifdef MAC
517881010f0SBryan Drewery 	will_transition = mac_vnode_execve_will_transition(oldcred, imgp->vp,
518881010f0SBryan Drewery 	    interpvplabel, imgp);
519881010f0SBryan Drewery 	credential_changing |= will_transition;
520881010f0SBryan Drewery #endif
521881010f0SBryan Drewery 
5221302eea7SKonstantin Belousov 	/* Don't inherit PROC_PDEATHSIG_CTL value if setuid/setgid. */
523b9408863SKonstantin Belousov 	if (credential_changing)
524b9408863SKonstantin Belousov 		imgp->proc->p_pdeathsig = 0;
525b9408863SKonstantin Belousov 
526881010f0SBryan Drewery 	if (credential_changing &&
527881010f0SBryan Drewery #ifdef CAPABILITY_MODE
528881010f0SBryan Drewery 	    ((oldcred->cr_flags & CRED_FLAG_CAPMODE) == 0) &&
529881010f0SBryan Drewery #endif
530881010f0SBryan Drewery 	    (imgp->vp->v_mount->mnt_flag & MNT_NOSUID) == 0 &&
531881010f0SBryan Drewery 	    (p->p_flag & P_TRACED) == 0) {
532881010f0SBryan Drewery 		imgp->credential_setid = true;
533b249ce48SMateusz Guzik 		VOP_UNLOCK(imgp->vp);
534881010f0SBryan Drewery 		imgp->newcred = crdup(oldcred);
535881010f0SBryan Drewery 		if (attr.va_mode & S_ISUID) {
536881010f0SBryan Drewery 			euip = uifind(attr.va_uid);
537881010f0SBryan Drewery 			change_euid(imgp->newcred, euip);
538881010f0SBryan Drewery 		}
5391040254bSKonstantin Belousov 		vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
540881010f0SBryan Drewery 		if (attr.va_mode & S_ISGID)
541881010f0SBryan Drewery 			change_egid(imgp->newcred, attr.va_gid);
542881010f0SBryan Drewery 		/*
543881010f0SBryan Drewery 		 * Implement correct POSIX saved-id behavior.
544881010f0SBryan Drewery 		 *
545881010f0SBryan Drewery 		 * XXXMAC: Note that the current logic will save the
546881010f0SBryan Drewery 		 * uid and gid if a MAC domain transition occurs, even
547881010f0SBryan Drewery 		 * though maybe it shouldn't.
548881010f0SBryan Drewery 		 */
549881010f0SBryan Drewery 		change_svuid(imgp->newcred, imgp->newcred->cr_uid);
550881010f0SBryan Drewery 		change_svgid(imgp->newcred, imgp->newcred->cr_gid);
551881010f0SBryan Drewery 	} else {
552881010f0SBryan Drewery 		/*
553881010f0SBryan Drewery 		 * Implement correct POSIX saved-id behavior.
554881010f0SBryan Drewery 		 *
555881010f0SBryan Drewery 		 * XXX: It's not clear that the existing behavior is
556881010f0SBryan Drewery 		 * POSIX-compliant.  A number of sources indicate that the
557881010f0SBryan Drewery 		 * saved uid/gid should only be updated if the new ruid is
558881010f0SBryan Drewery 		 * not equal to the old ruid, or the new euid is not equal
559881010f0SBryan Drewery 		 * to the old euid and the new euid is not equal to the old
560881010f0SBryan Drewery 		 * ruid.  The FreeBSD code always updates the saved uid/gid.
561881010f0SBryan Drewery 		 * Also, this code uses the new (replaced) euid and egid as
562881010f0SBryan Drewery 		 * the source, which may or may not be the right ones to use.
563881010f0SBryan Drewery 		 */
564881010f0SBryan Drewery 		if (oldcred->cr_svuid != oldcred->cr_uid ||
565881010f0SBryan Drewery 		    oldcred->cr_svgid != oldcred->cr_gid) {
566b249ce48SMateusz Guzik 			VOP_UNLOCK(imgp->vp);
567881010f0SBryan Drewery 			imgp->newcred = crdup(oldcred);
5681040254bSKonstantin Belousov 			vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
569881010f0SBryan Drewery 			change_svuid(imgp->newcred, imgp->newcred->cr_uid);
570881010f0SBryan Drewery 			change_svgid(imgp->newcred, imgp->newcred->cr_gid);
571881010f0SBryan Drewery 		}
572881010f0SBryan Drewery 	}
573881010f0SBryan Drewery 	/* The new credentials are installed into the process later. */
574881010f0SBryan Drewery 
57526f9a767SRodney W. Grimes 	/*
5761afd78b3SBryan Drewery 	 * Do the best to calculate the full path to the image file.
5771afd78b3SBryan Drewery 	 */
5781afd78b3SBryan Drewery 	if (args->fname != NULL && args->fname[0] == '/')
5791afd78b3SBryan Drewery 		imgp->execpath = args->fname;
5801afd78b3SBryan Drewery 	else {
581b249ce48SMateusz Guzik 		VOP_UNLOCK(imgp->vp);
582feabaaf9SMateusz Guzik 		if (vn_fullpath(imgp->vp, &imgp->execpath, &imgp->freepath) != 0)
5831afd78b3SBryan Drewery 			imgp->execpath = args->fname;
5841040254bSKonstantin Belousov 		vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
5851afd78b3SBryan Drewery 	}
5861afd78b3SBryan Drewery 
5871afd78b3SBryan Drewery 	/*
588d323ddf3SMatthew Dillon 	 *	If the current process has a special image activator it
589d323ddf3SMatthew Dillon 	 *	wants to try first, call it.   For example, emulating shell
590d323ddf3SMatthew Dillon 	 *	scripts differently.
59126f9a767SRodney W. Grimes 	 */
592d323ddf3SMatthew Dillon 	error = -1;
593d323ddf3SMatthew Dillon 	if ((img_first = imgp->proc->p_sysent->sv_imgact_try) != NULL)
594d323ddf3SMatthew Dillon 		error = img_first(imgp);
595d323ddf3SMatthew Dillon 
596d323ddf3SMatthew Dillon 	/*
597d323ddf3SMatthew Dillon 	 *	Loop through the list of image activators, calling each one.
598d323ddf3SMatthew Dillon 	 *	An activator returns -1 if there is no match, 0 on success,
599d323ddf3SMatthew Dillon 	 *	and an error otherwise.
600d323ddf3SMatthew Dillon 	 */
601d323ddf3SMatthew Dillon 	for (i = 0; error == -1 && execsw[i]; ++i) {
602d323ddf3SMatthew Dillon 		if (execsw[i]->ex_imgact == NULL ||
603d323ddf3SMatthew Dillon 		    execsw[i]->ex_imgact == img_first) {
604d323ddf3SMatthew Dillon 			continue;
605d323ddf3SMatthew Dillon 		}
606c52007c2SDavid Greenman 		error = (*execsw[i]->ex_imgact)(imgp);
607d323ddf3SMatthew Dillon 	}
608d323ddf3SMatthew Dillon 
609d323ddf3SMatthew Dillon 	if (error) {
61078022527SKonstantin Belousov 		if (error == -1)
611d323ddf3SMatthew Dillon 			error = ENOEXEC;
61226f9a767SRodney W. Grimes 		goto exec_fail_dealloc;
613d323ddf3SMatthew Dillon 	}
614d323ddf3SMatthew Dillon 
615d323ddf3SMatthew Dillon 	/*
616d323ddf3SMatthew Dillon 	 * Special interpreter operation, cleanup and loop up to try to
617d323ddf3SMatthew Dillon 	 * activate the interpreter.
618d323ddf3SMatthew Dillon 	 */
619c52007c2SDavid Greenman 	if (imgp->interpreted) {
6201616db3cSJohn Dyson 		exec_unmap_first_page(imgp);
621619eb6e5SJeff Roberson 		/*
62278022527SKonstantin Belousov 		 * The text reference needs to be removed for scripts.
62378022527SKonstantin Belousov 		 * There is a short period before we determine that
62478022527SKonstantin Belousov 		 * something is a script where text reference is active.
62578022527SKonstantin Belousov 		 * The vnode lock is held over this entire period
62678022527SKonstantin Belousov 		 * so nothing should illegitimately be blocked.
627619eb6e5SJeff Roberson 		 */
6281c36b728SKonstantin Belousov 		MPASS(imgp->textset);
6291c36b728SKonstantin Belousov 		VOP_UNSET_TEXT_CHECKED(newtextvp);
6301c36b728SKonstantin Belousov 		imgp->textset = false;
631762e6b85SEivind Eklund 		/* free name buffer and old vnode */
632632dbc19SKonstantin Belousov 		if (args->fname != NULL)
63369c9eff8SEd Schouten 			NDFREE(&nd, NDF_ONLY_PNBUF);
634670cb89bSRobert Watson #ifdef MAC
63561617058SMateusz Guzik 		mac_execve_interpreter_enter(newtextvp, &interpvplabel);
636670cb89bSRobert Watson #endif
6379a75ea23SKonstantin Belousov 		if (imgp->opened) {
63861617058SMateusz Guzik 			VOP_CLOSE(newtextvp, FREAD, td->td_ucred, td);
6399a75ea23SKonstantin Belousov 			imgp->opened = 0;
6409a75ea23SKonstantin Belousov 		}
64161617058SMateusz Guzik 		vput(newtextvp);
6420b2ed1aeSJeff Roberson 		vm_object_deallocate(imgp->object);
6430b2ed1aeSJeff Roberson 		imgp->object = NULL;
644881010f0SBryan Drewery 		imgp->credential_setid = false;
645881010f0SBryan Drewery 		if (imgp->newcred != NULL) {
646881010f0SBryan Drewery 			crfree(imgp->newcred);
647881010f0SBryan Drewery 			imgp->newcred = NULL;
648881010f0SBryan Drewery 		}
6491afd78b3SBryan Drewery 		imgp->execpath = NULL;
6501afd78b3SBryan Drewery 		free(imgp->freepath, M_TEMP);
6511afd78b3SBryan Drewery 		imgp->freepath = NULL;
65226f9a767SRodney W. Grimes 		/* set new name to that of the interpreter */
6538d4d271eSMateusz Guzik 		NDINIT(&nd, LOOKUP, ISOPEN | LOCKLEAF | LOCKSHARED | FOLLOW |
6548d4d271eSMateusz Guzik 		    SAVENAME, UIO_SYSSPACE, imgp->interpreter_name, td);
655632dbc19SKonstantin Belousov 		args->fname = imgp->interpreter_name;
65626f9a767SRodney W. Grimes 		goto interpret;
65726f9a767SRodney W. Grimes 	}
65826f9a767SRodney W. Grimes 
65926f9a767SRodney W. Grimes 	/*
660ded7d39cSChristian S.J. Peron 	 * NB: We unlock the vnode here because it is believed that none
661ded7d39cSChristian S.J. Peron 	 * of the sv_copyout_strings/sv_fixup operations require the vnode.
662ded7d39cSChristian S.J. Peron 	 */
663b249ce48SMateusz Guzik 	VOP_UNLOCK(imgp->vp);
6643ff06357SKonstantin Belousov 
665eda6009cSKonstantin Belousov 	if (disallow_high_osrel &&
666eda6009cSKonstantin Belousov 	    P_OSREL_MAJOR(p->p_osrel) > P_OSREL_MAJOR(__FreeBSD_version)) {
667eda6009cSKonstantin Belousov 		error = ENOEXEC;
668eda6009cSKonstantin Belousov 		uprintf("Osrel %d for image %s too high\n", p->p_osrel,
669eda6009cSKonstantin Belousov 		    imgp->execpath != NULL ? imgp->execpath : "<unresolved>");
670eda6009cSKonstantin Belousov 		vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
671eda6009cSKonstantin Belousov 		goto exec_fail_dealloc;
672eda6009cSKonstantin Belousov 	}
673eda6009cSKonstantin Belousov 
67439f5ebb7SEd Schouten 	/* ABI enforces the use of Capsicum. Switch into capabilities mode. */
67539f5ebb7SEd Schouten 	if (SV_PROC_FLAG(p, SV_CAPSICUM))
67639f5ebb7SEd Schouten 		sys_cap_enter(td, NULL);
67739f5ebb7SEd Schouten 
678ded7d39cSChristian S.J. Peron 	/*
67991ff2d48SEdward Tomasz Napierala 	 * Copy out strings (args and env) and initialize stack base.
68026f9a767SRodney W. Grimes 	 */
68103b0d68cSJohn Baldwin 	error = (*p->p_sysent->sv_copyout_strings)(imgp, &stack_base);
68203b0d68cSJohn Baldwin 	if (error != 0) {
68303b0d68cSJohn Baldwin 		vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
68403b0d68cSJohn Baldwin 		goto exec_fail_dealloc;
68503b0d68cSJohn Baldwin 	}
68626f9a767SRodney W. Grimes 
68726f9a767SRodney W. Grimes 	/*
68891ff2d48SEdward Tomasz Napierala 	 * Stack setup.
68926f9a767SRodney W. Grimes 	 */
6905f77b8a8SBrooks Davis 	error = (*p->p_sysent->sv_fixup)(&stack_base, imgp);
6916f26dd50SKonstantin Belousov 	if (error != 0) {
6926f26dd50SKonstantin Belousov 		vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
6935f77b8a8SBrooks Davis 		goto exec_fail_dealloc;
6946f26dd50SKonstantin Belousov 	}
69526f9a767SRodney W. Grimes 
696457f7e23SEd Schouten 	if (args->fdp != NULL) {
697457f7e23SEd Schouten 		/* Install a brand new file descriptor table. */
698457f7e23SEd Schouten 		fdinstall_remapped(td, args->fdp);
699457f7e23SEd Schouten 		args->fdp = NULL;
700457f7e23SEd Schouten 	} else {
701a78e8d2aSDavid Greenman 		/*
702457f7e23SEd Schouten 		 * Keep on using the existing file descriptor table. For
703457f7e23SEd Schouten 		 * security and other reasons, the file descriptor table
704457f7e23SEd Schouten 		 * cannot be shared after an exec.
705a78e8d2aSDavid Greenman 		 */
706b9d32c36SMateusz Guzik 		fdunshare(td);
70785078b85SConrad Meyer 		pdunshare(td);
708b0bc0cadSMateusz Guzik 		/* close files on exec */
709b0bc0cadSMateusz Guzik 		fdcloseexec(td);
710457f7e23SEd Schouten 	}
711a78e8d2aSDavid Greenman 
712333ea485SGuido van Rooij 	/*
7139b3b1c5fSJohn Baldwin 	 * Malloc things before we need locks.
7149b3b1c5fSJohn Baldwin 	 */
715f373437aSBrooks Davis 	i = exec_args_get_begin_envv(imgp->args) - imgp->args->begin_argv;
7165997cae9SDon Lewis 	/* Cache arguments if they fit inside our allowance */
7175997cae9SDon Lewis 	if (ps_arg_cache_limit >= i + sizeof(struct pargs)) {
7189b3b1c5fSJohn Baldwin 		newargs = pargs_alloc(i);
7195997cae9SDon Lewis 		bcopy(imgp->args->begin_argv, newargs->ar_args, i);
7205997cae9SDon Lewis 	}
7219b3b1c5fSJohn Baldwin 
7229b3b1c5fSJohn Baldwin 	/*
723333ea485SGuido van Rooij 	 * For security and other reasons, signal handlers cannot
7248688bb93SJohn Baldwin 	 * be shared after an exec. The new process gets a copy of the old
725b2c3fa70SDima Dorfman 	 * handlers. In execsigs(), the new process will have its signals
726333ea485SGuido van Rooij 	 * reset.
727333ea485SGuido van Rooij 	 */
72890af4afaSJohn Baldwin 	if (sigacts_shared(p->p_sigacts)) {
72990af4afaSJohn Baldwin 		oldsigacts = p->p_sigacts;
73090af4afaSJohn Baldwin 		newsigacts = sigacts_alloc();
73190af4afaSJohn Baldwin 		sigacts_copy(newsigacts, oldsigacts);
732a6bad85eSMateusz Guzik 	}
733333ea485SGuido van Rooij 
734cda68844SMateusz Guzik 	vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
735cda68844SMateusz Guzik 
736d00c8ea4SMateusz Guzik 	PROC_LOCK(p);
737d00c8ea4SMateusz Guzik 	if (oldsigacts)
738d00c8ea4SMateusz Guzik 		p->p_sigacts = newsigacts;
739fdf4e8b3SWarner Losh 	/* Stop profiling */
740fdf4e8b3SWarner Losh 	stopprofclock(p);
741fdf4e8b3SWarner Losh 
74226f9a767SRodney W. Grimes 	/* reset caught signals */
74326f9a767SRodney W. Grimes 	execsigs(p);
74426f9a767SRodney W. Grimes 
74526f9a767SRodney W. Grimes 	/* name this process - nameiexec(p, ndp) */
7465ca4819dSJohn Baldwin 	bzero(p->p_comm, sizeof(p->p_comm));
7475ca4819dSJohn Baldwin 	if (args->fname)
7485ca4819dSJohn Baldwin 		bcopy(nd.ni_cnd.cn_nameptr, p->p_comm,
7495ca4819dSJohn Baldwin 		    min(nd.ni_cnd.cn_namelen, MAXCOMLEN));
75061617058SMateusz Guzik 	else if (vn_commname(newtextvp, p->p_comm, sizeof(p->p_comm)) != 0)
7515ca4819dSJohn Baldwin 		bcopy(fexecv_proc_title, p->p_comm, sizeof(fexecv_proc_title));
752ca081fdbSJulian Elischer 	bcopy(p->p_comm, td->td_name, sizeof(td->td_name));
75344ad5475SJohn Baldwin #ifdef KTR
75444ad5475SJohn Baldwin 	sched_clear_tdname(td);
75544ad5475SJohn Baldwin #endif
75626f9a767SRodney W. Grimes 
75726f9a767SRodney W. Grimes 	/*
75824b34f09SSujal Patel 	 * mark as execed, wakeup the process that vforked (if any) and tell
759dc733423SDag-Erling Smørgrav 	 * it that it now has its own resources back
76026f9a767SRodney W. Grimes 	 */
76126f9a767SRodney W. Grimes 	p->p_flag |= P_EXEC;
762677258f7SKonstantin Belousov 	if ((p->p_flag2 & P2_NOTRACE_EXEC) == 0)
763677258f7SKonstantin Belousov 		p->p_flag2 &= ~P2_NOTRACE;
764fe69291fSKonstantin Belousov 	if ((p->p_flag2 & P2_STKGAP_DISABLE_EXEC) == 0)
765fe69291fSKonstantin Belousov 		p->p_flag2 &= ~P2_STKGAP_DISABLE;
766965d0860SMateusz Guzik 	if (p->p_flag & P_PPWAIT) {
767888d4d4fSKonstantin Belousov 		p->p_flag &= ~(P_PPWAIT | P_PPTRACE);
768aeb32571SKonstantin Belousov 		cv_broadcast(&p->p_pwait);
76977d68094SKonstantin Belousov 		/* STOPs are no longer ignored, arrange for AST */
77077d68094SKonstantin Belousov 		signotify(td);
77126f9a767SRodney W. Grimes 	}
77226f9a767SRodney W. Grimes 
77326f9a767SRodney W. Grimes 	/*
774881010f0SBryan Drewery 	 * Implement image setuid/setgid installation.
775c52007c2SDavid Greenman 	 */
776881010f0SBryan Drewery 	if (imgp->credential_setid) {
777c52007c2SDavid Greenman 		/*
778c52007c2SDavid Greenman 		 * Turn off syscall tracing for set-id programs, except for
779b85db196SPeter Wemm 		 * root.  Record any set-id flags first to make sure that
780b85db196SPeter Wemm 		 * we do not regain any tracing during a possible block.
78126f9a767SRodney W. Grimes 		 */
782b85db196SPeter Wemm 		setsugid(p);
783*1762f674SKonstantin Belousov 		kiop = NULL;
784acd3428bSRobert Watson 
7856c84de02SJohn Baldwin #ifdef KTRACE
786*1762f674SKonstantin Belousov 		kiop = ktrprocexec(p);
7876c84de02SJohn Baldwin #endif
78828b325aaSDon Lewis 		/*
789c1e2d386SNate Lawson 		 * Close any file descriptors 0..2 that reference procfs,
790c1e2d386SNate Lawson 		 * then make sure file descriptors 0..2 are in use.
79128b325aaSDon Lewis 		 *
7928a5177ccSMateusz Guzik 		 * Both fdsetugidsafety() and fdcheckstd() may call functions
7938a5177ccSMateusz Guzik 		 * taking sleepable locks, so temporarily drop our locks.
79428b325aaSDon Lewis 		 */
79528b325aaSDon Lewis 		PROC_UNLOCK(p);
796b249ce48SMateusz Guzik 		VOP_UNLOCK(imgp->vp);
79711888da8SMateusz Guzik 		fdsetugidsafety(td);
798e983a376SJacques Vidrine 		error = fdcheckstd(td);
7995e2554b7SMateusz Guzik 		vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
800cda68844SMateusz Guzik 		if (error != 0)
801cda68844SMateusz Guzik 			goto exec_fail_dealloc;
802e1b1aa3bSJohn Baldwin 		PROC_LOCK(p);
803ccafe7ebSRobert Watson #ifdef MAC
804670cb89bSRobert Watson 		if (will_transition) {
805881010f0SBryan Drewery 			mac_vnode_execve_transition(oldcred, imgp->newcred,
806881010f0SBryan Drewery 			    imgp->vp, interpvplabel, imgp);
807670cb89bSRobert Watson 		}
808ccafe7ebSRobert Watson #endif
809c52007c2SDavid Greenman 	} else {
810b1fc0ec1SRobert Watson 		if (oldcred->cr_uid == oldcred->cr_ruid &&
811b1fc0ec1SRobert Watson 		    oldcred->cr_gid == oldcred->cr_rgid)
812c52007c2SDavid Greenman 			p->p_flag &= ~P_SUGID;
813881010f0SBryan Drewery 	}
81426f9a767SRodney W. Grimes 	/*
815881010f0SBryan Drewery 	 * Set the new credentials.
81626f9a767SRodney W. Grimes 	 */
8173fc292d5SKonstantin Belousov 	if (imgp->newcred != NULL) {
818881010f0SBryan Drewery 		proc_set_cred(p, imgp->newcred);
8193fc292d5SKonstantin Belousov 		crfree(oldcred);
8203fc292d5SKonstantin Belousov 		oldcred = NULL;
8213fc292d5SKonstantin Belousov 	}
82226f9a767SRodney W. Grimes 
82326f9a767SRodney W. Grimes 	/*
824853be5ffSMateusz Guzik 	 * Store the vp for use in procfs.  This vnode was referenced by namei
825853be5ffSMateusz Guzik 	 * or fgetvp_exec.
8262a531c80SDavid Greenman 	 */
82761617058SMateusz Guzik 	oldtextvp = p->p_textvp;
82861617058SMateusz Guzik 	p->p_textvp = newtextvp;
8292a531c80SDavid Greenman 
8305d217f17SJohn Birrell #ifdef KDTRACE_HOOKS
8315d217f17SJohn Birrell 	/*
8325d217f17SJohn Birrell 	 * Tell the DTrace fasttrap provider about the exec if it
8335d217f17SJohn Birrell 	 * has declared an interest.
8345d217f17SJohn Birrell 	 */
8355d217f17SJohn Birrell 	if (dtrace_fasttrap_exec)
8365d217f17SJohn Birrell 		dtrace_fasttrap_exec(p);
8375d217f17SJohn Birrell #endif
8385d217f17SJohn Birrell 
8392a531c80SDavid Greenman 	/*
8409ca45e81SDag-Erling Smørgrav 	 * Notify others that we exec'd, and clear the P_INEXEC flag
8419ca45e81SDag-Erling Smørgrav 	 * as we're now a bona fide freshly-execed process.
842cb679c38SJonathan Lemon 	 */
8439e590ff0SKonstantin Belousov 	KNOTE_LOCKED(p->p_klist, NOTE_EXEC);
8449ca45e81SDag-Erling Smørgrav 	p->p_flag &= ~P_INEXEC;
845cb679c38SJonathan Lemon 
84626f9a767SRodney W. Grimes 	/* clear "fork but no exec" flag, as we _are_ execing */
84726f9a767SRodney W. Grimes 	p->p_acflag &= ~AFORK;
84826f9a767SRodney W. Grimes 
8495997cae9SDon Lewis 	/*
85034ea500bSDon Lewis 	 * Free any previous argument cache and replace it with
8515997cae9SDon Lewis 	 * the new argument cache, if any.
8525997cae9SDon Lewis 	 */
8539b3b1c5fSJohn Baldwin 	oldargs = p->p_args;
854e1b1aa3bSJohn Baldwin 	p->p_args = newargs;
855e1b1aa3bSJohn Baldwin 	newargs = NULL;
856ebccf1e3SJoseph Koshy 
85780a2397aSMateusz Guzik 	PROC_UNLOCK(p);
85880a2397aSMateusz Guzik 
859ebccf1e3SJoseph Koshy #ifdef	HWPMC_HOOKS
860ebccf1e3SJoseph Koshy 	/*
861f263522aSJoseph Koshy 	 * Check if system-wide sampling is in effect or if the
862f263522aSJoseph Koshy 	 * current process is using PMCs.  If so, do exec() time
863ebccf1e3SJoseph Koshy 	 * processing.  This processing needs to happen AFTER the
864ebccf1e3SJoseph Koshy 	 * P_INEXEC flag is cleared.
865ebccf1e3SJoseph Koshy 	 */
866f263522aSJoseph Koshy 	if (PMC_SYSTEM_SAMPLING_ACTIVE() || PMC_PROC_IS_USING_PMCS(p)) {
867b249ce48SMateusz Guzik 		VOP_UNLOCK(imgp->vp);
86815139246SJoseph Koshy 		pe.pm_credentialschanged = credential_changing;
86915139246SJoseph Koshy 		pe.pm_entryaddr = imgp->entry_addr;
87015139246SJoseph Koshy 
87115139246SJoseph Koshy 		PMC_CALL_HOOK_X(td, PMC_FN_PROCESS_EXEC, (void *) &pe);
8722974cc36SKonstantin Belousov 		vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
87380a2397aSMateusz Guzik 	}
874ebccf1e3SJoseph Koshy #endif
875e1b1aa3bSJohn Baldwin 
876e913ca22SDoug Rabson 	/* Set values passed into the program in registers. */
87731174518SJohn Baldwin 	(*p->p_sysent->sv_setregs)(td, imgp, stack_base);
878e913ca22SDoug Rabson 
879643656cfSMateusz Guzik 	VOP_MMAPPED(imgp->vp);
8806341095eSKen Smith 
88136160958SMark Johnston 	SDT_PROBE1(proc, , , exec__success, args->fname);
8825d217f17SJohn Birrell 
8831616db3cSJohn Dyson exec_fail_dealloc:
88401a2b567SKonstantin Belousov 	if (error != 0) {
88501a2b567SKonstantin Belousov 		p->p_osrel = orig_osrel;
88601a2b567SKonstantin Belousov 		p->p_fctl0 = orig_fctl0;
88701a2b567SKonstantin Belousov 	}
88801a2b567SKonstantin Belousov 
889d6c847f3SBruce Evans 	if (imgp->firstpage != NULL)
8901616db3cSJohn Dyson 		exec_unmap_first_page(imgp);
89126f9a767SRodney W. Grimes 
892d6c847f3SBruce Evans 	if (imgp->vp != NULL) {
893632dbc19SKonstantin Belousov 		if (args->fname)
89469c9eff8SEd Schouten 			NDFREE(&nd, NDF_ONLY_PNBUF);
8959a75ea23SKonstantin Belousov 		if (imgp->opened)
8969a75ea23SKonstantin Belousov 			VOP_CLOSE(imgp->vp, FREAD, td->td_ucred, td);
89778022527SKonstantin Belousov 		if (imgp->textset)
89878022527SKonstantin Belousov 			VOP_UNSET_TEXT_CHECKED(imgp->vp);
899853be5ffSMateusz Guzik 		if (error != 0)
900619eb6e5SJeff Roberson 			vput(imgp->vp);
901853be5ffSMateusz Guzik 		else
902b249ce48SMateusz Guzik 			VOP_UNLOCK(imgp->vp);
903a3cf6ebaSDavid Greenman 	}
90426f9a767SRodney W. Grimes 
905d6c847f3SBruce Evans 	if (imgp->object != NULL)
9060b2ed1aeSJeff Roberson 		vm_object_deallocate(imgp->object);
9070b2ed1aeSJeff Roberson 
9083ff06357SKonstantin Belousov 	free(imgp->freepath, M_TEMP);
9093ff06357SKonstantin Belousov 
910d1989db5SRobert Drehmel 	if (error == 0) {
911e6b645aeSMateusz Guzik 		if (p->p_ptevents & PTRACE_EXEC) {
912afe1a688SKonstantin Belousov 			PROC_LOCK(p);
9138d570f64SJohn Baldwin 			if (p->p_ptevents & PTRACE_EXEC)
914afe1a688SKonstantin Belousov 				td->td_dbgflags |= TDB_EXEC;
915afe1a688SKonstantin Belousov 			PROC_UNLOCK(p);
916e6b645aeSMateusz Guzik 		}
917cda68844SMateusz Guzik 	} else {
91826f9a767SRodney W. Grimes exec_fail:
9199ca45e81SDag-Erling Smørgrav 		/* we're done here, clear P_INEXEC */
9209ca45e81SDag-Erling Smørgrav 		PROC_LOCK(p);
9219ca45e81SDag-Erling Smørgrav 		p->p_flag &= ~P_INEXEC;
9229ca45e81SDag-Erling Smørgrav 		PROC_UNLOCK(p);
9239ca45e81SDag-Erling Smørgrav 
92436160958SMark Johnston 		SDT_PROBE1(proc, , , exec__failure, error);
925cda68844SMateusz Guzik 	}
9265d217f17SJohn Birrell 
9273fc292d5SKonstantin Belousov 	if (imgp->newcred != NULL && oldcred != NULL)
9283fc292d5SKonstantin Belousov 		crfree(imgp->newcred);
9293fc292d5SKonstantin Belousov 
930670cb89bSRobert Watson #ifdef MAC
931670cb89bSRobert Watson 	mac_execve_exit(imgp);
9326356dba0SRobert Watson 	mac_execve_interpreter_exit(interpvplabel);
933670cb89bSRobert Watson #endif
9348917b8d2SJohn Baldwin 	exec_free_args(args);
9358917b8d2SJohn Baldwin 
936cda68844SMateusz Guzik 	/*
937cda68844SMateusz Guzik 	 * Handle deferred decrement of ref counts.
938cda68844SMateusz Guzik 	 */
939cda68844SMateusz Guzik 	if (oldtextvp != NULL)
940cda68844SMateusz Guzik 		vrele(oldtextvp);
941*1762f674SKonstantin Belousov 	ktr_io_params_free(kiop);
942cda68844SMateusz Guzik 	pargs_drop(oldargs);
943cda68844SMateusz Guzik 	pargs_drop(newargs);
944cda68844SMateusz Guzik 	if (oldsigacts != NULL)
945cda68844SMateusz Guzik 		sigacts_free(oldsigacts);
946cda68844SMateusz Guzik 	if (euip != NULL)
947cda68844SMateusz Guzik 		uifree(euip);
948cda68844SMateusz Guzik 
9498917b8d2SJohn Baldwin 	if (error && imgp->vmspace_destroyed) {
9508917b8d2SJohn Baldwin 		/* sorry, no more process anymore. exit gracefully */
951aaf78c16SKonstantin Belousov 		exec_cleanup(td, oldvmspace);
952b4490c6eSKonstantin Belousov 		exit1(td, 0, SIGABRT);
9538917b8d2SJohn Baldwin 		/* NOT REACHED */
9548917b8d2SJohn Baldwin 	}
9557705d4b2SDmitry Chagin 
9567705d4b2SDmitry Chagin #ifdef KTRACE
9577705d4b2SDmitry Chagin 	if (error == 0)
9587705d4b2SDmitry Chagin 		ktrprocctor(p);
9597705d4b2SDmitry Chagin #endif
9607705d4b2SDmitry Chagin 
961814629ddSEd Schouten 	/*
962814629ddSEd Schouten 	 * We don't want cpu_set_syscall_retval() to overwrite any of
963814629ddSEd Schouten 	 * the register values put in place by exec_setregs().
964814629ddSEd Schouten 	 * Implementations of cpu_set_syscall_retval() will leave
965814629ddSEd Schouten 	 * registers unmodified when returning EJUSTRETURN.
966814629ddSEd Schouten 	 */
967814629ddSEd Schouten 	return (error == 0 ? EJUSTRETURN : error);
96826f9a767SRodney W. Grimes }
96926f9a767SRodney W. Grimes 
970aaf78c16SKonstantin Belousov void
971aaf78c16SKonstantin Belousov exec_cleanup(struct thread *td, struct vmspace *oldvmspace)
972aaf78c16SKonstantin Belousov {
973aaf78c16SKonstantin Belousov 	if ((td->td_pflags & TDP_EXECVMSPC) != 0) {
9745dca94eeSKonstantin Belousov 		KASSERT(td->td_proc->p_vmspace != oldvmspace,
975aaf78c16SKonstantin Belousov 		    ("oldvmspace still used"));
976aaf78c16SKonstantin Belousov 		vmspace_free(oldvmspace);
977aaf78c16SKonstantin Belousov 		td->td_pflags &= ~TDP_EXECVMSPC;
978aaf78c16SKonstantin Belousov 	}
979aaf78c16SKonstantin Belousov }
980aaf78c16SKonstantin Belousov 
9811616db3cSJohn Dyson int
982b8d908b7SEd Maste exec_map_first_page(struct image_params *imgp)
9831616db3cSJohn Dyson {
9841616db3cSJohn Dyson 	vm_object_t object;
985af009714SJeff Roberson 	vm_page_t m;
986af009714SJeff Roberson 	int error;
9871616db3cSJohn Dyson 
988d6c847f3SBruce Evans 	if (imgp->firstpage != NULL)
9891616db3cSJohn Dyson 		exec_unmap_first_page(imgp);
9901616db3cSJohn Dyson 
9918516dd18SPoul-Henning Kamp 	object = imgp->vp->v_object;
9924d7d2993SJeff Roberson 	if (object == NULL)
9934d7d2993SJeff Roberson 		return (EACCES);
994f8a47341SAlan Cox #if VM_NRESERVLEVEL > 0
9957aaf252cSJeff Roberson 	if ((object->flags & OBJ_COLORED) == 0) {
9967aaf252cSJeff Roberson 		VM_OBJECT_WLOCK(object);
9973d653db0SAlan Cox 		vm_object_color(object, 0);
9987aaf252cSJeff Roberson 		VM_OBJECT_WUNLOCK(object);
9997aaf252cSJeff Roberson 	}
1000f8a47341SAlan Cox #endif
10017aaf252cSJeff Roberson 	error = vm_page_grab_valid_unlocked(&m, object, 0,
1002af009714SJeff Roberson 	    VM_ALLOC_COUNT(VM_INITIAL_PAGEIN) |
1003af009714SJeff Roberson             VM_ALLOC_NORMAL | VM_ALLOC_NOBUSY | VM_ALLOC_WIRED);
10041616db3cSJohn Dyson 
1005af009714SJeff Roberson 	if (error != VM_PAGER_OK)
1006af009714SJeff Roberson 		return (EIO);
1007af009714SJeff Roberson 	imgp->firstpage = sf_buf_alloc(m, 0);
100859c8bc40SAlan Cox 	imgp->image_header = (char *)sf_buf_kva(imgp->firstpage);
10091616db3cSJohn Dyson 
1010a7cddfedSJake Burkholder 	return (0);
10111616db3cSJohn Dyson }
10121616db3cSJohn Dyson 
10131616db3cSJohn Dyson void
10143e85b721SEd Maste exec_unmap_first_page(struct image_params *imgp)
10151616db3cSJohn Dyson {
101659c8bc40SAlan Cox 	vm_page_t m;
101723955314SAlfred Perlstein 
1018d6c847f3SBruce Evans 	if (imgp->firstpage != NULL) {
101959c8bc40SAlan Cox 		m = sf_buf_page(imgp->firstpage);
102059c8bc40SAlan Cox 		sf_buf_free(imgp->firstpage);
10211616db3cSJohn Dyson 		imgp->firstpage = NULL;
1022eeacb3b0SMark Johnston 		vm_page_unwire(m, PQ_ACTIVE);
10231616db3cSJohn Dyson 	}
10241616db3cSJohn Dyson }
10251616db3cSJohn Dyson 
102626f9a767SRodney W. Grimes /*
1027467b3975SKonstantin Belousov  * Destroy old address space, and allocate a new stack.
1028467b3975SKonstantin Belousov  *	The new stack is only sgrowsiz large because it is grown
1029467b3975SKonstantin Belousov  *	automatically on a page fault.
103026f9a767SRodney W. Grimes  */
103126f9a767SRodney W. Grimes int
10323e85b721SEd Maste exec_new_vmspace(struct image_params *imgp, struct sysentvec *sv)
103326f9a767SRodney W. Grimes {
103426f9a767SRodney W. Grimes 	int error;
10355e20c11fSAlan Cox 	struct proc *p = imgp->proc;
10365e20c11fSAlan Cox 	struct vmspace *vmspace = p->p_vmspace;
1037146fc63fSKonstantin Belousov 	struct thread *td = curthread;
10386297a3d8SKonstantin Belousov 	vm_object_t obj;
1039316b3843SKonstantin Belousov 	struct rlimit rlim_stack;
1040878adb85SBjoern A. Zeeb 	vm_offset_t sv_minuser, stack_addr;
104105ba50f5SJake Burkholder 	vm_map_t map;
10424ea65707SKonstantin Belousov 	vm_prot_t stack_prot;
104359d8f3ffSJohn Baldwin 	u_long ssiz;
104426f9a767SRodney W. Grimes 
1045c52007c2SDavid Greenman 	imgp->vmspace_destroyed = 1;
1046993182e5SAlexander Leidinger 	imgp->sysent = sv;
104726f9a767SRodney W. Grimes 
1048a113b17fSKonstantin Belousov 	sigfastblock_clear(td);
104974a093ebSKonstantin Belousov 	umtx_exec(p);
1050e68c6191SKonstantin Belousov 	itimers_exec(p);
105187a9b18dSKonstantin Belousov 	if (sv->sv_onexec != NULL)
105287a9b18dSKonstantin Belousov 		sv->sv_onexec(p, imgp);
1053146fc63fSKonstantin Belousov 
10542ca45184SMatt Joras 	EVENTHANDLER_DIRECT_INVOKE(process_exec, p, imgp);
10556f5dafeaSAlan Cox 
10566f5dafeaSAlan Cox 	/*
1057af9ec885SJohn Dyson 	 * Blow away entire process VM, if address space not shared,
1058af9ec885SJohn Dyson 	 * otherwise, create a new VM space so that other threads are
1059af9ec885SJohn Dyson 	 * not disrupted
1060af9ec885SJohn Dyson 	 */
106105ba50f5SJake Burkholder 	map = &vmspace->vm_map;
1062878adb85SBjoern A. Zeeb 	if (map_at_zero)
1063878adb85SBjoern A. Zeeb 		sv_minuser = sv->sv_minuser;
1064878adb85SBjoern A. Zeeb 	else
1065878adb85SBjoern A. Zeeb 		sv_minuser = MAX(sv->sv_minuser, PAGE_SIZE);
1066f7db0c95SMark Johnston 	if (refcount_load(&vmspace->vm_refcnt) == 1 &&
1067f7db0c95SMark Johnston 	    vm_map_min(map) == sv_minuser &&
10686f1fe330SKonstantin Belousov 	    vm_map_max(map) == sv->sv_maxuser &&
10696f1fe330SKonstantin Belousov 	    cpu_exec_vmspace_reuse(p, map)) {
10703db161e0SMatthew Dillon 		shmexit(vmspace);
1071b9eee07eSPeter Wemm 		pmap_remove_pages(vmspace_pmap(vmspace));
107205ba50f5SJake Burkholder 		vm_map_remove(map, vm_map_min(map), vm_map_max(map));
1073fa50a355SKonstantin Belousov 		/*
10742e1c94aaSKonstantin Belousov 		 * An exec terminates mlockall(MCL_FUTURE).
10752e1c94aaSKonstantin Belousov 		 * ASLR and W^X states must be re-evaluated.
1076fa50a355SKonstantin Belousov 		 */
10778056df6eSAlan Cox 		vm_map_lock(map);
1078fa50a355SKonstantin Belousov 		vm_map_modflags(map, 0, MAP_WIREFUTURE | MAP_ASLR |
10792e1c94aaSKonstantin Belousov 		    MAP_ASLR_IGNSTART | MAP_WXORX);
10808056df6eSAlan Cox 		vm_map_unlock(map);
1081af9ec885SJohn Dyson 	} else {
1082878adb85SBjoern A. Zeeb 		error = vmspace_exec(p, sv_minuser, sv->sv_maxuser);
108389b57fcfSKonstantin Belousov 		if (error)
108489b57fcfSKonstantin Belousov 			return (error);
10855e20c11fSAlan Cox 		vmspace = p->p_vmspace;
108605ba50f5SJake Burkholder 		map = &vmspace->vm_map;
1087af9ec885SJohn Dyson 	}
1088fa50a355SKonstantin Belousov 	map->flags |= imgp->map_flags;
108926f9a767SRodney W. Grimes 
10906297a3d8SKonstantin Belousov 	/* Map a shared page */
10916297a3d8SKonstantin Belousov 	obj = sv->sv_shared_page_obj;
10926297a3d8SKonstantin Belousov 	if (obj != NULL) {
10936297a3d8SKonstantin Belousov 		vm_object_reference(obj);
10946297a3d8SKonstantin Belousov 		error = vm_map_fixed(map, obj, 0,
10956297a3d8SKonstantin Belousov 		    sv->sv_shared_page_base, sv->sv_shared_page_len,
10961e65d73cSKonstantin Belousov 		    VM_PROT_READ | VM_PROT_EXECUTE,
10971e65d73cSKonstantin Belousov 		    VM_PROT_READ | VM_PROT_EXECUTE,
10981e65d73cSKonstantin Belousov 		    MAP_INHERIT_SHARE | MAP_ACC_NO_CHARGE);
1099467b3975SKonstantin Belousov 		if (error != KERN_SUCCESS) {
11006297a3d8SKonstantin Belousov 			vm_object_deallocate(obj);
1101467b3975SKonstantin Belousov 			return (vm_mmap_to_errno(error));
11026297a3d8SKonstantin Belousov 		}
11036297a3d8SKonstantin Belousov 	}
11046297a3d8SKonstantin Belousov 
110526f9a767SRodney W. Grimes 	/* Allocate a new stack */
1106316b3843SKonstantin Belousov 	if (imgp->stack_sz != 0) {
1107fe8a824cSKonstantin Belousov 		ssiz = trunc_page(imgp->stack_sz);
1108316b3843SKonstantin Belousov 		PROC_LOCK(p);
1109f6f6d240SMateusz Guzik 		lim_rlimit_proc(p, RLIMIT_STACK, &rlim_stack);
1110316b3843SKonstantin Belousov 		PROC_UNLOCK(p);
1111316b3843SKonstantin Belousov 		if (ssiz > rlim_stack.rlim_max)
1112316b3843SKonstantin Belousov 			ssiz = rlim_stack.rlim_max;
1113316b3843SKonstantin Belousov 		if (ssiz > rlim_stack.rlim_cur) {
1114316b3843SKonstantin Belousov 			rlim_stack.rlim_cur = ssiz;
1115316b3843SKonstantin Belousov 			kern_setrlimit(curthread, RLIMIT_STACK, &rlim_stack);
1116316b3843SKonstantin Belousov 		}
1117316b3843SKonstantin Belousov 	} else if (sv->sv_maxssiz != NULL) {
111859d8f3ffSJohn Baldwin 		ssiz = *sv->sv_maxssiz;
1119316b3843SKonstantin Belousov 	} else {
112059d8f3ffSJohn Baldwin 		ssiz = maxssiz;
1121316b3843SKonstantin Belousov 	}
112201c3ba97SKonstantin Belousov 	imgp->eff_stack_sz = lim_cur(curthread, RLIMIT_STACK);
112301c3ba97SKonstantin Belousov 	if (ssiz < imgp->eff_stack_sz)
1124fc83c5a7SKonstantin Belousov 		imgp->eff_stack_sz = ssiz;
112559d8f3ffSJohn Baldwin 	stack_addr = sv->sv_usrstack - ssiz;
11264ea65707SKonstantin Belousov 	stack_prot = obj != NULL && imgp->stack_prot != 0 ?
11274ea65707SKonstantin Belousov 	    imgp->stack_prot : sv->sv_stackprot;
11284ea65707SKonstantin Belousov 	error = vm_map_stack(map, stack_addr, (vm_size_t)ssiz, stack_prot,
11294ea65707SKonstantin Belousov 	    VM_PROT_ALL, MAP_STACK_GROWS_DOWN);
11304ea65707SKonstantin Belousov 	if (error != KERN_SUCCESS) {
11314ea65707SKonstantin Belousov 		uprintf("exec_new_vmspace: mapping stack size %#jx prot %#x "
11324ea65707SKonstantin Belousov 		    "failed mach error %d errno %d\n", (uintmax_t)ssiz,
11334ea65707SKonstantin Belousov 		    stack_prot, error, vm_mmap_to_errno(error));
1134467b3975SKonstantin Belousov 		return (vm_mmap_to_errno(error));
11354ea65707SKonstantin Belousov 	}
11362267af78SJulian Elischer 
113778960940SAlan Cox 	/*
113878960940SAlan Cox 	 * vm_ssize and vm_maxsaddr are somewhat antiquated concepts, but they
113978960940SAlan Cox 	 * are still used to enforce the stack rlimit on the process stack.
11402267af78SJulian Elischer 	 */
1141cbc89bfbSPaul Saab 	vmspace->vm_ssize = sgrowsiz >> PAGE_SHIFT;
11426ef12002SKonstantin Belousov 	vmspace->vm_maxsaddr = (char *)stack_addr;
114326f9a767SRodney W. Grimes 
114426f9a767SRodney W. Grimes 	return (0);
114526f9a767SRodney W. Grimes }
114626f9a767SRodney W. Grimes 
114726f9a767SRodney W. Grimes /*
1148873fbcd7SRobert Watson  * Copy out argument and environment strings from the old process address
1149873fbcd7SRobert Watson  * space into the temporary string buffer.
115026f9a767SRodney W. Grimes  */
115126f9a767SRodney W. Grimes int
115212e69f96SBrooks Davis exec_copyin_args(struct image_args *args, const char *fname,
1153610ecfe0SMaxim Sobolev     enum uio_seg segflg, char **argv, char **envv)
115426f9a767SRodney W. Grimes {
1155f373437aSBrooks Davis 	u_long arg, env;
1156ecbb00a2SDoug Rabson 	int error;
115726f9a767SRodney W. Grimes 
1158610ecfe0SMaxim Sobolev 	bzero(args, sizeof(*args));
1159610ecfe0SMaxim Sobolev 	if (argv == NULL)
1160610ecfe0SMaxim Sobolev 		return (EFAULT);
11612af6e14dSAlan Cox 
116226f9a767SRodney W. Grimes 	/*
11632af6e14dSAlan Cox 	 * Allocate demand-paged memory for the file name, argument, and
11642af6e14dSAlan Cox 	 * environment strings.
116526f9a767SRodney W. Grimes 	 */
11662af6e14dSAlan Cox 	error = exec_alloc_args(args);
11672af6e14dSAlan Cox 	if (error != 0)
11682af6e14dSAlan Cox 		return (error);
11699e4e5114SAlan Cox 
1170610ecfe0SMaxim Sobolev 	/*
1171610ecfe0SMaxim Sobolev 	 * Copy the file name.
1172610ecfe0SMaxim Sobolev 	 */
1173f373437aSBrooks Davis 	error = exec_args_add_fname(args, fname, segflg);
1174c30af532SMaxim Sobolev 	if (error != 0)
117568ff3c24SStephan Uphoff 		goto err_exit;
117626f9a767SRodney W. Grimes 
1177610ecfe0SMaxim Sobolev 	/*
1178610ecfe0SMaxim Sobolev 	 * extract arguments first
1179610ecfe0SMaxim Sobolev 	 */
11800a2c94b8SKonstantin Belousov 	for (;;) {
1181f373437aSBrooks Davis 		error = fueword(argv++, &arg);
11820a2c94b8SKonstantin Belousov 		if (error == -1) {
118368ff3c24SStephan Uphoff 			error = EFAULT;
118468ff3c24SStephan Uphoff 			goto err_exit;
118568ff3c24SStephan Uphoff 		}
1186f373437aSBrooks Davis 		if (arg == 0)
11870a2c94b8SKonstantin Belousov 			break;
1188f373437aSBrooks Davis 		error = exec_args_add_arg(args, (char *)(uintptr_t)arg,
1189f373437aSBrooks Davis 		    UIO_USERSPACE);
1190f373437aSBrooks Davis 		if (error != 0)
119168ff3c24SStephan Uphoff 			goto err_exit;
1192610ecfe0SMaxim Sobolev 	}
1193b9df5231SPoul-Henning Kamp 
119426f9a767SRodney W. Grimes 	/*
119526f9a767SRodney W. Grimes 	 * extract environment strings
119626f9a767SRodney W. Grimes 	 */
11970fd1a014SDavid Greenman 	if (envv) {
11980a2c94b8SKonstantin Belousov 		for (;;) {
1199f373437aSBrooks Davis 			error = fueword(envv++, &env);
12000a2c94b8SKonstantin Belousov 			if (error == -1) {
120168ff3c24SStephan Uphoff 				error = EFAULT;
120268ff3c24SStephan Uphoff 				goto err_exit;
120368ff3c24SStephan Uphoff 			}
1204f373437aSBrooks Davis 			if (env == 0)
12050a2c94b8SKonstantin Belousov 				break;
1206f373437aSBrooks Davis 			error = exec_args_add_env(args,
1207f373437aSBrooks Davis 			    (char *)(uintptr_t)env, UIO_USERSPACE);
1208f373437aSBrooks Davis 			if (error != 0)
120968ff3c24SStephan Uphoff 				goto err_exit;
12100fd1a014SDavid Greenman 		}
12110fd1a014SDavid Greenman 	}
121226f9a767SRodney W. Grimes 
121326f9a767SRodney W. Grimes 	return (0);
121468ff3c24SStephan Uphoff 
121568ff3c24SStephan Uphoff err_exit:
121668ff3c24SStephan Uphoff 	exec_free_args(args);
121768ff3c24SStephan Uphoff 	return (error);
121826f9a767SRodney W. Grimes }
121926f9a767SRodney W. Grimes 
1220457f7e23SEd Schouten int
1221457f7e23SEd Schouten exec_copyin_data_fds(struct thread *td, struct image_args *args,
1222457f7e23SEd Schouten     const void *data, size_t datalen, const int *fds, size_t fdslen)
1223457f7e23SEd Schouten {
1224457f7e23SEd Schouten 	struct filedesc *ofdp;
1225457f7e23SEd Schouten 	const char *p;
1226457f7e23SEd Schouten 	int *kfds;
1227457f7e23SEd Schouten 	int error;
1228457f7e23SEd Schouten 
1229457f7e23SEd Schouten 	memset(args, '\0', sizeof(*args));
1230457f7e23SEd Schouten 	ofdp = td->td_proc->p_fd;
1231d8bc2a17SMateusz Guzik 	if (datalen >= ARG_MAX || fdslen >= ofdp->fd_nfiles)
1232457f7e23SEd Schouten 		return (E2BIG);
1233457f7e23SEd Schouten 	error = exec_alloc_args(args);
1234457f7e23SEd Schouten 	if (error != 0)
1235457f7e23SEd Schouten 		return (error);
1236457f7e23SEd Schouten 
1237457f7e23SEd Schouten 	args->begin_argv = args->buf;
1238457f7e23SEd Schouten 	args->stringspace = ARG_MAX;
1239457f7e23SEd Schouten 
1240457f7e23SEd Schouten 	if (datalen > 0) {
1241457f7e23SEd Schouten 		/*
1242457f7e23SEd Schouten 		 * Argument buffer has been provided. Copy it into the
1243457f7e23SEd Schouten 		 * kernel as a single string and add a terminating null
1244457f7e23SEd Schouten 		 * byte.
1245457f7e23SEd Schouten 		 */
1246457f7e23SEd Schouten 		error = copyin(data, args->begin_argv, datalen);
1247457f7e23SEd Schouten 		if (error != 0)
1248457f7e23SEd Schouten 			goto err_exit;
1249457f7e23SEd Schouten 		args->begin_argv[datalen] = '\0';
1250457f7e23SEd Schouten 		args->endp = args->begin_argv + datalen + 1;
1251457f7e23SEd Schouten 		args->stringspace -= datalen + 1;
1252457f7e23SEd Schouten 
1253457f7e23SEd Schouten 		/*
1254457f7e23SEd Schouten 		 * Traditional argument counting. Count the number of
1255457f7e23SEd Schouten 		 * null bytes.
1256457f7e23SEd Schouten 		 */
1257457f7e23SEd Schouten 		for (p = args->begin_argv; p < args->endp; ++p)
1258457f7e23SEd Schouten 			if (*p == '\0')
1259457f7e23SEd Schouten 				++args->argc;
1260457f7e23SEd Schouten 	} else {
1261457f7e23SEd Schouten 		/* No argument buffer provided. */
1262457f7e23SEd Schouten 		args->endp = args->begin_argv;
1263457f7e23SEd Schouten 	}
1264457f7e23SEd Schouten 
1265457f7e23SEd Schouten 	/* Create new file descriptor table. */
1266457f7e23SEd Schouten 	kfds = malloc(fdslen * sizeof(int), M_TEMP, M_WAITOK);
1267457f7e23SEd Schouten 	error = copyin(fds, kfds, fdslen * sizeof(int));
1268457f7e23SEd Schouten 	if (error != 0) {
1269457f7e23SEd Schouten 		free(kfds, M_TEMP);
1270457f7e23SEd Schouten 		goto err_exit;
1271457f7e23SEd Schouten 	}
1272457f7e23SEd Schouten 	error = fdcopy_remapped(ofdp, kfds, fdslen, &args->fdp);
1273457f7e23SEd Schouten 	free(kfds, M_TEMP);
1274457f7e23SEd Schouten 	if (error != 0)
1275457f7e23SEd Schouten 		goto err_exit;
1276457f7e23SEd Schouten 
1277457f7e23SEd Schouten 	return (0);
1278457f7e23SEd Schouten err_exit:
1279457f7e23SEd Schouten 	exec_free_args(args);
1280457f7e23SEd Schouten 	return (error);
1281457f7e23SEd Schouten }
1282457f7e23SEd Schouten 
1283ec492b13SMark Johnston struct exec_args_kva {
1284ec492b13SMark Johnston 	vm_offset_t addr;
1285c6a4ba5aSMark Johnston 	u_int gen;
1286ec492b13SMark Johnston 	SLIST_ENTRY(exec_args_kva) next;
1287ec492b13SMark Johnston };
1288ec492b13SMark Johnston 
12892bf95012SAndrew Turner DPCPU_DEFINE_STATIC(struct exec_args_kva *, exec_args_kva);
1290ec492b13SMark Johnston 
1291ec492b13SMark Johnston static SLIST_HEAD(, exec_args_kva) exec_args_kva_freelist;
1292ec492b13SMark Johnston static struct mtx exec_args_kva_mtx;
1293c6a4ba5aSMark Johnston static u_int exec_args_gen;
1294ec492b13SMark Johnston 
1295ec492b13SMark Johnston static void
1296ec492b13SMark Johnston exec_prealloc_args_kva(void *arg __unused)
1297ec492b13SMark Johnston {
1298ec492b13SMark Johnston 	struct exec_args_kva *argkva;
1299ec492b13SMark Johnston 	u_int i;
1300ec492b13SMark Johnston 
1301ec492b13SMark Johnston 	SLIST_INIT(&exec_args_kva_freelist);
1302ec492b13SMark Johnston 	mtx_init(&exec_args_kva_mtx, "exec args kva", NULL, MTX_DEF);
1303ec492b13SMark Johnston 	for (i = 0; i < exec_map_entries; i++) {
1304ec492b13SMark Johnston 		argkva = malloc(sizeof(*argkva), M_PARGS, M_WAITOK);
1305ec492b13SMark Johnston 		argkva->addr = kmap_alloc_wait(exec_map, exec_map_entry_size);
1306c6a4ba5aSMark Johnston 		argkva->gen = exec_args_gen;
1307ec492b13SMark Johnston 		SLIST_INSERT_HEAD(&exec_args_kva_freelist, argkva, next);
1308ec492b13SMark Johnston 	}
1309ec492b13SMark Johnston }
1310ec492b13SMark Johnston SYSINIT(exec_args_kva, SI_SUB_EXEC, SI_ORDER_ANY, exec_prealloc_args_kva, NULL);
1311ec492b13SMark Johnston 
1312ec492b13SMark Johnston static vm_offset_t
1313ec492b13SMark Johnston exec_alloc_args_kva(void **cookie)
1314ec492b13SMark Johnston {
1315ec492b13SMark Johnston 	struct exec_args_kva *argkva;
1316ec492b13SMark Johnston 
1317ec492b13SMark Johnston 	argkva = (void *)atomic_readandclear_ptr(
1318ec492b13SMark Johnston 	    (uintptr_t *)DPCPU_PTR(exec_args_kva));
1319ec492b13SMark Johnston 	if (argkva == NULL) {
1320ec492b13SMark Johnston 		mtx_lock(&exec_args_kva_mtx);
1321ec492b13SMark Johnston 		while ((argkva = SLIST_FIRST(&exec_args_kva_freelist)) == NULL)
1322ec492b13SMark Johnston 			(void)mtx_sleep(&exec_args_kva_freelist,
1323ec492b13SMark Johnston 			    &exec_args_kva_mtx, 0, "execkva", 0);
1324ec492b13SMark Johnston 		SLIST_REMOVE_HEAD(&exec_args_kva_freelist, next);
1325ec492b13SMark Johnston 		mtx_unlock(&exec_args_kva_mtx);
1326ec492b13SMark Johnston 	}
1327f1c3adefSMark Johnston 	kasan_mark((void *)argkva->addr, exec_map_entry_size,
1328f1c3adefSMark Johnston 	    exec_map_entry_size, 0);
1329ec492b13SMark Johnston 	*(struct exec_args_kva **)cookie = argkva;
1330ec492b13SMark Johnston 	return (argkva->addr);
1331ec492b13SMark Johnston }
1332ec492b13SMark Johnston 
1333ec492b13SMark Johnston static void
1334c6a4ba5aSMark Johnston exec_release_args_kva(struct exec_args_kva *argkva, u_int gen)
1335ec492b13SMark Johnston {
1336ec492b13SMark Johnston 	vm_offset_t base;
1337ec492b13SMark Johnston 
1338ec492b13SMark Johnston 	base = argkva->addr;
1339f1c3adefSMark Johnston 	kasan_mark((void *)argkva->addr, 0, exec_map_entry_size,
1340f1c3adefSMark Johnston 	    KASAN_EXEC_ARGS_FREED);
1341c6a4ba5aSMark Johnston 	if (argkva->gen != gen) {
13423e7cb27cSAlan Cox 		(void)vm_map_madvise(exec_map, base, base + exec_map_entry_size,
1343c6a4ba5aSMark Johnston 		    MADV_FREE);
1344c6a4ba5aSMark Johnston 		argkva->gen = gen;
1345c6a4ba5aSMark Johnston 	}
1346ec492b13SMark Johnston 	if (!atomic_cmpset_ptr((uintptr_t *)DPCPU_PTR(exec_args_kva),
1347ec492b13SMark Johnston 	    (uintptr_t)NULL, (uintptr_t)argkva)) {
1348ec492b13SMark Johnston 		mtx_lock(&exec_args_kva_mtx);
1349ec492b13SMark Johnston 		SLIST_INSERT_HEAD(&exec_args_kva_freelist, argkva, next);
1350ec492b13SMark Johnston 		wakeup_one(&exec_args_kva_freelist);
1351ec492b13SMark Johnston 		mtx_unlock(&exec_args_kva_mtx);
1352ec492b13SMark Johnston 	}
1353ec492b13SMark Johnston }
1354ec492b13SMark Johnston 
1355c6a4ba5aSMark Johnston static void
1356c6a4ba5aSMark Johnston exec_free_args_kva(void *cookie)
1357c6a4ba5aSMark Johnston {
1358c6a4ba5aSMark Johnston 
1359c6a4ba5aSMark Johnston 	exec_release_args_kva(cookie, exec_args_gen);
1360c6a4ba5aSMark Johnston }
1361c6a4ba5aSMark Johnston 
1362c6a4ba5aSMark Johnston static void
1363c6a4ba5aSMark Johnston exec_args_kva_lowmem(void *arg __unused)
1364c6a4ba5aSMark Johnston {
1365c6a4ba5aSMark Johnston 	SLIST_HEAD(, exec_args_kva) head;
1366c6a4ba5aSMark Johnston 	struct exec_args_kva *argkva;
1367c6a4ba5aSMark Johnston 	u_int gen;
1368c6a4ba5aSMark Johnston 	int i;
1369c6a4ba5aSMark Johnston 
1370c6a4ba5aSMark Johnston 	gen = atomic_fetchadd_int(&exec_args_gen, 1) + 1;
1371c6a4ba5aSMark Johnston 
1372c6a4ba5aSMark Johnston 	/*
1373c6a4ba5aSMark Johnston 	 * Force an madvise of each KVA range. Any currently allocated ranges
1374c6a4ba5aSMark Johnston 	 * will have MADV_FREE applied once they are freed.
1375c6a4ba5aSMark Johnston 	 */
1376c6a4ba5aSMark Johnston 	SLIST_INIT(&head);
1377c6a4ba5aSMark Johnston 	mtx_lock(&exec_args_kva_mtx);
1378c6a4ba5aSMark Johnston 	SLIST_SWAP(&head, &exec_args_kva_freelist, exec_args_kva);
1379c6a4ba5aSMark Johnston 	mtx_unlock(&exec_args_kva_mtx);
1380c6a4ba5aSMark Johnston 	while ((argkva = SLIST_FIRST(&head)) != NULL) {
1381c6a4ba5aSMark Johnston 		SLIST_REMOVE_HEAD(&head, next);
1382c6a4ba5aSMark Johnston 		exec_release_args_kva(argkva, gen);
1383c6a4ba5aSMark Johnston 	}
1384c6a4ba5aSMark Johnston 
1385c6a4ba5aSMark Johnston 	CPU_FOREACH(i) {
1386c6a4ba5aSMark Johnston 		argkva = (void *)atomic_readandclear_ptr(
1387c6a4ba5aSMark Johnston 		    (uintptr_t *)DPCPU_ID_PTR(i, exec_args_kva));
1388c6a4ba5aSMark Johnston 		if (argkva != NULL)
1389c6a4ba5aSMark Johnston 			exec_release_args_kva(argkva, gen);
1390c6a4ba5aSMark Johnston 	}
1391c6a4ba5aSMark Johnston }
1392c6a4ba5aSMark Johnston EVENTHANDLER_DEFINE(vm_lowmem, exec_args_kva_lowmem, NULL,
1393c6a4ba5aSMark Johnston     EVENTHANDLER_PRI_ANY);
1394c6a4ba5aSMark Johnston 
13952af6e14dSAlan Cox /*
13962af6e14dSAlan Cox  * Allocate temporary demand-paged, zero-filled memory for the file name,
1397ec492b13SMark Johnston  * argument, and environment strings.
13982af6e14dSAlan Cox  */
13992af6e14dSAlan Cox int
14002af6e14dSAlan Cox exec_alloc_args(struct image_args *args)
14012af6e14dSAlan Cox {
14022af6e14dSAlan Cox 
1403ec492b13SMark Johnston 	args->buf = (char *)exec_alloc_args_kva(&args->bufkva);
1404ec492b13SMark Johnston 	return (0);
14052af6e14dSAlan Cox }
14062af6e14dSAlan Cox 
140769a8f9e3SAlan Cox void
1408610ecfe0SMaxim Sobolev exec_free_args(struct image_args *args)
1409610ecfe0SMaxim Sobolev {
1410610ecfe0SMaxim Sobolev 
141169a8f9e3SAlan Cox 	if (args->buf != NULL) {
1412ec492b13SMark Johnston 		exec_free_args_kva(args->bufkva);
1413610ecfe0SMaxim Sobolev 		args->buf = NULL;
1414610ecfe0SMaxim Sobolev 	}
1415a14a9498SAlan Cox 	if (args->fname_buf != NULL) {
1416a14a9498SAlan Cox 		free(args->fname_buf, M_TEMP);
1417a14a9498SAlan Cox 		args->fname_buf = NULL;
1418a14a9498SAlan Cox 	}
1419457f7e23SEd Schouten 	if (args->fdp != NULL)
1420457f7e23SEd Schouten 		fdescfree_remapped(args->fdp);
1421610ecfe0SMaxim Sobolev }
1422610ecfe0SMaxim Sobolev 
142326f9a767SRodney W. Grimes /*
1424f373437aSBrooks Davis  * A set to functions to fill struct image args.
1425f373437aSBrooks Davis  *
1426f373437aSBrooks Davis  * NOTE: exec_args_add_fname() must be called (possibly with a NULL
1427f373437aSBrooks Davis  * fname) before the other functions.  All exec_args_add_arg() calls must
1428f373437aSBrooks Davis  * be made before any exec_args_add_env() calls.  exec_args_adjust_args()
1429f373437aSBrooks Davis  * may be called any time after exec_args_add_fname().
1430f373437aSBrooks Davis  *
1431f373437aSBrooks Davis  * exec_args_add_fname() - install path to be executed
1432f373437aSBrooks Davis  * exec_args_add_arg() - append an argument string
1433f373437aSBrooks Davis  * exec_args_add_env() - append an env string
1434f373437aSBrooks Davis  * exec_args_adjust_args() - adjust location of the argument list to
1435f373437aSBrooks Davis  *                           allow new arguments to be prepended
1436f373437aSBrooks Davis  */
1437f373437aSBrooks Davis int
1438f373437aSBrooks Davis exec_args_add_fname(struct image_args *args, const char *fname,
1439f373437aSBrooks Davis     enum uio_seg segflg)
1440f373437aSBrooks Davis {
1441f373437aSBrooks Davis 	int error;
1442f373437aSBrooks Davis 	size_t length;
1443f373437aSBrooks Davis 
1444f373437aSBrooks Davis 	KASSERT(args->fname == NULL, ("fname already appended"));
1445f373437aSBrooks Davis 	KASSERT(args->endp == NULL, ("already appending to args"));
1446f373437aSBrooks Davis 
1447f373437aSBrooks Davis 	if (fname != NULL) {
1448f373437aSBrooks Davis 		args->fname = args->buf;
1449f373437aSBrooks Davis 		error = segflg == UIO_SYSSPACE ?
1450f373437aSBrooks Davis 		    copystr(fname, args->fname, PATH_MAX, &length) :
1451f373437aSBrooks Davis 		    copyinstr(fname, args->fname, PATH_MAX, &length);
1452f373437aSBrooks Davis 		if (error != 0)
1453f373437aSBrooks Davis 			return (error == ENAMETOOLONG ? E2BIG : error);
1454f373437aSBrooks Davis 	} else
1455f373437aSBrooks Davis 		length = 0;
1456f373437aSBrooks Davis 
1457f373437aSBrooks Davis 	/* Set up for _arg_*()/_env_*() */
1458f373437aSBrooks Davis 	args->endp = args->buf + length;
1459f373437aSBrooks Davis 	/* begin_argv must be set and kept updated */
1460f373437aSBrooks Davis 	args->begin_argv = args->endp;
1461f373437aSBrooks Davis 	KASSERT(exec_map_entry_size - length >= ARG_MAX,
1462f373437aSBrooks Davis 	    ("too little space remaining for arguments %zu < %zu",
1463f373437aSBrooks Davis 	    exec_map_entry_size - length, (size_t)ARG_MAX));
1464f373437aSBrooks Davis 	args->stringspace = ARG_MAX;
1465f373437aSBrooks Davis 
1466f373437aSBrooks Davis 	return (0);
1467f373437aSBrooks Davis }
1468f373437aSBrooks Davis 
1469f373437aSBrooks Davis static int
1470f373437aSBrooks Davis exec_args_add_str(struct image_args *args, const char *str,
1471f373437aSBrooks Davis     enum uio_seg segflg, int *countp)
1472f373437aSBrooks Davis {
1473f373437aSBrooks Davis 	int error;
1474f373437aSBrooks Davis 	size_t length;
1475f373437aSBrooks Davis 
1476f373437aSBrooks Davis 	KASSERT(args->endp != NULL, ("endp not initialized"));
1477f373437aSBrooks Davis 	KASSERT(args->begin_argv != NULL, ("begin_argp not initialized"));
1478f373437aSBrooks Davis 
1479f373437aSBrooks Davis 	error = (segflg == UIO_SYSSPACE) ?
1480f373437aSBrooks Davis 	    copystr(str, args->endp, args->stringspace, &length) :
1481f373437aSBrooks Davis 	    copyinstr(str, args->endp, args->stringspace, &length);
1482f373437aSBrooks Davis 	if (error != 0)
1483f373437aSBrooks Davis 		return (error == ENAMETOOLONG ? E2BIG : error);
1484f373437aSBrooks Davis 	args->stringspace -= length;
1485f373437aSBrooks Davis 	args->endp += length;
1486f373437aSBrooks Davis 	(*countp)++;
1487f373437aSBrooks Davis 
1488f373437aSBrooks Davis 	return (0);
1489f373437aSBrooks Davis }
1490f373437aSBrooks Davis 
1491f373437aSBrooks Davis int
1492f373437aSBrooks Davis exec_args_add_arg(struct image_args *args, const char *argp,
1493f373437aSBrooks Davis     enum uio_seg segflg)
1494f373437aSBrooks Davis {
1495f373437aSBrooks Davis 
1496f373437aSBrooks Davis 	KASSERT(args->envc == 0, ("appending args after env"));
1497f373437aSBrooks Davis 
1498f373437aSBrooks Davis 	return (exec_args_add_str(args, argp, segflg, &args->argc));
1499f373437aSBrooks Davis }
1500f373437aSBrooks Davis 
1501f373437aSBrooks Davis int
1502f373437aSBrooks Davis exec_args_add_env(struct image_args *args, const char *envp,
1503f373437aSBrooks Davis     enum uio_seg segflg)
1504f373437aSBrooks Davis {
1505f373437aSBrooks Davis 
1506f373437aSBrooks Davis 	if (args->envc == 0)
1507f373437aSBrooks Davis 		args->begin_envv = args->endp;
1508f373437aSBrooks Davis 
1509f373437aSBrooks Davis 	return (exec_args_add_str(args, envp, segflg, &args->envc));
1510f373437aSBrooks Davis }
1511f373437aSBrooks Davis 
1512f373437aSBrooks Davis int
1513f373437aSBrooks Davis exec_args_adjust_args(struct image_args *args, size_t consume, ssize_t extend)
1514f373437aSBrooks Davis {
1515f373437aSBrooks Davis 	ssize_t offset;
1516f373437aSBrooks Davis 
1517f373437aSBrooks Davis 	KASSERT(args->endp != NULL, ("endp not initialized"));
1518f373437aSBrooks Davis 	KASSERT(args->begin_argv != NULL, ("begin_argp not initialized"));
1519f373437aSBrooks Davis 
1520f373437aSBrooks Davis 	offset = extend - consume;
1521f373437aSBrooks Davis 	if (args->stringspace < offset)
1522f373437aSBrooks Davis 		return (E2BIG);
1523f373437aSBrooks Davis 	memmove(args->begin_argv + extend, args->begin_argv + consume,
1524f373437aSBrooks Davis 	    args->endp - args->begin_argv + consume);
1525f373437aSBrooks Davis 	if (args->envc > 0)
1526f373437aSBrooks Davis 		args->begin_envv += offset;
1527f373437aSBrooks Davis 	args->endp += offset;
1528f373437aSBrooks Davis 	args->stringspace -= offset;
1529f373437aSBrooks Davis 	return (0);
1530f373437aSBrooks Davis }
1531f373437aSBrooks Davis 
1532f373437aSBrooks Davis char *
1533f373437aSBrooks Davis exec_args_get_begin_envv(struct image_args *args)
1534f373437aSBrooks Davis {
1535f373437aSBrooks Davis 
1536f373437aSBrooks Davis 	KASSERT(args->endp != NULL, ("endp not initialized"));
1537f373437aSBrooks Davis 
1538f373437aSBrooks Davis 	if (args->envc > 0)
1539f373437aSBrooks Davis 		return (args->begin_envv);
1540f373437aSBrooks Davis 	return (args->endp);
1541f373437aSBrooks Davis }
1542f373437aSBrooks Davis 
1543673e2dd6SKonstantin Belousov void
1544673e2dd6SKonstantin Belousov exec_stackgap(struct image_params *imgp, uintptr_t *dp)
1545673e2dd6SKonstantin Belousov {
1546673e2dd6SKonstantin Belousov 	if (imgp->sysent->sv_stackgap == NULL ||
1547673e2dd6SKonstantin Belousov 	    (imgp->proc->p_fctl0 & (NT_FREEBSD_FCTL_ASLR_DISABLE |
1548673e2dd6SKonstantin Belousov 	    NT_FREEBSD_FCTL_ASG_DISABLE)) != 0 ||
1549673e2dd6SKonstantin Belousov 	    (imgp->map_flags & MAP_ASLR) == 0)
1550673e2dd6SKonstantin Belousov 		return;
1551673e2dd6SKonstantin Belousov 	imgp->sysent->sv_stackgap(imgp, dp);
1552673e2dd6SKonstantin Belousov }
1553673e2dd6SKonstantin Belousov 
1554f373437aSBrooks Davis /*
1555873fbcd7SRobert Watson  * Copy strings out to the new process address space, constructing new arg
1556873fbcd7SRobert Watson  * and env vector tables. Return a pointer to the base so that it can be used
1557873fbcd7SRobert Watson  * as the initial stack pointer.
155826f9a767SRodney W. Grimes  */
155903b0d68cSJohn Baldwin int
156031174518SJohn Baldwin exec_copyout_strings(struct image_params *imgp, uintptr_t *stack_base)
156126f9a767SRodney W. Grimes {
156226f9a767SRodney W. Grimes 	int argc, envc;
156326f9a767SRodney W. Grimes 	char **vectp;
156488b124ceSKonstantin Belousov 	char *stringp;
156531174518SJohn Baldwin 	uintptr_t destp, ustringp;
156693f6448cSDavid Greenman 	struct ps_strings *arginfo;
1567f3bec5d7SJake Burkholder 	struct proc *p;
15683ff06357SKonstantin Belousov 	size_t execpath_len;
156903b0d68cSJohn Baldwin 	int error, szsigcode, szps;
1570ee235befSKonstantin Belousov 	char canary[sizeof(long) * 8];
157126f9a767SRodney W. Grimes 
1572ee235befSKonstantin Belousov 	szps = sizeof(pagesizes[0]) * MAXPAGESIZES;
157326f9a767SRodney W. Grimes 	/*
157426f9a767SRodney W. Grimes 	 * Calculate string base and vector table pointers.
1575d66a5066SPeter Wemm 	 * Also deal with signal trampoline code for this exec type.
157626f9a767SRodney W. Grimes 	 */
15773ff06357SKonstantin Belousov 	if (imgp->execpath != NULL && imgp->auxargs != NULL)
15783ff06357SKonstantin Belousov 		execpath_len = strlen(imgp->execpath) + 1;
15793ff06357SKonstantin Belousov 	else
15803ff06357SKonstantin Belousov 		execpath_len = 0;
1581f3bec5d7SJake Burkholder 	p = imgp->proc;
1582f3bec5d7SJake Burkholder 	szsigcode = 0;
158305ba50f5SJake Burkholder 	arginfo = (struct ps_strings *)p->p_sysent->sv_psstrings;
1584397df744SBrooks Davis 	imgp->ps_strings = arginfo;
15856297a3d8SKonstantin Belousov 	if (p->p_sysent->sv_sigcode_base == 0) {
1586f3bec5d7SJake Burkholder 		if (p->p_sysent->sv_szsigcode != NULL)
1587f3bec5d7SJake Burkholder 			szsigcode = *(p->p_sysent->sv_szsigcode);
15886297a3d8SKonstantin Belousov 	}
158988b124ceSKonstantin Belousov 	destp =	(uintptr_t)arginfo;
15901ed012f9SPeter Wemm 
159126f9a767SRodney W. Grimes 	/*
1592d66a5066SPeter Wemm 	 * install sigcode
1593d66a5066SPeter Wemm 	 */
159488b124ceSKonstantin Belousov 	if (szsigcode != 0) {
159588b124ceSKonstantin Belousov 		destp -= szsigcode;
159688b124ceSKonstantin Belousov 		destp = rounddown2(destp, sizeof(void *));
159703b0d68cSJohn Baldwin 		error = copyout(p->p_sysent->sv_sigcode, (void *)destp,
159803b0d68cSJohn Baldwin 		    szsigcode);
159903b0d68cSJohn Baldwin 		if (error != 0)
160003b0d68cSJohn Baldwin 			return (error);
160188b124ceSKonstantin Belousov 	}
1602d66a5066SPeter Wemm 
1603d66a5066SPeter Wemm 	/*
16043ff06357SKonstantin Belousov 	 * Copy the image path for the rtld.
16053ff06357SKonstantin Belousov 	 */
16063ff06357SKonstantin Belousov 	if (execpath_len != 0) {
160788b124ceSKonstantin Belousov 		destp -= execpath_len;
1608d92da759SBrooks Davis 		destp = rounddown2(destp, sizeof(void *));
1609b24e6ac8SBrooks Davis 		imgp->execpathp = (void *)destp;
1610b24e6ac8SBrooks Davis 		error = copyout(imgp->execpath, imgp->execpathp, execpath_len);
161103b0d68cSJohn Baldwin 		if (error != 0)
161203b0d68cSJohn Baldwin 			return (error);
16133ff06357SKonstantin Belousov 	}
16143ff06357SKonstantin Belousov 
16153ff06357SKonstantin Belousov 	/*
1616ee235befSKonstantin Belousov 	 * Prepare the canary for SSP.
1617ee235befSKonstantin Belousov 	 */
1618ee235befSKonstantin Belousov 	arc4rand(canary, sizeof(canary), 0);
161988b124ceSKonstantin Belousov 	destp -= sizeof(canary);
1620b24e6ac8SBrooks Davis 	imgp->canary = (void *)destp;
1621b24e6ac8SBrooks Davis 	error = copyout(canary, imgp->canary, sizeof(canary));
162203b0d68cSJohn Baldwin 	if (error != 0)
162303b0d68cSJohn Baldwin 		return (error);
1624ee235befSKonstantin Belousov 	imgp->canarylen = sizeof(canary);
1625ee235befSKonstantin Belousov 
1626ee235befSKonstantin Belousov 	/*
1627ee235befSKonstantin Belousov 	 * Prepare the pagesizes array.
1628ee235befSKonstantin Belousov 	 */
162988b124ceSKonstantin Belousov 	destp -= szps;
163088b124ceSKonstantin Belousov 	destp = rounddown2(destp, sizeof(void *));
1631b24e6ac8SBrooks Davis 	imgp->pagesizes = (void *)destp;
1632b24e6ac8SBrooks Davis 	error = copyout(pagesizes, imgp->pagesizes, szps);
163303b0d68cSJohn Baldwin 	if (error != 0)
163403b0d68cSJohn Baldwin 		return (error);
1635ee235befSKonstantin Belousov 	imgp->pagesizeslen = szps;
1636ee235befSKonstantin Belousov 
163731174518SJohn Baldwin 	/*
163831174518SJohn Baldwin 	 * Allocate room for the argument and environment strings.
163931174518SJohn Baldwin 	 */
164088b124ceSKonstantin Belousov 	destp -= ARG_MAX - imgp->args->stringspace;
164188b124ceSKonstantin Belousov 	destp = rounddown2(destp, sizeof(void *));
164231174518SJohn Baldwin 	ustringp = destp;
164388b124ceSKonstantin Belousov 
1644673e2dd6SKonstantin Belousov 	exec_stackgap(imgp, &destp);
1645fc83c5a7SKonstantin Belousov 
164603b0d68cSJohn Baldwin 	if (imgp->auxargs) {
1647d8010b11SJohn Baldwin 		/*
1648d8010b11SJohn Baldwin 		 * Allocate room on the stack for the ELF auxargs
1649d8010b11SJohn Baldwin 		 * array.  It has up to AT_COUNT entries.
1650d8010b11SJohn Baldwin 		 */
1651d8010b11SJohn Baldwin 		destp -= AT_COUNT * sizeof(Elf_Auxinfo);
1652d8010b11SJohn Baldwin 		destp = rounddown2(destp, sizeof(void *));
165303b0d68cSJohn Baldwin 	}
165426f9a767SRodney W. Grimes 
165531174518SJohn Baldwin 	vectp = (char **)destp;
165631174518SJohn Baldwin 
165726f9a767SRodney W. Grimes 	/*
165873c8686eSJohn Baldwin 	 * Allocate room for the argv[] and env vectors including the
165973c8686eSJohn Baldwin 	 * terminating NULL pointers.
166073c8686eSJohn Baldwin 	 */
166173c8686eSJohn Baldwin 	vectp -= imgp->args->argc + 1 + imgp->args->envc + 1;
166273c8686eSJohn Baldwin 
166373c8686eSJohn Baldwin 	/*
166426f9a767SRodney W. Grimes 	 * vectp also becomes our initial stack base
166526f9a767SRodney W. Grimes 	 */
166631174518SJohn Baldwin 	*stack_base = (uintptr_t)vectp;
166726f9a767SRodney W. Grimes 
1668610ecfe0SMaxim Sobolev 	stringp = imgp->args->begin_argv;
1669610ecfe0SMaxim Sobolev 	argc = imgp->args->argc;
1670610ecfe0SMaxim Sobolev 	envc = imgp->args->envc;
167126f9a767SRodney W. Grimes 
167293f6448cSDavid Greenman 	/*
16733aed948bSDavid Greenman 	 * Copy out strings - arguments and environment.
167493f6448cSDavid Greenman 	 */
167531174518SJohn Baldwin 	error = copyout(stringp, (void *)ustringp,
167603b0d68cSJohn Baldwin 	    ARG_MAX - imgp->args->stringspace);
167703b0d68cSJohn Baldwin 	if (error != 0)
167803b0d68cSJohn Baldwin 		return (error);
167993f6448cSDavid Greenman 
168093f6448cSDavid Greenman 	/*
16813aed948bSDavid Greenman 	 * Fill in "ps_strings" struct for ps, w, etc.
16823aed948bSDavid Greenman 	 */
16839df1c38bSBrooks Davis 	imgp->argv = vectp;
168403b0d68cSJohn Baldwin 	if (suword(&arginfo->ps_argvstr, (long)(intptr_t)vectp) != 0 ||
168503b0d68cSJohn Baldwin 	    suword32(&arginfo->ps_nargvstr, argc) != 0)
168603b0d68cSJohn Baldwin 		return (EFAULT);
16873aed948bSDavid Greenman 
16883aed948bSDavid Greenman 	/*
16893aed948bSDavid Greenman 	 * Fill in argument portion of vector table.
169093f6448cSDavid Greenman 	 */
169126f9a767SRodney W. Grimes 	for (; argc > 0; --argc) {
169231174518SJohn Baldwin 		if (suword(vectp++, ustringp) != 0)
169303b0d68cSJohn Baldwin 			return (EFAULT);
16943aed948bSDavid Greenman 		while (*stringp++ != 0)
169531174518SJohn Baldwin 			ustringp++;
169631174518SJohn Baldwin 		ustringp++;
169726f9a767SRodney W. Grimes 	}
169826f9a767SRodney W. Grimes 
16991a6e52d0SJeroen Ruigrok van der Werven 	/* a null vector table pointer separates the argp's from the envp's */
170003b0d68cSJohn Baldwin 	if (suword(vectp++, 0) != 0)
170103b0d68cSJohn Baldwin 		return (EFAULT);
170226f9a767SRodney W. Grimes 
17039df1c38bSBrooks Davis 	imgp->envv = vectp;
170403b0d68cSJohn Baldwin 	if (suword(&arginfo->ps_envstr, (long)(intptr_t)vectp) != 0 ||
170503b0d68cSJohn Baldwin 	    suword32(&arginfo->ps_nenvstr, envc) != 0)
170603b0d68cSJohn Baldwin 		return (EFAULT);
170793f6448cSDavid Greenman 
170893f6448cSDavid Greenman 	/*
17093aed948bSDavid Greenman 	 * Fill in environment portion of vector table.
171093f6448cSDavid Greenman 	 */
171126f9a767SRodney W. Grimes 	for (; envc > 0; --envc) {
171231174518SJohn Baldwin 		if (suword(vectp++, ustringp) != 0)
171303b0d68cSJohn Baldwin 			return (EFAULT);
17143aed948bSDavid Greenman 		while (*stringp++ != 0)
171531174518SJohn Baldwin 			ustringp++;
171631174518SJohn Baldwin 		ustringp++;
171726f9a767SRodney W. Grimes 	}
171826f9a767SRodney W. Grimes 
171926f9a767SRodney W. Grimes 	/* end of vector table is a null pointer */
172003b0d68cSJohn Baldwin 	if (suword(vectp, 0) != 0)
172103b0d68cSJohn Baldwin 		return (EFAULT);
172226f9a767SRodney W. Grimes 
1723d8010b11SJohn Baldwin 	if (imgp->auxargs) {
1724d8010b11SJohn Baldwin 		vectp++;
1725d8010b11SJohn Baldwin 		error = imgp->sysent->sv_copyout_auxargs(imgp,
1726d8010b11SJohn Baldwin 		    (uintptr_t)vectp);
1727d8010b11SJohn Baldwin 		if (error != 0)
1728d8010b11SJohn Baldwin 			return (error);
1729d8010b11SJohn Baldwin 	}
1730d8010b11SJohn Baldwin 
173103b0d68cSJohn Baldwin 	return (0);
173226f9a767SRodney W. Grimes }
173326f9a767SRodney W. Grimes 
173426f9a767SRodney W. Grimes /*
173526f9a767SRodney W. Grimes  * Check permissions of file to execute.
1736cf64863aSRobert Watson  *	Called with imgp->vp locked.
173726f9a767SRodney W. Grimes  *	Return 0 for success or error code on failure.
173826f9a767SRodney W. Grimes  */
1739c8a79999SPeter Wemm int
17403e85b721SEd Maste exec_check_permissions(struct image_params *imgp)
174126f9a767SRodney W. Grimes {
1742c52007c2SDavid Greenman 	struct vnode *vp = imgp->vp;
1743c52007c2SDavid Greenman 	struct vattr *attr = imgp->attr;
1744a854ed98SJohn Baldwin 	struct thread *td;
174578022527SKonstantin Belousov 	int error;
174626f9a767SRodney W. Grimes 
17476617724cSJeff Roberson 	td = curthread;
1748339b79b9SRobert Watson 
1749ec35c2afSRobert Watson 	/* Get file attributes */
17500359a12eSAttilio Rao 	error = VOP_GETATTR(vp, attr, td->td_ucred);
1751ec35c2afSRobert Watson 	if (error)
1752ec35c2afSRobert Watson 		return (error);
1753ec35c2afSRobert Watson 
1754339b79b9SRobert Watson #ifdef MAC
175530d239bcSRobert Watson 	error = mac_vnode_check_exec(td->td_ucred, imgp->vp, imgp);
1756339b79b9SRobert Watson 	if (error)
1757339b79b9SRobert Watson 		return (error);
1758339b79b9SRobert Watson #endif
1759339b79b9SRobert Watson 
176026f9a767SRodney W. Grimes 	/*
1761de478dd4SJaakko Heinonen 	 * 1) Check if file execution is disabled for the filesystem that
1762de478dd4SJaakko Heinonen 	 *    this file resides on.
1763de478dd4SJaakko Heinonen 	 * 2) Ensure that at least one execute bit is on. Otherwise, a
1764de478dd4SJaakko Heinonen 	 *    privileged user will always succeed, and we don't want this
1765de478dd4SJaakko Heinonen 	 *    to happen unless the file really is executable.
1766de478dd4SJaakko Heinonen 	 * 3) Ensure that the file is a regular file.
176726f9a767SRodney W. Grimes 	 */
1768c52007c2SDavid Greenman 	if ((vp->v_mount->mnt_flag & MNT_NOEXEC) ||
1769de478dd4SJaakko Heinonen 	    (attr->va_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0 ||
1770a854ed98SJohn Baldwin 	    (attr->va_type != VREG))
177126f9a767SRodney W. Grimes 		return (EACCES);
177226f9a767SRodney W. Grimes 
177326f9a767SRodney W. Grimes 	/*
177426f9a767SRodney W. Grimes 	 * Zero length files can't be exec'd
177526f9a767SRodney W. Grimes 	 */
177626f9a767SRodney W. Grimes 	if (attr->va_size == 0)
177726f9a767SRodney W. Grimes 		return (ENOEXEC);
177826f9a767SRodney W. Grimes 
177926f9a767SRodney W. Grimes 	/*
178026f9a767SRodney W. Grimes 	 *  Check for execute permission to file based on current credentials.
178126f9a767SRodney W. Grimes 	 */
1782a854ed98SJohn Baldwin 	error = VOP_ACCESS(vp, VEXEC, td->td_ucred, td);
178326f9a767SRodney W. Grimes 	if (error)
178426f9a767SRodney W. Grimes 		return (error);
178526f9a767SRodney W. Grimes 
17866d5a0a8cSDavid Greenman 	/*
17876d5a0a8cSDavid Greenman 	 * Check number of open-for-writes on the file and deny execution
17886d5a0a8cSDavid Greenman 	 * if there are any.
178978022527SKonstantin Belousov 	 *
179078022527SKonstantin Belousov 	 * Add a text reference now so no one can write to the
179178022527SKonstantin Belousov 	 * executable while we're activating it.
179278022527SKonstantin Belousov 	 *
179378022527SKonstantin Belousov 	 * Remember if this was set before and unset it in case this is not
179478022527SKonstantin Belousov 	 * actually an executable image.
17956d5a0a8cSDavid Greenman 	 */
179678022527SKonstantin Belousov 	error = VOP_SET_TEXT(vp);
1797140dedb8SKonstantin Belousov 	if (error != 0)
1798140dedb8SKonstantin Belousov 		return (error);
179978022527SKonstantin Belousov 	imgp->textset = true;
18006d5a0a8cSDavid Greenman 
18016d5a0a8cSDavid Greenman 	/*
18026d5a0a8cSDavid Greenman 	 * Call filesystem specific open routine (which does nothing in the
18036d5a0a8cSDavid Greenman 	 * general case).
18046d5a0a8cSDavid Greenman 	 */
18059e223287SKonstantin Belousov 	error = VOP_OPEN(vp, FREAD, td->td_ucred, td, NULL);
18069a75ea23SKonstantin Belousov 	if (error == 0)
18079a75ea23SKonstantin Belousov 		imgp->opened = 1;
180826f9a767SRodney W. Grimes 	return (error);
1809df8bae1dSRodney W. Grimes }
1810aa855a59SPeter Wemm 
1811aa855a59SPeter Wemm /*
1812aa855a59SPeter Wemm  * Exec handler registration
1813aa855a59SPeter Wemm  */
1814aa855a59SPeter Wemm int
18153e85b721SEd Maste exec_register(const struct execsw *execsw_arg)
1816aa855a59SPeter Wemm {
1817aa855a59SPeter Wemm 	const struct execsw **es, **xs, **newexecsw;
1818d821d364SPedro F. Giffuni 	u_int count = 2;	/* New slot and trailing NULL */
1819aa855a59SPeter Wemm 
1820aa855a59SPeter Wemm 	if (execsw)
1821aa855a59SPeter Wemm 		for (es = execsw; *es; es++)
1822aa855a59SPeter Wemm 			count++;
1823a163d034SWarner Losh 	newexecsw = malloc(count * sizeof(*es), M_TEMP, M_WAITOK);
1824aa855a59SPeter Wemm 	xs = newexecsw;
1825aa855a59SPeter Wemm 	if (execsw)
1826aa855a59SPeter Wemm 		for (es = execsw; *es; es++)
1827aa855a59SPeter Wemm 			*xs++ = *es;
1828aa855a59SPeter Wemm 	*xs++ = execsw_arg;
1829aa855a59SPeter Wemm 	*xs = NULL;
1830aa855a59SPeter Wemm 	if (execsw)
1831aa855a59SPeter Wemm 		free(execsw, M_TEMP);
1832aa855a59SPeter Wemm 	execsw = newexecsw;
1833a7cddfedSJake Burkholder 	return (0);
1834aa855a59SPeter Wemm }
1835aa855a59SPeter Wemm 
1836aa855a59SPeter Wemm int
18373e85b721SEd Maste exec_unregister(const struct execsw *execsw_arg)
1838aa855a59SPeter Wemm {
1839aa855a59SPeter Wemm 	const struct execsw **es, **xs, **newexecsw;
1840aa855a59SPeter Wemm 	int count = 1;
1841aa855a59SPeter Wemm 
1842aa855a59SPeter Wemm 	if (execsw == NULL)
1843aa855a59SPeter Wemm 		panic("unregister with no handlers left?\n");
1844aa855a59SPeter Wemm 
1845aa855a59SPeter Wemm 	for (es = execsw; *es; es++) {
1846aa855a59SPeter Wemm 		if (*es == execsw_arg)
1847aa855a59SPeter Wemm 			break;
1848aa855a59SPeter Wemm 	}
1849aa855a59SPeter Wemm 	if (*es == NULL)
1850a7cddfedSJake Burkholder 		return (ENOENT);
1851aa855a59SPeter Wemm 	for (es = execsw; *es; es++)
1852aa855a59SPeter Wemm 		if (*es != execsw_arg)
1853aa855a59SPeter Wemm 			count++;
1854a163d034SWarner Losh 	newexecsw = malloc(count * sizeof(*es), M_TEMP, M_WAITOK);
1855aa855a59SPeter Wemm 	xs = newexecsw;
1856aa855a59SPeter Wemm 	for (es = execsw; *es; es++)
1857aa855a59SPeter Wemm 		if (*es != execsw_arg)
1858aa855a59SPeter Wemm 			*xs++ = *es;
1859aa855a59SPeter Wemm 	*xs = NULL;
1860aa855a59SPeter Wemm 	if (execsw)
1861aa855a59SPeter Wemm 		free(execsw, M_TEMP);
1862aa855a59SPeter Wemm 	execsw = newexecsw;
1863a7cddfedSJake Burkholder 	return (0);
1864aa855a59SPeter Wemm }
186533621dfcSEdward Tomasz Napierala 
186633621dfcSEdward Tomasz Napierala /*
186733621dfcSEdward Tomasz Napierala  * Write out a core segment to the compression stream.
186833621dfcSEdward Tomasz Napierala  */
186933621dfcSEdward Tomasz Napierala static int
187033621dfcSEdward Tomasz Napierala compress_chunk(struct coredump_params *p, char *base, char *buf, u_int len)
187133621dfcSEdward Tomasz Napierala {
187233621dfcSEdward Tomasz Napierala 	u_int chunk_len;
187333621dfcSEdward Tomasz Napierala 	int error;
187433621dfcSEdward Tomasz Napierala 
187533621dfcSEdward Tomasz Napierala 	while (len > 0) {
187633621dfcSEdward Tomasz Napierala 		chunk_len = MIN(len, CORE_BUF_SIZE);
187733621dfcSEdward Tomasz Napierala 
187833621dfcSEdward Tomasz Napierala 		/*
187933621dfcSEdward Tomasz Napierala 		 * We can get EFAULT error here.
188033621dfcSEdward Tomasz Napierala 		 * In that case zero out the current chunk of the segment.
188133621dfcSEdward Tomasz Napierala 		 */
188233621dfcSEdward Tomasz Napierala 		error = copyin(base, buf, chunk_len);
188333621dfcSEdward Tomasz Napierala 		if (error != 0)
188433621dfcSEdward Tomasz Napierala 			bzero(buf, chunk_len);
188533621dfcSEdward Tomasz Napierala 		error = compressor_write(p->comp, buf, chunk_len);
188633621dfcSEdward Tomasz Napierala 		if (error != 0)
188733621dfcSEdward Tomasz Napierala 			break;
188833621dfcSEdward Tomasz Napierala 		base += chunk_len;
188933621dfcSEdward Tomasz Napierala 		len -= chunk_len;
189033621dfcSEdward Tomasz Napierala 	}
189133621dfcSEdward Tomasz Napierala 	return (error);
189233621dfcSEdward Tomasz Napierala }
189333621dfcSEdward Tomasz Napierala 
189433621dfcSEdward Tomasz Napierala int
189533621dfcSEdward Tomasz Napierala core_write(struct coredump_params *p, const void *base, size_t len,
189633621dfcSEdward Tomasz Napierala     off_t offset, enum uio_seg seg, size_t *resid)
189733621dfcSEdward Tomasz Napierala {
189833621dfcSEdward Tomasz Napierala 
189933621dfcSEdward Tomasz Napierala 	return (vn_rdwr_inchunks(UIO_WRITE, p->vp, __DECONST(void *, base),
190033621dfcSEdward Tomasz Napierala 	    len, offset, seg, IO_UNIT | IO_DIRECT | IO_RANGELOCKED,
190133621dfcSEdward Tomasz Napierala 	    p->active_cred, p->file_cred, resid, p->td));
190233621dfcSEdward Tomasz Napierala }
190333621dfcSEdward Tomasz Napierala 
190433621dfcSEdward Tomasz Napierala int
190533621dfcSEdward Tomasz Napierala core_output(char *base, size_t len, off_t offset, struct coredump_params *p,
190633621dfcSEdward Tomasz Napierala     void *tmpbuf)
190733621dfcSEdward Tomasz Napierala {
190833621dfcSEdward Tomasz Napierala 	vm_map_t map;
190933621dfcSEdward Tomasz Napierala 	struct mount *mp;
191033621dfcSEdward Tomasz Napierala 	size_t resid, runlen;
191133621dfcSEdward Tomasz Napierala 	int error;
191233621dfcSEdward Tomasz Napierala 	bool success;
191333621dfcSEdward Tomasz Napierala 
191433621dfcSEdward Tomasz Napierala 	KASSERT((uintptr_t)base % PAGE_SIZE == 0,
191533621dfcSEdward Tomasz Napierala 	    ("%s: user address %p is not page-aligned", __func__, base));
191633621dfcSEdward Tomasz Napierala 
191733621dfcSEdward Tomasz Napierala 	if (p->comp != NULL)
191833621dfcSEdward Tomasz Napierala 		return (compress_chunk(p, base, tmpbuf, len));
191933621dfcSEdward Tomasz Napierala 
192033621dfcSEdward Tomasz Napierala 	map = &p->td->td_proc->p_vmspace->vm_map;
192133621dfcSEdward Tomasz Napierala 	for (; len > 0; base += runlen, offset += runlen, len -= runlen) {
192233621dfcSEdward Tomasz Napierala 		/*
192333621dfcSEdward Tomasz Napierala 		 * Attempt to page in all virtual pages in the range.  If a
192433621dfcSEdward Tomasz Napierala 		 * virtual page is not backed by the pager, it is represented as
192533621dfcSEdward Tomasz Napierala 		 * a hole in the file.  This can occur with zero-filled
192633621dfcSEdward Tomasz Napierala 		 * anonymous memory or truncated files, for example.
192733621dfcSEdward Tomasz Napierala 		 */
192833621dfcSEdward Tomasz Napierala 		for (runlen = 0; runlen < len; runlen += PAGE_SIZE) {
192933621dfcSEdward Tomasz Napierala 			error = vm_fault(map, (uintptr_t)base + runlen,
193033621dfcSEdward Tomasz Napierala 			    VM_PROT_READ, VM_FAULT_NOFILL, NULL);
193133621dfcSEdward Tomasz Napierala 			if (runlen == 0)
193233621dfcSEdward Tomasz Napierala 				success = error == KERN_SUCCESS;
193333621dfcSEdward Tomasz Napierala 			else if ((error == KERN_SUCCESS) != success)
193433621dfcSEdward Tomasz Napierala 				break;
193533621dfcSEdward Tomasz Napierala 		}
193633621dfcSEdward Tomasz Napierala 
193733621dfcSEdward Tomasz Napierala 		if (success) {
193833621dfcSEdward Tomasz Napierala 			error = core_write(p, base, runlen, offset,
193933621dfcSEdward Tomasz Napierala 			    UIO_USERSPACE, &resid);
194033621dfcSEdward Tomasz Napierala 			if (error != 0) {
194133621dfcSEdward Tomasz Napierala 				if (error != EFAULT)
194233621dfcSEdward Tomasz Napierala 					break;
194333621dfcSEdward Tomasz Napierala 
194433621dfcSEdward Tomasz Napierala 				/*
194533621dfcSEdward Tomasz Napierala 				 * EFAULT may be returned if the user mapping
194633621dfcSEdward Tomasz Napierala 				 * could not be accessed, e.g., because a mapped
194733621dfcSEdward Tomasz Napierala 				 * file has been truncated.  Skip the page if no
194833621dfcSEdward Tomasz Napierala 				 * progress was made, to protect against a
194933621dfcSEdward Tomasz Napierala 				 * hypothetical scenario where vm_fault() was
195033621dfcSEdward Tomasz Napierala 				 * successful but core_write() returns EFAULT
195133621dfcSEdward Tomasz Napierala 				 * anyway.
195233621dfcSEdward Tomasz Napierala 				 */
195333621dfcSEdward Tomasz Napierala 				runlen -= resid;
195433621dfcSEdward Tomasz Napierala 				if (runlen == 0) {
195533621dfcSEdward Tomasz Napierala 					success = false;
195633621dfcSEdward Tomasz Napierala 					runlen = PAGE_SIZE;
195733621dfcSEdward Tomasz Napierala 				}
195833621dfcSEdward Tomasz Napierala 			}
195933621dfcSEdward Tomasz Napierala 		}
196033621dfcSEdward Tomasz Napierala 		if (!success) {
196133621dfcSEdward Tomasz Napierala 			error = vn_start_write(p->vp, &mp, V_WAIT);
196233621dfcSEdward Tomasz Napierala 			if (error != 0)
196333621dfcSEdward Tomasz Napierala 				break;
196433621dfcSEdward Tomasz Napierala 			vn_lock(p->vp, LK_EXCLUSIVE | LK_RETRY);
196533621dfcSEdward Tomasz Napierala 			error = vn_truncate_locked(p->vp, offset + runlen,
196633621dfcSEdward Tomasz Napierala 			    false, p->td->td_ucred);
196733621dfcSEdward Tomasz Napierala 			VOP_UNLOCK(p->vp);
196833621dfcSEdward Tomasz Napierala 			vn_finished_write(mp);
196933621dfcSEdward Tomasz Napierala 			if (error != 0)
197033621dfcSEdward Tomasz Napierala 				break;
197133621dfcSEdward Tomasz Napierala 		}
197233621dfcSEdward Tomasz Napierala 	}
197333621dfcSEdward Tomasz Napierala 	return (error);
197433621dfcSEdward Tomasz Napierala }
197533621dfcSEdward Tomasz Napierala 
197633621dfcSEdward Tomasz Napierala /*
197733621dfcSEdward Tomasz Napierala  * Drain into a core file.
197833621dfcSEdward Tomasz Napierala  */
197933621dfcSEdward Tomasz Napierala int
198033621dfcSEdward Tomasz Napierala sbuf_drain_core_output(void *arg, const char *data, int len)
198133621dfcSEdward Tomasz Napierala {
198233621dfcSEdward Tomasz Napierala 	struct coredump_params *p;
198333621dfcSEdward Tomasz Napierala 	int error, locked;
198433621dfcSEdward Tomasz Napierala 
198533621dfcSEdward Tomasz Napierala 	p = (struct coredump_params *)arg;
198633621dfcSEdward Tomasz Napierala 
198733621dfcSEdward Tomasz Napierala 	/*
198833621dfcSEdward Tomasz Napierala 	 * Some kern_proc out routines that print to this sbuf may
198933621dfcSEdward Tomasz Napierala 	 * call us with the process lock held. Draining with the
199033621dfcSEdward Tomasz Napierala 	 * non-sleepable lock held is unsafe. The lock is needed for
199133621dfcSEdward Tomasz Napierala 	 * those routines when dumping a live process. In our case we
199233621dfcSEdward Tomasz Napierala 	 * can safely release the lock before draining and acquire
199333621dfcSEdward Tomasz Napierala 	 * again after.
199433621dfcSEdward Tomasz Napierala 	 */
199533621dfcSEdward Tomasz Napierala 	locked = PROC_LOCKED(p->td->td_proc);
199633621dfcSEdward Tomasz Napierala 	if (locked)
199733621dfcSEdward Tomasz Napierala 		PROC_UNLOCK(p->td->td_proc);
199833621dfcSEdward Tomasz Napierala 	if (p->comp != NULL)
199933621dfcSEdward Tomasz Napierala 		error = compressor_write(p->comp, __DECONST(char *, data), len);
200033621dfcSEdward Tomasz Napierala 	else
200133621dfcSEdward Tomasz Napierala 		error = core_write(p, __DECONST(void *, data), len, p->offset,
200233621dfcSEdward Tomasz Napierala 		    UIO_SYSSPACE, NULL);
200333621dfcSEdward Tomasz Napierala 	if (locked)
200433621dfcSEdward Tomasz Napierala 		PROC_LOCK(p->td->td_proc);
200533621dfcSEdward Tomasz Napierala 	if (error != 0)
200633621dfcSEdward Tomasz Napierala 		return (-error);
200733621dfcSEdward Tomasz Napierala 	p->offset += len;
200833621dfcSEdward Tomasz Napierala 	return (len);
200933621dfcSEdward Tomasz Napierala }
201033621dfcSEdward Tomasz Napierala 
2011