xref: /illumos-gate/usr/src/uts/common/os/exec.c (revision 183ef8a1713ca188e24d970f22c6f9cc333007fd)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*	Copyright (c) 1988 AT&T	*/
28 /*	  All Rights Reserved  	*/
29 
30 #include <sys/types.h>
31 #include <sys/param.h>
32 #include <sys/sysmacros.h>
33 #include <sys/systm.h>
34 #include <sys/signal.h>
35 #include <sys/cred_impl.h>
36 #include <sys/policy.h>
37 #include <sys/user.h>
38 #include <sys/errno.h>
39 #include <sys/file.h>
40 #include <sys/vfs.h>
41 #include <sys/vnode.h>
42 #include <sys/mman.h>
43 #include <sys/acct.h>
44 #include <sys/cpuvar.h>
45 #include <sys/proc.h>
46 #include <sys/cmn_err.h>
47 #include <sys/debug.h>
48 #include <sys/pathname.h>
49 #include <sys/vm.h>
50 #include <sys/lgrp.h>
51 #include <sys/vtrace.h>
52 #include <sys/exec.h>
53 #include <sys/exechdr.h>
54 #include <sys/kmem.h>
55 #include <sys/prsystm.h>
56 #include <sys/modctl.h>
57 #include <sys/vmparam.h>
58 #include <sys/door.h>
59 #include <sys/schedctl.h>
60 #include <sys/utrap.h>
61 #include <sys/systeminfo.h>
62 #include <sys/stack.h>
63 #include <sys/rctl.h>
64 #include <sys/dtrace.h>
65 #include <sys/lwpchan_impl.h>
66 #include <sys/pool.h>
67 #include <sys/sdt.h>
68 #include <sys/brand.h>
69 
70 #include <c2/audit.h>
71 
72 #include <vm/hat.h>
73 #include <vm/anon.h>
74 #include <vm/as.h>
75 #include <vm/seg.h>
76 #include <vm/seg_vn.h>
77 
78 #define	PRIV_RESET		0x01	/* needs to reset privs */
79 #define	PRIV_SETID		0x02	/* needs to change uids */
80 #define	PRIV_SETUGID		0x04	/* is setuid/setgid/forced privs */
81 #define	PRIV_INCREASE		0x08	/* child runs with more privs */
82 #define	MAC_FLAGS		0x10	/* need to adjust MAC flags */
83 
84 static int execsetid(struct vnode *, struct vattr *, uid_t *, uid_t *);
85 static int hold_execsw(struct execsw *);
86 
87 uint_t auxv_hwcap = 0;	/* auxv AT_SUN_HWCAP value; determined on the fly */
88 #if defined(_SYSCALL32_IMPL)
89 uint_t auxv_hwcap32 = 0;	/* 32-bit version of auxv_hwcap */
90 #endif
91 
92 #define	PSUIDFLAGS		(SNOCD|SUGID)
93 
94 /*
95  * exece() - system call wrapper around exec_common()
96  */
97 int
98 exece(const char *fname, const char **argp, const char **envp)
99 {
100 	int error;
101 
102 	error = exec_common(fname, argp, envp, EBA_NONE);
103 	return (error ? (set_errno(error)) : 0);
104 }
105 
106 int
107 exec_common(const char *fname, const char **argp, const char **envp,
108     int brand_action)
109 {
110 	vnode_t *vp = NULL, *dir = NULL, *tmpvp = NULL;
111 	proc_t *p = ttoproc(curthread);
112 	klwp_t *lwp = ttolwp(curthread);
113 	struct user *up = PTOU(p);
114 	long execsz;		/* temporary count of exec size */
115 	int i;
116 	int error;
117 	char exec_file[MAXCOMLEN+1];
118 	struct pathname pn;
119 	struct pathname resolvepn;
120 	struct uarg args;
121 	struct execa ua;
122 	k_sigset_t savedmask;
123 	lwpdir_t *lwpdir = NULL;
124 	tidhash_t *tidhash;
125 	lwpdir_t *old_lwpdir = NULL;
126 	uint_t old_lwpdir_sz;
127 	tidhash_t *old_tidhash;
128 	uint_t old_tidhash_sz;
129 	ret_tidhash_t *ret_tidhash;
130 	lwpent_t *lep;
131 	boolean_t brandme = B_FALSE;
132 
133 	/*
134 	 * exec() is not supported for the /proc agent lwp.
135 	 */
136 	if (curthread == p->p_agenttp)
137 		return (ENOTSUP);
138 
139 	if (brand_action != EBA_NONE) {
140 		/*
141 		 * Brand actions are not supported for processes that are not
142 		 * running in a branded zone.
143 		 */
144 		if (!ZONE_IS_BRANDED(p->p_zone))
145 			return (ENOTSUP);
146 
147 		if (brand_action == EBA_NATIVE) {
148 			/* Only branded processes can be unbranded */
149 			if (!PROC_IS_BRANDED(p))
150 				return (ENOTSUP);
151 		} else {
152 			/* Only unbranded processes can be branded */
153 			if (PROC_IS_BRANDED(p))
154 				return (ENOTSUP);
155 			brandme = B_TRUE;
156 		}
157 	} else {
158 		/*
159 		 * If this is a native zone, or if the process is already
160 		 * branded, then we don't need to do anything.  If this is
161 		 * a native process in a branded zone, we need to brand the
162 		 * process as it exec()s the new binary.
163 		 */
164 		if (ZONE_IS_BRANDED(p->p_zone) && !PROC_IS_BRANDED(p))
165 			brandme = B_TRUE;
166 	}
167 
168 	/*
169 	 * Inform /proc that an exec() has started.
170 	 * Hold signals that are ignored by default so that we will
171 	 * not be interrupted by a signal that will be ignored after
172 	 * successful completion of gexec().
173 	 */
174 	mutex_enter(&p->p_lock);
175 	prexecstart();
176 	schedctl_finish_sigblock(curthread);
177 	savedmask = curthread->t_hold;
178 	sigorset(&curthread->t_hold, &ignoredefault);
179 	mutex_exit(&p->p_lock);
180 
181 	/*
182 	 * Look up path name and remember last component for later.
183 	 * To help coreadm expand its %d token, we attempt to save
184 	 * the directory containing the executable in p_execdir. The
185 	 * first call to lookuppn() may fail and return EINVAL because
186 	 * dirvpp is non-NULL. In that case, we make a second call to
187 	 * lookuppn() with dirvpp set to NULL; p_execdir will be NULL,
188 	 * but coreadm is allowed to expand %d to the empty string and
189 	 * there are other cases in which that failure may occur.
190 	 */
191 	if ((error = pn_get((char *)fname, UIO_USERSPACE, &pn)) != 0)
192 		goto out;
193 	pn_alloc(&resolvepn);
194 	if ((error = lookuppn(&pn, &resolvepn, FOLLOW, &dir, &vp)) != 0) {
195 		pn_free(&resolvepn);
196 		pn_free(&pn);
197 		if (error != EINVAL)
198 			goto out;
199 
200 		dir = NULL;
201 		if ((error = pn_get((char *)fname, UIO_USERSPACE, &pn)) != 0)
202 			goto out;
203 		pn_alloc(&resolvepn);
204 		if ((error = lookuppn(&pn, &resolvepn, FOLLOW, NULLVPP,
205 		    &vp)) != 0) {
206 			pn_free(&resolvepn);
207 			pn_free(&pn);
208 			goto out;
209 		}
210 	}
211 	if (vp == NULL) {
212 		if (dir != NULL)
213 			VN_RELE(dir);
214 		error = ENOENT;
215 		pn_free(&resolvepn);
216 		pn_free(&pn);
217 		goto out;
218 	}
219 
220 	if ((error = secpolicy_basic_exec(CRED(), vp)) != 0) {
221 		if (dir != NULL)
222 			VN_RELE(dir);
223 		pn_free(&resolvepn);
224 		pn_free(&pn);
225 		VN_RELE(vp);
226 		goto out;
227 	}
228 
229 	/*
230 	 * We do not allow executing files in attribute directories.
231 	 * We test this by determining whether the resolved path
232 	 * contains a "/" when we're in an attribute directory;
233 	 * only if the pathname does not contain a "/" the resolved path
234 	 * points to a file in the current working (attribute) directory.
235 	 */
236 	if ((p->p_user.u_cdir->v_flag & V_XATTRDIR) != 0 &&
237 	    strchr(resolvepn.pn_path, '/') == NULL) {
238 		if (dir != NULL)
239 			VN_RELE(dir);
240 		error = EACCES;
241 		pn_free(&resolvepn);
242 		pn_free(&pn);
243 		VN_RELE(vp);
244 		goto out;
245 	}
246 
247 	bzero(exec_file, MAXCOMLEN+1);
248 	(void) strncpy(exec_file, pn.pn_path, MAXCOMLEN);
249 	bzero(&args, sizeof (args));
250 	args.pathname = resolvepn.pn_path;
251 	/* don't free resolvepn until we are done with args */
252 	pn_free(&pn);
253 
254 	/*
255 	 * Specific exec handlers, or policies determined via
256 	 * /etc/system may override the historical default.
257 	 */
258 	args.stk_prot = PROT_ZFOD;
259 	args.dat_prot = PROT_ZFOD;
260 
261 	CPU_STATS_ADD_K(sys, sysexec, 1);
262 	DTRACE_PROC1(exec, char *, args.pathname);
263 
264 	ua.fname = fname;
265 	ua.argp = argp;
266 	ua.envp = envp;
267 
268 	/* If necessary, brand this process before we start the exec. */
269 	if (brandme)
270 		brand_setbrand(p);
271 
272 	if ((error = gexec(&vp, &ua, &args, NULL, 0, &execsz,
273 	    exec_file, p->p_cred, brand_action)) != 0) {
274 		if (brandme)
275 			brand_clearbrand(p);
276 		VN_RELE(vp);
277 		if (dir != NULL)
278 			VN_RELE(dir);
279 		pn_free(&resolvepn);
280 		goto fail;
281 	}
282 
283 	/*
284 	 * Free floating point registers (sun4u only)
285 	 */
286 	ASSERT(lwp != NULL);
287 	lwp_freeregs(lwp, 1);
288 
289 	/*
290 	 * Free thread and process context ops.
291 	 */
292 	if (curthread->t_ctx)
293 		freectx(curthread, 1);
294 	if (p->p_pctx)
295 		freepctx(p, 1);
296 
297 	/*
298 	 * Remember file name for accounting; clear any cached DTrace predicate.
299 	 */
300 	up->u_acflag &= ~AFORK;
301 	bcopy(exec_file, up->u_comm, MAXCOMLEN+1);
302 	curthread->t_predcache = NULL;
303 
304 	/*
305 	 * Clear contract template state
306 	 */
307 	lwp_ctmpl_clear(lwp);
308 
309 	/*
310 	 * Save the directory in which we found the executable for expanding
311 	 * the %d token used in core file patterns.
312 	 */
313 	mutex_enter(&p->p_lock);
314 	tmpvp = p->p_execdir;
315 	p->p_execdir = dir;
316 	if (p->p_execdir != NULL)
317 		VN_HOLD(p->p_execdir);
318 	mutex_exit(&p->p_lock);
319 
320 	if (tmpvp != NULL)
321 		VN_RELE(tmpvp);
322 
323 	/*
324 	 * Reset stack state to the user stack, clear set of signals
325 	 * caught on the signal stack, and reset list of signals that
326 	 * restart system calls; the new program's environment should
327 	 * not be affected by detritus from the old program.  Any
328 	 * pending held signals remain held, so don't clear t_hold.
329 	 */
330 	mutex_enter(&p->p_lock);
331 	lwp->lwp_oldcontext = 0;
332 	lwp->lwp_ustack = 0;
333 	lwp->lwp_old_stk_ctl = 0;
334 	sigemptyset(&up->u_signodefer);
335 	sigemptyset(&up->u_sigonstack);
336 	sigemptyset(&up->u_sigresethand);
337 	lwp->lwp_sigaltstack.ss_sp = 0;
338 	lwp->lwp_sigaltstack.ss_size = 0;
339 	lwp->lwp_sigaltstack.ss_flags = SS_DISABLE;
340 
341 	/*
342 	 * Make saved resource limit == current resource limit.
343 	 */
344 	for (i = 0; i < RLIM_NLIMITS; i++) {
345 		/*CONSTCOND*/
346 		if (RLIM_SAVED(i)) {
347 			(void) rctl_rlimit_get(rctlproc_legacy[i], p,
348 			    &up->u_saved_rlimit[i]);
349 		}
350 	}
351 
352 	/*
353 	 * If the action was to catch the signal, then the action
354 	 * must be reset to SIG_DFL.
355 	 */
356 	sigdefault(p);
357 	p->p_flag &= ~(SNOWAIT|SJCTL);
358 	p->p_flag |= (SEXECED|SMSACCT|SMSFORK);
359 	up->u_signal[SIGCLD - 1] = SIG_DFL;
360 
361 	/*
362 	 * Delete the dot4 sigqueues/signotifies.
363 	 */
364 	sigqfree(p);
365 
366 	mutex_exit(&p->p_lock);
367 
368 	mutex_enter(&p->p_pflock);
369 	p->p_prof.pr_base = NULL;
370 	p->p_prof.pr_size = 0;
371 	p->p_prof.pr_off = 0;
372 	p->p_prof.pr_scale = 0;
373 	p->p_prof.pr_samples = 0;
374 	mutex_exit(&p->p_pflock);
375 
376 	ASSERT(curthread->t_schedctl == NULL);
377 
378 #if defined(__sparc)
379 	if (p->p_utraps != NULL)
380 		utrap_free(p);
381 #endif	/* __sparc */
382 
383 	/*
384 	 * Close all close-on-exec files.
385 	 */
386 	close_exec(P_FINFO(p));
387 	TRACE_2(TR_FAC_PROC, TR_PROC_EXEC, "proc_exec:p %p up %p", p, up);
388 
389 	/* Unbrand ourself if necessary. */
390 	if (PROC_IS_BRANDED(p) && (brand_action == EBA_NATIVE))
391 		brand_clearbrand(p);
392 
393 	setregs(&args);
394 
395 	/* Mark this as an executable vnode */
396 	mutex_enter(&vp->v_lock);
397 	vp->v_flag |= VVMEXEC;
398 	mutex_exit(&vp->v_lock);
399 
400 	VN_RELE(vp);
401 	if (dir != NULL)
402 		VN_RELE(dir);
403 	pn_free(&resolvepn);
404 
405 	/*
406 	 * Allocate a new lwp directory and lwpid hash table if necessary.
407 	 */
408 	if (curthread->t_tid != 1 || p->p_lwpdir_sz != 2) {
409 		lwpdir = kmem_zalloc(2 * sizeof (lwpdir_t), KM_SLEEP);
410 		lwpdir->ld_next = lwpdir + 1;
411 		tidhash = kmem_zalloc(2 * sizeof (tidhash_t), KM_SLEEP);
412 		if (p->p_lwpdir != NULL)
413 			lep = p->p_lwpdir[curthread->t_dslot].ld_entry;
414 		else
415 			lep = kmem_zalloc(sizeof (*lep), KM_SLEEP);
416 	}
417 
418 	if (PROC_IS_BRANDED(p))
419 		BROP(p)->b_exec();
420 
421 	mutex_enter(&p->p_lock);
422 	prbarrier(p);
423 
424 	/*
425 	 * Reset lwp id to the default value of 1.
426 	 * This is a single-threaded process now
427 	 * and lwp #1 is lwp_wait()able by default.
428 	 * The t_unpark flag should not be inherited.
429 	 */
430 	ASSERT(p->p_lwpcnt == 1 && p->p_zombcnt == 0);
431 	curthread->t_tid = 1;
432 	kpreempt_disable();
433 	ASSERT(curthread->t_lpl != NULL);
434 	p->p_t1_lgrpid = curthread->t_lpl->lpl_lgrpid;
435 	kpreempt_enable();
436 	if (p->p_tr_lgrpid != LGRP_NONE && p->p_tr_lgrpid != p->p_t1_lgrpid) {
437 		lgrp_update_trthr_migrations(1);
438 	}
439 	curthread->t_unpark = 0;
440 	curthread->t_proc_flag |= TP_TWAIT;
441 	curthread->t_proc_flag &= ~TP_DAEMON;	/* daemons shouldn't exec */
442 	p->p_lwpdaemon = 0;			/* but oh well ... */
443 	p->p_lwpid = 1;
444 
445 	/*
446 	 * Install the newly-allocated lwp directory and lwpid hash table
447 	 * and insert the current thread into the new hash table.
448 	 */
449 	if (lwpdir != NULL) {
450 		old_lwpdir = p->p_lwpdir;
451 		old_lwpdir_sz = p->p_lwpdir_sz;
452 		old_tidhash = p->p_tidhash;
453 		old_tidhash_sz = p->p_tidhash_sz;
454 		p->p_lwpdir = p->p_lwpfree = lwpdir;
455 		p->p_lwpdir_sz = 2;
456 		lep->le_thread = curthread;
457 		lep->le_lwpid = curthread->t_tid;
458 		lep->le_start = curthread->t_start;
459 		lwp_hash_in(p, lep, tidhash, 2, 0);
460 		p->p_tidhash = tidhash;
461 		p->p_tidhash_sz = 2;
462 	}
463 	ret_tidhash = p->p_ret_tidhash;
464 	p->p_ret_tidhash = NULL;
465 
466 	/*
467 	 * Restore the saved signal mask and
468 	 * inform /proc that the exec() has finished.
469 	 */
470 	curthread->t_hold = savedmask;
471 	prexecend();
472 	mutex_exit(&p->p_lock);
473 	if (old_lwpdir) {
474 		kmem_free(old_lwpdir, old_lwpdir_sz * sizeof (lwpdir_t));
475 		kmem_free(old_tidhash, old_tidhash_sz * sizeof (tidhash_t));
476 	}
477 	while (ret_tidhash != NULL) {
478 		ret_tidhash_t *next = ret_tidhash->rth_next;
479 		kmem_free(ret_tidhash->rth_tidhash,
480 		    ret_tidhash->rth_tidhash_sz * sizeof (tidhash_t));
481 		kmem_free(ret_tidhash, sizeof (*ret_tidhash));
482 		ret_tidhash = next;
483 	}
484 
485 	ASSERT(error == 0);
486 	DTRACE_PROC(exec__success);
487 	return (0);
488 
489 fail:
490 	DTRACE_PROC1(exec__failure, int, error);
491 out:		/* error return */
492 	mutex_enter(&p->p_lock);
493 	curthread->t_hold = savedmask;
494 	prexecend();
495 	mutex_exit(&p->p_lock);
496 	ASSERT(error != 0);
497 	return (error);
498 }
499 
500 
501 /*
502  * Perform generic exec duties and switchout to object-file specific
503  * handler.
504  */
505 int
506 gexec(
507 	struct vnode **vpp,
508 	struct execa *uap,
509 	struct uarg *args,
510 	struct intpdata *idatap,
511 	int level,
512 	long *execsz,
513 	caddr_t exec_file,
514 	struct cred *cred,
515 	int brand_action)
516 {
517 	struct vnode *vp, *execvp = NULL;
518 	proc_t *pp = ttoproc(curthread);
519 	struct execsw *eswp;
520 	int error = 0;
521 	int suidflags = 0;
522 	ssize_t resid;
523 	uid_t uid, gid;
524 	struct vattr vattr;
525 	char magbuf[MAGIC_BYTES];
526 	int setid;
527 	cred_t *oldcred, *newcred = NULL;
528 	int privflags = 0;
529 	int setidfl;
530 
531 	/*
532 	 * If the SNOCD or SUGID flag is set, turn it off and remember the
533 	 * previous setting so we can restore it if we encounter an error.
534 	 */
535 	if (level == 0 && (pp->p_flag & PSUIDFLAGS)) {
536 		mutex_enter(&pp->p_lock);
537 		suidflags = pp->p_flag & PSUIDFLAGS;
538 		pp->p_flag &= ~PSUIDFLAGS;
539 		mutex_exit(&pp->p_lock);
540 	}
541 
542 	if ((error = execpermissions(*vpp, &vattr, args)) != 0)
543 		goto bad_noclose;
544 
545 	/* need to open vnode for stateful file systems */
546 	if ((error = VOP_OPEN(vpp, FREAD, CRED(), NULL)) != 0)
547 		goto bad_noclose;
548 	vp = *vpp;
549 
550 	/*
551 	 * Note: to support binary compatibility with SunOS a.out
552 	 * executables, we read in the first four bytes, as the
553 	 * magic number is in bytes 2-3.
554 	 */
555 	if (error = vn_rdwr(UIO_READ, vp, magbuf, sizeof (magbuf),
556 	    (offset_t)0, UIO_SYSSPACE, 0, (rlim64_t)0, CRED(), &resid))
557 		goto bad;
558 	if (resid != 0)
559 		goto bad;
560 
561 	if ((eswp = findexec_by_hdr(magbuf)) == NULL)
562 		goto bad;
563 
564 	if (level == 0 &&
565 	    (privflags = execsetid(vp, &vattr, &uid, &gid)) != 0) {
566 
567 		newcred = cred = crdup(cred);
568 
569 		/* If we can, drop the PA bit */
570 		if ((privflags & PRIV_RESET) != 0)
571 			priv_adjust_PA(cred);
572 
573 		if (privflags & PRIV_SETID) {
574 			cred->cr_uid = uid;
575 			cred->cr_gid = gid;
576 			cred->cr_suid = uid;
577 			cred->cr_sgid = gid;
578 		}
579 
580 		if (privflags & MAC_FLAGS) {
581 			if (!(CR_FLAGS(cred) & NET_MAC_AWARE_INHERIT))
582 				CR_FLAGS(cred) &= ~NET_MAC_AWARE;
583 			CR_FLAGS(cred) &= ~NET_MAC_AWARE_INHERIT;
584 		}
585 
586 		/*
587 		 * Implement the privilege updates:
588 		 *
589 		 * Restrict with L:
590 		 *
591 		 *	I' = I & L
592 		 *
593 		 *	E' = P' = (I' + F) & A
594 		 *
595 		 * But if running under ptrace, we cap I with P.
596 		 */
597 		if ((privflags & PRIV_RESET) != 0) {
598 			if ((privflags & PRIV_INCREASE) != 0 &&
599 			    (pp->p_proc_flag & P_PR_PTRACE) != 0)
600 				priv_intersect(&CR_OPPRIV(cred),
601 				    &CR_IPRIV(cred));
602 			priv_intersect(&CR_LPRIV(cred), &CR_IPRIV(cred));
603 			CR_EPRIV(cred) = CR_PPRIV(cred) = CR_IPRIV(cred);
604 			priv_adjust_PA(cred);
605 		}
606 	}
607 
608 	/* SunOS 4.x buy-back */
609 	if ((vp->v_vfsp->vfs_flag & VFS_NOSETUID) &&
610 	    (vattr.va_mode & (VSUID|VSGID))) {
611 		char path[MAXNAMELEN];
612 		refstr_t *mntpt = NULL;
613 		int ret = -1;
614 
615 		bzero(path, sizeof (path));
616 		zone_hold(pp->p_zone);
617 
618 		ret = vnodetopath(pp->p_zone->zone_rootvp, vp, path,
619 		    sizeof (path), cred);
620 
621 		/* fallback to mountpoint if a path can't be found */
622 		if ((ret != 0) || (ret == 0 && path[0] == '\0'))
623 			mntpt = vfs_getmntpoint(vp->v_vfsp);
624 
625 		if (mntpt == NULL)
626 			zcmn_err(pp->p_zone->zone_id, CE_NOTE,
627 			    "!uid %d: setuid execution not allowed, "
628 			    "file=%s", cred->cr_uid, path);
629 		else
630 			zcmn_err(pp->p_zone->zone_id, CE_NOTE,
631 			    "!uid %d: setuid execution not allowed, "
632 			    "fs=%s, file=%s", cred->cr_uid,
633 			    ZONE_PATH_TRANSLATE(refstr_value(mntpt),
634 			    pp->p_zone), exec_file);
635 
636 		if (!INGLOBALZONE(pp)) {
637 			/* zone_rootpath always has trailing / */
638 			if (mntpt == NULL)
639 				cmn_err(CE_NOTE, "!zone: %s, uid: %d "
640 				    "setuid execution not allowed, file=%s%s",
641 				    pp->p_zone->zone_name, cred->cr_uid,
642 				    pp->p_zone->zone_rootpath, path + 1);
643 			else
644 				cmn_err(CE_NOTE, "!zone: %s, uid: %d "
645 				    "setuid execution not allowed, fs=%s, "
646 				    "file=%s", pp->p_zone->zone_name,
647 				    cred->cr_uid, refstr_value(mntpt),
648 				    exec_file);
649 		}
650 
651 		if (mntpt != NULL)
652 			refstr_rele(mntpt);
653 
654 		zone_rele(pp->p_zone);
655 	}
656 
657 	/*
658 	 * execsetid() told us whether or not we had to change the
659 	 * credentials of the process.  In privflags, it told us
660 	 * whether we gained any privileges or executed a set-uid executable.
661 	 */
662 	setid = (privflags & (PRIV_SETUGID|PRIV_INCREASE));
663 
664 	/*
665 	 * Use /etc/system variable to determine if the stack
666 	 * should be marked as executable by default.
667 	 */
668 	if (noexec_user_stack)
669 		args->stk_prot &= ~PROT_EXEC;
670 
671 	args->execswp = eswp; /* Save execsw pointer in uarg for exec_func */
672 	args->ex_vp = vp;
673 
674 	/*
675 	 * Traditionally, the setid flags told the sub processes whether
676 	 * the file just executed was set-uid or set-gid; this caused
677 	 * some confusion as the 'setid' flag did not match the SUGID
678 	 * process flag which is only set when the uids/gids do not match.
679 	 * A script set-gid/set-uid to the real uid/gid would start with
680 	 * /dev/fd/X but an executable would happily trust LD_LIBRARY_PATH.
681 	 * Now we flag those cases where the calling process cannot
682 	 * be trusted to influence the newly exec'ed process, either
683 	 * because it runs with more privileges or when the uids/gids
684 	 * do in fact not match.
685 	 * This also makes the runtime linker agree with the on exec
686 	 * values of SNOCD and SUGID.
687 	 */
688 	setidfl = 0;
689 	if (cred->cr_uid != cred->cr_ruid || (cred->cr_rgid != cred->cr_gid &&
690 	    !supgroupmember(cred->cr_gid, cred))) {
691 		setidfl |= EXECSETID_UGIDS;
692 	}
693 	if (setid & PRIV_SETUGID)
694 		setidfl |= EXECSETID_SETID;
695 	if (setid & PRIV_INCREASE)
696 		setidfl |= EXECSETID_PRIVS;
697 
698 	execvp = pp->p_exec;
699 	if (execvp)
700 		VN_HOLD(execvp);
701 
702 	error = (*eswp->exec_func)(vp, uap, args, idatap, level, execsz,
703 	    setidfl, exec_file, cred, brand_action);
704 	rw_exit(eswp->exec_lock);
705 	if (error != 0) {
706 		if (execvp)
707 			VN_RELE(execvp);
708 		/*
709 		 * If this process's p_exec has been set to the vp of
710 		 * the executable by exec_func, we will return without
711 		 * calling VOP_CLOSE because proc_exit will close it
712 		 * on exit.
713 		 */
714 		if (pp->p_exec == vp)
715 			goto bad_noclose;
716 		else
717 			goto bad;
718 	}
719 
720 	if (level == 0) {
721 		if (execvp != NULL) {
722 			/*
723 			 * Close the previous executable only if we are
724 			 * at level 0.
725 			 */
726 			(void) VOP_CLOSE(execvp, FREAD, 1, (offset_t)0,
727 			    cred, NULL);
728 		}
729 
730 		mutex_enter(&pp->p_crlock);
731 		if (newcred != NULL) {
732 			/*
733 			 * Free the old credentials, and set the new ones.
734 			 * Do this for both the process and the (single) thread.
735 			 */
736 			crfree(pp->p_cred);
737 			pp->p_cred = cred;	/* cred already held for proc */
738 			crhold(cred);		/* hold new cred for thread */
739 			/*
740 			 * DTrace accesses t_cred in probe context.  t_cred
741 			 * must always be either NULL, or point to a valid,
742 			 * allocated cred structure.
743 			 */
744 			oldcred = curthread->t_cred;
745 			curthread->t_cred = cred;
746 			crfree(oldcred);
747 
748 			if (priv_basic_test >= 0 &&
749 			    !PRIV_ISASSERT(&CR_IPRIV(newcred),
750 			    priv_basic_test)) {
751 				pid_t pid = pp->p_pid;
752 				char *fn = PTOU(pp)->u_comm;
753 
754 				cmn_err(CE_WARN, "%s[%d]: exec: basic_test "
755 				    "privilege removed from E/I", fn, pid);
756 			}
757 		}
758 		/*
759 		 * On emerging from a successful exec(), the saved
760 		 * uid and gid equal the effective uid and gid.
761 		 */
762 		cred->cr_suid = cred->cr_uid;
763 		cred->cr_sgid = cred->cr_gid;
764 
765 		/*
766 		 * If the real and effective ids do not match, this
767 		 * is a setuid process that should not dump core.
768 		 * The group comparison is tricky; we prevent the code
769 		 * from flagging SNOCD when executing with an effective gid
770 		 * which is a supplementary group.
771 		 */
772 		if (cred->cr_ruid != cred->cr_uid ||
773 		    (cred->cr_rgid != cred->cr_gid &&
774 		    !supgroupmember(cred->cr_gid, cred)) ||
775 		    (privflags & PRIV_INCREASE) != 0)
776 			suidflags = PSUIDFLAGS;
777 		else
778 			suidflags = 0;
779 
780 		mutex_exit(&pp->p_crlock);
781 		if (suidflags) {
782 			mutex_enter(&pp->p_lock);
783 			pp->p_flag |= suidflags;
784 			mutex_exit(&pp->p_lock);
785 		}
786 		if (setid && (pp->p_proc_flag & P_PR_PTRACE) == 0) {
787 			/*
788 			 * If process is traced via /proc, arrange to
789 			 * invalidate the associated /proc vnode.
790 			 */
791 			if (pp->p_plist || (pp->p_proc_flag & P_PR_TRACE))
792 				args->traceinval = 1;
793 		}
794 		if (pp->p_proc_flag & P_PR_PTRACE)
795 			psignal(pp, SIGTRAP);
796 		if (args->traceinval)
797 			prinvalidate(&pp->p_user);
798 	}
799 	if (execvp)
800 		VN_RELE(execvp);
801 	return (0);
802 
803 bad:
804 	(void) VOP_CLOSE(vp, FREAD, 1, (offset_t)0, cred, NULL);
805 
806 bad_noclose:
807 	if (newcred != NULL)
808 		crfree(newcred);
809 	if (error == 0)
810 		error = ENOEXEC;
811 
812 	if (suidflags) {
813 		mutex_enter(&pp->p_lock);
814 		pp->p_flag |= suidflags;
815 		mutex_exit(&pp->p_lock);
816 	}
817 	return (error);
818 }
819 
820 extern char *execswnames[];
821 
822 struct execsw *
823 allocate_execsw(char *name, char *magic, size_t magic_size)
824 {
825 	int i, j;
826 	char *ename;
827 	char *magicp;
828 
829 	mutex_enter(&execsw_lock);
830 	for (i = 0; i < nexectype; i++) {
831 		if (execswnames[i] == NULL) {
832 			ename = kmem_alloc(strlen(name) + 1, KM_SLEEP);
833 			(void) strcpy(ename, name);
834 			execswnames[i] = ename;
835 			/*
836 			 * Set the magic number last so that we
837 			 * don't need to hold the execsw_lock in
838 			 * findexectype().
839 			 */
840 			magicp = kmem_alloc(magic_size, KM_SLEEP);
841 			for (j = 0; j < magic_size; j++)
842 				magicp[j] = magic[j];
843 			execsw[i].exec_magic = magicp;
844 			mutex_exit(&execsw_lock);
845 			return (&execsw[i]);
846 		}
847 	}
848 	mutex_exit(&execsw_lock);
849 	return (NULL);
850 }
851 
852 /*
853  * Find the exec switch table entry with the corresponding magic string.
854  */
855 struct execsw *
856 findexecsw(char *magic)
857 {
858 	struct execsw *eswp;
859 
860 	for (eswp = execsw; eswp < &execsw[nexectype]; eswp++) {
861 		ASSERT(eswp->exec_maglen <= MAGIC_BYTES);
862 		if (magic && eswp->exec_maglen != 0 &&
863 		    bcmp(magic, eswp->exec_magic, eswp->exec_maglen) == 0)
864 			return (eswp);
865 	}
866 	return (NULL);
867 }
868 
869 /*
870  * Find the execsw[] index for the given exec header string by looking for the
871  * magic string at a specified offset and length for each kind of executable
872  * file format until one matches.  If no execsw[] entry is found, try to
873  * autoload a module for this magic string.
874  */
875 struct execsw *
876 findexec_by_hdr(char *header)
877 {
878 	struct execsw *eswp;
879 
880 	for (eswp = execsw; eswp < &execsw[nexectype]; eswp++) {
881 		ASSERT(eswp->exec_maglen <= MAGIC_BYTES);
882 		if (header && eswp->exec_maglen != 0 &&
883 		    bcmp(&header[eswp->exec_magoff], eswp->exec_magic,
884 		    eswp->exec_maglen) == 0) {
885 			if (hold_execsw(eswp) != 0)
886 				return (NULL);
887 			return (eswp);
888 		}
889 	}
890 	return (NULL);	/* couldn't find the type */
891 }
892 
893 /*
894  * Find the execsw[] index for the given magic string.  If no execsw[] entry
895  * is found, try to autoload a module for this magic string.
896  */
897 struct execsw *
898 findexec_by_magic(char *magic)
899 {
900 	struct execsw *eswp;
901 
902 	for (eswp = execsw; eswp < &execsw[nexectype]; eswp++) {
903 		ASSERT(eswp->exec_maglen <= MAGIC_BYTES);
904 		if (magic && eswp->exec_maglen != 0 &&
905 		    bcmp(magic, eswp->exec_magic, eswp->exec_maglen) == 0) {
906 			if (hold_execsw(eswp) != 0)
907 				return (NULL);
908 			return (eswp);
909 		}
910 	}
911 	return (NULL);	/* couldn't find the type */
912 }
913 
914 static int
915 hold_execsw(struct execsw *eswp)
916 {
917 	char *name;
918 
919 	rw_enter(eswp->exec_lock, RW_READER);
920 	while (!LOADED_EXEC(eswp)) {
921 		rw_exit(eswp->exec_lock);
922 		name = execswnames[eswp-execsw];
923 		ASSERT(name);
924 		if (modload("exec", name) == -1)
925 			return (-1);
926 		rw_enter(eswp->exec_lock, RW_READER);
927 	}
928 	return (0);
929 }
930 
931 static int
932 execsetid(struct vnode *vp, struct vattr *vattrp, uid_t *uidp, uid_t *gidp)
933 {
934 	proc_t *pp = ttoproc(curthread);
935 	uid_t uid, gid;
936 	cred_t *cr = pp->p_cred;
937 	int privflags = 0;
938 
939 	/*
940 	 * Remember credentials.
941 	 */
942 	uid = cr->cr_uid;
943 	gid = cr->cr_gid;
944 
945 	/* Will try to reset the PRIV_AWARE bit later. */
946 	if ((CR_FLAGS(cr) & (PRIV_AWARE|PRIV_AWARE_INHERIT)) == PRIV_AWARE)
947 		privflags |= PRIV_RESET;
948 
949 	if ((vp->v_vfsp->vfs_flag & VFS_NOSETUID) == 0) {
950 		/*
951 		 * Set-uid root execution only allowed if the limit set
952 		 * holds all unsafe privileges.
953 		 */
954 		if ((vattrp->va_mode & VSUID) && (vattrp->va_uid != 0 ||
955 		    priv_issubset(&priv_unsafe, &CR_LPRIV(cr)))) {
956 			uid = vattrp->va_uid;
957 			privflags |= PRIV_SETUGID;
958 		}
959 		if (vattrp->va_mode & VSGID) {
960 			gid = vattrp->va_gid;
961 			privflags |= PRIV_SETUGID;
962 		}
963 	}
964 
965 	/*
966 	 * Do we need to change our credential anyway?
967 	 * This is the case when E != I or P != I, as
968 	 * we need to do the assignments (with F empty and A full)
969 	 * Or when I is not a subset of L; in that case we need to
970 	 * enforce L.
971 	 *
972 	 *		I' = L & I
973 	 *
974 	 *		E' = P' = (I' + F) & A
975 	 * or
976 	 *		E' = P' = I'
977 	 */
978 	if (!priv_isequalset(&CR_EPRIV(cr), &CR_IPRIV(cr)) ||
979 	    !priv_issubset(&CR_IPRIV(cr), &CR_LPRIV(cr)) ||
980 	    !priv_isequalset(&CR_PPRIV(cr), &CR_IPRIV(cr)))
981 		privflags |= PRIV_RESET;
982 
983 	/* If MAC-aware flag(s) are on, need to update cred to remove. */
984 	if ((CR_FLAGS(cr) & NET_MAC_AWARE) ||
985 	    (CR_FLAGS(cr) & NET_MAC_AWARE_INHERIT))
986 		privflags |= MAC_FLAGS;
987 
988 	/*
989 	 * When we introduce the "forced" set then we will need
990 	 * to set PRIV_INCREASE here if I not a subset of P.
991 	 * If the "allowed" set is introduced we will need to do
992 	 * a similar thing; however, it seems more reasonable to
993 	 * have the allowed set reduce "L": script language interpreters
994 	 * would typically have an allowed set of "all".
995 	 */
996 
997 	/*
998 	 * Set setuid/setgid protections if no ptrace() compatibility.
999 	 * For privileged processes, honor setuid/setgid even in
1000 	 * the presence of ptrace() compatibility.
1001 	 */
1002 	if (((pp->p_proc_flag & P_PR_PTRACE) == 0 ||
1003 	    PRIV_POLICY_ONLY(cr, PRIV_PROC_OWNER, (uid == 0))) &&
1004 	    (cr->cr_uid != uid ||
1005 	    cr->cr_gid != gid ||
1006 	    cr->cr_suid != uid ||
1007 	    cr->cr_sgid != gid)) {
1008 		*uidp = uid;
1009 		*gidp = gid;
1010 		privflags |= PRIV_SETID;
1011 	}
1012 	return (privflags);
1013 }
1014 
1015 int
1016 execpermissions(struct vnode *vp, struct vattr *vattrp, struct uarg *args)
1017 {
1018 	int error;
1019 	proc_t *p = ttoproc(curthread);
1020 
1021 	vattrp->va_mask = AT_MODE | AT_UID | AT_GID | AT_SIZE;
1022 	if (error = VOP_GETATTR(vp, vattrp, ATTR_EXEC, p->p_cred, NULL))
1023 		return (error);
1024 	/*
1025 	 * Check the access mode.
1026 	 * If VPROC, ask /proc if the file is an object file.
1027 	 */
1028 	if ((error = VOP_ACCESS(vp, VEXEC, 0, p->p_cred, NULL)) != 0 ||
1029 	    !(vp->v_type == VREG || (vp->v_type == VPROC && pr_isobject(vp))) ||
1030 	    (vp->v_vfsp->vfs_flag & VFS_NOEXEC) != 0 ||
1031 	    (vattrp->va_mode & (VEXEC|(VEXEC>>3)|(VEXEC>>6))) == 0) {
1032 		if (error == 0)
1033 			error = EACCES;
1034 		return (error);
1035 	}
1036 
1037 	if ((p->p_plist || (p->p_proc_flag & (P_PR_PTRACE|P_PR_TRACE))) &&
1038 	    (error = VOP_ACCESS(vp, VREAD, 0, p->p_cred, NULL))) {
1039 		/*
1040 		 * If process is under ptrace(2) compatibility,
1041 		 * fail the exec(2).
1042 		 */
1043 		if (p->p_proc_flag & P_PR_PTRACE)
1044 			goto bad;
1045 		/*
1046 		 * Process is traced via /proc.
1047 		 * Arrange to invalidate the /proc vnode.
1048 		 */
1049 		args->traceinval = 1;
1050 	}
1051 	return (0);
1052 bad:
1053 	if (error == 0)
1054 		error = ENOEXEC;
1055 	return (error);
1056 }
1057 
1058 /*
1059  * Map a section of an executable file into the user's
1060  * address space.
1061  */
1062 int
1063 execmap(struct vnode *vp, caddr_t addr, size_t len, size_t zfodlen,
1064     off_t offset, int prot, int page, uint_t szc)
1065 {
1066 	int error = 0;
1067 	off_t oldoffset;
1068 	caddr_t zfodbase, oldaddr;
1069 	size_t end, oldlen;
1070 	size_t zfoddiff;
1071 	label_t ljb;
1072 	proc_t *p = ttoproc(curthread);
1073 
1074 	oldaddr = addr;
1075 	addr = (caddr_t)((uintptr_t)addr & (uintptr_t)PAGEMASK);
1076 	if (len) {
1077 		oldlen = len;
1078 		len += ((size_t)oldaddr - (size_t)addr);
1079 		oldoffset = offset;
1080 		offset = (off_t)((uintptr_t)offset & PAGEMASK);
1081 		if (page) {
1082 			spgcnt_t  prefltmem, availm, npages;
1083 			int preread;
1084 			uint_t mflag = MAP_PRIVATE | MAP_FIXED;
1085 
1086 			if ((prot & (PROT_WRITE | PROT_EXEC)) == PROT_EXEC) {
1087 				mflag |= MAP_TEXT;
1088 			} else {
1089 				mflag |= MAP_INITDATA;
1090 			}
1091 
1092 			if (valid_usr_range(addr, len, prot, p->p_as,
1093 			    p->p_as->a_userlimit) != RANGE_OKAY) {
1094 				error = ENOMEM;
1095 				goto bad;
1096 			}
1097 			if (error = VOP_MAP(vp, (offset_t)offset,
1098 			    p->p_as, &addr, len, prot, PROT_ALL,
1099 			    mflag, CRED(), NULL))
1100 				goto bad;
1101 
1102 			/*
1103 			 * If the segment can fit, then we prefault
1104 			 * the entire segment in.  This is based on the
1105 			 * model that says the best working set of a
1106 			 * small program is all of its pages.
1107 			 */
1108 			npages = (spgcnt_t)btopr(len);
1109 			prefltmem = freemem - desfree;
1110 			preread =
1111 			    (npages < prefltmem && len < PGTHRESH) ? 1 : 0;
1112 
1113 			/*
1114 			 * If we aren't prefaulting the segment,
1115 			 * increment "deficit", if necessary to ensure
1116 			 * that pages will become available when this
1117 			 * process starts executing.
1118 			 */
1119 			availm = freemem - lotsfree;
1120 			if (preread == 0 && npages > availm &&
1121 			    deficit < lotsfree) {
1122 				deficit += MIN((pgcnt_t)(npages - availm),
1123 				    lotsfree - deficit);
1124 			}
1125 
1126 			if (preread) {
1127 				TRACE_2(TR_FAC_PROC, TR_EXECMAP_PREREAD,
1128 				    "execmap preread:freemem %d size %lu",
1129 				    freemem, len);
1130 				(void) as_fault(p->p_as->a_hat, p->p_as,
1131 				    (caddr_t)addr, len, F_INVAL, S_READ);
1132 			}
1133 		} else {
1134 			if (valid_usr_range(addr, len, prot, p->p_as,
1135 			    p->p_as->a_userlimit) != RANGE_OKAY) {
1136 				error = ENOMEM;
1137 				goto bad;
1138 			}
1139 
1140 			if (error = as_map(p->p_as, addr, len,
1141 			    segvn_create, zfod_argsp))
1142 				goto bad;
1143 			/*
1144 			 * Read in the segment in one big chunk.
1145 			 */
1146 			if (error = vn_rdwr(UIO_READ, vp, (caddr_t)oldaddr,
1147 			    oldlen, (offset_t)oldoffset, UIO_USERSPACE, 0,
1148 			    (rlim64_t)0, CRED(), (ssize_t *)0))
1149 				goto bad;
1150 			/*
1151 			 * Now set protections.
1152 			 */
1153 			if (prot != PROT_ZFOD) {
1154 				(void) as_setprot(p->p_as, (caddr_t)addr,
1155 				    len, prot);
1156 			}
1157 		}
1158 	}
1159 
1160 	if (zfodlen) {
1161 		struct as *as = curproc->p_as;
1162 		struct seg *seg;
1163 		uint_t zprot = 0;
1164 
1165 		end = (size_t)addr + len;
1166 		zfodbase = (caddr_t)roundup(end, PAGESIZE);
1167 		zfoddiff = (uintptr_t)zfodbase - end;
1168 		if (zfoddiff) {
1169 			/*
1170 			 * Before we go to zero the remaining space on the last
1171 			 * page, make sure we have write permission.
1172 			 */
1173 
1174 			AS_LOCK_ENTER(as, &as->a_lock, RW_READER);
1175 			seg = as_segat(curproc->p_as, (caddr_t)end);
1176 			if (seg != NULL)
1177 				SEGOP_GETPROT(seg, (caddr_t)end, zfoddiff - 1,
1178 				    &zprot);
1179 			AS_LOCK_EXIT(as, &as->a_lock);
1180 
1181 			if (seg != NULL && (zprot & PROT_WRITE) == 0) {
1182 				(void) as_setprot(as, (caddr_t)end,
1183 				    zfoddiff - 1, zprot | PROT_WRITE);
1184 			}
1185 
1186 			if (on_fault(&ljb)) {
1187 				no_fault();
1188 				if (seg != NULL && (zprot & PROT_WRITE) == 0)
1189 					(void) as_setprot(as, (caddr_t)end,
1190 					    zfoddiff - 1, zprot);
1191 				error = EFAULT;
1192 				goto bad;
1193 			}
1194 			uzero((void *)end, zfoddiff);
1195 			no_fault();
1196 			if (seg != NULL && (zprot & PROT_WRITE) == 0)
1197 				(void) as_setprot(as, (caddr_t)end,
1198 				    zfoddiff - 1, zprot);
1199 		}
1200 		if (zfodlen > zfoddiff) {
1201 			struct segvn_crargs crargs =
1202 			    SEGVN_ZFOD_ARGS(PROT_ZFOD, PROT_ALL);
1203 
1204 			zfodlen -= zfoddiff;
1205 			if (valid_usr_range(zfodbase, zfodlen, prot, p->p_as,
1206 			    p->p_as->a_userlimit) != RANGE_OKAY) {
1207 				error = ENOMEM;
1208 				goto bad;
1209 			}
1210 			if (szc > 0) {
1211 				/*
1212 				 * ASSERT alignment because the mapelfexec()
1213 				 * caller for the szc > 0 case extended zfod
1214 				 * so it's end is pgsz aligned.
1215 				 */
1216 				size_t pgsz = page_get_pagesize(szc);
1217 				ASSERT(IS_P2ALIGNED(zfodbase + zfodlen, pgsz));
1218 
1219 				if (IS_P2ALIGNED(zfodbase, pgsz)) {
1220 					crargs.szc = szc;
1221 				} else {
1222 					crargs.szc = AS_MAP_HEAP;
1223 				}
1224 			} else {
1225 				crargs.szc = AS_MAP_NO_LPOOB;
1226 			}
1227 			if (error = as_map(p->p_as, (caddr_t)zfodbase,
1228 			    zfodlen, segvn_create, &crargs))
1229 				goto bad;
1230 			if (prot != PROT_ZFOD) {
1231 				(void) as_setprot(p->p_as, (caddr_t)zfodbase,
1232 				    zfodlen, prot);
1233 			}
1234 		}
1235 	}
1236 	return (0);
1237 bad:
1238 	return (error);
1239 }
1240 
1241 void
1242 setexecenv(struct execenv *ep)
1243 {
1244 	proc_t *p = ttoproc(curthread);
1245 	klwp_t *lwp = ttolwp(curthread);
1246 	struct vnode *vp;
1247 
1248 	p->p_bssbase = ep->ex_bssbase;
1249 	p->p_brkbase = ep->ex_brkbase;
1250 	p->p_brksize = ep->ex_brksize;
1251 	if (p->p_exec)
1252 		VN_RELE(p->p_exec);	/* out with the old */
1253 	vp = p->p_exec = ep->ex_vp;
1254 	if (vp != NULL)
1255 		VN_HOLD(vp);		/* in with the new */
1256 
1257 	lwp->lwp_sigaltstack.ss_sp = 0;
1258 	lwp->lwp_sigaltstack.ss_size = 0;
1259 	lwp->lwp_sigaltstack.ss_flags = SS_DISABLE;
1260 }
1261 
1262 int
1263 execopen(struct vnode **vpp, int *fdp)
1264 {
1265 	struct vnode *vp = *vpp;
1266 	file_t *fp;
1267 	int error = 0;
1268 	int filemode = FREAD;
1269 
1270 	VN_HOLD(vp);		/* open reference */
1271 	if (error = falloc(NULL, filemode, &fp, fdp)) {
1272 		VN_RELE(vp);
1273 		*fdp = -1;	/* just in case falloc changed value */
1274 		return (error);
1275 	}
1276 	if (error = VOP_OPEN(&vp, filemode, CRED(), NULL)) {
1277 		VN_RELE(vp);
1278 		setf(*fdp, NULL);
1279 		unfalloc(fp);
1280 		*fdp = -1;
1281 		return (error);
1282 	}
1283 	*vpp = vp;		/* vnode should not have changed */
1284 	fp->f_vnode = vp;
1285 	mutex_exit(&fp->f_tlock);
1286 	setf(*fdp, fp);
1287 	return (0);
1288 }
1289 
1290 int
1291 execclose(int fd)
1292 {
1293 	return (closeandsetf(fd, NULL));
1294 }
1295 
1296 
1297 /*
1298  * noexec stub function.
1299  */
1300 /*ARGSUSED*/
1301 int
1302 noexec(
1303     struct vnode *vp,
1304     struct execa *uap,
1305     struct uarg *args,
1306     struct intpdata *idatap,
1307     int level,
1308     long *execsz,
1309     int setid,
1310     caddr_t exec_file,
1311     struct cred *cred)
1312 {
1313 	cmn_err(CE_WARN, "missing exec capability for %s", uap->fname);
1314 	return (ENOEXEC);
1315 }
1316 
1317 /*
1318  * Support routines for building a user stack.
1319  *
1320  * execve(path, argv, envp) must construct a new stack with the specified
1321  * arguments and environment variables (see exec_args() for a description
1322  * of the user stack layout).  To do this, we copy the arguments and
1323  * environment variables from the old user address space into the kernel,
1324  * free the old as, create the new as, and copy our buffered information
1325  * to the new stack.  Our kernel buffer has the following structure:
1326  *
1327  *	+-----------------------+ <--- stk_base + stk_size
1328  *	| string offsets	|
1329  *	+-----------------------+ <--- stk_offp
1330  *	|			|
1331  *	| STK_AVAIL() space	|
1332  *	|			|
1333  *	+-----------------------+ <--- stk_strp
1334  *	| strings		|
1335  *	+-----------------------+ <--- stk_base
1336  *
1337  * When we add a string, we store the string's contents (including the null
1338  * terminator) at stk_strp, and we store the offset of the string relative to
1339  * stk_base at --stk_offp.  At strings are added, stk_strp increases and
1340  * stk_offp decreases.  The amount of space remaining, STK_AVAIL(), is just
1341  * the difference between these pointers.  If we run out of space, we return
1342  * an error and exec_args() starts all over again with a buffer twice as large.
1343  * When we're all done, the kernel buffer looks like this:
1344  *
1345  *	+-----------------------+ <--- stk_base + stk_size
1346  *	| argv[0] offset	|
1347  *	+-----------------------+
1348  *	| ...			|
1349  *	+-----------------------+
1350  *	| argv[argc-1] offset	|
1351  *	+-----------------------+
1352  *	| envp[0] offset	|
1353  *	+-----------------------+
1354  *	| ...			|
1355  *	+-----------------------+
1356  *	| envp[envc-1] offset	|
1357  *	+-----------------------+
1358  *	| AT_SUN_PLATFORM offset|
1359  *	+-----------------------+
1360  *	| AT_SUN_EXECNAME offset|
1361  *	+-----------------------+ <--- stk_offp
1362  *	|			|
1363  *	| STK_AVAIL() space	|
1364  *	|			|
1365  *	+-----------------------+ <--- stk_strp
1366  *	| AT_SUN_EXECNAME offset|
1367  *	+-----------------------+
1368  *	| AT_SUN_PLATFORM offset|
1369  *	+-----------------------+
1370  *	| envp[envc-1] string	|
1371  *	+-----------------------+
1372  *	| ...			|
1373  *	+-----------------------+
1374  *	| envp[0] string	|
1375  *	+-----------------------+
1376  *	| argv[argc-1] string	|
1377  *	+-----------------------+
1378  *	| ...			|
1379  *	+-----------------------+
1380  *	| argv[0] string	|
1381  *	+-----------------------+ <--- stk_base
1382  */
1383 
1384 #define	STK_AVAIL(args)		((char *)(args)->stk_offp - (args)->stk_strp)
1385 
1386 /*
1387  * Add a string to the stack.
1388  */
1389 static int
1390 stk_add(uarg_t *args, const char *sp, enum uio_seg segflg)
1391 {
1392 	int error;
1393 	size_t len;
1394 
1395 	if (STK_AVAIL(args) < sizeof (int))
1396 		return (E2BIG);
1397 	*--args->stk_offp = args->stk_strp - args->stk_base;
1398 
1399 	if (segflg == UIO_USERSPACE) {
1400 		error = copyinstr(sp, args->stk_strp, STK_AVAIL(args), &len);
1401 		if (error != 0)
1402 			return (error);
1403 	} else {
1404 		len = strlen(sp) + 1;
1405 		if (len > STK_AVAIL(args))
1406 			return (E2BIG);
1407 		bcopy(sp, args->stk_strp, len);
1408 	}
1409 
1410 	args->stk_strp += len;
1411 
1412 	return (0);
1413 }
1414 
1415 static int
1416 stk_getptr(uarg_t *args, char *src, char **dst)
1417 {
1418 	int error;
1419 
1420 	if (args->from_model == DATAMODEL_NATIVE) {
1421 		ulong_t ptr;
1422 		error = fulword(src, &ptr);
1423 		*dst = (caddr_t)ptr;
1424 	} else {
1425 		uint32_t ptr;
1426 		error = fuword32(src, &ptr);
1427 		*dst = (caddr_t)(uintptr_t)ptr;
1428 	}
1429 	return (error);
1430 }
1431 
1432 static int
1433 stk_putptr(uarg_t *args, char *addr, char *value)
1434 {
1435 	if (args->to_model == DATAMODEL_NATIVE)
1436 		return (sulword(addr, (ulong_t)value));
1437 	else
1438 		return (suword32(addr, (uint32_t)(uintptr_t)value));
1439 }
1440 
1441 static int
1442 stk_copyin(execa_t *uap, uarg_t *args, intpdata_t *intp, void **auxvpp)
1443 {
1444 	char *sp;
1445 	int argc, error;
1446 	int argv_empty = 0;
1447 	size_t ptrsize = args->from_ptrsize;
1448 	size_t size, pad;
1449 	char *argv = (char *)uap->argp;
1450 	char *envp = (char *)uap->envp;
1451 
1452 	/*
1453 	 * Copy interpreter's name and argument to argv[0] and argv[1].
1454 	 */
1455 	if (intp != NULL && intp->intp_name != NULL) {
1456 		if ((error = stk_add(args, intp->intp_name, UIO_SYSSPACE)) != 0)
1457 			return (error);
1458 		if (intp->intp_arg != NULL &&
1459 		    (error = stk_add(args, intp->intp_arg, UIO_SYSSPACE)) != 0)
1460 			return (error);
1461 		if (args->fname != NULL)
1462 			error = stk_add(args, args->fname, UIO_SYSSPACE);
1463 		else
1464 			error = stk_add(args, uap->fname, UIO_USERSPACE);
1465 		if (error)
1466 			return (error);
1467 
1468 		/*
1469 		 * Check for an empty argv[].
1470 		 */
1471 		if (stk_getptr(args, argv, &sp))
1472 			return (EFAULT);
1473 		if (sp == NULL)
1474 			argv_empty = 1;
1475 
1476 		argv += ptrsize;		/* ignore original argv[0] */
1477 	}
1478 
1479 	if (argv_empty == 0) {
1480 		/*
1481 		 * Add argv[] strings to the stack.
1482 		 */
1483 		for (;;) {
1484 			if (stk_getptr(args, argv, &sp))
1485 				return (EFAULT);
1486 			if (sp == NULL)
1487 				break;
1488 			if ((error = stk_add(args, sp, UIO_USERSPACE)) != 0)
1489 				return (error);
1490 			argv += ptrsize;
1491 		}
1492 	}
1493 	argc = (int *)(args->stk_base + args->stk_size) - args->stk_offp;
1494 	args->arglen = args->stk_strp - args->stk_base;
1495 
1496 	/*
1497 	 * Add environ[] strings to the stack.
1498 	 */
1499 	if (envp != NULL) {
1500 		for (;;) {
1501 			if (stk_getptr(args, envp, &sp))
1502 				return (EFAULT);
1503 			if (sp == NULL)
1504 				break;
1505 			if ((error = stk_add(args, sp, UIO_USERSPACE)) != 0)
1506 				return (error);
1507 			envp += ptrsize;
1508 		}
1509 	}
1510 	args->na = (int *)(args->stk_base + args->stk_size) - args->stk_offp;
1511 	args->ne = args->na - argc;
1512 
1513 	/*
1514 	 * Add AT_SUN_PLATFORM, AT_SUN_EXECNAME, AT_SUN_BRANDNAME, and
1515 	 * AT_SUN_EMULATOR strings to the stack.
1516 	 */
1517 	if (auxvpp != NULL && *auxvpp != NULL) {
1518 		if ((error = stk_add(args, platform, UIO_SYSSPACE)) != 0)
1519 			return (error);
1520 		if ((error = stk_add(args, args->pathname, UIO_SYSSPACE)) != 0)
1521 			return (error);
1522 		if (args->brandname != NULL &&
1523 		    (error = stk_add(args, args->brandname, UIO_SYSSPACE)) != 0)
1524 			return (error);
1525 		if (args->emulator != NULL &&
1526 		    (error = stk_add(args, args->emulator, UIO_SYSSPACE)) != 0)
1527 			return (error);
1528 	}
1529 
1530 	/*
1531 	 * Compute the size of the stack.  This includes all the pointers,
1532 	 * the space reserved for the aux vector, and all the strings.
1533 	 * The total number of pointers is args->na (which is argc + envc)
1534 	 * plus 4 more: (1) a pointer's worth of space for argc; (2) the NULL
1535 	 * after the last argument (i.e. argv[argc]); (3) the NULL after the
1536 	 * last environment variable (i.e. envp[envc]); and (4) the NULL after
1537 	 * all the strings, at the very top of the stack.
1538 	 */
1539 	size = (args->na + 4) * args->to_ptrsize + args->auxsize +
1540 	    (args->stk_strp - args->stk_base);
1541 
1542 	/*
1543 	 * Pad the string section with zeroes to align the stack size.
1544 	 */
1545 	pad = P2NPHASE(size, args->stk_align);
1546 
1547 	if (STK_AVAIL(args) < pad)
1548 		return (E2BIG);
1549 
1550 	args->usrstack_size = size + pad;
1551 
1552 	while (pad-- != 0)
1553 		*args->stk_strp++ = 0;
1554 
1555 	args->nc = args->stk_strp - args->stk_base;
1556 
1557 	return (0);
1558 }
1559 
1560 static int
1561 stk_copyout(uarg_t *args, char *usrstack, void **auxvpp, user_t *up)
1562 {
1563 	size_t ptrsize = args->to_ptrsize;
1564 	ssize_t pslen;
1565 	char *kstrp = args->stk_base;
1566 	char *ustrp = usrstack - args->nc - ptrsize;
1567 	char *usp = usrstack - args->usrstack_size;
1568 	int *offp = (int *)(args->stk_base + args->stk_size);
1569 	int envc = args->ne;
1570 	int argc = args->na - envc;
1571 	int i;
1572 
1573 	/*
1574 	 * Record argc for /proc.
1575 	 */
1576 	up->u_argc = argc;
1577 
1578 	/*
1579 	 * Put argc on the stack.  Note that even though it's an int,
1580 	 * it always consumes ptrsize bytes (for alignment).
1581 	 */
1582 	if (stk_putptr(args, usp, (char *)(uintptr_t)argc))
1583 		return (-1);
1584 
1585 	/*
1586 	 * Add argc space (ptrsize) to usp and record argv for /proc.
1587 	 */
1588 	up->u_argv = (uintptr_t)(usp += ptrsize);
1589 
1590 	/*
1591 	 * Put the argv[] pointers on the stack.
1592 	 */
1593 	for (i = 0; i < argc; i++, usp += ptrsize)
1594 		if (stk_putptr(args, usp, &ustrp[*--offp]))
1595 			return (-1);
1596 
1597 	/*
1598 	 * Copy arguments to u_psargs.
1599 	 */
1600 	pslen = MIN(args->arglen, PSARGSZ) - 1;
1601 	for (i = 0; i < pslen; i++)
1602 		up->u_psargs[i] = (kstrp[i] == '\0' ? ' ' : kstrp[i]);
1603 	while (i < PSARGSZ)
1604 		up->u_psargs[i++] = '\0';
1605 
1606 	/*
1607 	 * Add space for argv[]'s NULL terminator (ptrsize) to usp and
1608 	 * record envp for /proc.
1609 	 */
1610 	up->u_envp = (uintptr_t)(usp += ptrsize);
1611 
1612 	/*
1613 	 * Put the envp[] pointers on the stack.
1614 	 */
1615 	for (i = 0; i < envc; i++, usp += ptrsize)
1616 		if (stk_putptr(args, usp, &ustrp[*--offp]))
1617 			return (-1);
1618 
1619 	/*
1620 	 * Add space for envp[]'s NULL terminator (ptrsize) to usp and
1621 	 * remember where the stack ends, which is also where auxv begins.
1622 	 */
1623 	args->stackend = usp += ptrsize;
1624 
1625 	/*
1626 	 * Put all the argv[], envp[], and auxv strings on the stack.
1627 	 */
1628 	if (copyout(args->stk_base, ustrp, args->nc))
1629 		return (-1);
1630 
1631 	/*
1632 	 * Fill in the aux vector now that we know the user stack addresses
1633 	 * for the AT_SUN_PLATFORM, AT_SUN_EXECNAME, AT_SUN_BRANDNAME and
1634 	 * AT_SUN_EMULATOR strings.
1635 	 */
1636 	if (auxvpp != NULL && *auxvpp != NULL) {
1637 		if (args->to_model == DATAMODEL_NATIVE) {
1638 			auxv_t **a = (auxv_t **)auxvpp;
1639 			ADDAUX(*a, AT_SUN_PLATFORM, (long)&ustrp[*--offp])
1640 			ADDAUX(*a, AT_SUN_EXECNAME, (long)&ustrp[*--offp])
1641 			if (args->brandname != NULL)
1642 				ADDAUX(*a,
1643 				    AT_SUN_BRANDNAME, (long)&ustrp[*--offp])
1644 			if (args->emulator != NULL)
1645 				ADDAUX(*a,
1646 				    AT_SUN_EMULATOR, (long)&ustrp[*--offp])
1647 		} else {
1648 			auxv32_t **a = (auxv32_t **)auxvpp;
1649 			ADDAUX(*a,
1650 			    AT_SUN_PLATFORM, (int)(uintptr_t)&ustrp[*--offp])
1651 			ADDAUX(*a,
1652 			    AT_SUN_EXECNAME, (int)(uintptr_t)&ustrp[*--offp])
1653 			if (args->brandname != NULL)
1654 				ADDAUX(*a, AT_SUN_BRANDNAME,
1655 				    (int)(uintptr_t)&ustrp[*--offp])
1656 			if (args->emulator != NULL)
1657 				ADDAUX(*a, AT_SUN_EMULATOR,
1658 				    (int)(uintptr_t)&ustrp[*--offp])
1659 		}
1660 	}
1661 
1662 	return (0);
1663 }
1664 
1665 /*
1666  * Initialize a new user stack with the specified arguments and environment.
1667  * The initial user stack layout is as follows:
1668  *
1669  *	User Stack
1670  *	+---------------+ <--- curproc->p_usrstack
1671  *	|		|
1672  *	| slew		|
1673  *	|		|
1674  *	+---------------+
1675  *	| NULL		|
1676  *	+---------------+
1677  *	|		|
1678  *	| auxv strings	|
1679  *	|		|
1680  *	+---------------+
1681  *	|		|
1682  *	| envp strings	|
1683  *	|		|
1684  *	+---------------+
1685  *	|		|
1686  *	| argv strings	|
1687  *	|		|
1688  *	+---------------+ <--- ustrp
1689  *	|		|
1690  *	| aux vector	|
1691  *	|		|
1692  *	+---------------+ <--- auxv
1693  *	| NULL		|
1694  *	+---------------+
1695  *	| envp[envc-1]	|
1696  *	+---------------+
1697  *	| ...		|
1698  *	+---------------+
1699  *	| envp[0]	|
1700  *	+---------------+ <--- envp[]
1701  *	| NULL		|
1702  *	+---------------+
1703  *	| argv[argc-1]	|
1704  *	+---------------+
1705  *	| ...		|
1706  *	+---------------+
1707  *	| argv[0]	|
1708  *	+---------------+ <--- argv[]
1709  *	| argc		|
1710  *	+---------------+ <--- stack base
1711  */
1712 int
1713 exec_args(execa_t *uap, uarg_t *args, intpdata_t *intp, void **auxvpp)
1714 {
1715 	size_t size;
1716 	int error;
1717 	proc_t *p = ttoproc(curthread);
1718 	user_t *up = PTOU(p);
1719 	char *usrstack;
1720 	rctl_entity_p_t e;
1721 	struct as *as;
1722 	extern int use_stk_lpg;
1723 	size_t sp_slew;
1724 
1725 	args->from_model = p->p_model;
1726 	if (p->p_model == DATAMODEL_NATIVE) {
1727 		args->from_ptrsize = sizeof (long);
1728 	} else {
1729 		args->from_ptrsize = sizeof (int32_t);
1730 	}
1731 
1732 	if (args->to_model == DATAMODEL_NATIVE) {
1733 		args->to_ptrsize = sizeof (long);
1734 		args->ncargs = NCARGS;
1735 		args->stk_align = STACK_ALIGN;
1736 		if (args->addr32)
1737 			usrstack = (char *)USRSTACK64_32;
1738 		else
1739 			usrstack = (char *)USRSTACK;
1740 	} else {
1741 		args->to_ptrsize = sizeof (int32_t);
1742 		args->ncargs = NCARGS32;
1743 		args->stk_align = STACK_ALIGN32;
1744 		usrstack = (char *)USRSTACK32;
1745 	}
1746 
1747 	ASSERT(P2PHASE((uintptr_t)usrstack, args->stk_align) == 0);
1748 
1749 #if defined(__sparc)
1750 	/*
1751 	 * Make sure user register windows are empty before
1752 	 * attempting to make a new stack.
1753 	 */
1754 	(void) flush_user_windows_to_stack(NULL);
1755 #endif
1756 
1757 	for (size = PAGESIZE; ; size *= 2) {
1758 		args->stk_size = size;
1759 		args->stk_base = kmem_alloc(size, KM_SLEEP);
1760 		args->stk_strp = args->stk_base;
1761 		args->stk_offp = (int *)(args->stk_base + size);
1762 		error = stk_copyin(uap, args, intp, auxvpp);
1763 		if (error == 0)
1764 			break;
1765 		kmem_free(args->stk_base, size);
1766 		if (error != E2BIG && error != ENAMETOOLONG)
1767 			return (error);
1768 		if (size >= args->ncargs)
1769 			return (E2BIG);
1770 	}
1771 
1772 	size = args->usrstack_size;
1773 
1774 	ASSERT(error == 0);
1775 	ASSERT(P2PHASE(size, args->stk_align) == 0);
1776 	ASSERT((ssize_t)STK_AVAIL(args) >= 0);
1777 
1778 	if (size > args->ncargs) {
1779 		kmem_free(args->stk_base, args->stk_size);
1780 		return (E2BIG);
1781 	}
1782 
1783 	/*
1784 	 * Leave only the current lwp and force the other lwps to exit.
1785 	 * If another lwp beat us to the punch by calling exit(), bail out.
1786 	 */
1787 	if ((error = exitlwps(0)) != 0) {
1788 		kmem_free(args->stk_base, args->stk_size);
1789 		return (error);
1790 	}
1791 
1792 	/*
1793 	 * Revoke any doors created by the process.
1794 	 */
1795 	if (p->p_door_list)
1796 		door_exit();
1797 
1798 	/*
1799 	 * Release schedctl data structures.
1800 	 */
1801 	if (p->p_pagep)
1802 		schedctl_proc_cleanup();
1803 
1804 	/*
1805 	 * Clean up any DTrace helpers for the process.
1806 	 */
1807 	if (p->p_dtrace_helpers != NULL) {
1808 		ASSERT(dtrace_helpers_cleanup != NULL);
1809 		(*dtrace_helpers_cleanup)();
1810 	}
1811 
1812 	mutex_enter(&p->p_lock);
1813 	/*
1814 	 * Cleanup the DTrace provider associated with this process.
1815 	 */
1816 	if (p->p_dtrace_probes) {
1817 		ASSERT(dtrace_fasttrap_exec_ptr != NULL);
1818 		dtrace_fasttrap_exec_ptr(p);
1819 	}
1820 	mutex_exit(&p->p_lock);
1821 
1822 	/*
1823 	 * discard the lwpchan cache.
1824 	 */
1825 	if (p->p_lcp != NULL)
1826 		lwpchan_destroy_cache(1);
1827 
1828 	/*
1829 	 * Delete the POSIX timers.
1830 	 */
1831 	if (p->p_itimer != NULL)
1832 		timer_exit();
1833 
1834 	/*
1835 	 * Delete the ITIMER_REALPROF interval timer.
1836 	 * The other ITIMER_* interval timers are specified
1837 	 * to be inherited across exec().
1838 	 */
1839 	delete_itimer_realprof();
1840 
1841 	if (AU_AUDITING())
1842 		audit_exec(args->stk_base, args->stk_base + args->arglen,
1843 		    args->na - args->ne, args->ne);
1844 
1845 	/*
1846 	 * Ensure that we don't change resource associations while we
1847 	 * change address spaces.
1848 	 */
1849 	mutex_enter(&p->p_lock);
1850 	pool_barrier_enter();
1851 	mutex_exit(&p->p_lock);
1852 
1853 	/*
1854 	 * Destroy the old address space and create a new one.
1855 	 * From here on, any errors are fatal to the exec()ing process.
1856 	 * On error we return -1, which means the caller must SIGKILL
1857 	 * the process.
1858 	 */
1859 	relvm();
1860 
1861 	mutex_enter(&p->p_lock);
1862 	pool_barrier_exit();
1863 	mutex_exit(&p->p_lock);
1864 
1865 	up->u_execsw = args->execswp;
1866 
1867 	p->p_brkbase = NULL;
1868 	p->p_brksize = 0;
1869 	p->p_brkpageszc = 0;
1870 	p->p_stksize = 0;
1871 	p->p_stkpageszc = 0;
1872 	p->p_model = args->to_model;
1873 	p->p_usrstack = usrstack;
1874 	p->p_stkprot = args->stk_prot;
1875 	p->p_datprot = args->dat_prot;
1876 
1877 	/*
1878 	 * Reset resource controls such that all controls are again active as
1879 	 * well as appropriate to the potentially new address model for the
1880 	 * process.
1881 	 */
1882 	e.rcep_p.proc = p;
1883 	e.rcep_t = RCENTITY_PROCESS;
1884 	rctl_set_reset(p->p_rctls, p, &e);
1885 
1886 	/* Too early to call map_pgsz for the heap */
1887 	if (use_stk_lpg) {
1888 		p->p_stkpageszc = page_szc(map_pgsz(MAPPGSZ_STK, p, 0, 0, 0));
1889 	}
1890 
1891 	mutex_enter(&p->p_lock);
1892 	p->p_flag |= SAUTOLPG;	/* kernel controls page sizes */
1893 	mutex_exit(&p->p_lock);
1894 
1895 	/*
1896 	 * Some platforms may choose to randomize real stack start by adding a
1897 	 * small slew (not more than a few hundred bytes) to the top of the
1898 	 * stack. This helps avoid cache thrashing when identical processes
1899 	 * simultaneously share caches that don't provide enough associativity
1900 	 * (e.g. sun4v systems). In this case stack slewing makes the same hot
1901 	 * stack variables in different processes to live in different cache
1902 	 * sets increasing effective associativity.
1903 	 */
1904 	sp_slew = exec_get_spslew();
1905 	ASSERT(P2PHASE(sp_slew, args->stk_align) == 0);
1906 	exec_set_sp(size + sp_slew);
1907 
1908 	as = as_alloc();
1909 	p->p_as = as;
1910 	as->a_proc = p;
1911 	if (p->p_model == DATAMODEL_ILP32 || args->addr32)
1912 		as->a_userlimit = (caddr_t)USERLIMIT32;
1913 	(void) hat_setup(as->a_hat, HAT_ALLOC);
1914 	hat_join_srd(as->a_hat, args->ex_vp);
1915 
1916 	/*
1917 	 * Finally, write out the contents of the new stack.
1918 	 */
1919 	error = stk_copyout(args, usrstack - sp_slew, auxvpp, up);
1920 	kmem_free(args->stk_base, args->stk_size);
1921 	return (error);
1922 }
1923