sync further changes from uts/aslr
7029 want per-process exploit mitigation features (secflags)
7030 want basic address space layout randomization (aslr)
7031 noexec_user_stack should be a secflag
7032 want a means to forbid mappings around NULL.

@@ -60,14 +60,20 @@
 #include <vm/seg_vn.h>
 
 int use_brk_lpg = 1;
 int use_stk_lpg = 1;
 
+/*
+ * If set, we will not randomize mappings where the 'addr' argument is
+ * non-NULL and not an alignment.
+ */
+int aslr_respect_mmap_hint = 0;
+
 static int brk_lpg(caddr_t nva);
 static int grow_lpg(caddr_t sp);
 
-int
+intptr_t
 brk(caddr_t nva)
 {
         int error;
         proc_t *p = curproc;
 

@@ -75,10 +81,20 @@
          * Serialize brk operations on an address space.
          * This also serves as the lock protecting p_brksize
          * and p_brkpageszc.
          */
         as_rangelock(p->p_as);
+
+        /*
+         * As a special case to aid the implementation of sbrk(3C), if given a
+         * new brk of 0, return the current brk.  We'll hide this in brk(3C).
+         */
+        if (nva == 0) {
+                as_rangeunlock(p->p_as);
+                return ((intptr_t)(p->p_brkbase + p->p_brksize));
+        }
+
         if (use_brk_lpg && (p->p_flag & SAUTOLPG) != 0) {
                 error = brk_lpg(nva);
         } else {
                 error = brk_internal(nva, p->p_brkpageszc);
         }

@@ -488,14 +504,14 @@
         p->p_stksize = newsize;
         return (0);
 }
 
 /*
- * Find address for user to map.
- * If MAP_FIXED is not specified, we can pick any address we want, but we will
- * first try the value in *addrp if it is non-NULL.  Thus this is implementing
- * a way to try and get a preferred address.
+ * Find address for user to map.  If MAP_FIXED is not specified, we can pick
+ * any address we want, but we will first try the value in *addrp if it is
+ * non-NULL and _MAP_RANDOMIZE is not set.  Thus this is implementing a way to
+ * try and get a preferred address.
  */
 int
 choose_addr(struct as *as, caddr_t *addrp, size_t len, offset_t off,
     int vacalign, uint_t flags)
 {

@@ -504,11 +520,12 @@
 
         ASSERT(AS_ISCLAIMGAP(as));      /* searches should be serialized */
         if (flags & MAP_FIXED) {
                 (void) as_unmap(as, *addrp, len);
                 return (0);
-        } else if (basep != NULL && ((flags & MAP_ALIGN) == 0) &&
+        } else if (basep != NULL &&
+            ((flags & (MAP_ALIGN | _MAP_RANDOMIZE)) == 0) &&
             !as_gap(as, len, &basep, &lenp, 0, *addrp)) {
                 /* User supplied address was available */
                 *addrp = basep;
         } else {
                 /*

@@ -585,10 +602,13 @@
         vn_a.lgrp_mem_policy_flags = 0;
 
         return (as_map(as, *addrp, len, segvn_create, &vn_a));
 }
 
+#define RANDOMIZABLE_MAPPING(addr, flags) (((flags & MAP_FIXED) == 0) && \
+        !(((flags & MAP_ALIGN) == 0) && (addr != 0) && aslr_respect_mmap_hint))
+
 static int
 smmap_common(caddr_t *addrp, size_t len,
     int prot, int flags, struct file *fp, offset_t pos)
 {
         struct vnode *vp;

@@ -610,10 +630,23 @@
 
         if ((flags & (MAP_TEXT | MAP_INITDATA)) == (MAP_TEXT | MAP_INITDATA)) {
                 return (EINVAL);
         }
 
+        if ((flags & (MAP_FIXED | _MAP_RANDOMIZE)) ==
+            (MAP_FIXED | _MAP_RANDOMIZE)) {
+                return (EINVAL);
+        }
+
+        /*
+         * If it's not a fixed allocation and mmap ASLR is enabled, randomize
+         * it.
+         */
+        if (RANDOMIZABLE_MAPPING(*addrp, flags) &&
+            secflag_enabled(curproc, PROC_SEC_ASLR))
+                flags |= _MAP_RANDOMIZE;
+
 #if defined(__sparc)
         /*
          * See if this is an "old mmap call".  If so, remember this
          * fact and convert the flags value given to mmap to indicate
          * the specified address in the system call must be used.

@@ -628,11 +661,10 @@
         if (type != MAP_PRIVATE && type != MAP_SHARED)
                 return (EINVAL);
 
 
         if (flags & MAP_ALIGN) {
-
                 if (flags & MAP_FIXED)
                         return (EINVAL);
 
                 /* alignment needs to be a power of 2 >= page size */
                 if (((uintptr_t)*addrp < PAGESIZE && (uintptr_t)*addrp != 0) ||