[MIPS] Add seccomp bpf support

sandbox/linux/seccomp-bpf/trap.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf/trap.h"
 
 #include <errno.h>
 #include <signal.h>
 #include <string.h>
 #include <sys/prctl.h>
@@ skipping 132 matching lines @@
   // Obtain the signal context. This, most notably, gives us access to
   // all CPU registers at the time of the signal.
   ucontext_t* ctx = reinterpret_cast<ucontext_t*>(void_context);
 
   // Obtain the siginfo information that is specific to SIGSYS. Unfortunately,
   // most versions of glibc don't include this information in siginfo_t. So,
   // we need to explicitly copy it into a arch_sigsys structure.
   struct arch_sigsys sigsys;
   memcpy(&sigsys, &info->_sifields, sizeof(sigsys));
 
+#if defined(__mips__)
+  // When indirect syscall (syscall(__NR_foo, ...)) is made on Mips, the
+  // number in register SECCOMP_SYSCALL(ctx) is always __NR_syscall and the
+  // real number of a syscall (__NR_foo) is in SECCOMP_PARM1(ctx)
+  bool sigsys_nr_is_bad = sigsys.nr != static_cast<int>(SECCOMP_SYSCALL(ctx))
+                       && sigsys.nr != static_cast<int>(SECCOMP_PARM1(ctx));

[jln (very slow on Chromium), 2014/06/20 00:37:06]

Nit: indent. (please use "git cl format")

[nedeljko, 2014/06/20 14:09:51]

Done.

+#else
+  bool sigsys_nr_is_bad = sigsys.nr != static_cast<int>(SECCOMP_SYSCALL(ctx));
+#endif
+
   // Some more sanity checks.
   if (sigsys.ip != reinterpret_cast<void*>(SECCOMP_IP(ctx)) ||
-      sigsys.nr != static_cast<int>(SECCOMP_SYSCALL(ctx)) ||
+      sigsys_nr_is_bad ||
       sigsys.arch != SECCOMP_ARCH) {
     // TODO(markus):
     // SANDBOX_DIE() can call LOG(FATAL). This is not normally async-signal
     // safe and can lead to bugs. We should eventually implement a different
     // logging and reporting mechanism that is safe to be called from
     // the sigSys() handler.
     RAW_SANDBOX_DIE("Sanity checks are failing after receiving SIGSYS.");
   }
 
   intptr_t rc;
   if (has_unsafe_traps_ && GetIsInSigHandler(ctx)) {
     errno = old_errno;
     if (sigsys.nr == __NR_clone) {
       RAW_SANDBOX_DIE("Cannot call clone() from an UnsafeTrap() handler.");
     }
-    rc = Syscall::Call(sigsys.nr,
+    rc = Syscall::Call(SECCOMP_SYSCALL(ctx),
                        SECCOMP_PARM1(ctx),
                        SECCOMP_PARM2(ctx),
                        SECCOMP_PARM3(ctx),
                        SECCOMP_PARM4(ctx),
                        SECCOMP_PARM5(ctx),
                        SECCOMP_PARM6(ctx));

[jln (very slow on Chromium), 2014/06/20 00:37:06]

What happens in MIPS if something makes an indirect syscall with 6 parameters?
Should MIPS take a 7th parameter?

Or alternatively, should we hanadle indirect syscalls in a separate codepath
here?

[nedeljko, 2014/06/20 14:09:51]

For indirect syscall with 6 parameters MIPS should indeed take 7th parameter
also.

I am not sure what is best approach to handle this...

I suppose that I could add one more parameter in Syscall::Call(), but should I
create additional unittest in that case? And if so, this would be meaningful
only on MIPS with O32 ABI, so this looks like an overkill.

On the other hand I could create additional Syscall::IndirectCall() function to
handle this, but should this new function then be used in all the places where
indirect syscall can occur?

Or maybe, since this problem is quite specific and it is connected only with
MIPS and then only with O32 ABI and since there is no particular gain in using
indirect syscall, I can disallow indirect syscalls with 6 arguments here by
checking if it is not zero if indirect syscall is made and handling this case.
That would have the smallest impact on the code.

What do you think?

[jln (very slow on Chromium), 2014/06/20 21:18:18]

What is the maximum number of parameters for a Linux MIPS system call? Is it 6
except for indirect system calls (so 7) or is it more?

petarj also mentioned 64 bits arguments, but these simply get split as two 32
bits arguments, correct?

I think we should add support for more arguments. I'll add a test for pread64
and you can simply make sure it does pass.

If that seems good, I can add a CL to change the syscall.h interface to support
an extra parameter on certain achitectures and you can just make sure it works
on MIPS.

   } else {
     const ErrorCode& err = trap_array_[info->si_errno - 1];
     if (!err.safe_) {
       SetIsInSigHandler();
     }
 
     // Copy the seccomp-specific data into a arch_seccomp_data structure. This
     // is what we are showing to TrapFnc callbacks that the system call
     // evaluator registered with the sandbox.
     struct arch_seccomp_data data = {
-        sigsys.nr, SECCOMP_ARCH, reinterpret_cast<uint64_t>(sigsys.ip),
+        static_cast<int> SECCOMP_SYSCALL(ctx),
+        SECCOMP_ARCH,
+        reinterpret_cast<uint64_t>(sigsys.ip),
         {static_cast<uint64_t>(SECCOMP_PARM1(ctx)),
          static_cast<uint64_t>(SECCOMP_PARM2(ctx)),
          static_cast<uint64_t>(SECCOMP_PARM3(ctx)),
          static_cast<uint64_t>(SECCOMP_PARM4(ctx)),
          static_cast<uint64_t>(SECCOMP_PARM5(ctx)),
          static_cast<uint64_t>(SECCOMP_PARM6(ctx))}};
 
     // Now call the TrapFnc callback associated with this particular instance
     // of SECCOMP_RET_TRAP.
     rc = err.fnc_(data, err.aux_);
   }
 
   // Update the CPU register that stores the return code of the system call
   // that we just handled, and restore "errno" to the value that it had
   // before entering the signal handler.
-  SECCOMP_RESULT(ctx) = static_cast<greg_t>(rc);
+  Syscall::PutValueInUcontext(rc, ctx);
   errno = old_errno;
 
   return;
 }
 
 bool Trap::TrapKey::operator<(const TrapKey& o) const {
   if (fnc != o.fnc) {
     return fnc < o.fnc;
   } else if (aux != o.aux) {
     return aux < o.aux;
@@ skipping 133 matching lines @@
   if (global_trap_ && id > 0 && id <= global_trap_->trap_array_size_) {
     return global_trap_->trap_array_[id - 1];
   } else {
     return ErrorCode();
   }
 }
 
 Trap* Trap::global_trap_;
 
 }  // namespace sandbox