[MIPS] Add seccomp bpf support

sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Note: any code in this file MUST be async-signal safe.
 
 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
 
 #include <unistd.h>
 
@@ skipping 26 matching lines @@
     // TODO(jln): query the current policy to check if send() is available and
     // use it to perform a non-blocking write.
     const int ret = HANDLE_EINTR(write(STDERR_FILENO, error_message, size));
     // We can't handle any type of error here.
     if (ret <= 0 || static_cast<size_t>(ret) > size) break;
     size -= ret;
     error_message += ret;
   }
 }
 
+uint32_t TruncSysnoToValue(uint32_t sysno) {
+#if defined(__mips__)
+  // On MIPS syscall numbers are in different range than on x86 and ARM
+  if (sysno < __NR_Linux || sysno > __NR_Linux + __NR_Linux_syscalls)
+    // 4000 (truncated to zero) is valid syscall number on mips O32 ABI.
+    // Invalid syscall will be printed with a value that is out of range
+    // on apropriate ABI.
+    sysno = sysno - __NR_Linux + 1000;

[jln (very slow on Chromium), 2014/05/16 19:30:17]

I don't understand what this does.

Please document the function above in a comment.

Invalid syscall values should be transformed to zero. Valid syscall values
should be transformed to sysno - __NR_linux.

Please choose another name as well. The name should be something along the lines
of: "SyscallNumberToOffsetFromBase()"

[nedeljko, 2014/05/19 17:37:23]

On MIPS O32 ABI value of __NR_Linux is 4000.

The value of the first syscall (__NR_syscall) is also 4000.

With sysno - __NR_Linux this valid syscall value would be transformed to zero.
That is the reason why I transformed invalid values to 1000 + offset.

On the other hand, I see that this is complicating things to much just for one
syscall in one of the ABIs, so I'll do as you said in your comment and transform
invalid values to zero.

[nedeljko, 2014/05/22 17:38:55]

Done.

+  else
+    sysno = sysno - __NR_Linux;
+#else
+  if (sysno >= 1024)
+    sysno = 0;
+#endif
+  return sysno;
+}
+
 // Print a seccomp-bpf failure to handle |sysno| to stderr in an
 // async-signal safe way.
 void PrintSyscallError(uint32_t sysno) {
-  if (sysno >= 1024)
-    sysno = 0;
+
+  sysno = TruncSysnoToValue(sysno);
+
   // TODO(markus): replace with async-signal safe snprintf when available.
   const size_t kNumDigits = 4;
   char sysno_base10[kNumDigits];
   uint32_t rem = sysno;
   uint32_t mod = 0;
   for (int i = kNumDigits - 1; i >= 0; i--) {
     mod = rem % 10;
     rem /= 10;
     sysno_base10[i] = '0' + mod;
   }
+#if defined(__mips__) && (_MIPS_SIM == _MIPS_SIM_ABI32)
+  static const char kSeccompErrorPrefix[] =
+      __FILE__":**CRASHING**:" SECCOMP_MESSAGE_COMMON_CONTENT
+                               " in syscall 4000 + ";
+#else
   static const char kSeccompErrorPrefix[] =
       __FILE__":**CRASHING**:" SECCOMP_MESSAGE_COMMON_CONTENT " in syscall ";
+#endif
   static const char kSeccompErrorPostfix[] = "\n";
   WriteToStdErr(kSeccompErrorPrefix, sizeof(kSeccompErrorPrefix) - 1);
   WriteToStdErr(sysno_base10, sizeof(sysno_base10));
   WriteToStdErr(kSeccompErrorPostfix, sizeof(kSeccompErrorPostfix) - 1);
 }
 
 }  // namespace.
 
 namespace sandbox {
 
 intptr_t CrashSIGSYS_Handler(const struct arch_seccomp_data& args, void* aux) {
   uint32_t syscall = args.nr;
-  if (syscall >= 1024)
-    syscall = 0;
+
   PrintSyscallError(syscall);
 
   // Encode 8-bits of the 1st two arguments too, so we can discern which socket
   // type, which fcntl, ... etc., without being likely to hit a mapped
   // address.
   // Do not encode more bits here without thinking about increasing the
   // likelihood of collision with mapped pages.
   syscall |= ((args.args[0] & 0xffUL) << 12);
   syscall |= ((args.args[1] & 0xffUL) << 20);
   // Purposefully dereference the syscall as an address so it'll show up very
@@ skipping 86 matching lines @@
 
 const char* GetPrctlErrorMessageContentForTests() {
   return SECCOMP_MESSAGE_PRCTL_CONTENT;
 }
 
 const char* GetIoctlErrorMessageContentForTests() {
   return SECCOMP_MESSAGE_IOCTL_CONTENT;
 }
 
 }  // namespace sandbox.