Enable the service runtime to use a zero-based sandbox on Linux.

src/trusted/service_runtime/arch/x86_32/sel_addrspace_x86_32.c

 /*
  * Copyright 2009 The Native Client Authors.  All rights reserved.
  * Use of this source code is governed by a BSD-style license that can
  * be found in the LICENSE file.
  */
 
+#if NACL_LINUX
+#include <errno.h>
+#include <sys/mman.h>
+#endif
+
 #include "native_client/src/include/nacl_platform.h"
 #include "native_client/src/shared/platform/nacl_check.h"
+#include "native_client/src/trusted/service_runtime/include/sys/errno.h"
 #include "native_client/src/trusted/service_runtime/sel_memory.h"
 #include "native_client/src/trusted/service_runtime/sel_ldr.h"
 
 
 NaClErrorCode NaClAllocateSpace(void **mem, size_t addrsp_size) {
+#if NACL_LINUX && NACL_BUILD_SUBARCH == 32

[Mark Seaborn, 2011/08/23 18:26:36]

You're already in the x86_32 file.

[Brad Chen, 2011/08/23 21:15:09]

Done.

+  const void *ONE_MEGABYTE = (void *)(1024*1024);
+#endif
   int result;
 
   CHECK(NULL != mem);
 
-#ifdef NACL_SANDBOX_FIXED_AT_ZERO
+#if NACL_LINUX && NACL_BUILD_SUBARCH == 32

[Mark Seaborn, 2011/08/23 18:26:36]

You're already in the x86_32 file.

[Brad Chen, 2011/08/23 21:15:09]

Done.

   /*
-   * When creating a zero-based sandbox, we do not allocate the first 64K of
-   * pages beneath the trampolines, because -- on Linux at least -- we cannot.
-   * Instead, we allocate starting at the trampolines, and then coerce the
-   * out parameter.
+   * On 32 bit Linux, a 1 gigabyte block of address space may be reserved at
+   * the zero-end of the address space during process creation, to address
+   * sandbox layout requirements on ARM and performance issues on Intel ATOM.
+   * Look for this pre-reserved block and if found, pass its address to the
+   * page allocation function.
    */
-  addrsp_size -= NACL_TRAMPOLINE_START;
-  *mem = (void *) NACL_TRAMPOLINE_START;
-  result = NaCl_page_alloc_at_addr(mem, addrsp_size);
-  *mem = 0;
+  if (NaCl_find_prereserved_sandbox_memory(mem, addrsp_size)) {
+    /* Sanity check zero sandbox base address. */

[Mark Seaborn, 2011/08/23 18:26:36]

Nit: Comment style is
/*
 * blah
 */

[Brad Chen, 2011/08/23 21:15:09]

Done.

+    /* It should be within a few pages above the 64KB boundary. See   */
+    /* chrome/nacl/nacl_helper_bootstrap.c in the Chromium repository */
+    /* for more details. */
+    if (0 == *mem || ONE_MEGABYTE < *mem) {
+      NaClLog(LOG_ERROR, "NaClAllocateSpace:"
+                         "Can't handle sandbox at high address"
+                         "0x%08"NACL_PRIxPTR"\n",
+              (uintptr_t)*mem);
+      return LOAD_NO_MEMORY;
+    }
+
+    /*
+     * When creating a zero-based sandbox, we do not allocate the first 64K of
+     * pages beneath the trampolines, because -- on Linux at least -- we cannot.
+     * Instead, we allocate starting at the trampolines, and then coerce the
+     * "mem" out parameter.
+     */
+    addrsp_size -= NACL_TRAMPOLINE_START;
+    *mem = (void *) NACL_TRAMPOLINE_START;
+    result = NaCl_page_alloc_at_addr(mem, addrsp_size);
+    *mem = 0;
+  } else {
+    /* Zero-based sandbox not pre-reserved. Attempt to allocate anyway. */
+    result = NaCl_page_alloc(mem, addrsp_size);
+  }
 #elif NACL_WINDOWS && NACL_BUILD_SUBARCH == 32
   /*
    * On 32 bit Windows, a 1 gigabyte block of address space is reserved before
    * starting up this process to make sure we can create the sandbox. Look for
    * this pre-reserved block and if found, pass its address to the page
    * allocation function.
    */
   if (0 == NaCl_find_prereserved_sandbox_memory(mem, addrsp_size)) {
     result = NaCl_page_alloc_at_addr(mem, addrsp_size);
   } else {
@@ skipping 14 matching lines @@
           (uintptr_t) *mem,
           addrsp_size);
 
   return LOAD_OK;
 }
 
 
 NaClErrorCode NaClMprotectGuards(struct NaClApp *nap) {
   uintptr_t start_addr;
   int       err;
+#if NACL_LINUX
+  uintptr_t page_addr;
+  void     *mmap_rval;
+#endif
 
   start_addr = nap->mem_start;
 
   NaClLog(3,
           ("NULL detection region start 0x%08"NACL_PRIxPTR", "
            "size 0x%08x, end 0x%08"NACL_PRIxPTR"\n"),
           start_addr, NACL_SYSCALL_START_ADDR,
           start_addr + NACL_SYSCALL_START_ADDR);
-  if ((err = NaCl_mprotect((void *) start_addr,
-                           NACL_SYSCALL_START_ADDR,
-                           PROT_NONE)) != 0) {
-    NaClLog(LOG_ERROR, ("NaClMemoryProtection: "
-                        "NaCl_mprotect(0x%08"NACL_PRIxPTR", "
-                        "0x%08x, 0x%x) failed, "
-                        "error %d (NULL pointer guard page)\n"),
-            start_addr, NACL_SYSCALL_START_ADDR, PROT_NONE,
-            err);
-    return LOAD_MPROTECT_FAIL;
+  if (0 == start_addr) {
+#if !NACL_LINUX
+    NaClLog(LOG_FATAL, ("NaClMprotectGuards: zero-based sandbox is"
+                        " supported on Linux only.\n"));
+#else
+    /* Attempt to protect one page at a time. It is normal for

[Mark Seaborn, 2011/08/23 18:26:36]

Nit: Comment style is
/*
 * blah
 */

[bsy, 2011/08/23 18:43:19]

there's no reason to do it one page at a time.  we need to cover vm_min_addr up
to NACL_SYSCALL_START_ADDR (or equivalently NACL_TRAMPOLINE_START -- we really
shouldn't have both), so why not:

for (page_addr = NACL_PAGESIZE;
     page_addr < NACL_SYSCALL_START_ADDR;
     page_addr += NACL_PAGESIZE) {
  mmap_rval = mmap((void *) page_addr, NACL_SYSCALL_START_ADDR - page_addr,
PROT_NONE, MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS, -1, 0);
  if (page_addr == (uintptr_t) mmap_rval) {
    /* Success */
    break;
  } else if (MAP_FAILED .... etc etc...
so that the whole region is squatted upon by the first successful mmap call? 
there's no need to map in 64K at a time on linux.  (actually, probably not on
windows either in this particular case, since we don't allow user code to map
over this region of memory.)

[Brad Chen, 2011/08/23 21:15:09]

Done.

[Brad Chen, 2011/08/23 21:15:09]

Done.

+     * these attempts to fail if the page is in the reserved low
+     * part of the address space. Note the 0 page can never be
+     * protected so start at NACL_PAGESIZE.
+     */
+    for (page_addr = NACL_PAGESIZE; page_addr < NACL_SYSCALL_START_ADDR;

[Mark Seaborn, 2011/08/23 18:26:36]

I'd put each for() clause on a different line if they overflow.

[Brad Chen, 2011/08/23 21:15:09]

Done.

+         page_addr += NACL_PAGESIZE) {
+      mmap_rval = mmap((void *)page_addr, NACL_PAGESIZE, PROT_NONE,
+                       MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS, -1, 0);

[Mark Seaborn, 2011/08/23 18:26:36]

Maybe MAP_NORESERVE too, just in case?

[Brad Chen, 2011/08/23 21:15:09]

Done.

+      if (page_addr == (uintptr_t)mmap_rval) {
+        /* Success; the page is now protected. */
+      } else if (MAP_FAILED == mmap_rval && EPERM == errno) {
+        /* Normal; this is an invalid page for this process and */

[Mark Seaborn, 2011/08/23 18:26:36]

Comment style

[Brad Chen, 2011/08/23 21:15:09]

Done.

+        /* doesn't need to be protected. */
+      } else {
+        NaClLog(LOG_ERROR, ("NaClMemoryProtection: "
+                            "mmap(0x%08"NACL_PRIxPTR") failed, "
+                            "error %d (NULL pointer guard page)\n"),
+                page_addr, errno);
+        return LOAD_MPROTECT_FAIL;
+      }
+    }
+#endif
+  } else {

[bbudge, 2011/08/23 18:50:21]

You could move the 'if' statement here: else if ((err = ..
Or for better readability, you could move the assignment out of the 'if', making
it the first statement in the block, followed by "if (err != 0) {...

[Brad Chen, 2011/08/23 21:15:09]

Done.

+    if ((err = NaCl_mprotect((void *) start_addr,
+                             NACL_SYSCALL_START_ADDR,
+                             PROT_NONE)) != 0) {
+      NaClLog(LOG_ERROR, ("NaClMemoryProtection: "
+                          "NaCl_mprotect(0x%08"NACL_PRIxPTR", "
+                          "0x%08x, 0x%x) failed, "
+                          "error %d (NULL pointer guard page)\n"),
+              start_addr, NACL_SYSCALL_START_ADDR, PROT_NONE,
+              err);
+      return LOAD_MPROTECT_FAIL;
+    }
   }
   if (!NaClVmmapAdd(&nap->mem_map,
                     (start_addr - nap->mem_start) >> NACL_PAGESHIFT,
                     NACL_SYSCALL_START_ADDR >> NACL_PAGESHIFT,
                     PROT_NONE,
                     (struct NaClMemObj *) NULL)) {
     NaClLog(LOG_ERROR, ("NaClMemoryProtection: NaClVmmapAdd failed"
                         " (NULL pointer guard page)\n"));
     return LOAD_MPROTECT_FAIL;
   }
 
   return LOAD_OK;
 }