Compute and pring the time that it takes to execute system calls. This data...

sandbox/linux/seccomp/trusted_process.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <dirent.h>
 #include <map>
 
 #include "debug.h"
 #include "sandbox_impl.h"
 #include "syscall_table.h"
 
 namespace playground {
 
 struct Thread {
   int              fdPub, fd;
   SecureMem::Args* mem;
 };
 
 SecureMem::Args* Sandbox::getSecureMem() {
   if (!secureMemPool_.empty()) {
     SecureMem::Args* rc = secureMemPool_.back();
     secureMemPool_.pop_back();
+    memset(rc->scratchPage, 0, sizeof(rc->scratchPage));
     return rc;
   }
   return NULL;
 }
 
 void Sandbox::trustedProcess(int parentMapsFd, int processFdPub, int sandboxFd,
                              int cloneFd, SecureMem::Args* secureArena) {
+  // The trusted process doesn't have access to TLS. Zero out the segment
+  // registers so that we can later test that we are in the trusted process.
+  #if defined(__x86_64__)
+  asm volatile("mov %0, %%gs\n" : : "r"(0));
+  #elif defined(__i386__)
+  asm volatile("mov %0, %%fs\n" : : "r"(0));
+  #else
+  #error Unsupported target platform
+  #endif
+
   std::map<long long, struct Thread> threads;
   SysCalls  sys;
   long long cookie               = 0;
 
   // The very first entry in the secure memory arena has been assigned to the
   // initial thread. The remaining entries are available for allocation.
   SecureMem::Args* startAddress  = secureArena;
   SecureMem::Args* nextThread    = startAddress;
   for (int i = 0; i < kMaxThreads-1; i++) {
     secureMemPool_.push_back(++startAddress);
@@ skipping 206 matching lines @@
 
   // We are still in the untrusted code. Deny access to restricted resources.
   mprotect(secureArena, 8192*kMaxThreads, PROT_NONE);
   mprotect(&syscall_mutex_, 4096, PROT_NONE);
   close(sandboxFd);
 
   return secureArena;
 }
 
 } // namespace