static int NaClGioShmClose(struct Gio *vself) {
struct NaClGioShm *self = (struct NaClGioShm *) vself;
if (NULL != self->cur_window) {
NaClDescUnmapUnsafe(self->shmp, (void *) self->cur_window,
NACL_MAP_PAGESIZE);
}
self->cur_window = NULL;
if (NULL == self->shmp) {
NaClLog(LOG_ERROR, "NaClGioShmClose: double close detected\n");
errno = EIO;
return -1;
}
NaClDescUnref(self->shmp);
self->shmp = NULL; /* double close will fault */
return 0;
}
/*
* Release current window if it exists, then map in window at the
* provided new_window_offset. This is akin to filbuf.
*
* Preconditions: 0 == (new_win_offset & (NACL_MAP_PAGESIZE - 1))
* new_win_offset < self->shm_sz
*/
static int NaClGioShmSetWindow(struct NaClGioShm *self,
size_t new_win_offset) {
uintptr_t map_result;
size_t actual_len;
NaClLog(4,
"NaClGioShmSetWindow: new_win_offset 0x%"NACL_PRIxS"\n",
new_win_offset);
if (0 != (new_win_offset & (NACL_MAP_PAGESIZE - 1))) {
NaClLog(LOG_FATAL,
("NaClGioShmSetWindow: internal error, requested"
" new window offset 0x%"NACL_PRIxS" is not aligned.\n"),
new_win_offset);
}
if (new_win_offset >= self->shm_sz) {
NaClLog(LOG_FATAL,
("NaClGioShmSetWindow: setting window beyond end of shm object"
" offset 0x%"NACL_PRIxS", size 0x%"NACL_PRIxS"\n"),
new_win_offset, self->shm_sz);
}
if (NULL != self->cur_window) {
NaClDescUnmapUnsafe(self->shmp, (void *) self->cur_window,
self->window_size);
}
self->cur_window = NULL;
self->window_size = 0;
/*
* The Map virtual function will NOT pad space beyond the end of the
* memory mapping object with zero-filled pages. This is done for
* user code in nacl_syscall_common.c(NaClCommonSysMmap), and the
* Map virtual function exposes the behavioral inconsistencies wrt
* allowing but ignoring mapping an offset beyond the end of file
* (linux) versus disallowing the mapping (MapViewOfFileEx).
*
* Here, we know the actual size of the shm object, and can deal
* with it.
*/
actual_len = GIO_SHM_WINDOWSIZE;
if (actual_len > self->shm_sz - new_win_offset) {
actual_len = self->shm_sz - new_win_offset;
}
map_result =
(*((struct NaClDescVtbl const *) self->shmp->base.vtbl)->
Map)(self->shmp,
NaClDescEffectorTrustedMem(),
(void *) NULL,
actual_len,
NACL_ABI_PROT_READ | NACL_ABI_PROT_WRITE,
NACL_ABI_MAP_SHARED,
(nacl_off64_t) new_win_offset);
NaClLog(4,
"NaClGioShmSetWindow: Map returned 0x%"NACL_PRIxPTR"\n",
map_result);
if (NaClPtrIsNegErrno(&map_result)) {
return 0;
}
self->cur_window = (char *) map_result;
self->window_size = actual_len;
self->window_offset = new_win_offset;
return 1;
}
/*
* Attempt to map into the NaClApp object nap from the NaCl descriptor
* ndp an ELF segment of type p_flags that start at file_offset for
* segment_size bytes, to memory starting at paddr (system address).
* If it is a code segment, make a scratch mapping and check
* validation in readonly_text mode -- if it succeeds, we map into the
* target address; if it fails, we return failure so that pread-based
* loading can proceed. For rodata and data segments, less checking
* is needed. In the text and data case, the end of the segment may
* not land on a NACL_MAP_PAGESIZE boundary; when this occurs, we will
* map in all whole NACL_MAP_PAGESIZE chunks, and pread in the tail
* partial chunk.
*
* Returns: LOAD_OK, LOAD_STATUS_UNKNOWN, other error codes.
*
* LOAD_OK -- if the segment has been fully handled
* LOAD_STATUS_UNKNOWN -- if pread-based fallback is required
* other error codes -- if a fatal error occurs, and the caller
* should propagate up
*
* See NaClSysMmapIntern in nacl_syscall_common.c for corresponding
* mmap syscall where PROT_EXEC allows shared libraries to be mapped
* into dynamic code space.
*/
static NaClErrorCode NaClElfFileMapSegment(struct NaClApp *nap,
struct NaClDesc *ndp,
Elf_Word p_flags,
Elf_Off file_offset,
Elf_Off segment_size,
uintptr_t vaddr,
uintptr_t paddr) {
size_t rounded_filesz; /* 64k rounded */
int mmap_prot = 0;
uintptr_t image_sys_addr;
NaClValidationStatus validator_status = NaClValidationFailed;
struct NaClValidationMetadata metadata;
int read_last_page_if_partial_allocation_page = 1;
ssize_t read_ret;
struct NaClPerfCounter time_mmap_segment;
NaClPerfCounterCtor(&time_mmap_segment, "NaClElfFileMapSegment");
rounded_filesz = NaClRoundAllocPage(segment_size);
NaClLog(4,
"NaClElfFileMapSegment: checking segment flags 0x%x"
" to determine map checks\n",
p_flags);
/*
* Is this the text segment? If so, map into scratch memory and
* run validation (possibly cached result) with !stubout_mode,
* readonly_text. If validator says it's okay, map directly into
* target location with NACL_ABI_PROT_READ|_EXEC. If anything
* failed, fall back to PRead. NB: the assumption is that there
* is only one PT_LOAD with PF_R|PF_X segment; this assumption is
* enforced by phdr seen_seg checks above in
* NaClElfImageValidateProgramHeaders.
*
* After this function returns, we will be setting memory protection
* in NaClMemoryProtection, so the actual memory protection used is
* immaterial.
*
* For rodata and data/bss, we mmap with NACL_ABI_PROT_READ or
* NACL_ABI_PROT_READ | NACL_ABI_PROT_WRITE as appropriate,
* without doing validation. There is no fallback to PRead, since
* we don't validate the contents.
*/
switch (p_flags) {
case PF_R | PF_X:
NaClLog(4,
"NaClElfFileMapSegment: text segment and"
" file is safe for mmap\n");
if (NACL_VTBL(NaClDesc, ndp)->typeTag != NACL_DESC_HOST_IO) {
NaClLog(4, "NaClElfFileMapSegment: not supported type, got %d\n",
NACL_VTBL(NaClDesc, ndp)->typeTag);
return LOAD_STATUS_UNKNOWN;
}
/*
* Unlike the mmap case, we do not re-run validation to
* allow patching here; instead, we handle validation
* failure by going to the pread_fallback case. In the
* future, we should consider doing an in-place mapping and
* allowing HLT patch validation, which should be cheaper
* since those pages that do not require patching (hopefully
* majority) will remain file-backed and not require swap
* space, even if we had to fault in every page.
*/
NaClLog(1, "NaClElfFileMapSegment: mapping for validation\n");
NaClPerfCounterMark(&time_mmap_segment, "PreMap");
NaClPerfCounterIntervalLast(&time_mmap_segment);
image_sys_addr = (*NACL_VTBL(NaClDesc, ndp)->
Map)(ndp,
NaClDescEffectorTrustedMem(),
(void *) NULL,
rounded_filesz,
NACL_ABI_PROT_READ,
NACL_ABI_MAP_PRIVATE,
file_offset);
NaClPerfCounterMark(&time_mmap_segment, "MapForValidate");
NaClPerfCounterIntervalLast(&time_mmap_segment);
if (NaClPtrIsNegErrno(&image_sys_addr)) {
NaClLog(LOG_INFO,
"NaClElfFileMapSegment: Could not make scratch mapping,"
" falling back to reading\n");
return LOAD_STATUS_UNKNOWN;
}
/* ask validator / validation cache */
NaClMetadataFromNaClDescCtor(&metadata, ndp);
CHECK(segment_size == nap->static_text_end - NACL_TRAMPOLINE_END);
validator_status = NACL_FI_VAL(
"ELF_LOAD_FORCE_VALIDATION_STATUS",
enum NaClValidationStatus,
(*nap->validator->
Validate)(vaddr,
(uint8_t *) image_sys_addr,
segment_size, /* actual size */
0, /* stubout_mode: no */
1, /* readonly_text: yes */
nap->cpu_features,
&metadata,
nap->validation_cache));
NaClPerfCounterMark(&time_mmap_segment, "ValidateMapped");
NaClPerfCounterIntervalLast(&time_mmap_segment);
NaClLog(3, "NaClElfFileMapSegment: validator_status %d\n",
validator_status);
NaClMetadataDtor(&metadata);
/*
* Remove scratch mapping, then map directly into untrusted
* address space or pread.
*/
NaClDescUnmapUnsafe(ndp, (void *) image_sys_addr,
rounded_filesz);
NACL_MAKE_MEM_UNDEFINED((void *) paddr, rounded_filesz);
if (NaClValidationSucceeded != validator_status) {
NaClLog(3,
("NaClElfFileMapSegment: readonly_text validation for mmap"
" failed. Will retry validation allowing HALT stubbing out"
" of unsupported instruction extensions.\n"));
return LOAD_STATUS_UNKNOWN;
}
NaClLog(1, "NaClElfFileMapSegment: mapping into code space\n");
/*
* Windows appears to not allow RWX mappings. This interferes
* with HALT_SLED and having to HALT pad the last page. We
* allow partial code pages, so
* read_last_page_if_partial_allocation_page will ensure that
* the last page is writable, so we will be able to write HALT
* instructions as needed.
*/
mmap_prot = NACL_ABI_PROT_READ | NACL_ABI_PROT_EXEC;
/*
* NB: the log string is used by tests/mmap_main_nexe/nacl.scons
* and must be logged at a level that is less than or equal to
* the requested verbosity level there.
*/
NaClLog(1, "NaClElfFileMapSegment: EXERCISING MMAP LOAD PATH\n");
nap->main_exe_prevalidated = 1;
break;
case PF_R | PF_W:
/* read-write (initialized data) */
mmap_prot = NACL_ABI_PROT_READ | NACL_ABI_PROT_WRITE;
/*
* NB: the partial page processing will result in zeros
* following the initialized data, so that the BSS will be zero.
* On a typical system, this page is mapped in and the BSS
* region is memset to zero, which means that this partial page
* is faulted in. Rather than saving a syscall (pread) and
* faulting it in, we just use the same code path as for code,
* which is (slightly) simpler.
*/
break;
case PF_R:
/* read-only */
mmap_prot = NACL_ABI_PROT_READ;
/*
* For rodata, we allow mapping in "garbage" past a partial
* page; this potentially eliminates a disk I/O operation
* (if data section has no partial page), possibly delaying
* disk spin-up if the code was in the validation cache.
* And it saves another 64kB of swap.
*/
read_last_page_if_partial_allocation_page = 0;
break;
default:
NaClLog(LOG_FATAL, "NaClElfFileMapSegment: unexpected p_flags %d\n",
p_flags);
}
if (rounded_filesz != segment_size &&
read_last_page_if_partial_allocation_page) {
uintptr_t tail_offset = rounded_filesz - NACL_MAP_PAGESIZE;
size_t tail_size = segment_size - tail_offset;
NaClLog(4, "NaClElfFileMapSegment: pread tail\n");
read_ret = (*NACL_VTBL(NaClDesc, ndp)->
PRead)(ndp,
(void *) (paddr + tail_offset),
tail_size,
(nacl_off64_t) (file_offset + tail_offset));
NaClPerfCounterMark(&time_mmap_segment, "PRead tail");
NaClPerfCounterIntervalLast(&time_mmap_segment);
if (NaClSSizeIsNegErrno(&read_ret) || (size_t) read_ret != tail_size) {
NaClLog(LOG_ERROR,
"NaClElfFileMapSegment: pread load of page tail failed\n");
return LOAD_SEGMENT_BAD_PARAM;
}
rounded_filesz -= NACL_MAP_PAGESIZE;
}
/* mmap in */
if (rounded_filesz == 0) {
NaClLog(4,
"NaClElfFileMapSegment: no pages to map, probably because"
" the segment was a partial page, so it was processed by"
" reading.\n");
} else {
NaClLog(4,
"NaClElfFileMapSegment: mapping %"NACL_PRIuS" (0x%"
NACL_PRIxS") bytes to"
" address 0x%"NACL_PRIxPTR", position %"
NACL_PRIdElf_Off" (0x%"NACL_PRIxElf_Off")\n",
rounded_filesz, rounded_filesz,
paddr,
file_offset, file_offset);
image_sys_addr = (*NACL_VTBL(NaClDesc, ndp)->
Map)(ndp,
nap->effp,
(void *) paddr,
rounded_filesz,
mmap_prot,
NACL_ABI_MAP_PRIVATE | NACL_ABI_MAP_FIXED,
file_offset);
NaClPerfCounterMark(&time_mmap_segment, "MapFinal");
NaClPerfCounterIntervalLast(&time_mmap_segment);
if (image_sys_addr != paddr) {
NaClLog(LOG_FATAL,
("NaClElfFileMapSegment: map to 0x%"NACL_PRIxPTR" (prot %x) "
"failed: got 0x%"NACL_PRIxPTR"\n"),
paddr, mmap_prot, image_sys_addr);
}
/* Tell Valgrind that we've mapped a segment of nacl_file. */
NaClFileMappingForValgrind(paddr, rounded_filesz, file_offset);
}
return LOAD_OK;
}
/*
* Maps a writable version of the code at [offset, offset+size) and returns a
* pointer to the new mapping. Internally caches the last mapping between
* calls. Pass offset=0,size=0 to clear cache.
* Caller must hold nap->dynamic_load_mutex.
*/
static uintptr_t CachedMapWritableText(struct NaClApp *nap,
uint32_t offset,
uint32_t size) {
/*
* The nap->* variables used in this function can be in two states:
*
* 1)
* nap->dynamic_mapcache_size == 0
* nap->dynamic_mapcache_ret == 0
*
* Initial state, nothing is cached.
*
* 2)
* nap->dynamic_mapcache_size != 0
* nap->dynamic_mapcache_ret != 0
*
* We have a cached mmap result stored, that must be unmapped.
*/
struct NaClDesc *shm = nap->text_shm;
if (offset != nap->dynamic_mapcache_offset
|| size != nap->dynamic_mapcache_size) {
/*
* cache miss, first clear the old cache if needed
*/
if (nap->dynamic_mapcache_size > 0) {
NaClDescUnmapUnsafe(shm, (void *) nap->dynamic_mapcache_ret,
nap->dynamic_mapcache_size);
nap->dynamic_mapcache_offset = 0;
nap->dynamic_mapcache_size = 0;
nap->dynamic_mapcache_ret = 0;
}
/*
* update that cached version
*/
if (size > 0) {
uint32_t current_page_index;
uint32_t end_page_index;
uintptr_t mapping = (*((struct NaClDescVtbl const *)
shm->base.vtbl)->
Map)(shm,
NaClDescEffectorTrustedMem(),
NULL,
size,
NACL_ABI_PROT_READ | NACL_ABI_PROT_WRITE,
NACL_ABI_MAP_SHARED,
offset);
if (NaClPtrIsNegErrno(&mapping)) {
return 0;
}
/*
* To reduce the number of mprotect() system calls, we coalesce
* MakeDynamicCodePagesVisible() calls for adjacent pages that
* have yet not been allocated.
*/
current_page_index = offset / NACL_MAP_PAGESIZE;
end_page_index = (offset + size) / NACL_MAP_PAGESIZE;
while (current_page_index < end_page_index) {
uint32_t start_page_index = current_page_index;
/* Find the end of this block of unallocated pages. */
while (current_page_index < end_page_index &&
!BitmapIsBitSet(nap->dynamic_page_bitmap, current_page_index)) {
current_page_index++;
}
if (current_page_index > start_page_index) {
uintptr_t writable_addr =
mapping + (start_page_index * NACL_MAP_PAGESIZE - offset);
MakeDynamicCodePagesVisible(nap, start_page_index, current_page_index,
(uint8_t *) writable_addr);
}
current_page_index++;
}
nap->dynamic_mapcache_offset = offset;
nap->dynamic_mapcache_size = size;
nap->dynamic_mapcache_ret = mapping;
}
}
return nap->dynamic_mapcache_ret;
}
