trusted_thread_x86_64.S

// Copyright (c) 2010 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include <asm/unistd.h>


#define CHECK_SYSCALL_ZERO  test %rax, %rax; jnz fatal_error


        .internal playground$runTrustedThread
        .global playground$runTrustedThread
playground$runTrustedThread:
        push %rbx
        push %rbp
        mov  %rdi, %rbp          // %rbp = args
        xor  %rbx, %rbx          // initial sequence number
        lea  999f(%rip), %r15    // continue in same thread

        // Signal handlers are process-wide. This means that for security
        // reasons, we cannot allow that the trusted thread ever executes any
        // signal handlers.
        // We prevent the execution of signal handlers by setting a signal
        // mask that blocks all signals. In addition, we make sure that the
        // stack pointer is invalid.
        // We cannot reset the signal mask until after we have enabled
        // Seccomp mode. Our sigprocmask() wrapper would normally do this by
        // raising a signal, modifying the signal mask in the kernel-generated
        // signal frame, and then calling sigreturn(). This presents a bit of
        // a Catch-22, as all signals are masked and we can therefore not
        // raise any signal that would allow us to generate the signal stack
        // frame.
        // Instead, we have to create the signal stack frame prior to entering
        // Seccomp mode. This incidentally also helps us to restore the
        // signal mask to the same value that it had prior to entering the
        // sandbox.
        // The signal wrapper for clone() is the second entry point into this
        // code (by means of sending an IPC to its trusted thread). It goes
        // through the same steps of creating a signal stack frame on the
        // newly created thread's stacks prior to cloning. See clone.cc for
        // details.
        mov  $__NR_clone + 0xF000, %eax
        mov  %rsp, %rcx
        int  $0                  // push a signal stack frame (see clone.cc)
        mov  %rcx, 0xA0(%rsp)    // pop stack upon call to sigreturn()
        mov  %r15, 0xA8(%rsp)    // return address: continue in same thread
        mov  %rsp, %r9
        mov  $2, %rdi            // how     = SIG_SETMASK
        pushq $-1
        mov  %rsp, %rsi          // set     = full mask
        xor  %rdx, %rdx          // old_set = NULL
        mov  $8, %r10            // mask all 64 signals
        mov  $__NR_rt_sigprocmask, %eax
        syscall
        CHECK_SYSCALL_ZERO
        xor  %rsp, %rsp          // invalidate the stack in all trusted code
        jmp  20f                 // create trusted thread

        // TODO(markus): Coalesce the read() operations by reading into a
        //               bigger buffer.

        // Parameters:
        //   *%fs: secure memory region
        //         the page following this one contains the scratch space
        //   %r13: thread's side of threadFd

        // Local variables:
        //   %rbx: sequence number for trusted calls

        // Temporary variables:
        //   %r8: child stack
        //   %r9: system call number, child stack
        //  %rbp: secure memory of previous thread

        // Layout of secure shared memory region (c.f. securemem.h):
        //   0x00:  pointer to the secure shared memory region (i.e. self)
        //   0x08:  sequence number; must match %rbx
        //   0x10:  call type; must match %eax, iff %eax == -1 || %eax == -2
        //   0x18:  system call number; passed to syscall in %rax
        //   0x20:  first argument; passed to syscall in %rdi
        //   0x28:  second argument; passed to syscall in %rsi
        //   0x30:  third argument; passed to syscall in %rdx
        //   0x38:  fourth argument; passed to syscall in %r10
        //   0x40:  fifth argument; passed to syscall in %r8
        //   0x48:  sixth argument; passed to syscall in %r9
        //   0x50-0xC0: no longer used
        //   0xC8:  new shared memory for clone()
        //   0xD0:  no longer used
        //   0xD4:  no longer used
        //   0xD8:  set to non-zero, if in debugging mode
        //   0xDC:  most recent SHM id returned by shmget(IPC_PRIVATE)
        //   0xE0:  cookie assigned to us by the trusted process (TLS_COOKIE)
        //   0xE8:  thread id (TLS_TID)
        //   0xF0:  threadFdPub (TLS_THREAD_FD)
        //   0xF8:  syscallMutex
        //   0xFC:  maxSyscall
        //   0x100: syscallTable
        //   0x200-0x1000: securely passed verified file name(s)

        // Layout of (untrusted) scratch space:
        //   0x00:  syscall number; passed in %rax
        //   0x04:  first argument; passed in %rdi
        //   0x0C:  second argument; passed in %rsi
        //   0x14:  third argument; passed in %rdx
        //   0x1C:  fourth argument; passed in %r10
        //   0x24:  fifth argument; passed in %r8
        //   0x2C:  sixth argument; passed in %r9
        //   0x34:  return value
        //   0x3C:  RDTSCP result (%eax)
        //   0x40:  RDTSCP result (%edx)
        //   0x44:  RDTSCP result (%ecx)
        //   0x48:  last system call (not used on x86-64)
        //   0x4C:  number of consecutive calls to a time fnc; unused on x86-64
        //   0x50:  nesting level of system calls (for debugging purposes only)
        //   0x54:  signal mask
        //   0x5C:  in SEGV handler

        // We use the %fs register for accessing the secure read-only page, and
        // the untrusted scratch space immediately following it. The segment
        // register and the local descriptor table is set up by passing
        // appropriate arguments to clone().

      0:xor  %rsp, %rsp
        mov  $2, %ebx            // %rbx  = initial sequence number

        // Read request from untrusted thread, or from trusted process. In
        // either case, the data that we read has to be considered untrusted.
        // read(threadFd, &scratch, 4)
      1:xor  %rax, %rax          // NR_read
        mov  %r13, %rdi          // fd  = threadFd
        mov  %fs:0x0, %rsi       // secure_mem
        add  $0x1000, %rsi       // buf = &scratch
        mov  $4, %edx            // len = 4
      2:syscall
        cmp  $-4, %rax           // EINTR
        jz   2b
        cmp  %rdx, %rax
        jnz  fatal_error

        // Retrieve system call number. It is crucial that we only dereference
        // %fs:0x1000 exactly once. Afterwards, memory becomes untrusted and
        // we must use the value that we have read the first time.
        mov  0(%rsi), %eax

        // If syscall number is -1, execute an unlocked system call from the
        // secure memory area
        cmp  $-1, %eax
        jnz  5f
      3:cmp  %rbx, %fs:0x8
        jne  fatal_error
        cmp  %fs:0x10, %eax
        jne  fatal_error
        mov  %fs:0x18, %eax
        mov  %fs:0x20, %rdi
        mov  %fs:0x28, %rsi
        mov  %fs:0x30, %rdx
        mov  %fs:0x38, %r10
        mov  %fs:0x40, %r8
        mov  %fs:0x48, %r9
        cmp  %rbx, %fs:0x8
        jne  fatal_error
        add  $2, %rbx

        // clone() has unusual calling conventions and must be handled
        // specially
        cmp  $__NR_clone, %rax
        jz   19f

        // shmget() gets some special treatment. Whenever we return from this
        // system call, we remember the most recently returned SysV shm id.
        cmp  $__NR_shmget, %eax
        jnz  4f
        syscall
        mov  %rax, %r8
        mov  $__NR_clone, %eax
        mov  $17, %edi           // flags = SIGCHLD
        mov  $1, %esi            // stack = 1
        syscall
        test %rax, %rax
        js   fatal_error
        mov  %rax, %rdi
        jnz  8f                  // wait for child, then return result
        mov  %fs:0x0, %rdi       // start = secure_mem
        mov  $4096, %esi         // len   = 4096
        mov  $3, %edx            // prot  = PROT_READ | PROT_WRITE
        mov  $__NR_mprotect, %eax
        syscall
        CHECK_SYSCALL_ZERO
        mov  %r8d, 0xDC(%rdi)    // set most recently returned SysV shm id
        xor  %rdi, %rdi

        // When debugging messages are enabled, warn about expensive system
        // calls
        #ifndef NDEBUG
        cmpw $0, %fs:0xD8        // debug mode
        jz   27f
        mov  $__NR_write, %eax
        mov  $2, %edi            // fd = stderr
        lea  101f(%rip), %rsi    // "This is an expensive system call"
        mov  $102f-101f, %edx    // len = strlen(msg)
        syscall
        xor  %rdi, %rdi
        #endif

        jmp  27f                 // exit program, no message
      4:syscall
        jmp  15f                 // return result

        // If syscall number is -2, execute locked system call from the
        // secure memory area
      5:jg   12f
        cmp  $-2, %eax
        jnz  9f
        cmp  %rbx, %fs:0x8
        jne  fatal_error
        cmp  %eax, %fs:0x10
        jne  fatal_error

        // When debugging messages are enabled, warn about expensive system
        // calls
        #ifndef NDEBUG
        cmpw $0, %fs:0xD8        // debug mode
        jz   6f
        mov  $__NR_write, %eax
        mov  $2, %edi            // fd = stderr
        lea  101f(%rip), %rsi    // "This is an expensive system call"
        mov  $102f-101f, %edx    // len = strlen(msg)
        syscall
      6:
        #endif

        mov  %fs:0x18, %eax
        mov  %fs:0x20, %rdi
        mov  %fs:0x28, %rsi
        mov  %fs:0x30, %rdx
        mov  %fs:0x38, %r10
        mov  %fs:0x40, %r8
        mov  %fs:0x48, %r9
        cmp  %rbx, %fs:0x8
        jne  fatal_error

        // exit() terminates trusted thread
        cmp  $__NR_exit, %eax
        jz   18f

        // Perform requested system call
        syscall

        // Unlock mutex
      7:cmp  %rbx, %fs:0x8
        jne  fatal_error
        mov  %fs:0, %r12
        add  $2, %rbx
        mov  %rax, %r8
        mov  $__NR_clone, %eax
        mov  $17, %rdi           // flags = SIGCHLD
        mov  $1, %rsi            // stack = 1
        syscall
        test %rax, %rax
        js   fatal_error
        jz   22f                 // unlock and exit
        mov  %rax, %rdi
      8:xor  %rsi, %rsi
        xor  %rdx, %rdx
        xor  %r10, %r10
        mov  $__NR_wait4, %eax
        syscall
        cmp  $-4, %eax           // EINTR
        jz   8b
        mov  %r8, %rax
        jmp  15f                 // return result

        // If syscall number is -3, read the time stamp counter
      9:cmp  $-3, %eax
        jnz  10f
        rdtsc                    // sets %edx:%eax
        xor  %rcx, %rcx
        jmp  11f
      10:cmp  $-4, %eax
        jnz  12f
        rdtscp                   // sets %edx:%eax and %ecx
     11:add  $0x3C, %rsi
        mov  %eax, 0(%rsi)
        mov  %edx, 4(%rsi)
        mov  %ecx, 8(%rsi)
        mov  $12, %edx
        jmp  16f                 // return result

        // Check in syscallTable whether this system call is unrestricted
     12:mov  %rax, %r9
        #ifndef NDEBUG
        cmpw $0, %fs:0xD8        // debug mode
        jnz  13f
        #endif
        cmp  %fs:0xFC, %eax      // maxSyscall
        ja   fatal_error
        shl  $4, %rax
        mov  %fs:0x100, %rdi     // syscallTable
        add  %rdi, %rax
        mov  0(%rax), %rax
        cmp  $1, %rax
        jne  fatal_error

        // Default behavior for unrestricted system calls is to just execute
        // them. Read the remaining arguments first.
     13:mov  %rsi, %r8
        xor  %rax, %rax          // NR_read
        mov  %r13, %rdi          // fd  = threadFd
        add  $4, %rsi            // buf = &scratch + 4
        mov  $48, %edx           // len = 6*sizeof(void *)
     14:syscall
        cmp  $-4, %rax           // EINTR
        jz   14b
        cmp  %rdx, %rax
        jnz  fatal_error
        mov  %r9, %rax
        mov  0x04(%r8), %rdi
        mov  0x0C(%r8), %rsi
        mov  0x14(%r8), %rdx
        mov  0x1C(%r8), %r10
        mov  0x2C(%r8), %r9
        mov  0x24(%r8), %r8
        cmp  $__NR_exit_group, %rax
        jz   27f                 // exit program, no message
        syscall

        // Return result of system call to sandboxed thread
     15:mov  %fs:0x0, %rsi       // secure_mem
        add  $0x1034, %rsi       // buf   = &scratch + 52
        mov  %rax, (%rsi)
        mov  $8, %edx            // len   = 8
     16:mov  %r13, %rdi          // fd    = threadFd
        mov  $__NR_write, %eax
     17:syscall
        cmp  %rdx, %rax
        jz   1b
        cmp  $-4, %rax           // EINTR
        jz   17b
        jmp  fatal_error

        // NR_exit:
        // Exit trusted thread after cleaning up resources
     18:mov  %fs:0x0, %r12       // secure_mem
        mov  0xF0(%r12), %rdi    // fd     = threadFdPub
        mov  $__NR_close, %eax
        syscall
        CHECK_SYSCALL_ZERO
        mov  %r12, %rdi          // start  = secure_mem
        mov  $8192, %esi         // length = 8192
        xor  %rdx, %rdx          // prot   = PROT_NONE
        mov  $__NR_mprotect, %eax
        syscall
        CHECK_SYSCALL_ZERO
        mov  %r13, %rdi          // fd     = threadFd
        mov  $__NR_close, %eax
        syscall
        CHECK_SYSCALL_ZERO
        mov  $__NR_clone, %eax
        mov  $17, %rdi           // flags = SIGCHLD
        mov  $1, %rsi            // stack = 1
        syscall
        mov  %rax, %rdi
        test %rax, %rax
        js   27f                 // exit process
        jne  21f                 // reap helper, exit thread
        jmp  22f                 // unlock mutex

        // NR_clone:
        // Original trusted thread calls clone() to create new nascent
        // thread. This thread is (typically) fully privileged and shares all
        // resources with the caller (i.e. the previous trusted thread),
        // and by extension it shares all resources with the sandbox'd
        // threads.
     19:mov  %fs:0x0, %rbp       // %rbp  = old_shared_mem
        mov  %rsi, %r15          // remember child stack
        mov  $1, %rsi            // stack = 1
        syscall                  // calls NR_clone
        cmp  $-4095, %rax        // return codes -1..-4095 are errno values
        jae  7b                  // unlock mutex, return result
        test %rax, %rax
        jne  15b                 // return result

        // In nascent thread, now.
        // Undo sequence number increase that was made for the general case.
        sub  $2, %rbx

        // We want to maintain an invalid %rsp whenver we access untrusted
        // memory. This ensures that even if an attacker can trick us into
        // triggering a SIGSEGV, we will never successfully execute a signal
        // handler.
        // Signal handlers are inherently dangerous, as an attacker could trick
        // us into returning to the wrong address by adjusting the signal stack
        // right before the handler returns.
        // N.B. While POSIX is curiously silent about this, it appears that on
        // Linux, alternate signal stacks are a per-thread property. That is
        // good. It means that this security mechanism works, even if the
        // sandboxed thread manages to set up an alternate signal stack.
        //
        // TODO(markus): We currently do not support emulating calls to
        // sys_clone() with a zero (i.e. copy) stack parameter. See clone.cc
        // for a discussion on how to fix this, if this ever becomes neccessary
        mov  %r15, %r9           // %r9 = child_stack
        xor  %r15, %r15          // Request to return from clone() when done

        // Get thread id of nascent thread
     20:mov  $__NR_gettid, %eax
        syscall
        mov  %rax, %r14

        // Nascent thread creates socketpair() for sending requests to
        // trusted thread.
        // We can create the filehandles on the child's stack. Filehandles are
        // always treated as untrusted.
        // socketpair(AF_UNIX, SOCK_STREAM, 0, fds)
        sub  $0x10, %r9
        mov  %r15, 8(%r9)        // preserve return address on child stack
        mov  $__NR_socketpair, %eax
        mov  $1, %edi            // domain = AF_UNIX
        mov  $1, %esi            // type = SOCK_STREAM
        xor  %rdx, %rdx          // protocol = 0
        mov  %r9, %r10           // sv = child_stack
        syscall
        test %rax, %rax
        jz   28f

        // If things went wrong, we don't have an (easy) way of signaling
        // the parent. For our purposes, it is sufficient to fail with a
        // fatal error.
        jmp  fatal_error
     21:xor  %rsi, %rsi
        xor  %rdx, %rdx
        xor  %r10, %r10
        mov  $__NR_wait4, %eax
        syscall
        cmp  $-4, %eax           // EINTR
        jz   21b
        jmp  23f                 // exit thread (no message)
        // Unlock syscallMutex and exit.
        // On entry %r12 = secureMem.  We cannot use %fs:0 in the case where
        // the page has been mprotect()'d to PROT_NONE.
     22:mov  %r12, %rdi
        mov  $4096, %esi
        mov  $3, %edx            // prot = PROT_READ | PROT_WRITE
        mov  $__NR_mprotect, %eax
        syscall
        CHECK_SYSCALL_ZERO
        add  $0xF8, %rdi
        lock; addl $0x80000000, (%rdi)
        jz   23f                 // exit thread
        mov  $1, %edx
        mov  %rdx, %rsi          // FUTEX_WAKE
        mov  $__NR_futex, %eax
        syscall
     23:mov  $__NR_exit, %eax
        mov  $1, %edi            // status = 1
     24:syscall
fatal_error:
        mov  $__NR_write, %eax
        mov  $2, %edi            // fd = stderr
        lea  100f(%rip), %rsi    // "Sandbox violation detected"
        mov  $101f-100f, %edx    // len = strlen(msg)
        syscall
     26:mov  $1, %edi
     27:mov  $__NR_exit_group, %eax
        jmp  24b

        // The first page is mapped read-only for use as securely shared memory
     28:mov  0xC8(%rbp), %r12    // %r12 = secure shared memory
        cmp  %rbx, 8(%rbp)
        jne  fatal_error
        mov  $__NR_mprotect, %eax
        mov  %r12, %rdi          // addr = secure_mem
        mov  $4096, %esi         // len  = 4096
        mov  $1, %edx            // prot = PROT_READ
        syscall
        CHECK_SYSCALL_ZERO

        // The second page is used as scratch space by the trusted thread.
        // Make it writable.
        mov  $__NR_mprotect, %eax
        add  $4096, %rdi         // addr = secure_mem + 4096
        mov  $3, %edx            // prot = PROT_READ | PROT_WRITE
        syscall
        CHECK_SYSCALL_ZERO

        // Call clone() to create new trusted thread().
        // clone(CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|
        //       CLONE_SYSVSEM|CLONE_UNTRACED|CLONE_SETTLS, stack, NULL, NULL,
        //       tls)
        mov  4(%r9), %r13d       // %r13  = threadFd (on child's stack)
        mov  $__NR_clone, %eax
        mov  $0x8D0F00, %edi     // flags = VM|FS|FILES|SIGH|THR|SYSV|UTR|TLS
        mov  $1, %rsi            // stack = 1
        mov  %r12, %r8           // tls   = new_secure_mem
        cmp  %rbx, 8(%rbp)
        jne  fatal_error
        syscall
        test %rax, %rax
        js   fatal_error
        jz   0b                  // invoke trustedThreadFnc()

        // Copy the caller's signal mask
        mov  0x1054(%rbp), %rax
        mov  %rax, 0x1054(%r12)

        // Done creating trusted thread. We can get ready to return to caller
        mov  %r9, %r8            // %r8 = child_stack
        mov  0(%r9), %r9d        // %r9 = threadFdPub

        // Set up thread local storage with information on how to talk to
        // trusted thread and trusted process.
        lea  0xE0(%r12), %rsi    // args   = &secure_mem.TLS;
        mov  $__NR_arch_prctl, %eax
        mov  $0x1001, %edi       // option = ARCH_SET_GS
        syscall
        cmp  $-4095, %rax        // return codes -1..-4095 are errno values
        jae  fatal_error

        add  $0x10, %r8

        // Check the sequence number
        cmp  %rbx, 8(%rbp)
        jne  fatal_error

        // Nascent thread launches a helper that doesn't share any of our
        // resources, except for pages mapped as MAP_SHARED.
        // clone(SIGCHLD, stack=1)
        mov  $__NR_clone, %eax
        mov  $17, %rdi           // flags = SIGCHLD
        mov  $1, %rsi            // stack = 1
        syscall
        test %rax, %rax
        js   fatal_error
        jne  31f

        // Use sendmsg() to send to the trusted process the file handles for
        // communicating with the new trusted thread. We also send the address
        // of the secure memory area (for sanity checks) and the thread id.
        // transport = Sandbox::cloneFdPub()
        mov  playground$cloneFdPub(%rip), %edi
        cmp  %rbx, 8(%rbp)
        jne  fatal_error

        // 0x00 msg:
        //   0x00 msg_name       ($0)
        //   0x08 msg_namelen    ($0)
        //   0x10 msg_iov        (%r8 + 0x44)
        //   0x18 msg_iovlen     ($1)
        //   0x20 msg_control    (%r8 + 0x54)
        //   0x28 msg_controllen ($0x18)
        // 0x30 data:
        //   0x30 msg_flags/err  ($0)
        //   0x34 secure_mem     (%r12)
        //   0x3C threadId       (%r14d)
        //   0x40 threadFdPub    (%r9d)
        // 0x44 iov:
        //   0x44 iov_base       (%r8 + 0x30)
        //   0x4C iov_len        ($0x14)
        // 0x54 cmsg:
        //   0x54 cmsg_len       ($0x18)
        //   0x5C cmsg_level     ($1, SOL_SOCKET)
        //   0x60 cmsg_type      ($1, SCM_RIGHTS)
        //   0x64 threadFdPub    (%r9d)
        //   0x68 threadFd       (%r13d)
        // 0x6C
        lea  sendmsg_data(%rip), %r8
        xor  %rdx, %rdx          // flags = 0
        mov  %rdx, 0x00(%r8)     // msg_name
        mov  %edx, 0x08(%r8)     // msg_namelen
        mov  %edx, 0x30(%r8)     // msg_flags
        mov  $1, %r11d
        mov  %r11, 0x18(%r8)     // msg_iovlen
        mov  %r11d, 0x5C(%r8)    // cmsg_level
        mov  %r11d, 0x60(%r8)    // cmsg_type
        lea  0x30(%r8), %r11
        mov  %r11, 0x44(%r8)     // iov_base
        add  $0x14, %r11
        mov  %r11, 0x10(%r8)     // msg_iov
        add  $0x10, %r11
        mov  %r11, 0x20(%r8)     // msg_control
        mov  $0x14, %r11d
        mov  %r11, 0x4C(%r8)     // iov_len
        add  $4, %r11d
        mov  %r11, 0x28(%r8)     // msg_controllen
        mov  %r11, 0x54(%r8)     // cmsg_len
        mov  %r12, 0x34(%r8)     // secure_mem
        mov  %r14d, 0x3C(%r8)    // threadId
        mov  %r9d, 0x40(%r8)     // threadFdPub
        mov  %r9d, 0x64(%r8)     // threadFdPub
        mov  %r13d, 0x68(%r8)    // threadFd
        mov  $__NR_sendmsg, %eax
        mov  %r8, %rsi           // msg
        syscall
     30:xor  %rdi, %rdi
        jmp  27b                 // exit process (no error message)

        // Reap helper
     31:mov  %rax, %rdi
     32:lea  -4(%r8), %rsi
        xor  %rdx, %rdx
        xor  %r10, %r10
        mov  $__NR_wait4, %eax
        syscall
        cmp  $-4, %eax           // EINTR
        jz   32b
        mov  -4(%r8), %eax
        test %rax, %rax
        jnz  26b                 // exit process (no error message)

        // Release privileges by entering seccomp mode.
        mov  $__NR_prctl, %eax
        mov  $22, %edi           // PR_SET_SECCOMP
        mov  $1, %esi
        syscall
        CHECK_SYSCALL_ZERO

        // We can finally start using the stack. Signal handlers no longer pose
        // a threat to us.
        mov  %r8, %rsp

        // Back in the newly created sandboxed thread, wait for trusted process
        // to receive request. It is possible for an attacker to make us
        // continue even before the trusted process is done. This is OK. It'll
        // result in us putting stale values into the new thread's TLS. But
        // that data is considered untrusted anyway.
        push %rax
        mov  $1, %edx            // len       = 1
        mov  %rsp, %rsi          // buf       = %rsp
        mov  %r9, %rdi           // fd        = threadFdPub
     33:xor  %rax, %rax          // NR_read
        syscall
        cmp  $-4, %rax           // EINTR
        jz   33b
        cmp  %rdx, %rax
        jne  fatal_error
        pop  %rax

        // Returning to the place where clone() had been called. We rely on
        // using rt_sigreturn() for restoring our registers. The caller already
        // created a signal stack frame and patched the register values
        // with the ones that were in effect prior to calling sandbox_clone().
        mov  $__NR_rt_sigreturn, %eax
        syscall

        .pushsection ".rodata"
    100:.ascii "Sandbox violation detected, program aborted\n"
    101:.ascii "WARNING! This is an expensive system call\n"
    102:
        .popsection

    999:pop  %rbp
        pop  %rbx
        ret


        .bss
        // Reserve space for sendmsg() data.  This is used in a fork()'d
        // helper process, so in principle this could safely overlap and
        // overwrite other data, but it is such a small amount of memory
        // that it is not worth trying to do that.  The only requirement
        // is that this must be in a MAP_PRIVATE mapping so that an
        // untrusted thread cannot modify the forked subprocess's copy.
sendmsg_data:
        .space 0x6C