Mojo + NaCl prototype.

mojo/monacl/gen/mojo_syscall.cc.template

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// WARNING this file was generated by $script_name
+// Do not edit by hand.
+
+#include "mojo/monacl/mojo_syscall.h"
+
+#include <stdio.h>
+
+#include "mojo/public/c/system/core.h"
+#include "native_client/src/public/nacl_app.h"
+#include "native_client/src/trusted/desc/nacl_desc_custom.h"
+#include "native_client/src/trusted/service_runtime/nacl_copy.h"
+#include "native_client/src/trusted/service_runtime/sel_ldr.h"
+
+namespace {
+
+class ScopedCopyLock {

[Mark Seaborn, 2014/08/26 16:25:53]

How about putting all these definitions into a normal .h file instead of a
template file?

[Nick Bray (chromium), 2014/09/03 23:45:03]

Moved out templates and inline functions.

+ public:
+  explicit ScopedCopyLock(struct NaClApp *nap) : nap_(nap) {

[Mark Seaborn, 2014/08/26 16:25:53]

Use "* " spacing in Chromium code.  Same elsewhere in the change.

[Nick Bray (chromium), 2014/09/03 23:45:03]

Done.

+    NaClCopyTakeLock(nap_);
+  }
+  ~ScopedCopyLock() {
+    NaClCopyDropLock(nap_);
+  }
+ private:
+  struct NaClApp *nap_;
+};
+
+static INLINE uintptr_t NaClUserToSysAddrArray(
+    struct NaClApp *nap,
+    uintptr_t uaddr,

[Mark Seaborn, 2014/08/26 16:25:53]

Nit: use uint32_t (as you do below)

[Nick Bray (chromium), 2014/09/03 23:45:03]

Done.

+    size_t count,
+    size_t size) {
+  // TODO overflow checking

[Mark Seaborn, 2014/08/26 16:25:52]

Nit: "TODO(ncbray)"

[Nick Bray (chromium), 2014/09/03 23:45:02]

Done.

+  size_t range = count * size;
+  return NaClUserToSysAddrRange(nap, uaddr, range);
+}
+
+template <typename T> bool ConvertScalarInput(

[Mark Seaborn, 2014/08/26 16:25:52]

"Convert" is vague.  How about ReadScalarInput or CopyInScalarInput?

[Nick Bray (chromium), 2014/09/03 23:45:03]

Although correct for this function, all the "convert" functions are similar and
not all of them read.  See the generated file.  If I am going to rename one of
them, I'd like some sort of consistent scheme.

+    struct NaClApp *nap,
+    uint32_t user_ptr,
+    T* value) {
+  if (user_ptr) {
+    uintptr_t temp = NaClUserToSysAddrRange(nap, user_ptr, sizeof(T));

[Mark Seaborn, 2014/08/26 16:25:53]

Nit: 'temp' -> 'sys_addr'

[Nick Bray (chromium), 2014/09/03 23:45:02]

Breaks naming used in related functions.

+    if (temp != kNaClBadAddress) {
+      *value = *reinterpret_cast<T volatile*>(temp);
+      return true;
+    }
+  }
+  return false;
+}
+
+template <typename T> bool ConvertScalarOutput(

[Mark Seaborn, 2014/08/26 16:25:53]

This looks like it would be like ConvertScalarInput but operate in the reverse
direction.  But that's not the case.

Maybe rename to "ScalarOutputUserToSys" or "GetScalarOutputSysAddr"?

[Nick Bray (chromium), 2014/09/03 23:45:03]

Part of larger naming discussion.  (See above)

+    struct NaClApp *nap,
+    uint32_t user_ptr,
+    T volatile** sys_ptr) {
+  if (user_ptr) {
+    uintptr_t temp = NaClUserToSysAddrRange(nap, user_ptr, sizeof(T));
+    if (temp != kNaClBadAddress) {
+      *sys_ptr = reinterpret_cast<T volatile*>(temp);
+      return true;
+    }
+  }
+  return false;

[Mark Seaborn, 2014/08/26 16:25:53]

Security bug: this leaves *sys_ptr undefined, so the caller will write to an
undefined trusted address.

[Nick Bray (chromium), 2014/09/03 23:45:03]

The caller will always early out.  Added paranoid null pointer assignment, just
in case.

+}
+
+template <typename T> bool ConvertScalarInOut(
+    struct NaClApp *nap,
+    uint32_t user_ptr,
+    bool optional,
+    T* value,
+    T volatile** sys_ptr) {
+  if (user_ptr) {
+    uintptr_t temp = NaClUserToSysAddrRange(nap, user_ptr, sizeof(T));
+    if (temp != kNaClBadAddress) {
+      T volatile* converted = reinterpret_cast<T volatile*>(temp);
+      *sys_ptr = converted;
+      *value = *converted;
+      return true;
+    }
+  } else if (optional) {
+    *sys_ptr = 0;
+    *value = static_cast<T>(0); // Paranoia.
+    return true;
+  }
+  return false;
+}
+
+template <typename T> bool ConvertArray(
+    struct NaClApp *nap,
+    uint32_t user_ptr,
+    uint32_t length,
+    bool optional,
+    T** sys_ptr) {
+  if (user_ptr) {
+    uintptr_t temp = NaClUserToSysAddrArray(nap, user_ptr, length, sizeof(T));
+    if (temp != kNaClBadAddress) {
+      *sys_ptr = reinterpret_cast<T*>(temp);
+      return true;
+    }
+  } else if (optional) {
+    *sys_ptr = 0;
+    return true;
+  }
+  return false;
+}
+
+template <typename T> bool ConvertBytes(
+    struct NaClApp *nap,
+    uint32_t user_ptr,
+    uint32_t length,
+    bool optional,
+    T** sys_ptr) {
+  if (user_ptr) {
+    uintptr_t temp = NaClUserToSysAddrRange(nap, user_ptr, length);
+    if (temp != kNaClBadAddress) {
+      *sys_ptr = reinterpret_cast<T*>(temp);
+      return true;
+    }
+  } else if (optional) {
+    *sys_ptr = 0;
+    return true;
+  }
+  return false;
+}
+
+// TODO(ncbray): size validation and complete copy.
+// TODO(ncbray): ensure non-null / missized structs are covered by a test case.
+template <typename T> bool ConvertStruct(
+    struct NaClApp *nap,
+    uint32_t user_ptr,
+    bool optional,
+    T** sys_ptr) {
+  if (user_ptr) {
+    uintptr_t temp = NaClUserToSysAddrRange(nap, user_ptr, sizeof(T));
+    if (temp != kNaClBadAddress) {
+      *sys_ptr = reinterpret_cast<T*>(temp);
+      return true;
+    }
+  } else if (optional) {
+    *sys_ptr = 0;
+    return true;
+  }
+  return false;
+}
+
+void MojoDescDestroy(void *handle) {
+  UNREFERENCED_PARAMETER(handle);
+}
+
+ssize_t MojoDescSendMsg(void *handle,
+                        const struct NaClImcTypedMsgHdr *msg,
+                        int flags) {
+  UNREFERENCED_PARAMETER(flags);
+
+  struct NaClApp *nap = static_cast<struct NaClApp*>(handle);
+
+  if (msg->iov_length != 1 || msg->iov[0].length < 8 || msg->ndesc_length != 0) {
+    return -1;
+  }
+
+  uint32_t *params = static_cast<uint32_t*>(msg->iov[0].base);
+  uint32_t numParams = msg->iov[0].length / sizeof(*params);
+
+  uint32_t msgType = params[0];
+  switch (msgType) {
+$body
+  default:
+    return -1;
+  }
+
+  return -1;
+}
+
+ssize_t MojoDescRecvMsg(void *handle,
+                           struct NaClImcTypedMsgHdr *msg,
+                           int flags) {
+  UNREFERENCED_PARAMETER(handle);
+  UNREFERENCED_PARAMETER(msg);
+  UNREFERENCED_PARAMETER(flags);
+
+  return -1;
+}
+
+struct NaClDesc *MakeMojoDesc(struct NaClApp *nap) {
+  struct NaClDescCustomFuncs funcs = NACL_DESC_CUSTOM_FUNCS_INITIALIZER;
+  funcs.Destroy = MojoDescDestroy;
+  funcs.SendMsg = MojoDescSendMsg;
+  funcs.RecvMsg = MojoDescRecvMsg;
+  return NaClDescMakeCustomDesc(nap, &funcs);
+}
+
+} // namespace
+
+#define NACL_MOJO_DESC 8
+
+void InjectMojo(struct NaClApp *nap) {
+  NaClAppSetDesc(nap, NACL_MOJO_DESC, MakeMojoDesc(nap));
+}