Mojo + NaCl prototype.

mojo/monacl/mojo_syscall.cc

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// WARNING this file was generated by generate_monacl_bindings.py
+// Do not edit by hand.
+
+#include "mojo/monacl/mojo_syscall.h"
+
+#include <stdio.h>
+
+#include "mojo/public/c/system/core.h"
+#include "native_client/src/public/nacl_app.h"
+#include "native_client/src/shared/platform/nacl_log.h"
+#include "native_client/src/trusted/desc/nacl_desc_custom.h"
+#include "native_client/src/trusted/service_runtime/nacl_copy.h"
+#include "native_client/src/trusted/service_runtime/sel_ldr.h"
+
+static INLINE uintptr_t NaClUserToSysAddrArray(
+    struct NaClApp *nap,
+    uintptr_t uaddr,
+    size_t count,
+    size_t size) {
+  // TODO overflow checking
+  size_t range = count * size;
+  return NaClUserToSysAddrRange(nap, uaddr, range);
+}
+
+void MojoDescDestroy(void *handle) {
+  UNREFERENCED_PARAMETER(handle);
+  NaClLog(LOG_ERROR, "Called destroy...\n");
+}
+
+ssize_t MojoDescSendMsg(void *handle,
+                        const struct NaClImcTypedMsgHdr *msg,
+                        int flags) {
+  UNREFERENCED_PARAMETER(flags);
+
+  struct NaClApp *nap = static_cast<struct NaClApp*>(handle);
+
+  if (msg->iov_length != 1 || msg->iov[0].length < 8 || msg->ndesc_length != 0) {
+    NaClLog(LOG_ERROR, "Malformed message.\n");
+    return -1;
+  }
+
+  uint32_t *params = static_cast<uint32_t*>(msg->iov[0].base);
+  uint32_t numParams = msg->iov[0].length / sizeof(*params);
+
+  uint32_t msgType = params[0];
+  //printf("Message: %d.\n", msgType);
+  switch (msgType) {
+  case 0:
+    {
+      if (numParams != 5) {
+        return -1;
+      }
+      NaClCopyTakeLock(nap);
+      const struct MojoCreateSharedBufferOptions* options;
+      if (params[1] == 0) {
+        options = NULL;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[1], sizeof(*options));

[Mark Seaborn, 2014/07/21 16:31:39]

You should use NaClCopyInFromUser() and NaClCopyOutToUser() rather than the
NaClUserToSys functions.

The NaClCopy* functions will do the right security checks and use locks properly
on your behalf.

[Nick Bray (chromium), 2014/07/21 22:38:36]

Except that the logic is more complicated than NaClCopy*.  Null pointers must be
passed through, in/outs require copies in and out of the same pointer, options
structures have internal size declarations, data arrays will not be copied, but
handle arrays may be.  There are enough ways to shoot yourself in the foot here,
I don't see using NaClCopy* as having a huge benefit, all other complexities
considered.  Using NaClCopy* will also entail acquiring the copy lock ~10 times
instead of twice, which sort of sucks.

That being said, this code is the ugliest part of the CL and need to be cleaned
up.  For example, I just noticed that the "return -1" statements do not release
the copy lock.  I am pondering a combination of templated pointer conversion
logic and a scoped copy lock.

[Mark Seaborn, 2014/07/21 23:25:44]

You could make a wrapper around CopyIn/Out to handle NULLs.
This does raise the question of why you're calling NaClUserToSysAddrRange() once
for each parameter.  Why don't you pass the parameters in a struct instead?

[Mark Seaborn, 2014/09/09 19:13:10]

Can you add a TODO for passing the parameters in a struct instead?

[Nick Bray (chromium), 2014/09/09 23:12:32]

This transcends the scope of a TODO.  The issue tracker, if anything.

+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        options = reinterpret_cast<const struct MojoCreateSharedBufferOptions*>(temp);
+      }
+      uint64_t num_bytes;
+      if (params[2] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[2], sizeof(num_bytes));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        num_bytes = *reinterpret_cast<uint64_t volatile*>(temp);
+      }
+      MojoHandle* shared_buffer_handle_ptr;
+      MojoHandle shared_buffer_handle;
+      if (params[3] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[3], sizeof(shared_buffer_handle));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        shared_buffer_handle_ptr = reinterpret_cast<MojoHandle*>(temp);
+      }
+      MojoResult* result_ptr;
+      MojoResult result;
+      if (params[4] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[4], sizeof(result));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        result_ptr = reinterpret_cast<MojoResult*>(temp);
+      }
+      NaClCopyDropLock(nap);
+
+      result = MojoCreateSharedBuffer(options, num_bytes, &shared_buffer_handle);
+
+      NaClCopyTakeLock(nap);
+      *shared_buffer_handle_ptr = shared_buffer_handle;
+      *result_ptr = result;
+      NaClCopyDropLock(nap);
+
+      return 0;
+    }
+  case 1:
+    {
+      if (numParams != 5) {
+        return -1;
+      }
+      NaClCopyTakeLock(nap);
+      MojoHandle buffer_handle;
+      if (params[1] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[1], sizeof(buffer_handle));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        buffer_handle = *reinterpret_cast<MojoHandle volatile*>(temp);
+      }
+      const struct MojoDuplicateBufferHandleOptions* options;
+      if (params[2] == 0) {
+        options = NULL;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[2], sizeof(*options));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        options = reinterpret_cast<const struct MojoDuplicateBufferHandleOptions*>(temp);
+      }
+      MojoHandle* new_buffer_handle_ptr;
+      MojoHandle new_buffer_handle;
+      if (params[3] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[3], sizeof(new_buffer_handle));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        new_buffer_handle_ptr = reinterpret_cast<MojoHandle*>(temp);
+      }
+      MojoResult* result_ptr;
+      MojoResult result;
+      if (params[4] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[4], sizeof(result));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        result_ptr = reinterpret_cast<MojoResult*>(temp);
+      }
+      NaClCopyDropLock(nap);
+
+      result = MojoDuplicateBufferHandle(buffer_handle, options, &new_buffer_handle);
+
+      NaClCopyTakeLock(nap);
+      *new_buffer_handle_ptr = new_buffer_handle;
+      *result_ptr = result;
+      NaClCopyDropLock(nap);
+
+      return 0;
+    }
+  case 2:
+    {
+      if (numParams != 7) {
+        return -1;
+      }
+      NaClCopyTakeLock(nap);
+      MojoHandle buffer_handle;
+      if (params[1] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[1], sizeof(buffer_handle));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        buffer_handle = *reinterpret_cast<MojoHandle volatile*>(temp);
+      }
+      uint64_t offset;
+      if (params[2] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[2], sizeof(offset));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        offset = *reinterpret_cast<uint64_t volatile*>(temp);
+      }
+      uint64_t num_bytes;
+      if (params[3] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[3], sizeof(num_bytes));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        num_bytes = *reinterpret_cast<uint64_t volatile*>(temp);
+      }
+      void** buffer_ptr;
+      void* buffer;
+      if (params[4] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[4], sizeof(buffer));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        buffer_ptr = reinterpret_cast<void**>(temp);
+      }
+      MojoMapBufferFlags flags;
+      if (params[5] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[5], sizeof(flags));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        flags = *reinterpret_cast<MojoMapBufferFlags volatile*>(temp);
+      }
+      MojoResult* result_ptr;
+      MojoResult result;
+      if (params[6] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[6], sizeof(result));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        result_ptr = reinterpret_cast<MojoResult*>(temp);
+      }
+      NaClCopyDropLock(nap);
+
+      result = MojoMapBuffer(buffer_handle, offset, num_bytes, &buffer, flags);
+
+      NaClCopyTakeLock(nap);
+      *buffer_ptr = buffer;
+      *result_ptr = result;
+      NaClCopyDropLock(nap);
+
+      return 0;
+    }
+  case 3:
+    {
+      if (numParams != 3) {
+        return -1;
+      }
+      NaClCopyTakeLock(nap);
+      void* buffer;
+      if (params[1] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[1], sizeof(buffer));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        buffer = *reinterpret_cast<void* volatile*>(temp);
+      }
+      MojoResult* result_ptr;
+      MojoResult result;
+      if (params[2] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[2], sizeof(result));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        result_ptr = reinterpret_cast<MojoResult*>(temp);
+      }
+      NaClCopyDropLock(nap);
+
+      result = MojoUnmapBuffer(buffer);
+
+      NaClCopyTakeLock(nap);
+      *result_ptr = result;
+      NaClCopyDropLock(nap);
+
+      return 0;
+    }
+  case 4:
+    {
+      if (numParams != 5) {
+        return -1;
+      }
+      NaClCopyTakeLock(nap);
+      const struct MojoCreateDataPipeOptions* options;
+      if (params[1] == 0) {
+        options = NULL;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[1], sizeof(*options));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        options = reinterpret_cast<const struct MojoCreateDataPipeOptions*>(temp);
+      }
+      MojoHandle* data_pipe_producer_handle_ptr;
+      MojoHandle data_pipe_producer_handle;
+      if (params[2] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[2], sizeof(data_pipe_producer_handle));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        data_pipe_producer_handle_ptr = reinterpret_cast<MojoHandle*>(temp);
+      }
+      MojoHandle* data_pipe_consumer_handle_ptr;
+      MojoHandle data_pipe_consumer_handle;
+      if (params[3] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[3], sizeof(data_pipe_consumer_handle));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        data_pipe_consumer_handle_ptr = reinterpret_cast<MojoHandle*>(temp);
+      }
+      MojoResult* result_ptr;
+      MojoResult result;
+      if (params[4] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[4], sizeof(result));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        result_ptr = reinterpret_cast<MojoResult*>(temp);
+      }
+      NaClCopyDropLock(nap);
+
+      result = MojoCreateDataPipe(options, &data_pipe_producer_handle, &data_pipe_consumer_handle);
+
+      NaClCopyTakeLock(nap);
+      *data_pipe_producer_handle_ptr = data_pipe_producer_handle;
+      *data_pipe_consumer_handle_ptr = data_pipe_consumer_handle;
+      *result_ptr = result;
+      NaClCopyDropLock(nap);
+
+      return 0;
+    }
+  case 5:
+    {
+      if (numParams != 6) {
+        return -1;
+      }
+      NaClCopyTakeLock(nap);
+      MojoHandle data_pipe_producer_handle;
+      if (params[1] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[1], sizeof(data_pipe_producer_handle));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        data_pipe_producer_handle = *reinterpret_cast<MojoHandle volatile*>(temp);
+      }
+      uint32_t* num_bytes_ptr;
+      uint32_t num_bytes;
+      if (params[3] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[3], sizeof(num_bytes));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        num_bytes_ptr = reinterpret_cast<uint32_t*>(temp);
+        // In/Out
+        num_bytes = *num_bytes_ptr;
+      }
+      MojoWriteDataFlags flags;
+      if (params[4] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[4], sizeof(flags));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        flags = *reinterpret_cast<MojoWriteDataFlags volatile*>(temp);
+      }
+      const void* elements;
+      if (params[2] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[2], num_bytes);
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        elements = reinterpret_cast<const void*>(temp);
+      }
+      MojoResult* result_ptr;
+      MojoResult result;
+      if (params[5] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[5], sizeof(result));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        result_ptr = reinterpret_cast<MojoResult*>(temp);
+      }
+      NaClCopyDropLock(nap);
+
+      result = MojoWriteData(data_pipe_producer_handle, elements, &num_bytes, flags);
+
+      NaClCopyTakeLock(nap);
+      *num_bytes_ptr = num_bytes;
+      *result_ptr = result;
+      NaClCopyDropLock(nap);
+
+      return 0;
+    }
+  case 6:
+    {
+      if (numParams != 6) {
+        return -1;
+      }
+      NaClCopyTakeLock(nap);
+      MojoHandle data_pipe_producer_handle;
+      if (params[1] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[1], sizeof(data_pipe_producer_handle));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        data_pipe_producer_handle = *reinterpret_cast<MojoHandle volatile*>(temp);
+      }
+      void** buffer_ptr;
+      void* buffer;
+      if (params[2] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[2], sizeof(buffer));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        buffer_ptr = reinterpret_cast<void**>(temp);
+      }
+      uint32_t* buffer_num_bytes_ptr;
+      uint32_t buffer_num_bytes;
+      if (params[3] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[3], sizeof(buffer_num_bytes));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        buffer_num_bytes_ptr = reinterpret_cast<uint32_t*>(temp);
+        // In/Out
+        buffer_num_bytes = *buffer_num_bytes_ptr;
+      }
+      MojoWriteDataFlags flags;
+      if (params[4] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[4], sizeof(flags));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        flags = *reinterpret_cast<MojoWriteDataFlags volatile*>(temp);
+      }
+      MojoResult* result_ptr;
+      MojoResult result;
+      if (params[5] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[5], sizeof(result));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        result_ptr = reinterpret_cast<MojoResult*>(temp);
+      }
+      NaClCopyDropLock(nap);
+
+      result = MojoBeginWriteData(data_pipe_producer_handle, &buffer, &buffer_num_bytes, flags);
+
+      NaClCopyTakeLock(nap);
+      *buffer_ptr = buffer;
+      *buffer_num_bytes_ptr = buffer_num_bytes;
+      *result_ptr = result;
+      NaClCopyDropLock(nap);
+
+      return 0;
+    }
+  case 7:
+    {
+      if (numParams != 4) {
+        return -1;
+      }
+      NaClCopyTakeLock(nap);
+      MojoHandle data_pipe_producer_handle;
+      if (params[1] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[1], sizeof(data_pipe_producer_handle));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        data_pipe_producer_handle = *reinterpret_cast<MojoHandle volatile*>(temp);
+      }
+      uint32_t num_bytes_written;
+      if (params[2] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[2], sizeof(num_bytes_written));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        num_bytes_written = *reinterpret_cast<uint32_t volatile*>(temp);
+      }
+      MojoResult* result_ptr;
+      MojoResult result;
+      if (params[3] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[3], sizeof(result));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        result_ptr = reinterpret_cast<MojoResult*>(temp);
+      }
+      NaClCopyDropLock(nap);
+
+      result = MojoEndWriteData(data_pipe_producer_handle, num_bytes_written);
+
+      NaClCopyTakeLock(nap);
+      *result_ptr = result;
+      NaClCopyDropLock(nap);
+
+      return 0;
+    }
+  case 8:
+    {
+      if (numParams != 6) {
+        return -1;
+      }
+      NaClCopyTakeLock(nap);
+      MojoHandle data_pipe_consumer_handle;
+      if (params[1] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[1], sizeof(data_pipe_consumer_handle));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        data_pipe_consumer_handle = *reinterpret_cast<MojoHandle volatile*>(temp);
+      }
+      uint32_t* num_bytes_ptr;
+      uint32_t num_bytes;
+      if (params[3] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[3], sizeof(num_bytes));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        num_bytes_ptr = reinterpret_cast<uint32_t*>(temp);
+        // In/Out
+        num_bytes = *num_bytes_ptr;
+      }
+      MojoReadDataFlags flags;
+      if (params[4] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[4], sizeof(flags));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        flags = *reinterpret_cast<MojoReadDataFlags volatile*>(temp);
+      }
+      void* elements;
+      if (params[2] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[2], num_bytes);
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        elements = reinterpret_cast<void*>(temp);
+      }
+      MojoResult* result_ptr;
+      MojoResult result;
+      if (params[5] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[5], sizeof(result));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        result_ptr = reinterpret_cast<MojoResult*>(temp);
+      }
+      NaClCopyDropLock(nap);
+
+      result = MojoReadData(data_pipe_consumer_handle, elements, &num_bytes, flags);
+
+      NaClCopyTakeLock(nap);
+      *num_bytes_ptr = num_bytes;
+      *result_ptr = result;
+      NaClCopyDropLock(nap);
+
+      return 0;
+    }
+  case 9:
+    {
+      if (numParams != 6) {
+        return -1;
+      }
+      NaClCopyTakeLock(nap);
+      MojoHandle data_pipe_consumer_handle;
+      if (params[1] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[1], sizeof(data_pipe_consumer_handle));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        data_pipe_consumer_handle = *reinterpret_cast<MojoHandle volatile*>(temp);
+      }
+      const void** buffer_ptr;
+      const void* buffer;
+      if (params[2] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[2], sizeof(buffer));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        buffer_ptr = reinterpret_cast<const void**>(temp);
+      }
+      uint32_t* buffer_num_bytes_ptr;
+      uint32_t buffer_num_bytes;
+      if (params[3] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[3], sizeof(buffer_num_bytes));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        buffer_num_bytes_ptr = reinterpret_cast<uint32_t*>(temp);
+        // In/Out
+        buffer_num_bytes = *buffer_num_bytes_ptr;
+      }
+      MojoReadDataFlags flags;
+      if (params[4] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[4], sizeof(flags));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        flags = *reinterpret_cast<MojoReadDataFlags volatile*>(temp);
+      }
+      MojoResult* result_ptr;
+      MojoResult result;
+      if (params[5] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[5], sizeof(result));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        result_ptr = reinterpret_cast<MojoResult*>(temp);
+      }
+      NaClCopyDropLock(nap);
+
+      result = MojoBeginReadData(data_pipe_consumer_handle, &buffer, &buffer_num_bytes, flags);
+
+      NaClCopyTakeLock(nap);
+      *buffer_ptr = buffer;
+      *buffer_num_bytes_ptr = buffer_num_bytes;
+      *result_ptr = result;
+      NaClCopyDropLock(nap);
+
+      return 0;
+    }
+  case 10:
+    {
+      if (numParams != 4) {
+        return -1;
+      }
+      NaClCopyTakeLock(nap);
+      MojoHandle data_pipe_consumer_handle;
+      if (params[1] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[1], sizeof(data_pipe_consumer_handle));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        data_pipe_consumer_handle = *reinterpret_cast<MojoHandle volatile*>(temp);
+      }
+      uint32_t num_bytes_read;
+      if (params[2] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[2], sizeof(num_bytes_read));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        num_bytes_read = *reinterpret_cast<uint32_t volatile*>(temp);
+      }
+      MojoResult* result_ptr;
+      MojoResult result;
+      if (params[3] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[3], sizeof(result));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        result_ptr = reinterpret_cast<MojoResult*>(temp);
+      }
+      NaClCopyDropLock(nap);
+
+      result = MojoEndReadData(data_pipe_consumer_handle, num_bytes_read);
+
+      NaClCopyTakeLock(nap);
+      *result_ptr = result;
+      NaClCopyDropLock(nap);
+
+      return 0;
+    }
+  case 11:
+    {
+      if (numParams != 2) {
+        return -1;
+      }
+      NaClCopyTakeLock(nap);
+      MojoTimeTicks* result_ptr;
+      MojoTimeTicks result;
+      if (params[1] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[1], sizeof(result));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        result_ptr = reinterpret_cast<MojoTimeTicks*>(temp);
+      }
+      NaClCopyDropLock(nap);
+
+      result = MojoGetTimeTicksNow();
+
+      NaClCopyTakeLock(nap);
+      *result_ptr = result;
+      NaClCopyDropLock(nap);
+
+      return 0;
+    }
+  case 12:
+    {
+      if (numParams != 3) {
+        return -1;
+      }
+      NaClCopyTakeLock(nap);
+      MojoHandle handle;
+      if (params[1] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[1], sizeof(handle));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        handle = *reinterpret_cast<MojoHandle volatile*>(temp);
+      }
+      MojoResult* result_ptr;
+      MojoResult result;
+      if (params[2] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[2], sizeof(result));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        result_ptr = reinterpret_cast<MojoResult*>(temp);
+      }
+      NaClCopyDropLock(nap);
+
+      result = MojoClose(handle);
+
+      NaClCopyTakeLock(nap);
+      *result_ptr = result;
+      NaClCopyDropLock(nap);
+
+      return 0;
+    }
+  case 13:
+    {
+      if (numParams != 5) {
+        return -1;
+      }
+      NaClCopyTakeLock(nap);
+      MojoHandle handle;
+      if (params[1] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[1], sizeof(handle));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        handle = *reinterpret_cast<MojoHandle volatile*>(temp);
+      }
+      MojoHandleSignals signals;
+      if (params[2] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[2], sizeof(signals));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        signals = *reinterpret_cast<MojoHandleSignals volatile*>(temp);
+      }
+      MojoDeadline deadline;
+      if (params[3] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[3], sizeof(deadline));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        deadline = *reinterpret_cast<MojoDeadline volatile*>(temp);
+      }
+      MojoResult* result_ptr;
+      MojoResult result;
+      if (params[4] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[4], sizeof(result));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        result_ptr = reinterpret_cast<MojoResult*>(temp);
+      }
+      NaClCopyDropLock(nap);
+
+      result = MojoWait(handle, signals, deadline);
+
+      NaClCopyTakeLock(nap);
+      *result_ptr = result;
+      NaClCopyDropLock(nap);
+
+      return 0;
+    }
+  case 14:
+    {
+      if (numParams != 6) {
+        return -1;
+      }
+      NaClCopyTakeLock(nap);
+      uint32_t num_handles;
+      if (params[3] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[3], sizeof(num_handles));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        num_handles = *reinterpret_cast<uint32_t volatile*>(temp);
+      }
+      MojoDeadline deadline;
+      if (params[4] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[4], sizeof(deadline));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        deadline = *reinterpret_cast<MojoDeadline volatile*>(temp);
+      }
+      const MojoHandle* handles;
+      if (params[1] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrArray(nap, params[1], num_handles, sizeof(*handles));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        handles = reinterpret_cast<const MojoHandle*>(temp);
+      }
+      const MojoHandleSignals* signals;
+      if (params[2] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrArray(nap, params[2], num_handles, sizeof(*signals));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        signals = reinterpret_cast<const MojoHandleSignals*>(temp);
+      }
+      MojoResult* result_ptr;
+      MojoResult result;
+      if (params[5] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[5], sizeof(result));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        result_ptr = reinterpret_cast<MojoResult*>(temp);
+      }
+      NaClCopyDropLock(nap);
+
+      result = MojoWaitMany(handles, signals, num_handles, deadline);
+
+      NaClCopyTakeLock(nap);
+      *result_ptr = result;
+      NaClCopyDropLock(nap);
+
+      return 0;
+    }
+  case 15:
+    {
+      if (numParams != 5) {
+        return -1;
+      }
+      NaClCopyTakeLock(nap);
+      const struct MojoCreateMessagePipeOptions* options;
+      if (params[1] == 0) {
+        options = NULL;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[1], sizeof(*options));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        options = reinterpret_cast<const struct MojoCreateMessagePipeOptions*>(temp);
+      }
+      MojoHandle* message_pipe_handle0_ptr;
+      MojoHandle message_pipe_handle0;
+      if (params[2] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[2], sizeof(message_pipe_handle0));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        message_pipe_handle0_ptr = reinterpret_cast<MojoHandle*>(temp);
+      }
+      MojoHandle* message_pipe_handle1_ptr;
+      MojoHandle message_pipe_handle1;
+      if (params[3] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[3], sizeof(message_pipe_handle1));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        message_pipe_handle1_ptr = reinterpret_cast<MojoHandle*>(temp);
+      }
+      MojoResult* result_ptr;
+      MojoResult result;
+      if (params[4] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[4], sizeof(result));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        result_ptr = reinterpret_cast<MojoResult*>(temp);
+      }
+      NaClCopyDropLock(nap);
+
+      result = MojoCreateMessagePipe(options, &message_pipe_handle0, &message_pipe_handle1);
+
+      NaClCopyTakeLock(nap);
+      *message_pipe_handle0_ptr = message_pipe_handle0;
+      *message_pipe_handle1_ptr = message_pipe_handle1;
+      *result_ptr = result;
+      NaClCopyDropLock(nap);
+
+      return 0;
+    }
+  case 16:
+    {
+      if (numParams != 8) {
+        return -1;
+      }
+      NaClCopyTakeLock(nap);
+      MojoHandle message_pipe_handle;
+      if (params[1] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[1], sizeof(message_pipe_handle));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        message_pipe_handle = *reinterpret_cast<MojoHandle volatile*>(temp);
+      }
+      uint32_t num_bytes;
+      if (params[3] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[3], sizeof(num_bytes));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        num_bytes = *reinterpret_cast<uint32_t volatile*>(temp);
+      }
+      uint32_t num_handles;
+      if (params[5] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[5], sizeof(num_handles));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        num_handles = *reinterpret_cast<uint32_t volatile*>(temp);
+      }
+      MojoWriteMessageFlags flags;
+      if (params[6] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[6], sizeof(flags));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        flags = *reinterpret_cast<MojoWriteMessageFlags volatile*>(temp);
+      }
+      const void* bytes;
+      if (params[2] == 0) {
+        bytes = NULL;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[2], num_bytes);
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        bytes = reinterpret_cast<const void*>(temp);
+      }
+      const MojoHandle* handles;
+      if (params[4] == 0) {
+        handles = NULL;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrArray(nap, params[4], num_handles, sizeof(*handles));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        handles = reinterpret_cast<const MojoHandle*>(temp);
+      }
+      MojoResult* result_ptr;
+      MojoResult result;
+      if (params[7] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[7], sizeof(result));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        result_ptr = reinterpret_cast<MojoResult*>(temp);
+      }
+      NaClCopyDropLock(nap);
+
+      result = MojoWriteMessage(message_pipe_handle, bytes, num_bytes, handles, num_handles, flags);
+
+      NaClCopyTakeLock(nap);
+      *result_ptr = result;
+      NaClCopyDropLock(nap);
+
+      return 0;
+    }
+  case 17:
+    {
+      if (numParams != 8) {
+        return -1;
+      }
+      NaClCopyTakeLock(nap);
+      MojoHandle message_pipe_handle;
+      if (params[1] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[1], sizeof(message_pipe_handle));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        message_pipe_handle = *reinterpret_cast<MojoHandle volatile*>(temp);
+      }
+      uint32_t* num_bytes_ptr;
+      uint32_t num_bytes;
+      if (params[3] == 0) {
+        num_bytes_ptr = NULL;
+        num_bytes = 0;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[3], sizeof(num_bytes));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        num_bytes_ptr = reinterpret_cast<uint32_t*>(temp);
+        // In/Out
+        num_bytes = *num_bytes_ptr;
+      }
+      uint32_t* num_handles_ptr;
+      uint32_t num_handles;
+      if (params[5] == 0) {
+        num_handles_ptr = NULL;
+        num_handles = 0;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[5], sizeof(num_handles));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        num_handles_ptr = reinterpret_cast<uint32_t*>(temp);
+        // In/Out
+        num_handles = *num_handles_ptr;
+      }
+      MojoReadMessageFlags flags;
+      if (params[6] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[6], sizeof(flags));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        flags = *reinterpret_cast<MojoReadMessageFlags volatile*>(temp);
+      }
+      void* bytes;
+      if (params[2] == 0) {
+        bytes = NULL;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[2], num_bytes);
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        bytes = reinterpret_cast<void*>(temp);
+      }
+      MojoHandle* handles;
+      if (params[4] == 0) {
+        handles = NULL;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrArray(nap, params[4], num_handles, sizeof(*handles));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        handles = reinterpret_cast<MojoHandle*>(temp);
+      }
+      MojoResult* result_ptr;
+      MojoResult result;
+      if (params[7] == 0) {
+        return -1;
+      } else {
+        uintptr_t temp = NaClUserToSysAddrRange(nap, params[7], sizeof(result));
+        if (temp == kNaClBadAddress) {
+          return -1;
+        }
+        result_ptr = reinterpret_cast<MojoResult*>(temp);
+      }
+      NaClCopyDropLock(nap);
+
+      result = MojoReadMessage(message_pipe_handle, bytes, num_bytes_ptr ? &num_bytes : NULL, handles, num_handles_ptr ? &num_handles : NULL, flags);
+
+      NaClCopyTakeLock(nap);
+      if (num_bytes_ptr != NULL) {
+        *num_bytes_ptr = num_bytes;
+      }
+      if (num_handles_ptr != NULL) {
+        *num_handles_ptr = num_handles;
+      }
+      *result_ptr = result;
+      NaClCopyDropLock(nap);
+
+      return 0;
+    }
+
+  default:
+    return -1;
+  }
+
+  return -1;
+}
+
+ssize_t MojoDescRecvMsg(void *handle,
+                           struct NaClImcTypedMsgHdr *msg,
+                           int flags) {
+  UNREFERENCED_PARAMETER(handle);
+  UNREFERENCED_PARAMETER(msg);
+  UNREFERENCED_PARAMETER(flags);
+
+  NaClLog(LOG_FATAL, "MojoDescRecvMsg: Not implemented\n");
+  return 0;
+}
+
+struct NaClDesc *MakeMojoDesc(struct NaClApp *nap) {
+  struct NaClDescCustomFuncs funcs = NACL_DESC_CUSTOM_FUNCS_INITIALIZER;
+  funcs.Destroy = MojoDescDestroy;
+  funcs.SendMsg = MojoDescSendMsg;
+  funcs.RecvMsg = MojoDescRecvMsg;
+  return NaClDescMakeCustomDesc(nap, &funcs);
+}
+
+#define NACL_MOJO_DESC 5
+
+void InjectMojo(struct NaClApp *nap) {
+  NaClAppSetDesc(nap, NACL_MOJO_DESC, MakeMojoDesc(nap));
+}