NaCl: create a separate namespace for Mojo handles.

mojo/public/platform/native/system_impl_private.h

Index: mojo/public/platform/native/system_impl_private.h
diff --git a/mojo/public/platform/native/system_impl_private.h b/mojo/public/platform/native/system_impl_private.h
new file mode 100644
index 0000000000000000000000000000000000000000..ff063162c67bb83e97875d6c5f1cd3e74310b9e1
--- /dev/null
+++ b/mojo/public/platform/native/system_impl_private.h
@@ -0,0 +1,128 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Note: This header should be compilable as C.
+
+#ifndef MOJO_PUBLIC_PLATFORM_NATIVE_SYSTEM_IMPL_PRIVATE_H_
+#define MOJO_PUBLIC_PLATFORM_NATIVE_SYSTEM_IMPL_PRIVATE_H_
+
+#include "mojo/public/c/system/core.h"
+
+// This interface provides the Mojo system API, but with the ability to confine
+// calls to a specific handle namespace. Handles in one namespace are unrelated
+// to handles in another namespace. Two ends of a pipe may live in different
+// handle namespaces, however.
+
+typedef void* MojoSystemImpl;
+
+extern "C" {
+// APIs for creating and manipulating MojoSystemImpls.
+
+// Returns the MojoSystemImpl implicitly used by the non-SystemImpl version of
+// the Mojo sytem APIs.
+MojoSystemImpl MojoSystemImplGetDefaultImpl();
+
+// Creates and returns a new MojoSystemImpl. Currently there is no way to
+// destroy a MojoSystemImpl, once created.
+MojoSystemImpl MojoSystemImplCreateImpl();
+
+// Moves a handle from one MojoSystemImpl to another.
+// On success, |result_handle| contains the name of the handle in the new
+// namespace.
+// If |MOJO_RESULT_RESOURCE_EXHAUSTED| is returned, the |handle| will have been

[Nick Bray (chromium), 2015/04/06 22:51:00]

Technically this corner case could be eliminated by fusing creation and transfer
into one operation.  (A newly created core should have space for at least one
handle?  Or we could hold the lock on the newly created core (which could not
deadlock), check there was enough space, and only remove the handle from the
source once we were sure there was space in the destination.)  Worth it?  It's
unclear that we won't need separate creation and transfer operations at some
point... but I am just speculating.

[viettrungluu, 2015/04/06 23:21:02]

Probably it's not worth it, and the extra generality of the separate interfaces
is better.

In code that actually uses them together, you could do:

MojoSystemImpl new_system = MojoSystemImplCreateImpl();
MojoHandle result_handle = MOJO_HANDLE_INVALID;
CHECK_EQ(MojoSystemImplTransferHandle(from_system, old_handle, new_system,
&result_handle), MOJO_RESULT_OK);

+// closed, and is now lost.
+// Busy handles cannot be transfered.
+// To avoid trouble, this API should only be used to bootstrap a newly created
+// |to_system| with a newly created |handle|.
+MojoResult MojoSystemImplTransferHandle(MojoSystemImpl from_system,
+                                        MojoHandle handle,
+                                        MojoSystemImpl to_system,
+                                        MojoHandle* result_handle);
+
+// APIs mirroring the Mojo system APIs, but also taking a MojoSystemImpl param.
+MojoTimeTicks MojoSystemImplGetTimeTicksNow(MojoSystemImpl system);
+MojoResult MojoSystemImplClose(MojoSystemImpl system, MojoHandle handle);
+MojoResult MojoSystemImplWait(MojoSystemImpl system,
+                              MojoHandle handle,
+                              MojoHandleSignals signals,
+                              MojoDeadline deadline,
+                              struct MojoHandleSignalsState* signals_state);
+MojoResult MojoSystemImplWaitMany(
+    MojoSystemImpl system,
+    const MojoHandle* handles,
+    const MojoHandleSignals* signals,
+    uint32_t num_handles,
+    MojoDeadline deadline,
+    uint32_t* result_index,
+    struct MojoHandleSignalsState* signals_states);
+MojoResult MojoSystemImplCreateMessagePipe(
+    MojoSystemImpl system,
+    const struct MojoCreateMessagePipeOptions* options,
+    MojoHandle* message_pipe_handle0,
+    MojoHandle* message_pipe_handle1);
+MojoResult MojoSystemImplWriteMessage(MojoSystemImpl system,
+                                      MojoHandle message_pipe_handle,
+                                      const void* bytes,
+                                      uint32_t num_bytes,
+                                      const MojoHandle* handles,
+                                      uint32_t num_handles,
+                                      MojoWriteMessageFlags flags);
+MojoResult MojoSystemImplReadMessage(MojoSystemImpl system,
+                                     MojoHandle message_pipe_handle,
+                                     void* bytes,
+                                     uint32_t* num_bytes,
+                                     MojoHandle* handles,
+                                     uint32_t* num_handles,
+                                     MojoReadMessageFlags flags);
+MojoResult MojoSystemImplCreateDataPipe(
+    MojoSystemImpl system,
+    const struct MojoCreateDataPipeOptions* options,
+    MojoHandle* data_pipe_producer_handle,
+    MojoHandle* data_pipe_consumer_handle);
+MojoResult MojoSystemImplWriteData(MojoSystemImpl system,
+                                   MojoHandle data_pipe_producer_handle,
+                                   const void* elements,
+                                   uint32_t* num_elements,
+                                   MojoWriteDataFlags flags);
+MojoResult MojoSystemImplBeginWriteData(MojoSystemImpl system,
+                                        MojoHandle data_pipe_producer_handle,
+                                        void** buffer,
+                                        uint32_t* buffer_num_elements,
+                                        MojoWriteDataFlags flags);
+MojoResult MojoSystemImplEndWriteData(MojoSystemImpl system,
+                                      MojoHandle data_pipe_producer_handle,
+                                      uint32_t num_elements_written);
+MojoResult MojoSystemImplReadData(MojoSystemImpl system,
+                                  MojoHandle data_pipe_consumer_handle,
+                                  void* elements,
+                                  uint32_t* num_elements,
+                                  MojoReadDataFlags flags);
+MojoResult MojoSystemImplBeginReadData(MojoSystemImpl system,
+                                       MojoHandle data_pipe_consumer_handle,
+                                       const void** buffer,
+                                       uint32_t* buffer_num_elements,
+                                       MojoReadDataFlags flags);
+MojoResult MojoSystemImplEndReadData(MojoSystemImpl system,
+                                     MojoHandle data_pipe_consumer_handle,
+                                     uint32_t num_elements_read);
+MojoResult MojoSystemImplCreateSharedBuffer(
+    MojoSystemImpl system,
+    const struct MojoCreateSharedBufferOptions* options,
+    uint64_t num_bytes,
+    MojoHandle* shared_buffer_handle);
+MojoResult MojoSystemImplDuplicateBufferHandle(
+    MojoSystemImpl system,
+    MojoHandle buffer_handle,
+    const struct MojoDuplicateBufferHandleOptions* options,
+    MojoHandle* new_buffer_handle);
+MojoResult MojoSystemImplMapBuffer(MojoSystemImpl system,
+                                   MojoHandle buffer_handle,
+                                   uint64_t offset,
+                                   uint64_t num_bytes,
+                                   void** buffer,
+                                   MojoMapBufferFlags flags);
+MojoResult MojoSystemImplUnmapBuffer(MojoSystemImpl system, void* buffer);
+}

[viettrungluu, 2015/04/06 23:21:02]

nit: could use a |// extern "C"| comment

[Nick Bray (chromium), 2015/04/07 23:51:05]

Done.

+
+#endif  // MOJO_PUBLIC_PLATFORM_NATIVE_SYSTEM_IMPL_PRIVATE_H_