[mojo-edk] Add explicit message object APIs

mojo/edk/embedder/entrypoints.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdint.h>
 
 #include "mojo/edk/embedder/embedder_internal.h"
 #include "mojo/edk/system/core.h"
 #include "mojo/public/c/system/buffer.h"
 #include "mojo/public/c/system/data_pipe.h"
@@ skipping 35 matching lines @@
                      MojoHandleSignals signals,
                      MojoWatchCallback callback,
                      uintptr_t context) {
   return g_core->Watch(handle, signals, callback, context);
 }
 
 MojoResult MojoCancelWatch(MojoHandle handle, uintptr_t context) {
   return g_core->CancelWatch(handle, context);
 }
 
+MojoResult MojoCreateMessage(uint32_t num_bytes,
+                             const MojoHandle* handles,

[Anand Mistry (off Chromium), 2016/04/14 10:25:03]

I know why you have this, but I'm really not a fan of exposing this. And
besides, the common case will be 0 handles and I think we can afford another
malloc/memcpy in the case you have a non-zero number of handles. Or, when you do
have handles, it'll likely be 1, so you could always reserve room for 1 handle.

+                             uint32_t num_handles,
+                             MojoCreateMessageFlags flags,
+                             void** message) {
+  return g_core->CreateMessage(num_bytes, handles, num_handles, flags, message);
+}
+
+MojoResult MojoDestroyMessage(void* message) {
+  return g_core->DestroyMessage(message);
+}
+
+MojoResult MojoGetMessageBuffer(void* message, void** buffer) {

[Anand Mistry (off Chromium), 2016/04/14 10:25:03]

Sorry, but not a fan. Two reasons:
1. Exposes internal details to the user. But also, a "Buffer API" should expose
just the buffer. The message itself is an implementation detail.
2. I'm concerned about the security aspect of making it easier to access the
message metadata. If an attacker compromises the process, it's easier for them
to re-route the message if they have easy access to the header.

Something to think about is crbug.com/590980. Having separate buffers for the
header and payload would make things simple. Even if you don't, you can always
map buffer address to message internally.

+  return g_core->GetMessageBuffer(message, buffer);
+}
+
 MojoResult MojoCreateWaitSet(MojoHandle* wait_set_handle) {
   return g_core->CreateWaitSet(wait_set_handle);
 }
 
 MojoResult MojoAddHandle(MojoHandle wait_set_handle,
                          MojoHandle handle,
                          MojoHandleSignals signals) {
   return g_core->AddHandle(wait_set_handle, handle, signals);
 }
 
@@ skipping 20 matching lines @@
 MojoResult MojoWriteMessage(MojoHandle message_pipe_handle,
                             const void* bytes,
                             uint32_t num_bytes,
                             const MojoHandle* handles,
                             uint32_t num_handles,
                             MojoWriteMessageFlags flags) {
   return g_core->WriteMessage(message_pipe_handle, bytes, num_bytes, handles,
                               num_handles, flags);
 }
 
+MojoResult MojoWriteMessageNew(MojoHandle message_pipe_handle,
+                               void* message,
+                               MojoWriteMessageFlags flags) {
+  return g_core->WriteMessageNew(message_pipe_handle, message, flags);
+}
+
 MojoResult MojoReadMessage(MojoHandle message_pipe_handle,
                            void* bytes,
                            uint32_t* num_bytes,
                            MojoHandle* handles,
                            uint32_t* num_handles,
                            MojoReadMessageFlags flags) {
   return g_core->ReadMessage(
       message_pipe_handle, bytes, num_bytes, handles, num_handles, flags);
 }
 
+MojoResult MojoReadMessageNew(MojoHandle message_pipe_handle,
+                              void** message,
+                              uint32_t* num_bytes,
+                              MojoHandle* handles,
+                              uint32_t* num_handles,
+                              MojoReadMessageFlags flags) {
+  return g_core->ReadMessageNew(
+      message_pipe_handle, message, num_bytes, handles, num_handles, flags);
+}
+
 MojoResult MojoFuseMessagePipes(MojoHandle handle0, MojoHandle handle1) {
   return g_core->FuseMessagePipes(handle0, handle1);
 }
 
 MojoResult MojoCreateDataPipe(const MojoCreateDataPipeOptions* options,
                               MojoHandle* data_pipe_producer_handle,
                               MojoHandle* data_pipe_consumer_handle) {
   return g_core->CreateDataPipe(options, data_pipe_producer_handle,
                                 data_pipe_consumer_handle);
 }
@@ skipping 61 matching lines @@
                          void** buffer,
                          MojoMapBufferFlags flags) {
   return g_core->MapBuffer(buffer_handle, offset, num_bytes, buffer, flags);
 }
 
 MojoResult MojoUnmapBuffer(void* buffer) {
   return g_core->UnmapBuffer(buffer);
 }
 
 }  // extern "C"