nacl_process_host.cc revision 5d1f7b1de12d16ceb2c938c56701a3e8bfa558f7
1// Copyright (c) 2012 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "components/nacl/browser/nacl_process_host.h"
6
7#include <algorithm>
8#include <string>
9#include <vector>
10
11#include "base/base_switches.h"
12#include "base/bind.h"
13#include "base/command_line.h"
14#include "base/file_util.h"
15#include "base/message_loop/message_loop.h"
16#include "base/metrics/histogram.h"
17#include "base/path_service.h"
18#include "base/process/launch.h"
19#include "base/process/process_iterator.h"
20#include "base/rand_util.h"
21#include "base/strings/string_number_conversions.h"
22#include "base/strings/string_split.h"
23#include "base/strings/string_util.h"
24#include "base/strings/stringprintf.h"
25#include "base/strings/utf_string_conversions.h"
26#include "base/threading/sequenced_worker_pool.h"
27#include "base/win/windows_version.h"
28#include "build/build_config.h"
29#include "components/nacl/browser/nacl_browser.h"
30#include "components/nacl/browser/nacl_host_message_filter.h"
31#include "components/nacl/common/nacl_cmd_line.h"
32#include "components/nacl/common/nacl_host_messages.h"
33#include "components/nacl/common/nacl_messages.h"
34#include "components/nacl/common/nacl_process_type.h"
35#include "components/nacl/common/nacl_switches.h"
36#include "content/public/browser/browser_child_process_host.h"
37#include "content/public/browser/browser_ppapi_host.h"
38#include "content/public/browser/child_process_data.h"
39#include "content/public/browser/plugin_service.h"
40#include "content/public/common/child_process_host.h"
41#include "content/public/common/content_switches.h"
42#include "content/public/common/process_type.h"
43#include "ipc/ipc_channel.h"
44#include "ipc/ipc_switches.h"
45#include "native_client/src/shared/imc/nacl_imc_c.h"
46#include "net/base/net_util.h"
47#include "net/socket/tcp_listen_socket.h"
48#include "ppapi/host/host_factory.h"
49#include "ppapi/host/ppapi_host.h"
50#include "ppapi/proxy/ppapi_messages.h"
51#include "ppapi/shared_impl/ppapi_nacl_plugin_args.h"
52#include "ppapi/shared_impl/ppapi_switches.h"
53
54#if defined(OS_POSIX)
55#include <fcntl.h>
56
57#include "ipc/ipc_channel_posix.h"
58#elif defined(OS_WIN)
59#include <windows.h>
60
61#include "base/threading/thread.h"
62#include "base/win/scoped_handle.h"
63#include "components/nacl/browser/nacl_broker_service_win.h"
64#include "components/nacl/common/nacl_debug_exception_handler_win.h"
65#include "content/public/common/sandbox_init.h"
66#include "content/public/common/sandboxed_process_launcher_delegate.h"
67#endif
68
69using content::BrowserThread;
70using content::ChildProcessData;
71using content::ChildProcessHost;
72using ppapi::proxy::SerializedHandle;
73
74#if defined(OS_WIN)
75
76namespace {
77
78// Looks for the largest contiguous unallocated region of address
79// space and returns it via |*out_addr| and |*out_size|.
80void FindAddressSpace(base::ProcessHandle process,
81                      char** out_addr, size_t* out_size) {
82  *out_addr = NULL;
83  *out_size = 0;
84  char* addr = 0;
85  while (true) {
86    MEMORY_BASIC_INFORMATION info;
87    size_t result = VirtualQueryEx(process, static_cast<void*>(addr),
88                                   &info, sizeof(info));
89    if (result < sizeof(info))
90      break;
91    if (info.State == MEM_FREE && info.RegionSize > *out_size) {
92      *out_addr = addr;
93      *out_size = info.RegionSize;
94    }
95    addr += info.RegionSize;
96  }
97}
98
99}  // namespace
100
101namespace nacl {
102
103// Allocates |size| bytes of address space in the given process at a
104// randomised address.
105void* AllocateAddressSpaceASLR(base::ProcessHandle process, size_t size) {
106  char* addr;
107  size_t avail_size;
108  FindAddressSpace(process, &addr, &avail_size);
109  if (avail_size < size)
110    return NULL;
111  size_t offset = base::RandGenerator(avail_size - size);
112  const int kPageSize = 0x10000;
113  void* request_addr =
114      reinterpret_cast<void*>(reinterpret_cast<uint64>(addr + offset)
115                              & ~(kPageSize - 1));
116  return VirtualAllocEx(process, request_addr, size,
117                        MEM_RESERVE, PAGE_NOACCESS);
118}
119
120}  // namespace nacl
121
122#endif  // defined(OS_WIN)
123
124namespace {
125
126#if defined(OS_WIN)
127bool RunningOnWOW64() {
128  return (base::win::OSInfo::GetInstance()->wow64_status() ==
129          base::win::OSInfo::WOW64_ENABLED);
130}
131
132// NOTE: changes to this class need to be reviewed by the security team.
133class NaClSandboxedProcessLauncherDelegate
134    : public content::SandboxedProcessLauncherDelegate {
135 public:
136  NaClSandboxedProcessLauncherDelegate() {}
137  virtual ~NaClSandboxedProcessLauncherDelegate() {}
138
139  virtual void PostSpawnTarget(base::ProcessHandle process) {
140    // For Native Client sel_ldr processes on 32-bit Windows, reserve 1 GB of
141    // address space to prevent later failure due to address space fragmentation
142    // from .dll loading. The NaCl process will attempt to locate this space by
143    // scanning the address space using VirtualQuery.
144    // TODO(bbudge) Handle the --no-sandbox case.
145    // http://code.google.com/p/nativeclient/issues/detail?id=2131
146    const SIZE_T kNaClSandboxSize = 1 << 30;
147    if (!nacl::AllocateAddressSpaceASLR(process, kNaClSandboxSize)) {
148      DLOG(WARNING) << "Failed to reserve address space for Native Client";
149    }
150  }
151};
152
153#endif  // OS_WIN
154
155void SetCloseOnExec(NaClHandle fd) {
156#if defined(OS_POSIX)
157  int flags = fcntl(fd, F_GETFD);
158  CHECK_NE(flags, -1);
159  int rc = fcntl(fd, F_SETFD, flags | FD_CLOEXEC);
160  CHECK_EQ(rc, 0);
161#endif
162}
163
164bool ShareHandleToSelLdr(
165    base::ProcessHandle processh,
166    NaClHandle sourceh,
167    bool close_source,
168    std::vector<nacl::FileDescriptor> *handles_for_sel_ldr) {
169#if defined(OS_WIN)
170  HANDLE channel;
171  int flags = DUPLICATE_SAME_ACCESS;
172  if (close_source)
173    flags |= DUPLICATE_CLOSE_SOURCE;
174  if (!DuplicateHandle(GetCurrentProcess(),
175                       reinterpret_cast<HANDLE>(sourceh),
176                       processh,
177                       &channel,
178                       0,  // Unused given DUPLICATE_SAME_ACCESS.
179                       FALSE,
180                       flags)) {
181    LOG(ERROR) << "DuplicateHandle() failed";
182    return false;
183  }
184  handles_for_sel_ldr->push_back(
185      reinterpret_cast<nacl::FileDescriptor>(channel));
186#else
187  nacl::FileDescriptor channel;
188  channel.fd = sourceh;
189  channel.auto_close = close_source;
190  handles_for_sel_ldr->push_back(channel);
191#endif
192  return true;
193}
194
195ppapi::PpapiPermissions GetNaClPermissions(uint32 permission_bits) {
196  // Only allow NaCl plugins to request certain permissions. We don't want
197  // a compromised renderer to be able to start a nacl plugin with e.g. Flash
198  // permissions which may expand the surface area of the sandbox.
199  uint32 masked_bits = permission_bits & ppapi::PERMISSION_DEV;
200  if (content::PluginService::GetInstance()->PpapiDevChannelSupported())
201    masked_bits |= ppapi::PERMISSION_DEV_CHANNEL;
202  return ppapi::PpapiPermissions::GetForCommandLine(masked_bits);
203}
204
205}  // namespace
206
207namespace nacl {
208
209struct NaClProcessHost::NaClInternal {
210  NaClHandle socket_for_renderer;
211  NaClHandle socket_for_sel_ldr;
212
213  NaClInternal()
214    : socket_for_renderer(NACL_INVALID_HANDLE),
215      socket_for_sel_ldr(NACL_INVALID_HANDLE) { }
216};
217
218// -----------------------------------------------------------------------------
219
220NaClProcessHost::NaClProcessHost(const GURL& manifest_url,
221                                 int render_view_id,
222                                 uint32 permission_bits,
223                                 bool uses_irt,
224                                 bool enable_dyncode_syscalls,
225                                 bool enable_exception_handling,
226                                 bool enable_crash_throttling,
227                                 bool off_the_record,
228                                 const base::FilePath& profile_directory)
229    : manifest_url_(manifest_url),
230      permissions_(GetNaClPermissions(permission_bits)),
231#if defined(OS_WIN)
232      process_launched_by_broker_(false),
233#endif
234      reply_msg_(NULL),
235#if defined(OS_WIN)
236      debug_exception_handler_requested_(false),
237#endif
238      internal_(new NaClInternal()),
239      weak_factory_(this),
240      uses_irt_(uses_irt),
241      enable_debug_stub_(false),
242      enable_dyncode_syscalls_(enable_dyncode_syscalls),
243      enable_exception_handling_(enable_exception_handling),
244      enable_crash_throttling_(enable_crash_throttling),
245      off_the_record_(off_the_record),
246      profile_directory_(profile_directory),
247      render_view_id_(render_view_id) {
248  process_.reset(content::BrowserChildProcessHost::Create(
249      PROCESS_TYPE_NACL_LOADER, this));
250
251  // Set the display name so the user knows what plugin the process is running.
252  // We aren't on the UI thread so getting the pref locale for language
253  // formatting isn't possible, so IDN will be lost, but this is probably OK
254  // for this use case.
255  process_->SetName(net::FormatUrl(manifest_url_, std::string()));
256
257  enable_debug_stub_ = CommandLine::ForCurrentProcess()->HasSwitch(
258      switches::kEnableNaClDebug);
259}
260
261NaClProcessHost::~NaClProcessHost() {
262  // Report exit status only if the process was successfully started.
263  if (process_->GetData().handle != base::kNullProcessHandle) {
264    int exit_code = 0;
265    process_->GetTerminationStatus(false /* known_dead */, &exit_code);
266    std::string message =
267        base::StringPrintf("NaCl process exited with status %i (0x%x)",
268                           exit_code, exit_code);
269    if (exit_code == 0) {
270      VLOG(1) << message;
271    } else {
272      LOG(ERROR) << message;
273    }
274  }
275
276  if (internal_->socket_for_renderer != NACL_INVALID_HANDLE) {
277    if (NaClClose(internal_->socket_for_renderer) != 0) {
278      NOTREACHED() << "NaClClose() failed";
279    }
280  }
281
282  if (internal_->socket_for_sel_ldr != NACL_INVALID_HANDLE) {
283    if (NaClClose(internal_->socket_for_sel_ldr) != 0) {
284      NOTREACHED() << "NaClClose() failed";
285    }
286  }
287
288  if (reply_msg_) {
289    // The process failed to launch for some reason.
290    // Don't keep the renderer hanging.
291    reply_msg_->set_reply_error();
292    nacl_host_message_filter_->Send(reply_msg_);
293  }
294#if defined(OS_WIN)
295  if (process_launched_by_broker_) {
296    NaClBrokerService::GetInstance()->OnLoaderDied();
297  }
298#endif
299}
300
301void NaClProcessHost::OnProcessCrashed(int exit_status) {
302  if (enable_crash_throttling_ &&
303      !CommandLine::ForCurrentProcess()->HasSwitch(
304          switches::kDisablePnaclCrashThrottling)) {
305    NaClBrowser::GetInstance()->OnProcessCrashed();
306  }
307}
308
309// This is called at browser startup.
310// static
311void NaClProcessHost::EarlyStartup() {
312  NaClBrowser::GetInstance()->EarlyStartup();
313#if defined(OS_LINUX) && !defined(OS_CHROMEOS)
314  // Open the IRT file early to make sure that it isn't replaced out from
315  // under us by autoupdate.
316  NaClBrowser::GetInstance()->EnsureIrtAvailable();
317#endif
318  CommandLine* cmd = CommandLine::ForCurrentProcess();
319  UMA_HISTOGRAM_BOOLEAN(
320      "NaCl.nacl-gdb",
321      !cmd->GetSwitchValuePath(switches::kNaClGdb).empty());
322  UMA_HISTOGRAM_BOOLEAN(
323      "NaCl.nacl-gdb-script",
324      !cmd->GetSwitchValuePath(switches::kNaClGdbScript).empty());
325  UMA_HISTOGRAM_BOOLEAN(
326      "NaCl.enable-nacl-debug",
327      cmd->HasSwitch(switches::kEnableNaClDebug));
328  NaClBrowser::GetDelegate()->SetDebugPatterns(
329      cmd->GetSwitchValueASCII(switches::kNaClDebugMask));
330}
331
332void NaClProcessHost::Launch(
333    NaClHostMessageFilter* nacl_host_message_filter,
334    IPC::Message* reply_msg,
335    const base::FilePath& manifest_path) {
336  nacl_host_message_filter_ = nacl_host_message_filter;
337  reply_msg_ = reply_msg;
338  manifest_path_ = manifest_path;
339
340  // Do not launch the requested NaCl module if NaCl is marked "unstable" due
341  // to too many crashes within a given time period.
342  if (enable_crash_throttling_ &&
343      !CommandLine::ForCurrentProcess()->HasSwitch(
344          switches::kDisablePnaclCrashThrottling) &&
345      NaClBrowser::GetInstance()->IsThrottled()) {
346    SendErrorToRenderer("Process creation was throttled due to excessive"
347                        " crashes");
348    delete this;
349    return;
350  }
351
352  const CommandLine* cmd = CommandLine::ForCurrentProcess();
353#if defined(OS_WIN)
354  if (cmd->HasSwitch(switches::kEnableNaClDebug) &&
355      !cmd->HasSwitch(switches::kNoSandbox)) {
356    // We don't switch off sandbox automatically for security reasons.
357    SendErrorToRenderer("NaCl's GDB debug stub requires --no-sandbox flag"
358                        " on Windows. See crbug.com/265624.");
359    delete this;
360    return;
361  }
362#endif
363  if (cmd->HasSwitch(switches::kNaClGdb) &&
364      !cmd->HasSwitch(switches::kEnableNaClDebug)) {
365    LOG(WARNING) << "--nacl-gdb flag requires --enable-nacl-debug flag";
366  }
367
368  // Start getting the IRT open asynchronously while we launch the NaCl process.
369  // We'll make sure this actually finished in StartWithLaunchedProcess, below.
370  NaClBrowser* nacl_browser = NaClBrowser::GetInstance();
371  nacl_browser->EnsureAllResourcesAvailable();
372  if (!nacl_browser->IsOk()) {
373    SendErrorToRenderer("could not find all the resources needed"
374                        " to launch the process");
375    delete this;
376    return;
377  }
378
379  // Rather than creating a socket pair in the renderer, and passing
380  // one side through the browser to sel_ldr, socket pairs are created
381  // in the browser and then passed to the renderer and sel_ldr.
382  //
383  // This is mainly for the benefit of Windows, where sockets cannot
384  // be passed in messages, but are copied via DuplicateHandle().
385  // This means the sandboxed renderer cannot send handles to the
386  // browser process.
387
388  NaClHandle pair[2];
389  // Create a connected socket
390  if (NaClSocketPair(pair) == -1) {
391    SendErrorToRenderer("NaClSocketPair() failed");
392    delete this;
393    return;
394  }
395  internal_->socket_for_renderer = pair[0];
396  internal_->socket_for_sel_ldr = pair[1];
397  SetCloseOnExec(pair[0]);
398  SetCloseOnExec(pair[1]);
399
400  // Launch the process
401  if (!LaunchSelLdr()) {
402    delete this;
403  }
404}
405
406void NaClProcessHost::OnChannelConnected(int32 peer_pid) {
407  if (!CommandLine::ForCurrentProcess()->GetSwitchValuePath(
408          switches::kNaClGdb).empty()) {
409    LaunchNaClGdb();
410  }
411}
412
413#if defined(OS_WIN)
414void NaClProcessHost::OnProcessLaunchedByBroker(base::ProcessHandle handle) {
415  process_launched_by_broker_ = true;
416  process_->SetHandle(handle);
417  if (!StartWithLaunchedProcess())
418    delete this;
419}
420
421void NaClProcessHost::OnDebugExceptionHandlerLaunchedByBroker(bool success) {
422  IPC::Message* reply = attach_debug_exception_handler_reply_msg_.release();
423  NaClProcessMsg_AttachDebugExceptionHandler::WriteReplyParams(reply, success);
424  Send(reply);
425}
426#endif
427
428// Needed to handle sync messages in OnMessageRecieved.
429bool NaClProcessHost::Send(IPC::Message* msg) {
430  return process_->Send(msg);
431}
432
433bool NaClProcessHost::LaunchNaClGdb() {
434#if defined(OS_WIN)
435  base::FilePath nacl_gdb =
436      CommandLine::ForCurrentProcess()->GetSwitchValuePath(switches::kNaClGdb);
437  CommandLine cmd_line(nacl_gdb);
438#else
439  CommandLine::StringType nacl_gdb =
440      CommandLine::ForCurrentProcess()->GetSwitchValueNative(
441          switches::kNaClGdb);
442  CommandLine::StringVector argv;
443  // We don't support spaces inside arguments in --nacl-gdb switch.
444  base::SplitString(nacl_gdb, static_cast<CommandLine::CharType>(' '), &argv);
445  CommandLine cmd_line(argv);
446#endif
447  cmd_line.AppendArg("--eval-command");
448  base::FilePath::StringType irt_path(
449      NaClBrowser::GetInstance()->GetIrtFilePath().value());
450  // Avoid back slashes because nacl-gdb uses posix escaping rules on Windows.
451  // See issue https://code.google.com/p/nativeclient/issues/detail?id=3482.
452  std::replace(irt_path.begin(), irt_path.end(), '\\', '/');
453  cmd_line.AppendArgNative(FILE_PATH_LITERAL("nacl-irt \"") + irt_path +
454                           FILE_PATH_LITERAL("\""));
455  if (!manifest_path_.empty()) {
456    cmd_line.AppendArg("--eval-command");
457    base::FilePath::StringType manifest_path_value(manifest_path_.value());
458    std::replace(manifest_path_value.begin(), manifest_path_value.end(),
459                 '\\', '/');
460    cmd_line.AppendArgNative(FILE_PATH_LITERAL("nacl-manifest \"") +
461                             manifest_path_value + FILE_PATH_LITERAL("\""));
462  }
463  cmd_line.AppendArg("--eval-command");
464  cmd_line.AppendArg("target remote :4014");
465  base::FilePath script = CommandLine::ForCurrentProcess()->GetSwitchValuePath(
466      switches::kNaClGdbScript);
467  if (!script.empty()) {
468    cmd_line.AppendArg("--command");
469    cmd_line.AppendArgNative(script.value());
470  }
471  return base::LaunchProcess(cmd_line, base::LaunchOptions(), NULL);
472}
473
474bool NaClProcessHost::LaunchSelLdr() {
475  std::string channel_id = process_->GetHost()->CreateChannel();
476  if (channel_id.empty()) {
477    SendErrorToRenderer("CreateChannel() failed");
478    return false;
479  }
480
481  CommandLine::StringType nacl_loader_prefix;
482#if defined(OS_POSIX)
483  nacl_loader_prefix = CommandLine::ForCurrentProcess()->GetSwitchValueNative(
484      switches::kNaClLoaderCmdPrefix);
485#endif  // defined(OS_POSIX)
486
487  // Build command line for nacl.
488
489#if defined(OS_MACOSX)
490  // The Native Client process needs to be able to allocate a 1GB contiguous
491  // region to use as the client environment's virtual address space. ASLR
492  // (PIE) interferes with this by making it possible that no gap large enough
493  // to accomodate this request will exist in the child process' address
494  // space. Disable PIE for NaCl processes. See http://crbug.com/90221 and
495  // http://code.google.com/p/nativeclient/issues/detail?id=2043.
496  int flags = ChildProcessHost::CHILD_NO_PIE;
497#elif defined(OS_LINUX)
498  int flags = nacl_loader_prefix.empty() ? ChildProcessHost::CHILD_ALLOW_SELF :
499                                           ChildProcessHost::CHILD_NORMAL;
500#else
501  int flags = ChildProcessHost::CHILD_NORMAL;
502#endif
503
504  base::FilePath exe_path = ChildProcessHost::GetChildPath(flags);
505  if (exe_path.empty())
506    return false;
507
508#if defined(OS_WIN)
509  // On Windows 64-bit NaCl loader is called nacl64.exe instead of chrome.exe
510  if (RunningOnWOW64()) {
511    if (!NaClBrowser::GetInstance()->GetNaCl64ExePath(&exe_path)) {
512      SendErrorToRenderer("could not get path to nacl64.exe");
513      return false;
514    }
515  }
516#endif
517
518  scoped_ptr<CommandLine> cmd_line(new CommandLine(exe_path));
519  CopyNaClCommandLineArguments(cmd_line.get());
520
521  cmd_line->AppendSwitchASCII(switches::kProcessType,
522                              switches::kNaClLoaderProcess);
523  cmd_line->AppendSwitchASCII(switches::kProcessChannelID, channel_id);
524  if (NaClBrowser::GetDelegate()->DialogsAreSuppressed())
525    cmd_line->AppendSwitch(switches::kNoErrorDialogs);
526
527  if (!nacl_loader_prefix.empty())
528    cmd_line->PrependWrapper(nacl_loader_prefix);
529
530  // On Windows we might need to start the broker process to launch a new loader
531#if defined(OS_WIN)
532  if (RunningOnWOW64()) {
533    if (!NaClBrokerService::GetInstance()->LaunchLoader(
534            weak_factory_.GetWeakPtr(), channel_id)) {
535      SendErrorToRenderer("broker service did not launch process");
536      return false;
537    }
538  } else {
539    process_->Launch(new NaClSandboxedProcessLauncherDelegate,
540                     false,
541                     cmd_line.release());
542  }
543#elif defined(OS_POSIX)
544  process_->Launch(nacl_loader_prefix.empty(),  // use_zygote
545                   base::EnvironmentMap(),
546                   cmd_line.release());
547#endif
548
549  return true;
550}
551
552bool NaClProcessHost::OnMessageReceived(const IPC::Message& msg) {
553  bool handled = true;
554  IPC_BEGIN_MESSAGE_MAP(NaClProcessHost, msg)
555    IPC_MESSAGE_HANDLER(NaClProcessMsg_QueryKnownToValidate,
556                        OnQueryKnownToValidate)
557    IPC_MESSAGE_HANDLER(NaClProcessMsg_SetKnownToValidate,
558                        OnSetKnownToValidate)
559    IPC_MESSAGE_HANDLER_DELAY_REPLY(NaClProcessMsg_ResolveFileToken,
560                                    OnResolveFileToken)
561#if defined(OS_WIN)
562    IPC_MESSAGE_HANDLER_DELAY_REPLY(NaClProcessMsg_AttachDebugExceptionHandler,
563                                    OnAttachDebugExceptionHandler)
564#endif
565    IPC_MESSAGE_HANDLER(NaClProcessHostMsg_PpapiChannelsCreated,
566                        OnPpapiChannelsCreated)
567    IPC_MESSAGE_UNHANDLED(handled = false)
568  IPC_END_MESSAGE_MAP()
569  return handled;
570}
571
572void NaClProcessHost::OnProcessLaunched() {
573  if (!StartWithLaunchedProcess())
574    delete this;
575}
576
577// Called when the NaClBrowser singleton has been fully initialized.
578void NaClProcessHost::OnResourcesReady() {
579  NaClBrowser* nacl_browser = NaClBrowser::GetInstance();
580  if (!nacl_browser->IsReady()) {
581    SendErrorToRenderer("could not acquire shared resources needed by NaCl");
582    delete this;
583  } else if (!SendStart()) {
584    delete this;
585  }
586}
587
588bool NaClProcessHost::ReplyToRenderer(
589    const IPC::ChannelHandle& channel_handle) {
590#if defined(OS_WIN)
591  // If we are on 64-bit Windows, the NaCl process's sandbox is
592  // managed by a different process from the renderer's sandbox.  We
593  // need to inform the renderer's sandbox about the NaCl process so
594  // that the renderer can send handles to the NaCl process using
595  // BrokerDuplicateHandle().
596  if (RunningOnWOW64()) {
597    if (!content::BrokerAddTargetPeer(process_->GetData().handle)) {
598      SendErrorToRenderer("BrokerAddTargetPeer() failed");
599      return false;
600    }
601  }
602#endif
603
604  FileDescriptor handle_for_renderer;
605#if defined(OS_WIN)
606  // Copy the handle into the renderer process.
607  HANDLE handle_in_renderer;
608  if (!DuplicateHandle(base::GetCurrentProcessHandle(),
609                       reinterpret_cast<HANDLE>(
610                           internal_->socket_for_renderer),
611                       nacl_host_message_filter_->PeerHandle(),
612                       &handle_in_renderer,
613                       0,  // Unused given DUPLICATE_SAME_ACCESS.
614                       FALSE,
615                       DUPLICATE_CLOSE_SOURCE | DUPLICATE_SAME_ACCESS)) {
616    SendErrorToRenderer("DuplicateHandle() failed");
617    return false;
618  }
619  handle_for_renderer = reinterpret_cast<FileDescriptor>(
620      handle_in_renderer);
621#else
622  // No need to dup the imc_handle - we don't pass it anywhere else so
623  // it cannot be closed.
624  FileDescriptor imc_handle;
625  imc_handle.fd = internal_->socket_for_renderer;
626  imc_handle.auto_close = true;
627  handle_for_renderer = imc_handle;
628#endif
629
630  const ChildProcessData& data = process_->GetData();
631  SendMessageToRenderer(
632      NaClLaunchResult(handle_for_renderer,
633                             channel_handle,
634                             base::GetProcId(data.handle),
635                             data.id),
636      std::string() /* error_message */);
637  internal_->socket_for_renderer = NACL_INVALID_HANDLE;
638  return true;
639}
640
641void NaClProcessHost::SendErrorToRenderer(const std::string& error_message) {
642  LOG(ERROR) << "NaCl process launch failed: " << error_message;
643  SendMessageToRenderer(NaClLaunchResult(), error_message);
644}
645
646void NaClProcessHost::SendMessageToRenderer(
647    const NaClLaunchResult& result,
648    const std::string& error_message) {
649  DCHECK(nacl_host_message_filter_);
650  DCHECK(reply_msg_);
651  if (nacl_host_message_filter_ != NULL && reply_msg_ != NULL) {
652    NaClHostMsg_LaunchNaCl::WriteReplyParams(
653        reply_msg_, result, error_message);
654    nacl_host_message_filter_->Send(reply_msg_);
655    nacl_host_message_filter_ = NULL;
656    reply_msg_ = NULL;
657  }
658}
659
660// TCP port we chose for NaCl debug stub. It can be any other number.
661static const int kInitialDebugStubPort = 4014;
662
663#if defined(OS_POSIX)
664net::SocketDescriptor NaClProcessHost::GetDebugStubSocketHandle() {
665  NaClBrowser* nacl_browser = NaClBrowser::GetInstance();
666  net::SocketDescriptor s = net::kInvalidSocket;
667  // We always try to allocate the default port first. If this fails, we then
668  // allocate any available port.
669  // On success, if the test system has register a handler
670  // (GdbDebugStubPortListener), we fire a notification.
671  int port = kInitialDebugStubPort;
672  s = net::TCPListenSocket::CreateAndBind("127.0.0.1", port);
673  if (s == net::kInvalidSocket) {
674    s = net::TCPListenSocket::CreateAndBindAnyPort("127.0.0.1", &port);
675  }
676  if (s != net::kInvalidSocket) {
677    if (nacl_browser->HasGdbDebugStubPortListener()) {
678      nacl_browser->FireGdbDebugStubPortOpened(port);
679    }
680  }
681  // Set debug stub port on the process object.
682  process_->SetNaClDebugStubPort(port);
683  if (s == net::kInvalidSocket) {
684    LOG(ERROR) << "failed to open socket for debug stub";
685    return net::kInvalidSocket;
686  } else {
687    LOG(WARNING) << "debug stub on port " << port;
688  }
689  if (listen(s, 1)) {
690    LOG(ERROR) << "listen() failed on debug stub socket";
691    if (IGNORE_EINTR(close(s)) < 0)
692      PLOG(ERROR) << "failed to close debug stub socket";
693    return net::kInvalidSocket;
694  }
695  return s;
696}
697#endif
698
699bool NaClProcessHost::StartNaClExecution() {
700  NaClBrowser* nacl_browser = NaClBrowser::GetInstance();
701
702  NaClStartParams params;
703  params.validation_cache_enabled = nacl_browser->ValidationCacheIsEnabled();
704  params.validation_cache_key = nacl_browser->GetValidationCacheKey();
705  params.version = NaClBrowser::GetDelegate()->GetVersionString();
706  params.enable_exception_handling = enable_exception_handling_;
707  params.enable_debug_stub = enable_debug_stub_ &&
708      NaClBrowser::GetDelegate()->URLMatchesDebugPatterns(manifest_url_);
709  // Enable PPAPI proxy channel creation only for renderer processes.
710  params.enable_ipc_proxy = enable_ppapi_proxy();
711  params.uses_irt = uses_irt_;
712  params.enable_dyncode_syscalls = enable_dyncode_syscalls_;
713  params.enable_nonsfi_mode = CommandLine::ForCurrentProcess()->HasSwitch(
714      switches::kEnableNaClNonSfiMode);
715
716  const ChildProcessData& data = process_->GetData();
717  if (!ShareHandleToSelLdr(data.handle,
718                           internal_->socket_for_sel_ldr, true,
719                           &params.handles)) {
720    return false;
721  }
722
723  if (params.uses_irt) {
724    base::PlatformFile irt_file = nacl_browser->IrtFile();
725    CHECK_NE(irt_file, base::kInvalidPlatformFileValue);
726    // Send over the IRT file handle.  We don't close our own copy!
727    if (!ShareHandleToSelLdr(data.handle, irt_file, false, &params.handles))
728      return false;
729  }
730
731#if defined(OS_MACOSX)
732  // For dynamic loading support, NaCl requires a file descriptor that
733  // was created in /tmp, since those created with shm_open() are not
734  // mappable with PROT_EXEC.  Rather than requiring an extra IPC
735  // round trip out of the sandbox, we create an FD here.
736  base::SharedMemory memory_buffer;
737  base::SharedMemoryCreateOptions options;
738  options.size = 1;
739  options.executable = true;
740  if (!memory_buffer.Create(options)) {
741    DLOG(ERROR) << "Failed to allocate memory buffer";
742    return false;
743  }
744  FileDescriptor memory_fd;
745  memory_fd.fd = dup(memory_buffer.handle().fd);
746  if (memory_fd.fd < 0) {
747    DLOG(ERROR) << "Failed to dup() a file descriptor";
748    return false;
749  }
750  memory_fd.auto_close = true;
751  params.handles.push_back(memory_fd);
752#endif
753
754#if defined(OS_POSIX)
755  if (params.enable_debug_stub) {
756    net::SocketDescriptor server_bound_socket = GetDebugStubSocketHandle();
757    if (server_bound_socket != net::kInvalidSocket) {
758      params.debug_stub_server_bound_socket =
759          FileDescriptor(server_bound_socket, true);
760    }
761  }
762#endif
763
764  process_->Send(new NaClProcessMsg_Start(params));
765
766  internal_->socket_for_sel_ldr = NACL_INVALID_HANDLE;
767  return true;
768}
769
770bool NaClProcessHost::SendStart() {
771  if (!enable_ppapi_proxy()) {
772    if (!ReplyToRenderer(IPC::ChannelHandle()))
773      return false;
774  }
775  return StartNaClExecution();
776}
777
778// This method is called when NaClProcessHostMsg_PpapiChannelCreated is
779// received.
780void NaClProcessHost::OnPpapiChannelsCreated(
781    const IPC::ChannelHandle& browser_channel_handle,
782    const IPC::ChannelHandle& renderer_channel_handle) {
783  // Only renderer processes should create a channel.
784  DCHECK(enable_ppapi_proxy());
785  if (!ipc_proxy_channel_.get()) {
786    DCHECK_EQ(PROCESS_TYPE_NACL_LOADER, process_->GetData().process_type);
787
788    ipc_proxy_channel_.reset(
789        new IPC::ChannelProxy(browser_channel_handle,
790                              IPC::Channel::MODE_CLIENT,
791                              NULL,
792                              base::MessageLoopProxy::current().get()));
793    // Create the browser ppapi host and enable PPAPI message dispatching to the
794    // browser process.
795    ppapi_host_.reset(content::BrowserPpapiHost::CreateExternalPluginProcess(
796        ipc_proxy_channel_.get(),  // sender
797        permissions_,
798        process_->GetData().handle,
799        ipc_proxy_channel_.get(),
800        nacl_host_message_filter_->render_process_id(),
801        render_view_id_,
802        profile_directory_));
803    ppapi_host_->SetOnKeepaliveCallback(
804        NaClBrowser::GetDelegate()->GetOnKeepaliveCallback());
805
806    ppapi::PpapiNaClPluginArgs args;
807    args.off_the_record = nacl_host_message_filter_->off_the_record();
808    args.permissions = permissions_;
809    CommandLine* cmdline = CommandLine::ForCurrentProcess();
810    DCHECK(cmdline);
811    std::string flag_whitelist[] = {
812      switches::kPpapiKeepAliveThrottle,
813      switches::kV,
814      switches::kVModule,
815    };
816    for (size_t i = 0; i < arraysize(flag_whitelist); ++i) {
817      std::string value = cmdline->GetSwitchValueASCII(flag_whitelist[i]);
818      if (!value.empty()) {
819        args.switch_names.push_back(flag_whitelist[i]);
820        args.switch_values.push_back(value);
821      }
822    }
823
824    ppapi_host_->GetPpapiHost()->AddHostFactoryFilter(
825        scoped_ptr<ppapi::host::HostFactory>(
826            NaClBrowser::GetDelegate()->CreatePpapiHostFactory(
827                ppapi_host_.get())));
828
829    // Send a message to initialize the IPC dispatchers in the NaCl plugin.
830    ipc_proxy_channel_->Send(new PpapiMsg_InitializeNaClDispatcher(args));
831
832    // Let the renderer know that the IPC channels are established.
833    ReplyToRenderer(renderer_channel_handle);
834  } else {
835    // Attempt to open more than 1 browser channel is not supported.
836    // Shut down the NaCl process.
837    process_->GetHost()->ForceShutdown();
838  }
839}
840
841bool NaClProcessHost::StartWithLaunchedProcess() {
842  NaClBrowser* nacl_browser = NaClBrowser::GetInstance();
843
844  if (nacl_browser->IsReady()) {
845    return SendStart();
846  } else if (nacl_browser->IsOk()) {
847    nacl_browser->WaitForResources(
848        base::Bind(&NaClProcessHost::OnResourcesReady,
849                   weak_factory_.GetWeakPtr()));
850    return true;
851  } else {
852    SendErrorToRenderer("previously failed to acquire shared resources");
853    return false;
854  }
855}
856
857void NaClProcessHost::OnQueryKnownToValidate(const std::string& signature,
858                                             bool* result) {
859  NaClBrowser* nacl_browser = NaClBrowser::GetInstance();
860  *result = nacl_browser->QueryKnownToValidate(signature, off_the_record_);
861}
862
863void NaClProcessHost::OnSetKnownToValidate(const std::string& signature) {
864  NaClBrowser::GetInstance()->SetKnownToValidate(
865      signature, off_the_record_);
866}
867
868void NaClProcessHost::FileResolved(
869    const base::FilePath& file_path,
870    IPC::Message* reply_msg,
871    const base::PlatformFile& file) {
872  if (file != base::kInvalidPlatformFileValue) {
873    IPC::PlatformFileForTransit handle = IPC::GetFileHandleForProcess(
874        file,
875        process_->GetData().handle,
876        true /* close_source */);
877    NaClProcessMsg_ResolveFileToken::WriteReplyParams(
878        reply_msg,
879        handle,
880        file_path);
881  } else {
882    NaClProcessMsg_ResolveFileToken::WriteReplyParams(
883        reply_msg,
884        IPC::InvalidPlatformFileForTransit(),
885        base::FilePath());
886  }
887  Send(reply_msg);
888}
889
890void NaClProcessHost::OnResolveFileToken(uint64 file_token_lo,
891                                         uint64 file_token_hi,
892                                         IPC::Message* reply_msg) {
893  // Was the file registered?
894  //
895  // Note that the file path cache is of bounded size, and old entries can get
896  // evicted.  If a large number of NaCl modules are being launched at once,
897  // resolving the file_token may fail because the path cache was thrashed
898  // while the file_token was in flight.  In this case the query fails, and we
899  // need to fall back to the slower path.
900  //
901  // However: each NaCl process will consume 2-3 entries as it starts up, this
902  // means that eviction will not happen unless you start up 33+ NaCl processes
903  // at the same time, and this still requires worst-case timing.  As a
904  // practical matter, no entries should be evicted prematurely.
905  // The cache itself should take ~ (150 characters * 2 bytes/char + ~60 bytes
906  // data structure overhead) * 100 = 35k when full, so making it bigger should
907  // not be a problem, if needed.
908  //
909  // Each NaCl process will consume 2-3 entries because the manifest and main
910  // nexe are currently not resolved.  Shared libraries will be resolved.  They
911  // will be loaded sequentially, so they will only consume a single entry
912  // while the load is in flight.
913  //
914  // TODO(ncbray): track behavior with UMA. If entries are getting evicted or
915  // bogus keys are getting queried, this would be good to know.
916  base::FilePath file_path;
917  if (!NaClBrowser::GetInstance()->GetFilePath(
918        file_token_lo, file_token_hi, &file_path)) {
919    NaClProcessMsg_ResolveFileToken::WriteReplyParams(
920        reply_msg,
921        IPC::InvalidPlatformFileForTransit(),
922        base::FilePath());
923    Send(reply_msg);
924    return;
925  }
926
927  // Open the file.
928  if (!base::PostTaskAndReplyWithResult(
929          content::BrowserThread::GetBlockingPool(),
930          FROM_HERE,
931          base::Bind(OpenNaClExecutableImpl, file_path),
932          base::Bind(&NaClProcessHost::FileResolved,
933                     weak_factory_.GetWeakPtr(),
934                     file_path,
935                     reply_msg))) {
936     NaClProcessMsg_ResolveFileToken::WriteReplyParams(
937         reply_msg,
938         IPC::InvalidPlatformFileForTransit(),
939         base::FilePath());
940     Send(reply_msg);
941  }
942}
943
944#if defined(OS_WIN)
945void NaClProcessHost::OnAttachDebugExceptionHandler(const std::string& info,
946                                                    IPC::Message* reply_msg) {
947  if (!AttachDebugExceptionHandler(info, reply_msg)) {
948    // Send failure message.
949    NaClProcessMsg_AttachDebugExceptionHandler::WriteReplyParams(reply_msg,
950                                                                 false);
951    Send(reply_msg);
952  }
953}
954
955bool NaClProcessHost::AttachDebugExceptionHandler(const std::string& info,
956                                                  IPC::Message* reply_msg) {
957  if (!enable_exception_handling_ && !enable_debug_stub_) {
958    DLOG(ERROR) <<
959        "Debug exception handler requested by NaCl process when not enabled";
960    return false;
961  }
962  if (debug_exception_handler_requested_) {
963    // The NaCl process should not request this multiple times.
964    DLOG(ERROR) << "Multiple AttachDebugExceptionHandler requests received";
965    return false;
966  }
967  debug_exception_handler_requested_ = true;
968
969  base::ProcessId nacl_pid = base::GetProcId(process_->GetData().handle);
970  base::ProcessHandle temp_handle;
971  // We cannot use process_->GetData().handle because it does not have
972  // the necessary access rights.  We open the new handle here rather
973  // than in the NaCl broker process in case the NaCl loader process
974  // dies before the NaCl broker process receives the message we send.
975  // The debug exception handler uses DebugActiveProcess() to attach,
976  // but this takes a PID.  We need to prevent the NaCl loader's PID
977  // from being reused before DebugActiveProcess() is called, and
978  // holding a process handle open achieves this.
979  if (!base::OpenProcessHandleWithAccess(
980           nacl_pid,
981           base::kProcessAccessQueryInformation |
982           base::kProcessAccessSuspendResume |
983           base::kProcessAccessTerminate |
984           base::kProcessAccessVMOperation |
985           base::kProcessAccessVMRead |
986           base::kProcessAccessVMWrite |
987           base::kProcessAccessDuplicateHandle |
988           base::kProcessAccessWaitForTermination,
989           &temp_handle)) {
990    LOG(ERROR) << "Failed to get process handle";
991    return false;
992  }
993  base::win::ScopedHandle process_handle(temp_handle);
994
995  attach_debug_exception_handler_reply_msg_.reset(reply_msg);
996  // If the NaCl loader is 64-bit, the process running its debug
997  // exception handler must be 64-bit too, so we use the 64-bit NaCl
998  // broker process for this.  Otherwise, on a 32-bit system, we use
999  // the 32-bit browser process to run the debug exception handler.
1000  if (RunningOnWOW64()) {
1001    return NaClBrokerService::GetInstance()->LaunchDebugExceptionHandler(
1002               weak_factory_.GetWeakPtr(), nacl_pid, process_handle, info);
1003  } else {
1004    NaClStartDebugExceptionHandlerThread(
1005        process_handle.Take(), info,
1006        base::MessageLoopProxy::current(),
1007        base::Bind(&NaClProcessHost::OnDebugExceptionHandlerLaunchedByBroker,
1008                   weak_factory_.GetWeakPtr()));
1009    return true;
1010  }
1011}
1012#endif
1013
1014}  // namespace nacl
1015