1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #include "content/ppapi_plugin/ppapi_thread.h"
9 #include "base/command_line.h"
11 #include "base/debug/crash_logging.h"
12 #include "base/files/file_util.h"
13 #include "base/logging.h"
14 #include "base/memory/discardable_memory_allocator.h"
15 #include "base/metrics/histogram.h"
16 #include "base/metrics/sparse_histogram.h"
17 #include "base/rand_util.h"
18 #include "base/strings/stringprintf.h"
19 #include "base/strings/utf_string_conversions.h"
20 #include "base/threading/platform_thread.h"
21 #include "base/time/time.h"
22 #include "content/child/browser_font_resource_trusted.h"
23 #include "content/child/child_discardable_shared_memory_manager.h"
24 #include "content/child/child_process.h"
25 #include "content/common/child_process_messages.h"
26 #include "content/common/sandbox_util.h"
27 #include "content/ppapi_plugin/broker_process_dispatcher.h"
28 #include "content/ppapi_plugin/plugin_process_dispatcher.h"
29 #include "content/ppapi_plugin/ppapi_blink_platform_impl.h"
30 #include "content/public/common/content_client.h"
31 #include "content/public/common/content_switches.h"
32 #include "content/public/common/pepper_plugin_info.h"
33 #include "content/public/common/sandbox_init.h"
34 #include "content/public/plugin/content_plugin_client.h"
35 #include "ipc/ipc_channel_handle.h"
36 #include "ipc/ipc_platform_file.h"
37 #include "ipc/ipc_sync_channel.h"
38 #include "ipc/ipc_sync_message_filter.h"
39 #include "ppapi/c/dev/ppp_network_state_dev.h"
40 #include "ppapi/c/pp_errors.h"
41 #include "ppapi/c/ppp.h"
42 #include "ppapi/proxy/interface_list.h"
43 #include "ppapi/proxy/plugin_globals.h"
44 #include "ppapi/proxy/plugin_message_filter.h"
45 #include "ppapi/proxy/ppapi_messages.h"
46 #include "ppapi/proxy/resource_reply_thread_registrar.h"
47 #include "third_party/WebKit/public/web/WebKit.h"
48 #include "ui/base/ui_base_switches.h"
51 #include "base/win/win_util.h"
52 #include "base/win/windows_version.h"
53 #include "sandbox/win/src/sandbox.h"
54 #elif defined(OS_MACOSX)
55 #include "content/common/sandbox_init_mac.h"
59 const char kWidevineCdmAdapterFileName
[] = "widevinecdmadapter.dll";
61 extern sandbox::TargetServices
* g_target_services
;
63 // Used by EnumSystemLocales for warming up.
64 static BOOL CALLBACK
EnumLocalesProc(LPTSTR lpLocaleString
) {
68 static BOOL CALLBACK
EnumLocalesProcEx(
69 LPWSTR lpLocaleString
,
75 // Warm up language subsystems before the sandbox is turned on.
76 static void WarmupWindowsLocales(const ppapi::PpapiPermissions
& permissions
) {
77 ::GetUserDefaultLangID();
78 ::GetUserDefaultLCID();
80 if (permissions
.HasPermission(ppapi::PERMISSION_FLASH
)) {
81 if (base::win::GetVersion() >= base::win::VERSION_VISTA
) {
82 typedef BOOL (WINAPI
*PfnEnumSystemLocalesEx
)
83 (LOCALE_ENUMPROCEX
, DWORD
, LPARAM
, LPVOID
);
85 HMODULE handle_kern32
= GetModuleHandleW(L
"Kernel32.dll");
86 PfnEnumSystemLocalesEx enum_sys_locales_ex
=
87 reinterpret_cast<PfnEnumSystemLocalesEx
>
88 (GetProcAddress(handle_kern32
, "EnumSystemLocalesEx"));
90 enum_sys_locales_ex(EnumLocalesProcEx
, LOCALE_WINDOWS
, 0, 0);
92 EnumSystemLocalesW(EnumLocalesProc
, LCID_INSTALLED
);
101 typedef int32_t (*InitializeBrokerFunc
)
102 (PP_ConnectInstance_Func
* connect_instance_func
);
104 PpapiThread::PpapiThread(const base::CommandLine
& command_line
, bool is_broker
)
105 : is_broker_(is_broker
),
106 plugin_globals_(GetIOTaskRunner()),
107 connect_instance_func_(NULL
),
108 local_pp_module_(base::RandInt(0, std::numeric_limits
<PP_Module
>::max())),
109 next_plugin_dispatcher_id_(1) {
110 plugin_globals_
.SetPluginProxyDelegate(this);
111 plugin_globals_
.set_command_line(
112 command_line
.GetSwitchValueASCII(switches::kPpapiFlashArgs
));
114 blink_platform_impl_
.reset(new PpapiBlinkPlatformImpl
);
115 blink::initialize(blink_platform_impl_
.get());
118 scoped_refptr
<ppapi::proxy::PluginMessageFilter
> plugin_filter(
119 new ppapi::proxy::PluginMessageFilter(
120 NULL
, plugin_globals_
.resource_reply_thread_registrar()));
121 channel()->AddFilter(plugin_filter
.get());
122 plugin_globals_
.RegisterResourceMessageFilters(plugin_filter
.get());
125 // In single process, browser main loop set up the discardable memory
127 if (!command_line
.HasSwitch(switches::kSingleProcess
)) {
128 base::DiscardableMemoryAllocator::SetInstance(
129 ChildThreadImpl::discardable_shared_memory_manager());
133 PpapiThread::~PpapiThread() {
136 void PpapiThread::Shutdown() {
137 ChildThreadImpl::Shutdown();
139 ppapi::proxy::PluginGlobals::Get()->ResetPluginProxyDelegate();
140 if (plugin_entry_points_
.shutdown_module
)
141 plugin_entry_points_
.shutdown_module();
142 blink_platform_impl_
->Shutdown();
146 bool PpapiThread::Send(IPC::Message
* msg
) {
147 // Allow access from multiple threads.
148 if (base::MessageLoop::current() == message_loop())
149 return ChildThreadImpl::Send(msg
);
151 return sync_message_filter()->Send(msg
);
154 // Note that this function is called only for messages from the channel to the
155 // browser process. Messages from the renderer process are sent via a different
156 // channel that ends up at Dispatcher::OnMessageReceived.
157 bool PpapiThread::OnControlMessageReceived(const IPC::Message
& msg
) {
159 IPC_BEGIN_MESSAGE_MAP(PpapiThread
, msg
)
160 IPC_MESSAGE_HANDLER(PpapiMsg_LoadPlugin
, OnLoadPlugin
)
161 IPC_MESSAGE_HANDLER(PpapiMsg_CreateChannel
, OnCreateChannel
)
162 IPC_MESSAGE_HANDLER(PpapiMsg_SetNetworkState
, OnSetNetworkState
)
163 IPC_MESSAGE_HANDLER(PpapiMsg_Crash
, OnCrash
)
164 IPC_MESSAGE_HANDLER(PpapiMsg_Hang
, OnHang
)
165 IPC_MESSAGE_UNHANDLED(handled
= false)
166 IPC_END_MESSAGE_MAP()
170 void PpapiThread::OnChannelConnected(int32 peer_pid
) {
171 ChildThreadImpl::OnChannelConnected(peer_pid
);
174 peer_handle_
.Set(::OpenProcess(PROCESS_DUP_HANDLE
, FALSE
, peer_pid
));
178 base::MessageLoopProxy
* PpapiThread::GetIPCMessageLoop() {
179 return ChildProcess::current()->io_message_loop_proxy();
182 base::WaitableEvent
* PpapiThread::GetShutdownEvent() {
183 return ChildProcess::current()->GetShutDownEvent();
186 IPC::PlatformFileForTransit
PpapiThread::ShareHandleWithRemote(
187 base::PlatformFile handle
,
188 base::ProcessId peer_pid
,
189 bool should_close_source
) {
191 if (peer_handle_
.IsValid()) {
193 return IPC::GetFileHandleForProcess(handle
, peer_handle_
.Get(),
194 should_close_source
);
198 DCHECK(peer_pid
!= base::kNullProcessId
);
199 return BrokerGetFileHandleForProcess(handle
, peer_pid
, should_close_source
);
202 std::set
<PP_Instance
>* PpapiThread::GetGloballySeenInstanceIDSet() {
203 return &globally_seen_instance_ids_
;
206 IPC::Sender
* PpapiThread::GetBrowserSender() {
210 std::string
PpapiThread::GetUILanguage() {
211 base::CommandLine
* command_line
= base::CommandLine::ForCurrentProcess();
212 return command_line
->GetSwitchValueASCII(switches::kLang
);
215 void PpapiThread::PreCacheFont(const void* logfontw
) {
217 ChildThreadImpl::PreCacheFont(*static_cast<const LOGFONTW
*>(logfontw
));
221 void PpapiThread::SetActiveURL(const std::string
& url
) {
222 GetContentClient()->SetActiveURL(GURL(url
));
225 PP_Resource
PpapiThread::CreateBrowserFont(
226 ppapi::proxy::Connection connection
,
227 PP_Instance instance
,
228 const PP_BrowserFont_Trusted_Description
& desc
,
229 const ppapi::Preferences
& prefs
) {
230 if (!BrowserFontResource_Trusted::IsPPFontDescriptionValid(desc
))
232 return (new BrowserFontResource_Trusted(
233 connection
, instance
, desc
, prefs
))->GetReference();
236 uint32
PpapiThread::Register(ppapi::proxy::PluginDispatcher
* plugin_dispatcher
) {
237 if (!plugin_dispatcher
||
238 plugin_dispatchers_
.size() >= std::numeric_limits
<uint32
>::max()) {
244 // Although it is unlikely, make sure that we won't cause any trouble when
245 // the counter overflows.
246 id
= next_plugin_dispatcher_id_
++;
248 plugin_dispatchers_
.find(id
) != plugin_dispatchers_
.end());
249 plugin_dispatchers_
[id
] = plugin_dispatcher
;
253 void PpapiThread::Unregister(uint32 plugin_dispatcher_id
) {
254 plugin_dispatchers_
.erase(plugin_dispatcher_id
);
257 void PpapiThread::OnLoadPlugin(const base::FilePath
& path
,
258 const ppapi::PpapiPermissions
& permissions
) {
259 // In case of crashes, the crash dump doesn't indicate which plugin
261 base::debug::SetCrashKeyValue("ppapi_path", path
.MaybeAsASCII());
263 SavePluginName(path
);
265 // This must be set before calling into the plugin so it can get the
266 // interfaces it has permission for.
267 ppapi::proxy::InterfaceList::SetProcessGlobalPermissions(permissions
);
268 permissions_
= permissions
;
270 // Trusted Pepper plugins may be "internal", i.e. built-in to the browser
271 // binary. If we're being asked to load such a plugin (e.g. the Chromoting
272 // client) then fetch the entry points from the embedder, rather than a DLL.
273 std::vector
<PepperPluginInfo
> plugins
;
274 GetContentClient()->AddPepperPlugins(&plugins
);
275 for (size_t i
= 0; i
< plugins
.size(); ++i
) {
276 if (plugins
[i
].is_internal
&& plugins
[i
].path
== path
) {
277 // An internal plugin is being loaded, so fetch the entry points.
278 plugin_entry_points_
= plugins
[i
].internal_entry_points
;
282 // If the plugin isn't internal then load it from |path|.
283 base::ScopedNativeLibrary library
;
284 if (plugin_entry_points_
.initialize_module
== NULL
) {
285 // Load the plugin from the specified library.
286 base::NativeLibraryLoadError error
;
287 library
.Reset(base::LoadNativeLibrary(path
, &error
));
288 if (!library
.is_valid()) {
289 LOG(ERROR
) << "Failed to load Pepper module from " << path
.value()
290 << " (error: " << error
.ToString() << ")";
291 if (!base::PathExists(path
)) {
292 ReportLoadResult(path
, FILE_MISSING
);
295 ReportLoadResult(path
, LOAD_FAILED
);
296 // Report detailed reason for load failure.
297 ReportLoadErrorCode(path
, error
);
301 // Get the GetInterface function (required).
302 plugin_entry_points_
.get_interface
=
303 reinterpret_cast<PP_GetInterface_Func
>(
304 library
.GetFunctionPointer("PPP_GetInterface"));
305 if (!plugin_entry_points_
.get_interface
) {
306 LOG(WARNING
) << "No PPP_GetInterface in plugin library";
307 ReportLoadResult(path
, ENTRY_POINT_MISSING
);
311 // The ShutdownModule/ShutdownBroker function is optional.
312 plugin_entry_points_
.shutdown_module
=
314 reinterpret_cast<PP_ShutdownModule_Func
>(
315 library
.GetFunctionPointer("PPP_ShutdownBroker")) :
316 reinterpret_cast<PP_ShutdownModule_Func
>(
317 library
.GetFunctionPointer("PPP_ShutdownModule"));
320 // Get the InitializeModule function (required for non-broker code).
321 plugin_entry_points_
.initialize_module
=
322 reinterpret_cast<PP_InitializeModule_Func
>(
323 library
.GetFunctionPointer("PPP_InitializeModule"));
324 if (!plugin_entry_points_
.initialize_module
) {
325 LOG(WARNING
) << "No PPP_InitializeModule in plugin library";
326 ReportLoadResult(path
, ENTRY_POINT_MISSING
);
333 // If code subsequently tries to exit using abort(), force a crash (since
334 // otherwise these would be silent terminations and fly under the radar).
335 base::win::SetAbortBehaviorForCrashReporting();
337 // Once we lower the token the sandbox is locked down and no new modules
338 // can be loaded. TODO(cpu): consider changing to the loading style of
340 if (g_target_services
) {
341 // Let Flash and Widevine CDM adapter load DXVA before lockdown on Vista+.
342 if (permissions
.HasPermission(ppapi::PERMISSION_FLASH
) ||
343 path
.BaseName().MaybeAsASCII() == kWidevineCdmAdapterFileName
) {
344 if (base::win::OSInfo::GetInstance()->version() >=
345 base::win::VERSION_VISTA
) {
346 LoadLibraryA("dxva2.dll");
350 if (permissions
.HasPermission(ppapi::PERMISSION_FLASH
)) {
351 if (base::win::OSInfo::GetInstance()->version() >=
352 base::win::VERSION_WIN7
) {
354 if (cpu
.vendor_name() == "AuthenticAMD") {
355 // The AMD crypto acceleration is only AMD Bulldozer and above.
357 LoadLibraryA("amdhcp64.dll");
359 LoadLibraryA("amdhcp32.dll");
365 // Cause advapi32 to load before the sandbox is turned on.
366 unsigned int dummy_rand
;
369 WarmupWindowsLocales(permissions
);
371 #if defined(ADDRESS_SANITIZER)
372 // Bind and leak dbghelp.dll before the token is lowered, otherwise
373 // AddressSanitizer will crash when trying to symbolize a report.
374 LoadLibraryA("dbghelp.dll");
377 g_target_services
->LowerToken();
382 // Get the InitializeBroker function (required).
383 InitializeBrokerFunc init_broker
=
384 reinterpret_cast<InitializeBrokerFunc
>(
385 library
.GetFunctionPointer("PPP_InitializeBroker"));
387 LOG(WARNING
) << "No PPP_InitializeBroker in plugin library";
388 ReportLoadResult(path
, ENTRY_POINT_MISSING
);
392 int32_t init_error
= init_broker(&connect_instance_func_
);
393 if (init_error
!= PP_OK
) {
394 LOG(WARNING
) << "InitBroker failed with error " << init_error
;
395 ReportLoadResult(path
, INIT_FAILED
);
398 if (!connect_instance_func_
) {
399 LOG(WARNING
) << "InitBroker did not provide PP_ConnectInstance_Func";
400 ReportLoadResult(path
, INIT_FAILED
);
404 #if defined(OS_MACOSX)
405 // We need to do this after getting |PPP_GetInterface()| (or presumably
406 // doing something nontrivial with the library), else the sandbox
408 CHECK(InitializeSandbox());
411 int32_t init_error
= plugin_entry_points_
.initialize_module(
413 &ppapi::proxy::PluginDispatcher::GetBrowserInterface
);
414 if (init_error
!= PP_OK
) {
415 LOG(WARNING
) << "InitModule failed with error " << init_error
;
416 ReportLoadResult(path
, INIT_FAILED
);
421 // Initialization succeeded, so keep the plugin DLL loaded.
422 library_
.Reset(library
.Release());
424 ReportLoadResult(path
, LOAD_SUCCESS
);
427 void PpapiThread::OnCreateChannel(base::ProcessId renderer_pid
,
428 int renderer_child_id
,
430 IPC::ChannelHandle channel_handle
;
432 if (!plugin_entry_points_
.get_interface
|| // Plugin couldn't be loaded.
433 !SetupRendererChannel(renderer_pid
, renderer_child_id
, incognito
,
435 Send(new PpapiHostMsg_ChannelCreated(IPC::ChannelHandle()));
439 Send(new PpapiHostMsg_ChannelCreated(channel_handle
));
442 void PpapiThread::OnSetNetworkState(bool online
) {
443 // Note the browser-process side shouldn't send us these messages in the
444 // first unless the plugin has dev permissions, so we don't need to check
445 // again here. We don't want random plugins depending on this dev interface.
446 if (!plugin_entry_points_
.get_interface
)
448 const PPP_NetworkState_Dev
* ns
= static_cast<const PPP_NetworkState_Dev
*>(
449 plugin_entry_points_
.get_interface(PPP_NETWORK_STATE_DEV_INTERFACE
));
451 ns
->SetOnLine(PP_FromBool(online
));
454 void PpapiThread::OnCrash() {
455 // Intentionally crash upon the request of the browser.
456 volatile int* null_pointer
= NULL
;
460 void PpapiThread::OnHang() {
461 // Intentionally hang upon the request of the browser.
463 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1));
466 bool PpapiThread::SetupRendererChannel(base::ProcessId renderer_pid
,
467 int renderer_child_id
,
469 IPC::ChannelHandle
* handle
) {
470 DCHECK(is_broker_
== (connect_instance_func_
!= NULL
));
471 IPC::ChannelHandle plugin_handle
;
472 plugin_handle
.name
= IPC::Channel::GenerateVerifiedChannelID(
474 "%d.r%d", base::GetCurrentProcId(), renderer_child_id
));
476 ppapi::proxy::ProxyChannel
* dispatcher
= NULL
;
477 bool init_result
= false;
479 BrokerProcessDispatcher
* broker_dispatcher
=
480 new BrokerProcessDispatcher(plugin_entry_points_
.get_interface
,
481 connect_instance_func_
);
482 init_result
= broker_dispatcher
->InitBrokerWithChannel(this,
486 dispatcher
= broker_dispatcher
;
488 PluginProcessDispatcher
* plugin_dispatcher
=
489 new PluginProcessDispatcher(plugin_entry_points_
.get_interface
,
492 init_result
= plugin_dispatcher
->InitPluginWithChannel(this,
496 dispatcher
= plugin_dispatcher
;
504 handle
->name
= plugin_handle
.name
;
505 #if defined(OS_POSIX)
506 // On POSIX, transfer ownership of the renderer-side (client) FD.
507 // This ensures this process will be notified when it is closed even if a
508 // connection is not established.
509 handle
->socket
= base::FileDescriptor(dispatcher
->TakeRendererFD());
510 if (handle
->socket
.fd
== -1)
514 // From here, the dispatcher will manage its own lifetime according to the
515 // lifetime of the attached channel.
519 void PpapiThread::SavePluginName(const base::FilePath
& path
) {
520 ppapi::proxy::PluginGlobals::Get()->set_plugin_name(
521 path
.BaseName().AsUTF8Unsafe());
523 // plugin() is NULL when in-process, which is fine, because this is
524 // just a hook for setting the process name.
525 if (GetContentClient()->plugin()) {
526 GetContentClient()->plugin()->PluginProcessStarted(
527 path
.BaseName().RemoveExtension().LossyDisplayName());
531 void PpapiThread::ReportLoadResult(const base::FilePath
& path
,
533 DCHECK_LT(result
, LOAD_RESULT_MAX
);
534 std::string histogram_name
= std::string("Plugin.Ppapi") +
535 (is_broker_
? "Broker" : "Plugin") +
536 "LoadResult_" + path
.BaseName().MaybeAsASCII();
538 // Note: This leaks memory, which is expected behavior.
539 base::HistogramBase
* histogram
=
540 base::LinearHistogram::FactoryGet(
545 base::HistogramBase::kUmaTargetedHistogramFlag
);
547 histogram
->Add(result
);
550 void PpapiThread::ReportLoadErrorCode(
551 const base::FilePath
& path
,
552 const base::NativeLibraryLoadError
& error
) {
554 // Only report load error code on Windows because that's the only platform
555 // that has a numerical error value.
556 std::string histogram_name
=
557 std::string("Plugin.Ppapi") + (is_broker_
? "Broker" : "Plugin") +
558 "LoadErrorCode_" + path
.BaseName().MaybeAsASCII();
560 // For sparse histograms, we can use the macro, as it does not incorporate a
562 UMA_HISTOGRAM_SPARSE_SLOWLY(histogram_name
, error
.code
);
566 } // namespace content