content/common/font_warmup_win.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/common/font_warmup_win.h"
   6
   7 #include <dwrite.h>
   8
   9 #include "base/debug/alias.h"
  10 #include "base/logging.h"
  11 #include "base/win/iat_patch_function.h"
  12 #include "base/win/windows_version.h"
  13 #include "content/public/common/dwrite_font_platform_win.h"
  14 #include "third_party/WebKit/public/web/win/WebFontRendering.h"
  15 #include "third_party/skia/include/core/SkPaint.h"
  16 #include "third_party/skia/include/ports/SkFontMgr.h"
  17 #include "third_party/skia/include/ports/SkTypeface_win.h"
  18
  19 namespace content {
  20
  21 namespace {
  22
  23 SkFontMgr* g_warmup_fontmgr = nullptr;
  24
  25 base::win::IATPatchFunction g_iat_patch_open_sc_manager;
  26 base::win::IATPatchFunction g_iat_patch_close_service_handle;
  27 base::win::IATPatchFunction g_iat_patch_open_service;
  28 base::win::IATPatchFunction g_iat_patch_start_service;
  29 base::win::IATPatchFunction g_iat_patch_nt_connect_port;
  30
  31 // These are from ntddk.h
  32 #if !defined(STATUS_ACCESS_DENIED)
  33 #define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L)
  34 #endif
  35
  36 typedef LONG NTSTATUS;
  37
  38 const uintptr_t kFakeSCMHandle = 0xdead0001;
  39 const uintptr_t kFakeServiceHandle = 0xdead0002;
  40
  41 SC_HANDLE WINAPI OpenSCManagerWPatch(const wchar_t* machine_name,
  42                                      const wchar_t* database_name,
  43                                      DWORD access_mask) {
  44   ::SetLastError(0);
  45   return reinterpret_cast<SC_HANDLE>(kFakeSCMHandle);
  46 }
  47
  48 SC_HANDLE WINAPI OpenServiceWPatch(SC_HANDLE sc_manager,
  49                                    const wchar_t* service_name,
  50                                    DWORD access_mask) {
  51   ::SetLastError(0);
  52   return reinterpret_cast<SC_HANDLE>(kFakeServiceHandle);
  53 }
  54
  55 BOOL WINAPI CloseServiceHandlePatch(SC_HANDLE service_handle) {
  56   if (service_handle != reinterpret_cast<SC_HANDLE>(kFakeServiceHandle) &&
  57       service_handle != reinterpret_cast<SC_HANDLE>(kFakeSCMHandle))
  58     CHECK(false);
  59   ::SetLastError(0);
  60   return TRUE;
  61 }
  62
  63 BOOL WINAPI StartServiceWPatch(SC_HANDLE service,
  64                                DWORD args,
  65                                const wchar_t** arg_vectors) {
  66   if (service != reinterpret_cast<SC_HANDLE>(kFakeServiceHandle))
  67     CHECK(false);
  68   ::SetLastError(ERROR_ACCESS_DENIED);
  69   return FALSE;
  70 }
  71
  72 NTSTATUS WINAPI NtALpcConnectPortPatch(HANDLE* port_handle,
  73                                        void* port_name,
  74                                        void* object_attribs,
  75                                        void* port_attribs,
  76                                        DWORD flags,
  77                                        void* server_sid,
  78                                        void* message,
  79                                        DWORD* buffer_length,
  80                                        void* out_message_attributes,
  81                                        void* in_message_attributes,
  82                                        void* time_out) {
  83   return STATUS_ACCESS_DENIED;
  84 }
  85
  86 // Directwrite connects to the font cache service to retrieve information about
  87 // fonts installed on the system etc. This works well outside the sandbox and
  88 // within the sandbox as long as the lpc connection maintained by the current
  89 // process with the font cache service remains valid. It appears that there
  90 // are cases when this connection is dropped after which directwrite is unable
  91 // to connect to the font cache service which causes problems with characters
  92 // disappearing.
  93 // Directwrite has fallback code to enumerate fonts if it is unable to connect
  94 // to the font cache service. We need to intercept the following APIs to
  95 // ensure that it does not connect to the font cache service.
  96 // NtALpcConnectPort
  97 // OpenSCManagerW
  98 // OpenServiceW
  99 // StartServiceW
 100 // CloseServiceHandle.
 101 // These are all IAT patched.
 102 void PatchServiceManagerCalls() {
 103   static bool is_patched = false;
 104   if (is_patched)
 105     return;
 106   const char* service_provider_dll =
 107       (base::win::GetVersion() >= base::win::VERSION_WIN8
 108            ? "api-ms-win-service-management-l1-1-0.dll"
 109            : "advapi32.dll");
 110
 111   is_patched = true;
 112
 113   DWORD patched =
 114       g_iat_patch_open_sc_manager.Patch(L"dwrite.dll", service_provider_dll,
 115                                         "OpenSCManagerW", OpenSCManagerWPatch);
 116   DCHECK(patched == 0);
 117
 118   patched = g_iat_patch_close_service_handle.Patch(
 119       L"dwrite.dll", service_provider_dll, "CloseServiceHandle",
 120       CloseServiceHandlePatch);
 121   DCHECK(patched == 0);
 122
 123   patched = g_iat_patch_open_service.Patch(L"dwrite.dll", service_provider_dll,
 124                                            "OpenServiceW", OpenServiceWPatch);
 125   DCHECK(patched == 0);
 126
 127   patched = g_iat_patch_start_service.Patch(
 128       L"dwrite.dll", service_provider_dll, "StartServiceW", StartServiceWPatch);
 129   DCHECK(patched == 0);
 130
 131   patched = g_iat_patch_nt_connect_port.Patch(
 132       L"dwrite.dll", "ntdll.dll", "NtAlpcConnectPort", NtALpcConnectPortPatch);
 133   DCHECK(patched == 0);
 134 }
 135
 136 // Windows-only DirectWrite support. These warm up the DirectWrite paths
 137 // before sandbox lock down to allow Skia access to the Font Manager service.
 138 void CreateDirectWriteFactory(IDWriteFactory** factory) {
 139   typedef decltype(DWriteCreateFactory)* DWriteCreateFactoryProc;
 140   HMODULE dwrite_dll = LoadLibraryW(L"dwrite.dll");
 141   // TODO(scottmg): Temporary code to track crash in http://crbug.com/387867.
 142   if (!dwrite_dll) {
 143     DWORD load_library_get_last_error = GetLastError();
 144     base::debug::Alias(&dwrite_dll);
 145     base::debug::Alias(&load_library_get_last_error);
 146     CHECK(false);
 147   }
 148
 149   PatchServiceManagerCalls();
 150
 151   DWriteCreateFactoryProc dwrite_create_factory_proc =
 152       reinterpret_cast<DWriteCreateFactoryProc>(
 153           GetProcAddress(dwrite_dll, "DWriteCreateFactory"));
 154   // TODO(scottmg): Temporary code to track crash in http://crbug.com/387867.
 155   if (!dwrite_create_factory_proc) {
 156     DWORD get_proc_address_get_last_error = GetLastError();
 157     base::debug::Alias(&dwrite_create_factory_proc);
 158     base::debug::Alias(&get_proc_address_get_last_error);
 159     CHECK(false);
 160   }
 161   CHECK(SUCCEEDED(dwrite_create_factory_proc(
 162       DWRITE_FACTORY_TYPE_ISOLATED, __uuidof(IDWriteFactory),
 163       reinterpret_cast<IUnknown**>(factory))));
 164 }
 165
 166 HRESULT STDMETHODCALLTYPE StubFontCollection(IDWriteFactory* factory,
 167                                              IDWriteFontCollection** col,
 168                                              BOOL checkUpdates) {
 169   // We always return pre-created font collection from here.
 170   IDWriteFontCollection* custom_collection = GetCustomFontCollection(factory);
 171   DCHECK(custom_collection != nullptr);
 172   *col = custom_collection;
 173   return S_OK;
 174 }
 175
 176 void PatchDWriteFactory(IDWriteFactory* factory) {
 177   const unsigned int kGetSystemFontCollectionVTableIndex = 3;
 178
 179   PROC* vtable = *reinterpret_cast<PROC**>(factory);
 180   PROC* function_ptr = &vtable[kGetSystemFontCollectionVTableIndex];
 181   void* stub_function = &StubFontCollection;
 182   base::win::ModifyCode(function_ptr, &stub_function, sizeof(PROC));
 183 }
 184
 185 }  // namespace
 186
 187 void DoPreSandboxWarmupForTypeface(SkTypeface* typeface) {
 188   SkPaint paint_warmup;
 189   paint_warmup.setTypeface(typeface);
 190   wchar_t glyph = L'S';
 191   paint_warmup.measureText(&glyph, 2);
 192 }
 193
 194 SkFontMgr* GetPreSandboxWarmupFontMgr() {
 195   if (!g_warmup_fontmgr) {
 196     IDWriteFactory* factory;
 197     CreateDirectWriteFactory(&factory);
 198
 199     GetCustomFontCollection(factory);
 200
 201     PatchDWriteFactory(factory);
 202
 203     blink::WebFontRendering::setDirectWriteFactory(factory);
 204     g_warmup_fontmgr = SkFontMgr_New_DirectWrite(factory);
 205   }
 206   return g_warmup_fontmgr;
 207 }
 208
 209 }  // namespace content