1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
|
// Copyright (c) 2011 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "content/ppapi_plugin/ppapi_thread.h"
#include <limits>
#include "base/command_line.h"
#include "base/process_util.h"
#include "base/rand_util.h"
#include "base/stringprintf.h"
#include "content/common/child_process.h"
#include "content/common/content_switches.h"
#include "content/common/sandbox_init_wrapper.h"
#include "content/ppapi_plugin/broker_process_dispatcher.h"
#include "content/ppapi_plugin/plugin_process_dispatcher.h"
#include "content/ppapi_plugin/ppapi_webkit_thread.h"
#include "ipc/ipc_channel_handle.h"
#include "ipc/ipc_sync_channel.h"
#include "ppapi/c/pp_errors.h"
#include "ppapi/c/ppp.h"
#include "ppapi/proxy/ppapi_messages.h"
#include "webkit/plugins/ppapi/webkit_forwarding_impl.h"
#if defined(OS_WIN)
#include "sandbox/src/sandbox.h"
#endif
#if defined(OS_WIN)
extern sandbox::TargetServices* g_target_services;
#else
extern void* g_target_services;
#endif
typedef int32_t (*InitializeBrokerFunc)
(PP_ConnectInstance_Func* connect_instance_func);
PpapiThread::PpapiThread(bool is_broker)
: is_broker_(is_broker),
get_plugin_interface_(NULL),
connect_instance_func_(NULL),
local_pp_module_(
base::RandInt(0, std::numeric_limits<PP_Module>::max())) {
}
PpapiThread::~PpapiThread() {
if (!library_.is_valid())
return;
// The ShutdownModule/ShutdownBroker function is optional.
pp::proxy::ProxyChannel::ShutdownModuleFunc shutdown_function =
is_broker_ ?
reinterpret_cast<pp::proxy::ProxyChannel::ShutdownModuleFunc>(
library_.GetFunctionPointer("PPP_ShutdownBroker")) :
reinterpret_cast<pp::proxy::ProxyChannel::ShutdownModuleFunc>(
library_.GetFunctionPointer("PPP_ShutdownModule"));
if (shutdown_function)
shutdown_function();
}
// The "regular" ChildThread implements this function and does some standard
// dispatching, then uses the message router. We don't actually need any of
// this so this function just overrides that one.
//
// Note that this function is called only for messages from the channel to the
// browser process. Messages from the renderer process are sent via a different
// channel that ends up at Dispatcher::OnMessageReceived.
bool PpapiThread::OnMessageReceived(const IPC::Message& msg) {
IPC_BEGIN_MESSAGE_MAP(PpapiThread, msg)
IPC_MESSAGE_HANDLER(PpapiMsg_LoadPlugin, OnMsgLoadPlugin)
IPC_MESSAGE_HANDLER(PpapiMsg_CreateChannel, OnMsgCreateChannel)
IPC_END_MESSAGE_MAP()
return true;
}
base::MessageLoopProxy* PpapiThread::GetIPCMessageLoop() {
return ChildProcess::current()->io_message_loop_proxy();
}
base::WaitableEvent* PpapiThread::GetShutdownEvent() {
return ChildProcess::current()->GetShutDownEvent();
}
std::set<PP_Instance>* PpapiThread::GetGloballySeenInstanceIDSet() {
return &globally_seen_instance_ids_;
}
ppapi::WebKitForwarding* PpapiThread::GetWebKitForwarding() {
if (!webkit_forwarding_.get())
webkit_forwarding_.reset(new webkit::ppapi::WebKitForwardingImpl);
return webkit_forwarding_.get();
}
void PpapiThread::PostToWebKitThread(const tracked_objects::Location& from_here,
const base::Closure& task) {
if (!webkit_thread_.get())
webkit_thread_.reset(new PpapiWebKitThread);
webkit_thread_->PostTask(from_here, task);
}
bool PpapiThread::SendToBrowser(IPC::Message* msg) {
return Send(msg);
}
void PpapiThread::OnMsgLoadPlugin(const FilePath& path) {
base::ScopedNativeLibrary library(base::LoadNativeLibrary(path, NULL));
#if defined(OS_WIN)
// Once we lower the token the sandbox is locked down and no new modules
// can be loaded. TODO(cpu): consider changing to the loading style of
// regular plugins.
if (g_target_services)
g_target_services->LowerToken();
#endif
if (!library.is_valid()) {
LOG(ERROR) << "Failed to load pepper module";
return;
}
if (is_broker_) {
// Get the InitializeBroker function (required).
InitializeBrokerFunc init_broker =
reinterpret_cast<InitializeBrokerFunc>(
library.GetFunctionPointer("PPP_InitializeBroker"));
if (!init_broker) {
LOG(WARNING) << "No PPP_InitializeBroker in plugin library";
return;
}
int32_t init_error = init_broker(&connect_instance_func_);
if (init_error != PP_OK) {
LOG(WARNING) << "InitBroker failed with error " << init_error;
return;
}
if (!connect_instance_func_) {
LOG(WARNING) << "InitBroker did not provide PP_ConnectInstance_Func";
return;
}
} else {
// Get the GetInterface function (required).
get_plugin_interface_ =
reinterpret_cast<pp::proxy::Dispatcher::GetInterfaceFunc>(
library.GetFunctionPointer("PPP_GetInterface"));
if (!get_plugin_interface_) {
LOG(WARNING) << "No PPP_GetInterface in plugin library";
return;
}
#if defined(OS_MACOSX)
// We need to do this after getting |PPP_GetInterface()| (or presumably
// doing something nontrivial with the library), else the sandbox
// intercedes.
CommandLine* parsed_command_line = CommandLine::ForCurrentProcess();
SandboxInitWrapper sandbox_wrapper;
if (!sandbox_wrapper.InitializeSandbox(*parsed_command_line,
switches::kPpapiPluginProcess))
LOG(WARNING) << "Failed to initialize sandbox";
#endif
// Get the InitializeModule function (required).
pp::proxy::Dispatcher::InitModuleFunc init_module =
reinterpret_cast<pp::proxy::Dispatcher::InitModuleFunc>(
library.GetFunctionPointer("PPP_InitializeModule"));
if (!init_module) {
LOG(WARNING) << "No PPP_InitializeModule in plugin library";
return;
}
int32_t init_error = init_module(
local_pp_module_,
&pp::proxy::PluginDispatcher::GetInterfaceFromDispatcher);
if (init_error != PP_OK) {
LOG(WARNING) << "InitModule failed with error " << init_error;
return;
}
}
library_.Reset(library.Release());
}
void PpapiThread::OnMsgCreateChannel(base::ProcessHandle host_process_handle,
int renderer_id) {
IPC::ChannelHandle channel_handle;
if (!library_.is_valid() || // Plugin couldn't be loaded.
!SetupRendererChannel(host_process_handle, renderer_id,
&channel_handle)) {
Send(new PpapiHostMsg_ChannelCreated(IPC::ChannelHandle()));
return;
}
Send(new PpapiHostMsg_ChannelCreated(channel_handle));
}
bool PpapiThread::SetupRendererChannel(base::ProcessHandle host_process_handle,
int renderer_id,
IPC::ChannelHandle* handle) {
DCHECK(is_broker_ == (connect_instance_func_ != NULL));
DCHECK(is_broker_ == (get_plugin_interface_ == NULL));
IPC::ChannelHandle plugin_handle;
plugin_handle.name = StringPrintf("%d.r%d", base::GetCurrentProcId(),
renderer_id);
pp::proxy::ProxyChannel* dispatcher = NULL;
bool init_result = false;
if (is_broker_) {
BrokerProcessDispatcher* broker_dispatcher =
new BrokerProcessDispatcher(host_process_handle,
connect_instance_func_);
init_result = broker_dispatcher->InitBrokerWithChannel(this,
plugin_handle,
false);
dispatcher = broker_dispatcher;
} else {
PluginProcessDispatcher* plugin_dispatcher =
new PluginProcessDispatcher(host_process_handle, get_plugin_interface_);
init_result = plugin_dispatcher->InitPluginWithChannel(this,
plugin_handle,
false);
dispatcher = plugin_dispatcher;
}
if (!init_result) {
delete dispatcher;
return false;
}
handle->name = plugin_handle.name;
#if defined(OS_POSIX)
// On POSIX, pass the renderer-side FD.
handle->socket = base::FileDescriptor(::dup(dispatcher->GetRendererFD()),
true);
#endif
// From here, the dispatcher will manage its own lifetime according to the
// lifetime of the attached channel.
return true;
}
|
