src/components/nacl/browser/nacl_process_host.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "components/nacl/browser/nacl_process_host.h"
   6
   7 #include <algorithm>
   8 #include <string>
   9 #include <vector>
  10
  11 #include "base/base_switches.h"
  12 #include "base/bind.h"
  13 #include "base/command_line.h"
  14 #include "base/files/file_util.h"
  15 #include "base/message_loop/message_loop.h"
  16 #include "base/metrics/histogram.h"
  17 #include "base/path_service.h"
  18 #include "base/process/launch.h"
  19 #include "base/process/process_iterator.h"
  20 #include "base/rand_util.h"
  21 #include "base/strings/string_number_conversions.h"
  22 #include "base/strings/string_split.h"
  23 #include "base/strings/string_util.h"
  24 #include "base/strings/stringprintf.h"
  25 #include "base/strings/utf_string_conversions.h"
  26 #include "base/threading/sequenced_worker_pool.h"
  27 #include "base/win/windows_version.h"
  28 #include "build/build_config.h"
  29 #include "components/nacl/browser/nacl_browser.h"
  30 #include "components/nacl/browser/nacl_browser_delegate.h"
  31 #include "components/nacl/browser/nacl_host_message_filter.h"
  32 #include "components/nacl/common/nacl_cmd_line.h"
  33 #include "components/nacl/common/nacl_host_messages.h"
  34 #include "components/nacl/common/nacl_messages.h"
  35 #include "components/nacl/common/nacl_process_type.h"
  36 #include "components/nacl/common/nacl_switches.h"
  37 #include "content/public/browser/browser_child_process_host.h"
  38 #include "content/public/browser/browser_ppapi_host.h"
  39 #include "content/public/browser/child_process_data.h"
  40 #include "content/public/browser/plugin_service.h"
  41 #include "content/public/browser/render_process_host.h"
  42 #include "content/public/browser/web_contents.h"
  43 #include "content/public/common/child_process_host.h"
  44 #include "content/public/common/content_switches.h"
  45 #include "content/public/common/process_type.h"
  46 #include "content/public/common/sandboxed_process_launcher_delegate.h"
  47 #include "ipc/ipc_channel.h"
  48 #include "ipc/ipc_switches.h"
  49 #include "native_client/src/public/nacl_file_info.h"
  50 #include "native_client/src/shared/imc/nacl_imc_c.h"
  51 #include "net/base/net_util.h"
  52 #include "net/socket/tcp_listen_socket.h"
  53 #include "ppapi/host/host_factory.h"
  54 #include "ppapi/host/ppapi_host.h"
  55 #include "ppapi/proxy/ppapi_messages.h"
  56 #include "ppapi/shared_impl/ppapi_constants.h"
  57 #include "ppapi/shared_impl/ppapi_nacl_plugin_args.h"
  58
  59 #if defined(OS_POSIX)
  60
  61 #include <fcntl.h>
  62
  63 #include "ipc/ipc_channel_posix.h"
  64 #elif defined(OS_WIN)
  65 #include <windows.h>
  66
  67 #include "base/threading/thread.h"
  68 #include "base/win/scoped_handle.h"
  69 #include "components/nacl/browser/nacl_broker_service_win.h"
  70 #include "components/nacl/common/nacl_debug_exception_handler_win.h"
  71 #include "content/public/common/sandbox_init.h"
  72 #endif
  73
  74 using content::BrowserThread;
  75 using content::ChildProcessData;
  76 using content::ChildProcessHost;
  77 using ppapi::proxy::SerializedHandle;
  78
  79 namespace nacl {
  80
  81 #if defined(OS_WIN)
  82 namespace {
  83
  84 // Looks for the largest contiguous unallocated region of address
  85 // space and returns it via |*out_addr| and |*out_size|.
  86 void FindAddressSpace(base::ProcessHandle process,
  87                       char** out_addr, size_t* out_size) {
  88   *out_addr = NULL;
  89   *out_size = 0;
  90   char* addr = 0;
  91   while (true) {
  92     MEMORY_BASIC_INFORMATION info;
  93     size_t result = VirtualQueryEx(process, static_cast<void*>(addr),
  94                                    &info, sizeof(info));
  95     if (result < sizeof(info))
  96       break;
  97     if (info.State == MEM_FREE && info.RegionSize > *out_size) {
  98       *out_addr = addr;
  99       *out_size = info.RegionSize;
 100     }
 101     addr += info.RegionSize;
 102   }
 103 }
 104
 105 #ifdef _DLL
 106
 107 bool IsInPath(const std::string& path_env_var, const std::string& dir) {
 108   std::vector<std::string> split;
 109   base::SplitString(path_env_var, ';', &split);
 110   for (std::vector<std::string>::const_iterator i(split.begin());
 111        i != split.end();
 112        ++i) {
 113     if (*i == dir)
 114       return true;
 115   }
 116   return false;
 117 }
 118
 119 #endif  // _DLL
 120
 121 }  // namespace
 122
 123 // Allocates |size| bytes of address space in the given process at a
 124 // randomised address.
 125 void* AllocateAddressSpaceASLR(base::ProcessHandle process, size_t size) {
 126   char* addr;
 127   size_t avail_size;
 128   FindAddressSpace(process, &addr, &avail_size);
 129   if (avail_size < size)
 130     return NULL;
 131   size_t offset = base::RandGenerator(avail_size - size);
 132   const int kPageSize = 0x10000;
 133   void* request_addr =
 134       reinterpret_cast<void*>(reinterpret_cast<uint64>(addr + offset)
 135                               & ~(kPageSize - 1));
 136   return VirtualAllocEx(process, request_addr, size,
 137                         MEM_RESERVE, PAGE_NOACCESS);
 138 }
 139
 140 namespace {
 141
 142 bool RunningOnWOW64() {
 143   return (base::win::OSInfo::GetInstance()->wow64_status() ==
 144           base::win::OSInfo::WOW64_ENABLED);
 145 }
 146
 147 }  // namespace
 148
 149 #endif  // defined(OS_WIN)
 150
 151 namespace {
 152
 153 // NOTE: changes to this class need to be reviewed by the security team.
 154 class NaClSandboxedProcessLauncherDelegate
 155     : public content::SandboxedProcessLauncherDelegate {
 156  public:
 157   NaClSandboxedProcessLauncherDelegate(ChildProcessHost* host)
 158 #if defined(OS_POSIX)
 159       : ipc_fd_(host->TakeClientFileDescriptor())
 160 #endif
 161   {}
 162
 163   virtual ~NaClSandboxedProcessLauncherDelegate() {}
 164
 165 #if defined(OS_WIN)
 166   virtual void PostSpawnTarget(base::ProcessHandle process) {
 167     // For Native Client sel_ldr processes on 32-bit Windows, reserve 1 GB of
 168     // address space to prevent later failure due to address space fragmentation
 169     // from .dll loading. The NaCl process will attempt to locate this space by
 170     // scanning the address space using VirtualQuery.
 171     // TODO(bbudge) Handle the --no-sandbox case.
 172     // http://code.google.com/p/nativeclient/issues/detail?id=2131
 173     const SIZE_T kNaClSandboxSize = 1 << 30;
 174     if (!nacl::AllocateAddressSpaceASLR(process, kNaClSandboxSize)) {
 175       DLOG(WARNING) << "Failed to reserve address space for Native Client";
 176     }
 177   }
 178 #elif defined(OS_POSIX)
 179   virtual bool ShouldUseZygote() OVERRIDE {
 180     return true;
 181   }
 182   virtual int GetIpcFd() OVERRIDE {
 183     return ipc_fd_;
 184   }
 185 #endif  // OS_WIN
 186
 187  private:
 188 #if defined(OS_POSIX)
 189   int ipc_fd_;
 190 #endif  // OS_POSIX
 191 };
 192
 193 void SetCloseOnExec(NaClHandle fd) {
 194 #if defined(OS_POSIX)
 195   int flags = fcntl(fd, F_GETFD);
 196   CHECK_NE(flags, -1);
 197   int rc = fcntl(fd, F_SETFD, flags | FD_CLOEXEC);
 198   CHECK_EQ(rc, 0);
 199 #endif
 200 }
 201
 202 bool ShareHandleToSelLdr(
 203     base::ProcessHandle processh,
 204     NaClHandle sourceh,
 205     bool close_source,
 206     std::vector<nacl::FileDescriptor> *handles_for_sel_ldr) {
 207 #if defined(OS_WIN)
 208   HANDLE channel;
 209   int flags = DUPLICATE_SAME_ACCESS;
 210   if (close_source)
 211     flags |= DUPLICATE_CLOSE_SOURCE;
 212   if (!DuplicateHandle(GetCurrentProcess(),
 213                        reinterpret_cast<HANDLE>(sourceh),
 214                        processh,
 215                        &channel,
 216                        0,  // Unused given DUPLICATE_SAME_ACCESS.
 217                        FALSE,
 218                        flags)) {
 219     LOG(ERROR) << "DuplicateHandle() failed";
 220     return false;
 221   }
 222   handles_for_sel_ldr->push_back(
 223       reinterpret_cast<nacl::FileDescriptor>(channel));
 224 #else
 225   nacl::FileDescriptor channel;
 226   channel.fd = sourceh;
 227   channel.auto_close = close_source;
 228   handles_for_sel_ldr->push_back(channel);
 229 #endif
 230   return true;
 231 }
 232
 233 }  // namespace
 234
 235 unsigned NaClProcessHost::keepalive_throttle_interval_milliseconds_ =
 236     ppapi::kKeepaliveThrottleIntervalDefaultMilliseconds;
 237
 238 NaClProcessHost::NaClProcessHost(const GURL& manifest_url,
 239                                  base::File nexe_file,
 240                                  const NaClFileToken& nexe_token,
 241                                  ppapi::PpapiPermissions permissions,
 242                                  int render_view_id,
 243                                  uint32 permission_bits,
 244                                  bool uses_irt,
 245                                  bool uses_nonsfi_mode,
 246                                  bool enable_dyncode_syscalls,
 247                                  bool enable_exception_handling,
 248                                  bool enable_crash_throttling,
 249                                  bool off_the_record,
 250                                  const base::FilePath& profile_directory)
 251     : manifest_url_(manifest_url),
 252       nexe_file_(nexe_file.Pass()),
 253       nexe_token_(nexe_token),
 254       permissions_(permissions),
 255 #if defined(OS_WIN)
 256       process_launched_by_broker_(false),
 257 #endif
 258       reply_msg_(NULL),
 259 #if defined(OS_WIN)
 260       debug_exception_handler_requested_(false),
 261 #endif
 262       uses_irt_(uses_irt),
 263       uses_nonsfi_mode_(uses_nonsfi_mode),
 264       enable_debug_stub_(false),
 265       enable_dyncode_syscalls_(enable_dyncode_syscalls),
 266       enable_exception_handling_(enable_exception_handling),
 267       enable_crash_throttling_(enable_crash_throttling),
 268       off_the_record_(off_the_record),
 269       profile_directory_(profile_directory),
 270       render_view_id_(render_view_id),
 271       weak_factory_(this) {
 272   process_.reset(content::BrowserChildProcessHost::Create(
 273       PROCESS_TYPE_NACL_LOADER, this));
 274
 275   // Set the display name so the user knows what plugin the process is running.
 276   // We aren't on the UI thread so getting the pref locale for language
 277   // formatting isn't possible, so IDN will be lost, but this is probably OK
 278   // for this use case.
 279   process_->SetName(net::FormatUrl(manifest_url_, std::string()));
 280
 281   enable_debug_stub_ = CommandLine::ForCurrentProcess()->HasSwitch(
 282       switches::kEnableNaClDebug);
 283 }
 284
 285 NaClProcessHost::~NaClProcessHost() {
 286   // Report exit status only if the process was successfully started.
 287   if (process_->GetData().handle != base::kNullProcessHandle) {
 288     int exit_code = 0;
 289     process_->GetTerminationStatus(false /* known_dead */, &exit_code);
 290     std::string message =
 291         base::StringPrintf("NaCl process exited with status %i (0x%x)",
 292                            exit_code, exit_code);
 293     if (exit_code == 0) {
 294       VLOG(1) << message;
 295     } else {
 296       LOG(ERROR) << message;
 297     }
 298     NaClBrowser::GetInstance()->OnProcessEnd(process_->GetData().id);
 299   }
 300
 301   if (reply_msg_) {
 302     // The process failed to launch for some reason.
 303     // Don't keep the renderer hanging.
 304     reply_msg_->set_reply_error();
 305     nacl_host_message_filter_->Send(reply_msg_);
 306   }
 307 #if defined(OS_WIN)
 308   if (process_launched_by_broker_) {
 309     NaClBrokerService::GetInstance()->OnLoaderDied();
 310   }
 311 #endif
 312 }
 313
 314 void NaClProcessHost::OnProcessCrashed(int exit_status) {
 315   if (enable_crash_throttling_ &&
 316       !CommandLine::ForCurrentProcess()->HasSwitch(
 317           switches::kDisablePnaclCrashThrottling)) {
 318     NaClBrowser::GetInstance()->OnProcessCrashed();
 319   }
 320 }
 321
 322 // This is called at browser startup.
 323 // static
 324 void NaClProcessHost::EarlyStartup() {
 325   NaClBrowser::GetInstance()->EarlyStartup();
 326   // Inform NaClBrowser that we exist and will have a debug port at some point.
 327 #if defined(OS_LINUX) && !defined(OS_CHROMEOS)
 328   // Open the IRT file early to make sure that it isn't replaced out from
 329   // under us by autoupdate.
 330   NaClBrowser::GetInstance()->EnsureIrtAvailable();
 331 #endif
 332   CommandLine* cmd = CommandLine::ForCurrentProcess();
 333   UMA_HISTOGRAM_BOOLEAN(
 334       "NaCl.nacl-gdb",
 335       !cmd->GetSwitchValuePath(switches::kNaClGdb).empty());
 336   UMA_HISTOGRAM_BOOLEAN(
 337       "NaCl.nacl-gdb-script",
 338       !cmd->GetSwitchValuePath(switches::kNaClGdbScript).empty());
 339   UMA_HISTOGRAM_BOOLEAN(
 340       "NaCl.enable-nacl-debug",
 341       cmd->HasSwitch(switches::kEnableNaClDebug));
 342   std::string nacl_debug_mask =
 343       cmd->GetSwitchValueASCII(switches::kNaClDebugMask);
 344   // By default, exclude debugging SSH and the PNaCl translator.
 345   // about::flags only allows empty flags as the default, so replace
 346   // the empty setting with the default. To debug all apps, use a wild-card.
 347   if (nacl_debug_mask.empty()) {
 348     nacl_debug_mask = "!*://*/*ssh_client.nmf,chrome://pnacl-translator/*";
 349   }
 350   NaClBrowser::GetDelegate()->SetDebugPatterns(nacl_debug_mask);
 351 }
 352
 353 // static
 354 void NaClProcessHost::SetPpapiKeepAliveThrottleForTesting(
 355     unsigned milliseconds) {
 356   keepalive_throttle_interval_milliseconds_ = milliseconds;
 357 }
 358
 359 void NaClProcessHost::Launch(
 360     NaClHostMessageFilter* nacl_host_message_filter,
 361     IPC::Message* reply_msg,
 362     const base::FilePath& manifest_path) {
 363   nacl_host_message_filter_ = nacl_host_message_filter;
 364   reply_msg_ = reply_msg;
 365   manifest_path_ = manifest_path;
 366
 367   // Do not launch the requested NaCl module if NaCl is marked "unstable" due
 368   // to too many crashes within a given time period.
 369   if (enable_crash_throttling_ &&
 370       !CommandLine::ForCurrentProcess()->HasSwitch(
 371           switches::kDisablePnaclCrashThrottling) &&
 372       NaClBrowser::GetInstance()->IsThrottled()) {
 373     SendErrorToRenderer("Process creation was throttled due to excessive"
 374                         " crashes");
 375     delete this;
 376     return;
 377   }
 378
 379   const CommandLine* cmd = CommandLine::ForCurrentProcess();
 380 #if defined(OS_WIN)
 381   if (cmd->HasSwitch(switches::kEnableNaClDebug) &&
 382       !cmd->HasSwitch(switches::kNoSandbox)) {
 383     // We don't switch off sandbox automatically for security reasons.
 384     SendErrorToRenderer("NaCl's GDB debug stub requires --no-sandbox flag"
 385                         " on Windows. See crbug.com/265624.");
 386     delete this;
 387     return;
 388   }
 389 #endif
 390   if (cmd->HasSwitch(switches::kNaClGdb) &&
 391       !cmd->HasSwitch(switches::kEnableNaClDebug)) {
 392     LOG(WARNING) << "--nacl-gdb flag requires --enable-nacl-debug flag";
 393   }
 394
 395   // Start getting the IRT open asynchronously while we launch the NaCl process.
 396   // We'll make sure this actually finished in StartWithLaunchedProcess, below.
 397   NaClBrowser* nacl_browser = NaClBrowser::GetInstance();
 398   nacl_browser->EnsureAllResourcesAvailable();
 399   if (!nacl_browser->IsOk()) {
 400     SendErrorToRenderer("could not find all the resources needed"
 401                         " to launch the process");
 402     delete this;
 403     return;
 404   }
 405
 406   if (uses_nonsfi_mode_) {
 407     bool nonsfi_mode_forced_by_command_line = false;
 408     bool nonsfi_mode_allowed = false;
 409 #if defined(OS_LINUX)
 410     nonsfi_mode_forced_by_command_line =
 411         cmd->HasSwitch(switches::kEnableNaClNonSfiMode);
 412 #if defined(OS_CHROMEOS) && defined(ARCH_CPU_ARMEL)
 413     nonsfi_mode_allowed = NaClBrowser::GetDelegate()->IsNonSfiModeAllowed(
 414         nacl_host_message_filter->profile_directory(), manifest_url_);
 415 #endif
 416 #endif
 417     bool nonsfi_mode_enabled =
 418         nonsfi_mode_forced_by_command_line || nonsfi_mode_allowed;
 419
 420     if (!nonsfi_mode_enabled) {
 421       SendErrorToRenderer(
 422           "NaCl non-SFI mode is not available for this platform"
 423           " and NaCl module.");
 424       delete this;
 425       return;
 426     }
 427   } else {
 428     // Rather than creating a socket pair in the renderer, and passing
 429     // one side through the browser to sel_ldr, socket pairs are created
 430     // in the browser and then passed to the renderer and sel_ldr.
 431     //
 432     // This is mainly for the benefit of Windows, where sockets cannot
 433     // be passed in messages, but are copied via DuplicateHandle().
 434     // This means the sandboxed renderer cannot send handles to the
 435     // browser process.
 436
 437     NaClHandle pair[2];
 438     // Create a connected socket
 439     if (NaClSocketPair(pair) == -1) {
 440       SendErrorToRenderer("NaClSocketPair() failed");
 441       delete this;
 442       return;
 443     }
 444     socket_for_renderer_ = base::File(pair[0]);
 445     socket_for_sel_ldr_ = base::File(pair[1]);
 446     SetCloseOnExec(pair[0]);
 447     SetCloseOnExec(pair[1]);
 448   }
 449
 450   // Create a shared memory region that the renderer and plugin share for
 451   // reporting crash information.
 452   crash_info_shmem_.CreateAnonymous(kNaClCrashInfoShmemSize);
 453
 454   // Launch the process
 455   if (!LaunchSelLdr()) {
 456     delete this;
 457   }
 458 }
 459
 460 void NaClProcessHost::OnChannelConnected(int32 peer_pid) {
 461   if (!CommandLine::ForCurrentProcess()->GetSwitchValuePath(
 462           switches::kNaClGdb).empty()) {
 463     LaunchNaClGdb();
 464   }
 465 }
 466
 467 #if defined(OS_WIN)
 468 void NaClProcessHost::OnProcessLaunchedByBroker(base::ProcessHandle handle) {
 469   process_launched_by_broker_ = true;
 470   process_->SetHandle(handle);
 471   SetDebugStubPort(nacl::kGdbDebugStubPortUnknown);
 472   if (!StartWithLaunchedProcess())
 473     delete this;
 474 }
 475
 476 void NaClProcessHost::OnDebugExceptionHandlerLaunchedByBroker(bool success) {
 477   IPC::Message* reply = attach_debug_exception_handler_reply_msg_.release();
 478   NaClProcessMsg_AttachDebugExceptionHandler::WriteReplyParams(reply, success);
 479   Send(reply);
 480 }
 481 #endif
 482
 483 // Needed to handle sync messages in OnMessageReceived.
 484 bool NaClProcessHost::Send(IPC::Message* msg) {
 485   return process_->Send(msg);
 486 }
 487
 488 bool NaClProcessHost::LaunchNaClGdb() {
 489 #if defined(OS_WIN)
 490   base::FilePath nacl_gdb =
 491       CommandLine::ForCurrentProcess()->GetSwitchValuePath(switches::kNaClGdb);
 492   CommandLine cmd_line(nacl_gdb);
 493 #else
 494   CommandLine::StringType nacl_gdb =
 495       CommandLine::ForCurrentProcess()->GetSwitchValueNative(
 496           switches::kNaClGdb);
 497   CommandLine::StringVector argv;
 498   // We don't support spaces inside arguments in --nacl-gdb switch.
 499   base::SplitString(nacl_gdb, static_cast<CommandLine::CharType>(' '), &argv);
 500   CommandLine cmd_line(argv);
 501 #endif
 502   cmd_line.AppendArg("--eval-command");
 503   base::FilePath::StringType irt_path(
 504       NaClBrowser::GetInstance()->GetIrtFilePath().value());
 505   // Avoid back slashes because nacl-gdb uses posix escaping rules on Windows.
 506   // See issue https://code.google.com/p/nativeclient/issues/detail?id=3482.
 507   std::replace(irt_path.begin(), irt_path.end(), '\\', '/');
 508   cmd_line.AppendArgNative(FILE_PATH_LITERAL("nacl-irt \"") + irt_path +
 509                            FILE_PATH_LITERAL("\""));
 510   if (!manifest_path_.empty()) {
 511     cmd_line.AppendArg("--eval-command");
 512     base::FilePath::StringType manifest_path_value(manifest_path_.value());
 513     std::replace(manifest_path_value.begin(), manifest_path_value.end(),
 514                  '\\', '/');
 515     cmd_line.AppendArgNative(FILE_PATH_LITERAL("nacl-manifest \"") +
 516                              manifest_path_value + FILE_PATH_LITERAL("\""));
 517   }
 518   cmd_line.AppendArg("--eval-command");
 519   cmd_line.AppendArg("target remote :4014");
 520   base::FilePath script = CommandLine::ForCurrentProcess()->GetSwitchValuePath(
 521       switches::kNaClGdbScript);
 522   if (!script.empty()) {
 523     cmd_line.AppendArg("--command");
 524     cmd_line.AppendArgNative(script.value());
 525   }
 526   return base::LaunchProcess(cmd_line, base::LaunchOptions(), NULL);
 527 }
 528
 529 bool NaClProcessHost::LaunchSelLdr() {
 530   std::string channel_id = process_->GetHost()->CreateChannel();
 531   if (channel_id.empty()) {
 532     SendErrorToRenderer("CreateChannel() failed");
 533     return false;
 534   }
 535
 536   // Build command line for nacl.
 537
 538 #if defined(OS_MACOSX)
 539   // The Native Client process needs to be able to allocate a 1GB contiguous
 540   // region to use as the client environment's virtual address space. ASLR
 541   // (PIE) interferes with this by making it possible that no gap large enough
 542   // to accomodate this request will exist in the child process' address
 543   // space. Disable PIE for NaCl processes. See http://crbug.com/90221 and
 544   // http://code.google.com/p/nativeclient/issues/detail?id=2043.
 545   int flags = ChildProcessHost::CHILD_NO_PIE;
 546 #elif defined(OS_LINUX)
 547   int flags = ChildProcessHost::CHILD_ALLOW_SELF;
 548 #else
 549   int flags = ChildProcessHost::CHILD_NORMAL;
 550 #endif
 551
 552   base::FilePath exe_path = ChildProcessHost::GetChildPath(flags);
 553   if (exe_path.empty())
 554     return false;
 555
 556 #if defined(OS_WIN)
 557   // On Windows 64-bit NaCl loader is called nacl64.exe instead of chrome.exe
 558   if (RunningOnWOW64()) {
 559     if (!NaClBrowser::GetInstance()->GetNaCl64ExePath(&exe_path)) {
 560       SendErrorToRenderer("could not get path to nacl64.exe");
 561       return false;
 562     }
 563
 564 #ifdef _DLL
 565     // When using the DLL CRT on Windows, we need to amend the PATH to include
 566     // the location of the x64 CRT DLLs. This is only the case when using a
 567     // component=shared_library build (i.e. generally dev debug builds). The
 568     // x86 CRT DLLs are in e.g. out\Debug for chrome.exe etc., so the x64 ones
 569     // are put in out\Debug\x64 which we add to the PATH here so that loader
 570     // can find them. See http://crbug.com/346034.
 571     scoped_ptr<base::Environment> env(base::Environment::Create());
 572     static const char kPath[] = "PATH";
 573     std::string old_path;
 574     base::FilePath module_path;
 575     if (!PathService::Get(base::FILE_MODULE, &module_path)) {
 576       SendErrorToRenderer("could not get path to current module");
 577       return false;
 578     }
 579     std::string x64_crt_path =
 580         base::WideToUTF8(module_path.DirName().Append(L"x64").value());
 581     if (!env->GetVar(kPath, &old_path)) {
 582       env->SetVar(kPath, x64_crt_path);
 583     } else if (!IsInPath(old_path, x64_crt_path)) {
 584       std::string new_path(old_path);
 585       new_path.append(";");
 586       new_path.append(x64_crt_path);
 587       env->SetVar(kPath, new_path);
 588     }
 589 #endif  // _DLL
 590   }
 591 #endif
 592
 593   scoped_ptr<CommandLine> cmd_line(new CommandLine(exe_path));
 594   CopyNaClCommandLineArguments(cmd_line.get());
 595
 596   cmd_line->AppendSwitchASCII(switches::kProcessType,
 597                               (uses_nonsfi_mode_ ?
 598                                switches::kNaClLoaderNonSfiProcess :
 599                                switches::kNaClLoaderProcess));
 600   cmd_line->AppendSwitchASCII(switches::kProcessChannelID, channel_id);
 601   if (NaClBrowser::GetDelegate()->DialogsAreSuppressed())
 602     cmd_line->AppendSwitch(switches::kNoErrorDialogs);
 603
 604   // On Windows we might need to start the broker process to launch a new loader
 605 #if defined(OS_WIN)
 606   if (RunningOnWOW64()) {
 607     if (!NaClBrokerService::GetInstance()->LaunchLoader(
 608             weak_factory_.GetWeakPtr(), channel_id)) {
 609       SendErrorToRenderer("broker service did not launch process");
 610       return false;
 611     }
 612     return true;
 613   }
 614 #endif
 615   process_->Launch(
 616       new NaClSandboxedProcessLauncherDelegate(process_->GetHost()),
 617       cmd_line.release());
 618   return true;
 619 }
 620
 621 bool NaClProcessHost::OnMessageReceived(const IPC::Message& msg) {
 622   bool handled = true;
 623   if (uses_nonsfi_mode_) {
 624     // IPC messages relating to NaCl's validation cache must not be exposed
 625     // in Non-SFI Mode, otherwise a Non-SFI nexe could use
 626     // SetKnownToValidate to create a hole in the SFI sandbox.
 627     IPC_BEGIN_MESSAGE_MAP(NaClProcessHost, msg)
 628       IPC_MESSAGE_HANDLER(NaClProcessHostMsg_PpapiChannelsCreated,
 629                           OnPpapiChannelsCreated)
 630       IPC_MESSAGE_UNHANDLED(handled = false)
 631     IPC_END_MESSAGE_MAP()
 632   } else {
 633     IPC_BEGIN_MESSAGE_MAP(NaClProcessHost, msg)
 634       IPC_MESSAGE_HANDLER(NaClProcessMsg_QueryKnownToValidate,
 635                           OnQueryKnownToValidate)
 636       IPC_MESSAGE_HANDLER(NaClProcessMsg_SetKnownToValidate,
 637                           OnSetKnownToValidate)
 638       IPC_MESSAGE_HANDLER_DELAY_REPLY(NaClProcessMsg_ResolveFileToken,
 639                                       OnResolveFileToken)
 640       IPC_MESSAGE_HANDLER(NaClProcessMsg_ResolveFileTokenAsync,
 641                           OnResolveFileTokenAsync)
 642
 643 #if defined(OS_WIN)
 644       IPC_MESSAGE_HANDLER_DELAY_REPLY(
 645           NaClProcessMsg_AttachDebugExceptionHandler,
 646           OnAttachDebugExceptionHandler)
 647       IPC_MESSAGE_HANDLER(NaClProcessHostMsg_DebugStubPortSelected,
 648                           OnDebugStubPortSelected)
 649 #endif
 650       IPC_MESSAGE_HANDLER(NaClProcessHostMsg_PpapiChannelsCreated,
 651                           OnPpapiChannelsCreated)
 652       IPC_MESSAGE_UNHANDLED(handled = false)
 653     IPC_END_MESSAGE_MAP()
 654   }
 655   return handled;
 656 }
 657
 658 void NaClProcessHost::OnProcessLaunched() {
 659   if (!StartWithLaunchedProcess())
 660     delete this;
 661 }
 662
 663 // Called when the NaClBrowser singleton has been fully initialized.
 664 void NaClProcessHost::OnResourcesReady() {
 665   NaClBrowser* nacl_browser = NaClBrowser::GetInstance();
 666   if (!nacl_browser->IsReady()) {
 667     SendErrorToRenderer("could not acquire shared resources needed by NaCl");
 668     delete this;
 669   } else if (!StartNaClExecution()) {
 670     delete this;
 671   }
 672 }
 673
 674 bool NaClProcessHost::ReplyToRenderer(
 675     const IPC::ChannelHandle& ppapi_channel_handle,
 676     const IPC::ChannelHandle& trusted_channel_handle,
 677     const IPC::ChannelHandle& manifest_service_channel_handle) {
 678 #if defined(OS_WIN)
 679   // If we are on 64-bit Windows, the NaCl process's sandbox is
 680   // managed by a different process from the renderer's sandbox.  We
 681   // need to inform the renderer's sandbox about the NaCl process so
 682   // that the renderer can send handles to the NaCl process using
 683   // BrokerDuplicateHandle().
 684   if (RunningOnWOW64()) {
 685     if (!content::BrokerAddTargetPeer(process_->GetData().handle)) {
 686       SendErrorToRenderer("BrokerAddTargetPeer() failed");
 687       return false;
 688     }
 689   }
 690 #endif
 691
 692   FileDescriptor imc_handle_for_renderer;
 693 #if defined(OS_WIN)
 694   // Copy the handle into the renderer process.
 695   HANDLE handle_in_renderer;
 696   if (!DuplicateHandle(base::GetCurrentProcessHandle(),
 697                        socket_for_renderer_.TakePlatformFile(),
 698                        nacl_host_message_filter_->PeerHandle(),
 699                        &handle_in_renderer,
 700                        0,  // Unused given DUPLICATE_SAME_ACCESS.
 701                        FALSE,
 702                        DUPLICATE_CLOSE_SOURCE | DUPLICATE_SAME_ACCESS)) {
 703     SendErrorToRenderer("DuplicateHandle() failed");
 704     return false;
 705   }
 706   imc_handle_for_renderer = reinterpret_cast<FileDescriptor>(
 707       handle_in_renderer);
 708 #else
 709   // No need to dup the imc_handle - we don't pass it anywhere else so
 710   // it cannot be closed.
 711   FileDescriptor imc_handle;
 712   imc_handle.fd = socket_for_renderer_.TakePlatformFile();
 713   imc_handle.auto_close = true;
 714   imc_handle_for_renderer = imc_handle;
 715 #endif
 716
 717   const ChildProcessData& data = process_->GetData();
 718   base::SharedMemoryHandle crash_info_shmem_renderer_handle;
 719   if (!crash_info_shmem_.ShareToProcess(nacl_host_message_filter_->PeerHandle(),
 720                                         &crash_info_shmem_renderer_handle)) {
 721     SendErrorToRenderer("ShareToProcess() failed");
 722     return false;
 723   }
 724
 725   SendMessageToRenderer(
 726       NaClLaunchResult(imc_handle_for_renderer,
 727                        ppapi_channel_handle,
 728                        trusted_channel_handle,
 729                        manifest_service_channel_handle,
 730                        base::GetProcId(data.handle),
 731                        data.id,
 732                        crash_info_shmem_renderer_handle),
 733       std::string() /* error_message */);
 734
 735   // Now that the crash information shmem handles have been shared with the
 736   // plugin and the renderer, the browser can close its handle.
 737   crash_info_shmem_.Close();
 738   return true;
 739 }
 740
 741 void NaClProcessHost::SendErrorToRenderer(const std::string& error_message) {
 742   LOG(ERROR) << "NaCl process launch failed: " << error_message;
 743   SendMessageToRenderer(NaClLaunchResult(), error_message);
 744 }
 745
 746 void NaClProcessHost::SendMessageToRenderer(
 747     const NaClLaunchResult& result,
 748     const std::string& error_message) {
 749   DCHECK(nacl_host_message_filter_.get());
 750   DCHECK(reply_msg_);
 751   if (nacl_host_message_filter_.get() != NULL && reply_msg_ != NULL) {
 752     NaClHostMsg_LaunchNaCl::WriteReplyParams(
 753         reply_msg_, result, error_message);
 754     nacl_host_message_filter_->Send(reply_msg_);
 755     nacl_host_message_filter_ = NULL;
 756     reply_msg_ = NULL;
 757   }
 758 }
 759
 760 void NaClProcessHost::SetDebugStubPort(int port) {
 761   NaClBrowser* nacl_browser = NaClBrowser::GetInstance();
 762   nacl_browser->SetProcessGdbDebugStubPort(process_->GetData().id, port);
 763 }
 764
 765 #if defined(OS_POSIX)
 766 // TCP port we chose for NaCl debug stub. It can be any other number.
 767 static const int kInitialDebugStubPort = 4014;
 768
 769 net::SocketDescriptor NaClProcessHost::GetDebugStubSocketHandle() {
 770   net::SocketDescriptor s = net::kInvalidSocket;
 771   // We always try to allocate the default port first. If this fails, we then
 772   // allocate any available port.
 773   // On success, if the test system has register a handler
 774   // (GdbDebugStubPortListener), we fire a notification.
 775   int port = kInitialDebugStubPort;
 776   s = net::TCPListenSocket::CreateAndBind("127.0.0.1", port);
 777   if (s == net::kInvalidSocket) {
 778     s = net::TCPListenSocket::CreateAndBindAnyPort("127.0.0.1", &port);
 779   }
 780   if (s != net::kInvalidSocket) {
 781     SetDebugStubPort(port);
 782   }
 783   if (s == net::kInvalidSocket) {
 784     LOG(ERROR) << "failed to open socket for debug stub";
 785     return net::kInvalidSocket;
 786   } else {
 787     LOG(WARNING) << "debug stub on port " << port;
 788   }
 789   if (listen(s, 1)) {
 790     LOG(ERROR) << "listen() failed on debug stub socket";
 791     if (IGNORE_EINTR(close(s)) < 0)
 792       PLOG(ERROR) << "failed to close debug stub socket";
 793     return net::kInvalidSocket;
 794   }
 795   return s;
 796 }
 797 #endif
 798
 799 #if defined(OS_WIN)
 800 void NaClProcessHost::OnDebugStubPortSelected(uint16_t debug_stub_port) {
 801   CHECK(!uses_nonsfi_mode_);
 802   SetDebugStubPort(debug_stub_port);
 803 }
 804 #endif
 805
 806 bool NaClProcessHost::StartNaClExecution() {
 807   NaClBrowser* nacl_browser = NaClBrowser::GetInstance();
 808
 809   NaClStartParams params;
 810
 811   // Enable PPAPI proxy channel creation only for renderer processes.
 812   params.enable_ipc_proxy = enable_ppapi_proxy();
 813   if (uses_nonsfi_mode_) {
 814     // Currently, non-SFI mode is supported only on Linux.
 815 #if defined(OS_LINUX)
 816     // In non-SFI mode, we do not use SRPC. Make sure that the socketpair is
 817     // not created.
 818     DCHECK(!socket_for_sel_ldr_.IsValid());
 819 #endif
 820   } else {
 821     params.validation_cache_enabled = nacl_browser->ValidationCacheIsEnabled();
 822     params.validation_cache_key = nacl_browser->GetValidationCacheKey();
 823     params.version = NaClBrowser::GetDelegate()->GetVersionString();
 824     params.enable_exception_handling = enable_exception_handling_;
 825     params.enable_debug_stub = enable_debug_stub_ &&
 826         NaClBrowser::GetDelegate()->URLMatchesDebugPatterns(manifest_url_);
 827     params.uses_irt = uses_irt_;
 828     params.enable_dyncode_syscalls = enable_dyncode_syscalls_;
 829
 830     // TODO(teravest): Resolve the file tokens right now instead of making the
 831     // loader send IPC to resolve them later.
 832     params.nexe_token_lo = nexe_token_.lo;
 833     params.nexe_token_hi = nexe_token_.hi;
 834
 835     const ChildProcessData& data = process_->GetData();
 836     if (!ShareHandleToSelLdr(data.handle,
 837                              socket_for_sel_ldr_.TakePlatformFile(),
 838                              true,
 839                              &params.handles)) {
 840       return false;
 841     }
 842
 843     if (params.uses_irt) {
 844       const base::File& irt_file = nacl_browser->IrtFile();
 845       CHECK(irt_file.IsValid());
 846       // Send over the IRT file handle.  We don't close our own copy!
 847       if (!ShareHandleToSelLdr(data.handle, irt_file.GetPlatformFile(), false,
 848                                &params.handles)) {
 849         return false;
 850       }
 851     }
 852
 853 #if defined(OS_MACOSX)
 854     // For dynamic loading support, NaCl requires a file descriptor that
 855     // was created in /tmp, since those created with shm_open() are not
 856     // mappable with PROT_EXEC.  Rather than requiring an extra IPC
 857     // round trip out of the sandbox, we create an FD here.
 858     base::SharedMemory memory_buffer;
 859     base::SharedMemoryCreateOptions options;
 860     options.size = 1;
 861     options.executable = true;
 862     if (!memory_buffer.Create(options)) {
 863       DLOG(ERROR) << "Failed to allocate memory buffer";
 864       return false;
 865     }
 866     FileDescriptor memory_fd;
 867     memory_fd.fd = dup(memory_buffer.handle().fd);
 868     if (memory_fd.fd < 0) {
 869       DLOG(ERROR) << "Failed to dup() a file descriptor";
 870       return false;
 871     }
 872     memory_fd.auto_close = true;
 873     params.handles.push_back(memory_fd);
 874 #endif
 875
 876 #if defined(OS_POSIX)
 877     if (params.enable_debug_stub) {
 878       net::SocketDescriptor server_bound_socket = GetDebugStubSocketHandle();
 879       if (server_bound_socket != net::kInvalidSocket) {
 880         params.debug_stub_server_bound_socket =
 881             FileDescriptor(server_bound_socket, true);
 882       }
 883     }
 884 #endif
 885   }
 886
 887   params.nexe_file = IPC::TakeFileHandleForProcess(nexe_file_.Pass(),
 888                                                    process_->GetData().handle);
 889   if (!crash_info_shmem_.ShareToProcess(process_->GetData().handle,
 890                                         &params.crash_info_shmem_handle)) {
 891     DLOG(ERROR) << "Failed to ShareToProcess() a shared memory buffer";
 892     return false;
 893   }
 894
 895   process_->Send(new NaClProcessMsg_Start(params));
 896   return true;
 897 }
 898
 899 // This method is called when NaClProcessHostMsg_PpapiChannelCreated is
 900 // received.
 901 void NaClProcessHost::OnPpapiChannelsCreated(
 902     const IPC::ChannelHandle& browser_channel_handle,
 903     const IPC::ChannelHandle& ppapi_renderer_channel_handle,
 904     const IPC::ChannelHandle& trusted_renderer_channel_handle,
 905     const IPC::ChannelHandle& manifest_service_channel_handle) {
 906   if (!enable_ppapi_proxy()) {
 907     ReplyToRenderer(IPC::ChannelHandle(),
 908                     trusted_renderer_channel_handle,
 909                     manifest_service_channel_handle);
 910     return;
 911   }
 912
 913   if (!ipc_proxy_channel_.get()) {
 914     DCHECK_EQ(PROCESS_TYPE_NACL_LOADER, process_->GetData().process_type);
 915
 916     ipc_proxy_channel_ =
 917         IPC::ChannelProxy::Create(browser_channel_handle,
 918                                   IPC::Channel::MODE_CLIENT,
 919                                   NULL,
 920                                   base::MessageLoopProxy::current().get());
 921     // Create the browser ppapi host and enable PPAPI message dispatching to the
 922     // browser process.
 923     ppapi_host_.reset(content::BrowserPpapiHost::CreateExternalPluginProcess(
 924         ipc_proxy_channel_.get(),  // sender
 925         permissions_,
 926         process_->GetData().handle,
 927         ipc_proxy_channel_.get(),
 928         nacl_host_message_filter_->render_process_id(),
 929         render_view_id_,
 930         profile_directory_));
 931     ppapi_host_->SetOnKeepaliveCallback(
 932         NaClBrowser::GetDelegate()->GetOnKeepaliveCallback());
 933
 934     ppapi::PpapiNaClPluginArgs args;
 935     args.off_the_record = nacl_host_message_filter_->off_the_record();
 936     args.permissions = permissions_;
 937     args.keepalive_throttle_interval_milliseconds =
 938         keepalive_throttle_interval_milliseconds_;
 939     CommandLine* cmdline = CommandLine::ForCurrentProcess();
 940     DCHECK(cmdline);
 941     std::string flag_whitelist[] = {
 942       switches::kV,
 943       switches::kVModule,
 944     };
 945     for (size_t i = 0; i < arraysize(flag_whitelist); ++i) {
 946       std::string value = cmdline->GetSwitchValueASCII(flag_whitelist[i]);
 947       if (!value.empty()) {
 948         args.switch_names.push_back(flag_whitelist[i]);
 949         args.switch_values.push_back(value);
 950       }
 951     }
 952
 953     ppapi_host_->GetPpapiHost()->AddHostFactoryFilter(
 954         scoped_ptr<ppapi::host::HostFactory>(
 955             NaClBrowser::GetDelegate()->CreatePpapiHostFactory(
 956                 ppapi_host_.get())));
 957
 958     // Send a message to initialize the IPC dispatchers in the NaCl plugin.
 959     ipc_proxy_channel_->Send(new PpapiMsg_InitializeNaClDispatcher(args));
 960
 961     // Let the renderer know that the IPC channels are established.
 962     ReplyToRenderer(ppapi_renderer_channel_handle,
 963                     trusted_renderer_channel_handle,
 964                     manifest_service_channel_handle);
 965   } else {
 966     // Attempt to open more than 1 browser channel is not supported.
 967     // Shut down the NaCl process.
 968     process_->GetHost()->ForceShutdown();
 969   }
 970 }
 971
 972 bool NaClProcessHost::StartWithLaunchedProcess() {
 973   NaClBrowser* nacl_browser = NaClBrowser::GetInstance();
 974
 975   if (nacl_browser->IsReady()) {
 976     return StartNaClExecution();
 977   } else if (nacl_browser->IsOk()) {
 978     nacl_browser->WaitForResources(
 979         base::Bind(&NaClProcessHost::OnResourcesReady,
 980                    weak_factory_.GetWeakPtr()));
 981     return true;
 982   } else {
 983     SendErrorToRenderer("previously failed to acquire shared resources");
 984     return false;
 985   }
 986 }
 987
 988 void NaClProcessHost::OnQueryKnownToValidate(const std::string& signature,
 989                                              bool* result) {
 990   CHECK(!uses_nonsfi_mode_);
 991   NaClBrowser* nacl_browser = NaClBrowser::GetInstance();
 992   *result = nacl_browser->QueryKnownToValidate(signature, off_the_record_);
 993 }
 994
 995 void NaClProcessHost::OnSetKnownToValidate(const std::string& signature) {
 996   CHECK(!uses_nonsfi_mode_);
 997   NaClBrowser::GetInstance()->SetKnownToValidate(
 998       signature, off_the_record_);
 999 }
1000
1001 void NaClProcessHost::OnResolveFileToken(uint64 file_token_lo,
1002                                          uint64 file_token_hi,
1003                                          IPC::Message* reply_msg) {
1004   // Was the file registered?
1005   //
1006   // Note that the file path cache is of bounded size, and old entries can get
1007   // evicted.  If a large number of NaCl modules are being launched at once,
1008   // resolving the file_token may fail because the path cache was thrashed
1009   // while the file_token was in flight.  In this case the query fails, and we
1010   // need to fall back to the slower path.
1011   //
1012   // However: each NaCl process will consume 2-3 entries as it starts up, this
1013   // means that eviction will not happen unless you start up 33+ NaCl processes
1014   // at the same time, and this still requires worst-case timing.  As a
1015   // practical matter, no entries should be evicted prematurely.
1016   // The cache itself should take ~ (150 characters * 2 bytes/char + ~60 bytes
1017   // data structure overhead) * 100 = 35k when full, so making it bigger should
1018   // not be a problem, if needed.
1019   //
1020   // Each NaCl process will consume 2-3 entries because the manifest and main
1021   // nexe are currently not resolved.  Shared libraries will be resolved.  They
1022   // will be loaded sequentially, so they will only consume a single entry
1023   // while the load is in flight.
1024   //
1025   // TODO(ncbray): track behavior with UMA. If entries are getting evicted or
1026   // bogus keys are getting queried, this would be good to know.
1027   CHECK(!uses_nonsfi_mode_);
1028   base::FilePath file_path;
1029   if (!NaClBrowser::GetInstance()->GetFilePath(
1030         file_token_lo, file_token_hi, &file_path)) {
1031     NaClProcessMsg_ResolveFileToken::WriteReplyParams(
1032         reply_msg,
1033         IPC::InvalidPlatformFileForTransit(),
1034         base::FilePath());
1035     Send(reply_msg);
1036     return;
1037   }
1038
1039   // Open the file.
1040   if (!base::PostTaskAndReplyWithResult(
1041           content::BrowserThread::GetBlockingPool(),
1042           FROM_HERE,
1043           base::Bind(OpenNaClReadExecImpl, file_path, true /* is_executable */),
1044           base::Bind(&NaClProcessHost::FileResolved,
1045                      weak_factory_.GetWeakPtr(),
1046                      file_path,
1047                      reply_msg))) {
1048      NaClProcessMsg_ResolveFileToken::WriteReplyParams(
1049          reply_msg,
1050          IPC::InvalidPlatformFileForTransit(),
1051          base::FilePath());
1052      Send(reply_msg);
1053   }
1054 }
1055
1056 void NaClProcessHost::OnResolveFileTokenAsync(uint64 file_token_lo,
1057                                               uint64 file_token_hi) {
1058   // See the comment at OnResolveFileToken() for details of the file path cache
1059   // behavior.
1060   CHECK(!uses_nonsfi_mode_);
1061   base::FilePath file_path;
1062   if (!NaClBrowser::GetInstance()->GetFilePath(
1063         file_token_lo, file_token_hi, &file_path)) {
1064     Send(new NaClProcessMsg_ResolveFileTokenAsyncReply(
1065              file_token_lo,
1066              file_token_hi,
1067              IPC::PlatformFileForTransit(),
1068              base::FilePath()));
1069     return;
1070   }
1071
1072   // Open the file.
1073   if (!base::PostTaskAndReplyWithResult(
1074           content::BrowserThread::GetBlockingPool(),
1075           FROM_HERE,
1076           base::Bind(OpenNaClReadExecImpl, file_path, true /* is_executable */),
1077           base::Bind(&NaClProcessHost::FileResolvedAsync,
1078                      weak_factory_.GetWeakPtr(),
1079                      file_token_lo,
1080                      file_token_hi,
1081                      file_path))) {
1082     Send(new NaClProcessMsg_ResolveFileTokenAsyncReply(
1083             file_token_lo,
1084             file_token_hi,
1085             IPC::PlatformFileForTransit(),
1086             base::FilePath()));
1087   }
1088 }
1089
1090 void NaClProcessHost::FileResolved(
1091     const base::FilePath& file_path,
1092     IPC::Message* reply_msg,
1093     base::File file) {
1094   if (file.IsValid()) {
1095     IPC::PlatformFileForTransit handle = IPC::TakeFileHandleForProcess(
1096         file.Pass(),
1097         process_->GetData().handle);
1098     NaClProcessMsg_ResolveFileToken::WriteReplyParams(
1099         reply_msg,
1100         handle,
1101         file_path);
1102   } else {
1103     NaClProcessMsg_ResolveFileToken::WriteReplyParams(
1104         reply_msg,
1105         IPC::InvalidPlatformFileForTransit(),
1106         base::FilePath());
1107   }
1108   Send(reply_msg);
1109 }
1110
1111 void NaClProcessHost::FileResolvedAsync(
1112     uint64_t file_token_lo,
1113     uint64_t file_token_hi,
1114     const base::FilePath& file_path,
1115     base::File file) {
1116   base::FilePath out_file_path;
1117   IPC::PlatformFileForTransit out_handle;
1118   if (file.IsValid()) {
1119     out_file_path = file_path;
1120     out_handle = IPC::TakeFileHandleForProcess(
1121         file.Pass(),
1122         process_->GetData().handle);
1123   } else {
1124     out_handle = IPC::InvalidPlatformFileForTransit();
1125   }
1126   Send(new NaClProcessMsg_ResolveFileTokenAsyncReply(
1127            file_token_lo,
1128            file_token_hi,
1129            out_handle,
1130            out_file_path));
1131 }
1132
1133 #if defined(OS_WIN)
1134 void NaClProcessHost::OnAttachDebugExceptionHandler(const std::string& info,
1135                                                     IPC::Message* reply_msg) {
1136   CHECK(!uses_nonsfi_mode_);
1137   if (!AttachDebugExceptionHandler(info, reply_msg)) {
1138     // Send failure message.
1139     NaClProcessMsg_AttachDebugExceptionHandler::WriteReplyParams(reply_msg,
1140                                                                  false);
1141     Send(reply_msg);
1142   }
1143 }
1144
1145 bool NaClProcessHost::AttachDebugExceptionHandler(const std::string& info,
1146                                                   IPC::Message* reply_msg) {
1147   if (!enable_exception_handling_ && !enable_debug_stub_) {
1148     DLOG(ERROR) <<
1149         "Debug exception handler requested by NaCl process when not enabled";
1150     return false;
1151   }
1152   if (debug_exception_handler_requested_) {
1153     // The NaCl process should not request this multiple times.
1154     DLOG(ERROR) << "Multiple AttachDebugExceptionHandler requests received";
1155     return false;
1156   }
1157   debug_exception_handler_requested_ = true;
1158
1159   base::ProcessId nacl_pid = base::GetProcId(process_->GetData().handle);
1160   base::ProcessHandle temp_handle;
1161   // We cannot use process_->GetData().handle because it does not have
1162   // the necessary access rights.  We open the new handle here rather
1163   // than in the NaCl broker process in case the NaCl loader process
1164   // dies before the NaCl broker process receives the message we send.
1165   // The debug exception handler uses DebugActiveProcess() to attach,
1166   // but this takes a PID.  We need to prevent the NaCl loader's PID
1167   // from being reused before DebugActiveProcess() is called, and
1168   // holding a process handle open achieves this.
1169   if (!base::OpenProcessHandleWithAccess(
1170            nacl_pid,
1171            base::kProcessAccessQueryInformation |
1172            base::kProcessAccessSuspendResume |
1173            base::kProcessAccessTerminate |
1174            base::kProcessAccessVMOperation |
1175            base::kProcessAccessVMRead |
1176            base::kProcessAccessVMWrite |
1177            base::kProcessAccessDuplicateHandle |
1178            base::kProcessAccessWaitForTermination,
1179            &temp_handle)) {
1180     LOG(ERROR) << "Failed to get process handle";
1181     return false;
1182   }
1183   base::win::ScopedHandle process_handle(temp_handle);
1184
1185   attach_debug_exception_handler_reply_msg_.reset(reply_msg);
1186   // If the NaCl loader is 64-bit, the process running its debug
1187   // exception handler must be 64-bit too, so we use the 64-bit NaCl
1188   // broker process for this.  Otherwise, on a 32-bit system, we use
1189   // the 32-bit browser process to run the debug exception handler.
1190   if (RunningOnWOW64()) {
1191     return NaClBrokerService::GetInstance()->LaunchDebugExceptionHandler(
1192                weak_factory_.GetWeakPtr(), nacl_pid, process_handle, info);
1193   } else {
1194     NaClStartDebugExceptionHandlerThread(
1195         process_handle.Take(), info,
1196         base::MessageLoopProxy::current(),
1197         base::Bind(&NaClProcessHost::OnDebugExceptionHandlerLaunchedByBroker,
1198                    weak_factory_.GetWeakPtr()));
1199     return true;
1200   }
1201 }
1202 #endif
1203
1204 }  // namespace nacl