RFC: Add an interface for having the browser open a pnacl support file

chrome/browser/nacl_host/pnacl_file_host.cc

+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/nacl_host/pnacl_file_host.h"
+
+#include <stdio.h>
+
+#include "base/bind.h"
+#include "base/memory/ref_counted.h"
+#include "base/path_service.h"
+#include "chrome/common/chrome_paths.h"
+#include "chrome/common/render_messages.h"
+#include "chrome/browser/renderer_host/chrome_render_message_filter.h"
+#include "content/public/browser/browser_thread.h"
+#include "native_client/src/shared/imc/nacl_imc.h"
+
+using content::BrowserThread;
+
+namespace {
+
+// Need the DuplicateHandle good to send the handle over to the
+// plugin process.
+// TODO(jvoung): share some code with nacl_process_host if possible.
+bool SendHandleToNaClPlugin(
+    base::ProcessHandle target_processh,
+    nacl::Handle sourceh,
+    bool close_source,
+    nacl::FileDescriptor* handle_for_plugin) {
+#if defined(OS_WIN)
+  HANDLE channel;
+  int flags = DUPLICATE_SAME_ACCESS;
+  if (close_source)
+    flags |= DUPLICATE_CLOSE_SOURCE;
+  if (!DuplicateHandle(GetCurrentProcess(),
+                       reinterpret_cast<HANDLE>(sourceh),
+                       target_processh,
+                       &channel,
+                       0,  // Unused given DUPLICATE_SAME_ACCESS.
+                       FALSE,
+                       flags)) {
+    LOG(ERROR) << "DuplicateHandle() failed";
+    return false;
+  }
+  *handle_for_plugin = reinterpret_cast<nacl::FileDescriptor>(channel);
+#else
+  nacl::FileDescriptor channel;
+  channel.fd = sourceh;
+  channel.auto_close = close_source;
+  *handle_for_plugin = channel;
+#endif
+  return true;
+}
+
+void NotifyRendererOfError(
+    ChromeRenderMessageFilter* chrome_render_message_filter,
+    IPC::Message* reply_msg) {
+  reply_msg->set_reply_error();
+  chrome_render_message_filter->Send(reply_msg);
+}
+
+}  // namespace
+
+namespace pnacl_file_host {
+
+// This only ever runs on the BrowserThread::FILE thread.
+void DoOpenPnaclFile(ChromeRenderMessageFilter* chrome_render_message_filter,
+                     const std::string& filename,
+                     IPC::Message* reply_msg);
+
+
+void GetReadonlyPnaclFd(
+    ChromeRenderMessageFilter* chrome_render_message_filter,
+    const std::string& filename,
+    IPC::Message* reply_msg) {
+  fprintf(stderr, "In GetReadonlyPnaclFd: %s\n", filename.c_str());
+
+  if (!BrowserThread::PostTask(
+          BrowserThread::FILE, FROM_HERE,
+          base::Bind(&DoOpenPnaclFile,
+                     make_scoped_refptr(chrome_render_message_filter),
+                     filename,
+                     reply_msg))) {
+    NotifyRendererOfError(chrome_render_message_filter, reply_msg);
+  }
+}
+
+void DoOpenPnaclFile(
+    ChromeRenderMessageFilter* chrome_render_message_filter,
+    const std::string& filename,
+    IPC::Message* reply_msg) {
+  FilePath filepath;
+  FilePath pnacl_dir;
+  base::PlatformFile file_to_open;
+
+  // Do some validation.
+  // The file must use only ASCII characters.
+  if (!IsStringASCII(filename)) {
+    LOG(ERROR) << "Cannot open non-ASCII pnacl files.";
+    NotifyRendererOfError(chrome_render_message_filter, reply_msg);
+    return;
+  }
+
+#if defined(OS_WIN)
+  FilePath file_to_find(ASCIIToUTF16(filename));
+#elif defined(OS_POSIX)
+  FilePath file_to_find(filename);
+#endif
+
+  //  Disallow peeking outside of the pnacl component directory.
+  if (file_to_find.ReferencesParent() || file_to_find.IsAbsolute()) {
+    LOG(ERROR) << "Cannot open a pnacl file referencing a parent dir, etc.";
+    NotifyRendererOfError(chrome_render_message_filter, reply_msg);
+    return;
+  }
+
+  if (!PathService::Get(chrome::DIR_PNACL_COMPONENT, &pnacl_dir)) {
+    LOG(ERROR) << "Failed to locate the pnacl install directory";
+    NotifyRendererOfError(chrome_render_message_filter, reply_msg);
+    return;
+  }
+
+  filepath = pnacl_dir.Append(file_to_find);
+
+  fprintf(stderr, "In DoOpenPnaclFile: %s\n", filepath.MaybeAsASCII().c_str());
+
+  base::PlatformFileError error_code;
+  file_to_open = base::CreatePlatformFile(filepath,

[Mark Seaborn, 2012/02/26 21:02:44]

I would expect that won't work properly with autoupdate on Linux.  If
Chrome/Chromium has been upgraded but not yet restarted, you will start opening
new files that don't match with the currently-running version of Chromium.

See Evan Martin's blog post on the topic:
http://neugierig.org/software/chromium/notes/2011/08/zygote.html

We had to solve this problem with the IRT in the past.  See nacl_proces_host.cc
and the comment about autoupdate there.  (I don't know how the Component Updater
you referenced would change this situation though.)

Stepping back a bit, I suspect that whatever we do for the PNaCl translator's
files should match up with how we handle the IRT library.

How about this:

 * When a renderer process launches a NaCl process, it passes a list of names of
files (e.g. "irt_x86_32.nexe", "translator_x86_32.nexe", "crt1.o") to grant to
the NaCl process.

 * On Linux, the browser can pre-open all these files at startup.  I'm expecting
the number of files to be small enough for this to be OK, e.g. <=10 files.  If
it were 100s, we'd have to rethink this.  On other OSes, the browser can open
the requested files when the NaCl process is launched.

 * This avoids some IPC round trips for opening translator.nexe etc.

Mark

+                                          base::PLATFORM_FILE_OPEN |
+                                          base::PLATFORM_FILE_READ |
+                                          base::PLATFORM_FILE_SHARE_DELETE,
+                                          NULL,
+                                          &error_code);
+  if (error_code != base::PLATFORM_FILE_OK) {
+    LOG(ERROR) << "Failed to open Pnacl file \""
+               << filepath.LossyDisplayName()
+               << "\": " << error_code;
+    NotifyRendererOfError(chrome_render_message_filter, reply_msg);
+    return;
+  }
+
+  // Send the reply!
+  // Do any DuplicateHandle magic that is necessary first.
+  nacl::FileDescriptor target_desc;
+  SendHandleToNaClPlugin(chrome_render_message_filter->peer_handle(),
+                         file_to_open,
+                         true /* Close source */,
+                         &target_desc);
+  ChromeViewHostMsg_GetReadonlyPnaclFD::WriteReplyParams(
+      reply_msg, target_desc);
+  chrome_render_message_filter->Send(reply_msg);
+}
+
+}