mirror of
https://github.com/chromium/crashpad.git
synced 2025-01-17 04:50:27 +08:00
a685942342
The existing implementation used the same logic as is found in mach_msg_server(), but that logic seems incorrect. When the caller wants to retry a mach_msg() receive of a too-large message that returns MACH_RCV_TOO_LARGE, there’s no harm in attempting the receive with a larger buffer initially. On the other hand, if the caller does not want to retry such mach_msg() receive attempts, it’s an indication that the caller is expecting to be intolerant of too-large messages, and there’s no need to attempt the receive with a buffer any larger than requested. TEST=util_test R=rsesek@chromium.org Review URL: https://codereview.chromium.org/753363003
294 lines
11 KiB
C++
294 lines
11 KiB
C++
// Copyright 2014 The Crashpad Authors. All rights reserved.
|
||
//
|
||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||
// you may not use this file except in compliance with the License.
|
||
// You may obtain a copy of the License at
|
||
//
|
||
// http://www.apache.org/licenses/LICENSE-2.0
|
||
//
|
||
// Unless required by applicable law or agreed to in writing, software
|
||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||
// See the License for the specific language governing permissions and
|
||
// limitations under the License.
|
||
|
||
#include "util/mach/mach_message_server.h"
|
||
|
||
#include <limits>
|
||
|
||
#include "base/mac/mach_logging.h"
|
||
#include "base/mac/scoped_mach_vm.h"
|
||
#include "util/misc/clock.h"
|
||
|
||
namespace crashpad {
|
||
|
||
namespace {
|
||
|
||
const int kNanosecondsPerMillisecond = 1E6;
|
||
|
||
// TimerRunning determines whether |deadline| has passed. If |deadline| is in
|
||
// the future, |*remaining_ms| is set to the number of milliseconds remaining,
|
||
// which will always be a positive value, and this function returns true. If
|
||
// |deadline| is zero (indicating that no timer is in effect), |*remaining_ms|
|
||
// is set to zero and this function returns true. Otherwise, this function
|
||
// returns false. |deadline| is specified on the same time base as is returned
|
||
// by ClockMonotonicNanoseconds().
|
||
bool TimerRunning(uint64_t deadline, mach_msg_timeout_t* remaining_ms) {
|
||
if (!deadline) {
|
||
*remaining_ms = MACH_MSG_TIMEOUT_NONE;
|
||
return true;
|
||
}
|
||
|
||
uint64_t now = ClockMonotonicNanoseconds();
|
||
|
||
if (now >= deadline) {
|
||
return false;
|
||
}
|
||
|
||
uint64_t remaining = deadline - now;
|
||
|
||
// Round to the nearest millisecond, taking care not to overflow.
|
||
const int kHalfMillisecondInNanoseconds = kNanosecondsPerMillisecond / 2;
|
||
mach_msg_timeout_t remaining_mach;
|
||
if (remaining <=
|
||
std::numeric_limits<uint64_t>::max() - kHalfMillisecondInNanoseconds) {
|
||
remaining_mach = (remaining + kHalfMillisecondInNanoseconds) /
|
||
kNanosecondsPerMillisecond;
|
||
} else {
|
||
remaining_mach = remaining / kNanosecondsPerMillisecond;
|
||
}
|
||
|
||
if (remaining_mach == MACH_MSG_TIMEOUT_NONE) {
|
||
return false;
|
||
}
|
||
|
||
*remaining_ms = remaining_mach;
|
||
return true;
|
||
}
|
||
|
||
} // namespace
|
||
|
||
// This implementation is based on 10.9.4
|
||
// xnu-2422.110.17/libsyscall/mach/mach_msg.c mach_msg_server_once(), but
|
||
// adapted to local style using scopers, replacing the server callback function
|
||
// and |max_size| parameter with a C++ interface, and with the addition of the
|
||
// the |persistent| parameter allowing this function to serve as a stand-in for
|
||
// mach_msg_server(), the |nonblocking| parameter to control blocking directly,
|
||
// and the |timeout_ms| parameter allowing this function to not block
|
||
// indefinitely.
|
||
//
|
||
// static
|
||
mach_msg_return_t MachMessageServer::Run(Interface* interface,
|
||
mach_port_t receive_port,
|
||
mach_msg_options_t options,
|
||
Persistent persistent,
|
||
Nonblocking nonblocking,
|
||
ReceiveLarge receive_large,
|
||
mach_msg_timeout_t timeout_ms) {
|
||
options &= ~(MACH_RCV_MSG | MACH_SEND_MSG);
|
||
|
||
mach_msg_options_t timeout_options = MACH_RCV_TIMEOUT | MACH_SEND_TIMEOUT |
|
||
MACH_RCV_INTERRUPT | MACH_SEND_INTERRUPT;
|
||
|
||
uint64_t deadline;
|
||
if (nonblocking == kNonblocking) {
|
||
options |= timeout_options;
|
||
deadline = 0;
|
||
} else if (timeout_ms != MACH_MSG_TIMEOUT_NONE) {
|
||
options |= timeout_options;
|
||
deadline = ClockMonotonicNanoseconds() +
|
||
implicit_cast<uint64_t>(timeout_ms) * kNanosecondsPerMillisecond;
|
||
} else {
|
||
options &= ~timeout_options;
|
||
deadline = 0;
|
||
}
|
||
|
||
if (receive_large == kReceiveLargeResize) {
|
||
options |= MACH_RCV_LARGE;
|
||
} else {
|
||
options &= ~MACH_RCV_LARGE;
|
||
}
|
||
|
||
mach_msg_size_t trailer_alloc = REQUESTED_TRAILER_SIZE(options);
|
||
mach_msg_size_t max_request_size = interface->MachMessageServerRequestSize();
|
||
mach_msg_size_t request_alloc = round_page(max_request_size + trailer_alloc);
|
||
|
||
// mach_msg_server() and mach_msg_server_once() invert this condition, but
|
||
// their interpretation is incorrect. When it is desirable to retry a receive
|
||
// attempt that returns MACH_RCV_TOO_LARGE with a larger receive buffer, it is
|
||
// also desirable to use the full receive buffer rounded up to a page size for
|
||
// the initial receive attempt. On the other hand, when this behavior is not
|
||
// requested, there is no reason to attempt receiving messages any larger than
|
||
// expected.
|
||
mach_msg_size_t request_size = (receive_large == kReceiveLargeResize)
|
||
? max_request_size + trailer_alloc
|
||
: request_alloc;
|
||
|
||
mach_msg_size_t max_reply_size = interface->MachMessageServerReplySize();
|
||
|
||
// mach_msg_server() and mach_msg_server_once() would consider whether
|
||
// |options| contains MACH_SEND_TRAILER and include MAX_TRAILER_SIZE in this
|
||
// computation if it does, but that option is ineffective on OS X.
|
||
mach_msg_size_t reply_alloc = round_page(max_reply_size);
|
||
|
||
kern_return_t kr;
|
||
|
||
do {
|
||
mach_msg_size_t this_request_alloc = request_alloc;
|
||
mach_msg_size_t this_request_size = request_size;
|
||
|
||
base::mac::ScopedMachVM request_scoper;
|
||
mach_msg_header_t* request_header = nullptr;
|
||
|
||
while (!request_scoper.address()) {
|
||
vm_address_t request_addr;
|
||
kr = vm_allocate(mach_task_self(),
|
||
&request_addr,
|
||
this_request_alloc,
|
||
VM_FLAGS_ANYWHERE | VM_MAKE_TAG(VM_MEMORY_MACH_MSG));
|
||
if (kr != KERN_SUCCESS) {
|
||
return kr;
|
||
}
|
||
base::mac::ScopedMachVM trial_request_scoper(request_addr,
|
||
this_request_alloc);
|
||
request_header = reinterpret_cast<mach_msg_header_t*>(request_addr);
|
||
|
||
bool run_mach_msg_receive = false;
|
||
do {
|
||
// If |options| contains MACH_RCV_INTERRUPT, retry mach_msg() in a loop
|
||
// when it returns MACH_RCV_INTERRUPTED to recompute |remaining_ms|
|
||
// rather than allowing mach_msg() to retry using the original timeout
|
||
// value. See 10.9.4 xnu-2422.110.17/libsyscall/mach/mach_msg.c
|
||
// mach_msg().
|
||
mach_msg_timeout_t remaining_ms;
|
||
if (!TimerRunning(deadline, &remaining_ms)) {
|
||
return MACH_RCV_TIMED_OUT;
|
||
}
|
||
|
||
kr = mach_msg(request_header,
|
||
options | MACH_RCV_MSG,
|
||
0,
|
||
this_request_size,
|
||
receive_port,
|
||
remaining_ms,
|
||
MACH_PORT_NULL);
|
||
|
||
if (kr == MACH_RCV_TOO_LARGE && receive_large == kReceiveLargeIgnore) {
|
||
MACH_LOG(WARNING, kr) << "mach_msg: ignoring large message";
|
||
run_mach_msg_receive = true;
|
||
} else if (kr == MACH_RCV_INTERRUPTED) {
|
||
run_mach_msg_receive = true;
|
||
}
|
||
} while (run_mach_msg_receive);
|
||
|
||
if (kr == MACH_MSG_SUCCESS) {
|
||
request_scoper.swap(trial_request_scoper);
|
||
} else if (kr == MACH_RCV_TOO_LARGE &&
|
||
receive_large == kReceiveLargeResize) {
|
||
this_request_size =
|
||
round_page(request_header->msgh_size + trailer_alloc);
|
||
this_request_alloc = this_request_size;
|
||
} else {
|
||
return kr;
|
||
}
|
||
}
|
||
|
||
vm_address_t reply_addr;
|
||
kr = vm_allocate(mach_task_self(),
|
||
&reply_addr,
|
||
reply_alloc,
|
||
VM_FLAGS_ANYWHERE | VM_MAKE_TAG(VM_MEMORY_MACH_MSG));
|
||
if (kr != KERN_SUCCESS) {
|
||
return kr;
|
||
}
|
||
|
||
base::mac::ScopedMachVM reply_scoper(reply_addr, reply_alloc);
|
||
|
||
mach_msg_header_t* reply_header =
|
||
reinterpret_cast<mach_msg_header_t*>(reply_addr);
|
||
bool destroy_complex_request = false;
|
||
interface->MachMessageServerFunction(
|
||
request_header, reply_header, &destroy_complex_request);
|
||
|
||
if (!(reply_header->msgh_bits & MACH_MSGH_BITS_COMPLEX)) {
|
||
// This only works if the reply message is not complex, because otherwise,
|
||
// the location of the RetCode field is not known. It should be possible
|
||
// to locate the RetCode field by looking beyond the descriptors in a
|
||
// complex reply message, but this is not currently done. This behavior
|
||
// has not proven itself necessary in practice, and it’s not done by
|
||
// mach_msg_server() or mach_msg_server_once() either.
|
||
mig_reply_error_t* reply_mig =
|
||
reinterpret_cast<mig_reply_error_t*>(reply_header);
|
||
if (reply_mig->RetCode == MIG_NO_REPLY) {
|
||
reply_header->msgh_remote_port = MACH_PORT_NULL;
|
||
} else if (reply_mig->RetCode != KERN_SUCCESS &&
|
||
request_header->msgh_bits & MACH_MSGH_BITS_COMPLEX) {
|
||
destroy_complex_request = true;
|
||
}
|
||
}
|
||
|
||
if (destroy_complex_request &&
|
||
request_header->msgh_bits & MACH_MSGH_BITS_COMPLEX) {
|
||
request_header->msgh_remote_port = MACH_PORT_NULL;
|
||
mach_msg_destroy(request_header);
|
||
}
|
||
|
||
if (reply_header->msgh_remote_port != MACH_PORT_NULL) {
|
||
// If the reply port right is a send-once right, the send won’t block even
|
||
// if the remote side isn’t waiting for a message. No timeout is used,
|
||
// which keeps the communication on the kernel’s fast path. If the reply
|
||
// port right is a send right, MACH_SEND_TIMEOUT is used to avoid blocking
|
||
// indefinitely. This duplicates the logic in 10.9.4
|
||
// xnu-2422.110.17/libsyscall/mach/mach_msg.c mach_msg_server_once().
|
||
mach_msg_option_t send_options =
|
||
options | MACH_SEND_MSG |
|
||
(MACH_MSGH_BITS_REMOTE(reply_header->msgh_bits) ==
|
||
MACH_MSG_TYPE_MOVE_SEND_ONCE
|
||
? 0
|
||
: MACH_SEND_TIMEOUT);
|
||
|
||
bool running;
|
||
do {
|
||
// If |options| contains MACH_SEND_INTERRUPT, retry mach_msg() in a loop
|
||
// when it returns MACH_SEND_INTERRUPTED to recompute |remaining_ms|
|
||
// rather than allowing mach_msg() to retry using the original timeout
|
||
// value. See 10.9.4 xnu-2422.110.17/libsyscall/mach/mach_msg.c
|
||
// mach_msg().
|
||
mach_msg_timeout_t remaining_ms;
|
||
running = TimerRunning(deadline, &remaining_ms);
|
||
if (!running) {
|
||
// Don’t return just yet. If the timer ran out in between the time the
|
||
// request was received and now, at least try to send the response.
|
||
remaining_ms = 0;
|
||
}
|
||
|
||
kr = mach_msg(reply_header,
|
||
send_options,
|
||
reply_header->msgh_size,
|
||
0,
|
||
MACH_PORT_NULL,
|
||
remaining_ms,
|
||
MACH_PORT_NULL);
|
||
} while (kr == MACH_SEND_INTERRUPTED);
|
||
|
||
if (kr != KERN_SUCCESS) {
|
||
if (kr == MACH_SEND_INVALID_DEST || kr == MACH_SEND_TIMED_OUT) {
|
||
mach_msg_destroy(reply_header);
|
||
}
|
||
return kr;
|
||
}
|
||
|
||
if (!running) {
|
||
// The reply message was sent successfuly, so act as though the deadline
|
||
// was reached before or during the subsequent receive operation when in
|
||
// persistent mode, and just return success when not in persistent mode.
|
||
return (persistent == kPersistent) ? MACH_RCV_TIMED_OUT : kr;
|
||
}
|
||
}
|
||
} while (persistent == kPersistent);
|
||
|
||
return kr;
|
||
}
|
||
|
||
} // namespace crashpad
|