blob: 87112febbd8b96deaa009d570c150d6a2aae2b1e [file] [log] [blame]
// Copyright 2017 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "chrome/installer/setup/user_experiment.h"
#include <windows.h>
#include <lm.h>
#include <shellapi.h>
#include <wtsapi32.h>
#include <memory>
#include "base/command_line.h"
#include "base/files/file_path.h"
#include "base/process/launch.h"
#include "base/process/process_info.h"
#include "base/rand_util.h"
#include "base/stl_util.h"
#include "base/strings/string16.h"
#include "base/strings/string_number_conversions.h"
#include "base/win/registry.h"
#include "base/win/scoped_handle.h"
#include "base/win/scoped_process_information.h"
#include "base/win/win_util.h"
#include "base/win/windows_version.h"
#include "build/build_config.h"
#include "chrome/common/chrome_switches.h"
#include "chrome/common/chrome_version.h"
#include "chrome/install_static/buildflags.h"
#include "chrome/install_static/install_util.h"
#include "chrome/installer/setup/installer_state.h"
#include "chrome/installer/setup/setup_constants.h"
#include "chrome/installer/setup/setup_singleton.h"
#include "chrome/installer/setup/setup_util.h"
#include "chrome/installer/setup/update_active_setup_version_work_item.h"
#include "chrome/installer/util/experiment.h"
#include "chrome/installer/util/experiment_storage.h"
#include "chrome/installer/util/google_update_constants.h"
#include "chrome/installer/util/google_update_settings.h"
#include "chrome/installer/util/install_util.h"
#include "chrome/installer/util/util_constants.h"
#include "ui/base/fullscreen_win.h"
namespace installer {
namespace {
// The study currently being conducted.
constexpr ExperimentStorage::Study kCurrentStudy = ExperimentStorage::kStudyOne;
// The primary group for study number two.
constexpr int kStudyTwoGroup = 0;
// Test switches.
constexpr char kExperimentParticipation[] = "experiment-participation";
constexpr char kExperimentRetryDelay[] = "experiment-retry-delay";
constexpr char kExperimentEnableForTesting[] = "experiment-enable-for-testing";
constexpr char kExperimentEnterpriseBypass[] = "experiment-enterprise-bypass";
// Returns true if the experiment is enabled for testing.
bool IsExperimentEnabledForTesting() {
return base::CommandLine::ForCurrentProcess()->HasSwitch(
// Returns true if the install originated from the MSI or if the machine is
// joined to a domain. This check can be bypassed via
// --experiment-enterprise-bypass.
bool IsEnterpriseInstall(const InstallerState& installer_state) {
if (base::CommandLine::ForCurrentProcess()->HasSwitch(
kExperimentEnterpriseBypass)) {
return false;
return installer_state.is_msi() || IsDomainJoined();
// Returns the delay to be used between presentation retries. The default (five
// minutes) can be overidden via --experiment-retry-delay=SECONDS.
base::TimeDelta GetRetryDelay() {
base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
base::string16 value =
int seconds;
if (!value.empty() && base::StringToInt(value, &seconds))
return base::TimeDelta::FromSeconds(seconds);
return base::TimeDelta::FromMinutes(5);
// Overrides the participation value for testing if a value is provided via
// --experiment-participation=value. "value" may be "one" or "two". Any other
// value (or none at all) results in clearing the persisted state for organic
// re-evaluation.
ExperimentStorage::Study HandleParticipationOverride(
ExperimentStorage::Study current_participation,
ExperimentStorage::Lock* lock) {
base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
if (!command_line->HasSwitch(kExperimentParticipation))
return current_participation;
base::string16 participation_override =
ExperimentStorage::Study participation = ExperimentStorage::kNoStudySelected;
if (participation_override == L"one")
participation = ExperimentStorage::kStudyOne;
else if (participation_override == L"two")
participation = ExperimentStorage::kStudyTwo;
if (participation != current_participation)
return participation;
// This function launches setup as the currently logged-in interactive
// user, that is, the user whose logon session is attached to winsta0\default.
// It assumes that currently we are running as SYSTEM in a non-interactive
// window station.
// The function fails if there is no interactive session active, basically
// the computer is on but nobody has logged in locally.
// Remote Desktop sessions do not count as interactive sessions; running this
// method as a user logged in via remote desktop will do nothing.
bool LaunchSetupAsConsoleUser(const base::CommandLine& cmd_line) {
DWORD console_id = ::WTSGetActiveConsoleSessionId();
if (console_id == 0xFFFFFFFF) {
PLOG(ERROR) << __func__ << " no session attached to the console";
return false;
base::win::ScopedHandle user_token_handle;
HANDLE user_token;
if (!::WTSQueryUserToken(console_id, &user_token)) {
PLOG(ERROR) << __func__ << " failed to get user token for console_id "
<< console_id;
return false;
base::LaunchOptions options;
options.as_user = user_token_handle.Get();
options.empty_desktop_name = true;
VLOG(1) << "Spawning experiment process: " << cmd_line.GetCommandLineString();
if (base::LaunchProcess(cmd_line, options).IsValid())
return true;
PLOG(ERROR) << "Failed";
return false;
// Returns true if the Windows shell indicates that the machine isn't in
// presentation mode, running a full-screen D3D app, or in a quiet period.
bool MayShowNotifications() {
HRESULT result = SHQueryUserNotificationState(&state);
if (FAILED(result))
return true;
// Explicitly allow the acceptable states rather than the converse to be sure
// there are no surprises should new states be introduced.
return state == QUNS_NOT_PRESENT || // Locked/screensaver running.
state == QUNS_ACCEPTS_NOTIFICATIONS; // Go for it!
bool UserSessionIsNotYoung() {
static constexpr base::TimeDelta kMinSessionLength =
base::Time session_start_time = GetConsoleSessionStartTime();
if (session_start_time.is_null())
return true;
base::TimeDelta session_length = base::Time::Now() - session_start_time;
return session_length >= kMinSessionLength;
bool ActiveWindowIsNotFullscreen() {
return !ui::IsFullScreenMode();
// Blocks processing if conditions are not right for presentation. Returns true
// if presentation should continue, or false otherwise (e.g., another process
// requires the setup singleton).
bool WaitForPresentation(
const SetupSingleton& setup_singleton,
Experiment* experiment,
ExperimentStorage* storage,
std::unique_ptr<ExperimentStorage::Lock>* storage_lock) {
base::TimeDelta retry_delay = GetRetryDelay();
bool first_sleep = true;
bool loop_again = true;
do {
if (MayShowNotifications() && UserSessionIsNotYoung() &&
ActiveWindowIsNotFullscreen()) {
return true;
// Update the state accordingly if this is the first sleep.
if (first_sleep) {
first_sleep = false;
// Release the storage lock and wait on the singleton for five minutes.
// Break when another process needs the singleton.
loop_again = !setup_singleton.WaitForInterrupt(retry_delay);
*storage_lock = storage->AcquireLock();
} while (loop_again);
return false;
} // namespace
// Execution may be in the context of the system or a user on it, and no
// guarantee is made regarding the setup singleton.
bool ShouldRunUserExperiment(const InstallerState& installer_state) {
return false;
if (!install_static::SupportsRetentionExperiments())
return false;
// The current experiment only applies to Windows 10 and newer.
if (base::win::GetVersion() < base::win::Version::WIN10)
return false;
// Installs originating from the MSI and domain joined machines are excluded.
if (IsEnterpriseInstall(installer_state))
return false;
// Gain exclusive access to the persistent experiment state. Only per-install
// state may be queried (participation and metrics are okay; Experiment itself
// is not).
ExperimentStorage storage;
auto lock = storage.AcquireLock();
// Bail out if this install is not selected into the fraction participating in
// the current study.
// NOTE: No clients will participate while this feature is under development.
if (!IsExperimentEnabledForTesting() ||
!IsSelectedForStudy(lock.get(), kCurrentStudy)) {
return false;
// Skip the experiment if a user on the machine has already reached a terminal
// state.
ExperimentMetrics metrics;
if (!lock->LoadMetrics(&metrics) || metrics.InTerminalState())
return false;
return true;
// Execution is from the context of the installer immediately following a
// successful update. The setup singleton is held.
void BeginUserExperiment(const InstallerState& installer_state,
const base::FilePath& setup_path,
bool user_context) {
ExperimentStorage storage;
// Prepare a command line to relaunch the installed setup.exe for the
// experiment.
base::CommandLine setup_command(setup_path);
if (installer_state.system_install())
if (installer_state.verbose_logging())
// Copy any test switches used by the spawned process.
static constexpr const char* kSwitchesToCopy[] = {
kSwitchesToCopy, base::size(kSwitchesToCopy));
if (user_context) {
// This is either a per-user install or a per-machine install run via
// Active Setup as a normal user.
DCHECK(!installer_state.system_install() ||
base::GetCurrentProcessIntegrityLevel() == base::MEDIUM_INTEGRITY);
VLOG(1) << "Spawning experiment process: "
<< setup_command.GetCommandLineString();
// The installer is already running in the context of an ordinary user.
// Relaunch directly to run the experiment.
base::LaunchOptions launch_options;
launch_options.force_breakaway_from_job_ = true;
if (!base::LaunchProcess(setup_command, launch_options).IsValid()) {
LOG(ERROR) << __func__
<< " failed to relaunch installer for user experiment,";
WriteInitialState(&storage, ExperimentMetrics::kRelaunchFailed);
// The installer is running at high integrity, likely as SYSTEM. Relaunch as
// the console user at medium integrity.
VLOG(1) << "Attempting to spawn experiment as console user.";
if (LaunchSetupAsConsoleUser(setup_command)) {
// Trigger Active Setup to run on the next user logon if this machine has
// never participated in the experiment. This will be done at most once per
// machine, even across updates. Doing so more often risks having excessive
// active setup activity for some users.
auto storage_lock = storage.AcquireLock();
ExperimentMetrics experiment_metrics;
if (storage_lock->LoadMetrics(&experiment_metrics) &&
experiment_metrics.state == ExperimentMetrics::kUninitialized) {
UpdateActiveSetupVersionWorkItem item(
if (item.Do()) {
VLOG(1) << "Bumped Active Setup Version for user experiment";
experiment_metrics.state = ExperimentMetrics::kWaitingForUserLogon;
} else {
LOG(ERROR) << "Failed to bump Active Setup Version for user experiment.";
// This function executes within the context of a signed-in user, even for the
// case of system-level installs. In particular, it may be run in a spawned
// setup.exe immediately after a successful update or following user logon as a
// result of Active Setup.
void RunUserExperiment(const base::CommandLine& command_line,
const MasterPreferences& master_preferences,
InstallationState* original_state,
InstallerState* installer_state) {
VLOG(1) << __func__;
ExperimentStorage storage;
std::unique_ptr<SetupSingleton> setup_singleton(SetupSingleton::Acquire(
command_line, master_preferences, original_state, installer_state));
if (!setup_singleton) {
VLOG(1) << "Timed out while waiting for setup singleton";
WriteInitialState(&storage, ExperimentMetrics::kSingletonWaitTimeout);
Experiment experiment;
auto storage_lock = storage.AcquireLock();
// Determine the study in which this client participates.
ExperimentStorage::Study participation = ExperimentStorage::kNoStudySelected;
if (!storage_lock->ReadParticipation(&participation) ||
participation == ExperimentStorage::kNoStudySelected) {
// ShouldRunUserExperiment should have brought this client into a particular
// study. Something is very wrong if it can't be determined here.
LOG(ERROR) << "Failed to read study participation.";
if (!storage_lock->LoadExperiment(&experiment)) {
// The metrics correspond to a different user on the machine; nothing to do.
VLOG(1) << "Another user is participating in the experiment.";
// There is nothing to do if the user has already reached a terminal state.
if (experiment.metrics().InTerminalState()) {
VLOG(1) << "Experiment has reached terminal state: "
<< experiment.metrics().state;
// Now the fun begins. Assign this user to a group if this is the first time
// through.
if (experiment.metrics().InInitialState()) {
VLOG(1) << "Assigned user to experiment group: "
<< experiment.metrics().group;
// Chrome is considered actively used if it has been run within the last 28
// days or if it was installed within the same time period.
int inactive_days = GoogleUpdateSettings::GetLastRunTime();
if (inactive_days < 0)
inactive_days = GetInstallAge(*installer_state);
if (inactive_days <= 28) {
VLOG(1) << "Aborting experiment due to activity.";
// Check for a dormant user: one for which the machine has been off or the
// user has been signed out for more than 90% of the last 28 days.
if (false) { // TODO(grt): Implement this.
VLOG(1) << "Aborting experiment due to dormancy.";
// Note that the following call will not detect Win10 Tablet mode when
// run under a debugger - GetForegroundWindow gets confused.
if (base::win::IsTabletDevice(nullptr, ::GetForegroundWindow())) {
VLOG(1) << "Aborting experiment due to tablet device.";
if (IsUpdateRenamePending()) {
VLOG(1) << "Aborting experiment due to Chrome update rename pending.";
if (!WaitForPresentation(*setup_singleton, &experiment, &storage,
&storage_lock)) {
VLOG(1) << "Aborting experiment while waiting to present.";
if ( != ExperimentMetrics::kHoldbackGroup) {
VLOG(1) << "Launching Chrome to show the toast.";
LaunchChrome(*installer_state, experiment);
} else {
// Move clients in the holdback group directly into the "SelectedClose"
// group since they will not be prompted and Chrome will not launch.
VLOG(1) << "Skipping Chrome launch for client in the holdback group.";
// Writes the initial state |state| to the registry if there is no existing
// state for this or another user.
void WriteInitialState(ExperimentStorage* storage,
ExperimentMetrics::State state) {
auto storage_lock = storage->AcquireLock();
// Write the state provided that there is either no existing state or that
// any that exists also represents an initial state.
ExperimentMetrics experiment_metrics;
if (storage_lock->LoadMetrics(&experiment_metrics) &&
experiment_metrics.InInitialState()) {
experiment_metrics.state = state;
bool IsDomainJoined() {
LPWSTR buffer = nullptr;
NETSETUP_JOIN_STATUS buffer_type = NetSetupUnknownStatus;
bool is_joined =
::NetGetJoinInformation(nullptr, &buffer, &buffer_type) == NERR_Success &&
buffer_type == NetSetupDomainName;
if (buffer)
return is_joined;
bool IsSelectedForStudy(ExperimentStorage::Lock* lock,
ExperimentStorage::Study current_study) {
ExperimentStorage::Study participation = ExperimentStorage::kNoStudySelected;
if (!lock->ReadParticipation(&participation))
return false;
participation = HandleParticipationOverride(participation, lock);
if (participation == ExperimentStorage::kNoStudySelected) {
// This install has not been evaluated for participation. Do so now. Select
// a small population into the first study of the experiment. Everyone else
// gets the second study.
participation = base::RandDouble() <= 0.02756962532
? ExperimentStorage::kStudyOne
: ExperimentStorage::kStudyTwo;
if (!lock->WriteParticipation(participation))
return false;
return participation <= current_study;
int PickGroup(ExperimentStorage::Study participation) {
DCHECK(participation == ExperimentStorage::kStudyOne ||
participation == ExperimentStorage::kStudyTwo);
if (participation == ExperimentStorage::kStudyOne) {
// Evenly distrubute clients among the groups.
return base::RandInt(0, ExperimentMetrics::kNumGroups - 1);
// 1% holdback, 99% in the winning group.
return base::RandDouble() < 0.01 ? ExperimentMetrics::kHoldbackGroup
: kStudyTwoGroup;
bool IsUpdateRenamePending() {
// Consider an update to be pending if an "opv" value is present in the
// registry or if Chrome's version as registered with Omaha doesn't match the
// current version.
base::string16 clients_key_path = install_static::GetClientsKeyPath();
const HKEY root = install_static::IsSystemInstall() ? HKEY_LOCAL_MACHINE
base::win::RegKey clients_key;
// The failure modes below are generally indicitive of a run from a
// non-installed Chrome. Pretend that all is well.
if (clients_key.Open(root, clients_key_path.c_str(),
return false;
if (clients_key.HasValue(google_update::kRegOldVersionField))
return true;
base::string16 product_version;
if (clients_key.ReadValue(google_update::kRegVersionField,
&product_version) != ERROR_SUCCESS) {
return false;
return product_version != TEXT(CHROME_VERSION_STRING);
void LaunchChrome(const InstallerState& installer_state,
const Experiment& experiment) {
const base::FilePath chrome_exe =
base::CommandLine command_line(chrome_exe);
#if defined(OS_WIN)
#endif // defined(OS_WIN)
STARTUPINFOW startup_info = {sizeof(startup_info)};
PROCESS_INFORMATION temp_process_info = {};
base::string16 writable_command_line_string(
if (!::CreateProcess(
chrome_exe.value().c_str(), &writable_command_line_string[0],
nullptr /* lpProcessAttributes */, nullptr /* lpThreadAttributes */,
FALSE /* bInheritHandles */, CREATE_NO_WINDOW,
nullptr /* lpEnvironment */, nullptr /* lpCurrentDirectory */,
&startup_info, &temp_process_info)) {
PLOG(ERROR) << "Failed to launch: " << writable_command_line_string;
// Ensure that the thread and process handles of the new process are closed.
base::win::ScopedProcessInformation process_info(temp_process_info);
} // namespace installer