1 /*
2  * Copyright (C) 2016 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #define LOG_TAG "AAudioService"
18 //#define LOG_NDEBUG 0
19 #include <utils/Log.h>
20 
21 #include <iomanip>
22 #include <iostream>
23 #include <sstream>
24 
25 #include <aaudio/AAudio.h>
26 #include <mediautils/ServiceUtilities.h>
27 #include <utils/String16.h>
28 
29 #include "binding/AAudioServiceMessage.h"
30 #include "AAudioClientTracker.h"
31 #include "AAudioEndpointManager.h"
32 #include "AAudioService.h"
33 #include "AAudioServiceStreamMMAP.h"
34 #include "AAudioServiceStreamShared.h"
35 #include "binding/IAAudioService.h"
36 
37 using namespace android;
38 using namespace aaudio;
39 
40 #define MAX_STREAMS_PER_PROCESS   8
41 
42 using android::AAudioService;
43 
AAudioService()44 android::AAudioService::AAudioService()
45     : BnAAudioService() {
46     mAudioClient.clientUid = getuid();   // TODO consider using geteuid()
47     mAudioClient.clientPid = getpid();
48     mAudioClient.packageName = String16("");
49     AAudioClientTracker::getInstance().setAAudioService(this);
50 }
51 
~AAudioService()52 AAudioService::~AAudioService() {
53 }
54 
dump(int fd,const Vector<String16> & args)55 status_t AAudioService::dump(int fd, const Vector<String16>& args) {
56     std::string result;
57 
58     if (!dumpAllowed()) {
59         std::stringstream ss;
60         ss << "Permission Denial: can't dump AAudioService from pid="
61                 << IPCThreadState::self()->getCallingPid() << ", uid="
62                 << IPCThreadState::self()->getCallingUid() << "\n";
63         result = ss.str();
64         ALOGW("%s", result.c_str());
65     } else {
66         result = "------------ AAudio Service ------------\n"
67                  + mStreamTracker.dump()
68                  + AAudioClientTracker::getInstance().dump()
69                  + AAudioEndpointManager::getInstance().dump();
70     }
71     (void)write(fd, result.c_str(), result.size());
72     return NO_ERROR;
73 }
74 
registerClient(const sp<IAAudioClient> & client)75 void AAudioService::registerClient(const sp<IAAudioClient>& client) {
76     pid_t pid = IPCThreadState::self()->getCallingPid();
77     AAudioClientTracker::getInstance().registerClient(pid, client);
78 }
79 
isCallerInService()80 bool AAudioService::isCallerInService() {
81     return mAudioClient.clientPid == IPCThreadState::self()->getCallingPid() &&
82         mAudioClient.clientUid == IPCThreadState::self()->getCallingUid();
83 }
84 
openStream(const aaudio::AAudioStreamRequest & request,aaudio::AAudioStreamConfiguration & configurationOutput)85 aaudio_handle_t AAudioService::openStream(const aaudio::AAudioStreamRequest &request,
86                                           aaudio::AAudioStreamConfiguration &configurationOutput) {
87     // A lock in is used to order the opening of endpoints when an
88     // EXCLUSIVE endpoint is stolen. We want the order to be:
89     // 1) Thread A opens exclusive MMAP endpoint
90     // 2) Thread B wants to open an exclusive MMAP endpoint so it steals the one from A
91     //    under this lock.
92     // 3) Thread B opens a shared MMAP endpoint.
93     // 4) Thread A can then get the lock and also open a shared stream.
94     // Without the lock. Thread A might sneak in and reallocate an exclusive stream
95     // before B can open the shared stream.
96     std::unique_lock<std::recursive_mutex> lock(mOpenLock);
97 
98     aaudio_result_t result = AAUDIO_OK;
99     sp<AAudioServiceStreamBase> serviceStream;
100     const AAudioStreamConfiguration &configurationInput = request.getConstantConfiguration();
101     bool sharingModeMatchRequired = request.isSharingModeMatchRequired();
102     aaudio_sharing_mode_t sharingMode = configurationInput.getSharingMode();
103 
104     // Enforce limit on client processes.
105     pid_t pid = request.getProcessId();
106     if (pid != mAudioClient.clientPid) {
107         int32_t count = AAudioClientTracker::getInstance().getStreamCount(pid);
108         if (count >= MAX_STREAMS_PER_PROCESS) {
109             ALOGE("openStream(): exceeded max streams per process %d >= %d",
110                   count,  MAX_STREAMS_PER_PROCESS);
111             return AAUDIO_ERROR_UNAVAILABLE;
112         }
113     }
114 
115     if (sharingMode != AAUDIO_SHARING_MODE_EXCLUSIVE && sharingMode != AAUDIO_SHARING_MODE_SHARED) {
116         ALOGE("openStream(): unrecognized sharing mode = %d", sharingMode);
117         return AAUDIO_ERROR_ILLEGAL_ARGUMENT;
118     }
119 
120     if (sharingMode == AAUDIO_SHARING_MODE_EXCLUSIVE
121         && AAudioClientTracker::getInstance().isExclusiveEnabled(request.getProcessId())) {
122         // only trust audioserver for in service indication
123         bool inService = false;
124         if (isCallerInService()) {
125             inService = request.isInService();
126         }
127         serviceStream = new AAudioServiceStreamMMAP(*this, inService);
128         result = serviceStream->open(request);
129         if (result != AAUDIO_OK) {
130             // Clear it so we can possibly fall back to using a shared stream.
131             ALOGW("openStream(), could not open in EXCLUSIVE mode");
132             serviceStream.clear();
133         }
134     }
135 
136     // Try SHARED if SHARED requested or if EXCLUSIVE failed.
137     if (sharingMode == AAUDIO_SHARING_MODE_SHARED) {
138         serviceStream =  new AAudioServiceStreamShared(*this);
139         result = serviceStream->open(request);
140     } else if (serviceStream.get() == nullptr && !sharingModeMatchRequired) {
141         aaudio::AAudioStreamRequest modifiedRequest = request;
142         // Overwrite the original EXCLUSIVE mode with SHARED.
143         modifiedRequest.getConfiguration().setSharingMode(AAUDIO_SHARING_MODE_SHARED);
144         serviceStream =  new AAudioServiceStreamShared(*this);
145         result = serviceStream->open(modifiedRequest);
146     }
147 
148     if (result != AAUDIO_OK) {
149         serviceStream.clear();
150         return result;
151     } else {
152         aaudio_handle_t handle = mStreamTracker.addStreamForHandle(serviceStream.get());
153         serviceStream->setHandle(handle);
154         pid_t pid = request.getProcessId();
155         AAudioClientTracker::getInstance().registerClientStream(pid, serviceStream);
156         configurationOutput.copyFrom(*serviceStream);
157         // Log open in MediaMetrics after we have the handle because we need the handle to
158         // create the metrics ID.
159         serviceStream->logOpen(handle);
160         ALOGV("%s(): return handle = 0x%08X", __func__, handle);
161         return handle;
162     }
163 }
164 
closeStream(aaudio_handle_t streamHandle)165 aaudio_result_t AAudioService::closeStream(aaudio_handle_t streamHandle) {
166     // Check permission and ownership first.
167     sp<AAudioServiceStreamBase> serviceStream = convertHandleToServiceStream(streamHandle);
168     if (serviceStream.get() == nullptr) {
169         ALOGE("closeStream(0x%0x), illegal stream handle", streamHandle);
170         return AAUDIO_ERROR_INVALID_HANDLE;
171     }
172     return closeStream(serviceStream);
173 }
174 
closeStream(sp<AAudioServiceStreamBase> serviceStream)175 aaudio_result_t AAudioService::closeStream(sp<AAudioServiceStreamBase> serviceStream) {
176     // This is protected by a lock in AAudioClientTracker.
177     // It is safe to unregister the same stream twice.
178     pid_t pid = serviceStream->getOwnerProcessId();
179     AAudioClientTracker::getInstance().unregisterClientStream(pid, serviceStream);
180     // This is protected by a lock in mStreamTracker.
181     // It is safe to remove the same stream twice.
182     mStreamTracker.removeStreamByHandle(serviceStream->getHandle());
183 
184     return serviceStream->close();
185 }
186 
convertHandleToServiceStream(aaudio_handle_t streamHandle)187 sp<AAudioServiceStreamBase> AAudioService::convertHandleToServiceStream(
188         aaudio_handle_t streamHandle) {
189     sp<AAudioServiceStreamBase> serviceStream = mStreamTracker.getStreamByHandle(
190             streamHandle);
191     if (serviceStream.get() != nullptr) {
192         // Only allow owner or the aaudio service to access the stream.
193         const uid_t callingUserId = IPCThreadState::self()->getCallingUid();
194         const uid_t ownerUserId = serviceStream->getOwnerUserId();
195         bool callerOwnsIt = callingUserId == ownerUserId;
196         bool serverCalling = callingUserId == mAudioClient.clientUid;
197         bool serverOwnsIt = ownerUserId == mAudioClient.clientUid;
198         bool allowed = callerOwnsIt || serverCalling || serverOwnsIt;
199         if (!allowed) {
200             ALOGE("AAudioService: calling uid %d cannot access stream 0x%08X owned by %d",
201                   callingUserId, streamHandle, ownerUserId);
202             serviceStream.clear();
203         }
204     }
205     return serviceStream;
206 }
207 
getStreamDescription(aaudio_handle_t streamHandle,aaudio::AudioEndpointParcelable & parcelable)208 aaudio_result_t AAudioService::getStreamDescription(
209                 aaudio_handle_t streamHandle,
210                 aaudio::AudioEndpointParcelable &parcelable) {
211     sp<AAudioServiceStreamBase> serviceStream = convertHandleToServiceStream(streamHandle);
212     if (serviceStream.get() == nullptr) {
213         ALOGE("getStreamDescription(), illegal stream handle = 0x%0x", streamHandle);
214         return AAUDIO_ERROR_INVALID_HANDLE;
215     }
216     return serviceStream->getDescription(parcelable);
217 }
218 
startStream(aaudio_handle_t streamHandle)219 aaudio_result_t AAudioService::startStream(aaudio_handle_t streamHandle) {
220     sp<AAudioServiceStreamBase> serviceStream = convertHandleToServiceStream(streamHandle);
221     if (serviceStream.get() == nullptr) {
222         ALOGW("%s(), invalid streamHandle = 0x%0x", __func__, streamHandle);
223         return AAUDIO_ERROR_INVALID_HANDLE;
224     }
225     return serviceStream->start();
226 }
227 
pauseStream(aaudio_handle_t streamHandle)228 aaudio_result_t AAudioService::pauseStream(aaudio_handle_t streamHandle) {
229     sp<AAudioServiceStreamBase> serviceStream = convertHandleToServiceStream(streamHandle);
230     if (serviceStream.get() == nullptr) {
231         ALOGW("%s(), invalid streamHandle = 0x%0x", __func__, streamHandle);
232         return AAUDIO_ERROR_INVALID_HANDLE;
233     }
234     return serviceStream->pause();
235 }
236 
stopStream(aaudio_handle_t streamHandle)237 aaudio_result_t AAudioService::stopStream(aaudio_handle_t streamHandle) {
238     sp<AAudioServiceStreamBase> serviceStream = convertHandleToServiceStream(streamHandle);
239     if (serviceStream.get() == nullptr) {
240         ALOGW("%s(), invalid streamHandle = 0x%0x", __func__, streamHandle);
241         return AAUDIO_ERROR_INVALID_HANDLE;
242     }
243     return serviceStream->stop();
244 }
245 
flushStream(aaudio_handle_t streamHandle)246 aaudio_result_t AAudioService::flushStream(aaudio_handle_t streamHandle) {
247     sp<AAudioServiceStreamBase> serviceStream = convertHandleToServiceStream(streamHandle);
248     if (serviceStream.get() == nullptr) {
249         ALOGW("%s(), invalid streamHandle = 0x%0x", __func__, streamHandle);
250         return AAUDIO_ERROR_INVALID_HANDLE;
251     }
252     return serviceStream->flush();
253 }
254 
registerAudioThread(aaudio_handle_t streamHandle,pid_t clientThreadId,int64_t)255 aaudio_result_t AAudioService::registerAudioThread(aaudio_handle_t streamHandle,
256                                                    pid_t clientThreadId,
257                                                    int64_t /* periodNanoseconds */) {
258     sp<AAudioServiceStreamBase> serviceStream = convertHandleToServiceStream(streamHandle);
259     if (serviceStream.get() == nullptr) {
260         ALOGW("%s(), invalid streamHandle = 0x%0x", __func__, streamHandle);
261         return AAUDIO_ERROR_INVALID_HANDLE;
262     }
263     int32_t priority = isCallerInService()
264         ? kRealTimeAudioPriorityService : kRealTimeAudioPriorityClient;
265     return serviceStream->registerAudioThread(clientThreadId, priority);
266 }
267 
unregisterAudioThread(aaudio_handle_t streamHandle,pid_t clientThreadId)268 aaudio_result_t AAudioService::unregisterAudioThread(aaudio_handle_t streamHandle,
269                                                      pid_t clientThreadId) {
270     sp<AAudioServiceStreamBase> serviceStream = convertHandleToServiceStream(streamHandle);
271     if (serviceStream.get() == nullptr) {
272         ALOGW("%s(), invalid streamHandle = 0x%0x", __func__, streamHandle);
273         return AAUDIO_ERROR_INVALID_HANDLE;
274     }
275     return serviceStream->unregisterAudioThread(clientThreadId);
276 }
277 
startClient(aaudio_handle_t streamHandle,const android::AudioClient & client,const audio_attributes_t * attr,audio_port_handle_t * clientHandle)278 aaudio_result_t AAudioService::startClient(aaudio_handle_t streamHandle,
279                                            const android::AudioClient& client,
280                                            const audio_attributes_t *attr,
281                                            audio_port_handle_t *clientHandle) {
282     sp<AAudioServiceStreamBase> serviceStream = convertHandleToServiceStream(streamHandle);
283     if (serviceStream.get() == nullptr) {
284         ALOGW("%s(), invalid streamHandle = 0x%0x", __func__, streamHandle);
285         return AAUDIO_ERROR_INVALID_HANDLE;
286     }
287     return serviceStream->startClient(client, attr, clientHandle);
288 }
289 
stopClient(aaudio_handle_t streamHandle,audio_port_handle_t portHandle)290 aaudio_result_t AAudioService::stopClient(aaudio_handle_t streamHandle,
291                                           audio_port_handle_t portHandle) {
292     sp<AAudioServiceStreamBase> serviceStream = convertHandleToServiceStream(streamHandle);
293     if (serviceStream.get() == nullptr) {
294         ALOGW("%s(), invalid streamHandle = 0x%0x", __func__, streamHandle);
295         return AAUDIO_ERROR_INVALID_HANDLE;
296     }
297     return serviceStream->stopClient(portHandle);
298 }
299 
300 // This is only called internally when AudioFlinger wants to tear down a stream.
301 // So we do not have to check permissions.
disconnectStreamByPortHandle(audio_port_handle_t portHandle)302 aaudio_result_t AAudioService::disconnectStreamByPortHandle(audio_port_handle_t portHandle) {
303     ALOGD("%s(%d) called", __func__, portHandle);
304     sp<AAudioServiceStreamBase> serviceStream =
305             mStreamTracker.findStreamByPortHandle(portHandle);
306     if (serviceStream.get() == nullptr) {
307         ALOGE("%s(), could not find stream with portHandle = %d", __func__, portHandle);
308         return AAUDIO_ERROR_INVALID_HANDLE;
309     }
310     // This is protected by a lock and will just return if already stopped.
311     aaudio_result_t result = serviceStream->stop();
312     serviceStream->disconnect();
313     return result;
314 }
315