1 /*
2  * Copyright (C) 2010 The Android Open Source Project
3  * Copyright (C) 2012-2016, The Linux Foundation. All rights reserved.
4  *
5  * Not a Contribution, Apache license notifications and license are
6  * retained for attribution purposes only.
7 
8  * Licensed under the Apache License, Version 2.0 (the "License");
9  * you may not use this file except in compliance with the License.
10  * You may obtain a copy of the License at
11  *
12  *      http://www.apache.org/licenses/LICENSE-2.0
13  *
14  * Unless required by applicable law or agreed to in writing, software
15  * distributed under the License is distributed on an "AS IS" BASIS,
16  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17  * See the License for the specific language governing permissions and
18  * limitations under the License.
19  */
20 
21 #include <fcntl.h>
22 #include <stdint.h>
23 #include <sys/types.h>
24 #include <binder/Parcel.h>
25 #include <binder/IBinder.h>
26 #include <binder/IInterface.h>
27 #include <binder/IPCThreadState.h>
28 #include <cutils/android_filesystem_config.h>
29 #include <utils/Errors.h>
30 #include <IQService.h>
31 
32 #define QSERVICE_DEBUG 0
33 
34 using namespace android;
35 using namespace qClient;
36 
37 // ---------------------------------------------------------------------------
38 
39 namespace qService {
40 
41 class BpQService : public BpInterface<IQService>
42 {
43 public:
BpQService(const sp<IBinder> & impl)44     BpQService(const sp<IBinder>& impl)
45         : BpInterface<IQService>(impl) {}
46 
connect(const sp<IQClient> & client)47     virtual void connect(const sp<IQClient>& client) {
48         ALOGD_IF(QSERVICE_DEBUG, "%s: connect HWC client", __FUNCTION__);
49         Parcel data, reply;
50         data.writeInterfaceToken(IQService::getInterfaceDescriptor());
51         data.writeStrongBinder(IInterface::asBinder(client));
52         remote()->transact(CONNECT_HWC_CLIENT, data, &reply);
53     }
54 
connect(const sp<IQHDMIClient> & client)55     virtual void connect(const sp<IQHDMIClient>& client) {
56         ALOGD_IF(QSERVICE_DEBUG, "%s: connect HDMI client", __FUNCTION__);
57         Parcel data, reply;
58         data.writeInterfaceToken(IQService::getInterfaceDescriptor());
59         data.writeStrongBinder(IInterface::asBinder(client));
60         remote()->transact(CONNECT_HDMI_CLIENT, data, &reply);
61     }
62 
63 
dispatch(uint32_t command,const Parcel * inParcel,Parcel * outParcel)64     virtual android::status_t dispatch(uint32_t command, const Parcel* inParcel,
65             Parcel* outParcel) {
66         ALOGD_IF(QSERVICE_DEBUG, "%s: dispatch in:%p", __FUNCTION__, inParcel);
67         status_t err = (status_t) android::FAILED_TRANSACTION;
68         Parcel data;
69         Parcel *reply = outParcel;
70         data.writeInterfaceToken(IQService::getInterfaceDescriptor());
71         if (inParcel && inParcel->dataSize() > 0)
72             data.appendFrom(inParcel, 0, inParcel->dataSize());
73         err = remote()->transact(command, data, reply);
74         return err;
75     }
76 };
77 
78 IMPLEMENT_META_INTERFACE(QService, "android.display.IQService");
79 
80 // ----------------------------------------------------------------------
81 
onTransact(uint32_t code,const Parcel & data,Parcel * reply,uint32_t flags)82 status_t BnQService::onTransact(
83     uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
84 {
85     ALOGD_IF(QSERVICE_DEBUG, "%s: code: %d", __FUNCTION__, code);
86     // IPC should be from certain processes only
87     IPCThreadState* ipc = IPCThreadState::self();
88     const int callerPid = ipc->getCallingPid();
89     const int callerUid = ipc->getCallingUid();
90 
91     const bool permission = (callerUid == AID_MEDIA ||
92             callerUid == AID_GRAPHICS ||
93             callerUid == AID_ROOT ||
94             callerUid == AID_CAMERASERVER ||
95             callerUid == AID_AUDIO ||
96             callerUid == AID_SYSTEM ||
97             callerUid == AID_MEDIA_CODEC);
98 
99     if (code == CONNECT_HWC_CLIENT) {
100         CHECK_INTERFACE(IQService, data, reply);
101         if(callerUid != AID_GRAPHICS) {
102             ALOGE("display.qservice CONNECT_HWC_CLIENT access denied: pid=%d uid=%d",
103                    callerPid, callerUid);
104             return PERMISSION_DENIED;
105         }
106         sp<IQClient> client =
107                 interface_cast<IQClient>(data.readStrongBinder());
108         connect(client);
109         return NO_ERROR;
110     } else if(code == CONNECT_HDMI_CLIENT) {
111         CHECK_INTERFACE(IQService, data, reply);
112         if(callerUid != AID_SYSTEM && callerUid != AID_ROOT) {
113             ALOGE("display.qservice CONNECT_HDMI_CLIENT access denied: pid=%d uid=%d",
114                    callerPid, callerUid);
115             return PERMISSION_DENIED;
116         }
117         sp<IQHDMIClient> client =
118                 interface_cast<IQHDMIClient>(data.readStrongBinder());
119         connect(client);
120         return NO_ERROR;
121     } else if (code > COMMAND_LIST_START && code < COMMAND_LIST_END) {
122         if(!permission) {
123             ALOGE("display.qservice access denied: command=%d pid=%d uid=%d",
124                    code, callerPid, callerUid);
125             return PERMISSION_DENIED;
126         }
127         CHECK_INTERFACE(IQService, data, reply);
128         dispatch(code, &data, reply);
129         return NO_ERROR;
130     } else {
131         return BBinder::onTransact(code, data, reply, flags);
132     }
133 }
134 
135 }; // namespace qService
136