|  | /* | 
|  | * Copyright (C) 2018 The Android Open Source Project | 
|  | * | 
|  | * Licensed under the Apache License, Version 2.0 (the "License"); | 
|  | * you may not use this file except in compliance with the License. | 
|  | * You may obtain a copy of the License at | 
|  | * | 
|  | *      http://www.apache.org/licenses/LICENSE-2.0 | 
|  | * | 
|  | * Unless required by applicable law or agreed to in writing, software | 
|  | * distributed under the License is distributed on an "AS IS" BASIS, | 
|  | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | 
|  | * See the License for the specific language governing permissions and | 
|  | * limitations under the License. | 
|  | */ | 
|  |  | 
|  | #include <array> | 
|  | #include <iomanip> | 
|  | #include <random> | 
|  | #include <sstream> | 
|  |  | 
|  | #include <android/hardware_buffer.h> | 
|  | #include <bufferhub/BufferHubService.h> | 
|  | #include <cutils/native_handle.h> | 
|  | #include <log/log.h> | 
|  | #include <openssl/hmac.h> | 
|  | #include <system/graphics-base.h> | 
|  | #include <ui/BufferHubDefs.h> | 
|  |  | 
|  | using ::android::BufferHubDefs::MetadataHeader; | 
|  | using ::android::hardware::Void; | 
|  |  | 
|  | namespace android { | 
|  | namespace frameworks { | 
|  | namespace bufferhub { | 
|  | namespace V1_0 { | 
|  | namespace implementation { | 
|  |  | 
|  | BufferHubService::BufferHubService() { | 
|  | std::mt19937_64 randomEngine; | 
|  | randomEngine.seed(time(nullptr)); | 
|  |  | 
|  | mKey = randomEngine(); | 
|  | } | 
|  |  | 
|  | Return<void> BufferHubService::allocateBuffer(const HardwareBufferDescription& description, | 
|  | const uint32_t userMetadataSize, | 
|  | allocateBuffer_cb _hidl_cb) { | 
|  | AHardwareBuffer_Desc desc; | 
|  | memcpy(&desc, &description, sizeof(AHardwareBuffer_Desc)); | 
|  |  | 
|  | std::shared_ptr<BufferNode> node = | 
|  | std::make_shared<BufferNode>(desc.width, desc.height, desc.layers, desc.format, | 
|  | desc.usage, userMetadataSize, | 
|  | BufferHubIdGenerator::getInstance().getId()); | 
|  | if (node == nullptr || !node->IsValid()) { | 
|  | ALOGE("%s: creating BufferNode failed.", __FUNCTION__); | 
|  | _hidl_cb(/*status=*/BufferHubStatus::ALLOCATION_FAILED, /*bufferClient=*/nullptr, | 
|  | /*bufferTraits=*/{}); | 
|  | return Void(); | 
|  | } | 
|  |  | 
|  | sp<BufferClient> client = BufferClient::create(this, node); | 
|  | // Add it to list for bookkeeping and dumpsys. | 
|  | std::lock_guard<std::mutex> lock(mClientSetMutex); | 
|  | mClientSet.emplace(client); | 
|  |  | 
|  | hidl_handle bufferInfo = | 
|  | buildBufferInfo(node->id(), node->AddNewActiveClientsBitToMask(), | 
|  | node->user_metadata_size(), node->metadata().ashmem_fd()); | 
|  | BufferTraits bufferTraits = {/*bufferDesc=*/description, | 
|  | /*bufferHandle=*/hidl_handle(node->buffer_handle()), | 
|  | /*bufferInfo=*/bufferInfo}; | 
|  |  | 
|  | _hidl_cb(/*status=*/BufferHubStatus::NO_ERROR, /*bufferClient=*/client, | 
|  | /*bufferTraits=*/bufferTraits); | 
|  | return Void(); | 
|  | } | 
|  |  | 
|  | Return<void> BufferHubService::importBuffer(const hidl_handle& tokenHandle, | 
|  | importBuffer_cb _hidl_cb) { | 
|  | if (!tokenHandle.getNativeHandle() || tokenHandle->numFds != 0 || tokenHandle->numInts <= 1) { | 
|  | // nullptr handle or wrong format | 
|  | _hidl_cb(/*status=*/BufferHubStatus::INVALID_TOKEN, /*bufferClient=*/nullptr, | 
|  | /*bufferTraits=*/{}); | 
|  | return Void(); | 
|  | } | 
|  |  | 
|  | int tokenId = tokenHandle->data[0]; | 
|  |  | 
|  | wp<BufferClient> originClientWp; | 
|  | { | 
|  | std::lock_guard<std::mutex> lock(mTokenMutex); | 
|  | auto iter = mTokenMap.find(tokenId); | 
|  | if (iter == mTokenMap.end()) { | 
|  | // Token Id not exist | 
|  | ALOGD("%s: token #%d not found.", __FUNCTION__, tokenId); | 
|  | _hidl_cb(/*status=*/BufferHubStatus::INVALID_TOKEN, /*bufferClient=*/nullptr, | 
|  | /*bufferTraits=*/{}); | 
|  | return Void(); | 
|  | } | 
|  |  | 
|  | const std::vector<uint8_t>& tokenHMAC = iter->second.first; | 
|  |  | 
|  | int numIntsForHMAC = (int)ceil(tokenHMAC.size() * sizeof(uint8_t) / (double)sizeof(int)); | 
|  | if (tokenHandle->numInts - 1 != numIntsForHMAC) { | 
|  | // HMAC size not match | 
|  | ALOGD("%s: token #%d HMAC size not match. Expected: %d Actual: %d", __FUNCTION__, | 
|  | tokenId, numIntsForHMAC, tokenHandle->numInts - 1); | 
|  | _hidl_cb(/*status=*/BufferHubStatus::INVALID_TOKEN, /*bufferClient=*/nullptr, | 
|  | /*bufferTraits=*/{}); | 
|  | return Void(); | 
|  | } | 
|  |  | 
|  | size_t hmacSize = tokenHMAC.size() * sizeof(uint8_t); | 
|  | if (memcmp(tokenHMAC.data(), &tokenHandle->data[1], hmacSize) != 0) { | 
|  | // HMAC not match | 
|  | ALOGD("%s: token #%d HMAC not match.", __FUNCTION__, tokenId); | 
|  | _hidl_cb(/*status=*/BufferHubStatus::INVALID_TOKEN, /*bufferClient=*/nullptr, | 
|  | /*bufferTraits=*/{}); | 
|  | return Void(); | 
|  | } | 
|  |  | 
|  | originClientWp = iter->second.second; | 
|  | mTokenMap.erase(iter); | 
|  | } | 
|  |  | 
|  | // Check if original client is dead | 
|  | sp<BufferClient> originClient = originClientWp.promote(); | 
|  | if (!originClient) { | 
|  | // Should not happen since token should be removed if already gone | 
|  | ALOGE("%s: original client %p gone!", __FUNCTION__, originClientWp.unsafe_get()); | 
|  | _hidl_cb(/*status=*/BufferHubStatus::BUFFER_FREED, /*bufferClient=*/nullptr, | 
|  | /*bufferTraits=*/{}); | 
|  | return Void(); | 
|  | } | 
|  |  | 
|  | sp<BufferClient> client = new BufferClient(*originClient); | 
|  | uint32_t clientStateMask = client->getBufferNode()->AddNewActiveClientsBitToMask(); | 
|  | if (clientStateMask == 0U) { | 
|  | // Reach max client count | 
|  | ALOGE("%s: import failed, BufferNode#%u reached maximum clients.", __FUNCTION__, | 
|  | client->getBufferNode()->id()); | 
|  | _hidl_cb(/*status=*/BufferHubStatus::MAX_CLIENT, /*bufferClient=*/nullptr, | 
|  | /*bufferTraits=*/{}); | 
|  | return Void(); | 
|  | } | 
|  |  | 
|  | std::lock_guard<std::mutex> lock(mClientSetMutex); | 
|  | mClientSet.emplace(client); | 
|  |  | 
|  | std::shared_ptr<BufferNode> node = client->getBufferNode(); | 
|  |  | 
|  | HardwareBufferDescription bufferDesc; | 
|  | memcpy(&bufferDesc, &node->buffer_desc(), sizeof(HardwareBufferDescription)); | 
|  |  | 
|  | hidl_handle bufferInfo = | 
|  | buildBufferInfo(node->id(), clientStateMask, node->user_metadata_size(), | 
|  | node->metadata().ashmem_fd()); | 
|  | BufferTraits bufferTraits = {/*bufferDesc=*/bufferDesc, | 
|  | /*bufferHandle=*/hidl_handle(node->buffer_handle()), | 
|  | /*bufferInfo=*/bufferInfo}; | 
|  |  | 
|  | _hidl_cb(/*status=*/BufferHubStatus::NO_ERROR, /*bufferClient=*/client, | 
|  | /*bufferTraits=*/bufferTraits); | 
|  | return Void(); | 
|  | } | 
|  |  | 
|  | Return<void> BufferHubService::debug(const hidl_handle& fd, const hidl_vec<hidl_string>& args) { | 
|  | if (fd.getNativeHandle() == nullptr || fd->numFds < 1) { | 
|  | ALOGE("%s: missing fd for writing.", __FUNCTION__); | 
|  | return Void(); | 
|  | } | 
|  |  | 
|  | FILE* out = fdopen(dup(fd->data[0]), "w"); | 
|  |  | 
|  | if (args.size() != 0) { | 
|  | fprintf(out, | 
|  | "Note: lshal bufferhub currently does not support args. Input arguments are " | 
|  | "ignored.\n"); | 
|  | } | 
|  |  | 
|  | std::ostringstream stream; | 
|  |  | 
|  | // Get the number of clients of each buffer. | 
|  | // Map from bufferId to bufferNode_clientCount pair. | 
|  | std::map<int, std::pair<const std::shared_ptr<BufferNode>, uint32_t>> clientCount; | 
|  | { | 
|  | std::lock_guard<std::mutex> lock(mClientSetMutex); | 
|  | for (auto iter = mClientSet.begin(); iter != mClientSet.end(); ++iter) { | 
|  | sp<BufferClient> client = iter->promote(); | 
|  | if (client != nullptr) { | 
|  | const std::shared_ptr<BufferNode> node = client->getBufferNode(); | 
|  | auto mapIter = clientCount.find(node->id()); | 
|  | if (mapIter != clientCount.end()) { | 
|  | ++mapIter->second.second; | 
|  | } else { | 
|  | clientCount.emplace(node->id(), | 
|  | std::pair<std::shared_ptr<BufferNode>, uint32_t>(node, 1U)); | 
|  | } | 
|  | } | 
|  | } | 
|  | } | 
|  |  | 
|  | stream << "Active Buffers:\n"; | 
|  | stream << std::right; | 
|  | stream << std::setw(6) << "Id"; | 
|  | stream << " "; | 
|  | stream << std::setw(9) << "Clients"; | 
|  | stream << " "; | 
|  | stream << std::setw(14) << "Geometry"; | 
|  | stream << " "; | 
|  | stream << std::setw(6) << "Format"; | 
|  | stream << " "; | 
|  | stream << std::setw(10) << "Usage"; | 
|  | stream << " "; | 
|  | stream << std::setw(10) << "State"; | 
|  | stream << " "; | 
|  | stream << std::setw(8) << "Index"; | 
|  | stream << std::endl; | 
|  |  | 
|  | for (auto iter = clientCount.begin(); iter != clientCount.end(); ++iter) { | 
|  | const std::shared_ptr<BufferNode> node = std::move(iter->second.first); | 
|  | const uint32_t clientCount = iter->second.second; | 
|  | AHardwareBuffer_Desc desc = node->buffer_desc(); | 
|  |  | 
|  | MetadataHeader* metadataHeader = | 
|  | const_cast<BufferHubMetadata*>(&node->metadata())->metadata_header(); | 
|  | const uint32_t state = metadataHeader->buffer_state.load(std::memory_order_acquire); | 
|  | const uint64_t index = metadataHeader->queue_index; | 
|  |  | 
|  | stream << std::right; | 
|  | stream << std::setw(6) << /*Id=*/node->id(); | 
|  | stream << " "; | 
|  | stream << std::setw(9) << /*Clients=*/clientCount; | 
|  | stream << " "; | 
|  | if (desc.format == HAL_PIXEL_FORMAT_BLOB) { | 
|  | std::string size = std::to_string(desc.width) + " B"; | 
|  | stream << std::setw(14) << /*Geometry=*/size; | 
|  | } else { | 
|  | std::string dimensions = std::to_string(desc.width) + "x" + | 
|  | std::to_string(desc.height) + "x" + std::to_string(desc.layers); | 
|  | stream << std::setw(14) << /*Geometry=*/dimensions; | 
|  | } | 
|  | stream << " "; | 
|  | stream << std::setw(6) << /*Format=*/desc.format; | 
|  | stream << " "; | 
|  | stream << "0x" << std::hex << std::setfill('0'); | 
|  | stream << std::setw(8) << /*Usage=*/desc.usage; | 
|  | stream << std::dec << std::setfill(' '); | 
|  | stream << " "; | 
|  | stream << "0x" << std::hex << std::setfill('0'); | 
|  | stream << std::setw(8) << /*State=*/state; | 
|  | stream << std::dec << std::setfill(' '); | 
|  | stream << " "; | 
|  | stream << std::setw(8) << /*Index=*/index; | 
|  | stream << std::endl; | 
|  | } | 
|  |  | 
|  | stream << std::endl; | 
|  |  | 
|  | // Get the number of tokens of each buffer. | 
|  | // Map from bufferId to tokenCount | 
|  | std::map<int, uint32_t> tokenCount; | 
|  | { | 
|  | std::lock_guard<std::mutex> lock(mTokenMutex); | 
|  | for (auto iter = mTokenMap.begin(); iter != mTokenMap.end(); ++iter) { | 
|  | sp<BufferClient> client = iter->second.second.promote(); | 
|  | if (client != nullptr) { | 
|  | const std::shared_ptr<BufferNode> node = client->getBufferNode(); | 
|  | auto mapIter = tokenCount.find(node->id()); | 
|  | if (mapIter != tokenCount.end()) { | 
|  | ++mapIter->second; | 
|  | } else { | 
|  | tokenCount.emplace(node->id(), 1U); | 
|  | } | 
|  | } | 
|  | } | 
|  | } | 
|  |  | 
|  | stream << "Unused Tokens:\n"; | 
|  | stream << std::right; | 
|  | stream << std::setw(8) << "Buffer Id"; | 
|  | stream << " "; | 
|  | stream << std::setw(6) << "Tokens"; | 
|  | stream << std::endl; | 
|  |  | 
|  | for (auto iter = tokenCount.begin(); iter != tokenCount.end(); ++iter) { | 
|  | stream << std::right; | 
|  | stream << std::setw(8) << /*Buffer Id=*/iter->first; | 
|  | stream << " "; | 
|  | stream << std::setw(6) << /*Tokens=*/iter->second; | 
|  | stream << std::endl; | 
|  | } | 
|  |  | 
|  | fprintf(out, "%s", stream.str().c_str()); | 
|  |  | 
|  | fclose(out); | 
|  | return Void(); | 
|  | } | 
|  |  | 
|  | hidl_handle BufferHubService::registerToken(const wp<BufferClient>& client) { | 
|  | // Find next available token id | 
|  | std::lock_guard<std::mutex> lock(mTokenMutex); | 
|  | do { | 
|  | ++mLastTokenId; | 
|  | } while (mTokenMap.find(mLastTokenId) != mTokenMap.end()); | 
|  |  | 
|  | std::array<uint8_t, EVP_MAX_MD_SIZE> hmac; | 
|  | uint32_t hmacSize = 0U; | 
|  |  | 
|  | HMAC(/*evp_md=*/EVP_sha256(), /*key=*/&mKey, /*key_len=*/kKeyLen, | 
|  | /*data=*/(uint8_t*)&mLastTokenId, /*data_len=*/mTokenIdSize, | 
|  | /*out=*/hmac.data(), /*out_len=*/&hmacSize); | 
|  |  | 
|  | int numIntsForHMAC = (int)ceil(hmacSize / (double)sizeof(int)); | 
|  | native_handle_t* handle = native_handle_create(/*numFds=*/0, /*numInts=*/1 + numIntsForHMAC); | 
|  | handle->data[0] = mLastTokenId; | 
|  | // Set all the the bits of last int to 0 since it might not be fully overwritten | 
|  | handle->data[numIntsForHMAC] = 0; | 
|  | memcpy(&handle->data[1], hmac.data(), hmacSize); | 
|  |  | 
|  | // returnToken owns the native_handle_t* thus doing lifecycle management | 
|  | hidl_handle returnToken; | 
|  | returnToken.setTo(handle, /*shoudOwn=*/true); | 
|  |  | 
|  | std::vector<uint8_t> hmacVec; | 
|  | hmacVec.resize(hmacSize); | 
|  | memcpy(hmacVec.data(), hmac.data(), hmacSize); | 
|  | mTokenMap.emplace(mLastTokenId, std::pair(hmacVec, client)); | 
|  |  | 
|  | return returnToken; | 
|  | } | 
|  |  | 
|  | void BufferHubService::onClientClosed(const BufferClient* client) { | 
|  | removeTokenByClient(client); | 
|  |  | 
|  | std::lock_guard<std::mutex> lock(mClientSetMutex); | 
|  | auto iter = std::find(mClientSet.begin(), mClientSet.end(), client); | 
|  | if (iter != mClientSet.end()) { | 
|  | mClientSet.erase(iter); | 
|  | } | 
|  | } | 
|  |  | 
|  | // Implementation of this function should be consistent with the definition of bufferInfo handle in | 
|  | // ui/BufferHubDefs.h. | 
|  | hidl_handle BufferHubService::buildBufferInfo(int bufferId, uint32_t clientBitMask, | 
|  | uint32_t userMetadataSize, const int metadataFd) { | 
|  | native_handle_t* infoHandle = native_handle_create(BufferHubDefs::kBufferInfoNumFds, | 
|  | BufferHubDefs::kBufferInfoNumInts); | 
|  |  | 
|  | infoHandle->data[0] = dup(metadataFd); | 
|  | infoHandle->data[1] = bufferId; | 
|  | // Use memcpy to convert to int without missing digit. | 
|  | // TOOD(b/121345852): use bit_cast to unpack bufferInfo when C++20 becomes available. | 
|  | memcpy(&infoHandle->data[2], &clientBitMask, sizeof(clientBitMask)); | 
|  | memcpy(&infoHandle->data[3], &userMetadataSize, sizeof(userMetadataSize)); | 
|  |  | 
|  | hidl_handle bufferInfo; | 
|  | bufferInfo.setTo(infoHandle, /*shouldOwn=*/true); | 
|  |  | 
|  | return bufferInfo; | 
|  | } | 
|  |  | 
|  | void BufferHubService::removeTokenByClient(const BufferClient* client) { | 
|  | std::lock_guard<std::mutex> lock(mTokenMutex); | 
|  | auto iter = mTokenMap.begin(); | 
|  | while (iter != mTokenMap.end()) { | 
|  | if (iter->second.second == client) { | 
|  | auto oldIter = iter; | 
|  | ++iter; | 
|  | mTokenMap.erase(oldIter); | 
|  | } else { | 
|  | ++iter; | 
|  | } | 
|  | } | 
|  | } | 
|  |  | 
|  | } // namespace implementation | 
|  | } // namespace V1_0 | 
|  | } // namespace bufferhub | 
|  | } // namespace frameworks | 
|  | } // namespace android |