IOMX.cpp revision 3e328782f1e1061d08ea0c45b855cc418a2d9ea6 
1/*
2 * Copyright (c) 2009 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *     http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17//#define LOG_NDEBUG 0
18#define LOG_TAG "IOMX"
19#include <utils/Log.h>
20
21#include <sys/mman.h>
22
23#include <binder/IMemory.h>
24#include <binder/Parcel.h>
25#include <media/IOMX.h>
26#include <media/stagefright/foundation/ADebug.h>
27#include <media/openmax/OMX_IndexExt.h>
28#include <utils/NativeHandle.h>
29
30namespace android {
31
32enum {
33    CONNECT = IBinder::FIRST_CALL_TRANSACTION,
34    LIVES_LOCALLY,
35    LIST_NODES,
36    ALLOCATE_NODE,
37    FREE_NODE,
38    SEND_COMMAND,
39    GET_PARAMETER,
40    SET_PARAMETER,
41    GET_CONFIG,
42    SET_CONFIG,
43    GET_STATE,
44    ENABLE_NATIVE_BUFFERS,
45    USE_BUFFER,
46    USE_GRAPHIC_BUFFER,
47    CREATE_INPUT_SURFACE,
48    CREATE_PERSISTENT_INPUT_SURFACE,
49    SET_INPUT_SURFACE,
50    SIGNAL_END_OF_INPUT_STREAM,
51    STORE_META_DATA_IN_BUFFERS,
52    PREPARE_FOR_ADAPTIVE_PLAYBACK,
53    ALLOC_SECURE_BUFFER,
54    ALLOC_BUFFER_WITH_BACKUP,
55    FREE_BUFFER,
56    FILL_BUFFER,
57    EMPTY_BUFFER,
58    GET_EXTENSION_INDEX,
59    OBSERVER_ON_MSG,
60    GET_GRAPHIC_BUFFER_USAGE,
61    SET_INTERNAL_OPTION,
62    UPDATE_GRAPHIC_BUFFER_IN_META,
63    CONFIGURE_VIDEO_TUNNEL_MODE,
64    UPDATE_NATIVE_HANDLE_IN_META,
65};
66
67class BpOMX : public BpInterface<IOMX> {
68public:
69    BpOMX(const sp<IBinder> &impl)
70        : BpInterface<IOMX>(impl) {
71    }
72
73    virtual bool livesLocally(node_id node, pid_t pid) {
74        Parcel data, reply;
75        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
76        data.writeInt32((int32_t)node);
77        data.writeInt32(pid);
78        remote()->transact(LIVES_LOCALLY, data, &reply);
79
80        return reply.readInt32() != 0;
81    }
82
83    virtual status_t listNodes(List<ComponentInfo> *list) {
84        list->clear();
85
86        Parcel data, reply;
87        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
88        remote()->transact(LIST_NODES, data, &reply);
89
90        int32_t n = reply.readInt32();
91        for (int32_t i = 0; i < n; ++i) {
92            list->push_back(ComponentInfo());
93            ComponentInfo &info = *--list->end();
94
95            info.mName = reply.readString8();
96            int32_t numRoles = reply.readInt32();
97            for (int32_t j = 0; j < numRoles; ++j) {
98                info.mRoles.push_back(reply.readString8());
99            }
100        }
101
102        return OK;
103    }
104
105    virtual status_t allocateNode(
106            const char *name, const sp<IOMXObserver> &observer,
107            sp<IBinder> *nodeBinder,
108            node_id *node) {
109        Parcel data, reply;
110        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
111        data.writeCString(name);
112        data.writeStrongBinder(IInterface::asBinder(observer));
113        remote()->transact(ALLOCATE_NODE, data, &reply);
114
115        status_t err = reply.readInt32();
116        if (err == OK) {
117            *node = (node_id)reply.readInt32();
118            if (nodeBinder != NULL) {
119                *nodeBinder = remote();
120            }
121        } else {
122            *node = 0;
123        }
124
125        return err;
126    }
127
128    virtual status_t freeNode(node_id node) {
129        Parcel data, reply;
130        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
131        data.writeInt32((int32_t)node);
132        remote()->transact(FREE_NODE, data, &reply);
133
134        return reply.readInt32();
135    }
136
137    virtual status_t sendCommand(
138            node_id node, OMX_COMMANDTYPE cmd, OMX_S32 param) {
139        Parcel data, reply;
140        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
141        data.writeInt32((int32_t)node);
142        data.writeInt32(cmd);
143        data.writeInt32(param);
144        remote()->transact(SEND_COMMAND, data, &reply);
145
146        return reply.readInt32();
147    }
148
149    virtual status_t getParameter(
150            node_id node, OMX_INDEXTYPE index,
151            void *params, size_t size) {
152        Parcel data, reply;
153        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
154        data.writeInt32((int32_t)node);
155        data.writeInt32(index);
156        data.writeInt64(size);
157        data.write(params, size);
158        remote()->transact(GET_PARAMETER, data, &reply);
159
160        status_t err = reply.readInt32();
161        if (err != OK) {
162            return err;
163        }
164
165        reply.read(params, size);
166
167        return OK;
168    }
169
170    virtual status_t setParameter(
171            node_id node, OMX_INDEXTYPE index,
172            const void *params, size_t size) {
173        Parcel data, reply;
174        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
175        data.writeInt32((int32_t)node);
176        data.writeInt32(index);
177        data.writeInt64(size);
178        data.write(params, size);
179        remote()->transact(SET_PARAMETER, data, &reply);
180
181        return reply.readInt32();
182    }
183
184    virtual status_t getConfig(
185            node_id node, OMX_INDEXTYPE index,
186            void *params, size_t size) {
187        Parcel data, reply;
188        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
189        data.writeInt32((int32_t)node);
190        data.writeInt32(index);
191        data.writeInt64(size);
192        data.write(params, size);
193        remote()->transact(GET_CONFIG, data, &reply);
194
195        status_t err = reply.readInt32();
196        if (err != OK) {
197            return err;
198        }
199
200        reply.read(params, size);
201
202        return OK;
203    }
204
205    virtual status_t setConfig(
206            node_id node, OMX_INDEXTYPE index,
207            const void *params, size_t size) {
208        Parcel data, reply;
209        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
210        data.writeInt32((int32_t)node);
211        data.writeInt32(index);
212        data.writeInt64(size);
213        data.write(params, size);
214        remote()->transact(SET_CONFIG, data, &reply);
215
216        return reply.readInt32();
217    }
218
219    virtual status_t getState(
220            node_id node, OMX_STATETYPE* state) {
221        Parcel data, reply;
222        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
223        data.writeInt32((int32_t)node);
224        remote()->transact(GET_STATE, data, &reply);
225
226        *state = static_cast<OMX_STATETYPE>(reply.readInt32());
227        return reply.readInt32();
228    }
229
230    virtual status_t enableNativeBuffers(
231            node_id node, OMX_U32 port_index, OMX_BOOL graphic, OMX_BOOL enable) {
232        Parcel data, reply;
233        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
234        data.writeInt32((int32_t)node);
235        data.writeInt32(port_index);
236        data.writeInt32((uint32_t)graphic);
237        data.writeInt32((uint32_t)enable);
238        remote()->transact(ENABLE_NATIVE_BUFFERS, data, &reply);
239
240        status_t err = reply.readInt32();
241        return err;
242    }
243
244    virtual status_t getGraphicBufferUsage(
245            node_id node, OMX_U32 port_index, OMX_U32* usage) {
246        Parcel data, reply;
247        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
248        data.writeInt32((int32_t)node);
249        data.writeInt32(port_index);
250        remote()->transact(GET_GRAPHIC_BUFFER_USAGE, data, &reply);
251
252        status_t err = reply.readInt32();
253        *usage = reply.readInt32();
254        return err;
255    }
256
257    virtual status_t useBuffer(
258            node_id node, OMX_U32 port_index, const sp<IMemory> &params,
259            buffer_id *buffer, OMX_U32 allottedSize) {
260        Parcel data, reply;
261        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
262        data.writeInt32((int32_t)node);
263        data.writeInt32(port_index);
264        data.writeStrongBinder(IInterface::asBinder(params));
265        data.writeInt32(allottedSize);
266        remote()->transact(USE_BUFFER, data, &reply);
267
268        status_t err = reply.readInt32();
269        if (err != OK) {
270            *buffer = 0;
271
272            return err;
273        }
274
275        *buffer = (buffer_id)reply.readInt32();
276
277        return err;
278    }
279
280
281    virtual status_t useGraphicBuffer(
282            node_id node, OMX_U32 port_index,
283            const sp<GraphicBuffer> &graphicBuffer, buffer_id *buffer) {
284        Parcel data, reply;
285        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
286        data.writeInt32((int32_t)node);
287        data.writeInt32(port_index);
288        data.write(*graphicBuffer);
289        remote()->transact(USE_GRAPHIC_BUFFER, data, &reply);
290
291        status_t err = reply.readInt32();
292        if (err != OK) {
293            *buffer = 0;
294
295            return err;
296        }
297
298        *buffer = (buffer_id)reply.readInt32();
299
300        return err;
301    }
302
303    virtual status_t updateGraphicBufferInMeta(
304            node_id node, OMX_U32 port_index,
305            const sp<GraphicBuffer> &graphicBuffer, buffer_id buffer) {
306        Parcel data, reply;
307        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
308        data.writeInt32((int32_t)node);
309        data.writeInt32(port_index);
310        data.write(*graphicBuffer);
311        data.writeInt32((int32_t)buffer);
312        remote()->transact(UPDATE_GRAPHIC_BUFFER_IN_META, data, &reply);
313
314        status_t err = reply.readInt32();
315        return err;
316    }
317
318    virtual status_t updateNativeHandleInMeta(
319            node_id node, OMX_U32 port_index,
320            const sp<NativeHandle> &nativeHandle, buffer_id buffer) {
321        Parcel data, reply;
322        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
323        data.writeInt32((int32_t)node);
324        data.writeInt32(port_index);
325        data.writeInt32(nativeHandle != NULL);
326        if (nativeHandle != NULL) {
327            data.writeNativeHandle(nativeHandle->handle());
328        }
329        data.writeInt32((int32_t)buffer);
330        remote()->transact(UPDATE_NATIVE_HANDLE_IN_META, data, &reply);
331
332        status_t err = reply.readInt32();
333        return err;
334    }
335
336    virtual status_t createInputSurface(
337            node_id node, OMX_U32 port_index, android_dataspace dataSpace,
338            sp<IGraphicBufferProducer> *bufferProducer, MetadataBufferType *type) {
339        Parcel data, reply;
340        status_t err;
341        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
342        data.writeInt32((int32_t)node);
343        data.writeInt32(port_index);
344        data.writeInt32(dataSpace);
345        err = remote()->transact(CREATE_INPUT_SURFACE, data, &reply);
346        if (err != OK) {
347            ALOGW("binder transaction failed: %d", err);
348            return err;
349        }
350
351        // read type even if createInputSurface failed
352        int negotiatedType = reply.readInt32();
353        if (type != NULL) {
354            *type = (MetadataBufferType)negotiatedType;
355        }
356
357        err = reply.readInt32();
358        if (err != OK) {
359            return err;
360        }
361
362        *bufferProducer = IGraphicBufferProducer::asInterface(
363                reply.readStrongBinder());
364
365        return err;
366    }
367
368    virtual status_t createPersistentInputSurface(
369            sp<IGraphicBufferProducer> *bufferProducer,
370            sp<IGraphicBufferConsumer> *bufferConsumer) {
371        Parcel data, reply;
372        status_t err;
373        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
374        err = remote()->transact(CREATE_PERSISTENT_INPUT_SURFACE, data, &reply);
375        if (err != OK) {
376            ALOGW("binder transaction failed: %d", err);
377            return err;
378        }
379
380        err = reply.readInt32();
381        if (err != OK) {
382            return err;
383        }
384
385        *bufferProducer = IGraphicBufferProducer::asInterface(
386                reply.readStrongBinder());
387        *bufferConsumer = IGraphicBufferConsumer::asInterface(
388                reply.readStrongBinder());
389
390        return err;
391    }
392
393    virtual status_t setInputSurface(
394            node_id node, OMX_U32 port_index,
395            const sp<IGraphicBufferConsumer> &bufferConsumer, MetadataBufferType *type) {
396        Parcel data, reply;
397        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
398        status_t err;
399        data.writeInt32((int32_t)node);
400        data.writeInt32(port_index);
401        data.writeStrongBinder(IInterface::asBinder(bufferConsumer));
402
403        err = remote()->transact(SET_INPUT_SURFACE, data, &reply);
404
405        if (err != OK) {
406            ALOGW("binder transaction failed: %d", err);
407            return err;
408        }
409
410        // read type even if setInputSurface failed
411        int negotiatedType = reply.readInt32();
412        if (type != NULL) {
413            *type = (MetadataBufferType)negotiatedType;
414        }
415
416        return reply.readInt32();
417    }
418
419    virtual status_t signalEndOfInputStream(node_id node) {
420        Parcel data, reply;
421        status_t err;
422        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
423        data.writeInt32((int32_t)node);
424        err = remote()->transact(SIGNAL_END_OF_INPUT_STREAM, data, &reply);
425        if (err != OK) {
426            ALOGW("binder transaction failed: %d", err);
427            return err;
428        }
429
430        return reply.readInt32();
431    }
432
433    virtual status_t storeMetaDataInBuffers(
434            node_id node, OMX_U32 port_index, OMX_BOOL enable, MetadataBufferType *type) {
435        Parcel data, reply;
436        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
437        data.writeInt32((int32_t)node);
438        data.writeInt32(port_index);
439        data.writeInt32((int32_t)enable);
440        data.writeInt32(type == NULL ? kMetadataBufferTypeANWBuffer : *type);
441
442        remote()->transact(STORE_META_DATA_IN_BUFFERS, data, &reply);
443
444        // read type even storeMetaDataInBuffers failed
445        int negotiatedType = reply.readInt32();
446        if (type != NULL) {
447            *type = (MetadataBufferType)negotiatedType;
448        }
449
450        return reply.readInt32();
451    }
452
453    virtual status_t prepareForAdaptivePlayback(
454            node_id node, OMX_U32 port_index, OMX_BOOL enable,
455            OMX_U32 max_width, OMX_U32 max_height) {
456        Parcel data, reply;
457        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
458        data.writeInt32((int32_t)node);
459        data.writeInt32(port_index);
460        data.writeInt32((int32_t)enable);
461        data.writeInt32(max_width);
462        data.writeInt32(max_height);
463        remote()->transact(PREPARE_FOR_ADAPTIVE_PLAYBACK, data, &reply);
464
465        status_t err = reply.readInt32();
466        return err;
467    }
468
469    virtual status_t configureVideoTunnelMode(
470            node_id node, OMX_U32 portIndex, OMX_BOOL tunneled,
471            OMX_U32 audioHwSync, native_handle_t **sidebandHandle ) {
472        Parcel data, reply;
473        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
474        data.writeInt32((int32_t)node);
475        data.writeInt32(portIndex);
476        data.writeInt32((int32_t)tunneled);
477        data.writeInt32(audioHwSync);
478        remote()->transact(CONFIGURE_VIDEO_TUNNEL_MODE, data, &reply);
479
480        status_t err = reply.readInt32();
481        if (err == OK && sidebandHandle) {
482            *sidebandHandle = (native_handle_t *)reply.readNativeHandle();
483        }
484        return err;
485    }
486
487
488    virtual status_t allocateSecureBuffer(
489            node_id node, OMX_U32 port_index, size_t size,
490            buffer_id *buffer, void **buffer_data, native_handle_t **native_handle) {
491        Parcel data, reply;
492        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
493        data.writeInt32((int32_t)node);
494        data.writeInt32(port_index);
495        data.writeInt64(size);
496        remote()->transact(ALLOC_SECURE_BUFFER, data, &reply);
497
498        status_t err = reply.readInt32();
499        if (err != OK) {
500            *buffer = 0;
501            *buffer_data = NULL;
502            *native_handle = NULL;
503            return err;
504        }
505
506        *buffer = (buffer_id)reply.readInt32();
507        *buffer_data = (void *)reply.readInt64();
508        if (*buffer_data == NULL) {
509            *native_handle = reply.readNativeHandle();
510        } else {
511            *native_handle = NULL;
512        }
513        return err;
514    }
515
516    virtual status_t allocateBufferWithBackup(
517            node_id node, OMX_U32 port_index, const sp<IMemory> &params,
518            buffer_id *buffer, OMX_U32 allottedSize) {
519        Parcel data, reply;
520        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
521        data.writeInt32((int32_t)node);
522        data.writeInt32(port_index);
523        data.writeStrongBinder(IInterface::asBinder(params));
524        data.writeInt32(allottedSize);
525        remote()->transact(ALLOC_BUFFER_WITH_BACKUP, data, &reply);
526
527        status_t err = reply.readInt32();
528        if (err != OK) {
529            *buffer = 0;
530
531            return err;
532        }
533
534        *buffer = (buffer_id)reply.readInt32();
535
536        return err;
537    }
538
539    virtual status_t freeBuffer(
540            node_id node, OMX_U32 port_index, buffer_id buffer) {
541        Parcel data, reply;
542        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
543        data.writeInt32((int32_t)node);
544        data.writeInt32(port_index);
545        data.writeInt32((int32_t)buffer);
546        remote()->transact(FREE_BUFFER, data, &reply);
547
548        return reply.readInt32();
549    }
550
551    virtual status_t fillBuffer(node_id node, buffer_id buffer, int fenceFd) {
552        Parcel data, reply;
553        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
554        data.writeInt32((int32_t)node);
555        data.writeInt32((int32_t)buffer);
556        data.writeInt32(fenceFd >= 0);
557        if (fenceFd >= 0) {
558            data.writeFileDescriptor(fenceFd, true /* takeOwnership */);
559        }
560        remote()->transact(FILL_BUFFER, data, &reply);
561
562        return reply.readInt32();
563    }
564
565    virtual status_t emptyBuffer(
566            node_id node,
567            buffer_id buffer,
568            OMX_U32 range_offset, OMX_U32 range_length,
569            OMX_U32 flags, OMX_TICKS timestamp, int fenceFd) {
570        Parcel data, reply;
571        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
572        data.writeInt32((int32_t)node);
573        data.writeInt32((int32_t)buffer);
574        data.writeInt32(range_offset);
575        data.writeInt32(range_length);
576        data.writeInt32(flags);
577        data.writeInt64(timestamp);
578        data.writeInt32(fenceFd >= 0);
579        if (fenceFd >= 0) {
580            data.writeFileDescriptor(fenceFd, true /* takeOwnership */);
581        }
582        remote()->transact(EMPTY_BUFFER, data, &reply);
583
584        return reply.readInt32();
585    }
586
587    virtual status_t getExtensionIndex(
588            node_id node,
589            const char *parameter_name,
590            OMX_INDEXTYPE *index) {
591        Parcel data, reply;
592        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
593        data.writeInt32((int32_t)node);
594        data.writeCString(parameter_name);
595
596        remote()->transact(GET_EXTENSION_INDEX, data, &reply);
597
598        status_t err = reply.readInt32();
599        if (err == OK) {
600            *index = static_cast<OMX_INDEXTYPE>(reply.readInt32());
601        } else {
602            *index = OMX_IndexComponentStartUnused;
603        }
604
605        return err;
606    }
607
608    virtual status_t setInternalOption(
609            node_id node,
610            OMX_U32 port_index,
611            InternalOptionType type,
612            const void *optionData,
613            size_t size) {
614        Parcel data, reply;
615        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
616        data.writeInt32((int32_t)node);
617        data.writeInt32(port_index);
618        data.writeInt64(size);
619        data.write(optionData, size);
620        data.writeInt32(type);
621        remote()->transact(SET_INTERNAL_OPTION, data, &reply);
622
623        return reply.readInt32();
624    }
625};
626
627IMPLEMENT_META_INTERFACE(OMX, "android.hardware.IOMX");
628
629////////////////////////////////////////////////////////////////////////////////
630
631#define CHECK_OMX_INTERFACE(interface, data, reply) \
632        do { if (!data.enforceInterface(interface::getInterfaceDescriptor())) { \
633            ALOGW("Call incorrectly routed to " #interface); \
634            return PERMISSION_DENIED; \
635        } } while (0)
636
637status_t BnOMX::onTransact(
638    uint32_t code, const Parcel &data, Parcel *reply, uint32_t flags) {
639    switch (code) {
640        case LIVES_LOCALLY:
641        {
642            CHECK_OMX_INTERFACE(IOMX, data, reply);
643            node_id node = (node_id)data.readInt32();
644            pid_t pid = (pid_t)data.readInt32();
645            reply->writeInt32(livesLocally(node, pid));
646
647            return OK;
648        }
649
650        case LIST_NODES:
651        {
652            CHECK_OMX_INTERFACE(IOMX, data, reply);
653
654            List<ComponentInfo> list;
655            listNodes(&list);
656
657            reply->writeInt32(list.size());
658            for (List<ComponentInfo>::iterator it = list.begin();
659                 it != list.end(); ++it) {
660                ComponentInfo &cur = *it;
661
662                reply->writeString8(cur.mName);
663                reply->writeInt32(cur.mRoles.size());
664                for (List<String8>::iterator role_it = cur.mRoles.begin();
665                     role_it != cur.mRoles.end(); ++role_it) {
666                    reply->writeString8(*role_it);
667                }
668            }
669
670            return NO_ERROR;
671        }
672
673        case ALLOCATE_NODE:
674        {
675            CHECK_OMX_INTERFACE(IOMX, data, reply);
676
677            const char *name = data.readCString();
678
679            sp<IOMXObserver> observer =
680                interface_cast<IOMXObserver>(data.readStrongBinder());
681
682            if (name == NULL || observer == NULL) {
683                ALOGE("b/26392700");
684                reply->writeInt32(INVALID_OPERATION);
685                return NO_ERROR;
686            }
687
688            node_id node;
689
690            status_t err = allocateNode(name, observer,
691                    NULL /* nodeBinder */, &node);
692            reply->writeInt32(err);
693            if (err == OK) {
694                reply->writeInt32((int32_t)node);
695            }
696
697            return NO_ERROR;
698        }
699
700        case FREE_NODE:
701        {
702            CHECK_OMX_INTERFACE(IOMX, data, reply);
703
704            node_id node = (node_id)data.readInt32();
705
706            reply->writeInt32(freeNode(node));
707
708            return NO_ERROR;
709        }
710
711        case SEND_COMMAND:
712        {
713            CHECK_OMX_INTERFACE(IOMX, data, reply);
714
715            node_id node = (node_id)data.readInt32();
716
717            OMX_COMMANDTYPE cmd =
718                static_cast<OMX_COMMANDTYPE>(data.readInt32());
719
720            OMX_S32 param = data.readInt32();
721            reply->writeInt32(sendCommand(node, cmd, param));
722
723            return NO_ERROR;
724        }
725
726        case GET_PARAMETER:
727        case SET_PARAMETER:
728        case GET_CONFIG:
729        case SET_CONFIG:
730        case SET_INTERNAL_OPTION:
731        {
732            CHECK_OMX_INTERFACE(IOMX, data, reply);
733
734            node_id node = (node_id)data.readInt32();
735            OMX_INDEXTYPE index = static_cast<OMX_INDEXTYPE>(data.readInt32());
736
737            size_t size = data.readInt64();
738
739            status_t err = NOT_ENOUGH_DATA;
740            void *params = NULL;
741            size_t pageSize = 0;
742            size_t allocSize = 0;
743            bool isUsageBits = (index == (OMX_INDEXTYPE) OMX_IndexParamConsumerUsageBits);
744            if ((isUsageBits && size < 4) ||
745                    (!isUsageBits && code != SET_INTERNAL_OPTION && size < 8)) {
746                // we expect the structure to contain at least the size and
747                // version, 8 bytes total
748                ALOGE("b/27207275 (%zu) (%d/%d)", size, int(index), int(code));
749                android_errorWriteLog(0x534e4554, "27207275");
750            } else {
751                err = NO_MEMORY;
752                pageSize = (size_t) sysconf(_SC_PAGE_SIZE);
753                if (size > SIZE_MAX - (pageSize * 2)) {
754                    ALOGE("requested param size too big");
755                } else {
756                    allocSize = (size + pageSize * 2) & ~(pageSize - 1);
757                    params = mmap(NULL, allocSize, PROT_READ | PROT_WRITE,
758                            MAP_PRIVATE | MAP_ANONYMOUS, -1 /* fd */, 0 /* offset */);
759                }
760                if (params != MAP_FAILED) {
761                    err = data.read(params, size);
762                    if (err != OK) {
763                        android_errorWriteLog(0x534e4554, "26914474");
764                    } else {
765                        err = NOT_ENOUGH_DATA;
766                        OMX_U32 declaredSize = *(OMX_U32*)params;
767                        if (code != SET_INTERNAL_OPTION &&
768                                index != (OMX_INDEXTYPE) OMX_IndexParamConsumerUsageBits &&
769                                declaredSize > size) {
770                            // the buffer says it's bigger than it actually is
771                            ALOGE("b/27207275 (%u/%zu)", declaredSize, size);
772                            android_errorWriteLog(0x534e4554, "27207275");
773                        } else {
774                            // mark the last page as inaccessible, to avoid exploitation
775                            // of codecs that access past the end of the allocation because
776                            // they didn't check the size
777                            mprotect((char*)params + allocSize - pageSize, pageSize, PROT_NONE);
778                            switch (code) {
779                                case GET_PARAMETER:
780                                    err = getParameter(node, index, params, size);
781                                    break;
782                                case SET_PARAMETER:
783                                    err = setParameter(node, index, params, size);
784                                    break;
785                                case GET_CONFIG:
786                                    err = getConfig(node, index, params, size);
787                                    break;
788                                case SET_CONFIG:
789                                    err = setConfig(node, index, params, size);
790                                    break;
791                                case SET_INTERNAL_OPTION:
792                                {
793                                    InternalOptionType type =
794                                        (InternalOptionType)data.readInt32();
795
796                                    err = setInternalOption(node, index, type, params, size);
797                                    break;
798                                }
799
800                                default:
801                                    TRESPASS();
802                            }
803                        }
804                    }
805                } else {
806                    ALOGE("couldn't map: %s", strerror(errno));
807                }
808            }
809
810            reply->writeInt32(err);
811
812            if ((code == GET_PARAMETER || code == GET_CONFIG) && err == OK) {
813                reply->write(params, size);
814            }
815
816            if (params) {
817                munmap(params, allocSize);
818            }
819            params = NULL;
820
821            return NO_ERROR;
822        }
823
824        case GET_STATE:
825        {
826            CHECK_OMX_INTERFACE(IOMX, data, reply);
827
828            node_id node = (node_id)data.readInt32();
829            OMX_STATETYPE state = OMX_StateInvalid;
830
831            status_t err = getState(node, &state);
832            reply->writeInt32(state);
833            reply->writeInt32(err);
834
835            return NO_ERROR;
836        }
837
838        case ENABLE_NATIVE_BUFFERS:
839        {
840            CHECK_OMX_INTERFACE(IOMX, data, reply);
841
842            node_id node = (node_id)data.readInt32();
843            OMX_U32 port_index = data.readInt32();
844            OMX_BOOL graphic = (OMX_BOOL)data.readInt32();
845            OMX_BOOL enable = (OMX_BOOL)data.readInt32();
846
847            status_t err = enableNativeBuffers(node, port_index, graphic, enable);
848            reply->writeInt32(err);
849
850            return NO_ERROR;
851        }
852
853        case GET_GRAPHIC_BUFFER_USAGE:
854        {
855            CHECK_OMX_INTERFACE(IOMX, data, reply);
856
857            node_id node = (node_id)data.readInt32();
858            OMX_U32 port_index = data.readInt32();
859
860            OMX_U32 usage = 0;
861            status_t err = getGraphicBufferUsage(node, port_index, &usage);
862            reply->writeInt32(err);
863            reply->writeInt32(usage);
864
865            return NO_ERROR;
866        }
867
868        case USE_BUFFER:
869        {
870            CHECK_OMX_INTERFACE(IOMX, data, reply);
871
872            node_id node = (node_id)data.readInt32();
873            OMX_U32 port_index = data.readInt32();
874            sp<IMemory> params =
875                interface_cast<IMemory>(data.readStrongBinder());
876            OMX_U32 allottedSize = data.readInt32();
877
878            if (params == NULL) {
879                ALOGE("b/26392700");
880                reply->writeInt32(INVALID_OPERATION);
881                return NO_ERROR;
882            }
883
884            buffer_id buffer;
885            status_t err = useBuffer(node, port_index, params, &buffer, allottedSize);
886            reply->writeInt32(err);
887
888            if (err == OK) {
889                reply->writeInt32((int32_t)buffer);
890            }
891
892            return NO_ERROR;
893        }
894
895        case USE_GRAPHIC_BUFFER:
896        {
897            CHECK_OMX_INTERFACE(IOMX, data, reply);
898
899            node_id node = (node_id)data.readInt32();
900            OMX_U32 port_index = data.readInt32();
901            sp<GraphicBuffer> graphicBuffer = new GraphicBuffer();
902            data.read(*graphicBuffer);
903
904            buffer_id buffer;
905            status_t err = useGraphicBuffer(
906                    node, port_index, graphicBuffer, &buffer);
907            reply->writeInt32(err);
908
909            if (err == OK) {
910                reply->writeInt32((int32_t)buffer);
911            }
912
913            return NO_ERROR;
914        }
915
916        case UPDATE_GRAPHIC_BUFFER_IN_META:
917        {
918            CHECK_OMX_INTERFACE(IOMX, data, reply);
919
920            node_id node = (node_id)data.readInt32();
921            OMX_U32 port_index = data.readInt32();
922            sp<GraphicBuffer> graphicBuffer = new GraphicBuffer();
923            data.read(*graphicBuffer);
924            buffer_id buffer = (buffer_id)data.readInt32();
925
926            status_t err = updateGraphicBufferInMeta(
927                    node, port_index, graphicBuffer, buffer);
928            reply->writeInt32(err);
929
930            return NO_ERROR;
931        }
932
933        case UPDATE_NATIVE_HANDLE_IN_META:
934        {
935            CHECK_OMX_INTERFACE(IOMX, data, reply);
936
937            node_id node = (node_id)data.readInt32();
938            OMX_U32 port_index = data.readInt32();
939            native_handle *handle = NULL;
940            if (data.readInt32()) {
941                handle = data.readNativeHandle();
942            }
943            buffer_id buffer = (buffer_id)data.readInt32();
944
945            status_t err = updateNativeHandleInMeta(
946                    node, port_index, NativeHandle::create(handle, true /* ownshandle */), buffer);
947            reply->writeInt32(err);
948
949            return NO_ERROR;
950        }
951
952        case CREATE_INPUT_SURFACE:
953        {
954            CHECK_OMX_INTERFACE(IOMX, data, reply);
955
956            node_id node = (node_id)data.readInt32();
957            OMX_U32 port_index = data.readInt32();
958            android_dataspace dataSpace = (android_dataspace)data.readInt32();
959
960            sp<IGraphicBufferProducer> bufferProducer;
961            MetadataBufferType type = kMetadataBufferTypeInvalid;
962            status_t err = createInputSurface(node, port_index, dataSpace, &bufferProducer, &type);
963
964            if ((err != OK) && (type == kMetadataBufferTypeInvalid)) {
965                android_errorWriteLog(0x534e4554, "26324358");
966            }
967
968            reply->writeInt32(type);
969            reply->writeInt32(err);
970
971            if (err == OK) {
972                reply->writeStrongBinder(IInterface::asBinder(bufferProducer));
973            }
974
975            return NO_ERROR;
976        }
977
978        case CREATE_PERSISTENT_INPUT_SURFACE:
979        {
980            CHECK_OMX_INTERFACE(IOMX, data, reply);
981
982            sp<IGraphicBufferProducer> bufferProducer;
983            sp<IGraphicBufferConsumer> bufferConsumer;
984            status_t err = createPersistentInputSurface(
985                    &bufferProducer, &bufferConsumer);
986
987            reply->writeInt32(err);
988
989            if (err == OK) {
990                reply->writeStrongBinder(IInterface::asBinder(bufferProducer));
991                reply->writeStrongBinder(IInterface::asBinder(bufferConsumer));
992            }
993
994            return NO_ERROR;
995        }
996
997        case SET_INPUT_SURFACE:
998        {
999            CHECK_OMX_INTERFACE(IOMX, data, reply);
1000
1001            node_id node = (node_id)data.readInt32();
1002            OMX_U32 port_index = data.readInt32();
1003
1004            sp<IGraphicBufferConsumer> bufferConsumer =
1005                    interface_cast<IGraphicBufferConsumer>(data.readStrongBinder());
1006
1007            MetadataBufferType type = kMetadataBufferTypeInvalid;
1008
1009            status_t err = INVALID_OPERATION;
1010            if (bufferConsumer == NULL) {
1011                ALOGE("b/26392700");
1012            } else {
1013                err = setInputSurface(node, port_index, bufferConsumer, &type);
1014
1015                if ((err != OK) && (type == kMetadataBufferTypeInvalid)) {
1016                   android_errorWriteLog(0x534e4554, "26324358");
1017                }
1018            }
1019
1020            reply->writeInt32(type);
1021            reply->writeInt32(err);
1022            return NO_ERROR;
1023        }
1024
1025        case SIGNAL_END_OF_INPUT_STREAM:
1026        {
1027            CHECK_OMX_INTERFACE(IOMX, data, reply);
1028
1029            node_id node = (node_id)data.readInt32();
1030
1031            status_t err = signalEndOfInputStream(node);
1032            reply->writeInt32(err);
1033
1034            return NO_ERROR;
1035        }
1036
1037        case STORE_META_DATA_IN_BUFFERS:
1038        {
1039            CHECK_OMX_INTERFACE(IOMX, data, reply);
1040
1041            node_id node = (node_id)data.readInt32();
1042            OMX_U32 port_index = data.readInt32();
1043            OMX_BOOL enable = (OMX_BOOL)data.readInt32();
1044
1045            MetadataBufferType type = (MetadataBufferType)data.readInt32();
1046            status_t err = storeMetaDataInBuffers(node, port_index, enable, &type);
1047
1048            reply->writeInt32(type);
1049            reply->writeInt32(err);
1050
1051            return NO_ERROR;
1052        }
1053
1054        case PREPARE_FOR_ADAPTIVE_PLAYBACK:
1055        {
1056            CHECK_OMX_INTERFACE(IOMX, data, reply);
1057
1058            node_id node = (node_id)data.readInt32();
1059            OMX_U32 port_index = data.readInt32();
1060            OMX_BOOL enable = (OMX_BOOL)data.readInt32();
1061            OMX_U32 max_width = data.readInt32();
1062            OMX_U32 max_height = data.readInt32();
1063
1064            status_t err = prepareForAdaptivePlayback(
1065                    node, port_index, enable, max_width, max_height);
1066            reply->writeInt32(err);
1067
1068            return NO_ERROR;
1069        }
1070
1071        case CONFIGURE_VIDEO_TUNNEL_MODE:
1072        {
1073            CHECK_OMX_INTERFACE(IOMX, data, reply);
1074
1075            node_id node = (node_id)data.readInt32();
1076            OMX_U32 port_index = data.readInt32();
1077            OMX_BOOL tunneled = (OMX_BOOL)data.readInt32();
1078            OMX_U32 audio_hw_sync = data.readInt32();
1079
1080            native_handle_t *sideband_handle = NULL;
1081            status_t err = configureVideoTunnelMode(
1082                    node, port_index, tunneled, audio_hw_sync, &sideband_handle);
1083            reply->writeInt32(err);
1084            if(err == OK){
1085                reply->writeNativeHandle(sideband_handle);
1086            }
1087
1088            return NO_ERROR;
1089        }
1090
1091        case ALLOC_SECURE_BUFFER:
1092        {
1093            CHECK_OMX_INTERFACE(IOMX, data, reply);
1094
1095            node_id node = (node_id)data.readInt32();
1096            OMX_U32 port_index = data.readInt32();
1097            if (!isSecure(node) || port_index != 0 /* kPortIndexInput */) {
1098                ALOGE("b/24310423");
1099                reply->writeInt32(INVALID_OPERATION);
1100                return NO_ERROR;
1101            }
1102
1103            size_t size = data.readInt64();
1104
1105            buffer_id buffer;
1106            void *buffer_data = NULL;
1107            native_handle_t *native_handle = NULL;
1108            status_t err = allocateSecureBuffer(
1109                    node, port_index, size, &buffer, &buffer_data, &native_handle);
1110            reply->writeInt32(err);
1111
1112            if (err == OK) {
1113                reply->writeInt32((int32_t)buffer);
1114                reply->writeInt64((uintptr_t)buffer_data);
1115                if (buffer_data == NULL) {
1116                    reply->writeNativeHandle(native_handle);
1117                }
1118            }
1119
1120            return NO_ERROR;
1121        }
1122
1123        case ALLOC_BUFFER_WITH_BACKUP:
1124        {
1125            CHECK_OMX_INTERFACE(IOMX, data, reply);
1126
1127            node_id node = (node_id)data.readInt32();
1128            OMX_U32 port_index = data.readInt32();
1129            sp<IMemory> params =
1130                interface_cast<IMemory>(data.readStrongBinder());
1131            OMX_U32 allottedSize = data.readInt32();
1132
1133            if (params == NULL) {
1134                ALOGE("b/26392700");
1135                reply->writeInt32(INVALID_OPERATION);
1136                return NO_ERROR;
1137            }
1138
1139            buffer_id buffer;
1140            status_t err = allocateBufferWithBackup(
1141                    node, port_index, params, &buffer, allottedSize);
1142
1143            reply->writeInt32(err);
1144
1145            if (err == OK) {
1146                reply->writeInt32((int32_t)buffer);
1147            }
1148
1149            return NO_ERROR;
1150        }
1151
1152        case FREE_BUFFER:
1153        {
1154            CHECK_OMX_INTERFACE(IOMX, data, reply);
1155
1156            node_id node = (node_id)data.readInt32();
1157            OMX_U32 port_index = data.readInt32();
1158            buffer_id buffer = (buffer_id)data.readInt32();
1159            reply->writeInt32(freeBuffer(node, port_index, buffer));
1160
1161            return NO_ERROR;
1162        }
1163
1164        case FILL_BUFFER:
1165        {
1166            CHECK_OMX_INTERFACE(IOMX, data, reply);
1167
1168            node_id node = (node_id)data.readInt32();
1169            buffer_id buffer = (buffer_id)data.readInt32();
1170            bool haveFence = data.readInt32();
1171            int fenceFd = haveFence ? ::dup(data.readFileDescriptor()) : -1;
1172            reply->writeInt32(fillBuffer(node, buffer, fenceFd));
1173
1174            return NO_ERROR;
1175        }
1176
1177        case EMPTY_BUFFER:
1178        {
1179            CHECK_OMX_INTERFACE(IOMX, data, reply);
1180
1181            node_id node = (node_id)data.readInt32();
1182            buffer_id buffer = (buffer_id)data.readInt32();
1183            OMX_U32 range_offset = data.readInt32();
1184            OMX_U32 range_length = data.readInt32();
1185            OMX_U32 flags = data.readInt32();
1186            OMX_TICKS timestamp = data.readInt64();
1187            bool haveFence = data.readInt32();
1188            int fenceFd = haveFence ? ::dup(data.readFileDescriptor()) : -1;
1189            reply->writeInt32(emptyBuffer(
1190                    node, buffer, range_offset, range_length, flags, timestamp, fenceFd));
1191
1192            return NO_ERROR;
1193        }
1194
1195        case GET_EXTENSION_INDEX:
1196        {
1197            CHECK_OMX_INTERFACE(IOMX, data, reply);
1198
1199            node_id node = (node_id)data.readInt32();
1200            const char *parameter_name = data.readCString();
1201
1202            if (parameter_name == NULL) {
1203                ALOGE("b/26392700");
1204                reply->writeInt32(INVALID_OPERATION);
1205                return NO_ERROR;
1206            }
1207
1208            OMX_INDEXTYPE index;
1209            status_t err = getExtensionIndex(node, parameter_name, &index);
1210
1211            reply->writeInt32(err);
1212
1213            if (err == OK) {
1214                reply->writeInt32(index);
1215            }
1216
1217            return OK;
1218        }
1219
1220        default:
1221            return BBinder::onTransact(code, data, reply, flags);
1222    }
1223}
1224
1225////////////////////////////////////////////////////////////////////////////////
1226
1227class BpOMXObserver : public BpInterface<IOMXObserver> {
1228public:
1229    BpOMXObserver(const sp<IBinder> &impl)
1230        : BpInterface<IOMXObserver>(impl) {
1231    }
1232
1233    virtual void onMessages(const std::list<omx_message> &messages) {
1234        Parcel data, reply;
1235        std::list<omx_message>::const_iterator it = messages.cbegin();
1236        bool first = true;
1237        while (it != messages.cend()) {
1238            const omx_message &msg = *it++;
1239            if (first) {
1240                data.writeInterfaceToken(IOMXObserver::getInterfaceDescriptor());
1241                data.writeInt32(msg.node);
1242                first = false;
1243            }
1244            data.writeInt32(msg.fenceFd >= 0);
1245            if (msg.fenceFd >= 0) {
1246                data.writeFileDescriptor(msg.fenceFd, true /* takeOwnership */);
1247            }
1248            data.writeInt32(msg.type);
1249            data.write(&msg.u, sizeof(msg.u));
1250            ALOGV("onMessage writing message %d, size %zu", msg.type, sizeof(msg));
1251        }
1252        if (!first) {
1253            data.writeInt32(-1); // mark end
1254            remote()->transact(OBSERVER_ON_MSG, data, &reply, IBinder::FLAG_ONEWAY);
1255        }
1256    }
1257};
1258
1259IMPLEMENT_META_INTERFACE(OMXObserver, "android.hardware.IOMXObserver");
1260
1261status_t BnOMXObserver::onTransact(
1262    uint32_t code, const Parcel &data, Parcel *reply, uint32_t flags) {
1263    switch (code) {
1264        case OBSERVER_ON_MSG:
1265        {
1266            CHECK_OMX_INTERFACE(IOMXObserver, data, reply);
1267            IOMX::node_id node = data.readInt32();
1268            std::list<omx_message> messages;
1269            status_t err = FAILED_TRANSACTION; // must receive at least one message
1270            do {
1271                int haveFence = data.readInt32();
1272                if (haveFence < 0) { // we use -1 to mark end of messages
1273                    break;
1274                }
1275                omx_message msg;
1276                msg.node = node;
1277                msg.fenceFd = haveFence ? ::dup(data.readFileDescriptor()) : -1;
1278                msg.type = (typeof(msg.type))data.readInt32();
1279                err = data.read(&msg.u, sizeof(msg.u));
1280                ALOGV("onTransact reading message %d, size %zu", msg.type, sizeof(msg));
1281                messages.push_back(msg);
1282            } while (err == OK);
1283
1284            if (err == OK) {
1285                onMessages(messages);
1286            }
1287
1288            return err;
1289        }
1290
1291        default:
1292            return BBinder::onTransact(code, data, reply, flags);
1293    }
1294}
1295
1296}  // namespace android
1297