AccessibilityManagerService.java revision 58d37b55bd228032355360ea3303e46a804e0516
1/* 2 ** Copyright 2009, The Android Open Source Project 3 ** 4 ** Licensed under the Apache License, Version 2.0 (the "License"); 5 ** you may not use this file except in compliance with the License. 6 ** You may obtain a copy of the License at 7 ** 8 ** http://www.apache.org/licenses/LICENSE-2.0 9 ** 10 ** Unless required by applicable law or agreed to in writing, software 11 ** distributed under the License is distributed on an "AS IS" BASIS, 12 ** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 ** See the License for the specific language governing permissions and 14 ** limitations under the License. 15 */ 16 17package com.android.server.accessibility; 18 19import static android.accessibilityservice.AccessibilityServiceInfo.DEFAULT; 20import static android.accessibilityservice.AccessibilityServiceInfo.FLAG_INCLUDE_NOT_IMPORTANT_VIEWS; 21 22import android.Manifest; 23import android.accessibilityservice.AccessibilityService; 24import android.accessibilityservice.AccessibilityServiceInfo; 25import android.accessibilityservice.IAccessibilityServiceClient; 26import android.accessibilityservice.IAccessibilityServiceConnection; 27import android.app.AlertDialog; 28import android.app.PendingIntent; 29import android.app.StatusBarManager; 30import android.content.BroadcastReceiver; 31import android.content.ComponentName; 32import android.content.ContentResolver; 33import android.content.Context; 34import android.content.DialogInterface; 35import android.content.DialogInterface.OnClickListener; 36import android.content.Intent; 37import android.content.IntentFilter; 38import android.content.ServiceConnection; 39import android.content.pm.PackageManager; 40import android.content.pm.ResolveInfo; 41import android.content.pm.ServiceInfo; 42import android.database.ContentObserver; 43import android.graphics.Rect; 44import android.hardware.input.InputManager; 45import android.net.Uri; 46import android.os.Binder; 47import android.os.Build; 48import android.os.Bundle; 49import android.os.Handler; 50import android.os.IBinder; 51import android.os.Looper; 52import android.os.Message; 53import android.os.Process; 54import android.os.RemoteCallbackList; 55import android.os.RemoteException; 56import android.os.ServiceManager; 57import android.os.SystemClock; 58import android.os.UserHandle; 59import android.provider.Settings; 60import android.text.TextUtils; 61import android.text.TextUtils.SimpleStringSplitter; 62import android.util.Slog; 63import android.util.SparseArray; 64import android.view.IWindow; 65import android.view.IWindowManager; 66import android.view.InputDevice; 67import android.view.KeyCharacterMap; 68import android.view.KeyEvent; 69import android.view.WindowInfo; 70import android.view.WindowManager; 71import android.view.accessibility.AccessibilityEvent; 72import android.view.accessibility.AccessibilityInteractionClient; 73import android.view.accessibility.AccessibilityManager; 74import android.view.accessibility.AccessibilityNodeInfo; 75import android.view.accessibility.IAccessibilityInteractionConnection; 76import android.view.accessibility.IAccessibilityInteractionConnectionCallback; 77import android.view.accessibility.IAccessibilityManager; 78import android.view.accessibility.IAccessibilityManagerClient; 79 80import com.android.internal.R; 81import com.android.internal.content.PackageMonitor; 82import com.android.internal.os.SomeArgs; 83import com.android.internal.statusbar.IStatusBarService; 84 85import org.xmlpull.v1.XmlPullParserException; 86 87import java.io.IOException; 88import java.util.ArrayList; 89import java.util.Arrays; 90import java.util.HashMap; 91import java.util.HashSet; 92import java.util.Iterator; 93import java.util.List; 94import java.util.Map; 95import java.util.Set; 96import java.util.concurrent.CopyOnWriteArrayList; 97 98/** 99 * This class is instantiated by the system as a system level service and can be 100 * accessed only by the system. The task of this service is to be a centralized 101 * event dispatch for {@link AccessibilityEvent}s generated across all processes 102 * on the device. Events are dispatched to {@link AccessibilityService}s. 103 * 104 * @hide 105 */ 106public class AccessibilityManagerService extends IAccessibilityManager.Stub { 107 108 private static final boolean DEBUG = false; 109 110 private static final String LOG_TAG = "AccessibilityManagerService"; 111 112 private static final String FUNCTION_REGISTER_UI_TEST_AUTOMATION_SERVICE = 113 "registerUiTestAutomationService"; 114 115 private static final char COMPONENT_NAME_SEPARATOR = ':'; 116 117 private static final int OWN_PROCESS_ID = android.os.Process.myPid(); 118 119 private static int sIdCounter = 0; 120 121 private static int sNextWindowId; 122 123 private final Context mContext; 124 125 private final Object mLock = new Object(); 126 127 private final SimpleStringSplitter mStringColonSplitter = 128 new SimpleStringSplitter(COMPONENT_NAME_SEPARATOR); 129 130 private final List<AccessibilityServiceInfo> mEnabledServicesForFeedbackTempList = 131 new ArrayList<AccessibilityServiceInfo>(); 132 133 private final PackageManager mPackageManager; 134 135 private final IWindowManager mWindowManagerService; 136 137 private final SecurityPolicy mSecurityPolicy; 138 139 private final MainHandler mMainHandler; 140 141 private Service mUiAutomationService; 142 143 private Service mQueryBridge; 144 145 private AlertDialog mEnableTouchExplorationDialog; 146 147 private AccessibilityInputFilter mInputFilter; 148 149 private boolean mHasInputFilter; 150 151 private final RemoteCallbackList<IAccessibilityManagerClient> mGlobalClients = 152 new RemoteCallbackList<IAccessibilityManagerClient>(); 153 154 private final SparseArray<AccessibilityConnectionWrapper> mGlobalInteractionConnections = 155 new SparseArray<AccessibilityConnectionWrapper>(); 156 157 private final SparseArray<IBinder> mGlobalWindowTokens = new SparseArray<IBinder>(); 158 159 private final SparseArray<UserState> mUserStates = new SparseArray<UserState>(); 160 161 private int mCurrentUserId = UserHandle.USER_NULL; 162 163 private UserState getCurrentUserStateLocked() { 164 return getUserStateLocked(mCurrentUserId); 165 } 166 167 private UserState getUserStateLocked(int userId) { 168 UserState state = mUserStates.get(userId); 169 if (state == null) { 170 state = new UserState(userId); 171 mUserStates.put(userId, state); 172 } 173 return state; 174 } 175 176 /** 177 * Creates a new instance. 178 * 179 * @param context A {@link Context} instance. 180 */ 181 public AccessibilityManagerService(Context context) { 182 mContext = context; 183 mPackageManager = mContext.getPackageManager(); 184 mWindowManagerService = (IWindowManager) ServiceManager.getService(Context.WINDOW_SERVICE); 185 mSecurityPolicy = new SecurityPolicy(); 186 mMainHandler = new MainHandler(mContext.getMainLooper()); 187 registerBroadcastReceivers(); 188 new AccessibilityContentObserver(mMainHandler).register( 189 context.getContentResolver()); 190 } 191 192 private void registerBroadcastReceivers() { 193 PackageMonitor monitor = new PackageMonitor() { 194 @Override 195 public void onSomePackagesChanged() { 196 synchronized (mLock) { 197 if (getChangingUserId() != mCurrentUserId) { 198 return; 199 } 200 // We will update when the automation service dies. 201 if (mUiAutomationService == null) { 202 UserState userState = getCurrentUserStateLocked(); 203 populateInstalledAccessibilityServiceLocked(userState); 204 manageServicesLocked(userState); 205 } 206 } 207 } 208 209 @Override 210 public void onPackageRemoved(String packageName, int uid) { 211 synchronized (mLock) { 212 final int userId = getChangingUserId(); 213 if (userId != mCurrentUserId) { 214 return; 215 } 216 UserState state = getUserStateLocked(userId); 217 Iterator<ComponentName> it = state.mEnabledServices.iterator(); 218 while (it.hasNext()) { 219 ComponentName comp = it.next(); 220 String compPkg = comp.getPackageName(); 221 if (compPkg.equals(packageName)) { 222 it.remove(); 223 // Update the enabled services setting. 224 persistComponentNamesToSettingLocked( 225 Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES, 226 state.mEnabledServices, userId); 227 // Update the touch exploration granted services setting. 228 state.mTouchExplorationGrantedServices.remove(comp); 229 persistComponentNamesToSettingLocked( 230 Settings.Secure. 231 TOUCH_EXPLORATION_GRANTED_ACCESSIBILITY_SERVICES, 232 state.mEnabledServices, userId); 233 return; 234 } 235 } 236 } 237 } 238 239 @Override 240 public boolean onHandleForceStop(Intent intent, String[] packages, 241 int uid, boolean doit) { 242 synchronized (mLock) { 243 final int userId = getChangingUserId(); 244 if (userId != mCurrentUserId) { 245 return false; 246 } 247 UserState state = getUserStateLocked(userId); 248 Iterator<ComponentName> it = state.mEnabledServices.iterator(); 249 while (it.hasNext()) { 250 ComponentName comp = it.next(); 251 String compPkg = comp.getPackageName(); 252 for (String pkg : packages) { 253 if (compPkg.equals(pkg)) { 254 if (!doit) { 255 return true; 256 } 257 it.remove(); 258 persistComponentNamesToSettingLocked( 259 Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES, 260 state.mEnabledServices, userId); 261 } 262 } 263 } 264 return false; 265 } 266 } 267 }; 268 269 // package changes 270 monitor.register(mContext, null, UserHandle.ALL, true); 271 272 // user change 273 IntentFilter userFilter = new IntentFilter(); 274 userFilter.addAction(Intent.ACTION_USER_SWITCHED); 275 userFilter.addAction(Intent.ACTION_USER_REMOVED); 276 277 mContext.registerReceiver(new BroadcastReceiver() { 278 @Override 279 public void onReceive(Context context, Intent intent) { 280 String action = intent.getAction(); 281 if (Intent.ACTION_USER_SWITCHED.equals(action)) { 282 switchUser(intent.getIntExtra(Intent.EXTRA_USER_HANDLE, 0)); 283 } else if (Intent.ACTION_USER_REMOVED.equals(action)) { 284 removeUser(intent.getIntExtra(Intent.EXTRA_USER_HANDLE, 0)); 285 } 286 } 287 }, userFilter); 288 } 289 290 public int addClient(IAccessibilityManagerClient client, int userId) { 291 synchronized (mLock) { 292 final int resolvedUserId = mSecurityPolicy 293 .resolveCallingUserIdEnforcingPermissionsLocked(userId); 294 // If the client is from a process that runs across users such as 295 // the system UI or the system we add it to the global state that 296 // is shared across users. 297 UserState userState = getUserStateLocked(resolvedUserId); 298 if (mSecurityPolicy.isCallerInteractingAcrossUsers(userId)) { 299 mGlobalClients.register(client); 300 return getClientState(userState); 301 } else { 302 userState.mClients.register(client); 303 // If this client is not for the current user we do not 304 // return a state since it is not for the foreground user. 305 // We will send the state to the client on a user switch. 306 return (resolvedUserId == mCurrentUserId) ? getClientState(userState) : 0; 307 } 308 } 309 } 310 311 public boolean sendAccessibilityEvent(AccessibilityEvent event, int userId) { 312 synchronized (mLock) { 313 final int resolvedUserId = mSecurityPolicy 314 .resolveCallingUserIdEnforcingPermissionsLocked(userId); 315 // This method does nothing for a background user. 316 if (resolvedUserId != mCurrentUserId) { 317 return true; // yes, recycle the event 318 } 319 if (mSecurityPolicy.canDispatchAccessibilityEvent(event)) { 320 mSecurityPolicy.updateActiveWindowAndEventSourceLocked(event); 321 notifyAccessibilityServicesDelayedLocked(event, false); 322 notifyAccessibilityServicesDelayedLocked(event, true); 323 } 324 if (mHasInputFilter && mInputFilter != null) { 325 mMainHandler.obtainMessage(MainHandler.MSG_SEND_ACCESSIBILITY_EVENT_TO_INPUT_FILTER, 326 AccessibilityEvent.obtain(event)).sendToTarget(); 327 } 328 event.recycle(); 329 getUserStateLocked(resolvedUserId).mHandledFeedbackTypes = 0; 330 } 331 return (OWN_PROCESS_ID != Binder.getCallingPid()); 332 } 333 334 public List<AccessibilityServiceInfo> getInstalledAccessibilityServiceList(int userId) { 335 synchronized (mLock) { 336 final int resolvedUserId = mSecurityPolicy 337 .resolveCallingUserIdEnforcingPermissionsLocked(userId); 338 return getUserStateLocked(resolvedUserId).mInstalledServices; 339 } 340 } 341 342 public List<AccessibilityServiceInfo> getEnabledAccessibilityServiceList(int feedbackType, 343 int userId) { 344 List<AccessibilityServiceInfo> result = null; 345 synchronized (mLock) { 346 final int resolvedUserId = mSecurityPolicy 347 .resolveCallingUserIdEnforcingPermissionsLocked(userId); 348 result = mEnabledServicesForFeedbackTempList; 349 result.clear(); 350 List<Service> services = getUserStateLocked(resolvedUserId).mServices; 351 while (feedbackType != 0) { 352 final int feedbackTypeBit = (1 << Integer.numberOfTrailingZeros(feedbackType)); 353 feedbackType &= ~feedbackTypeBit; 354 final int serviceCount = services.size(); 355 for (int i = 0; i < serviceCount; i++) { 356 Service service = services.get(i); 357 if ((service.mFeedbackType & feedbackTypeBit) != 0) { 358 result.add(service.mAccessibilityServiceInfo); 359 } 360 } 361 } 362 } 363 return result; 364 } 365 366 public void interrupt(int userId) { 367 CopyOnWriteArrayList<Service> services; 368 synchronized (mLock) { 369 final int resolvedUserId = mSecurityPolicy 370 .resolveCallingUserIdEnforcingPermissionsLocked(userId); 371 // This method does nothing for a background user. 372 if (resolvedUserId != mCurrentUserId) { 373 return; 374 } 375 services = getUserStateLocked(resolvedUserId).mServices; 376 } 377 for (int i = 0, count = services.size(); i < count; i++) { 378 Service service = services.get(i); 379 try { 380 service.mServiceInterface.onInterrupt(); 381 } catch (RemoteException re) { 382 Slog.e(LOG_TAG, "Error during sending interrupt request to " 383 + service.mService, re); 384 } 385 } 386 } 387 388 public int addAccessibilityInteractionConnection(IWindow windowToken, 389 IAccessibilityInteractionConnection connection, int userId) throws RemoteException { 390 synchronized (mLock) { 391 final int resolvedUserId = mSecurityPolicy 392 .resolveCallingUserIdEnforcingPermissionsLocked(userId); 393 final int windowId = sNextWindowId++; 394 // If the window is from a process that runs across users such as 395 // the system UI or the system we add it to the global state that 396 // is shared across users. 397 if (mSecurityPolicy.isCallerInteractingAcrossUsers(userId)) { 398 AccessibilityConnectionWrapper wrapper = new AccessibilityConnectionWrapper( 399 windowId, connection, UserHandle.USER_ALL); 400 wrapper.linkToDeath(); 401 mGlobalInteractionConnections.put(windowId, wrapper); 402 mGlobalWindowTokens.put(windowId, windowToken.asBinder()); 403 } else { 404 AccessibilityConnectionWrapper wrapper = new AccessibilityConnectionWrapper( 405 windowId, connection, resolvedUserId); 406 wrapper.linkToDeath(); 407 UserState userState = getUserStateLocked(resolvedUserId); 408 userState.mInteractionConnections.put(windowId, wrapper); 409 userState.mWindowTokens.put(windowId, windowToken.asBinder()); 410 } 411 if (DEBUG) { 412 Slog.i(LOG_TAG, "Adding interaction connection to windowId: " + windowId); 413 } 414 return windowId; 415 } 416 } 417 418 public void removeAccessibilityInteractionConnection(IWindow window) { 419 synchronized (mLock) { 420 mSecurityPolicy.resolveCallingUserIdEnforcingPermissionsLocked( 421 UserHandle.getCallingUserId()); 422 IBinder token = window.asBinder(); 423 final boolean removedGlobal = 424 removeAccessibilityInteractionConnectionInternalLocked( 425 token, mGlobalWindowTokens, mGlobalInteractionConnections); 426 if (removedGlobal) { 427 return; 428 } 429 final int userCount = mUserStates.size(); 430 for (int i = 0; i < userCount; i++) { 431 UserState userState = mUserStates.valueAt(i); 432 final boolean removedForUser = 433 removeAccessibilityInteractionConnectionInternalLocked( 434 token, userState.mWindowTokens, userState.mInteractionConnections); 435 if (removedForUser) { 436 return; 437 } 438 } 439 } 440 } 441 442 private boolean removeAccessibilityInteractionConnectionInternalLocked(IBinder windowToken, 443 SparseArray<IBinder> windowTokens, 444 SparseArray<AccessibilityConnectionWrapper> interactionConnections) { 445 final int count = windowTokens.size(); 446 for (int i = 0; i < count; i++) { 447 if (windowTokens.valueAt(i) == windowToken) { 448 final int windowId = windowTokens.keyAt(i); 449 windowTokens.removeAt(i); 450 AccessibilityConnectionWrapper wrapper = interactionConnections.get(windowId); 451 wrapper.unlinkToDeath(); 452 interactionConnections.remove(windowId); 453 return true; 454 } 455 } 456 return false; 457 } 458 459 public void registerUiTestAutomationService(IAccessibilityServiceClient serviceClient, 460 AccessibilityServiceInfo accessibilityServiceInfo) { 461 mSecurityPolicy.enforceCallingPermission(Manifest.permission.RETRIEVE_WINDOW_CONTENT, 462 FUNCTION_REGISTER_UI_TEST_AUTOMATION_SERVICE); 463 ComponentName componentName = new ComponentName("foo.bar", 464 "AutomationAccessibilityService"); 465 synchronized (mLock) { 466 // If an automation services is connected to the system all services are stopped 467 // so the automation one is the only one running. Settings are not changed so when 468 // the automation service goes away the state is restored from the settings. 469 UserState userState = getCurrentUserStateLocked(); 470 unbindAllServicesLocked(userState); 471 472 // If necessary enable accessibility and announce that. 473 if (!userState.mIsAccessibilityEnabled) { 474 userState.mIsAccessibilityEnabled = true; 475 scheduleSendStateToClientsLocked(userState); 476 } 477 } 478 // Hook the automation service up. 479 mUiAutomationService = new Service(mCurrentUserId, componentName, 480 accessibilityServiceInfo, true); 481 mUiAutomationService.onServiceConnected(componentName, serviceClient.asBinder()); 482 } 483 484 public void unregisterUiTestAutomationService(IAccessibilityServiceClient serviceClient) { 485 synchronized (mLock) { 486 // Automation service is not bound, so pretend it died to perform clean up. 487 if (mUiAutomationService != null 488 && mUiAutomationService.mServiceInterface == serviceClient) { 489 mUiAutomationService.binderDied(); 490 } 491 } 492 } 493 494 boolean onGesture(int gestureId) { 495 synchronized (mLock) { 496 boolean handled = notifyGestureLocked(gestureId, false); 497 if (!handled) { 498 handled = notifyGestureLocked(gestureId, true); 499 } 500 return handled; 501 } 502 } 503 504 /** 505 * Gets the bounds of the accessibility focus in the active window. 506 * 507 * @param outBounds The output to which to write the focus bounds. 508 * @return Whether accessibility focus was found and the bounds are populated. 509 */ 510 boolean getAccessibilityFocusBoundsInActiveWindow(Rect outBounds) { 511 // Instead of keeping track of accessibility focus events per 512 // window to be able to find the focus in the active window, 513 // we take a stateless approach and look it up. This is fine 514 // since we do this only when the user clicks/long presses. 515 Service service = getQueryBridge(); 516 final int connectionId = service.mId; 517 AccessibilityInteractionClient client = AccessibilityInteractionClient.getInstance(); 518 client.addConnection(connectionId, service); 519 try { 520 AccessibilityNodeInfo root = AccessibilityInteractionClient.getInstance() 521 .getRootInActiveWindow(connectionId); 522 if (root == null) { 523 return false; 524 } 525 AccessibilityNodeInfo focus = root.findFocus( 526 AccessibilityNodeInfo.FOCUS_ACCESSIBILITY); 527 if (focus == null) { 528 return false; 529 } 530 focus.getBoundsInScreen(outBounds); 531 return true; 532 } finally { 533 client.removeConnection(connectionId); 534 } 535 } 536 537 /** 538 * Gets the bounds of the active window. 539 * 540 * @param outBounds The output to which to write the bounds. 541 */ 542 boolean getActiveWindowBounds(Rect outBounds) { 543 IBinder token; 544 synchronized (mLock) { 545 final int windowId = mSecurityPolicy.mActiveWindowId; 546 token = mGlobalWindowTokens.get(windowId); 547 if (token == null) { 548 token = getCurrentUserStateLocked().mWindowTokens.get(windowId); 549 } 550 } 551 WindowInfo info = null; 552 try { 553 info = mWindowManagerService.getWindowInfo(token); 554 if (info != null) { 555 outBounds.set(info.frame); 556 return true; 557 } 558 } catch (RemoteException re) { 559 /* ignore */ 560 } finally { 561 if (info != null) { 562 info.recycle(); 563 } 564 } 565 return false; 566 } 567 568 int getActiveWindowId() { 569 return mSecurityPolicy.mActiveWindowId; 570 } 571 572 private void switchUser(int userId) { 573 synchronized (mLock) { 574 if (userId == mCurrentUserId) { 575 return; 576 } 577 578 // Disconnect from services for the old user. 579 UserState oldUserState = getUserStateLocked(mCurrentUserId); 580 unbindAllServicesLocked(oldUserState); 581 582 // Disable the local managers for the old user. 583 if (oldUserState.mClients.getRegisteredCallbackCount() > 0) { 584 mMainHandler.obtainMessage(MainHandler.MSG_SEND_CLEARED_STATE_TO_CLIENTS_FOR_USER, 585 oldUserState.mUserId, 0).sendToTarget(); 586 } 587 588 // The user changed. 589 mCurrentUserId = userId; 590 591 // Recreate the internal state for the new user. 592 mMainHandler.obtainMessage(MainHandler.MSG_SEND_RECREATE_INTERNAL_STATE, 593 mCurrentUserId, 0).sendToTarget(); 594 595 // Re-register the test automation service after the new state is recreated. 596 if (mUiAutomationService != null) { 597 unregisterUiTestAutomationService(mUiAutomationService.mServiceInterface); 598 SomeArgs args = SomeArgs.obtain(); 599 args.arg1 = mUiAutomationService.mServiceInterface; 600 args.arg2 = mUiAutomationService.mAccessibilityServiceInfo; 601 mMainHandler.obtainMessage(MainHandler.MSG_REGISTER_UI_TEST_AUTOMATION_SERVICE, 602 args).sendToTarget(); 603 } 604 } 605 } 606 607 private void removeUser(int userId) { 608 synchronized (mLock) { 609 mUserStates.remove(userId); 610 } 611 } 612 613 private Service getQueryBridge() { 614 if (mQueryBridge == null) { 615 AccessibilityServiceInfo info = new AccessibilityServiceInfo(); 616 mQueryBridge = new Service(UserHandle.USER_NULL, null, info, true); 617 } 618 return mQueryBridge; 619 } 620 621 private boolean notifyGestureLocked(int gestureId, boolean isDefault) { 622 // TODO: Now we are giving the gestures to the last enabled 623 // service that can handle them which is the last one 624 // in our list since we write the last enabled as the 625 // last record in the enabled services setting. Ideally, 626 // the user should make the call which service handles 627 // gestures. However, only one service should handle 628 // gestures to avoid user frustration when different 629 // behavior is observed from different combinations of 630 // enabled accessibility services. 631 UserState state = getCurrentUserStateLocked(); 632 for (int i = state.mServices.size() - 1; i >= 0; i--) { 633 Service service = state.mServices.get(i); 634 if (service.mRequestTouchExplorationMode && service.mIsDefault == isDefault) { 635 service.notifyGesture(gestureId); 636 return true; 637 } 638 } 639 return false; 640 } 641 642 /** 643 * Removes an AccessibilityInteractionConnection. 644 * 645 * @param windowId The id of the window to which the connection is targeted. 646 * @param userId The id of the user owning the connection. UserHandle.USER_ALL 647 * if global. 648 */ 649 private void removeAccessibilityInteractionConnectionLocked(int windowId, int userId) { 650 if (userId == UserHandle.USER_ALL) { 651 mGlobalWindowTokens.remove(windowId); 652 mGlobalInteractionConnections.remove(windowId); 653 } else { 654 UserState userState = getCurrentUserStateLocked(); 655 userState.mWindowTokens.remove(windowId); 656 userState.mInteractionConnections.remove(windowId); 657 } 658 if (DEBUG) { 659 Slog.i(LOG_TAG, "Removing interaction connection to windowId: " + windowId); 660 } 661 } 662 663 private void populateInstalledAccessibilityServiceLocked(UserState userState) { 664 userState.mInstalledServices.clear(); 665 666 List<ResolveInfo> installedServices = mPackageManager.queryIntentServicesAsUser( 667 new Intent(AccessibilityService.SERVICE_INTERFACE), 668 PackageManager.GET_SERVICES | PackageManager.GET_META_DATA, 669 mCurrentUserId); 670 671 for (int i = 0, count = installedServices.size(); i < count; i++) { 672 ResolveInfo resolveInfo = installedServices.get(i); 673 ServiceInfo serviceInfo = resolveInfo.serviceInfo; 674 if (!android.Manifest.permission.BIND_ACCESSIBILITY_SERVICE.equals( 675 serviceInfo.permission)) { 676 Slog.w(LOG_TAG, "Skipping accessibilty service " + new ComponentName( 677 serviceInfo.packageName, serviceInfo.name).flattenToShortString() 678 + ": it does not require the permission " 679 + android.Manifest.permission.BIND_ACCESSIBILITY_SERVICE); 680 continue; 681 } 682 AccessibilityServiceInfo accessibilityServiceInfo; 683 try { 684 accessibilityServiceInfo = new AccessibilityServiceInfo(resolveInfo, mContext); 685 userState.mInstalledServices.add(accessibilityServiceInfo); 686 } catch (XmlPullParserException xppe) { 687 Slog.e(LOG_TAG, "Error while initializing AccessibilityServiceInfo", xppe); 688 } catch (IOException ioe) { 689 Slog.e(LOG_TAG, "Error while initializing AccessibilityServiceInfo", ioe); 690 } 691 } 692 } 693 694 private void populateEnabledAccessibilityServicesLocked(UserState userState) { 695 populateComponentNamesFromSettingLocked( 696 Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES, 697 userState.mUserId, 698 userState.mEnabledServices); 699 } 700 701 private void populateTouchExplorationGrantedAccessibilityServicesLocked( 702 UserState userState) { 703 populateComponentNamesFromSettingLocked( 704 Settings.Secure.TOUCH_EXPLORATION_GRANTED_ACCESSIBILITY_SERVICES, 705 userState.mUserId, 706 userState.mTouchExplorationGrantedServices); 707 } 708 709 /** 710 * Performs {@link AccessibilityService}s delayed notification. The delay is configurable 711 * and denotes the period after the last event before notifying the service. 712 * 713 * @param event The event. 714 * @param isDefault True to notify default listeners, not default services. 715 */ 716 private void notifyAccessibilityServicesDelayedLocked(AccessibilityEvent event, 717 boolean isDefault) { 718 try { 719 UserState state = getCurrentUserStateLocked(); 720 for (int i = 0, count = state.mServices.size(); i < count; i++) { 721 Service service = state.mServices.get(i); 722 723 if (service.mIsDefault == isDefault) { 724 if (canDispathEventLocked(service, event, state.mHandledFeedbackTypes)) { 725 state.mHandledFeedbackTypes |= service.mFeedbackType; 726 service.notifyAccessibilityEvent(event); 727 } 728 } 729 } 730 } catch (IndexOutOfBoundsException oobe) { 731 // An out of bounds exception can happen if services are going away 732 // as the for loop is running. If that happens, just bail because 733 // there are no more services to notify. 734 return; 735 } 736 } 737 738 /** 739 * Adds a service for a user. 740 * 741 * @param service The service to add. 742 * @param userId The user id. 743 */ 744 private void tryAddServiceLocked(Service service, int userId) { 745 try { 746 UserState userState = getUserStateLocked(userId); 747 if (userState.mServices.contains(service) || !service.isConfigured()) { 748 return; 749 } 750 service.linkToOwnDeath(); 751 userState.mServices.add(service); 752 userState.mComponentNameToServiceMap.put(service.mComponentName, service); 753 updateInputFilterLocked(userState); 754 tryEnableTouchExplorationLocked(service); 755 } catch (RemoteException e) { 756 /* do nothing */ 757 } 758 } 759 760 /** 761 * Removes a service. 762 * 763 * @param service The service. 764 * @return True if the service was removed, false otherwise. 765 */ 766 private boolean tryRemoveServiceLocked(Service service) { 767 UserState userState = getUserStateLocked(service.mUserId); 768 final boolean removed = userState.mServices.remove(service); 769 if (!removed) { 770 return false; 771 } 772 userState.mComponentNameToServiceMap.remove(service.mComponentName); 773 service.unlinkToOwnDeath(); 774 service.dispose(); 775 updateInputFilterLocked(userState); 776 tryDisableTouchExplorationLocked(service); 777 return removed; 778 } 779 780 /** 781 * Determines if given event can be dispatched to a service based on the package of the 782 * event source and already notified services for that event type. Specifically, a 783 * service is notified if it is interested in events from the package and no other service 784 * providing the same feedback type has been notified. Exception are services the 785 * provide generic feedback (feedback type left as a safety net for unforeseen feedback 786 * types) which are always notified. 787 * 788 * @param service The potential receiver. 789 * @param event The event. 790 * @param handledFeedbackTypes The feedback types for which services have been notified. 791 * @return True if the listener should be notified, false otherwise. 792 */ 793 private boolean canDispathEventLocked(Service service, AccessibilityEvent event, 794 int handledFeedbackTypes) { 795 796 if (!service.isConfigured()) { 797 return false; 798 } 799 800 if (!event.isImportantForAccessibility() 801 && !service.mIncludeNotImportantViews) { 802 return false; 803 } 804 805 int eventType = event.getEventType(); 806 if ((service.mEventTypes & eventType) != eventType) { 807 return false; 808 } 809 810 Set<String> packageNames = service.mPackageNames; 811 CharSequence packageName = event.getPackageName(); 812 813 if (packageNames.isEmpty() || packageNames.contains(packageName)) { 814 int feedbackType = service.mFeedbackType; 815 if ((handledFeedbackTypes & feedbackType) != feedbackType 816 || feedbackType == AccessibilityServiceInfo.FEEDBACK_GENERIC) { 817 return true; 818 } 819 } 820 821 return false; 822 } 823 824 /** 825 * Manages services by starting enabled ones and stopping disabled ones. 826 */ 827 private void manageServicesLocked(UserState userState) { 828 final int enabledInstalledServicesCount = updateServicesStateLocked(userState); 829 // No enabled installed services => disable accessibility to avoid 830 // sending accessibility events with no recipient across processes. 831 if (userState.mIsAccessibilityEnabled && enabledInstalledServicesCount == 0) { 832 Settings.Secure.putIntForUser(mContext.getContentResolver(), 833 Settings.Secure.ACCESSIBILITY_ENABLED, 0, userState.mUserId); 834 } 835 } 836 837 /** 838 * Unbinds all bound services for a user. 839 * 840 * @param userState The user state. 841 */ 842 private void unbindAllServicesLocked(UserState userState) { 843 List<Service> services = userState.mServices; 844 for (int i = 0, count = services.size(); i < count; i++) { 845 Service service = services.get(i); 846 if (service.unbind()) { 847 i--; 848 count--; 849 } 850 } 851 } 852 853 /** 854 * Populates a set with the {@link ComponentName}s stored in a colon 855 * separated value setting for a given user. 856 * 857 * @param settingName The setting to parse. 858 * @param userId The user id. 859 * @param outComponentNames The output component names. 860 */ 861 private void populateComponentNamesFromSettingLocked(String settingName, int userId, 862 Set<ComponentName> outComponentNames) { 863 String settingValue = Settings.Secure.getStringForUser(mContext.getContentResolver(), 864 settingName, userId); 865 outComponentNames.clear(); 866 if (settingValue != null) { 867 TextUtils.SimpleStringSplitter splitter = mStringColonSplitter; 868 splitter.setString(settingValue); 869 while (splitter.hasNext()) { 870 String str = splitter.next(); 871 if (str == null || str.length() <= 0) { 872 continue; 873 } 874 ComponentName enabledService = ComponentName.unflattenFromString(str); 875 if (enabledService != null) { 876 outComponentNames.add(enabledService); 877 } 878 } 879 } 880 } 881 882 /** 883 * Persists the component names in the specified setting in a 884 * colon separated fashion. 885 * 886 * @param settingName The setting name. 887 * @param componentNames The component names. 888 */ 889 private void persistComponentNamesToSettingLocked(String settingName, 890 Set<ComponentName> componentNames, int userId) { 891 StringBuilder builder = new StringBuilder(); 892 for (ComponentName componentName : componentNames) { 893 if (builder.length() > 0) { 894 builder.append(COMPONENT_NAME_SEPARATOR); 895 } 896 builder.append(componentName.flattenToShortString()); 897 } 898 Settings.Secure.putStringForUser(mContext.getContentResolver(), 899 settingName, builder.toString(), userId); 900 } 901 902 /** 903 * Updates the state of each service by starting (or keeping running) enabled ones and 904 * stopping the rest. 905 * 906 * @param userState The user state for which to do that. 907 * @return The number of enabled installed services. 908 */ 909 private int updateServicesStateLocked(UserState userState) { 910 Map<ComponentName, Service> componentNameToServiceMap = 911 userState.mComponentNameToServiceMap; 912 boolean isEnabled = userState.mIsAccessibilityEnabled; 913 914 int enabledInstalledServices = 0; 915 for (int i = 0, count = userState.mInstalledServices.size(); i < count; i++) { 916 AccessibilityServiceInfo installedService = userState.mInstalledServices.get(i); 917 ComponentName componentName = ComponentName.unflattenFromString( 918 installedService.getId()); 919 Service service = componentNameToServiceMap.get(componentName); 920 921 if (isEnabled) { 922 if (userState.mEnabledServices.contains(componentName)) { 923 if (service == null) { 924 service = new Service(userState.mUserId, componentName, 925 installedService, false); 926 } 927 service.bind(); 928 enabledInstalledServices++; 929 } else { 930 if (service != null) { 931 service.unbind(); 932 } 933 } 934 } else { 935 if (service != null) { 936 service.unbind(); 937 } 938 } 939 } 940 941 return enabledInstalledServices; 942 } 943 944 private void scheduleSendStateToClientsLocked(UserState userState) { 945 if (mGlobalClients.getRegisteredCallbackCount() > 0 946 || userState.mClients.getRegisteredCallbackCount() > 0) { 947 final int clientState = getClientState(userState); 948 mMainHandler.obtainMessage(MainHandler.MSG_SEND_STATE_TO_CLIENTS, 949 clientState, userState.mUserId) .sendToTarget(); 950 } 951 } 952 953 private void updateInputFilterLocked(UserState userState) { 954 boolean setInputFilter = false; 955 AccessibilityInputFilter inputFilter = null; 956 synchronized (mLock) { 957 if ((userState.mIsAccessibilityEnabled && userState.mIsTouchExplorationEnabled) 958 || userState.mIsDisplayMagnificationEnabled) { 959 if (!mHasInputFilter) { 960 mHasInputFilter = true; 961 if (mInputFilter == null) { 962 mInputFilter = new AccessibilityInputFilter(mContext, 963 AccessibilityManagerService.this); 964 } 965 inputFilter = mInputFilter; 966 setInputFilter = true; 967 } 968 int flags = 0; 969 if (userState.mIsDisplayMagnificationEnabled) { 970 flags |= AccessibilityInputFilter.FLAG_FEATURE_SCREEN_MAGNIFIER; 971 } 972 if (userState.mIsTouchExplorationEnabled) { 973 flags |= AccessibilityInputFilter.FLAG_FEATURE_TOUCH_EXPLORATION; 974 } 975 mInputFilter.setEnabledFeatures(flags); 976 } else { 977 if (mHasInputFilter) { 978 mHasInputFilter = false; 979 mInputFilter.setEnabledFeatures(0); 980 inputFilter = null; 981 setInputFilter = true; 982 } 983 } 984 } 985 if (setInputFilter) { 986 try { 987 mWindowManagerService.setInputFilter(inputFilter); 988 } catch (RemoteException re) { 989 /* ignore */ 990 } 991 } 992 } 993 994 private void showEnableTouchExplorationDialog(final Service service) { 995 String label = service.mResolveInfo.loadLabel( 996 mContext.getPackageManager()).toString(); 997 synchronized (mLock) { 998 final UserState state = getCurrentUserStateLocked(); 999 if (state.mIsTouchExplorationEnabled) { 1000 return; 1001 } 1002 if (mEnableTouchExplorationDialog != null 1003 && mEnableTouchExplorationDialog.isShowing()) { 1004 return; 1005 } 1006 mEnableTouchExplorationDialog = new AlertDialog.Builder(mContext) 1007 .setIcon(android.R.drawable.ic_dialog_alert) 1008 .setPositiveButton(android.R.string.ok, new OnClickListener() { 1009 @Override 1010 public void onClick(DialogInterface dialog, int which) { 1011 // The user allowed the service to toggle touch exploration. 1012 state.mTouchExplorationGrantedServices.add(service.mComponentName); 1013 persistComponentNamesToSettingLocked( 1014 Settings.Secure.TOUCH_EXPLORATION_GRANTED_ACCESSIBILITY_SERVICES, 1015 state.mTouchExplorationGrantedServices, state.mUserId); 1016 // Enable touch exploration. 1017 Settings.Secure.putIntForUser(mContext.getContentResolver(), 1018 Settings.Secure.TOUCH_EXPLORATION_ENABLED, 1, 1019 service.mUserId); 1020 } 1021 }) 1022 .setNegativeButton(android.R.string.cancel, new OnClickListener() { 1023 @Override 1024 public void onClick(DialogInterface dialog, int which) { 1025 dialog.dismiss(); 1026 } 1027 }) 1028 .setTitle(R.string.enable_explore_by_touch_warning_title) 1029 .setMessage(mContext.getString( 1030 R.string.enable_explore_by_touch_warning_message, label)) 1031 .create(); 1032 mEnableTouchExplorationDialog.getWindow().setType( 1033 WindowManager.LayoutParams.TYPE_INPUT_METHOD_DIALOG); 1034 mEnableTouchExplorationDialog.setCanceledOnTouchOutside(true); 1035 mEnableTouchExplorationDialog.show(); 1036 } 1037 } 1038 1039 private int getClientState(UserState userState) { 1040 int clientState = 0; 1041 if (userState.mIsAccessibilityEnabled) { 1042 clientState |= AccessibilityManager.STATE_FLAG_ACCESSIBILITY_ENABLED; 1043 } 1044 // Touch exploration relies on enabled accessibility. 1045 if (userState.mIsAccessibilityEnabled && userState.mIsTouchExplorationEnabled) { 1046 clientState |= AccessibilityManager.STATE_FLAG_TOUCH_EXPLORATION_ENABLED; 1047 } 1048 return clientState; 1049 } 1050 1051 private void recreateInternalStateLocked(UserState userState) { 1052 populateInstalledAccessibilityServiceLocked(userState); 1053 populateEnabledAccessibilityServicesLocked(userState); 1054 populateTouchExplorationGrantedAccessibilityServicesLocked(userState); 1055 1056 handleTouchExplorationEnabledSettingChangedLocked(userState); 1057 handleDisplayMagnificationEnabledSettingChangedLocked(userState); 1058 handleAccessibilityEnabledSettingChangedLocked(userState); 1059 1060 updateInputFilterLocked(userState); 1061 scheduleSendStateToClientsLocked(userState); 1062 } 1063 1064 private void handleAccessibilityEnabledSettingChangedLocked(UserState userState) { 1065 userState.mIsAccessibilityEnabled = Settings.Secure.getIntForUser( 1066 mContext.getContentResolver(), 1067 Settings.Secure.ACCESSIBILITY_ENABLED, 0, userState.mUserId) == 1; 1068 if (userState.mIsAccessibilityEnabled ) { 1069 manageServicesLocked(userState); 1070 } else { 1071 unbindAllServicesLocked(userState); 1072 } 1073 } 1074 1075 private void handleTouchExplorationEnabledSettingChangedLocked(UserState userState) { 1076 userState.mIsTouchExplorationEnabled = Settings.Secure.getIntForUser( 1077 mContext.getContentResolver(), 1078 Settings.Secure.TOUCH_EXPLORATION_ENABLED, 0, userState.mUserId) == 1; 1079 } 1080 1081 private void handleDisplayMagnificationEnabledSettingChangedLocked(UserState userState) { 1082 userState.mIsDisplayMagnificationEnabled = Settings.Secure.getIntForUser( 1083 mContext.getContentResolver(), 1084 Settings.Secure.ACCESSIBILITY_DISPLAY_MAGNIFICATION_ENABLED, 1085 0, userState.mUserId) == 1; 1086 } 1087 1088 private void handleTouchExplorationGrantedAccessibilityServicesChangedLocked( 1089 UserState userState) { 1090 final int serviceCount = userState.mServices.size(); 1091 for (int i = 0; i < serviceCount; i++) { 1092 Service service = userState.mServices.get(i); 1093 if (service.mRequestTouchExplorationMode 1094 && userState.mTouchExplorationGrantedServices.contains( 1095 service.mComponentName)) { 1096 tryEnableTouchExplorationLocked(service); 1097 return; 1098 } 1099 } 1100 if (userState.mIsTouchExplorationEnabled) { 1101 Settings.Secure.putIntForUser(mContext.getContentResolver(), 1102 Settings.Secure.TOUCH_EXPLORATION_ENABLED, 0, userState.mUserId); 1103 } 1104 } 1105 1106 private void tryEnableTouchExplorationLocked(final Service service) { 1107 UserState userState = getUserStateLocked(service.mUserId); 1108 if (!userState.mIsTouchExplorationEnabled && service.mRequestTouchExplorationMode) { 1109 final boolean canToggleTouchExploration = 1110 userState.mTouchExplorationGrantedServices.contains(service.mComponentName); 1111 if (!service.mIsAutomation && !canToggleTouchExploration) { 1112 showEnableTouchExplorationDialog(service); 1113 } else { 1114 Settings.Secure.putIntForUser(mContext.getContentResolver(), 1115 Settings.Secure.TOUCH_EXPLORATION_ENABLED, 1, userState.mUserId); 1116 } 1117 } 1118 } 1119 1120 private void tryDisableTouchExplorationLocked(Service service) { 1121 UserState userState = getUserStateLocked(service.mUserId); 1122 if (userState.mIsTouchExplorationEnabled) { 1123 final int serviceCount = userState.mServices.size(); 1124 for (int i = 0; i < serviceCount; i++) { 1125 Service other = userState.mServices.get(i); 1126 if (other != service && other.mRequestTouchExplorationMode) { 1127 return; 1128 } 1129 } 1130 Settings.Secure.putIntForUser(mContext.getContentResolver(), 1131 Settings.Secure.TOUCH_EXPLORATION_ENABLED, 0, userState.mUserId); 1132 } 1133 } 1134 1135 private class AccessibilityConnectionWrapper implements DeathRecipient { 1136 private final int mWindowId; 1137 private final int mUserId; 1138 private final IAccessibilityInteractionConnection mConnection; 1139 1140 public AccessibilityConnectionWrapper(int windowId, 1141 IAccessibilityInteractionConnection connection, int userId) { 1142 mWindowId = windowId; 1143 mUserId = userId; 1144 mConnection = connection; 1145 } 1146 1147 public void linkToDeath() throws RemoteException { 1148 mConnection.asBinder().linkToDeath(this, 0); 1149 } 1150 1151 public void unlinkToDeath() { 1152 mConnection.asBinder().unlinkToDeath(this, 0); 1153 } 1154 1155 @Override 1156 public void binderDied() { 1157 unlinkToDeath(); 1158 synchronized (mLock) { 1159 removeAccessibilityInteractionConnectionLocked(mWindowId, mUserId); 1160 } 1161 } 1162 } 1163 1164 private final class MainHandler extends Handler { 1165 public static final int MSG_SEND_ACCESSIBILITY_EVENT_TO_INPUT_FILTER = 1; 1166 public static final int MSG_SEND_STATE_TO_CLIENTS = 2; 1167 public static final int MSG_SEND_CLEARED_STATE_TO_CLIENTS_FOR_USER = 3; 1168 public static final int MSG_SEND_RECREATE_INTERNAL_STATE = 4; 1169 public static final int MSG_REGISTER_UI_TEST_AUTOMATION_SERVICE = 5; 1170 1171 public MainHandler(Looper looper) { 1172 super(looper); 1173 } 1174 1175 @Override 1176 public void handleMessage(Message msg) { 1177 final int type = msg.what; 1178 switch (type) { 1179 case MSG_SEND_ACCESSIBILITY_EVENT_TO_INPUT_FILTER: { 1180 AccessibilityEvent event = (AccessibilityEvent) msg.obj; 1181 synchronized (mLock) { 1182 if (mHasInputFilter && mInputFilter != null) { 1183 mInputFilter.notifyAccessibilityEvent(event); 1184 } 1185 } 1186 event.recycle(); 1187 } break; 1188 case MSG_SEND_STATE_TO_CLIENTS: { 1189 final int clientState = msg.arg1; 1190 final int userId = msg.arg2; 1191 sendStateToClients(clientState, mGlobalClients); 1192 sendStateToClientsForUser(clientState, userId); 1193 } break; 1194 case MSG_SEND_CLEARED_STATE_TO_CLIENTS_FOR_USER: { 1195 final int userId = msg.arg1; 1196 sendStateToClientsForUser(0, userId); 1197 } break; 1198 case MSG_SEND_RECREATE_INTERNAL_STATE: { 1199 final int userId = msg.arg1; 1200 synchronized (mLock) { 1201 UserState userState = getUserStateLocked(userId); 1202 recreateInternalStateLocked(userState); 1203 } 1204 } break; 1205 case MSG_REGISTER_UI_TEST_AUTOMATION_SERVICE: { 1206 SomeArgs args = (SomeArgs) msg.obj; 1207 try { 1208 IAccessibilityServiceClient client = 1209 (IAccessibilityServiceClient) args.arg1; 1210 AccessibilityServiceInfo info = (AccessibilityServiceInfo) args.arg2; 1211 registerUiTestAutomationService(client, info); 1212 } finally { 1213 args.recycle(); 1214 } 1215 } break; 1216 } 1217 } 1218 1219 private void sendStateToClientsForUser(int clientState, int userId) { 1220 final UserState userState; 1221 synchronized (mLock) { 1222 userState = getUserStateLocked(userId); 1223 } 1224 sendStateToClients(clientState, userState.mClients); 1225 } 1226 1227 private void sendStateToClients(int clientState, 1228 RemoteCallbackList<IAccessibilityManagerClient> clients) { 1229 try { 1230 final int userClientCount = clients.beginBroadcast(); 1231 for (int i = 0; i < userClientCount; i++) { 1232 IAccessibilityManagerClient client = clients.getBroadcastItem(i); 1233 try { 1234 client.setState(clientState); 1235 } catch (RemoteException re) { 1236 /* ignore */ 1237 } 1238 } 1239 } finally { 1240 clients.finishBroadcast(); 1241 } 1242 } 1243 } 1244 1245 /** 1246 * This class represents an accessibility service. It stores all per service 1247 * data required for the service management, provides API for starting/stopping the 1248 * service and is responsible for adding/removing the service in the data structures 1249 * for service management. The class also exposes configuration interface that is 1250 * passed to the service it represents as soon it is bound. It also serves as the 1251 * connection for the service. 1252 */ 1253 class Service extends IAccessibilityServiceConnection.Stub 1254 implements ServiceConnection, DeathRecipient { 1255 1256 // We pick the MSB to avoid collision since accessibility event types are 1257 // used as message types allowing us to remove messages per event type. 1258 private static final int MSG_ON_GESTURE = 0x80000000; 1259 1260 final int mUserId; 1261 1262 int mId = 0; 1263 1264 AccessibilityServiceInfo mAccessibilityServiceInfo; 1265 1266 IBinder mService; 1267 1268 IAccessibilityServiceClient mServiceInterface; 1269 1270 int mEventTypes; 1271 1272 int mFeedbackType; 1273 1274 Set<String> mPackageNames = new HashSet<String>(); 1275 1276 boolean mIsDefault; 1277 1278 boolean mRequestTouchExplorationMode; 1279 1280 boolean mIncludeNotImportantViews; 1281 1282 long mNotificationTimeout; 1283 1284 ComponentName mComponentName; 1285 1286 Intent mIntent; 1287 1288 boolean mCanRetrieveScreenContent; 1289 1290 boolean mIsAutomation; 1291 1292 final Rect mTempBounds = new Rect(); 1293 1294 final ResolveInfo mResolveInfo; 1295 1296 // the events pending events to be dispatched to this service 1297 final SparseArray<AccessibilityEvent> mPendingEvents = 1298 new SparseArray<AccessibilityEvent>(); 1299 1300 /** 1301 * Handler for delayed event dispatch. 1302 */ 1303 public Handler mHandler = new Handler(mMainHandler.getLooper()) { 1304 @Override 1305 public void handleMessage(Message message) { 1306 final int type = message.what; 1307 switch (type) { 1308 case MSG_ON_GESTURE: { 1309 final int gestureId = message.arg1; 1310 notifyGestureInternal(gestureId); 1311 } break; 1312 default: { 1313 final int eventType = type; 1314 notifyAccessibilityEventInternal(eventType); 1315 } break; 1316 } 1317 } 1318 }; 1319 1320 public Service(int userId, ComponentName componentName, 1321 AccessibilityServiceInfo accessibilityServiceInfo, boolean isAutomation) { 1322 mUserId = userId; 1323 mResolveInfo = accessibilityServiceInfo.getResolveInfo(); 1324 mId = sIdCounter++; 1325 mComponentName = componentName; 1326 mAccessibilityServiceInfo = accessibilityServiceInfo; 1327 mIsAutomation = isAutomation; 1328 if (!isAutomation) { 1329 mCanRetrieveScreenContent = accessibilityServiceInfo.getCanRetrieveWindowContent(); 1330 mRequestTouchExplorationMode = 1331 (accessibilityServiceInfo.flags 1332 & AccessibilityServiceInfo.FLAG_REQUEST_TOUCH_EXPLORATION_MODE) != 0; 1333 mIntent = new Intent().setComponent(mComponentName); 1334 mIntent.putExtra(Intent.EXTRA_CLIENT_LABEL, 1335 com.android.internal.R.string.accessibility_binding_label); 1336 mIntent.putExtra(Intent.EXTRA_CLIENT_INTENT, PendingIntent.getActivity( 1337 mContext, 0, new Intent(Settings.ACTION_ACCESSIBILITY_SETTINGS), 0)); 1338 } else { 1339 mCanRetrieveScreenContent = true; 1340 } 1341 setDynamicallyConfigurableProperties(accessibilityServiceInfo); 1342 } 1343 1344 public void setDynamicallyConfigurableProperties(AccessibilityServiceInfo info) { 1345 mEventTypes = info.eventTypes; 1346 mFeedbackType = info.feedbackType; 1347 String[] packageNames = info.packageNames; 1348 if (packageNames != null) { 1349 mPackageNames.addAll(Arrays.asList(packageNames)); 1350 } 1351 mNotificationTimeout = info.notificationTimeout; 1352 mIsDefault = (info.flags & DEFAULT) != 0; 1353 1354 if (mIsAutomation || info.getResolveInfo().serviceInfo.applicationInfo.targetSdkVersion 1355 >= Build.VERSION_CODES.JELLY_BEAN) { 1356 mIncludeNotImportantViews = 1357 (info.flags & FLAG_INCLUDE_NOT_IMPORTANT_VIEWS) != 0; 1358 } 1359 1360 mRequestTouchExplorationMode = (info.flags 1361 & AccessibilityServiceInfo.FLAG_REQUEST_TOUCH_EXPLORATION_MODE) != 0; 1362 1363 // If this service is up and running we may have to enable touch 1364 // exploration, otherwise this will happen when the service connects. 1365 synchronized (mLock) { 1366 if (isConfigured()) { 1367 if (mRequestTouchExplorationMode) { 1368 tryEnableTouchExplorationLocked(this); 1369 } else { 1370 tryDisableTouchExplorationLocked(this); 1371 } 1372 } 1373 } 1374 } 1375 1376 /** 1377 * Binds to the accessibility service. 1378 * 1379 * @return True if binding is successful. 1380 */ 1381 public boolean bind() { 1382 if (!mIsAutomation && mService == null) { 1383 return mContext.bindService(mIntent, this, Context.BIND_AUTO_CREATE, mUserId); 1384 } 1385 return false; 1386 } 1387 1388 /** 1389 * Unbinds form the accessibility service and removes it from the data 1390 * structures for service management. 1391 * 1392 * @return True if unbinding is successful. 1393 */ 1394 public boolean unbind() { 1395 if (mService != null) { 1396 synchronized (mLock) { 1397 tryRemoveServiceLocked(this); 1398 } 1399 if (!mIsAutomation) { 1400 mContext.unbindService(this); 1401 } 1402 return true; 1403 } 1404 return false; 1405 } 1406 1407 /** 1408 * Returns if the service is configured i.e. at least event types of interest 1409 * and feedback type must be set. 1410 * 1411 * @return True if the service is configured, false otherwise. 1412 */ 1413 public boolean isConfigured() { 1414 return (mEventTypes != 0 && mFeedbackType != 0 && mService != null); 1415 } 1416 1417 @Override 1418 public AccessibilityServiceInfo getServiceInfo() { 1419 synchronized (mLock) { 1420 return mAccessibilityServiceInfo; 1421 } 1422 } 1423 1424 @Override 1425 public void setServiceInfo(AccessibilityServiceInfo info) { 1426 final long identity = Binder.clearCallingIdentity(); 1427 try { 1428 synchronized (mLock) { 1429 // If the XML manifest had data to configure the service its info 1430 // should be already set. In such a case update only the dynamically 1431 // configurable properties. 1432 AccessibilityServiceInfo oldInfo = mAccessibilityServiceInfo; 1433 if (oldInfo != null) { 1434 oldInfo.updateDynamicallyConfigurableProperties(info); 1435 setDynamicallyConfigurableProperties(oldInfo); 1436 } else { 1437 setDynamicallyConfigurableProperties(info); 1438 } 1439 } 1440 } finally { 1441 Binder.restoreCallingIdentity(identity); 1442 } 1443 } 1444 1445 @Override 1446 public void onServiceConnected(ComponentName componentName, IBinder service) { 1447 mService = service; 1448 mServiceInterface = IAccessibilityServiceClient.Stub.asInterface(service); 1449 try { 1450 mServiceInterface.setConnection(this, mId); 1451 synchronized (mLock) { 1452 tryAddServiceLocked(this, mUserId); 1453 } 1454 } catch (RemoteException re) { 1455 Slog.w(LOG_TAG, "Error while setting Controller for service: " + service, re); 1456 } 1457 } 1458 1459 @Override 1460 public float findAccessibilityNodeInfoByViewId(int accessibilityWindowId, 1461 long accessibilityNodeId, int viewId, int interactionId, 1462 IAccessibilityInteractionConnectionCallback callback, long interrogatingTid) 1463 throws RemoteException { 1464 final int resolvedWindowId; 1465 IAccessibilityInteractionConnection connection = null; 1466 synchronized (mLock) { 1467 final int resolvedUserId = mSecurityPolicy 1468 .resolveCallingUserIdEnforcingPermissionsLocked( 1469 UserHandle.getCallingUserId()); 1470 if (resolvedUserId != mCurrentUserId) { 1471 return -1; 1472 } 1473 mSecurityPolicy.enforceCanRetrieveWindowContent(this); 1474 final boolean permissionGranted = mSecurityPolicy.canRetrieveWindowContent(this); 1475 if (!permissionGranted) { 1476 return 0; 1477 } else { 1478 resolvedWindowId = resolveAccessibilityWindowIdLocked(accessibilityWindowId); 1479 connection = getConnectionLocked(resolvedWindowId); 1480 if (connection == null) { 1481 return 0; 1482 } 1483 } 1484 } 1485 final int flags = (mIncludeNotImportantViews) ? 1486 AccessibilityNodeInfo.INCLUDE_NOT_IMPORTANT_VIEWS : 0; 1487 final int interrogatingPid = Binder.getCallingPid(); 1488 final long identityToken = Binder.clearCallingIdentity(); 1489 try { 1490 connection.findAccessibilityNodeInfoByViewId(accessibilityNodeId, viewId, 1491 interactionId, callback, flags, interrogatingPid, interrogatingTid); 1492 return getCompatibilityScale(resolvedWindowId); 1493 } catch (RemoteException re) { 1494 if (DEBUG) { 1495 Slog.e(LOG_TAG, "Error findAccessibilityNodeInfoByViewId()."); 1496 } 1497 } finally { 1498 Binder.restoreCallingIdentity(identityToken); 1499 } 1500 return 0; 1501 } 1502 1503 @Override 1504 public float findAccessibilityNodeInfosByText(int accessibilityWindowId, 1505 long accessibilityNodeId, String text, int interactionId, 1506 IAccessibilityInteractionConnectionCallback callback, long interrogatingTid) 1507 throws RemoteException { 1508 final int resolvedWindowId; 1509 IAccessibilityInteractionConnection connection = null; 1510 synchronized (mLock) { 1511 final int resolvedUserId = mSecurityPolicy 1512 .resolveCallingUserIdEnforcingPermissionsLocked( 1513 UserHandle.getCallingUserId()); 1514 if (resolvedUserId != mCurrentUserId) { 1515 return -1; 1516 } 1517 mSecurityPolicy.enforceCanRetrieveWindowContent(this); 1518 resolvedWindowId = resolveAccessibilityWindowIdLocked(accessibilityWindowId); 1519 final boolean permissionGranted = 1520 mSecurityPolicy.canGetAccessibilityNodeInfoLocked(this, resolvedWindowId); 1521 if (!permissionGranted) { 1522 return 0; 1523 } else { 1524 connection = getConnectionLocked(resolvedWindowId); 1525 if (connection == null) { 1526 return 0; 1527 } 1528 } 1529 } 1530 final int flags = (mIncludeNotImportantViews) ? 1531 AccessibilityNodeInfo.INCLUDE_NOT_IMPORTANT_VIEWS : 0; 1532 final int interrogatingPid = Binder.getCallingPid(); 1533 final long identityToken = Binder.clearCallingIdentity(); 1534 try { 1535 connection.findAccessibilityNodeInfosByText(accessibilityNodeId, text, 1536 interactionId, callback, flags, interrogatingPid, 1537 interrogatingTid); 1538 return getCompatibilityScale(resolvedWindowId); 1539 } catch (RemoteException re) { 1540 if (DEBUG) { 1541 Slog.e(LOG_TAG, "Error calling findAccessibilityNodeInfosByText()"); 1542 } 1543 } finally { 1544 Binder.restoreCallingIdentity(identityToken); 1545 } 1546 return 0; 1547 } 1548 1549 @Override 1550 public float findAccessibilityNodeInfoByAccessibilityId(int accessibilityWindowId, 1551 long accessibilityNodeId, int interactionId, 1552 IAccessibilityInteractionConnectionCallback callback, int flags, 1553 long interrogatingTid) throws RemoteException { 1554 final int resolvedWindowId; 1555 IAccessibilityInteractionConnection connection = null; 1556 synchronized (mLock) { 1557 final int resolvedUserId = mSecurityPolicy 1558 .resolveCallingUserIdEnforcingPermissionsLocked( 1559 UserHandle.getCallingUserId()); 1560 if (resolvedUserId != mCurrentUserId) { 1561 return -1; 1562 } 1563 mSecurityPolicy.enforceCanRetrieveWindowContent(this); 1564 resolvedWindowId = resolveAccessibilityWindowIdLocked(accessibilityWindowId); 1565 final boolean permissionGranted = 1566 mSecurityPolicy.canGetAccessibilityNodeInfoLocked(this, resolvedWindowId); 1567 if (!permissionGranted) { 1568 return 0; 1569 } else { 1570 connection = getConnectionLocked(resolvedWindowId); 1571 if (connection == null) { 1572 return 0; 1573 } 1574 } 1575 } 1576 final int allFlags = flags | ((mIncludeNotImportantViews) ? 1577 AccessibilityNodeInfo.INCLUDE_NOT_IMPORTANT_VIEWS : 0); 1578 final int interrogatingPid = Binder.getCallingPid(); 1579 final long identityToken = Binder.clearCallingIdentity(); 1580 try { 1581 connection.findAccessibilityNodeInfoByAccessibilityId(accessibilityNodeId, 1582 interactionId, callback, allFlags, interrogatingPid, interrogatingTid); 1583 return getCompatibilityScale(resolvedWindowId); 1584 } catch (RemoteException re) { 1585 if (DEBUG) { 1586 Slog.e(LOG_TAG, "Error calling findAccessibilityNodeInfoByAccessibilityId()"); 1587 } 1588 } finally { 1589 Binder.restoreCallingIdentity(identityToken); 1590 } 1591 return 0; 1592 } 1593 1594 @Override 1595 public float findFocus(int accessibilityWindowId, long accessibilityNodeId, 1596 int focusType, int interactionId, 1597 IAccessibilityInteractionConnectionCallback callback, long interrogatingTid) 1598 throws RemoteException { 1599 final int resolvedWindowId; 1600 IAccessibilityInteractionConnection connection = null; 1601 synchronized (mLock) { 1602 final int resolvedUserId = mSecurityPolicy 1603 .resolveCallingUserIdEnforcingPermissionsLocked( 1604 UserHandle.getCallingUserId()); 1605 if (resolvedUserId != mCurrentUserId) { 1606 return -1; 1607 } 1608 mSecurityPolicy.enforceCanRetrieveWindowContent(this); 1609 resolvedWindowId = resolveAccessibilityWindowIdLocked(accessibilityWindowId); 1610 final boolean permissionGranted = 1611 mSecurityPolicy.canGetAccessibilityNodeInfoLocked(this, resolvedWindowId); 1612 if (!permissionGranted) { 1613 return 0; 1614 } else { 1615 connection = getConnectionLocked(resolvedWindowId); 1616 if (connection == null) { 1617 return 0; 1618 } 1619 } 1620 } 1621 final int flags = (mIncludeNotImportantViews) ? 1622 AccessibilityNodeInfo.INCLUDE_NOT_IMPORTANT_VIEWS : 0; 1623 final int interrogatingPid = Binder.getCallingPid(); 1624 final long identityToken = Binder.clearCallingIdentity(); 1625 try { 1626 connection.findFocus(accessibilityNodeId, focusType, interactionId, callback, 1627 flags, interrogatingPid, interrogatingTid); 1628 return getCompatibilityScale(resolvedWindowId); 1629 } catch (RemoteException re) { 1630 if (DEBUG) { 1631 Slog.e(LOG_TAG, "Error calling findAccessibilityFocus()"); 1632 } 1633 } finally { 1634 Binder.restoreCallingIdentity(identityToken); 1635 } 1636 return 0; 1637 } 1638 1639 @Override 1640 public float focusSearch(int accessibilityWindowId, long accessibilityNodeId, 1641 int direction, int interactionId, 1642 IAccessibilityInteractionConnectionCallback callback, long interrogatingTid) 1643 throws RemoteException { 1644 final int resolvedWindowId; 1645 IAccessibilityInteractionConnection connection = null; 1646 synchronized (mLock) { 1647 final int resolvedUserId = mSecurityPolicy 1648 .resolveCallingUserIdEnforcingPermissionsLocked( 1649 UserHandle.getCallingUserId()); 1650 if (resolvedUserId != mCurrentUserId) { 1651 return -1; 1652 } 1653 mSecurityPolicy.enforceCanRetrieveWindowContent(this); 1654 resolvedWindowId = resolveAccessibilityWindowIdLocked(accessibilityWindowId); 1655 final boolean permissionGranted = 1656 mSecurityPolicy.canGetAccessibilityNodeInfoLocked(this, resolvedWindowId); 1657 if (!permissionGranted) { 1658 return 0; 1659 } else { 1660 connection = getConnectionLocked(resolvedWindowId); 1661 if (connection == null) { 1662 return 0; 1663 } 1664 } 1665 } 1666 final int flags = (mIncludeNotImportantViews) ? 1667 AccessibilityNodeInfo.INCLUDE_NOT_IMPORTANT_VIEWS : 0; 1668 final int interrogatingPid = Binder.getCallingPid(); 1669 final long identityToken = Binder.clearCallingIdentity(); 1670 try { 1671 connection.focusSearch(accessibilityNodeId, direction, interactionId, callback, 1672 flags, interrogatingPid, interrogatingTid); 1673 return getCompatibilityScale(resolvedWindowId); 1674 } catch (RemoteException re) { 1675 if (DEBUG) { 1676 Slog.e(LOG_TAG, "Error calling accessibilityFocusSearch()"); 1677 } 1678 } finally { 1679 Binder.restoreCallingIdentity(identityToken); 1680 } 1681 return 0; 1682 } 1683 1684 @Override 1685 public boolean performAccessibilityAction(int accessibilityWindowId, 1686 long accessibilityNodeId, int action, Bundle arguments, int interactionId, 1687 IAccessibilityInteractionConnectionCallback callback, long interrogatingTid) 1688 throws RemoteException { 1689 final int resolvedWindowId; 1690 IAccessibilityInteractionConnection connection = null; 1691 synchronized (mLock) { 1692 final int resolvedUserId = mSecurityPolicy 1693 .resolveCallingUserIdEnforcingPermissionsLocked( 1694 UserHandle.getCallingUserId()); 1695 if (resolvedUserId != mCurrentUserId) { 1696 return false; 1697 } 1698 mSecurityPolicy.enforceCanRetrieveWindowContent(this); 1699 resolvedWindowId = resolveAccessibilityWindowIdLocked(accessibilityWindowId); 1700 final boolean permissionGranted = mSecurityPolicy.canPerformActionLocked(this, 1701 resolvedWindowId, action, arguments); 1702 if (!permissionGranted) { 1703 return false; 1704 } else { 1705 connection = getConnectionLocked(resolvedWindowId); 1706 if (connection == null) { 1707 return false; 1708 } 1709 } 1710 } 1711 final int flags = (mIncludeNotImportantViews) ? 1712 AccessibilityNodeInfo.INCLUDE_NOT_IMPORTANT_VIEWS : 0; 1713 final int interrogatingPid = Binder.getCallingPid(); 1714 final long identityToken = Binder.clearCallingIdentity(); 1715 try { 1716 connection.performAccessibilityAction(accessibilityNodeId, action, arguments, 1717 interactionId, callback, flags, interrogatingPid, interrogatingTid); 1718 } catch (RemoteException re) { 1719 if (DEBUG) { 1720 Slog.e(LOG_TAG, "Error calling performAccessibilityAction()"); 1721 } 1722 } finally { 1723 Binder.restoreCallingIdentity(identityToken); 1724 } 1725 return true; 1726 } 1727 1728 public boolean performGlobalAction(int action) throws RemoteException { 1729 synchronized (mLock) { 1730 final int resolvedUserId = mSecurityPolicy 1731 .resolveCallingUserIdEnforcingPermissionsLocked( 1732 UserHandle.getCallingUserId()); 1733 if (resolvedUserId != mCurrentUserId) { 1734 return false; 1735 } 1736 } 1737 final long identity = Binder.clearCallingIdentity(); 1738 try { 1739 switch (action) { 1740 case AccessibilityService.GLOBAL_ACTION_BACK: { 1741 sendDownAndUpKeyEvents(KeyEvent.KEYCODE_BACK); 1742 } return true; 1743 case AccessibilityService.GLOBAL_ACTION_HOME: { 1744 sendDownAndUpKeyEvents(KeyEvent.KEYCODE_HOME); 1745 } return true; 1746 case AccessibilityService.GLOBAL_ACTION_RECENTS: { 1747 openRecents(); 1748 } return true; 1749 case AccessibilityService.GLOBAL_ACTION_NOTIFICATIONS: { 1750 expandStatusBar(); 1751 } return true; 1752 } 1753 return false; 1754 } finally { 1755 Binder.restoreCallingIdentity(identity); 1756 } 1757 } 1758 1759 public void onServiceDisconnected(ComponentName componentName) { 1760 /* do nothing - #binderDied takes care */ 1761 } 1762 1763 public void linkToOwnDeath() throws RemoteException { 1764 mService.linkToDeath(this, 0); 1765 } 1766 1767 public void unlinkToOwnDeath() { 1768 mService.unlinkToDeath(this, 0); 1769 } 1770 1771 public void dispose() { 1772 try { 1773 // Clear the proxy in the other process so this 1774 // IAccessibilityServiceConnection can be garbage collected. 1775 mServiceInterface.setConnection(null, mId); 1776 } catch (RemoteException re) { 1777 /* ignore */ 1778 } 1779 mService = null; 1780 mServiceInterface = null; 1781 } 1782 1783 public void binderDied() { 1784 synchronized (mLock) { 1785 // The death recipient is unregistered in tryRemoveServiceLocked 1786 tryRemoveServiceLocked(this); 1787 // We no longer have an automation service, so restore 1788 // the state based on values in the settings database. 1789 if (mIsAutomation) { 1790 mUiAutomationService = null; 1791 recreateInternalStateLocked(getUserStateLocked(mUserId)); 1792 } 1793 } 1794 } 1795 1796 /** 1797 * Performs a notification for an {@link AccessibilityEvent}. 1798 * 1799 * @param event The event. 1800 */ 1801 public void notifyAccessibilityEvent(AccessibilityEvent event) { 1802 synchronized (mLock) { 1803 final int eventType = event.getEventType(); 1804 // Make a copy since during dispatch it is possible the event to 1805 // be modified to remove its source if the receiving service does 1806 // not have permission to access the window content. 1807 AccessibilityEvent newEvent = AccessibilityEvent.obtain(event); 1808 AccessibilityEvent oldEvent = mPendingEvents.get(eventType); 1809 mPendingEvents.put(eventType, newEvent); 1810 1811 final int what = eventType; 1812 if (oldEvent != null) { 1813 mHandler.removeMessages(what); 1814 oldEvent.recycle(); 1815 } 1816 1817 Message message = mHandler.obtainMessage(what); 1818 mHandler.sendMessageDelayed(message, mNotificationTimeout); 1819 } 1820 } 1821 1822 /** 1823 * Notifies an accessibility service client for a scheduled event given the event type. 1824 * 1825 * @param eventType The type of the event to dispatch. 1826 */ 1827 private void notifyAccessibilityEventInternal(int eventType) { 1828 IAccessibilityServiceClient listener; 1829 AccessibilityEvent event; 1830 1831 synchronized (mLock) { 1832 listener = mServiceInterface; 1833 1834 // If the service died/was disabled while the message for dispatching 1835 // the accessibility event was propagating the listener may be null. 1836 if (listener == null) { 1837 return; 1838 } 1839 1840 event = mPendingEvents.get(eventType); 1841 1842 // Check for null here because there is a concurrent scenario in which this 1843 // happens: 1) A binder thread calls notifyAccessibilityServiceDelayedLocked 1844 // which posts a message for dispatching an event. 2) The message is pulled 1845 // from the queue by the handler on the service thread and the latter is 1846 // just about to acquire the lock and call this method. 3) Now another binder 1847 // thread acquires the lock calling notifyAccessibilityServiceDelayedLocked 1848 // so the service thread waits for the lock; 4) The binder thread replaces 1849 // the event with a more recent one (assume the same event type) and posts a 1850 // dispatch request releasing the lock. 5) Now the main thread is unblocked and 1851 // dispatches the event which is removed from the pending ones. 6) And ... now 1852 // the service thread handles the last message posted by the last binder call 1853 // but the event is already dispatched and hence looking it up in the pending 1854 // ones yields null. This check is much simpler that keeping count for each 1855 // event type of each service to catch such a scenario since only one message 1856 // is processed at a time. 1857 if (event == null) { 1858 return; 1859 } 1860 1861 mPendingEvents.remove(eventType); 1862 if (mSecurityPolicy.canRetrieveWindowContent(this)) { 1863 event.setConnectionId(mId); 1864 } else { 1865 event.setSource(null); 1866 } 1867 event.setSealed(true); 1868 } 1869 1870 try { 1871 listener.onAccessibilityEvent(event); 1872 if (DEBUG) { 1873 Slog.i(LOG_TAG, "Event " + event + " sent to " + listener); 1874 } 1875 } catch (RemoteException re) { 1876 Slog.e(LOG_TAG, "Error during sending " + event + " to " + listener, re); 1877 } finally { 1878 event.recycle(); 1879 } 1880 } 1881 1882 public void notifyGesture(int gestureId) { 1883 mHandler.obtainMessage(MSG_ON_GESTURE, gestureId, 0).sendToTarget(); 1884 } 1885 1886 private void notifyGestureInternal(int gestureId) { 1887 IAccessibilityServiceClient listener = mServiceInterface; 1888 if (listener != null) { 1889 try { 1890 listener.onGesture(gestureId); 1891 } catch (RemoteException re) { 1892 Slog.e(LOG_TAG, "Error during sending gesture " + gestureId 1893 + " to " + mService, re); 1894 } 1895 } 1896 } 1897 1898 private void sendDownAndUpKeyEvents(int keyCode) { 1899 final long token = Binder.clearCallingIdentity(); 1900 1901 // Inject down. 1902 final long downTime = SystemClock.uptimeMillis(); 1903 KeyEvent down = KeyEvent.obtain(downTime, downTime, KeyEvent.ACTION_DOWN, keyCode, 0, 0, 1904 KeyCharacterMap.VIRTUAL_KEYBOARD, 0, KeyEvent.FLAG_FROM_SYSTEM, 1905 InputDevice.SOURCE_KEYBOARD, null); 1906 InputManager.getInstance().injectInputEvent(down, 1907 InputManager.INJECT_INPUT_EVENT_MODE_ASYNC); 1908 down.recycle(); 1909 1910 // Inject up. 1911 final long upTime = SystemClock.uptimeMillis(); 1912 KeyEvent up = KeyEvent.obtain(downTime, upTime, KeyEvent.ACTION_UP, keyCode, 0, 0, 1913 KeyCharacterMap.VIRTUAL_KEYBOARD, 0, KeyEvent.FLAG_FROM_SYSTEM, 1914 InputDevice.SOURCE_KEYBOARD, null); 1915 InputManager.getInstance().injectInputEvent(up, 1916 InputManager.INJECT_INPUT_EVENT_MODE_ASYNC); 1917 up.recycle(); 1918 1919 Binder.restoreCallingIdentity(token); 1920 } 1921 1922 private void expandStatusBar() { 1923 final long token = Binder.clearCallingIdentity(); 1924 1925 StatusBarManager statusBarManager = (StatusBarManager) mContext.getSystemService( 1926 android.app.Service.STATUS_BAR_SERVICE); 1927 statusBarManager.expand(); 1928 1929 Binder.restoreCallingIdentity(token); 1930 } 1931 1932 private void openRecents() { 1933 final long token = Binder.clearCallingIdentity(); 1934 1935 IStatusBarService statusBarService = IStatusBarService.Stub.asInterface( 1936 ServiceManager.getService("statusbar")); 1937 try { 1938 statusBarService.toggleRecentApps(); 1939 } catch (RemoteException e) { 1940 Slog.e(LOG_TAG, "Error toggling recent apps."); 1941 } 1942 1943 Binder.restoreCallingIdentity(token); 1944 } 1945 1946 private IAccessibilityInteractionConnection getConnectionLocked(int windowId) { 1947 if (DEBUG) { 1948 Slog.i(LOG_TAG, "Trying to get interaction connection to windowId: " + windowId); 1949 } 1950 AccessibilityConnectionWrapper wrapper = mGlobalInteractionConnections.get(windowId); 1951 if (wrapper == null) { 1952 wrapper = getCurrentUserStateLocked().mInteractionConnections.get(windowId); 1953 } 1954 if (wrapper != null && wrapper.mConnection != null) { 1955 return wrapper.mConnection; 1956 } 1957 if (DEBUG) { 1958 Slog.e(LOG_TAG, "No interaction connection to window: " + windowId); 1959 } 1960 return null; 1961 } 1962 1963 private int resolveAccessibilityWindowIdLocked(int accessibilityWindowId) { 1964 if (accessibilityWindowId == AccessibilityNodeInfo.ACTIVE_WINDOW_ID) { 1965 return mSecurityPolicy.mActiveWindowId; 1966 } 1967 return accessibilityWindowId; 1968 } 1969 1970 private float getCompatibilityScale(int windowId) { 1971 try { 1972 IBinder windowToken = mGlobalWindowTokens.get(windowId); 1973 if (windowToken != null) { 1974 return mWindowManagerService.getWindowCompatibilityScale(windowToken); 1975 } 1976 windowToken = getCurrentUserStateLocked().mWindowTokens.get(windowId); 1977 if (windowToken != null) { 1978 return mWindowManagerService.getWindowCompatibilityScale(windowToken); 1979 } 1980 } catch (RemoteException re) { 1981 /* ignore */ 1982 } 1983 return 1.0f; 1984 } 1985 } 1986 1987 final class SecurityPolicy { 1988 private static final int VALID_ACTIONS = 1989 AccessibilityNodeInfo.ACTION_CLICK 1990 | AccessibilityNodeInfo.ACTION_LONG_CLICK 1991 | AccessibilityNodeInfo.ACTION_FOCUS 1992 | AccessibilityNodeInfo.ACTION_CLEAR_FOCUS 1993 | AccessibilityNodeInfo.ACTION_SELECT 1994 | AccessibilityNodeInfo.ACTION_CLEAR_SELECTION 1995 | AccessibilityNodeInfo.ACTION_ACCESSIBILITY_FOCUS 1996 | AccessibilityNodeInfo.ACTION_CLEAR_ACCESSIBILITY_FOCUS 1997 | AccessibilityNodeInfo.ACTION_NEXT_AT_MOVEMENT_GRANULARITY 1998 | AccessibilityNodeInfo.ACTION_PREVIOUS_AT_MOVEMENT_GRANULARITY 1999 | AccessibilityNodeInfo.ACTION_NEXT_HTML_ELEMENT 2000 | AccessibilityNodeInfo.ACTION_PREVIOUS_HTML_ELEMENT 2001 | AccessibilityNodeInfo.ACTION_SCROLL_FORWARD 2002 | AccessibilityNodeInfo.ACTION_SCROLL_BACKWARD; 2003 2004 private static final int RETRIEVAL_ALLOWING_EVENT_TYPES = 2005 AccessibilityEvent.TYPE_VIEW_CLICKED 2006 | AccessibilityEvent.TYPE_VIEW_FOCUSED 2007 | AccessibilityEvent.TYPE_VIEW_HOVER_ENTER 2008 | AccessibilityEvent.TYPE_VIEW_HOVER_EXIT 2009 | AccessibilityEvent.TYPE_VIEW_LONG_CLICKED 2010 | AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED 2011 | AccessibilityEvent.TYPE_WINDOW_STATE_CHANGED 2012 | AccessibilityEvent.TYPE_VIEW_SELECTED 2013 | AccessibilityEvent.TYPE_WINDOW_CONTENT_CHANGED 2014 | AccessibilityEvent.TYPE_VIEW_TEXT_SELECTION_CHANGED 2015 | AccessibilityEvent.TYPE_VIEW_SCROLLED 2016 | AccessibilityEvent.TYPE_VIEW_ACCESSIBILITY_FOCUSED 2017 | AccessibilityEvent.TYPE_VIEW_ACCESSIBILITY_FOCUS_CLEARED; 2018 2019 private int mActiveWindowId; 2020 2021 private boolean canDispatchAccessibilityEvent(AccessibilityEvent event) { 2022 // Send window changed event only for the retrieval allowing window. 2023 return (event.getEventType() != AccessibilityEvent.TYPE_WINDOW_CONTENT_CHANGED 2024 || event.getWindowId() == mActiveWindowId); 2025 } 2026 2027 public void updateActiveWindowAndEventSourceLocked(AccessibilityEvent event) { 2028 // The active window is either the window that has input focus or 2029 // the window that the user is currently touching. If the user is 2030 // touching a window that does not have input focus as soon as the 2031 // the user stops touching that window the focused window becomes 2032 // the active one. 2033 final int windowId = event.getWindowId(); 2034 final int eventType = event.getEventType(); 2035 switch (eventType) { 2036 case AccessibilityEvent.TYPE_WINDOW_STATE_CHANGED: { 2037 if (getFocusedWindowId() == windowId) { 2038 mActiveWindowId = windowId; 2039 } 2040 } break; 2041 case AccessibilityEvent.TYPE_VIEW_HOVER_ENTER: 2042 case AccessibilityEvent.TYPE_VIEW_HOVER_EXIT: { 2043 mActiveWindowId = windowId; 2044 } break; 2045 case AccessibilityEvent.TYPE_TOUCH_EXPLORATION_GESTURE_END: { 2046 mActiveWindowId = getFocusedWindowId(); 2047 } break; 2048 } 2049 if ((eventType & RETRIEVAL_ALLOWING_EVENT_TYPES) == 0) { 2050 event.setSource(null); 2051 } 2052 } 2053 2054 public int getRetrievalAllowingWindowLocked() { 2055 return mActiveWindowId; 2056 } 2057 2058 public boolean canGetAccessibilityNodeInfoLocked(Service service, int windowId) { 2059 return canRetrieveWindowContent(service) && isRetrievalAllowingWindow(windowId); 2060 } 2061 2062 public boolean canPerformActionLocked(Service service, int windowId, int action, 2063 Bundle arguments) { 2064 return canRetrieveWindowContent(service) 2065 && isRetrievalAllowingWindow(windowId) 2066 && isActionPermitted(action); 2067 } 2068 2069 public boolean canRetrieveWindowContent(Service service) { 2070 return service.mCanRetrieveScreenContent; 2071 } 2072 2073 public void enforceCanRetrieveWindowContent(Service service) throws RemoteException { 2074 // This happens due to incorrect registration so make it apparent. 2075 if (!canRetrieveWindowContent(service)) { 2076 Slog.e(LOG_TAG, "Accessibility serivce " + service.mComponentName + " does not " + 2077 "declare android:canRetrieveWindowContent."); 2078 throw new RemoteException(); 2079 } 2080 } 2081 2082 public int resolveCallingUserIdEnforcingPermissionsLocked(int userId) { 2083 final int callingUid = Binder.getCallingUid(); 2084 if (callingUid == Process.SYSTEM_UID 2085 || callingUid == Process.SHELL_UID) { 2086 return mCurrentUserId; 2087 } 2088 final int callingUserId = UserHandle.getUserId(callingUid); 2089 if (callingUserId == userId) { 2090 return userId; 2091 } 2092 if (!hasPermission(Manifest.permission.INTERACT_ACROSS_USERS) 2093 && !hasPermission(Manifest.permission.INTERACT_ACROSS_USERS_FULL)) { 2094 throw new SecurityException("Call from user " + callingUserId + " as user " 2095 + userId + " without permission INTERACT_ACROSS_USERS or " 2096 + "INTERACT_ACROSS_USERS_FULL not allowed."); 2097 } 2098 if (userId == UserHandle.USER_CURRENT 2099 || userId == UserHandle.USER_CURRENT_OR_SELF) { 2100 return mCurrentUserId; 2101 } 2102 throw new IllegalArgumentException("Calling user can be changed to only " 2103 + "UserHandle.USER_CURRENT or UserHandle.USER_CURRENT_OR_SELF."); 2104 } 2105 2106 public boolean isCallerInteractingAcrossUsers(int userId) { 2107 final int callingUid = Binder.getCallingUid(); 2108 return (callingUid == Process.SYSTEM_UID 2109 || callingUid == Process.SHELL_UID 2110 || userId == UserHandle.USER_CURRENT 2111 || userId == UserHandle.USER_CURRENT_OR_SELF); 2112 } 2113 2114 private boolean isRetrievalAllowingWindow(int windowId) { 2115 return (mActiveWindowId == windowId); 2116 } 2117 2118 private boolean isActionPermitted(int action) { 2119 return (VALID_ACTIONS & action) != 0; 2120 } 2121 2122 private void enforceCallingPermission(String permission, String function) { 2123 if (OWN_PROCESS_ID == Binder.getCallingPid()) { 2124 return; 2125 } 2126 if (hasPermission(permission)) { 2127 throw new SecurityException("You do not have " + permission 2128 + " required to call " + function); 2129 } 2130 } 2131 2132 private boolean hasPermission(String permission) { 2133 return mContext.checkCallingPermission(permission) == PackageManager.PERMISSION_GRANTED; 2134 } 2135 2136 private int getFocusedWindowId() { 2137 final long identity = Binder.clearCallingIdentity(); 2138 try { 2139 // We call this only on window focus change or after touch 2140 // exploration gesture end and the shown windows are not that 2141 // many, so the linear look up is just fine. 2142 IBinder token = mWindowManagerService.getFocusedWindowToken(); 2143 if (token != null) { 2144 SparseArray<IBinder> windows = getCurrentUserStateLocked().mWindowTokens; 2145 final int windowCount = windows.size(); 2146 for (int i = 0; i < windowCount; i++) { 2147 if (windows.valueAt(i) == token) { 2148 return windows.keyAt(i); 2149 } 2150 } 2151 } 2152 } catch (RemoteException re) { 2153 /* ignore */ 2154 } finally { 2155 Binder.restoreCallingIdentity(identity); 2156 } 2157 return -1; 2158 } 2159 } 2160 2161 private class UserState { 2162 public final int mUserId; 2163 2164 public final CopyOnWriteArrayList<Service> mServices = new CopyOnWriteArrayList<Service>(); 2165 2166 public final RemoteCallbackList<IAccessibilityManagerClient> mClients = 2167 new RemoteCallbackList<IAccessibilityManagerClient>(); 2168 2169 public final Map<ComponentName, Service> mComponentNameToServiceMap = 2170 new HashMap<ComponentName, Service>(); 2171 2172 public final List<AccessibilityServiceInfo> mInstalledServices = 2173 new ArrayList<AccessibilityServiceInfo>(); 2174 2175 public final Set<ComponentName> mEnabledServices = new HashSet<ComponentName>(); 2176 2177 public final Set<ComponentName> mTouchExplorationGrantedServices = 2178 new HashSet<ComponentName>(); 2179 2180 public final SparseArray<AccessibilityConnectionWrapper> 2181 mInteractionConnections = 2182 new SparseArray<AccessibilityConnectionWrapper>(); 2183 2184 public final SparseArray<IBinder> mWindowTokens = new SparseArray<IBinder>(); 2185 2186 public int mHandledFeedbackTypes = 0; 2187 2188 public boolean mIsAccessibilityEnabled; 2189 public boolean mIsTouchExplorationEnabled; 2190 public boolean mIsDisplayMagnificationEnabled; 2191 2192 public UserState(int userId) { 2193 mUserId = userId; 2194 } 2195 } 2196 2197 private final class AccessibilityContentObserver extends ContentObserver { 2198 2199 private final Uri mAccessibilityEnabledUri = Settings.Secure.getUriFor( 2200 Settings.Secure.ACCESSIBILITY_ENABLED); 2201 2202 private final Uri mTouchExplorationEnabledUri = Settings.Secure.getUriFor( 2203 Settings.Secure.TOUCH_EXPLORATION_ENABLED); 2204 2205 private final Uri mDisplayMagnificationEnabledUri = Settings.Secure.getUriFor( 2206 Settings.Secure.ACCESSIBILITY_DISPLAY_MAGNIFICATION_ENABLED); 2207 2208 private final Uri mEnabledAccessibilityServicesUri = Settings.Secure.getUriFor( 2209 Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES); 2210 2211 private final Uri mTouchExplorationGrantedAccessibilityServicesUri = Settings.Secure 2212 .getUriFor(Settings.Secure.TOUCH_EXPLORATION_GRANTED_ACCESSIBILITY_SERVICES); 2213 2214 public AccessibilityContentObserver(Handler handler) { 2215 super(handler); 2216 } 2217 2218 public void register(ContentResolver contentResolver) { 2219 contentResolver.registerContentObserver(mAccessibilityEnabledUri, 2220 false, this, UserHandle.USER_ALL); 2221 contentResolver.registerContentObserver(mTouchExplorationEnabledUri, 2222 false, this, UserHandle.USER_ALL); 2223 contentResolver.registerContentObserver(mDisplayMagnificationEnabledUri, 2224 false, this, UserHandle.USER_ALL); 2225 contentResolver.registerContentObserver(mEnabledAccessibilityServicesUri, 2226 false, this, UserHandle.USER_ALL); 2227 contentResolver.registerContentObserver( 2228 mTouchExplorationGrantedAccessibilityServicesUri, 2229 false, this, UserHandle.USER_ALL); 2230 } 2231 2232 @Override 2233 public void onChange(boolean selfChange, Uri uri) { 2234 if (mAccessibilityEnabledUri.equals(uri)) { 2235 synchronized (mLock) { 2236 // We will update when the automation service dies. 2237 if (mUiAutomationService == null) { 2238 UserState userState = getCurrentUserStateLocked(); 2239 handleAccessibilityEnabledSettingChangedLocked(userState); 2240 updateInputFilterLocked(userState); 2241 scheduleSendStateToClientsLocked(userState); 2242 } 2243 } 2244 } else if (mTouchExplorationEnabledUri.equals(uri)) { 2245 synchronized (mLock) { 2246 // We will update when the automation service dies. 2247 if (mUiAutomationService == null) { 2248 UserState userState = getCurrentUserStateLocked(); 2249 handleTouchExplorationEnabledSettingChangedLocked(userState); 2250 updateInputFilterLocked(userState); 2251 scheduleSendStateToClientsLocked(userState); 2252 } 2253 } 2254 } else if (mDisplayMagnificationEnabledUri.equals(uri)) { 2255 synchronized (mLock) { 2256 // We will update when the automation service dies. 2257 if (mUiAutomationService == null) { 2258 UserState userState = getCurrentUserStateLocked(); 2259 handleDisplayMagnificationEnabledSettingChangedLocked(userState); 2260 updateInputFilterLocked(userState); 2261 scheduleSendStateToClientsLocked(userState); 2262 } 2263 } 2264 } else if (mEnabledAccessibilityServicesUri.equals(uri)) { 2265 synchronized (mLock) { 2266 // We will update when the automation service dies. 2267 if (mUiAutomationService == null) { 2268 UserState userState = getCurrentUserStateLocked(); 2269 populateEnabledAccessibilityServicesLocked(userState); 2270 manageServicesLocked(userState); 2271 } 2272 } 2273 } else if (mTouchExplorationGrantedAccessibilityServicesUri.equals(uri)) { 2274 synchronized (mLock) { 2275 // We will update when the automation service dies. 2276 if (mUiAutomationService == null) { 2277 UserState userState = getCurrentUserStateLocked(); 2278 populateTouchExplorationGrantedAccessibilityServicesLocked(userState); 2279 handleTouchExplorationGrantedAccessibilityServicesChangedLocked(userState); 2280 } 2281 } 2282 } 2283 } 2284 } 2285} 2286