services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java

   1 /*
   2  ** Copyright 2009, The Android Open Source Project
   3  **
   4  ** Licensed under the Apache License, Version 2.0 (the "License");
   5  ** you may not use this file except in compliance with the License.
   6  ** You may obtain a copy of the License at
   7  **
   8  **     http://www.apache.org/licenses/LICENSE-2.0
   9  **
  10  ** Unless required by applicable law or agreed to in writing, software
  11  ** distributed under the License is distributed on an "AS IS" BASIS,
  12  ** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  ** See the License for the specific language governing permissions and
  14  ** limitations under the License.
  15  */
  16
  17 package com.android.server.accessibility;
  18
  19 import static android.accessibilityservice.AccessibilityServiceInfo.DEFAULT;
  20
  21 import android.Manifest;
  22 import android.accessibilityservice.AccessibilityService;
  23 import android.accessibilityservice.AccessibilityServiceInfo;
  24 import android.accessibilityservice.GestureDescription;
  25 import android.accessibilityservice.IAccessibilityServiceClient;
  26 import android.accessibilityservice.IAccessibilityServiceConnection;
  27 import android.annotation.NonNull;
  28 import android.app.AlertDialog;
  29 import android.app.PendingIntent;
  30 import android.app.StatusBarManager;
  31 import android.app.UiAutomation;
  32 import android.content.BroadcastReceiver;
  33 import android.content.ComponentName;
  34 import android.content.ContentResolver;
  35 import android.content.Context;
  36 import android.content.DialogInterface;
  37 import android.content.DialogInterface.OnClickListener;
  38 import android.content.Intent;
  39 import android.content.IntentFilter;
  40 import android.content.ServiceConnection;
  41 import android.content.pm.PackageManager;
  42 import android.content.pm.ParceledListSlice;
  43 import android.content.pm.ResolveInfo;
  44 import android.content.pm.ServiceInfo;
  45 import android.content.pm.UserInfo;
  46 import android.database.ContentObserver;
  47 import android.graphics.Point;
  48 import android.graphics.Rect;
  49 import android.graphics.Region;
  50 import android.hardware.display.DisplayManager;
  51 import android.hardware.input.InputManager;
  52 import android.net.Uri;
  53 import android.os.Binder;
  54 import android.os.Build;
  55 import android.os.Bundle;
  56 import android.os.Handler;
  57 import android.os.IBinder;
  58 import android.os.Looper;
  59 import android.os.Message;
  60 import android.os.PowerManager;
  61 import android.os.Process;
  62 import android.os.RemoteCallbackList;
  63 import android.os.RemoteException;
  64 import android.os.SystemClock;
  65 import android.os.UserHandle;
  66 import android.os.UserManager;
  67 import android.provider.Settings;
  68 import android.text.TextUtils;
  69 import android.text.TextUtils.SimpleStringSplitter;
  70 import android.util.Slog;
  71 import android.util.SparseArray;
  72 import android.view.Display;
  73 import android.view.IWindow;
  74 import android.view.InputDevice;
  75 import android.view.KeyCharacterMap;
  76 import android.view.KeyEvent;
  77 import android.view.MagnificationSpec;
  78 import android.view.MotionEvent;
  79 import android.view.WindowInfo;
  80 import android.view.WindowManager;
  81 import android.view.WindowManagerInternal;
  82 import android.view.accessibility.AccessibilityEvent;
  83 import android.view.accessibility.AccessibilityInteractionClient;
  84 import android.view.accessibility.AccessibilityManager;
  85 import android.view.accessibility.AccessibilityNodeInfo;
  86 import android.view.accessibility.AccessibilityWindowInfo;
  87 import android.view.accessibility.IAccessibilityInteractionConnection;
  88 import android.view.accessibility.IAccessibilityInteractionConnectionCallback;
  89 import android.view.accessibility.IAccessibilityManager;
  90 import android.view.accessibility.IAccessibilityManagerClient;
  91
  92 import com.android.internal.R;
  93 import com.android.internal.content.PackageMonitor;
  94 import com.android.internal.os.SomeArgs;
  95 import com.android.server.LocalServices;
  96
  97 import com.android.server.statusbar.StatusBarManagerInternal;
  98 import org.xmlpull.v1.XmlPullParserException;
  99
 100 import java.io.FileDescriptor;
 101 import java.io.IOException;
 102 import java.io.PrintWriter;
 103 import java.util.ArrayList;
 104 import java.util.Arrays;
 105 import java.util.Collections;
 106 import java.util.HashMap;
 107 import java.util.HashSet;
 108 import java.util.Iterator;
 109 import java.util.List;
 110 import java.util.Map;
 111 import java.util.Set;
 112 import java.util.concurrent.CopyOnWriteArrayList;
 113
 114 /**
 115  * This class is instantiated by the system as a system level service and can be
 116  * accessed only by the system. The task of this service is to be a centralized
 117  * event dispatch for {@link AccessibilityEvent}s generated across all processes
 118  * on the device. Events are dispatched to {@link AccessibilityService}s.
 119  */
 120 public class AccessibilityManagerService extends IAccessibilityManager.Stub {
 121
 122     private static final boolean DEBUG = false;
 123
 124     private static final String LOG_TAG = "AccessibilityManagerService";
 125
 126     // TODO: This is arbitrary. When there is time implement this by watching
 127     //       when that accessibility services are bound.
 128     private static final int WAIT_FOR_USER_STATE_FULLY_INITIALIZED_MILLIS = 3000;
 129
 130     private static final int WAIT_WINDOWS_TIMEOUT_MILLIS = 5000;
 131
 132     // TODO: Restructure service initialization so services aren't connected before all of
 133     //       their capabilities are ready.
 134     private static final int WAIT_MOTION_INJECTOR_TIMEOUT_MILLIS = 1000;
 135
 136     private static final String FUNCTION_REGISTER_UI_TEST_AUTOMATION_SERVICE =
 137         "registerUiTestAutomationService";
 138
 139     private static final String TEMPORARY_ENABLE_ACCESSIBILITY_UNTIL_KEYGUARD_REMOVED =
 140             "temporaryEnableAccessibilityStateUntilKeyguardRemoved";
 141
 142     private static final String GET_WINDOW_TOKEN = "getWindowToken";
 143
 144     private static final ComponentName sFakeAccessibilityServiceComponentName =
 145             new ComponentName("foo.bar", "FakeService");
 146
 147     private static final String FUNCTION_DUMP = "dump";
 148
 149     private static final char COMPONENT_NAME_SEPARATOR = ':';
 150
 151     private static final int OWN_PROCESS_ID = android.os.Process.myPid();
 152
 153     private static final int WINDOW_ID_UNKNOWN = -1;
 154
 155     // Each service has an ID. Also provide one for magnification gesture handling
 156     public static final int MAGNIFICATION_GESTURE_HANDLER_ID = 0;
 157
 158     private static int sIdCounter = MAGNIFICATION_GESTURE_HANDLER_ID + 1;
 159
 160     private static int sNextWindowId;
 161
 162     private final Context mContext;
 163
 164     private final Object mLock = new Object();
 165
 166     private final SimpleStringSplitter mStringColonSplitter =
 167             new SimpleStringSplitter(COMPONENT_NAME_SEPARATOR);
 168
 169     private final List<AccessibilityServiceInfo> mEnabledServicesForFeedbackTempList =
 170             new ArrayList<>();
 171
 172     private final Rect mTempRect = new Rect();
 173
 174     private final Rect mTempRect1 = new Rect();
 175
 176     private final Point mTempPoint = new Point();
 177
 178     private final PackageManager mPackageManager;
 179
 180     private final PowerManager mPowerManager;
 181
 182     private final WindowManagerInternal mWindowManagerService;
 183
 184     private final SecurityPolicy mSecurityPolicy;
 185
 186     private final MainHandler mMainHandler;
 187
 188     private MagnificationController mMagnificationController;
 189
 190     private InteractionBridge mInteractionBridge;
 191
 192     private AlertDialog mEnableTouchExplorationDialog;
 193
 194     private AccessibilityInputFilter mInputFilter;
 195
 196     private boolean mHasInputFilter;
 197
 198     private KeyEventDispatcher mKeyEventDispatcher;
 199
 200     private MotionEventInjector mMotionEventInjector;
 201
 202     private final Set<ComponentName> mTempComponentNameSet = new HashSet<>();
 203
 204     private final List<AccessibilityServiceInfo> mTempAccessibilityServiceInfoList =
 205             new ArrayList<>();
 206
 207     private final RemoteCallbackList<IAccessibilityManagerClient> mGlobalClients =
 208             new RemoteCallbackList<>();
 209
 210     private final SparseArray<AccessibilityConnectionWrapper> mGlobalInteractionConnections =
 211             new SparseArray<>();
 212
 213     private final SparseArray<IBinder> mGlobalWindowTokens = new SparseArray<>();
 214
 215     private final SparseArray<UserState> mUserStates = new SparseArray<>();
 216
 217     private final UserManager mUserManager;
 218
 219     private int mCurrentUserId = UserHandle.USER_SYSTEM;
 220
 221     //TODO: Remove this hack
 222     private boolean mInitialized;
 223
 224     private WindowsForAccessibilityCallback mWindowsForAccessibilityCallback;
 225
 226     private UserState getCurrentUserStateLocked() {
 227         return getUserStateLocked(mCurrentUserId);
 228     }
 229
 230     /**
 231      * Creates a new instance.
 232      *
 233      * @param context A {@link Context} instance.
 234      */
 235     public AccessibilityManagerService(Context context) {
 236         mContext = context;
 237         mPackageManager = mContext.getPackageManager();
 238         mPowerManager = (PowerManager) mContext.getSystemService(Context.POWER_SERVICE);
 239         mWindowManagerService = LocalServices.getService(WindowManagerInternal.class);
 240         mUserManager = (UserManager) context.getSystemService(Context.USER_SERVICE);
 241         mSecurityPolicy = new SecurityPolicy();
 242         mMainHandler = new MainHandler(mContext.getMainLooper());
 243         registerBroadcastReceivers();
 244         new AccessibilityContentObserver(mMainHandler).register(
 245                 context.getContentResolver());
 246     }
 247
 248     private UserState getUserStateLocked(int userId) {
 249         UserState state = mUserStates.get(userId);
 250         if (state == null) {
 251             state = new UserState(userId);
 252             mUserStates.put(userId, state);
 253         }
 254         return state;
 255     }
 256
 257     private void registerBroadcastReceivers() {
 258         PackageMonitor monitor = new PackageMonitor() {
 259             @Override
 260             public void onSomePackagesChanged() {
 261                 synchronized (mLock) {
 262                     // Only the profile parent can install accessibility services.
 263                     // Therefore we ignore packages from linked profiles.
 264                     if (getChangingUserId() != mCurrentUserId) {
 265                         return;
 266                     }
 267                     // We will update when the automation service dies.
 268                     UserState userState = getCurrentUserStateLocked();
 269                     // We have to reload the installed services since some services may
 270                     // have different attributes, resolve info (does not support equals),
 271                     // etc. Remove them then to force reload.
 272                     userState.mInstalledServices.clear();
 273                     if (!userState.isUiAutomationSuppressingOtherServices()) {
 274                         if (readConfigurationForUserStateLocked(userState)) {
 275                             onUserStateChangedLocked(userState);
 276                         }
 277                     }
 278                 }
 279             }
 280
 281             @Override
 282             public void onPackageRemoved(String packageName, int uid) {
 283                 synchronized (mLock) {
 284                     final int userId = getChangingUserId();
 285                     // Only the profile parent can install accessibility services.
 286                     // Therefore we ignore packages from linked profiles.
 287                     if (userId != mCurrentUserId) {
 288                         return;
 289                     }
 290                     UserState userState = getUserStateLocked(userId);
 291                     Iterator<ComponentName> it = userState.mEnabledServices.iterator();
 292                     while (it.hasNext()) {
 293                         ComponentName comp = it.next();
 294                         String compPkg = comp.getPackageName();
 295                         if (compPkg.equals(packageName)) {
 296                             it.remove();
 297                             // Update the enabled services setting.
 298                             persistComponentNamesToSettingLocked(
 299                                     Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES,
 300                                     userState.mEnabledServices, userId);
 301                             // Update the touch exploration granted services setting.
 302                             userState.mTouchExplorationGrantedServices.remove(comp);
 303                             persistComponentNamesToSettingLocked(
 304                                     Settings.Secure.
 305                                     TOUCH_EXPLORATION_GRANTED_ACCESSIBILITY_SERVICES,
 306                                     userState.mTouchExplorationGrantedServices, userId);
 307                             // We will update when the automation service dies.
 308                             if (!userState.isUiAutomationSuppressingOtherServices()) {
 309                                 onUserStateChangedLocked(userState);
 310                             }
 311                             return;
 312                         }
 313                     }
 314                 }
 315             }
 316
 317             @Override
 318             public boolean onHandleForceStop(Intent intent, String[] packages,
 319                     int uid, boolean doit) {
 320                 synchronized (mLock) {
 321                     final int userId = getChangingUserId();
 322                     // Only the profile parent can install accessibility services.
 323                     // Therefore we ignore packages from linked profiles.
 324                     if (userId != mCurrentUserId) {
 325                         return false;
 326                     }
 327                     UserState userState = getUserStateLocked(userId);
 328                     Iterator<ComponentName> it = userState.mEnabledServices.iterator();
 329                     while (it.hasNext()) {
 330                         ComponentName comp = it.next();
 331                         String compPkg = comp.getPackageName();
 332                         for (String pkg : packages) {
 333                             if (compPkg.equals(pkg)) {
 334                                 if (!doit) {
 335                                     return true;
 336                                 }
 337                                 it.remove();
 338                                 persistComponentNamesToSettingLocked(
 339                                         Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES,
 340                                         userState.mEnabledServices, userId);
 341                                 // We will update when the automation service dies.
 342                                 if (!userState.isUiAutomationSuppressingOtherServices()) {
 343                                     onUserStateChangedLocked(userState);
 344                                 }
 345                             }
 346                         }
 347                     }
 348                     return false;
 349                 }
 350             }
 351         };
 352
 353         // package changes
 354         monitor.register(mContext, null,  UserHandle.ALL, true);
 355
 356         // user change and unlock
 357         IntentFilter intentFilter = new IntentFilter();
 358         intentFilter.addAction(Intent.ACTION_USER_SWITCHED);
 359         intentFilter.addAction(Intent.ACTION_USER_UNLOCKED);
 360         intentFilter.addAction(Intent.ACTION_USER_REMOVED);
 361         intentFilter.addAction(Intent.ACTION_USER_PRESENT);
 362         intentFilter.addAction(Intent.ACTION_SETTING_RESTORED);
 363
 364         mContext.registerReceiverAsUser(new BroadcastReceiver() {
 365             @Override
 366             public void onReceive(Context context, Intent intent) {
 367                 String action = intent.getAction();
 368                 if (Intent.ACTION_USER_SWITCHED.equals(action)) {
 369                     switchUser(intent.getIntExtra(Intent.EXTRA_USER_HANDLE, 0));
 370                 } else if (Intent.ACTION_USER_UNLOCKED.equals(action)) {
 371                     unlockUser(intent.getIntExtra(Intent.EXTRA_USER_HANDLE, 0));
 372                 } else if (Intent.ACTION_USER_REMOVED.equals(action)) {
 373                     removeUser(intent.getIntExtra(Intent.EXTRA_USER_HANDLE, 0));
 374                 } else if (Intent.ACTION_USER_PRESENT.equals(action)) {
 375                     // We will update when the automation service dies.
 376                     UserState userState = getCurrentUserStateLocked();
 377                     if (!userState.isUiAutomationSuppressingOtherServices()) {
 378                         if (readConfigurationForUserStateLocked(userState)) {
 379                             onUserStateChangedLocked(userState);
 380                         }
 381                     }
 382                 } else if (Intent.ACTION_SETTING_RESTORED.equals(action)) {
 383                     final String which = intent.getStringExtra(Intent.EXTRA_SETTING_NAME);
 384                     if (Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES.equals(which)) {
 385                         synchronized (mLock) {
 386                             restoreEnabledAccessibilityServicesLocked(
 387                                     intent.getStringExtra(Intent.EXTRA_SETTING_PREVIOUS_VALUE),
 388                                     intent.getStringExtra(Intent.EXTRA_SETTING_NEW_VALUE));
 389                         }
 390                     }
 391                 }
 392             }
 393         }, UserHandle.ALL, intentFilter, null, null);
 394     }
 395
 396     @Override
 397     public int addClient(IAccessibilityManagerClient client, int userId) {
 398         synchronized (mLock) {
 399             // We treat calls from a profile as if made by its parent as profiles
 400             // share the accessibility state of the parent. The call below
 401             // performs the current profile parent resolution.
 402             final int resolvedUserId = mSecurityPolicy
 403                     .resolveCallingUserIdEnforcingPermissionsLocked(userId);
 404             // If the client is from a process that runs across users such as
 405             // the system UI or the system we add it to the global state that
 406             // is shared across users.
 407             UserState userState = getUserStateLocked(resolvedUserId);
 408             if (mSecurityPolicy.isCallerInteractingAcrossUsers(userId)) {
 409                 mGlobalClients.register(client);
 410                 if (DEBUG) {
 411                     Slog.i(LOG_TAG, "Added global client for pid:" + Binder.getCallingPid());
 412                 }
 413                 return userState.getClientState();
 414             } else {
 415                 userState.mClients.register(client);
 416                 // If this client is not for the current user we do not
 417                 // return a state since it is not for the foreground user.
 418                 // We will send the state to the client on a user switch.
 419                 if (DEBUG) {
 420                     Slog.i(LOG_TAG, "Added user client for pid:" + Binder.getCallingPid()
 421                             + " and userId:" + mCurrentUserId);
 422                 }
 423                 return (resolvedUserId == mCurrentUserId) ? userState.getClientState() : 0;
 424             }
 425         }
 426     }
 427
 428     @Override
 429     public boolean sendAccessibilityEvent(AccessibilityEvent event, int userId) {
 430         synchronized (mLock) {
 431             // We treat calls from a profile as if made by its parent as profiles
 432             // share the accessibility state of the parent. The call below
 433             // performs the current profile parent resolution..
 434             final int resolvedUserId = mSecurityPolicy
 435                     .resolveCallingUserIdEnforcingPermissionsLocked(userId);
 436             // This method does nothing for a background user.
 437             if (resolvedUserId != mCurrentUserId) {
 438                 return true; // yes, recycle the event
 439             }
 440             if (mSecurityPolicy.canDispatchAccessibilityEventLocked(event)) {
 441                 mSecurityPolicy.updateActiveAndAccessibilityFocusedWindowLocked(event.getWindowId(),
 442                         event.getSourceNodeId(), event.getEventType(), event.getAction());
 443                 mSecurityPolicy.updateEventSourceLocked(event);
 444                 notifyAccessibilityServicesDelayedLocked(event, false);
 445                 notifyAccessibilityServicesDelayedLocked(event, true);
 446             }
 447             if (mHasInputFilter && mInputFilter != null) {
 448                 mMainHandler.obtainMessage(MainHandler.MSG_SEND_ACCESSIBILITY_EVENT_TO_INPUT_FILTER,
 449                         AccessibilityEvent.obtain(event)).sendToTarget();
 450             }
 451             event.recycle();
 452         }
 453         return (OWN_PROCESS_ID != Binder.getCallingPid());
 454     }
 455
 456     @Override
 457     public List<AccessibilityServiceInfo> getInstalledAccessibilityServiceList(int userId) {
 458         synchronized (mLock) {
 459             // We treat calls from a profile as if made by its parent as profiles
 460             // share the accessibility state of the parent. The call below
 461             // performs the current profile parent resolution.
 462             final int resolvedUserId = mSecurityPolicy
 463                     .resolveCallingUserIdEnforcingPermissionsLocked(userId);
 464             // The automation service is a fake one and should not be reported
 465             // to clients as being installed - it really is not.
 466             UserState userState = getUserStateLocked(resolvedUserId);
 467             if (userState.mUiAutomationService != null) {
 468                 List<AccessibilityServiceInfo> installedServices = new ArrayList<>();
 469                 installedServices.addAll(userState.mInstalledServices);
 470                 installedServices.remove(userState.mUiAutomationService.mAccessibilityServiceInfo);
 471                 return installedServices;
 472             }
 473             return userState.mInstalledServices;
 474         }
 475     }
 476
 477     @Override
 478     public List<AccessibilityServiceInfo> getEnabledAccessibilityServiceList(int feedbackType,
 479             int userId) {
 480         List<AccessibilityServiceInfo> result = null;
 481         synchronized (mLock) {
 482             // We treat calls from a profile as if made by its parent as profiles
 483             // share the accessibility state of the parent. The call below
 484             // performs the current profile parent resolution.
 485             final int resolvedUserId = mSecurityPolicy
 486                     .resolveCallingUserIdEnforcingPermissionsLocked(userId);
 487
 488             // The automation service can suppress other services.
 489             UserState userState = getUserStateLocked(resolvedUserId);
 490             if (userState.isUiAutomationSuppressingOtherServices()) {
 491                 return Collections.emptyList();
 492             }
 493
 494             result = mEnabledServicesForFeedbackTempList;
 495             result.clear();
 496             List<Service> services = userState.mBoundServices;
 497             while (feedbackType != 0) {
 498                 final int feedbackTypeBit = (1 << Integer.numberOfTrailingZeros(feedbackType));
 499                 feedbackType &= ~feedbackTypeBit;
 500                 final int serviceCount = services.size();
 501                 for (int i = 0; i < serviceCount; i++) {
 502                     Service service = services.get(i);
 503                     // Don't report the UIAutomation (fake service)
 504                     if (!sFakeAccessibilityServiceComponentName.equals(service.mComponentName)
 505                             && (service.mFeedbackType & feedbackTypeBit) != 0) {
 506                         result.add(service.mAccessibilityServiceInfo);
 507                     }
 508                 }
 509             }
 510         }
 511         return result;
 512     }
 513
 514     @Override
 515     public void interrupt(int userId) {
 516         CopyOnWriteArrayList<Service> services;
 517         synchronized (mLock) {
 518             // We treat calls from a profile as if made by its parent as profiles
 519             // share the accessibility state of the parent. The call below
 520             // performs the current profile parent resolution.
 521             final int resolvedUserId = mSecurityPolicy
 522                     .resolveCallingUserIdEnforcingPermissionsLocked(userId);
 523             // This method does nothing for a background user.
 524             if (resolvedUserId != mCurrentUserId) {
 525                 return;
 526             }
 527             services = getUserStateLocked(resolvedUserId).mBoundServices;
 528         }
 529         for (int i = 0, count = services.size(); i < count; i++) {
 530             Service service = services.get(i);
 531             try {
 532                 service.mServiceInterface.onInterrupt();
 533             } catch (RemoteException re) {
 534                 Slog.e(LOG_TAG, "Error during sending interrupt request to "
 535                     + service.mService, re);
 536             }
 537         }
 538     }
 539
 540     @Override
 541     public int addAccessibilityInteractionConnection(IWindow windowToken,
 542             IAccessibilityInteractionConnection connection, int userId) throws RemoteException {
 543         synchronized (mLock) {
 544             // We treat calls from a profile as if made by its parent as profiles
 545             // share the accessibility state of the parent. The call below
 546             // performs the current profile parent resolution.
 547             final int resolvedUserId = mSecurityPolicy
 548                     .resolveCallingUserIdEnforcingPermissionsLocked(userId);
 549             final int windowId = sNextWindowId++;
 550             // If the window is from a process that runs across users such as
 551             // the system UI or the system we add it to the global state that
 552             // is shared across users.
 553             if (mSecurityPolicy.isCallerInteractingAcrossUsers(userId)) {
 554                 AccessibilityConnectionWrapper wrapper = new AccessibilityConnectionWrapper(
 555                         windowId, connection, UserHandle.USER_ALL);
 556                 wrapper.linkToDeath();
 557                 mGlobalInteractionConnections.put(windowId, wrapper);
 558                 mGlobalWindowTokens.put(windowId, windowToken.asBinder());
 559                 if (DEBUG) {
 560                     Slog.i(LOG_TAG, "Added global connection for pid:" + Binder.getCallingPid()
 561                             + " with windowId: " + windowId + " and  token: " + windowToken.asBinder());
 562                 }
 563             } else {
 564                 AccessibilityConnectionWrapper wrapper = new AccessibilityConnectionWrapper(
 565                         windowId, connection, resolvedUserId);
 566                 wrapper.linkToDeath();
 567                 UserState userState = getUserStateLocked(resolvedUserId);
 568                 userState.mInteractionConnections.put(windowId, wrapper);
 569                 userState.mWindowTokens.put(windowId, windowToken.asBinder());
 570                 if (DEBUG) {
 571                     Slog.i(LOG_TAG, "Added user connection for pid:" + Binder.getCallingPid()
 572                             + " with windowId: " + windowId + " and userId:" + mCurrentUserId
 573                             + " and  token: " + windowToken.asBinder());
 574                 }
 575             }
 576             return windowId;
 577         }
 578     }
 579
 580     @Override
 581     public void removeAccessibilityInteractionConnection(IWindow window) {
 582         synchronized (mLock) {
 583             // We treat calls from a profile as if made by its parent as profiles
 584             // share the accessibility state of the parent. The call below
 585             // performs the current profile parent resolution.
 586             mSecurityPolicy.resolveCallingUserIdEnforcingPermissionsLocked(
 587                     UserHandle.getCallingUserId());
 588             IBinder token = window.asBinder();
 589             final int removedWindowId = removeAccessibilityInteractionConnectionInternalLocked(
 590                     token, mGlobalWindowTokens, mGlobalInteractionConnections);
 591             if (removedWindowId >= 0) {
 592                 if (DEBUG) {
 593                     Slog.i(LOG_TAG, "Removed global connection for pid:" + Binder.getCallingPid()
 594                             + " with windowId: " + removedWindowId + " and token: " + window.asBinder());
 595                 }
 596                 return;
 597             }
 598             final int userCount = mUserStates.size();
 599             for (int i = 0; i < userCount; i++) {
 600                 UserState userState = mUserStates.valueAt(i);
 601                 final int removedWindowIdForUser =
 602                         removeAccessibilityInteractionConnectionInternalLocked(
 603                         token, userState.mWindowTokens, userState.mInteractionConnections);
 604                 if (removedWindowIdForUser >= 0) {
 605                     if (DEBUG) {
 606                         Slog.i(LOG_TAG, "Removed user connection for pid:" + Binder.getCallingPid()
 607                                 + " with windowId: " + removedWindowIdForUser + " and userId:"
 608                                 + mUserStates.keyAt(i) + " and token: " + window.asBinder());
 609                     }
 610                     return;
 611                 }
 612             }
 613         }
 614     }
 615
 616     private int removeAccessibilityInteractionConnectionInternalLocked(IBinder windowToken,
 617             SparseArray<IBinder> windowTokens,
 618             SparseArray<AccessibilityConnectionWrapper> interactionConnections) {
 619         final int count = windowTokens.size();
 620         for (int i = 0; i < count; i++) {
 621             if (windowTokens.valueAt(i) == windowToken) {
 622                 final int windowId = windowTokens.keyAt(i);
 623                 windowTokens.removeAt(i);
 624                 AccessibilityConnectionWrapper wrapper = interactionConnections.get(windowId);
 625                 wrapper.unlinkToDeath();
 626                 interactionConnections.remove(windowId);
 627                 return windowId;
 628             }
 629         }
 630         return -1;
 631     }
 632
 633     @Override
 634     public void registerUiTestAutomationService(IBinder owner,
 635             IAccessibilityServiceClient serviceClient,
 636             AccessibilityServiceInfo accessibilityServiceInfo,
 637             int flags) {
 638         mSecurityPolicy.enforceCallingPermission(Manifest.permission.RETRIEVE_WINDOW_CONTENT,
 639                 FUNCTION_REGISTER_UI_TEST_AUTOMATION_SERVICE);
 640
 641         accessibilityServiceInfo.setComponentName(sFakeAccessibilityServiceComponentName);
 642
 643         synchronized (mLock) {
 644             UserState userState = getCurrentUserStateLocked();
 645
 646             if (userState.mUiAutomationService != null) {
 647                 throw new IllegalStateException("UiAutomationService " + serviceClient
 648                         + "already registered!");
 649             }
 650
 651             try {
 652                 owner.linkToDeath(userState.mUiAutomationSerivceOnwerDeathRecipient, 0);
 653             } catch (RemoteException re) {
 654                 Slog.e(LOG_TAG, "Couldn't register for the death of a"
 655                         + " UiTestAutomationService!", re);
 656                 return;
 657             }
 658
 659             userState.mUiAutomationServiceOwner = owner;
 660             userState.mUiAutomationServiceClient = serviceClient;
 661             userState.mUiAutomationFlags = flags;
 662             userState.mInstalledServices.add(accessibilityServiceInfo);
 663             if ((flags & UiAutomation.FLAG_DONT_SUPPRESS_ACCESSIBILITY_SERVICES) == 0) {
 664                 // Set the temporary state, and use it instead of settings
 665                 userState.mIsTouchExplorationEnabled = false;
 666                 userState.mIsEnhancedWebAccessibilityEnabled = false;
 667                 userState.mIsDisplayMagnificationEnabled = false;
 668                 userState.mIsAutoclickEnabled = false;
 669                 userState.mEnabledServices.clear();
 670             }
 671             userState.mEnabledServices.add(sFakeAccessibilityServiceComponentName);
 672             userState.mTouchExplorationGrantedServices.add(sFakeAccessibilityServiceComponentName);
 673
 674             // Use the new state instead of settings.
 675             onUserStateChangedLocked(userState);
 676         }
 677     }
 678
 679     @Override
 680     public void unregisterUiTestAutomationService(IAccessibilityServiceClient serviceClient) {
 681         synchronized (mLock) {
 682             UserState userState = getCurrentUserStateLocked();
 683             // Automation service is not bound, so pretend it died to perform clean up.
 684             if (userState.mUiAutomationService != null
 685                     && serviceClient != null
 686                     && userState.mUiAutomationService.mServiceInterface != null
 687                     && userState.mUiAutomationService.mServiceInterface.asBinder()
 688                     == serviceClient.asBinder()) {
 689                 userState.mUiAutomationService.binderDied();
 690             } else {
 691                 throw new IllegalStateException("UiAutomationService " + serviceClient
 692                         + " not registered!");
 693             }
 694         }
 695     }
 696
 697     @Override
 698     public void temporaryEnableAccessibilityStateUntilKeyguardRemoved(
 699             ComponentName service, boolean touchExplorationEnabled) {
 700         mSecurityPolicy.enforceCallingPermission(
 701                 Manifest.permission.TEMPORARY_ENABLE_ACCESSIBILITY,
 702                 TEMPORARY_ENABLE_ACCESSIBILITY_UNTIL_KEYGUARD_REMOVED);
 703         if (!mWindowManagerService.isKeyguardLocked()) {
 704             return;
 705         }
 706         synchronized (mLock) {
 707             // Set the temporary state.
 708             UserState userState = getCurrentUserStateLocked();
 709
 710             // This is a nop if UI automation is enabled.
 711             if (userState.isUiAutomationSuppressingOtherServices()) {
 712                 return;
 713             }
 714
 715             userState.mIsTouchExplorationEnabled = touchExplorationEnabled;
 716             userState.mIsEnhancedWebAccessibilityEnabled = false;
 717             userState.mIsDisplayMagnificationEnabled = false;
 718             userState.mIsAutoclickEnabled = false;
 719             userState.mEnabledServices.clear();
 720             userState.mEnabledServices.add(service);
 721             userState.mBindingServices.clear();
 722             userState.mTouchExplorationGrantedServices.clear();
 723             userState.mTouchExplorationGrantedServices.add(service);
 724
 725             // User the current state instead settings.
 726             onUserStateChangedLocked(userState);
 727         }
 728     }
 729
 730     @Override
 731     public IBinder getWindowToken(int windowId, int userId) {
 732         mSecurityPolicy.enforceCallingPermission(
 733                 Manifest.permission.RETRIEVE_WINDOW_TOKEN,
 734                 GET_WINDOW_TOKEN);
 735         synchronized (mLock) {
 736             // We treat calls from a profile as if made by its parent as profiles
 737             // share the accessibility state of the parent. The call below
 738             // performs the current profile parent resolution.
 739             final int resolvedUserId = mSecurityPolicy
 740                     .resolveCallingUserIdEnforcingPermissionsLocked(userId);
 741             if (resolvedUserId != mCurrentUserId) {
 742                 return null;
 743             }
 744             if (mSecurityPolicy.findWindowById(windowId) == null) {
 745                 return null;
 746             }
 747             IBinder token = mGlobalWindowTokens.get(windowId);
 748             if (token != null) {
 749                 return token;
 750             }
 751             return getCurrentUserStateLocked().mWindowTokens.get(windowId);
 752         }
 753     }
 754
 755     boolean onGesture(int gestureId) {
 756         synchronized (mLock) {
 757             boolean handled = notifyGestureLocked(gestureId, false);
 758             if (!handled) {
 759                 handled = notifyGestureLocked(gestureId, true);
 760             }
 761             return handled;
 762         }
 763     }
 764
 765     boolean notifyKeyEvent(KeyEvent event, int policyFlags) {
 766         synchronized (mLock) {
 767             List<Service> boundServices = getCurrentUserStateLocked().mBoundServices;
 768             if (boundServices.isEmpty()) {
 769                 return false;
 770             }
 771             return getKeyEventDispatcher().notifyKeyEventLocked(event, policyFlags, boundServices);
 772         }
 773     }
 774
 775     /**
 776      * Called by the MagnificationController when the state of display
 777      * magnification changes.
 778      *
 779      * @param region the new magnified region, may be empty if
 780      *               magnification is not enabled (e.g. scale is 1)
 781      * @param scale the new scale
 782      * @param centerX the new screen-relative center X coordinate
 783      * @param centerY the new screen-relative center Y coordinate
 784      */
 785     void notifyMagnificationChanged(@NonNull Region region,
 786             float scale, float centerX, float centerY) {
 787         synchronized (mLock) {
 788             notifyMagnificationChangedLocked(region, scale, centerX, centerY);
 789         }
 790     }
 791
 792     /**
 793      * Called by AccessibilityInputFilter when it creates or destroys the motionEventInjector.
 794      * Not using a getter because the AccessibilityInputFilter isn't thread-safe
 795      *
 796      * @param motionEventInjector The new value of the motionEventInjector. May be null.
 797      */
 798     void setMotionEventInjector(MotionEventInjector motionEventInjector) {
 799         synchronized (mLock) {
 800             mMotionEventInjector = motionEventInjector;
 801             // We may be waiting on this object being set
 802             mLock.notifyAll();
 803         }
 804     }
 805
 806     /**
 807      * Gets a point within the accessibility focused node where we can send down
 808      * and up events to perform a click.
 809      *
 810      * @param outPoint The click point to populate.
 811      * @return Whether accessibility a click point was found and set.
 812      */
 813     // TODO: (multi-display) Make sure this works for multiple displays.
 814     boolean getAccessibilityFocusClickPointInScreen(Point outPoint) {
 815         return getInteractionBridgeLocked()
 816                 .getAccessibilityFocusClickPointInScreenNotLocked(outPoint);
 817     }
 818
 819     /**
 820      * Gets the bounds of a window.
 821      *
 822      * @param outBounds The output to which to write the bounds.
 823      */
 824     boolean getWindowBounds(int windowId, Rect outBounds) {
 825         IBinder token;
 826         synchronized (mLock) {
 827             token = mGlobalWindowTokens.get(windowId);
 828             if (token == null) {
 829                 token = getCurrentUserStateLocked().mWindowTokens.get(windowId);
 830             }
 831         }
 832         mWindowManagerService.getWindowFrame(token, outBounds);
 833         if (!outBounds.isEmpty()) {
 834             return true;
 835         }
 836         return false;
 837     }
 838
 839     boolean accessibilityFocusOnlyInActiveWindow() {
 840         synchronized (mLock) {
 841             return mWindowsForAccessibilityCallback == null;
 842         }
 843     }
 844
 845     int getActiveWindowId() {
 846         return mSecurityPolicy.getActiveWindowId();
 847     }
 848
 849     void onTouchInteractionStart() {
 850         mSecurityPolicy.onTouchInteractionStart();
 851     }
 852
 853     void onTouchInteractionEnd() {
 854         mSecurityPolicy.onTouchInteractionEnd();
 855     }
 856
 857     void onMagnificationStateChanged() {
 858         notifyClearAccessibilityCacheLocked();
 859     }
 860
 861     private void switchUser(int userId) {
 862         synchronized (mLock) {
 863             if (mCurrentUserId == userId && mInitialized) {
 864                 return;
 865             }
 866
 867             // Disconnect from services for the old user.
 868             UserState oldUserState = getCurrentUserStateLocked();
 869             oldUserState.onSwitchToAnotherUser();
 870
 871             // Disable the local managers for the old user.
 872             if (oldUserState.mClients.getRegisteredCallbackCount() > 0) {
 873                 mMainHandler.obtainMessage(MainHandler.MSG_SEND_CLEARED_STATE_TO_CLIENTS_FOR_USER,
 874                         oldUserState.mUserId, 0).sendToTarget();
 875             }
 876
 877             // Announce user changes only if more that one exist.
 878             UserManager userManager = (UserManager) mContext.getSystemService(Context.USER_SERVICE);
 879             final boolean announceNewUser = userManager.getUsers().size() > 1;
 880
 881             // The user changed.
 882             mCurrentUserId = userId;
 883
 884             UserState userState = getCurrentUserStateLocked();
 885             if (userState.mUiAutomationService != null) {
 886                 // Switching users disables the UI automation service.
 887                 userState.mUiAutomationService.binderDied();
 888             }
 889
 890             readConfigurationForUserStateLocked(userState);
 891             // Even if reading did not yield change, we have to update
 892             // the state since the context in which the current user
 893             // state was used has changed since it was inactive.
 894             onUserStateChangedLocked(userState);
 895
 896             if (announceNewUser) {
 897                 // Schedule announcement of the current user if needed.
 898                 mMainHandler.sendEmptyMessageDelayed(MainHandler.MSG_ANNOUNCE_NEW_USER_IF_NEEDED,
 899                         WAIT_FOR_USER_STATE_FULLY_INITIALIZED_MILLIS);
 900             }
 901         }
 902     }
 903
 904     private void unlockUser(int userId) {
 905         synchronized (mLock) {
 906             int parentUserId = mSecurityPolicy.resolveProfileParentLocked(userId);
 907             if (parentUserId == mCurrentUserId) {
 908                 UserState userState = getUserStateLocked(mCurrentUserId);
 909                 onUserStateChangedLocked(userState);
 910             }
 911         }
 912     }
 913
 914     private void removeUser(int userId) {
 915         synchronized (mLock) {
 916             mUserStates.remove(userId);
 917         }
 918     }
 919
 920     // Called only during settings restore; currently supports only the owner user
 921     // TODO: http://b/22388012
 922     void restoreEnabledAccessibilityServicesLocked(String oldSetting, String newSetting) {
 923         readComponentNamesFromStringLocked(oldSetting, mTempComponentNameSet, false);
 924         readComponentNamesFromStringLocked(newSetting, mTempComponentNameSet, true);
 925
 926         UserState userState = getUserStateLocked(UserHandle.USER_SYSTEM);
 927         userState.mEnabledServices.clear();
 928         userState.mEnabledServices.addAll(mTempComponentNameSet);
 929         persistComponentNamesToSettingLocked(
 930                 Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES,
 931                 userState.mEnabledServices,
 932                 UserHandle.USER_SYSTEM);
 933         onUserStateChangedLocked(userState);
 934     }
 935
 936     private InteractionBridge getInteractionBridgeLocked() {
 937         if (mInteractionBridge == null) {
 938             mInteractionBridge = new InteractionBridge();
 939         }
 940         return mInteractionBridge;
 941     }
 942
 943     private boolean notifyGestureLocked(int gestureId, boolean isDefault) {
 944         // TODO: Now we are giving the gestures to the last enabled
 945         //       service that can handle them which is the last one
 946         //       in our list since we write the last enabled as the
 947         //       last record in the enabled services setting. Ideally,
 948         //       the user should make the call which service handles
 949         //       gestures. However, only one service should handle
 950         //       gestures to avoid user frustration when different
 951         //       behavior is observed from different combinations of
 952         //       enabled accessibility services.
 953         UserState state = getCurrentUserStateLocked();
 954         for (int i = state.mBoundServices.size() - 1; i >= 0; i--) {
 955             Service service = state.mBoundServices.get(i);
 956             if (service.mRequestTouchExplorationMode && service.mIsDefault == isDefault) {
 957                 service.notifyGesture(gestureId);
 958                 return true;
 959             }
 960         }
 961         return false;
 962     }
 963
 964     private void notifyClearAccessibilityCacheLocked() {
 965         UserState state = getCurrentUserStateLocked();
 966         for (int i = state.mBoundServices.size() - 1; i >= 0; i--) {
 967             Service service = state.mBoundServices.get(i);
 968             service.notifyClearAccessibilityNodeInfoCache();
 969         }
 970     }
 971
 972     private void notifyMagnificationChangedLocked(@NonNull Region region,
 973             float scale, float centerX, float centerY) {
 974         final UserState state = getCurrentUserStateLocked();
 975         for (int i = state.mBoundServices.size() - 1; i >= 0; i--) {
 976             final Service service = state.mBoundServices.get(i);
 977             service.notifyMagnificationChangedLocked(region, scale, centerX, centerY);
 978         }
 979     }
 980
 981     private void notifySoftKeyboardShowModeChangedLocked(int showMode) {
 982         final UserState state = getCurrentUserStateLocked();
 983         for (int i = state.mBoundServices.size() - 1; i >= 0; i--) {
 984             final Service service = state.mBoundServices.get(i);
 985             service.notifySoftKeyboardShowModeChangedLocked(showMode);
 986         }
 987     }
 988
 989     /**
 990      * Removes an AccessibilityInteractionConnection.
 991      *
 992      * @param windowId The id of the window to which the connection is targeted.
 993      * @param userId The id of the user owning the connection. UserHandle.USER_ALL
 994      *     if global.
 995      */
 996     private void removeAccessibilityInteractionConnectionLocked(int windowId, int userId) {
 997         if (userId == UserHandle.USER_ALL) {
 998             mGlobalWindowTokens.remove(windowId);
 999             mGlobalInteractionConnections.remove(windowId);
1000         } else {
1001             UserState userState = getCurrentUserStateLocked();
1002             userState.mWindowTokens.remove(windowId);
1003             userState.mInteractionConnections.remove(windowId);
1004         }
1005         if (DEBUG) {
1006             Slog.i(LOG_TAG, "Removing interaction connection to windowId: " + windowId);
1007         }
1008     }
1009
1010     private boolean readInstalledAccessibilityServiceLocked(UserState userState) {
1011         mTempAccessibilityServiceInfoList.clear();
1012
1013         List<ResolveInfo> installedServices = mPackageManager.queryIntentServicesAsUser(
1014                 new Intent(AccessibilityService.SERVICE_INTERFACE),
1015                 PackageManager.GET_SERVICES
1016                         | PackageManager.GET_META_DATA
1017                         | PackageManager.MATCH_DISABLED_UNTIL_USED_COMPONENTS
1018                         | PackageManager.MATCH_DIRECT_BOOT_AWARE
1019                         | PackageManager.MATCH_DIRECT_BOOT_UNAWARE,
1020                 mCurrentUserId);
1021
1022         for (int i = 0, count = installedServices.size(); i < count; i++) {
1023             ResolveInfo resolveInfo = installedServices.get(i);
1024             ServiceInfo serviceInfo = resolveInfo.serviceInfo;
1025             if (!android.Manifest.permission.BIND_ACCESSIBILITY_SERVICE.equals(
1026                     serviceInfo.permission)) {
1027                 Slog.w(LOG_TAG, "Skipping accessibilty service " + new ComponentName(
1028                         serviceInfo.packageName, serviceInfo.name).flattenToShortString()
1029                         + ": it does not require the permission "
1030                         + android.Manifest.permission.BIND_ACCESSIBILITY_SERVICE);
1031                 continue;
1032             }
1033             AccessibilityServiceInfo accessibilityServiceInfo;
1034             try {
1035                 accessibilityServiceInfo = new AccessibilityServiceInfo(resolveInfo, mContext);
1036                 mTempAccessibilityServiceInfoList.add(accessibilityServiceInfo);
1037             } catch (XmlPullParserException | IOException xppe) {
1038                 Slog.e(LOG_TAG, "Error while initializing AccessibilityServiceInfo", xppe);
1039             }
1040         }
1041
1042         if (!mTempAccessibilityServiceInfoList.equals(userState.mInstalledServices)) {
1043             userState.mInstalledServices.clear();
1044             userState.mInstalledServices.addAll(mTempAccessibilityServiceInfoList);
1045             mTempAccessibilityServiceInfoList.clear();
1046             return true;
1047         }
1048
1049         mTempAccessibilityServiceInfoList.clear();
1050         return false;
1051     }
1052
1053     private boolean readEnabledAccessibilityServicesLocked(UserState userState) {
1054         mTempComponentNameSet.clear();
1055         readComponentNamesFromSettingLocked(Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES,
1056                 userState.mUserId, mTempComponentNameSet);
1057         if (!mTempComponentNameSet.equals(userState.mEnabledServices)) {
1058             userState.mEnabledServices.clear();
1059             userState.mEnabledServices.addAll(mTempComponentNameSet);
1060             if (userState.mUiAutomationService != null) {
1061                 userState.mEnabledServices.add(sFakeAccessibilityServiceComponentName);
1062             }
1063             mTempComponentNameSet.clear();
1064             return true;
1065         }
1066         mTempComponentNameSet.clear();
1067         return false;
1068     }
1069
1070     private boolean readTouchExplorationGrantedAccessibilityServicesLocked(
1071             UserState userState) {
1072         mTempComponentNameSet.clear();
1073         readComponentNamesFromSettingLocked(
1074                 Settings.Secure.TOUCH_EXPLORATION_GRANTED_ACCESSIBILITY_SERVICES,
1075                 userState.mUserId, mTempComponentNameSet);
1076         if (!mTempComponentNameSet.equals(userState.mTouchExplorationGrantedServices)) {
1077             userState.mTouchExplorationGrantedServices.clear();
1078             userState.mTouchExplorationGrantedServices.addAll(mTempComponentNameSet);
1079             mTempComponentNameSet.clear();
1080             return true;
1081         }
1082         mTempComponentNameSet.clear();
1083         return false;
1084     }
1085
1086     /**
1087      * Performs {@link AccessibilityService}s delayed notification. The delay is configurable
1088      * and denotes the period after the last event before notifying the service.
1089      *
1090      * @param event The event.
1091      * @param isDefault True to notify default listeners, not default services.
1092      */
1093     private void notifyAccessibilityServicesDelayedLocked(AccessibilityEvent event,
1094             boolean isDefault) {
1095         try {
1096             UserState state = getCurrentUserStateLocked();
1097             for (int i = 0, count = state.mBoundServices.size(); i < count; i++) {
1098                 Service service = state.mBoundServices.get(i);
1099
1100                 if (service.mIsDefault == isDefault) {
1101                     if (canDispatchEventToServiceLocked(service, event)) {
1102                         service.notifyAccessibilityEvent(event);
1103                     }
1104                 }
1105             }
1106         } catch (IndexOutOfBoundsException oobe) {
1107             // An out of bounds exception can happen if services are going away
1108             // as the for loop is running. If that happens, just bail because
1109             // there are no more services to notify.
1110         }
1111     }
1112
1113     private void addServiceLocked(Service service, UserState userState) {
1114         try {
1115             service.onAdded();
1116             userState.mBoundServices.add(service);
1117             userState.mComponentNameToServiceMap.put(service.mComponentName, service);
1118         } catch (RemoteException re) {
1119             /* do nothing */
1120         }
1121     }
1122
1123     /**
1124      * Removes a service.
1125      *
1126      * @param service The service.
1127      */
1128     private void removeServiceLocked(Service service, UserState userState) {
1129         userState.mBoundServices.remove(service);
1130         userState.mComponentNameToServiceMap.remove(service.mComponentName);
1131         service.onRemoved();
1132     }
1133
1134     /**
1135      * Determines if given event can be dispatched to a service based on the package of the
1136      * event source. Specifically, a service is notified if it is interested in events from the
1137      * package.
1138      *
1139      * @param service The potential receiver.
1140      * @param event The event.
1141      * @return True if the listener should be notified, false otherwise.
1142      */
1143     private boolean canDispatchEventToServiceLocked(Service service, AccessibilityEvent event) {
1144
1145         if (!service.canReceiveEventsLocked()) {
1146             return false;
1147         }
1148
1149         if (event.getWindowId() != WINDOW_ID_UNKNOWN && !event.isImportantForAccessibility()
1150                 && (service.mFetchFlags
1151                         & AccessibilityNodeInfo.FLAG_INCLUDE_NOT_IMPORTANT_VIEWS) == 0) {
1152             return false;
1153         }
1154
1155         int eventType = event.getEventType();
1156         if ((service.mEventTypes & eventType) != eventType) {
1157             return false;
1158         }
1159
1160         Set<String> packageNames = service.mPackageNames;
1161         String packageName = (event.getPackageName() != null)
1162                 ? event.getPackageName().toString() : null;
1163
1164         return (packageNames.isEmpty() || packageNames.contains(packageName));
1165     }
1166
1167     private void unbindAllServicesLocked(UserState userState) {
1168         List<Service> services = userState.mBoundServices;
1169         for (int i = 0, count = services.size(); i < count; i++) {
1170             Service service = services.get(i);
1171             if (service.unbindLocked()) {
1172                 i--;
1173                 count--;
1174             }
1175         }
1176     }
1177
1178     /**
1179      * Populates a set with the {@link ComponentName}s stored in a colon
1180      * separated value setting for a given user.
1181      *
1182      * @param settingName The setting to parse.
1183      * @param userId The user id.
1184      * @param outComponentNames The output component names.
1185      */
1186     private void readComponentNamesFromSettingLocked(String settingName, int userId,
1187             Set<ComponentName> outComponentNames) {
1188         String settingValue = Settings.Secure.getStringForUser(mContext.getContentResolver(),
1189                 settingName, userId);
1190         readComponentNamesFromStringLocked(settingValue, outComponentNames, false);
1191     }
1192
1193     /**
1194      * Populates a set with the {@link ComponentName}s contained in a colon-delimited string.
1195      *
1196      * @param names The colon-delimited string to parse.
1197      * @param outComponentNames The set of component names to be populated based on
1198      *    the contents of the <code>names</code> string.
1199      * @param doMerge If true, the parsed component names will be merged into the output
1200      *    set, rather than replacing the set's existing contents entirely.
1201      */
1202     private void readComponentNamesFromStringLocked(String names,
1203             Set<ComponentName> outComponentNames,
1204             boolean doMerge) {
1205         if (!doMerge) {
1206             outComponentNames.clear();
1207         }
1208         if (names != null) {
1209             TextUtils.SimpleStringSplitter splitter = mStringColonSplitter;
1210             splitter.setString(names);
1211             while (splitter.hasNext()) {
1212                 String str = splitter.next();
1213                 if (str == null || str.length() <= 0) {
1214                     continue;
1215                 }
1216                 ComponentName enabledService = ComponentName.unflattenFromString(str);
1217                 if (enabledService != null) {
1218                     outComponentNames.add(enabledService);
1219                 }
1220             }
1221         }
1222     }
1223
1224     /**
1225      * Persists the component names in the specified setting in a
1226      * colon separated fashion.
1227      *
1228      * @param settingName The setting name.
1229      * @param componentNames The component names.
1230      */
1231     private void persistComponentNamesToSettingLocked(String settingName,
1232             Set<ComponentName> componentNames, int userId) {
1233         StringBuilder builder = new StringBuilder();
1234         for (ComponentName componentName : componentNames) {
1235             if (builder.length() > 0) {
1236                 builder.append(COMPONENT_NAME_SEPARATOR);
1237             }
1238             builder.append(componentName.flattenToShortString());
1239         }
1240         final long identity = Binder.clearCallingIdentity();
1241         try {
1242             Settings.Secure.putStringForUser(mContext.getContentResolver(),
1243                     settingName, builder.toString(), userId);
1244         } finally {
1245             Binder.restoreCallingIdentity(identity);
1246         }
1247     }
1248
1249     private void updateServicesLocked(UserState userState) {
1250         Map<ComponentName, Service> componentNameToServiceMap =
1251                 userState.mComponentNameToServiceMap;
1252         boolean isUnlockingOrUnlocked = mContext.getSystemService(UserManager.class)
1253                 .isUserUnlockingOrUnlocked(userState.mUserId);
1254
1255         for (int i = 0, count = userState.mInstalledServices.size(); i < count; i++) {
1256             AccessibilityServiceInfo installedService = userState.mInstalledServices.get(i);
1257             ComponentName componentName = ComponentName.unflattenFromString(
1258                     installedService.getId());
1259
1260             Service service = componentNameToServiceMap.get(componentName);
1261
1262             // Ignore non-encryption-aware services until user is unlocked
1263             if (!isUnlockingOrUnlocked && !installedService.isDirectBootAware()) {
1264                 Slog.d(LOG_TAG, "Ignoring non-encryption-aware service " + componentName);
1265                 continue;
1266             }
1267
1268             // Wait for the binding if it is in process.
1269             if (userState.mBindingServices.contains(componentName)) {
1270                 continue;
1271             }
1272             if (userState.mEnabledServices.contains(componentName)) {
1273                 if (service == null) {
1274                     service = new Service(userState.mUserId, componentName, installedService);
1275                 } else if (userState.mBoundServices.contains(service)) {
1276                     continue;
1277                 }
1278                 service.bindLocked();
1279             } else {
1280                 if (service != null) {
1281                     service.unbindLocked();
1282                 }
1283             }
1284         }
1285
1286         updateAccessibilityEnabledSetting(userState);
1287     }
1288
1289     private void scheduleUpdateClientsIfNeededLocked(UserState userState) {
1290         final int clientState = userState.getClientState();
1291         if (userState.mLastSentClientState != clientState
1292                 && (mGlobalClients.getRegisteredCallbackCount() > 0
1293                         || userState.mClients.getRegisteredCallbackCount() > 0)) {
1294             userState.mLastSentClientState = clientState;
1295             mMainHandler.obtainMessage(MainHandler.MSG_SEND_STATE_TO_CLIENTS,
1296                     clientState, userState.mUserId) .sendToTarget();
1297         }
1298     }
1299
1300     private void scheduleUpdateInputFilter(UserState userState) {
1301         mMainHandler.obtainMessage(MainHandler.MSG_UPDATE_INPUT_FILTER, userState).sendToTarget();
1302     }
1303
1304     private void updateInputFilter(UserState userState) {
1305         boolean setInputFilter = false;
1306         AccessibilityInputFilter inputFilter = null;
1307         synchronized (mLock) {
1308             int flags = 0;
1309             if (userState.mIsDisplayMagnificationEnabled) {
1310                 flags |= AccessibilityInputFilter.FLAG_FEATURE_SCREEN_MAGNIFIER;
1311             }
1312             if (userHasMagnificationServicesLocked(userState)) {
1313                 flags |= AccessibilityInputFilter.FLAG_FEATURE_CONTROL_SCREEN_MAGNIFIER;
1314             }
1315             // Touch exploration without accessibility makes no sense.
1316             if (userState.isHandlingAccessibilityEvents()
1317                     && userState.mIsTouchExplorationEnabled) {
1318                 flags |= AccessibilityInputFilter.FLAG_FEATURE_TOUCH_EXPLORATION;
1319             }
1320             if (userState.mIsFilterKeyEventsEnabled) {
1321                 flags |= AccessibilityInputFilter.FLAG_FEATURE_FILTER_KEY_EVENTS;
1322             }
1323             if (userState.mIsAutoclickEnabled) {
1324                 flags |= AccessibilityInputFilter.FLAG_FEATURE_AUTOCLICK;
1325             }
1326             if (userState.mIsPerformGesturesEnabled) {
1327                 flags |= AccessibilityInputFilter.FLAG_FEATURE_INJECT_MOTION_EVENTS;
1328             }
1329             if (flags != 0) {
1330                 if (!mHasInputFilter) {
1331                     mHasInputFilter = true;
1332                     if (mInputFilter == null) {
1333                         mInputFilter = new AccessibilityInputFilter(mContext,
1334                                 AccessibilityManagerService.this);
1335                     }
1336                     inputFilter = mInputFilter;
1337                     setInputFilter = true;
1338                 }
1339                 mInputFilter.setUserAndEnabledFeatures(userState.mUserId, flags);
1340             } else {
1341                 if (mHasInputFilter) {
1342                     mHasInputFilter = false;
1343                     mInputFilter.setUserAndEnabledFeatures(userState.mUserId, 0);
1344                     inputFilter = null;
1345                     setInputFilter = true;
1346                 }
1347             }
1348         }
1349         if (setInputFilter) {
1350             mWindowManagerService.setInputFilter(inputFilter);
1351         }
1352     }
1353
1354     private void showEnableTouchExplorationDialog(final Service service) {
1355         synchronized (mLock) {
1356             String label = service.mResolveInfo.loadLabel(
1357             mContext.getPackageManager()).toString();
1358
1359             final UserState state = getCurrentUserStateLocked();
1360             if (state.mIsTouchExplorationEnabled) {
1361                 return;
1362             }
1363             if (mEnableTouchExplorationDialog != null
1364                     && mEnableTouchExplorationDialog.isShowing()) {
1365                 return;
1366             }
1367             mEnableTouchExplorationDialog = new AlertDialog.Builder(mContext)
1368                 .setIconAttribute(android.R.attr.alertDialogIcon)
1369                 .setPositiveButton(android.R.string.ok, new OnClickListener() {
1370                      @Override
1371                      public void onClick(DialogInterface dialog, int which) {
1372                          // The user allowed the service to toggle touch exploration.
1373                          state.mTouchExplorationGrantedServices.add(service.mComponentName);
1374                          persistComponentNamesToSettingLocked(
1375                                  Settings.Secure.TOUCH_EXPLORATION_GRANTED_ACCESSIBILITY_SERVICES,
1376                                  state.mTouchExplorationGrantedServices, state.mUserId);
1377                          // Enable touch exploration.
1378                          UserState userState = getUserStateLocked(service.mUserId);
1379                          userState.mIsTouchExplorationEnabled = true;
1380                          final long identity = Binder.clearCallingIdentity();
1381                          try {
1382                              Settings.Secure.putIntForUser(mContext.getContentResolver(),
1383                                      Settings.Secure.TOUCH_EXPLORATION_ENABLED, 1,
1384                                      service.mUserId);
1385                          } finally {
1386                              Binder.restoreCallingIdentity(identity);
1387                          }
1388                          onUserStateChangedLocked(userState);
1389                      }
1390                  })
1391                  .setNegativeButton(android.R.string.cancel, new OnClickListener() {
1392                      @Override
1393                      public void onClick(DialogInterface dialog, int which) {
1394                          dialog.dismiss();
1395                      }
1396                  })
1397                  .setTitle(R.string.enable_explore_by_touch_warning_title)
1398                  .setMessage(mContext.getString(
1399                          R.string.enable_explore_by_touch_warning_message, label))
1400                  .create();
1401              mEnableTouchExplorationDialog.getWindow().setType(
1402                      WindowManager.LayoutParams.TYPE_SYSTEM_ALERT);
1403              mEnableTouchExplorationDialog.getWindow().getAttributes().privateFlags
1404                      |= WindowManager.LayoutParams.PRIVATE_FLAG_SHOW_FOR_ALL_USERS;
1405              mEnableTouchExplorationDialog.setCanceledOnTouchOutside(true);
1406              mEnableTouchExplorationDialog.show();
1407         }
1408     }
1409
1410     /**
1411      * Called when any property of the user state has changed.
1412      *
1413      * @param userState the new user state
1414      */
1415     private void onUserStateChangedLocked(UserState userState) {
1416         // TODO: Remove this hack
1417         mInitialized = true;
1418         updateLegacyCapabilitiesLocked(userState);
1419         updateServicesLocked(userState);
1420         updateWindowsForAccessibilityCallbackLocked(userState);
1421         updateAccessibilityFocusBehaviorLocked(userState);
1422         updateFilterKeyEventsLocked(userState);
1423         updateTouchExplorationLocked(userState);
1424         updatePerformGesturesLocked(userState);
1425         updateEnhancedWebAccessibilityLocked(userState);
1426         updateDisplayColorAdjustmentSettingsLocked(userState);
1427         updateMagnificationLocked(userState);
1428         updateSoftKeyboardShowModeLocked(userState);
1429         scheduleUpdateInputFilter(userState);
1430         scheduleUpdateClientsIfNeededLocked(userState);
1431     }
1432
1433     private void updateAccessibilityFocusBehaviorLocked(UserState userState) {
1434         // If there is no service that can operate with interactive windows
1435         // then we keep the old behavior where a window loses accessibility
1436         // focus if it is no longer active. This still changes the behavior
1437         // for services that do not operate with interactive windows and run
1438         // at the same time as the one(s) which does. In practice however,
1439         // there is only one service that uses accessibility focus and it
1440         // is typically the one that operates with interactive windows, So,
1441         // this is fine. Note that to allow a service to work across windows
1442         // we have to allow accessibility focus stay in any of them. Sigh...
1443         List<Service> boundServices = userState.mBoundServices;
1444         final int boundServiceCount = boundServices.size();
1445         for (int i = 0; i < boundServiceCount; i++) {
1446             Service boundService = boundServices.get(i);
1447             if (boundService.canRetrieveInteractiveWindowsLocked()) {
1448                 userState.mAccessibilityFocusOnlyInActiveWindow = false;
1449                 return;
1450             }
1451         }
1452         userState.mAccessibilityFocusOnlyInActiveWindow = true;
1453     }
1454
1455     private void updateWindowsForAccessibilityCallbackLocked(UserState userState) {
1456         // We observe windows for accessibility only if there is at least
1457         // one bound service that can retrieve window content that specified
1458         // it is interested in accessing such windows. For services that are
1459         // binding we do an update pass after each bind event, so we run this
1460         // code and register the callback if needed.
1461
1462         List<Service> boundServices = userState.mBoundServices;
1463         final int boundServiceCount = boundServices.size();
1464         for (int i = 0; i < boundServiceCount; i++) {
1465             Service boundService = boundServices.get(i);
1466             if (boundService.canRetrieveInteractiveWindowsLocked()) {
1467                 if (mWindowsForAccessibilityCallback == null) {
1468                     mWindowsForAccessibilityCallback = new WindowsForAccessibilityCallback();
1469                     mWindowManagerService.setWindowsForAccessibilityCallback(
1470                             mWindowsForAccessibilityCallback);
1471                 }
1472                 return;
1473             }
1474         }
1475
1476         if (mWindowsForAccessibilityCallback != null) {
1477             mWindowsForAccessibilityCallback = null;
1478             mWindowManagerService.setWindowsForAccessibilityCallback(null);
1479             // Drop all windows we know about.
1480             mSecurityPolicy.clearWindowsLocked();
1481         }
1482     }
1483
1484     private void updateLegacyCapabilitiesLocked(UserState userState) {
1485         // Up to JB-MR1 we had a white list with services that can enable touch
1486         // exploration. When a service is first started we show a dialog to the
1487         // use to get a permission to white list the service.
1488         final int installedServiceCount = userState.mInstalledServices.size();
1489         for (int i = 0; i < installedServiceCount; i++) {
1490             AccessibilityServiceInfo serviceInfo = userState.mInstalledServices.get(i);
1491             ResolveInfo resolveInfo = serviceInfo.getResolveInfo();
1492             if ((serviceInfo.getCapabilities()
1493                         & AccessibilityServiceInfo.CAPABILITY_CAN_REQUEST_TOUCH_EXPLORATION) == 0
1494                     && resolveInfo.serviceInfo.applicationInfo.targetSdkVersion
1495                         <= Build.VERSION_CODES.JELLY_BEAN_MR1) {
1496                 ComponentName componentName = new ComponentName(
1497                         resolveInfo.serviceInfo.packageName, resolveInfo.serviceInfo.name);
1498                 if (userState.mTouchExplorationGrantedServices.contains(componentName)) {
1499                     serviceInfo.setCapabilities(serviceInfo.getCapabilities()
1500                             | AccessibilityServiceInfo.CAPABILITY_CAN_REQUEST_TOUCH_EXPLORATION);
1501                 }
1502             }
1503         }
1504     }
1505
1506     private void updatePerformGesturesLocked(UserState userState) {
1507         final int serviceCount = userState.mBoundServices.size();
1508         for (int i = 0; i < serviceCount; i++) {
1509             Service service = userState.mBoundServices.get(i);
1510             if ((service.mAccessibilityServiceInfo.getCapabilities()
1511                     & AccessibilityServiceInfo.CAPABILITY_CAN_PERFORM_GESTURES) != 0) {
1512                 userState.mIsPerformGesturesEnabled = true;
1513                 return;
1514             }
1515         }
1516         userState.mIsPerformGesturesEnabled = false;
1517     }
1518
1519     private void updateFilterKeyEventsLocked(UserState userState) {
1520         final int serviceCount = userState.mBoundServices.size();
1521         for (int i = 0; i < serviceCount; i++) {
1522             Service service = userState.mBoundServices.get(i);
1523             if (service.mRequestFilterKeyEvents
1524                     && (service.mAccessibilityServiceInfo.getCapabilities()
1525                             & AccessibilityServiceInfo
1526                             .CAPABILITY_CAN_REQUEST_FILTER_KEY_EVENTS) != 0) {
1527                 userState.mIsFilterKeyEventsEnabled = true;
1528                 return;
1529             }
1530         }
1531         userState.mIsFilterKeyEventsEnabled = false;
1532     }
1533
1534     private boolean readConfigurationForUserStateLocked(UserState userState) {
1535         boolean somethingChanged = readInstalledAccessibilityServiceLocked(userState);
1536         somethingChanged |= readEnabledAccessibilityServicesLocked(userState);
1537         somethingChanged |= readTouchExplorationGrantedAccessibilityServicesLocked(userState);
1538         somethingChanged |= readTouchExplorationEnabledSettingLocked(userState);
1539         somethingChanged |= readHighTextContrastEnabledSettingLocked(userState);
1540         somethingChanged |= readEnhancedWebAccessibilityEnabledChangedLocked(userState);
1541         somethingChanged |= readDisplayMagnificationEnabledSettingLocked(userState);
1542         somethingChanged |= readAutoclickEnabledSettingLocked(userState);
1543         somethingChanged |= readDisplayColorAdjustmentSettingsLocked(userState);
1544
1545         return somethingChanged;
1546     }
1547
1548     private void updateAccessibilityEnabledSetting(UserState userState) {
1549         final long identity = Binder.clearCallingIdentity();
1550         try {
1551             Settings.Secure.putIntForUser(mContext.getContentResolver(),
1552                     Settings.Secure.ACCESSIBILITY_ENABLED,
1553                     userState.isHandlingAccessibilityEvents() ? 1 : 0,
1554                     userState.mUserId);
1555         } finally {
1556             Binder.restoreCallingIdentity(identity);
1557         }
1558     }
1559
1560     private boolean readTouchExplorationEnabledSettingLocked(UserState userState) {
1561         final boolean touchExplorationEnabled = Settings.Secure.getIntForUser(
1562                 mContext.getContentResolver(),
1563                 Settings.Secure.TOUCH_EXPLORATION_ENABLED, 0, userState.mUserId) == 1;
1564         if (touchExplorationEnabled != userState.mIsTouchExplorationEnabled) {
1565             userState.mIsTouchExplorationEnabled = touchExplorationEnabled;
1566             return true;
1567         }
1568         return false;
1569     }
1570
1571     private boolean readDisplayMagnificationEnabledSettingLocked(UserState userState) {
1572         final boolean displayMagnificationEnabled = Settings.Secure.getIntForUser(
1573                 mContext.getContentResolver(),
1574                 Settings.Secure.ACCESSIBILITY_DISPLAY_MAGNIFICATION_ENABLED,
1575                 0, userState.mUserId) == 1;
1576         if (displayMagnificationEnabled != userState.mIsDisplayMagnificationEnabled) {
1577             userState.mIsDisplayMagnificationEnabled = displayMagnificationEnabled;
1578             return true;
1579         }
1580         return false;
1581     }
1582
1583     private boolean readAutoclickEnabledSettingLocked(UserState userState) {
1584         final boolean autoclickEnabled = Settings.Secure.getIntForUser(
1585                 mContext.getContentResolver(),
1586                 Settings.Secure.ACCESSIBILITY_AUTOCLICK_ENABLED,
1587                 0, userState.mUserId) == 1;
1588         if (autoclickEnabled != userState.mIsAutoclickEnabled) {
1589             userState.mIsAutoclickEnabled = autoclickEnabled;
1590             return true;
1591         }
1592         return false;
1593     }
1594
1595     private boolean readEnhancedWebAccessibilityEnabledChangedLocked(UserState userState) {
1596          final boolean enhancedWeAccessibilityEnabled = Settings.Secure.getIntForUser(
1597                 mContext.getContentResolver(), Settings.Secure.ACCESSIBILITY_SCRIPT_INJECTION,
1598                 0, userState.mUserId) == 1;
1599          if (enhancedWeAccessibilityEnabled != userState.mIsEnhancedWebAccessibilityEnabled) {
1600              userState.mIsEnhancedWebAccessibilityEnabled = enhancedWeAccessibilityEnabled;
1601              return true;
1602          }
1603          return false;
1604     }
1605
1606     private boolean readDisplayColorAdjustmentSettingsLocked(UserState userState) {
1607         final boolean displayAdjustmentsEnabled = DisplayAdjustmentUtils.hasAdjustments(mContext,
1608                 userState.mUserId);
1609         if (displayAdjustmentsEnabled != userState.mHasDisplayColorAdjustment) {
1610             userState.mHasDisplayColorAdjustment = displayAdjustmentsEnabled;
1611             return true;
1612         }
1613         // If display adjustment is enabled, always assume there was a change in
1614         // the adjustment settings.
1615         return displayAdjustmentsEnabled;
1616     }
1617
1618     private boolean readHighTextContrastEnabledSettingLocked(UserState userState) {
1619         final boolean highTextContrastEnabled = Settings.Secure.getIntForUser(
1620                 mContext.getContentResolver(),
1621                 Settings.Secure.ACCESSIBILITY_HIGH_TEXT_CONTRAST_ENABLED, 0,
1622                 userState.mUserId) == 1;
1623         if (highTextContrastEnabled != userState.mIsTextHighContrastEnabled) {
1624             userState.mIsTextHighContrastEnabled = highTextContrastEnabled;
1625             return true;
1626         }
1627         return false;
1628     }
1629
1630     private boolean readSoftKeyboardShowModeChangedLocked(UserState userState) {
1631         final int softKeyboardShowMode = Settings.Secure.getIntForUser(
1632                 mContext.getContentResolver(),
1633                 Settings.Secure.ACCESSIBILITY_SOFT_KEYBOARD_MODE, 0,
1634                 userState.mUserId);
1635         if (softKeyboardShowMode != userState.mSoftKeyboardShowMode) {
1636             userState.mSoftKeyboardShowMode = softKeyboardShowMode;
1637             return true;
1638         }
1639         return false;
1640     }
1641
1642     private void updateTouchExplorationLocked(UserState userState) {
1643         boolean enabled = false;
1644         final int serviceCount = userState.mBoundServices.size();
1645         for (int i = 0; i < serviceCount; i++) {
1646             Service service = userState.mBoundServices.get(i);
1647             if (canRequestAndRequestsTouchExplorationLocked(service)) {
1648                 enabled = true;
1649                 break;
1650             }
1651         }
1652         if (enabled != userState.mIsTouchExplorationEnabled) {
1653             userState.mIsTouchExplorationEnabled = enabled;
1654             final long identity = Binder.clearCallingIdentity();
1655             try {
1656                 Settings.Secure.putIntForUser(mContext.getContentResolver(),
1657                         Settings.Secure.TOUCH_EXPLORATION_ENABLED, enabled ? 1 : 0,
1658                         userState.mUserId);
1659             } finally {
1660                 Binder.restoreCallingIdentity(identity);
1661             }
1662         }
1663     }
1664
1665     private boolean canRequestAndRequestsTouchExplorationLocked(Service service) {
1666         // Service not ready or cannot request the feature - well nothing to do.
1667         if (!service.canReceiveEventsLocked() || !service.mRequestTouchExplorationMode) {
1668             return false;
1669         }
1670         // UI test automation service can always enable it.
1671         if (service.mIsAutomation) {
1672             return true;
1673         }
1674         if (service.mResolveInfo.serviceInfo.applicationInfo.targetSdkVersion
1675                 <= Build.VERSION_CODES.JELLY_BEAN_MR1) {
1676             // Up to JB-MR1 we had a white list with services that can enable touch
1677             // exploration. When a service is first started we show a dialog to the
1678             // use to get a permission to white list the service.
1679             UserState userState = getUserStateLocked(service.mUserId);
1680             if (userState.mTouchExplorationGrantedServices.contains(service.mComponentName)) {
1681                 return true;
1682             } else if (mEnableTouchExplorationDialog == null
1683                     || !mEnableTouchExplorationDialog.isShowing()) {
1684                 mMainHandler.obtainMessage(
1685                         MainHandler.MSG_SHOW_ENABLED_TOUCH_EXPLORATION_DIALOG,
1686                         service).sendToTarget();
1687             }
1688         } else {
1689             // Starting in JB-MR2 we request an accessibility service to declare
1690             // certain capabilities in its meta-data to allow it to enable the
1691             // corresponding features.
1692             if ((service.mAccessibilityServiceInfo.getCapabilities()
1693                     & AccessibilityServiceInfo.CAPABILITY_CAN_REQUEST_TOUCH_EXPLORATION) != 0) {
1694                 return true;
1695             }
1696         }
1697         return false;
1698     }
1699
1700     private void updateEnhancedWebAccessibilityLocked(UserState userState) {
1701         boolean enabled = false;
1702         final int serviceCount = userState.mBoundServices.size();
1703         for (int i = 0; i < serviceCount; i++) {
1704             Service service = userState.mBoundServices.get(i);
1705             if (canRequestAndRequestsEnhancedWebAccessibilityLocked(service)) {
1706                 enabled = true;
1707                 break;
1708             }
1709         }
1710         if (enabled != userState.mIsEnhancedWebAccessibilityEnabled) {
1711             userState.mIsEnhancedWebAccessibilityEnabled = enabled;
1712             final long identity = Binder.clearCallingIdentity();
1713             try {
1714                 Settings.Secure.putIntForUser(mContext.getContentResolver(),
1715                         Settings.Secure.ACCESSIBILITY_SCRIPT_INJECTION, enabled ? 1 : 0,
1716                         userState.mUserId);
1717             } finally {
1718                 Binder.restoreCallingIdentity(identity);
1719             }
1720         }
1721     }
1722
1723     private boolean canRequestAndRequestsEnhancedWebAccessibilityLocked(Service service) {
1724         if (!service.canReceiveEventsLocked() || !service.mRequestEnhancedWebAccessibility ) {
1725             return false;
1726         }
1727         if (service.mIsAutomation || (service.mAccessibilityServiceInfo.getCapabilities()
1728                & AccessibilityServiceInfo.CAPABILITY_CAN_REQUEST_ENHANCED_WEB_ACCESSIBILITY) != 0) {
1729             return true;
1730         }
1731         return false;
1732     }
1733
1734     private void updateDisplayColorAdjustmentSettingsLocked(UserState userState) {
1735         DisplayAdjustmentUtils.applyAdjustments(mContext, userState.mUserId);
1736     }
1737
1738     private void updateMagnificationLocked(UserState userState) {
1739         if (userState.mUserId != mCurrentUserId) {
1740             return;
1741         }
1742
1743         if (userState.mIsDisplayMagnificationEnabled ||
1744                 userHasListeningMagnificationServicesLocked(userState)) {
1745             // Initialize the magnification controller if necessary
1746             getMagnificationController();
1747             mMagnificationController.register();
1748         } else if (mMagnificationController != null) {
1749             mMagnificationController.unregister();
1750         }
1751     }
1752
1753     /**
1754      * Returns whether the specified user has any services that are capable of
1755      * controlling magnification.
1756      */
1757     private boolean userHasMagnificationServicesLocked(UserState userState) {
1758         final List<Service> services = userState.mBoundServices;
1759         for (int i = 0, count = services.size(); i < count; i++) {
1760             final Service service = services.get(i);
1761             if (mSecurityPolicy.canControlMagnification(service)) {
1762                 return true;
1763             }
1764         }
1765         return false;
1766     }
1767
1768     /**
1769      * Returns whether the specified user has any services that are capable of
1770      * controlling magnification and are actively listening for magnification updates.
1771      */
1772     private boolean userHasListeningMagnificationServicesLocked(UserState userState) {
1773         final List<Service> services = userState.mBoundServices;
1774         for (int i = 0, count = services.size(); i < count; i++) {
1775             final Service service = services.get(i);
1776             if (mSecurityPolicy.canControlMagnification(service)
1777                     && service.mInvocationHandler.mIsMagnificationCallbackEnabled) {
1778                 return true;
1779             }
1780         }
1781         return false;
1782     }
1783
1784     private void updateSoftKeyboardShowModeLocked(UserState userState) {
1785         final int userId = userState.mUserId;
1786         // Only check whether we need to reset the soft keyboard mode if it is not set to the
1787         // default.
1788         if ((userId == mCurrentUserId) && (userState.mSoftKeyboardShowMode != 0)) {
1789             // Check whether the last Accessibility Service that changed the soft keyboard mode to
1790             // something other than the default is still enabled and, if not, remove flag and
1791             // reset to the default soft keyboard behavior.
1792             boolean serviceChangingSoftKeyboardModeIsEnabled =
1793                     userState.mEnabledServices.contains(userState.mServiceChangingSoftKeyboardMode);
1794
1795             if (!serviceChangingSoftKeyboardModeIsEnabled) {
1796                 final long identity = Binder.clearCallingIdentity();
1797                 try {
1798                     Settings.Secure.putIntForUser(mContext.getContentResolver(),
1799                             Settings.Secure.ACCESSIBILITY_SOFT_KEYBOARD_MODE,
1800                             0,
1801                             userState.mUserId);
1802                 } finally {
1803                     Binder.restoreCallingIdentity(identity);
1804                 }
1805                 userState.mSoftKeyboardShowMode = 0;
1806                 userState.mServiceChangingSoftKeyboardMode = null;
1807                 notifySoftKeyboardShowModeChangedLocked(userState.mSoftKeyboardShowMode);
1808             }
1809         }
1810     }
1811
1812     private MagnificationSpec getCompatibleMagnificationSpecLocked(int windowId) {
1813         IBinder windowToken = mGlobalWindowTokens.get(windowId);
1814         if (windowToken == null) {
1815             windowToken = getCurrentUserStateLocked().mWindowTokens.get(windowId);
1816         }
1817         if (windowToken != null) {
1818             return mWindowManagerService.getCompatibleMagnificationSpecForWindow(
1819                     windowToken);
1820         }
1821         return null;
1822     }
1823
1824     private KeyEventDispatcher getKeyEventDispatcher() {
1825         if (mKeyEventDispatcher == null) {
1826             mKeyEventDispatcher = new KeyEventDispatcher(
1827                     mMainHandler, MainHandler.MSG_SEND_KEY_EVENT_TO_INPUT_FILTER, mLock,
1828                     mPowerManager);
1829         }
1830         return mKeyEventDispatcher;
1831     }
1832
1833     /**
1834      * Enables accessibility service specified by {@param componentName} for the {@param userId}.
1835      */
1836     public void enableAccessibilityService(ComponentName componentName, int userId) {
1837         synchronized(mLock) {
1838             if (Binder.getCallingUid() != Process.SYSTEM_UID) {
1839                 throw new SecurityException("only SYSTEM can call enableAccessibilityService.");
1840             }
1841
1842             SettingsStringHelper settingsHelper = new SettingsStringHelper(
1843                     Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES, userId);
1844             settingsHelper.addService(componentName);
1845             settingsHelper.writeToSettings();
1846
1847             UserState userState = getUserStateLocked(userId);
1848             if (userState.mEnabledServices.add(componentName)) {
1849                 onUserStateChangedLocked(userState);
1850             }
1851         }
1852     }
1853
1854     /**
1855      * Disables accessibility service specified by {@param componentName} for the {@param userId}.
1856      */
1857     public void disableAccessibilityService(ComponentName componentName, int userId) {
1858         synchronized(mLock) {
1859             if (Binder.getCallingUid() != Process.SYSTEM_UID) {
1860                 throw new SecurityException("only SYSTEM can call disableAccessibility");
1861             }
1862
1863             SettingsStringHelper settingsHelper = new SettingsStringHelper(
1864                     Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES, userId);
1865             settingsHelper.deleteService(componentName);
1866             settingsHelper.writeToSettings();
1867
1868             UserState userState = getUserStateLocked(userId);
1869             if (userState.mEnabledServices.remove(componentName)) {
1870                 onUserStateChangedLocked(userState);
1871             }
1872         }
1873     }
1874
1875     private class SettingsStringHelper {
1876         private static final String SETTINGS_DELIMITER = ":";
1877         private ContentResolver mContentResolver;
1878         private final String mSettingsName;
1879         private Set<String> mServices;
1880         private final int mUserId;
1881
1882         public SettingsStringHelper(String name, int userId) {
1883             mUserId = userId;
1884             mSettingsName = name;
1885             mContentResolver = mContext.getContentResolver();
1886             String servicesString = Settings.Secure.getStringForUser(
1887                     mContentResolver, mSettingsName, userId);
1888             mServices = new HashSet();
1889             if (!TextUtils.isEmpty(servicesString)) {
1890                 final TextUtils.SimpleStringSplitter colonSplitter =
1891                         new TextUtils.SimpleStringSplitter(SETTINGS_DELIMITER.charAt(0));
1892                 colonSplitter.setString(servicesString);
1893                 while (colonSplitter.hasNext()) {
1894                     final String serviceName = colonSplitter.next();
1895                     mServices.add(serviceName);
1896                 }
1897             }
1898         }
1899
1900         public void addService(ComponentName component) {
1901             mServices.add(component.flattenToString());
1902         }
1903
1904         public void deleteService(ComponentName component) {
1905             mServices.remove(component.flattenToString());
1906         }
1907
1908         public void writeToSettings() {
1909             Settings.Secure.putStringForUser(mContentResolver, mSettingsName,
1910                     TextUtils.join(SETTINGS_DELIMITER, mServices), mUserId);
1911         }
1912     }
1913
1914     @Override
1915     public void dump(FileDescriptor fd, final PrintWriter pw, String[] args) {
1916         mSecurityPolicy.enforceCallingPermission(Manifest.permission.DUMP, FUNCTION_DUMP);
1917         synchronized (mLock) {
1918             pw.println("ACCESSIBILITY MANAGER (dumpsys accessibility)");
1919             pw.println();
1920             final int userCount = mUserStates.size();
1921             for (int i = 0; i < userCount; i++) {
1922                 UserState userState = mUserStates.valueAt(i);
1923                 pw.append("User state[attributes:{id=" + userState.mUserId);
1924                 pw.append(", currentUser=" + (userState.mUserId == mCurrentUserId));
1925                 pw.append(", touchExplorationEnabled=" + userState.mIsTouchExplorationEnabled);
1926                 pw.append(", displayMagnificationEnabled="
1927                         + userState.mIsDisplayMagnificationEnabled);
1928                 pw.append(", autoclickEnabled=" + userState.mIsAutoclickEnabled);
1929                 if (userState.mUiAutomationService != null) {
1930                     pw.append(", ");
1931                     userState.mUiAutomationService.dump(fd, pw, args);
1932                     pw.println();
1933                 }
1934                 pw.append("}");
1935                 pw.println();
1936                 pw.append("           services:{");
1937                 final int serviceCount = userState.mBoundServices.size();
1938                 for (int j = 0; j < serviceCount; j++) {
1939                     if (j > 0) {
1940                         pw.append(", ");
1941                         pw.println();
1942                         pw.append("                     ");
1943                     }
1944                     Service service = userState.mBoundServices.get(j);
1945                     service.dump(fd, pw, args);
1946                 }
1947                 pw.println("}]");
1948                 pw.println();
1949             }
1950             if (mSecurityPolicy.mWindows != null) {
1951                 final int windowCount = mSecurityPolicy.mWindows.size();
1952                 for (int j = 0; j < windowCount; j++) {
1953                     if (j > 0) {
1954                         pw.append(',');
1955                         pw.println();
1956                     }
1957                     pw.append("Window[");
1958                     AccessibilityWindowInfo window = mSecurityPolicy.mWindows.get(j);
1959                     pw.append(window.toString());
1960                     pw.append(']');
1961                 }
1962             }
1963         }
1964     }
1965
1966     private class AccessibilityConnectionWrapper implements DeathRecipient {
1967         private final int mWindowId;
1968         private final int mUserId;
1969         private final IAccessibilityInteractionConnection mConnection;
1970
1971         public AccessibilityConnectionWrapper(int windowId,
1972                 IAccessibilityInteractionConnection connection, int userId) {
1973             mWindowId = windowId;
1974             mUserId = userId;
1975             mConnection = connection;
1976         }
1977
1978         public void linkToDeath() throws RemoteException {
1979             mConnection.asBinder().linkToDeath(this, 0);
1980         }
1981
1982         public void unlinkToDeath() {
1983             mConnection.asBinder().unlinkToDeath(this, 0);
1984         }
1985
1986         @Override
1987         public void binderDied() {
1988             unlinkToDeath();
1989             synchronized (mLock) {
1990                 removeAccessibilityInteractionConnectionLocked(mWindowId, mUserId);
1991             }
1992         }
1993     }
1994
1995     private final class MainHandler extends Handler {
1996         public static final int MSG_SEND_ACCESSIBILITY_EVENT_TO_INPUT_FILTER = 1;
1997         public static final int MSG_SEND_STATE_TO_CLIENTS = 2;
1998         public static final int MSG_SEND_CLEARED_STATE_TO_CLIENTS_FOR_USER = 3;
1999         public static final int MSG_ANNOUNCE_NEW_USER_IF_NEEDED = 5;
2000         public static final int MSG_UPDATE_INPUT_FILTER = 6;
2001         public static final int MSG_SHOW_ENABLED_TOUCH_EXPLORATION_DIALOG = 7;
2002         public static final int MSG_SEND_KEY_EVENT_TO_INPUT_FILTER = 8;
2003         public static final int MSG_CLEAR_ACCESSIBILITY_FOCUS = 9;
2004
2005         public MainHandler(Looper looper) {
2006             super(looper);
2007         }
2008
2009         @Override
2010         public void handleMessage(Message msg) {
2011             final int type = msg.what;
2012             switch (type) {
2013                 case MSG_SEND_ACCESSIBILITY_EVENT_TO_INPUT_FILTER: {
2014                     AccessibilityEvent event = (AccessibilityEvent) msg.obj;
2015                     synchronized (mLock) {
2016                         if (mHasInputFilter && mInputFilter != null) {
2017                             mInputFilter.notifyAccessibilityEvent(event);
2018                         }
2019                     }
2020                     event.recycle();
2021                 } break;
2022
2023                 case MSG_SEND_KEY_EVENT_TO_INPUT_FILTER: {
2024                     KeyEvent event = (KeyEvent) msg.obj;
2025                     final int policyFlags = msg.arg1;
2026                     synchronized (mLock) {
2027                         if (mHasInputFilter && mInputFilter != null) {
2028                             mInputFilter.sendInputEvent(event, policyFlags);
2029                         }
2030                     }
2031                     event.recycle();
2032                 } break;
2033
2034                 case MSG_SEND_STATE_TO_CLIENTS: {
2035                     final int clientState = msg.arg1;
2036                     final int userId = msg.arg2;
2037                     sendStateToClients(clientState, mGlobalClients);
2038                     sendStateToClientsForUser(clientState, userId);
2039                 } break;
2040
2041                 case MSG_SEND_CLEARED_STATE_TO_CLIENTS_FOR_USER: {
2042                     final int userId = msg.arg1;
2043                     sendStateToClientsForUser(0, userId);
2044                 } break;
2045
2046                 case MSG_ANNOUNCE_NEW_USER_IF_NEEDED: {
2047                     announceNewUserIfNeeded();
2048                 } break;
2049
2050                 case MSG_UPDATE_INPUT_FILTER: {
2051                     UserState userState = (UserState) msg.obj;
2052                     updateInputFilter(userState);
2053                 } break;
2054
2055                 case MSG_SHOW_ENABLED_TOUCH_EXPLORATION_DIALOG: {
2056                     Service service = (Service) msg.obj;
2057                     showEnableTouchExplorationDialog(service);
2058                 } break;
2059
2060                 case MSG_CLEAR_ACCESSIBILITY_FOCUS: {
2061                     final int windowId = msg.arg1;
2062                     InteractionBridge bridge;
2063                     synchronized (mLock) {
2064                         bridge = getInteractionBridgeLocked();
2065                     }
2066                     bridge.clearAccessibilityFocusNotLocked(windowId);
2067                 } break;
2068             }
2069         }
2070
2071         private void announceNewUserIfNeeded() {
2072             synchronized (mLock) {
2073                 UserState userState = getCurrentUserStateLocked();
2074                 if (userState.isHandlingAccessibilityEvents()) {
2075                     UserManager userManager = (UserManager) mContext.getSystemService(
2076                             Context.USER_SERVICE);
2077                     String message = mContext.getString(R.string.user_switched,
2078                             userManager.getUserInfo(mCurrentUserId).name);
2079                     AccessibilityEvent event = AccessibilityEvent.obtain(
2080                             AccessibilityEvent.TYPE_ANNOUNCEMENT);
2081                     event.getText().add(message);
2082                     sendAccessibilityEvent(event, mCurrentUserId);
2083                 }
2084             }
2085         }
2086
2087         private void sendStateToClientsForUser(int clientState, int userId) {
2088             final UserState userState;
2089             synchronized (mLock) {
2090                 userState = getUserStateLocked(userId);
2091             }
2092             sendStateToClients(clientState, userState.mClients);
2093         }
2094
2095         private void sendStateToClients(int clientState,
2096                 RemoteCallbackList<IAccessibilityManagerClient> clients) {
2097             try {
2098                 final int userClientCount = clients.beginBroadcast();
2099                 for (int i = 0; i < userClientCount; i++) {
2100                     IAccessibilityManagerClient client = clients.getBroadcastItem(i);
2101                     try {
2102                         client.setState(clientState);
2103                     } catch (RemoteException re) {
2104                         /* ignore */
2105                     }
2106                 }
2107             } finally {
2108                 clients.finishBroadcast();
2109             }
2110         }
2111     }
2112
2113     private int findWindowIdLocked(IBinder token) {
2114         final int globalIndex = mGlobalWindowTokens.indexOfValue(token);
2115         if (globalIndex >= 0) {
2116             return mGlobalWindowTokens.keyAt(globalIndex);
2117         }
2118         UserState userState = getCurrentUserStateLocked();
2119         final int userIndex = userState.mWindowTokens.indexOfValue(token);
2120         if (userIndex >= 0) {
2121             return userState.mWindowTokens.keyAt(userIndex);
2122         }
2123         return -1;
2124     }
2125
2126     private void ensureWindowsAvailableTimed() {
2127         synchronized (mLock) {
2128             if (mSecurityPolicy.mWindows != null) {
2129                 return;
2130             }
2131             // If we have no registered callback, update the state we
2132             // we may have to register one but it didn't happen yet.
2133             if (mWindowsForAccessibilityCallback == null) {
2134                 UserState userState = getCurrentUserStateLocked();
2135                 onUserStateChangedLocked(userState);
2136             }
2137             // We have no windows but do not care about them, done.
2138             if (mWindowsForAccessibilityCallback == null) {
2139                 return;
2140             }
2141
2142             // Wait for the windows with a timeout.
2143             final long startMillis = SystemClock.uptimeMillis();
2144             while (mSecurityPolicy.mWindows == null) {
2145                 final long elapsedMillis = SystemClock.uptimeMillis() - startMillis;
2146                 final long remainMillis = WAIT_WINDOWS_TIMEOUT_MILLIS - elapsedMillis;
2147                 if (remainMillis <= 0) {
2148                     return;
2149                 }
2150                 try {
2151                     mLock.wait(remainMillis);
2152                 } catch (InterruptedException ie) {
2153                     /* ignore */
2154                 }
2155             }
2156         }
2157     }
2158
2159     MagnificationController getMagnificationController() {
2160         synchronized (mLock) {
2161             if (mMagnificationController == null) {
2162                 mMagnificationController = new MagnificationController(mContext, this, mLock);
2163                 mMagnificationController.setUserId(mCurrentUserId);
2164             }
2165             return mMagnificationController;
2166         }
2167     }
2168
2169     /**
2170      * This class represents an accessibility service. It stores all per service
2171      * data required for the service management, provides API for starting/stopping the
2172      * service and is responsible for adding/removing the service in the data structures
2173      * for service management. The class also exposes configuration interface that is
2174      * passed to the service it represents as soon it is bound. It also serves as the
2175      * connection for the service.
2176      */
2177     class Service extends IAccessibilityServiceConnection.Stub
2178             implements ServiceConnection, DeathRecipient {;
2179
2180         final int mUserId;
2181
2182         int mId = 0;
2183
2184         AccessibilityServiceInfo mAccessibilityServiceInfo;
2185
2186         IBinder mService;
2187
2188         IAccessibilityServiceClient mServiceInterface;
2189
2190         int mEventTypes;
2191
2192         int mFeedbackType;
2193
2194         Set<String> mPackageNames = new HashSet<>();
2195
2196         boolean mIsDefault;
2197
2198         boolean mRequestTouchExplorationMode;
2199
2200         boolean mRequestEnhancedWebAccessibility;
2201
2202         boolean mRequestFilterKeyEvents;
2203
2204         boolean mRetrieveInteractiveWindows;
2205
2206         int mFetchFlags;
2207
2208         long mNotificationTimeout;
2209
2210         ComponentName mComponentName;
2211
2212         Intent mIntent;
2213
2214         boolean mIsAutomation;
2215
2216         final ResolveInfo mResolveInfo;
2217
2218         final IBinder mOverlayWindowToken = new Binder();
2219
2220         // the events pending events to be dispatched to this service
2221         final SparseArray<AccessibilityEvent> mPendingEvents =
2222             new SparseArray<>();
2223
2224         boolean mWasConnectedAndDied;
2225
2226         // Handler only for dispatching accessibility events since we use event
2227         // types as message types allowing us to remove messages per event type.
2228         public Handler mEventDispatchHandler = new Handler(mMainHandler.getLooper()) {
2229             @Override
2230             public void handleMessage(Message message) {
2231                 final int eventType =  message.what;
2232                 AccessibilityEvent event = (AccessibilityEvent) message.obj;
2233                 notifyAccessibilityEventInternal(eventType, event);
2234             }
2235         };
2236
2237         // Handler for scheduling method invocations on the main thread.
2238         public final InvocationHandler mInvocationHandler = new InvocationHandler(
2239                 mMainHandler.getLooper());
2240
2241         public Service(int userId, ComponentName componentName,
2242                 AccessibilityServiceInfo accessibilityServiceInfo) {
2243             mUserId = userId;
2244             mResolveInfo = accessibilityServiceInfo.getResolveInfo();
2245             mId = sIdCounter++;
2246             mComponentName = componentName;
2247             mAccessibilityServiceInfo = accessibilityServiceInfo;
2248             mIsAutomation = (sFakeAccessibilityServiceComponentName.equals(componentName));
2249             if (!mIsAutomation) {
2250                 mIntent = new Intent().setComponent(mComponentName);
2251                 mIntent.putExtra(Intent.EXTRA_CLIENT_LABEL,
2252                         com.android.internal.R.string.accessibility_binding_label);
2253                 final long idendtity = Binder.clearCallingIdentity();
2254                 try {
2255                     mIntent.putExtra(Intent.EXTRA_CLIENT_INTENT, PendingIntent.getActivity(
2256                             mContext, 0, new Intent(Settings.ACTION_ACCESSIBILITY_SETTINGS), 0));
2257                 } finally {
2258                     Binder.restoreCallingIdentity(idendtity);
2259                 }
2260             }
2261             setDynamicallyConfigurableProperties(accessibilityServiceInfo);
2262         }
2263
2264         public void setDynamicallyConfigurableProperties(AccessibilityServiceInfo info) {
2265             mEventTypes = info.eventTypes;
2266             mFeedbackType = info.feedbackType;
2267             String[] packageNames = info.packageNames;
2268             if (packageNames != null) {
2269                 mPackageNames.addAll(Arrays.asList(packageNames));
2270             }
2271             mNotificationTimeout = info.notificationTimeout;
2272             mIsDefault = (info.flags & DEFAULT) != 0;
2273
2274             if (mIsAutomation || info.getResolveInfo().serviceInfo.applicationInfo.targetSdkVersion
2275                     >= Build.VERSION_CODES.JELLY_BEAN) {
2276                 if ((info.flags & AccessibilityServiceInfo.FLAG_INCLUDE_NOT_IMPORTANT_VIEWS) != 0) {
2277                     mFetchFlags |= AccessibilityNodeInfo.FLAG_INCLUDE_NOT_IMPORTANT_VIEWS;
2278                 } else {
2279                     mFetchFlags &= ~AccessibilityNodeInfo.FLAG_INCLUDE_NOT_IMPORTANT_VIEWS;
2280                 }
2281             }
2282
2283             if ((info.flags & AccessibilityServiceInfo.FLAG_REPORT_VIEW_IDS) != 0) {
2284                 mFetchFlags |= AccessibilityNodeInfo.FLAG_REPORT_VIEW_IDS;
2285             } else {
2286                 mFetchFlags &= ~AccessibilityNodeInfo.FLAG_REPORT_VIEW_IDS;
2287             }
2288
2289             mRequestTouchExplorationMode = (info.flags
2290                     & AccessibilityServiceInfo.FLAG_REQUEST_TOUCH_EXPLORATION_MODE) != 0;
2291             mRequestEnhancedWebAccessibility = (info.flags
2292                     & AccessibilityServiceInfo.FLAG_REQUEST_ENHANCED_WEB_ACCESSIBILITY) != 0;
2293             mRequestFilterKeyEvents = (info.flags
2294                     & AccessibilityServiceInfo.FLAG_REQUEST_FILTER_KEY_EVENTS) != 0;
2295             mRetrieveInteractiveWindows = (info.flags
2296                     & AccessibilityServiceInfo.FLAG_RETRIEVE_INTERACTIVE_WINDOWS) != 0;
2297         }
2298
2299         /**
2300          * Binds to the accessibility service.
2301          *
2302          * @return True if binding is successful.
2303          */
2304         public boolean bindLocked() {
2305             UserState userState = getUserStateLocked(mUserId);
2306             if (!mIsAutomation) {
2307                 final long identity = Binder.clearCallingIdentity();
2308                 try {
2309                     if (mService == null && mContext.bindServiceAsUser(
2310                             mIntent, this,
2311                             Context.BIND_AUTO_CREATE | Context.BIND_FOREGROUND_SERVICE_WHILE_AWAKE,
2312                             new UserHandle(mUserId))) {
2313                         userState.mBindingServices.add(mComponentName);
2314                     }
2315                 } finally {
2316                     Binder.restoreCallingIdentity(identity);
2317                 }
2318             } else {
2319                 userState.mBindingServices.add(mComponentName);
2320                 mService = userState.mUiAutomationServiceClient.asBinder();
2321                 mMainHandler.post(new Runnable() {
2322                     @Override
2323                     public void run() {
2324                         // Simulate asynchronous connection since in onServiceConnected
2325                         // we may modify the state data in case of an error but bind is
2326                         // called while iterating over the data and bad things can happen.
2327                         onServiceConnected(mComponentName, mService);
2328                     }
2329                 });
2330                 userState.mUiAutomationService = this;
2331             }
2332             return false;
2333         }
2334
2335         /**
2336          * Unbinds form the accessibility service and removes it from the data
2337          * structures for service management.
2338          *
2339          * @return True if unbinding is successful.
2340          */
2341         public boolean unbindLocked() {
2342             if (mService == null) {
2343                 return false;
2344             }
2345             UserState userState = getUserStateLocked(mUserId);
2346             getKeyEventDispatcher().flush(this);
2347             if (!mIsAutomation) {
2348                 mContext.unbindService(this);
2349             } else {
2350                 userState.destroyUiAutomationService();
2351             }
2352             removeServiceLocked(this, userState);
2353             resetLocked();
2354             return true;
2355         }
2356
2357         @Override
2358         public void disableSelf() {
2359             synchronized(mLock) {
2360                 UserState userState = getUserStateLocked(mUserId);
2361                 if (userState.mEnabledServices.remove(mComponentName)) {
2362                     final long identity = Binder.clearCallingIdentity();
2363                     try {
2364                         persistComponentNamesToSettingLocked(
2365                                 Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES,
2366                                 userState.mEnabledServices, mUserId);
2367                     } finally {
2368                         Binder.restoreCallingIdentity(identity);
2369                     }
2370                     onUserStateChangedLocked(userState);
2371                 }
2372             }
2373         }
2374
2375         public boolean canReceiveEventsLocked() {
2376             return (mEventTypes != 0 && mFeedbackType != 0 && mService != null);
2377         }
2378
2379         @Override
2380         public void setOnKeyEventResult(boolean handled, int sequence) {
2381             getKeyEventDispatcher().setOnKeyEventResult(this, handled, sequence);
2382         }
2383
2384         @Override
2385         public AccessibilityServiceInfo getServiceInfo() {
2386             synchronized (mLock) {
2387                 return mAccessibilityServiceInfo;
2388             }
2389         }
2390
2391         public boolean canRetrieveInteractiveWindowsLocked() {
2392             return mSecurityPolicy.canRetrieveWindowContentLocked(this)
2393                     && mRetrieveInteractiveWindows;
2394         }
2395
2396         @Override
2397         public void setServiceInfo(AccessibilityServiceInfo info) {
2398             final long identity = Binder.clearCallingIdentity();
2399             try {
2400                 synchronized (mLock) {
2401                     // If the XML manifest had data to configure the service its info
2402                     // should be already set. In such a case update only the dynamically
2403                     // configurable properties.
2404                     AccessibilityServiceInfo oldInfo = mAccessibilityServiceInfo;
2405                     if (oldInfo != null) {
2406                         oldInfo.updateDynamicallyConfigurableProperties(info);
2407                         setDynamicallyConfigurableProperties(oldInfo);
2408                     } else {
2409                         setDynamicallyConfigurableProperties(info);
2410                     }
2411                     UserState userState = getUserStateLocked(mUserId);
2412                     onUserStateChangedLocked(userState);
2413                 }
2414             } finally {
2415                 Binder.restoreCallingIdentity(identity);
2416             }
2417         }
2418
2419         @Override
2420         public void onServiceConnected(ComponentName componentName, IBinder service) {
2421             synchronized (mLock) {
2422                 mService = service;
2423                 mServiceInterface = IAccessibilityServiceClient.Stub.asInterface(service);
2424                 UserState userState = getUserStateLocked(mUserId);
2425                 addServiceLocked(this, userState);
2426                 if (userState.mBindingServices.contains(mComponentName) || mWasConnectedAndDied) {
2427                     userState.mBindingServices.remove(mComponentName);
2428                     mWasConnectedAndDied = false;
2429                     try {
2430                        mServiceInterface.init(this, mId, mOverlayWindowToken);
2431                        onUserStateChangedLocked(userState);
2432                     } catch (RemoteException re) {
2433                         Slog.w(LOG_TAG, "Error while setting connection for service: "
2434                                 + service, re);
2435                         binderDied();
2436                     }
2437                 } else {
2438                     binderDied();
2439                 }
2440             }
2441         }
2442
2443         private boolean isCalledForCurrentUserLocked() {
2444             // We treat calls from a profile as if made by its parent as profiles
2445             // share the accessibility state of the parent. The call below
2446             // performs the current profile parent resolution.
2447             final int resolvedUserId = mSecurityPolicy
2448                     .resolveCallingUserIdEnforcingPermissionsLocked(UserHandle.USER_CURRENT);
2449             return resolvedUserId == mCurrentUserId;
2450         }
2451
2452         @Override
2453         public List<AccessibilityWindowInfo> getWindows() {
2454             ensureWindowsAvailableTimed();
2455             synchronized (mLock) {
2456                 if (!isCalledForCurrentUserLocked()) {
2457                     return null;
2458                 }
2459                 final boolean permissionGranted =
2460                         mSecurityPolicy.canRetrieveWindowsLocked(this);
2461                 if (!permissionGranted) {
2462                     return null;
2463                 }
2464                 if (mSecurityPolicy.mWindows == null) {
2465                     return null;
2466                 }
2467                 List<AccessibilityWindowInfo> windows = new ArrayList<>();
2468                 final int windowCount = mSecurityPolicy.mWindows.size();
2469                 for (int i = 0; i < windowCount; i++) {
2470                     AccessibilityWindowInfo window = mSecurityPolicy.mWindows.get(i);
2471                     AccessibilityWindowInfo windowClone =
2472                             AccessibilityWindowInfo.obtain(window);
2473                     windowClone.setConnectionId(mId);
2474                     windows.add(windowClone);
2475                 }
2476                 return windows;
2477             }
2478         }
2479
2480         @Override
2481         public AccessibilityWindowInfo getWindow(int windowId) {
2482             ensureWindowsAvailableTimed();
2483             synchronized (mLock) {
2484                 if (!isCalledForCurrentUserLocked()) {
2485                     return null;
2486                 }
2487                 final boolean permissionGranted =
2488                         mSecurityPolicy.canRetrieveWindowsLocked(this);
2489                 if (!permissionGranted) {
2490                     return null;
2491                 }
2492                 AccessibilityWindowInfo window = mSecurityPolicy.findWindowById(windowId);
2493                 if (window != null) {
2494                     AccessibilityWindowInfo windowClone = AccessibilityWindowInfo.obtain(window);
2495                     windowClone.setConnectionId(mId);
2496                     return windowClone;
2497                 }
2498                 return null;
2499             }
2500         }
2501
2502         @Override
2503         public boolean findAccessibilityNodeInfosByViewId(int accessibilityWindowId,
2504                 long accessibilityNodeId, String viewIdResName, int interactionId,
2505                 IAccessibilityInteractionConnectionCallback callback, long interrogatingTid)
2506                 throws RemoteException {
2507             final int resolvedWindowId;
2508             IAccessibilityInteractionConnection connection = null;
2509             Region partialInteractiveRegion = Region.obtain();
2510             synchronized (mLock) {
2511                 if (!isCalledForCurrentUserLocked()) {
2512                     return false;
2513                 }
2514                 resolvedWindowId = resolveAccessibilityWindowIdLocked(accessibilityWindowId);
2515                 final boolean permissionGranted =
2516                         mSecurityPolicy.canGetAccessibilityNodeInfoLocked(this, resolvedWindowId);
2517                 if (!permissionGranted) {
2518                     return false;
2519                 } else {
2520                     connection = getConnectionLocked(resolvedWindowId);
2521                     if (connection == null) {
2522                         return false;
2523                     }
2524                 }
2525                 if (!mSecurityPolicy.computePartialInteractiveRegionForWindowLocked(
2526                         resolvedWindowId, partialInteractiveRegion)) {
2527                     partialInteractiveRegion.recycle();
2528                     partialInteractiveRegion = null;
2529                 }
2530             }
2531             final int interrogatingPid = Binder.getCallingPid();
2532             final long identityToken = Binder.clearCallingIdentity();
2533             MagnificationSpec spec = getCompatibleMagnificationSpecLocked(resolvedWindowId);
2534             try {
2535                 connection.findAccessibilityNodeInfosByViewId(accessibilityNodeId, viewIdResName,
2536                         partialInteractiveRegion, interactionId, callback, mFetchFlags,
2537                         interrogatingPid, interrogatingTid, spec);
2538                 return true;
2539             } catch (RemoteException re) {
2540                 if (DEBUG) {
2541                     Slog.e(LOG_TAG, "Error findAccessibilityNodeInfoByViewId().");
2542                 }
2543             } finally {
2544                 Binder.restoreCallingIdentity(identityToken);
2545                 // Recycle if passed to another process.
2546                 if (partialInteractiveRegion != null && Binder.isProxy(connection)) {
2547                     partialInteractiveRegion.recycle();
2548                 }
2549             }
2550             return false;
2551         }
2552
2553         @Override
2554         public boolean findAccessibilityNodeInfosByText(int accessibilityWindowId,
2555                 long accessibilityNodeId, String text, int interactionId,
2556                 IAccessibilityInteractionConnectionCallback callback, long interrogatingTid)
2557                 throws RemoteException {
2558             final int resolvedWindowId;
2559             IAccessibilityInteractionConnection connection = null;
2560             Region partialInteractiveRegion = Region.obtain();
2561             synchronized (mLock) {
2562                 if (!isCalledForCurrentUserLocked()) {
2563                     return false;
2564                 }
2565                 resolvedWindowId = resolveAccessibilityWindowIdLocked(accessibilityWindowId);
2566                 final boolean permissionGranted =
2567                     mSecurityPolicy.canGetAccessibilityNodeInfoLocked(this, resolvedWindowId);
2568                 if (!permissionGranted) {
2569                     return false;
2570                 } else {
2571                     connection = getConnectionLocked(resolvedWindowId);
2572                     if (connection == null) {
2573                         return false;
2574                     }
2575                 }
2576                 if (!mSecurityPolicy.computePartialInteractiveRegionForWindowLocked(
2577                         resolvedWindowId, partialInteractiveRegion)) {
2578                     partialInteractiveRegion.recycle();
2579                     partialInteractiveRegion = null;
2580                 }
2581             }
2582             final int interrogatingPid = Binder.getCallingPid();
2583             final long identityToken = Binder.clearCallingIdentity();
2584             MagnificationSpec spec = getCompatibleMagnificationSpecLocked(resolvedWindowId);
2585             try {
2586                 connection.findAccessibilityNodeInfosByText(accessibilityNodeId, text,
2587                         partialInteractiveRegion, interactionId, callback, mFetchFlags,
2588                         interrogatingPid, interrogatingTid, spec);
2589                 return true;
2590             } catch (RemoteException re) {
2591                 if (DEBUG) {
2592                     Slog.e(LOG_TAG, "Error calling findAccessibilityNodeInfosByText()");
2593                 }
2594             } finally {
2595                 Binder.restoreCallingIdentity(identityToken);
2596                 // Recycle if passed to another process.
2597                 if (partialInteractiveRegion != null && Binder.isProxy(connection)) {
2598                     partialInteractiveRegion.recycle();
2599                 }
2600             }
2601             return false;
2602         }
2603
2604         @Override
2605         public boolean findAccessibilityNodeInfoByAccessibilityId(
2606                 int accessibilityWindowId, long accessibilityNodeId, int interactionId,
2607                 IAccessibilityInteractionConnectionCallback callback, int flags,
2608                 long interrogatingTid) throws RemoteException {
2609             final int resolvedWindowId;
2610             IAccessibilityInteractionConnection connection = null;
2611             Region partialInteractiveRegion = Region.obtain();
2612             synchronized (mLock) {
2613                 if (!isCalledForCurrentUserLocked()) {
2614                     return false;
2615                 }
2616                 resolvedWindowId = resolveAccessibilityWindowIdLocked(accessibilityWindowId);
2617                 final boolean permissionGranted =
2618                     mSecurityPolicy.canGetAccessibilityNodeInfoLocked(this, resolvedWindowId);
2619                 if (!permissionGranted) {
2620                     return false;
2621                 } else {
2622                     connection = getConnectionLocked(resolvedWindowId);
2623                     if (connection == null) {
2624                         return false;
2625                     }
2626                 }
2627                 if (!mSecurityPolicy.computePartialInteractiveRegionForWindowLocked(
2628                         resolvedWindowId, partialInteractiveRegion)) {
2629                     partialInteractiveRegion.recycle();
2630                     partialInteractiveRegion = null;
2631                 }
2632             }
2633             final int interrogatingPid = Binder.getCallingPid();
2634             final long identityToken = Binder.clearCallingIdentity();
2635             MagnificationSpec spec = getCompatibleMagnificationSpecLocked(resolvedWindowId);
2636             try {
2637                 connection.findAccessibilityNodeInfoByAccessibilityId(accessibilityNodeId,
2638                         partialInteractiveRegion, interactionId, callback, mFetchFlags | flags,
2639                         interrogatingPid, interrogatingTid, spec);
2640                 return true;
2641             } catch (RemoteException re) {
2642                 if (DEBUG) {
2643                     Slog.e(LOG_TAG, "Error calling findAccessibilityNodeInfoByAccessibilityId()");
2644                 }
2645             } finally {
2646                 Binder.restoreCallingIdentity(identityToken);
2647                 // Recycle if passed to another process.
2648                 if (partialInteractiveRegion != null && Binder.isProxy(connection)) {
2649                     partialInteractiveRegion.recycle();
2650                 }
2651             }
2652             return false;
2653         }
2654
2655         @Override
2656         public boolean findFocus(int accessibilityWindowId, long accessibilityNodeId,
2657                 int focusType, int interactionId,
2658                 IAccessibilityInteractionConnectionCallback callback, long interrogatingTid)
2659                 throws RemoteException {
2660             final int resolvedWindowId;
2661             IAccessibilityInteractionConnection connection = null;
2662             Region partialInteractiveRegion = Region.obtain();
2663             synchronized (mLock) {
2664                 if (!isCalledForCurrentUserLocked()) {
2665                     return false;
2666                 }
2667                 resolvedWindowId = resolveAccessibilityWindowIdForFindFocusLocked(
2668                         accessibilityWindowId, focusType);
2669                 final boolean permissionGranted =
2670                     mSecurityPolicy.canGetAccessibilityNodeInfoLocked(this, resolvedWindowId);
2671                 if (!permissionGranted) {
2672                     return false;
2673                 } else {
2674                     connection = getConnectionLocked(resolvedWindowId);
2675                     if (connection == null) {
2676                         return false;
2677                     }
2678                 }
2679                 if (!mSecurityPolicy.computePartialInteractiveRegionForWindowLocked(
2680                         resolvedWindowId, partialInteractiveRegion)) {
2681                     partialInteractiveRegion.recycle();
2682                     partialInteractiveRegion = null;
2683                 }
2684             }
2685             final int interrogatingPid = Binder.getCallingPid();
2686             final long identityToken = Binder.clearCallingIdentity();
2687             MagnificationSpec spec = getCompatibleMagnificationSpecLocked(resolvedWindowId);
2688             try {
2689                 connection.findFocus(accessibilityNodeId, focusType, partialInteractiveRegion,
2690                         interactionId, callback, mFetchFlags, interrogatingPid, interrogatingTid,
2691                         spec);
2692                 return true;
2693             } catch (RemoteException re) {
2694                 if (DEBUG) {
2695                     Slog.e(LOG_TAG, "Error calling findFocus()");
2696                 }
2697             } finally {
2698                 Binder.restoreCallingIdentity(identityToken);
2699                 // Recycle if passed to another process.
2700                 if (partialInteractiveRegion != null && Binder.isProxy(connection)) {
2701                     partialInteractiveRegion.recycle();
2702                 }
2703             }
2704             return false;
2705         }
2706
2707         @Override
2708         public boolean focusSearch(int accessibilityWindowId, long accessibilityNodeId,
2709                 int direction, int interactionId,
2710                 IAccessibilityInteractionConnectionCallback callback, long interrogatingTid)
2711                 throws RemoteException {
2712             final int resolvedWindowId;
2713             IAccessibilityInteractionConnection connection = null;
2714             Region partialInteractiveRegion = Region.obtain();
2715             synchronized (mLock) {
2716                 if (!isCalledForCurrentUserLocked()) {
2717                     return false;
2718                 }
2719                 resolvedWindowId = resolveAccessibilityWindowIdLocked(accessibilityWindowId);
2720                 final boolean permissionGranted =
2721                     mSecurityPolicy.canGetAccessibilityNodeInfoLocked(this, resolvedWindowId);
2722                 if (!permissionGranted) {
2723                     return false;
2724                 } else {
2725                     connection = getConnectionLocked(resolvedWindowId);
2726                     if (connection == null) {
2727                         return false;
2728                     }
2729                 }
2730                 if (!mSecurityPolicy.computePartialInteractiveRegionForWindowLocked(
2731                         resolvedWindowId, partialInteractiveRegion)) {
2732                     partialInteractiveRegion.recycle();
2733                     partialInteractiveRegion = null;
2734                 }
2735             }
2736             final int interrogatingPid = Binder.getCallingPid();
2737             final long identityToken = Binder.clearCallingIdentity();
2738             MagnificationSpec spec = getCompatibleMagnificationSpecLocked(resolvedWindowId);
2739             try {
2740                 connection.focusSearch(accessibilityNodeId, direction, partialInteractiveRegion,
2741                         interactionId, callback, mFetchFlags, interrogatingPid, interrogatingTid,
2742                         spec);
2743                 return true;
2744             } catch (RemoteException re) {
2745                 if (DEBUG) {
2746                     Slog.e(LOG_TAG, "Error calling accessibilityFocusSearch()");
2747                 }
2748             } finally {
2749                 Binder.restoreCallingIdentity(identityToken);
2750                 // Recycle if passed to another process.
2751                 if (partialInteractiveRegion != null && Binder.isProxy(connection)) {
2752                     partialInteractiveRegion.recycle();
2753                 }
2754             }
2755             return false;
2756         }
2757
2758         @Override
2759         public void sendGesture(int sequence, ParceledListSlice gestureSteps) {
2760             synchronized (mLock) {
2761                 if (mSecurityPolicy.canPerformGestures(this)) {
2762                     final long endMillis =
2763                             SystemClock.uptimeMillis() + WAIT_MOTION_INJECTOR_TIMEOUT_MILLIS;
2764                     while ((mMotionEventInjector == null)
2765                             && (SystemClock.uptimeMillis() < endMillis)) {
2766                         try {
2767                             mLock.wait(endMillis - SystemClock.uptimeMillis());
2768                         } catch (InterruptedException ie) {
2769                             /* ignore */
2770                         }
2771                     }
2772                     if (mMotionEventInjector != null) {
2773                         List<GestureDescription.GestureStep> steps = gestureSteps.getList();
2774                         List<MotionEvent> events = GestureDescription.MotionEventGenerator
2775                                 .getMotionEventsFromGestureSteps(steps);
2776                         // Confirm that the motion events end with an UP event.
2777                         if (events.get(events.size() - 1).getAction() == MotionEvent.ACTION_UP) {
2778                             mMotionEventInjector.injectEvents(events, mServiceInterface, sequence);
2779                             return;
2780                         } else {
2781                             Slog.e(LOG_TAG, "Gesture is not well-formed");
2782                         }
2783                     } else {
2784                         Slog.e(LOG_TAG, "MotionEventInjector installation timed out");
2785                     }
2786                 }
2787             }
2788             try {
2789                 mServiceInterface.onPerformGestureResult(sequence, false);
2790             } catch (RemoteException re) {
2791                 Slog.e(LOG_TAG, "Error sending motion event injection failure to "
2792                         + mServiceInterface, re);
2793             }
2794         }
2795
2796         @Override
2797         public boolean performAccessibilityAction(int accessibilityWindowId,
2798                 long accessibilityNodeId, int action, Bundle arguments, int interactionId,
2799                 IAccessibilityInteractionConnectionCallback callback, long interrogatingTid)
2800                 throws RemoteException {
2801             final int resolvedWindowId;
2802             IAccessibilityInteractionConnection connection = null;
2803             synchronized (mLock) {
2804                 if (!isCalledForCurrentUserLocked()) {
2805                     return false;
2806                 }
2807                 resolvedWindowId = resolveAccessibilityWindowIdLocked(accessibilityWindowId);
2808                 final boolean permissionGranted = mSecurityPolicy.canGetAccessibilityNodeInfoLocked(
2809                         this, resolvedWindowId);
2810                 if (!permissionGranted) {
2811                     return false;
2812                 } else {
2813                     connection = getConnectionLocked(resolvedWindowId);
2814                     if (connection == null) {
2815                         return false;
2816                     }
2817                 }
2818             }
2819             final int interrogatingPid = Binder.getCallingPid();
2820             final long identityToken = Binder.clearCallingIdentity();
2821             try {
2822                 // Regardless of whether or not the action succeeds, it was generated by an
2823                 // accessibility service that is driven by user actions, so note user activity.
2824                 mPowerManager.userActivity(SystemClock.uptimeMillis(),
2825                         PowerManager.USER_ACTIVITY_EVENT_ACCESSIBILITY, 0);
2826
2827                 connection.performAccessibilityAction(accessibilityNodeId, action, arguments,
2828                         interactionId, callback, mFetchFlags, interrogatingPid, interrogatingTid);
2829             } catch (RemoteException re) {
2830                 if (DEBUG) {
2831                     Slog.e(LOG_TAG, "Error calling performAccessibilityAction()");
2832                 }
2833             } finally {
2834                 Binder.restoreCallingIdentity(identityToken);
2835             }
2836             return true;
2837         }
2838
2839         @Override
2840         public boolean performGlobalAction(int action) {
2841             synchronized (mLock) {
2842                 if (!isCalledForCurrentUserLocked()) {
2843                     return false;
2844                 }
2845             }
2846             final long identity = Binder.clearCallingIdentity();
2847             try {
2848                 mPowerManager.userActivity(SystemClock.uptimeMillis(),
2849                         PowerManager.USER_ACTIVITY_EVENT_ACCESSIBILITY, 0);
2850                 switch (action) {
2851                     case AccessibilityService.GLOBAL_ACTION_BACK: {
2852                         sendDownAndUpKeyEvents(KeyEvent.KEYCODE_BACK);
2853                     } return true;
2854                     case AccessibilityService.GLOBAL_ACTION_HOME: {
2855                         sendDownAndUpKeyEvents(KeyEvent.KEYCODE_HOME);
2856                     } return true;
2857                     case AccessibilityService.GLOBAL_ACTION_RECENTS: {
2858                         openRecents();
2859                     } return true;
2860                     case AccessibilityService.GLOBAL_ACTION_NOTIFICATIONS: {
2861                         expandNotifications();
2862                     } return true;
2863                     case AccessibilityService.GLOBAL_ACTION_QUICK_SETTINGS: {
2864                         expandQuickSettings();
2865                     } return true;
2866                     case AccessibilityService.GLOBAL_ACTION_POWER_DIALOG: {
2867                         showGlobalActions();
2868                     } return true;
2869                     case AccessibilityService.GLOBAL_ACTION_TOGGLE_SPLIT_SCREEN: {
2870                         toggleSplitScreen();
2871                     } return true;
2872                 }
2873                 return false;
2874             } finally {
2875                 Binder.restoreCallingIdentity(identity);
2876             }
2877         }
2878
2879         @Override
2880         public float getMagnificationScale() {
2881             synchronized (mLock) {
2882                 if (!isCalledForCurrentUserLocked()) {
2883                     return 1.0f;
2884                 }
2885             }
2886             final long identity = Binder.clearCallingIdentity();
2887             try {
2888                 return getMagnificationController().getScale();
2889             } finally {
2890                 Binder.restoreCallingIdentity(identity);
2891             }
2892         }
2893
2894         @Override
2895         public Region getMagnificationRegion() {
2896             synchronized (mLock) {
2897                 final Region region = Region.obtain();
2898                 if (!isCalledForCurrentUserLocked()) {
2899                     return region;
2900                 }
2901                 MagnificationController magnificationController = getMagnificationController();
2902                 boolean forceRegistration = mSecurityPolicy.canControlMagnification(this);
2903                 boolean initiallyRegistered = magnificationController.isRegisteredLocked();
2904                 if (!initiallyRegistered && forceRegistration) {
2905                     magnificationController.register();
2906                 }
2907                 final long identity = Binder.clearCallingIdentity();
2908                 try {
2909                     magnificationController.getMagnificationRegion(region);
2910                     return region;
2911                 } finally {
2912                     Binder.restoreCallingIdentity(identity);
2913                     if (!initiallyRegistered && forceRegistration) {
2914                         magnificationController.unregister();
2915                     }
2916                 }
2917             }
2918         }
2919
2920         @Override
2921         public float getMagnificationCenterX() {
2922             synchronized (mLock) {
2923                 if (!isCalledForCurrentUserLocked()) {
2924                     return 0.0f;
2925                 }
2926             }
2927             final long identity = Binder.clearCallingIdentity();
2928             try {
2929                 return getMagnificationController().getCenterX();
2930             } finally {
2931                 Binder.restoreCallingIdentity(identity);
2932             }
2933         }
2934
2935         @Override
2936         public float getMagnificationCenterY() {
2937             synchronized (mLock) {
2938                 if (!isCalledForCurrentUserLocked()) {
2939                     return 0.0f;
2940                 }
2941             }
2942             final long identity = Binder.clearCallingIdentity();
2943             try {
2944                 return getMagnificationController().getCenterY();
2945             } finally {
2946                 Binder.restoreCallingIdentity(identity);
2947             }
2948         }
2949
2950         @Override
2951         public boolean resetMagnification(boolean animate) {
2952             synchronized (mLock) {
2953                 if (!isCalledForCurrentUserLocked()) {
2954                     return false;
2955                 }
2956                 final boolean permissionGranted = mSecurityPolicy.canControlMagnification(this);
2957                 if (!permissionGranted) {
2958                     return false;
2959                 }
2960             }
2961             final long identity = Binder.clearCallingIdentity();
2962             try {
2963                 return getMagnificationController().reset(animate);
2964             } finally {
2965                 Binder.restoreCallingIdentity(identity);
2966             }
2967         }
2968
2969         @Override
2970         public boolean setMagnificationScaleAndCenter(float scale, float centerX, float centerY,
2971                 boolean animate) {
2972             synchronized (mLock) {
2973                 if (!isCalledForCurrentUserLocked()) {
2974                     return false;
2975                 }
2976                 final boolean permissionGranted = mSecurityPolicy.canControlMagnification(this);
2977                 if (!permissionGranted) {
2978                     return false;
2979                 }
2980                 final long identity = Binder.clearCallingIdentity();
2981                 try {
2982                     MagnificationController magnificationController = getMagnificationController();
2983                     if (!magnificationController.isRegisteredLocked()) {
2984                         magnificationController.register();
2985                     }
2986                     return magnificationController
2987                             .setScaleAndCenter(scale, centerX, centerY, animate, mId);
2988                 } finally {
2989                     Binder.restoreCallingIdentity(identity);
2990                 }
2991             }
2992         }
2993
2994         @Override
2995         public void setMagnificationCallbackEnabled(boolean enabled) {
2996             mInvocationHandler.setMagnificationCallbackEnabled(enabled);
2997         }
2998
2999         @Override
3000         public boolean setSoftKeyboardShowMode(int showMode) {
3001             final UserState userState;
3002             synchronized (mLock) {
3003                 if (!isCalledForCurrentUserLocked()) {
3004                     return false;
3005                 }
3006
3007                 userState = getCurrentUserStateLocked();
3008             }
3009
3010             final long identity = Binder.clearCallingIdentity();
3011             try {
3012                 // Keep track of the last service to request a non-default show mode. The show mode
3013                 // should be restored to default should this service be disabled.
3014                 if (showMode == Settings.Secure.SHOW_MODE_AUTO) {
3015                     userState.mServiceChangingSoftKeyboardMode = null;
3016                 } else {
3017                     userState.mServiceChangingSoftKeyboardMode = mComponentName;
3018                 }
3019
3020                 Settings.Secure.putIntForUser(mContext.getContentResolver(),
3021                         Settings.Secure.ACCESSIBILITY_SOFT_KEYBOARD_MODE, showMode,
3022                         userState.mUserId);
3023             } finally {
3024                 Binder.restoreCallingIdentity(identity);
3025             }
3026             return true;
3027         }
3028
3029         @Override
3030         public void setSoftKeyboardCallbackEnabled(boolean enabled) {
3031             mInvocationHandler.setSoftKeyboardCallbackEnabled(enabled);
3032         }
3033
3034         @Override
3035         public void dump(FileDescriptor fd, final PrintWriter pw, String[] args) {
3036             mSecurityPolicy.enforceCallingPermission(Manifest.permission.DUMP, FUNCTION_DUMP);
3037             synchronized (mLock) {
3038                 pw.append("Service[label=" + mAccessibilityServiceInfo.getResolveInfo()
3039                         .loadLabel(mContext.getPackageManager()));
3040                 pw.append(", feedbackType"
3041                         + AccessibilityServiceInfo.feedbackTypeToString(mFeedbackType));
3042                 pw.append(", capabilities=" + mAccessibilityServiceInfo.getCapabilities());
3043                 pw.append(", eventTypes="
3044                         + AccessibilityEvent.eventTypeToString(mEventTypes));
3045                 pw.append(", notificationTimeout=" + mNotificationTimeout);
3046                 pw.append("]");
3047             }
3048         }
3049
3050         @Override
3051         public void onServiceDisconnected(ComponentName componentName) {
3052             /* do nothing - #binderDied takes care */
3053         }
3054
3055         public void onAdded() throws RemoteException {
3056             linkToOwnDeathLocked();
3057             final long identity = Binder.clearCallingIdentity();
3058             try {
3059                 mWindowManagerService.addWindowToken(mOverlayWindowToken,
3060                         WindowManager.LayoutParams.TYPE_ACCESSIBILITY_OVERLAY);
3061             } finally {
3062                 Binder.restoreCallingIdentity(identity);
3063             }
3064         }
3065
3066         public void onRemoved() {
3067             final long identity = Binder.clearCallingIdentity();
3068             try {
3069                 mWindowManagerService.removeWindowToken(mOverlayWindowToken, true);
3070             } finally {
3071                 Binder.restoreCallingIdentity(identity);
3072             }
3073             unlinkToOwnDeathLocked();
3074         }
3075
3076         public void linkToOwnDeathLocked() throws RemoteException {
3077             mService.linkToDeath(this, 0);
3078         }
3079
3080         public void unlinkToOwnDeathLocked() {
3081             mService.unlinkToDeath(this, 0);
3082         }
3083
3084         public void resetLocked() {
3085             try {
3086                 // Clear the proxy in the other process so this
3087                 // IAccessibilityServiceConnection can be garbage collected.
3088                 mServiceInterface.init(null, mId, null);
3089             } catch (RemoteException re) {
3090                 /* ignore */
3091             }
3092             mService = null;
3093             mServiceInterface = null;
3094         }
3095
3096         public boolean isConnectedLocked() {
3097             return (mService != null);
3098         }
3099
3100         public void binderDied() {
3101             synchronized (mLock) {
3102                 // It is possible that this service's package was force stopped during
3103                 // whose handling the death recipient is unlinked and still get a call
3104                 // on binderDied since the call was made before we unlink but was
3105                 // waiting on the lock we held during the force stop handling.
3106                 if (!isConnectedLocked()) {
3107                     return;
3108                 }
3109                 mWasConnectedAndDied = true;
3110                 getKeyEventDispatcher().flush(this);
3111                 UserState userState = getUserStateLocked(mUserId);
3112                 // The death recipient is unregistered in removeServiceLocked
3113                 removeServiceLocked(this, userState);
3114                 resetLocked();
3115                 if (mIsAutomation) {
3116                     // We no longer have an automation service, so restore
3117                     // the state based on values in the settings database.
3118                     userState.mInstalledServices.remove(mAccessibilityServiceInfo);
3119                     userState.mEnabledServices.remove(mComponentName);
3120                     userState.destroyUiAutomationService();
3121                     readConfigurationForUserStateLocked(userState);
3122                 }
3123                 if (mId == getMagnificationController().getIdOfLastServiceToMagnify()) {
3124                     getMagnificationController().resetIfNeeded(true);
3125                 }
3126                 onUserStateChangedLocked(userState);
3127             }
3128         }
3129
3130         /**
3131          * Performs a notification for an {@link AccessibilityEvent}.
3132          *
3133          * @param event The event.
3134          */
3135         public void notifyAccessibilityEvent(AccessibilityEvent event) {
3136             synchronized (mLock) {
3137                 final int eventType = event.getEventType();
3138                 // Make a copy since during dispatch it is possible the event to
3139                 // be modified to remove its source if the receiving service does
3140                 // not have permission to access the window content.
3141                 AccessibilityEvent newEvent = AccessibilityEvent.obtain(event);
3142                 Message message;
3143                 if ((mNotificationTimeout > 0)
3144                         && (eventType != AccessibilityEvent.TYPE_WINDOW_CONTENT_CHANGED)) {
3145                     // Allow at most one pending event
3146                     final AccessibilityEvent oldEvent = mPendingEvents.get(eventType);
3147                     mPendingEvents.put(eventType, newEvent);
3148                     if (oldEvent != null) {
3149                         mEventDispatchHandler.removeMessages(eventType);
3150                         oldEvent.recycle();
3151                     }
3152                     message = mEventDispatchHandler.obtainMessage(eventType);
3153                 } else {
3154                     // Send all messages, bypassing mPendingEvents
3155                     message = mEventDispatchHandler.obtainMessage(eventType, newEvent);
3156                 }
3157
3158                 mEventDispatchHandler.sendMessageDelayed(message, mNotificationTimeout);
3159             }
3160         }
3161
3162         /**
3163          * Notifies an accessibility service client for a scheduled event given the event type.
3164          *
3165          * @param eventType The type of the event to dispatch.
3166          */
3167         private void notifyAccessibilityEventInternal(int eventType, AccessibilityEvent event) {
3168             IAccessibilityServiceClient listener;
3169
3170             synchronized (mLock) {
3171                 listener = mServiceInterface;
3172
3173                 // If the service died/was disabled while the message for dispatching
3174                 // the accessibility event was propagating the listener may be null.
3175                 if (listener == null) {
3176                     return;
3177                 }
3178
3179                 // There are two ways we notify for events, throttled and non-throttled. If we
3180                 // are not throttling, then messages come with events, which we handle with
3181                 // minimal fuss.
3182                 if (event == null) {
3183                     // We are throttling events, so we'll send the event for this type in
3184                     // mPendingEvents as long as it it's null. It can only null due to a race
3185                     // condition:
3186                     //
3187                     //   1) A binder thread calls notifyAccessibilityServiceDelayedLocked
3188                     //      which posts a message for dispatching an event and stores the event
3189                     //      in mPendingEvents.
3190                     //   2) The message is pulled from the queue by the handler on the service
3191                     //      thread and this method is just about to acquire the lock.
3192                     //   3) Another binder thread acquires the lock in notifyAccessibilityEvent
3193                     //   4) notifyAccessibilityEvent recycles the event that this method was about
3194                     //      to process, replaces it with a new one, and posts a second message
3195                     //   5) This method grabs the new event, processes it, and removes it from
3196                     //      mPendingEvents
3197                     //   6) The second message dispatched in (4) arrives, but the event has been
3198                     //      remvoved in (5).
3199                     event = mPendingEvents.get(eventType);
3200                     if (event == null) {
3201                         return;
3202                     }
3203                     mPendingEvents.remove(eventType);
3204                 }
3205                 if (mSecurityPolicy.canRetrieveWindowContentLocked(this)) {
3206                     event.setConnectionId(mId);
3207                 } else {
3208                     event.setSource(null);
3209                 }
3210                 event.setSealed(true);
3211             }
3212
3213             try {
3214                 listener.onAccessibilityEvent(event);
3215                 if (DEBUG) {
3216                     Slog.i(LOG_TAG, "Event " + event + " sent to " + listener);
3217                 }
3218             } catch (RemoteException re) {
3219                 Slog.e(LOG_TAG, "Error during sending " + event + " to " + listener, re);
3220             } finally {
3221                 event.recycle();
3222             }
3223         }
3224
3225         public void notifyGesture(int gestureId) {
3226             mInvocationHandler.obtainMessage(InvocationHandler.MSG_ON_GESTURE,
3227                     gestureId, 0).sendToTarget();
3228         }
3229
3230         public void notifyClearAccessibilityNodeInfoCache() {
3231             mInvocationHandler.sendEmptyMessage(
3232                     InvocationHandler.MSG_CLEAR_ACCESSIBILITY_CACHE);
3233         }
3234
3235         public void notifyMagnificationChangedLocked(@NonNull Region region,
3236                 float scale, float centerX, float centerY) {
3237             mInvocationHandler
3238                     .notifyMagnificationChangedLocked(region, scale, centerX, centerY);
3239         }
3240
3241         public void notifySoftKeyboardShowModeChangedLocked(int showState) {
3242             mInvocationHandler.notifySoftKeyboardShowModeChangedLocked(showState);
3243         }
3244
3245         /**
3246          * Called by the invocation handler to notify the service that the
3247          * state of magnification has changed.
3248          */
3249         private void notifyMagnificationChangedInternal(@NonNull Region region,
3250                 float scale, float centerX, float centerY) {
3251             final IAccessibilityServiceClient listener;
3252             synchronized (mLock) {
3253                 listener = mServiceInterface;
3254             }
3255             if (listener != null) {
3256                 try {
3257                     listener.onMagnificationChanged(region, scale, centerX, centerY);
3258                 } catch (RemoteException re) {
3259                     Slog.e(LOG_TAG, "Error sending magnification changes to " + mService, re);
3260                 }
3261             }
3262         }
3263
3264         /**
3265          * Called by the invocation handler to notify the service that the state of the soft
3266          * keyboard show mode has changed.
3267          */
3268         private void notifySoftKeyboardShowModeChangedInternal(int showState) {
3269             final IAccessibilityServiceClient listener;
3270             synchronized (mLock) {
3271                 listener = mServiceInterface;
3272             }
3273             if (listener != null) {
3274                 try {
3275                     listener.onSoftKeyboardShowModeChanged(showState);
3276                 } catch (RemoteException re) {
3277                     Slog.e(LOG_TAG, "Error sending soft keyboard show mode changes to " + mService,
3278                             re);
3279                 }
3280             }
3281         }
3282
3283         private void notifyGestureInternal(int gestureId) {
3284             final IAccessibilityServiceClient listener;
3285             synchronized (mLock) {
3286                 listener = mServiceInterface;
3287             }
3288             if (listener != null) {
3289                 try {
3290                     listener.onGesture(gestureId);
3291                 } catch (RemoteException re) {
3292                     Slog.e(LOG_TAG, "Error during sending gesture " + gestureId
3293                             + " to " + mService, re);
3294                 }
3295             }
3296         }
3297
3298         private void notifyClearAccessibilityCacheInternal() {
3299             final IAccessibilityServiceClient listener;
3300             synchronized (mLock) {
3301                 listener = mServiceInterface;
3302             }
3303             if (listener != null) {
3304                 try {
3305                     listener.clearAccessibilityCache();
3306                 } catch (RemoteException re) {
3307                     Slog.e(LOG_TAG, "Error during requesting accessibility info cache"
3308                             + " to be cleared.", re);
3309                 }
3310             }
3311         }
3312
3313         private void sendDownAndUpKeyEvents(int keyCode) {
3314             final long token = Binder.clearCallingIdentity();
3315
3316             // Inject down.
3317             final long downTime = SystemClock.uptimeMillis();
3318             KeyEvent down = KeyEvent.obtain(downTime, downTime, KeyEvent.ACTION_DOWN, keyCode, 0, 0,
3319                     KeyCharacterMap.VIRTUAL_KEYBOARD, 0, KeyEvent.FLAG_FROM_SYSTEM,
3320                     InputDevice.SOURCE_KEYBOARD, null);
3321             InputManager.getInstance().injectInputEvent(down,
3322                     InputManager.INJECT_INPUT_EVENT_MODE_ASYNC);
3323             down.recycle();
3324
3325             // Inject up.
3326             final long upTime = SystemClock.uptimeMillis();
3327             KeyEvent up = KeyEvent.obtain(downTime, upTime, KeyEvent.ACTION_UP, keyCode, 0, 0,
3328                     KeyCharacterMap.VIRTUAL_KEYBOARD, 0, KeyEvent.FLAG_FROM_SYSTEM,
3329                     InputDevice.SOURCE_KEYBOARD, null);
3330             InputManager.getInstance().injectInputEvent(up,
3331                     InputManager.INJECT_INPUT_EVENT_MODE_ASYNC);
3332             up.recycle();
3333
3334             Binder.restoreCallingIdentity(token);
3335         }
3336
3337         private void expandNotifications() {
3338             final long token = Binder.clearCallingIdentity();
3339
3340             StatusBarManager statusBarManager = (StatusBarManager) mContext.getSystemService(
3341                     android.app.Service.STATUS_BAR_SERVICE);
3342             statusBarManager.expandNotificationsPanel();
3343
3344             Binder.restoreCallingIdentity(token);
3345         }
3346
3347         private void expandQuickSettings() {
3348             final long token = Binder.clearCallingIdentity();
3349
3350             StatusBarManager statusBarManager = (StatusBarManager) mContext.getSystemService(
3351                     android.app.Service.STATUS_BAR_SERVICE);
3352             statusBarManager.expandSettingsPanel();
3353
3354             Binder.restoreCallingIdentity(token);
3355         }
3356
3357         private void openRecents() {
3358             final long token = Binder.clearCallingIdentity();
3359
3360             StatusBarManagerInternal statusBarService = LocalServices.getService(
3361                     StatusBarManagerInternal.class);
3362             statusBarService.toggleRecentApps();
3363
3364             Binder.restoreCallingIdentity(token);
3365         }
3366
3367         private void showGlobalActions() {
3368             mWindowManagerService.showGlobalActions();
3369         }
3370
3371         private void toggleSplitScreen() {
3372             LocalServices.getService(StatusBarManagerInternal.class).toggleSplitScreen();
3373         }
3374
3375         private IAccessibilityInteractionConnection getConnectionLocked(int windowId) {
3376             if (DEBUG) {
3377                 Slog.i(LOG_TAG, "Trying to get interaction connection to windowId: " + windowId);
3378             }
3379             AccessibilityConnectionWrapper wrapper = mGlobalInteractionConnections.get(windowId);
3380             if (wrapper == null) {
3381                 wrapper = getCurrentUserStateLocked().mInteractionConnections.get(windowId);
3382             }
3383             if (wrapper != null && wrapper.mConnection != null) {
3384                 return wrapper.mConnection;
3385             }
3386             if (DEBUG) {
3387                 Slog.e(LOG_TAG, "No interaction connection to window: " + windowId);
3388             }
3389             return null;
3390         }
3391
3392         private int resolveAccessibilityWindowIdLocked(int accessibilityWindowId) {
3393             if (accessibilityWindowId == AccessibilityNodeInfo.ACTIVE_WINDOW_ID) {
3394                 return mSecurityPolicy.getActiveWindowId();
3395             }
3396             return accessibilityWindowId;
3397         }
3398
3399         private int resolveAccessibilityWindowIdForFindFocusLocked(int windowId, int focusType) {
3400             if (windowId == AccessibilityNodeInfo.ACTIVE_WINDOW_ID) {
3401                 return mSecurityPolicy.mActiveWindowId;
3402             }
3403             if (windowId == AccessibilityNodeInfo.ANY_WINDOW_ID) {
3404                 if (focusType == AccessibilityNodeInfo.FOCUS_INPUT) {
3405                     return mSecurityPolicy.mFocusedWindowId;
3406                 } else if (focusType == AccessibilityNodeInfo.FOCUS_ACCESSIBILITY) {
3407                     return mSecurityPolicy.mAccessibilityFocusedWindowId;
3408                 }
3409             }
3410             return windowId;
3411         }
3412
3413         private final class InvocationHandler extends Handler {
3414             public static final int MSG_ON_GESTURE = 1;
3415             public static final int MSG_CLEAR_ACCESSIBILITY_CACHE = 2;
3416
3417             private static final int MSG_ON_MAGNIFICATION_CHANGED = 5;
3418             private static final int MSG_ON_SOFT_KEYBOARD_STATE_CHANGED = 6;
3419
3420             private boolean mIsMagnificationCallbackEnabled = false;
3421             private boolean mIsSoftKeyboardCallbackEnabled = false;
3422
3423             public InvocationHandler(Looper looper) {
3424                 super(looper, null, true);
3425             }
3426
3427             @Override
3428             public void handleMessage(Message message) {
3429                 final int type = message.what;
3430                 switch (type) {
3431                     case MSG_ON_GESTURE: {
3432                         final int gestureId = message.arg1;
3433                         notifyGestureInternal(gestureId);
3434                     } break;
3435
3436                     case MSG_CLEAR_ACCESSIBILITY_CACHE: {
3437                         notifyClearAccessibilityCacheInternal();
3438                     } break;
3439
3440                     case MSG_ON_MAGNIFICATION_CHANGED: {
3441                         final SomeArgs args = (SomeArgs) message.obj;
3442                         final Region region = (Region) args.arg1;
3443                         final float scale = (float) args.arg2;
3444                         final float centerX = (float) args.arg3;
3445                         final float centerY = (float) args.arg4;
3446                         notifyMagnificationChangedInternal(region, scale, centerX, centerY);
3447                     } break;
3448
3449                     case MSG_ON_SOFT_KEYBOARD_STATE_CHANGED: {
3450                         final int showState = (int) message.arg1;
3451                         notifySoftKeyboardShowModeChangedInternal(showState);
3452                     } break;
3453
3454                     default: {
3455                         throw new IllegalArgumentException("Unknown message: " + type);
3456                     }
3457                 }
3458             }
3459
3460             public void notifyMagnificationChangedLocked(@NonNull Region region, float scale,
3461                     float centerX, float centerY) {
3462                 if (!mIsMagnificationCallbackEnabled) {
3463                     // Callback is disabled, don't bother packing args.
3464                     return;
3465                 }
3466
3467                 final SomeArgs args = SomeArgs.obtain();
3468                 args.arg1 = region;
3469                 args.arg2 = scale;
3470                 args.arg3 = centerX;
3471                 args.arg4 = centerY;
3472
3473                 final Message msg = obtainMessage(MSG_ON_MAGNIFICATION_CHANGED, args);
3474                 msg.sendToTarget();
3475             }
3476
3477             public void setMagnificationCallbackEnabled(boolean enabled) {
3478                 mIsMagnificationCallbackEnabled = enabled;
3479             }
3480
3481             public void notifySoftKeyboardShowModeChangedLocked(int showState) {
3482                 if (!mIsSoftKeyboardCallbackEnabled) {
3483                     return;
3484                 }
3485
3486                 final Message msg = obtainMessage(MSG_ON_SOFT_KEYBOARD_STATE_CHANGED, showState, 0);
3487                 msg.sendToTarget();
3488             }
3489
3490             public void setSoftKeyboardCallbackEnabled(boolean enabled) {
3491                 mIsSoftKeyboardCallbackEnabled = enabled;
3492             }
3493         }
3494     }
3495
3496     final class WindowsForAccessibilityCallback implements
3497             WindowManagerInternal.WindowsForAccessibilityCallback {
3498
3499         @Override
3500         public void onWindowsForAccessibilityChanged(List<WindowInfo> windows) {
3501             synchronized (mLock) {
3502                 // Populate the windows to report.
3503                 List<AccessibilityWindowInfo> reportedWindows = new ArrayList<>();
3504                 final int receivedWindowCount = windows.size();
3505                 for (int i = 0; i < receivedWindowCount; i++) {
3506                     WindowInfo receivedWindow = windows.get(i);
3507                     AccessibilityWindowInfo reportedWindow = populateReportedWindow(
3508                             receivedWindow);
3509                     if (reportedWindow != null) {
3510                         reportedWindows.add(reportedWindow);
3511                     }
3512                 }
3513
3514                 if (DEBUG) {
3515                     Slog.i(LOG_TAG, "Windows changed: " + reportedWindows);
3516                 }
3517
3518                 // Let the policy update the focused and active windows.
3519                 mSecurityPolicy.updateWindowsLocked(reportedWindows);
3520
3521                 // Someone may be waiting for the windows - advertise it.
3522                 mLock.notifyAll();
3523             }
3524         }
3525
3526         private AccessibilityWindowInfo populateReportedWindow(WindowInfo window) {
3527             final int windowId = findWindowIdLocked(window.token);
3528             if (windowId < 0) {
3529                 return null;
3530             }
3531
3532             AccessibilityWindowInfo reportedWindow = AccessibilityWindowInfo.obtain();
3533
3534             reportedWindow.setId(windowId);
3535             reportedWindow.setType(getTypeForWindowManagerWindowType(window.type));
3536             reportedWindow.setLayer(window.layer);
3537             reportedWindow.setFocused(window.focused);
3538             reportedWindow.setBoundsInScreen(window.boundsInScreen);
3539             reportedWindow.setTitle(window.title);
3540             reportedWindow.setAnchorId(window.accessibilityIdOfAnchor);
3541
3542             final int parentId = findWindowIdLocked(window.parentToken);
3543             if (parentId >= 0) {
3544                 reportedWindow.setParentId(parentId);
3545             }
3546
3547             if (window.childTokens != null) {
3548                 final int childCount = window.childTokens.size();
3549                 for (int i = 0; i < childCount; i++) {
3550                     IBinder childToken = window.childTokens.get(i);
3551                     final int childId = findWindowIdLocked(childToken);
3552                     if (childId >= 0) {
3553                         reportedWindow.addChild(childId);
3554                     }
3555                 }
3556             }
3557
3558             return reportedWindow;
3559         }
3560
3561         private int getTypeForWindowManagerWindowType(int windowType) {
3562             switch (windowType) {
3563                 case WindowManager.LayoutParams.TYPE_APPLICATION:
3564                 case WindowManager.LayoutParams.TYPE_APPLICATION_MEDIA:
3565                 case WindowManager.LayoutParams.TYPE_APPLICATION_PANEL:
3566                 case WindowManager.LayoutParams.TYPE_APPLICATION_STARTING:
3567                 case WindowManager.LayoutParams.TYPE_APPLICATION_SUB_PANEL:
3568                 case WindowManager.LayoutParams.TYPE_APPLICATION_ABOVE_SUB_PANEL:
3569                 case WindowManager.LayoutParams.TYPE_BASE_APPLICATION:
3570                 case WindowManager.LayoutParams.TYPE_PHONE:
3571                 case WindowManager.LayoutParams.TYPE_PRIORITY_PHONE:
3572                 case WindowManager.LayoutParams.TYPE_TOAST:
3573                 case WindowManager.LayoutParams.TYPE_APPLICATION_ATTACHED_DIALOG: {
3574                     return AccessibilityWindowInfo.TYPE_APPLICATION;
3575                 }
3576
3577                 case WindowManager.LayoutParams.TYPE_INPUT_METHOD:
3578                 case WindowManager.LayoutParams.TYPE_INPUT_METHOD_DIALOG: {
3579                     return AccessibilityWindowInfo.TYPE_INPUT_METHOD;
3580                 }
3581
3582                 case WindowManager.LayoutParams.TYPE_KEYGUARD_DIALOG:
3583                 case WindowManager.LayoutParams.TYPE_NAVIGATION_BAR:
3584                 case WindowManager.LayoutParams.TYPE_NAVIGATION_BAR_PANEL:
3585                 case WindowManager.LayoutParams.TYPE_SEARCH_BAR:
3586                 case WindowManager.LayoutParams.TYPE_STATUS_BAR:
3587                 case WindowManager.LayoutParams.TYPE_STATUS_BAR_PANEL:
3588                 case WindowManager.LayoutParams.TYPE_STATUS_BAR_SUB_PANEL:
3589                 case WindowManager.LayoutParams.TYPE_VOLUME_OVERLAY:
3590                 case WindowManager.LayoutParams.TYPE_SYSTEM_ALERT:
3591                 case WindowManager.LayoutParams.TYPE_SYSTEM_DIALOG:
3592                 case WindowManager.LayoutParams.TYPE_SYSTEM_ERROR:
3593                 case WindowManager.LayoutParams.TYPE_SYSTEM_OVERLAY:
3594                 case WindowManager.LayoutParams.TYPE_SCREENSHOT: {
3595                     return AccessibilityWindowInfo.TYPE_SYSTEM;
3596                 }
3597
3598                 case WindowManager.LayoutParams.TYPE_DOCK_DIVIDER: {
3599                     return AccessibilityWindowInfo.TYPE_SPLIT_SCREEN_DIVIDER;
3600                 }
3601
3602                 case WindowManager.LayoutParams.TYPE_ACCESSIBILITY_OVERLAY: {
3603                     return AccessibilityWindowInfo.TYPE_ACCESSIBILITY_OVERLAY;
3604                 }
3605
3606                 default: {
3607                     return -1;
3608                 }
3609             }
3610         }
3611     }
3612
3613     private final class InteractionBridge {
3614         private final Display mDefaultDisplay;
3615         private final int mConnectionId;
3616         private final AccessibilityInteractionClient mClient;
3617
3618         public InteractionBridge() {
3619             AccessibilityServiceInfo info = new AccessibilityServiceInfo();
3620             info.setCapabilities(AccessibilityServiceInfo.CAPABILITY_CAN_RETRIEVE_WINDOW_CONTENT);
3621             info.flags |= AccessibilityServiceInfo.FLAG_RETRIEVE_INTERACTIVE_WINDOWS;
3622             info.flags |= AccessibilityServiceInfo.FLAG_INCLUDE_NOT_IMPORTANT_VIEWS;
3623             Service service = new Service(UserHandle.USER_NULL,
3624                     sFakeAccessibilityServiceComponentName, info);
3625
3626             mConnectionId = service.mId;
3627
3628             mClient = AccessibilityInteractionClient.getInstance();
3629             mClient.addConnection(mConnectionId, service);
3630
3631             //TODO: (multi-display) We need to support multiple displays.
3632             DisplayManager displayManager = (DisplayManager)
3633                     mContext.getSystemService(Context.DISPLAY_SERVICE);
3634             mDefaultDisplay = displayManager.getDisplay(Display.DEFAULT_DISPLAY);
3635         }
3636
3637         public void clearAccessibilityFocusNotLocked(int windowId) {
3638             AccessibilityNodeInfo focus = getAccessibilityFocusNotLocked(windowId);
3639             if (focus != null) {
3640                 focus.performAction(AccessibilityNodeInfo.ACTION_CLEAR_ACCESSIBILITY_FOCUS);
3641             }
3642         }
3643
3644         public boolean getAccessibilityFocusClickPointInScreenNotLocked(Point outPoint) {
3645             AccessibilityNodeInfo focus = getAccessibilityFocusNotLocked();
3646             if (focus == null) {
3647                 return false;
3648             }
3649
3650             synchronized (mLock) {
3651                 Rect boundsInScreen = mTempRect;
3652                 focus.getBoundsInScreen(boundsInScreen);
3653
3654                 // Clip to the window bounds.
3655                 Rect windowBounds = mTempRect1;
3656                 getWindowBounds(focus.getWindowId(), windowBounds);
3657                 if (!boundsInScreen.intersect(windowBounds)) {
3658                     return false;
3659                 }
3660
3661                 // Apply magnification if needed.
3662                 MagnificationSpec spec = getCompatibleMagnificationSpecLocked(focus.getWindowId());
3663                 if (spec != null && !spec.isNop()) {
3664                     boundsInScreen.offset((int) -spec.offsetX, (int) -spec.offsetY);
3665                     boundsInScreen.scale(1 / spec.scale);
3666                 }
3667
3668                 // Clip to the screen bounds.
3669                 Point screenSize = mTempPoint;
3670                 mDefaultDisplay.getRealSize(screenSize);
3671                 if (!boundsInScreen.intersect(0, 0, screenSize.x, screenSize.y)) {
3672                     return false;
3673                 }
3674
3675                 outPoint.set(boundsInScreen.centerX(), boundsInScreen.centerY());
3676             }
3677
3678             return true;
3679         }
3680
3681         private AccessibilityNodeInfo getAccessibilityFocusNotLocked() {
3682             final int focusedWindowId;
3683             synchronized (mLock) {
3684                 focusedWindowId = mSecurityPolicy.mAccessibilityFocusedWindowId;
3685                 if (focusedWindowId == SecurityPolicy.INVALID_WINDOW_ID) {
3686                     return null;
3687                 }
3688             }
3689             return getAccessibilityFocusNotLocked(focusedWindowId);
3690         }
3691
3692         private AccessibilityNodeInfo getAccessibilityFocusNotLocked(int windowId) {
3693             return mClient.findFocus(mConnectionId,
3694                     windowId, AccessibilityNodeInfo.ROOT_NODE_ID,
3695                     AccessibilityNodeInfo.FOCUS_ACCESSIBILITY);
3696         }
3697     }
3698
3699     final class SecurityPolicy {
3700         public static final int INVALID_WINDOW_ID = -1;
3701
3702         private static final int RETRIEVAL_ALLOWING_EVENT_TYPES =
3703             AccessibilityEvent.TYPE_VIEW_CLICKED
3704             | AccessibilityEvent.TYPE_VIEW_FOCUSED
3705             | AccessibilityEvent.TYPE_VIEW_HOVER_ENTER
3706             | AccessibilityEvent.TYPE_VIEW_HOVER_EXIT
3707             | AccessibilityEvent.TYPE_VIEW_LONG_CLICKED
3708             | AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED
3709             | AccessibilityEvent.TYPE_WINDOW_STATE_CHANGED
3710             | AccessibilityEvent.TYPE_VIEW_SELECTED
3711             | AccessibilityEvent.TYPE_WINDOW_CONTENT_CHANGED
3712             | AccessibilityEvent.TYPE_VIEW_TEXT_SELECTION_CHANGED
3713             | AccessibilityEvent.TYPE_VIEW_SCROLLED
3714             | AccessibilityEvent.TYPE_VIEW_ACCESSIBILITY_FOCUSED
3715             | AccessibilityEvent.TYPE_VIEW_ACCESSIBILITY_FOCUS_CLEARED
3716             | AccessibilityEvent.TYPE_VIEW_TEXT_TRAVERSED_AT_MOVEMENT_GRANULARITY;
3717
3718         public List<AccessibilityWindowInfo> mWindows;
3719
3720         public int mActiveWindowId = INVALID_WINDOW_ID;
3721         public int mFocusedWindowId = INVALID_WINDOW_ID;
3722         public int mAccessibilityFocusedWindowId = INVALID_WINDOW_ID;
3723         public long mAccessibilityFocusNodeId = AccessibilityNodeInfo.UNDEFINED_ITEM_ID;
3724
3725         private boolean mTouchInteractionInProgress;
3726
3727         private boolean canDispatchAccessibilityEventLocked(AccessibilityEvent event) {
3728             final int eventType = event.getEventType();
3729             switch (eventType) {
3730                 // All events that are for changes in a global window
3731                 // state should *always* be dispatched.
3732                 case AccessibilityEvent.TYPE_WINDOW_STATE_CHANGED:
3733                 case AccessibilityEvent.TYPE_NOTIFICATION_STATE_CHANGED:
3734                 case AccessibilityEvent.TYPE_ANNOUNCEMENT:
3735                 // All events generated by the user touching the
3736                 // screen should *always* be dispatched.
3737                 case AccessibilityEvent.TYPE_TOUCH_EXPLORATION_GESTURE_START:
3738                 case AccessibilityEvent.TYPE_TOUCH_EXPLORATION_GESTURE_END:
3739                 case AccessibilityEvent.TYPE_GESTURE_DETECTION_START:
3740                 case AccessibilityEvent.TYPE_GESTURE_DETECTION_END:
3741                 case AccessibilityEvent.TYPE_TOUCH_INTERACTION_START:
3742                 case AccessibilityEvent.TYPE_TOUCH_INTERACTION_END:
3743                 case AccessibilityEvent.TYPE_VIEW_HOVER_ENTER:
3744                 case AccessibilityEvent.TYPE_VIEW_HOVER_EXIT:
3745                 // Also always dispatch the event that assist is reading context.
3746                 case AccessibilityEvent.TYPE_ASSIST_READING_CONTEXT:
3747                 // Also windows changing should always be anounced.
3748                 case AccessibilityEvent.TYPE_WINDOWS_CHANGED: {
3749                     return true;
3750                 }
3751                 // All events for changes in window content should be
3752                 // dispatched *only* if this window is one of the windows
3753                 // the accessibility layer reports which are windows
3754                 // that a sighted user can touch.
3755                 default: {
3756                     return isRetrievalAllowingWindow(event.getWindowId());
3757                 }
3758             }
3759         }
3760
3761         public void clearWindowsLocked() {
3762             List<AccessibilityWindowInfo> windows = Collections.emptyList();
3763             final int activeWindowId = mActiveWindowId;
3764             updateWindowsLocked(windows);
3765             mActiveWindowId = activeWindowId;
3766             mWindows = null;
3767         }
3768
3769         public void updateWindowsLocked(List<AccessibilityWindowInfo> windows) {
3770             if (mWindows == null) {
3771                 mWindows = new ArrayList<>();
3772             }
3773
3774             final int oldWindowCount = mWindows.size();
3775             for (int i = oldWindowCount - 1; i >= 0; i--) {
3776                 mWindows.remove(i).recycle();
3777             }
3778
3779             mFocusedWindowId = INVALID_WINDOW_ID;
3780             if (!mTouchInteractionInProgress) {
3781                 mActiveWindowId = INVALID_WINDOW_ID;
3782             }
3783
3784             // If the active window goes away while the user is touch exploring we
3785             // reset the active window id and wait for the next hover event from
3786             // under the user's finger to determine which one is the new one. It
3787             // is possible that the finger is not moving and the input system
3788             // filters out such events.
3789             boolean activeWindowGone = true;
3790
3791             final int windowCount = windows.size();
3792             if (windowCount > 0) {
3793                 for (int i = 0; i < windowCount; i++) {
3794                     AccessibilityWindowInfo window = windows.get(i);
3795                     final int windowId = window.getId();
3796                     if (window.isFocused()) {
3797                         mFocusedWindowId = windowId;
3798                         if (!mTouchInteractionInProgress) {
3799                             mActiveWindowId = windowId;
3800                             window.setActive(true);
3801                         } else if (windowId == mActiveWindowId) {
3802                             activeWindowGone = false;
3803                         }
3804                     }
3805                     mWindows.add(window);
3806                 }
3807
3808                 if (mTouchInteractionInProgress && activeWindowGone) {
3809                     mActiveWindowId = mFocusedWindowId;
3810                 }
3811
3812                 // Focused window may change the active one, so set the
3813                 // active window once we decided which it is.
3814                 for (int i = 0; i < windowCount; i++) {
3815                     AccessibilityWindowInfo window = mWindows.get(i);
3816                     if (window.getId() == mActiveWindowId) {
3817                         window.setActive(true);
3818                     }
3819                     if (window.getId() == mAccessibilityFocusedWindowId) {
3820                         window.setAccessibilityFocused(true);
3821                     }
3822                 }
3823             }
3824
3825             notifyWindowsChanged();
3826         }
3827
3828         public boolean computePartialInteractiveRegionForWindowLocked(int windowId,
3829                 Region outRegion) {
3830             if (mWindows == null) {
3831                 return false;
3832             }
3833
3834             // Windows are ordered in z order so start from the bottom and find
3835             // the window of interest. After that all windows that cover it should
3836             // be subtracted from the resulting region. Note that for accessibility
3837             // we are returning only interactive windows.
3838             Region windowInteractiveRegion = null;
3839             boolean windowInteractiveRegionChanged = false;
3840
3841             final int windowCount = mWindows.size();
3842             for (int i = windowCount - 1; i >= 0; i--) {
3843                 AccessibilityWindowInfo currentWindow = mWindows.get(i);
3844                 if (windowInteractiveRegion == null) {
3845                     if (currentWindow.getId() == windowId) {
3846                         Rect currentWindowBounds = mTempRect;
3847                         currentWindow.getBoundsInScreen(currentWindowBounds);
3848                         outRegion.set(currentWindowBounds);
3849                         windowInteractiveRegion = outRegion;
3850                         continue;
3851                     }
3852                 } else if (currentWindow.getType()
3853                         != AccessibilityWindowInfo.TYPE_ACCESSIBILITY_OVERLAY) {
3854                     Rect currentWindowBounds = mTempRect;
3855                     currentWindow.getBoundsInScreen(currentWindowBounds);
3856                     if (windowInteractiveRegion.op(currentWindowBounds, Region.Op.DIFFERENCE)) {
3857                         windowInteractiveRegionChanged = true;
3858                     }
3859                 }
3860             }
3861
3862             return windowInteractiveRegionChanged;
3863         }
3864
3865         public void updateEventSourceLocked(AccessibilityEvent event) {
3866             if ((event.getEventType() & RETRIEVAL_ALLOWING_EVENT_TYPES) == 0) {
3867                 event.setSource(null);
3868             }
3869         }
3870
3871         public void updateActiveAndAccessibilityFocusedWindowLocked(int windowId, long nodeId,
3872                 int eventType, int eventAction) {
3873             // The active window is either the window that has input focus or
3874             // the window that the user is currently touching. If the user is
3875             // touching a window that does not have input focus as soon as the
3876             // the user stops touching that window the focused window becomes
3877             // the active one. Here we detect the touched window and make it
3878             // active. In updateWindowsLocked() we update the focused window
3879             // and if the user is not touching the screen, we make the focused
3880             // window the active one.
3881             switch (eventType) {
3882                 case AccessibilityEvent.TYPE_WINDOW_STATE_CHANGED: {
3883                     // If no service has the capability to introspect screen,
3884                     // we do not register callback in the window manager for
3885                     // window changes, so we have to ask the window manager
3886                     // what the focused window is to update the active one.
3887                     // The active window also determined events from which
3888                     // windows are delivered.
3889                     synchronized (mLock) {
3890                         if (mWindowsForAccessibilityCallback == null) {
3891                             mFocusedWindowId = getFocusedWindowId();
3892                             if (windowId == mFocusedWindowId) {
3893                                 mActiveWindowId = windowId;
3894                             }
3895                         }
3896                     }
3897                 } break;
3898
3899                 case AccessibilityEvent.TYPE_VIEW_HOVER_ENTER: {
3900                     // Do not allow delayed hover events to confuse us
3901                     // which the active window is.
3902                     synchronized (mLock) {
3903                         if (mTouchInteractionInProgress && mActiveWindowId != windowId) {
3904                             setActiveWindowLocked(windowId);
3905                         }
3906                     }
3907                 } break;
3908
3909                 case AccessibilityEvent.TYPE_VIEW_ACCESSIBILITY_FOCUSED: {
3910                     synchronized (mLock) {
3911                         if (mAccessibilityFocusedWindowId != windowId) {
3912                             mMainHandler.obtainMessage(MainHandler.MSG_CLEAR_ACCESSIBILITY_FOCUS,
3913                                     mAccessibilityFocusedWindowId, 0).sendToTarget();
3914                             mSecurityPolicy.setAccessibilityFocusedWindowLocked(windowId);
3915                             mAccessibilityFocusNodeId = nodeId;
3916                         }
3917                     }
3918                 } break;
3919
3920                 case AccessibilityEvent.TYPE_VIEW_ACCESSIBILITY_FOCUS_CLEARED: {
3921                     synchronized (mLock) {
3922                         if (mAccessibilityFocusNodeId == nodeId) {
3923                             mAccessibilityFocusNodeId = AccessibilityNodeInfo.UNDEFINED_ITEM_ID;
3924                         }
3925                         // Clear the window with focus if it no longer has focus and we aren't
3926                         // just moving focus from one view to the other in the same window
3927                         if ((mAccessibilityFocusNodeId == AccessibilityNodeInfo.UNDEFINED_ITEM_ID)
3928                                 && (mAccessibilityFocusedWindowId == windowId)
3929                                 && (eventAction != AccessibilityNodeInfo.ACTION_ACCESSIBILITY_FOCUS)
3930                                 ) {
3931                             mAccessibilityFocusedWindowId = INVALID_WINDOW_ID;
3932                         }
3933                     }
3934                 } break;
3935             }
3936         }
3937
3938         public void onTouchInteractionStart() {
3939             synchronized (mLock) {
3940                 mTouchInteractionInProgress = true;
3941             }
3942         }
3943
3944         public void onTouchInteractionEnd() {
3945             synchronized (mLock) {
3946                 mTouchInteractionInProgress = false;
3947                 // We want to set the active window to be current immediately
3948                 // after the user has stopped touching the screen since if the
3949                 // user types with the IME he should get a feedback for the
3950                 // letter typed in the text view which is in the input focused
3951                 // window. Note that we always deliver hover accessibility events
3952                 // (they are a result of user touching the screen) so change of
3953                 // the active window before all hover accessibility events from
3954                 // the touched window are delivered is fine.
3955                 final int oldActiveWindow = mSecurityPolicy.mActiveWindowId;
3956                 setActiveWindowLocked(mFocusedWindowId);
3957
3958                 // If there is no service that can operate with active windows
3959                 // we keep accessibility focus behavior to constrain it only in
3960                 // the active window. Look at updateAccessibilityFocusBehaviorLocked
3961                 // for details.
3962                 if (oldActiveWindow != mSecurityPolicy.mActiveWindowId
3963                         && mAccessibilityFocusedWindowId == oldActiveWindow
3964                         && getCurrentUserStateLocked().mAccessibilityFocusOnlyInActiveWindow) {
3965                     mMainHandler.obtainMessage(MainHandler.MSG_CLEAR_ACCESSIBILITY_FOCUS,
3966                             oldActiveWindow, 0).sendToTarget();
3967                 }
3968             }
3969         }
3970
3971         public int getActiveWindowId() {
3972             if (mActiveWindowId == INVALID_WINDOW_ID && !mTouchInteractionInProgress) {
3973                 mActiveWindowId = getFocusedWindowId();
3974             }
3975             return mActiveWindowId;
3976         }
3977
3978         private void setActiveWindowLocked(int windowId) {
3979             if (mActiveWindowId != windowId) {
3980                 mActiveWindowId = windowId;
3981                 if (mWindows != null) {
3982                     final int windowCount = mWindows.size();
3983                     for (int i = 0; i < windowCount; i++) {
3984                         AccessibilityWindowInfo window = mWindows.get(i);
3985                         window.setActive(window.getId() == windowId);
3986                     }
3987                 }
3988                 notifyWindowsChanged();
3989             }
3990         }
3991
3992         private void setAccessibilityFocusedWindowLocked(int windowId) {
3993             if (mAccessibilityFocusedWindowId != windowId) {
3994                 mAccessibilityFocusedWindowId = windowId;
3995                 if (mWindows != null) {
3996                     final int windowCount = mWindows.size();
3997                     for (int i = 0; i < windowCount; i++) {
3998                         AccessibilityWindowInfo window = mWindows.get(i);
3999                         window.setAccessibilityFocused(window.getId() == windowId);
4000                     }
4001                 }
4002
4003                 notifyWindowsChanged();
4004             }
4005         }
4006
4007         private void notifyWindowsChanged() {
4008             if (mWindowsForAccessibilityCallback == null) {
4009                 return;
4010             }
4011             final long identity = Binder.clearCallingIdentity();
4012             try {
4013                 // Let the client know the windows changed.
4014                 AccessibilityEvent event = AccessibilityEvent.obtain(
4015                         AccessibilityEvent.TYPE_WINDOWS_CHANGED);
4016                 event.setEventTime(SystemClock.uptimeMillis());
4017                 sendAccessibilityEvent(event, mCurrentUserId);
4018             } finally {
4019                 Binder.restoreCallingIdentity(identity);
4020             }
4021         }
4022
4023         public boolean canGetAccessibilityNodeInfoLocked(Service service, int windowId) {
4024             return canRetrieveWindowContentLocked(service) && isRetrievalAllowingWindow(windowId);
4025         }
4026
4027         public boolean canRetrieveWindowsLocked(Service service) {
4028             return canRetrieveWindowContentLocked(service) && service.mRetrieveInteractiveWindows;
4029         }
4030
4031         public boolean canRetrieveWindowContentLocked(Service service) {
4032             return (service.mAccessibilityServiceInfo.getCapabilities()
4033                     & AccessibilityServiceInfo.CAPABILITY_CAN_RETRIEVE_WINDOW_CONTENT) != 0;
4034         }
4035
4036         public boolean canControlMagnification(Service service) {
4037             return (service.mAccessibilityServiceInfo.getCapabilities()
4038                     & AccessibilityServiceInfo.CAPABILITY_CAN_CONTROL_MAGNIFICATION) != 0;
4039         }
4040
4041         public boolean canPerformGestures(Service service) {
4042             return (service.mAccessibilityServiceInfo.getCapabilities()
4043                     & AccessibilityServiceInfo.CAPABILITY_CAN_PERFORM_GESTURES) != 0;
4044         }
4045
4046         private int resolveProfileParentLocked(int userId) {
4047             if (userId != mCurrentUserId) {
4048                 final long identity = Binder.clearCallingIdentity();
4049                 try {
4050                     UserInfo parent = mUserManager.getProfileParent(userId);
4051                     if (parent != null) {
4052                         return parent.getUserHandle().getIdentifier();
4053                     }
4054                 } finally {
4055                     Binder.restoreCallingIdentity(identity);
4056                 }
4057             }
4058             return userId;
4059         }
4060
4061         public int resolveCallingUserIdEnforcingPermissionsLocked(int userId) {
4062             final int callingUid = Binder.getCallingUid();
4063             if (callingUid == 0
4064                     || callingUid == Process.SYSTEM_UID
4065                     || callingUid == Process.SHELL_UID) {
4066                 if (userId == UserHandle.USER_CURRENT
4067                         || userId == UserHandle.USER_CURRENT_OR_SELF) {
4068                     return mCurrentUserId;
4069                 }
4070                 return resolveProfileParentLocked(userId);
4071             }
4072             final int callingUserId = UserHandle.getUserId(callingUid);
4073             if (callingUserId == userId) {
4074                 return resolveProfileParentLocked(userId);
4075             }
4076             final int callingUserParentId = resolveProfileParentLocked(callingUserId);
4077             if (callingUserParentId == mCurrentUserId &&
4078                     (userId == UserHandle.USER_CURRENT
4079                             || userId == UserHandle.USER_CURRENT_OR_SELF)) {
4080                 return mCurrentUserId;
4081             }
4082             if (!hasPermission(Manifest.permission.INTERACT_ACROSS_USERS)
4083                     && !hasPermission(Manifest.permission.INTERACT_ACROSS_USERS_FULL)) {
4084                 throw new SecurityException("Call from user " + callingUserId + " as user "
4085                         + userId + " without permission INTERACT_ACROSS_USERS or "
4086                         + "INTERACT_ACROSS_USERS_FULL not allowed.");
4087             }
4088             if (userId == UserHandle.USER_CURRENT
4089                     || userId == UserHandle.USER_CURRENT_OR_SELF) {
4090                 return mCurrentUserId;
4091             }
4092             throw new IllegalArgumentException("Calling user can be changed to only "
4093                     + "UserHandle.USER_CURRENT or UserHandle.USER_CURRENT_OR_SELF.");
4094         }
4095
4096         public boolean isCallerInteractingAcrossUsers(int userId) {
4097             final int callingUid = Binder.getCallingUid();
4098             return (Binder.getCallingPid() == android.os.Process.myPid()
4099                     || callingUid == Process.SHELL_UID
4100                     || userId == UserHandle.USER_CURRENT
4101                     || userId == UserHandle.USER_CURRENT_OR_SELF);
4102         }
4103
4104         private boolean isRetrievalAllowingWindow(int windowId) {
4105             // The system gets to interact with any window it wants.
4106             if (Binder.getCallingUid() == Process.SYSTEM_UID) {
4107                 return true;
4108             }
4109             if (windowId == mActiveWindowId) {
4110                 return true;
4111             }
4112             return findWindowById(windowId) != null;
4113         }
4114
4115         private AccessibilityWindowInfo findWindowById(int windowId) {
4116             if (mWindows != null) {
4117                 final int windowCount = mWindows.size();
4118                 for (int i = 0; i < windowCount; i++) {
4119                     AccessibilityWindowInfo window = mWindows.get(i);
4120                     if (window.getId() == windowId) {
4121                         return window;
4122                     }
4123                 }
4124             }
4125             return null;
4126         }
4127
4128         private void enforceCallingPermission(String permission, String function) {
4129             if (OWN_PROCESS_ID == Binder.getCallingPid()) {
4130                 return;
4131             }
4132             if (!hasPermission(permission)) {
4133                 throw new SecurityException("You do not have " + permission
4134                         + " required to call " + function + " from pid="
4135                         + Binder.getCallingPid() + ", uid=" + Binder.getCallingUid());
4136             }
4137         }
4138
4139         private boolean hasPermission(String permission) {
4140             return mContext.checkCallingPermission(permission) == PackageManager.PERMISSION_GRANTED;
4141         }
4142
4143         private int getFocusedWindowId() {
4144             IBinder token = mWindowManagerService.getFocusedWindowToken();
4145             synchronized (mLock) {
4146                 return findWindowIdLocked(token);
4147             }
4148         }
4149     }
4150
4151     private class UserState {
4152         public final int mUserId;
4153
4154         // Non-transient state.
4155
4156         public final RemoteCallbackList<IAccessibilityManagerClient> mClients =
4157             new RemoteCallbackList<>();
4158
4159         public final SparseArray<AccessibilityConnectionWrapper> mInteractionConnections =
4160                 new SparseArray<>();
4161
4162         public final SparseArray<IBinder> mWindowTokens = new SparseArray<>();
4163
4164         // Transient state.
4165
4166         public final CopyOnWriteArrayList<Service> mBoundServices =
4167                 new CopyOnWriteArrayList<>();
4168
4169         public final Map<ComponentName, Service> mComponentNameToServiceMap =
4170                 new HashMap<>();
4171
4172         public final List<AccessibilityServiceInfo> mInstalledServices =
4173                 new ArrayList<>();
4174
4175         public final Set<ComponentName> mBindingServices = new HashSet<>();
4176
4177         public final Set<ComponentName> mEnabledServices = new HashSet<>();
4178
4179         public final Set<ComponentName> mTouchExplorationGrantedServices =
4180                 new HashSet<>();
4181
4182         public ComponentName mServiceChangingSoftKeyboardMode;
4183
4184         public int mLastSentClientState = -1;
4185
4186         public int mSoftKeyboardShowMode = 0;
4187
4188         public boolean mIsTouchExplorationEnabled;
4189         public boolean mIsTextHighContrastEnabled;
4190         public boolean mIsEnhancedWebAccessibilityEnabled;
4191         public boolean mIsDisplayMagnificationEnabled;
4192         public boolean mIsAutoclickEnabled;
4193         public boolean mIsPerformGesturesEnabled;
4194         public boolean mIsFilterKeyEventsEnabled;
4195         public boolean mHasDisplayColorAdjustment;
4196         public boolean mAccessibilityFocusOnlyInActiveWindow;
4197
4198         private Service mUiAutomationService;
4199         private int mUiAutomationFlags;
4200         private IAccessibilityServiceClient mUiAutomationServiceClient;
4201
4202         private IBinder mUiAutomationServiceOwner;
4203         private final DeathRecipient mUiAutomationSerivceOnwerDeathRecipient =
4204                 new DeathRecipient() {
4205             @Override
4206             public void binderDied() {
4207                 mUiAutomationServiceOwner.unlinkToDeath(
4208                         mUiAutomationSerivceOnwerDeathRecipient, 0);
4209                 mUiAutomationServiceOwner = null;
4210                 if (mUiAutomationService != null) {
4211                     mUiAutomationService.binderDied();
4212                 }
4213             }
4214         };
4215
4216         public UserState(int userId) {
4217             mUserId = userId;
4218         }
4219
4220         public int getClientState() {
4221             int clientState = 0;
4222             if (isHandlingAccessibilityEvents()) {
4223                 clientState |= AccessibilityManager.STATE_FLAG_ACCESSIBILITY_ENABLED;
4224             }
4225             // Touch exploration relies on enabled accessibility.
4226             if (isHandlingAccessibilityEvents() && mIsTouchExplorationEnabled) {
4227                 clientState |= AccessibilityManager.STATE_FLAG_TOUCH_EXPLORATION_ENABLED;
4228             }
4229             if (mIsTextHighContrastEnabled) {
4230                 clientState |= AccessibilityManager.STATE_FLAG_HIGH_TEXT_CONTRAST_ENABLED;
4231             }
4232             return clientState;
4233         }
4234
4235         public boolean isHandlingAccessibilityEvents() {
4236             return !mBoundServices.isEmpty() || !mBindingServices.isEmpty();
4237         }
4238
4239         public void onSwitchToAnotherUser() {
4240             // Clear UI test automation state.
4241             if (mUiAutomationService != null) {
4242                 mUiAutomationService.binderDied();
4243             }
4244
4245             // Unbind all services.
4246             unbindAllServicesLocked(this);
4247
4248             // Clear service management state.
4249             mBoundServices.clear();
4250             mBindingServices.clear();
4251
4252             // Clear event management state.
4253             mLastSentClientState = -1;
4254
4255             // Clear state persisted in settings.
4256             mEnabledServices.clear();
4257             mTouchExplorationGrantedServices.clear();
4258             mIsTouchExplorationEnabled = false;
4259             mIsEnhancedWebAccessibilityEnabled = false;
4260             mIsDisplayMagnificationEnabled = false;
4261             mIsAutoclickEnabled = false;
4262             mSoftKeyboardShowMode = 0;
4263         }
4264
4265         public void destroyUiAutomationService() {
4266             mUiAutomationService = null;
4267             mUiAutomationFlags = 0;
4268             mUiAutomationServiceClient = null;
4269             if (mUiAutomationServiceOwner != null) {
4270                 mUiAutomationServiceOwner.unlinkToDeath(
4271                         mUiAutomationSerivceOnwerDeathRecipient, 0);
4272                 mUiAutomationServiceOwner = null;
4273             }
4274         }
4275
4276         boolean isUiAutomationSuppressingOtherServices() {
4277             return ((mUiAutomationService != null) && (mUiAutomationFlags
4278                     & UiAutomation.FLAG_DONT_SUPPRESS_ACCESSIBILITY_SERVICES) == 0);
4279         }
4280     }
4281
4282     private final class AccessibilityContentObserver extends ContentObserver {
4283
4284         private final Uri mTouchExplorationEnabledUri = Settings.Secure.getUriFor(
4285                 Settings.Secure.TOUCH_EXPLORATION_ENABLED);
4286
4287         private final Uri mDisplayMagnificationEnabledUri = Settings.Secure.getUriFor(
4288                 Settings.Secure.ACCESSIBILITY_DISPLAY_MAGNIFICATION_ENABLED);
4289
4290         private final Uri mAutoclickEnabledUri = Settings.Secure.getUriFor(
4291                 Settings.Secure.ACCESSIBILITY_AUTOCLICK_ENABLED);
4292
4293         private final Uri mEnabledAccessibilityServicesUri = Settings.Secure.getUriFor(
4294                 Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES);
4295
4296         private final Uri mTouchExplorationGrantedAccessibilityServicesUri = Settings.Secure
4297                 .getUriFor(Settings.Secure.TOUCH_EXPLORATION_GRANTED_ACCESSIBILITY_SERVICES);
4298
4299         private final Uri mEnhancedWebAccessibilityUri = Settings.Secure
4300                 .getUriFor(Settings.Secure.ACCESSIBILITY_SCRIPT_INJECTION);
4301
4302         private final Uri mDisplayInversionEnabledUri = Settings.Secure.getUriFor(
4303                 Settings.Secure.ACCESSIBILITY_DISPLAY_INVERSION_ENABLED);
4304
4305         private final Uri mDisplayDaltonizerEnabledUri = Settings.Secure.getUriFor(
4306                 Settings.Secure.ACCESSIBILITY_DISPLAY_DALTONIZER_ENABLED);
4307
4308         private final Uri mDisplayDaltonizerUri = Settings.Secure.getUriFor(
4309                 Settings.Secure.ACCESSIBILITY_DISPLAY_DALTONIZER);
4310
4311         private final Uri mDisplayColorMatrixUri = Settings.Secure.getUriFor(
4312                 Settings.Secure.ACCESSIBILITY_DISPLAY_COLOR_MATRIX);
4313
4314         private final Uri mHighTextContrastUri = Settings.Secure.getUriFor(
4315                 Settings.Secure.ACCESSIBILITY_HIGH_TEXT_CONTRAST_ENABLED);
4316
4317         private final Uri mAccessibilitySoftKeyboardModeUri = Settings.Secure.getUriFor(
4318                 Settings.Secure.ACCESSIBILITY_SOFT_KEYBOARD_MODE);
4319
4320         public AccessibilityContentObserver(Handler handler) {
4321             super(handler);
4322         }
4323
4324         public void register(ContentResolver contentResolver) {
4325             contentResolver.registerContentObserver(mTouchExplorationEnabledUri,
4326                     false, this, UserHandle.USER_ALL);
4327             contentResolver.registerContentObserver(mDisplayMagnificationEnabledUri,
4328                     false, this, UserHandle.USER_ALL);
4329             contentResolver.registerContentObserver(mAutoclickEnabledUri,
4330                     false, this, UserHandle.USER_ALL);
4331             contentResolver.registerContentObserver(mEnabledAccessibilityServicesUri,
4332                     false, this, UserHandle.USER_ALL);
4333             contentResolver.registerContentObserver(
4334                     mTouchExplorationGrantedAccessibilityServicesUri,
4335                     false, this, UserHandle.USER_ALL);
4336             contentResolver.registerContentObserver(mEnhancedWebAccessibilityUri,
4337                     false, this, UserHandle.USER_ALL);
4338             contentResolver.registerContentObserver(
4339                     mDisplayInversionEnabledUri, false, this, UserHandle.USER_ALL);
4340             contentResolver.registerContentObserver(
4341                     mDisplayDaltonizerEnabledUri, false, this, UserHandle.USER_ALL);
4342             contentResolver.registerContentObserver(
4343                     mDisplayDaltonizerUri, false, this, UserHandle.USER_ALL);
4344             contentResolver.registerContentObserver(
4345                     mDisplayColorMatrixUri, false, this, UserHandle.USER_ALL);
4346             contentResolver.registerContentObserver(
4347                     mHighTextContrastUri, false, this, UserHandle.USER_ALL);
4348             contentResolver.registerContentObserver(
4349                     mAccessibilitySoftKeyboardModeUri, false, this, UserHandle.USER_ALL);
4350         }
4351
4352         @Override
4353         public void onChange(boolean selfChange, Uri uri) {
4354             synchronized (mLock) {
4355                 // Profiles share the accessibility state of the parent. Therefore,
4356                 // we are checking for changes only the parent settings.
4357                 UserState userState = getCurrentUserStateLocked();
4358
4359                 // If the automation service is suppressing, we will update when it dies.
4360                 if (userState.isUiAutomationSuppressingOtherServices()) {
4361                     return;
4362                 }
4363
4364                 if (mTouchExplorationEnabledUri.equals(uri)) {
4365                     if (readTouchExplorationEnabledSettingLocked(userState)) {
4366                         onUserStateChangedLocked(userState);
4367                     }
4368                 } else if (mDisplayMagnificationEnabledUri.equals(uri)) {
4369                     if (readDisplayMagnificationEnabledSettingLocked(userState)) {
4370                         onUserStateChangedLocked(userState);
4371                     }
4372                 } else if (mAutoclickEnabledUri.equals(uri)) {
4373                     if (readAutoclickEnabledSettingLocked(userState)) {
4374                         onUserStateChangedLocked(userState);
4375                     }
4376                 } else if (mEnabledAccessibilityServicesUri.equals(uri)) {
4377                     if (readEnabledAccessibilityServicesLocked(userState)) {
4378                         onUserStateChangedLocked(userState);
4379                     }
4380                 } else if (mTouchExplorationGrantedAccessibilityServicesUri.equals(uri)) {
4381                     if (readTouchExplorationGrantedAccessibilityServicesLocked(userState)) {
4382                         onUserStateChangedLocked(userState);
4383                     }
4384                 } else if (mEnhancedWebAccessibilityUri.equals(uri)) {
4385                     if (readEnhancedWebAccessibilityEnabledChangedLocked(userState)) {
4386                         onUserStateChangedLocked(userState);
4387                     }
4388                 } else if (mDisplayInversionEnabledUri.equals(uri)
4389                         || mDisplayDaltonizerEnabledUri.equals(uri)
4390                         || mDisplayDaltonizerUri.equals(uri)) {
4391                     if (readDisplayColorAdjustmentSettingsLocked(userState)) {
4392                         updateDisplayColorAdjustmentSettingsLocked(userState);
4393                     }
4394                 } else if (mDisplayColorMatrixUri.equals(uri)) {
4395                     updateDisplayColorAdjustmentSettingsLocked(userState);
4396                 } else if (mHighTextContrastUri.equals(uri)) {
4397                     if (readHighTextContrastEnabledSettingLocked(userState)) {
4398                         onUserStateChangedLocked(userState);
4399                     }
4400                 } else if (mAccessibilitySoftKeyboardModeUri.equals(uri)) {
4401                     if (readSoftKeyboardShowModeChangedLocked(userState)) {
4402                         notifySoftKeyboardShowModeChangedLocked(userState.mSoftKeyboardShowMode);
4403                         onUserStateChangedLocked(userState);
4404                     }
4405                 }
4406             }
4407         }
4408     }
4409 }