OSDN Git Service

aaudio: use weak pointer to prevent UAF
[android-x86/frameworks-av.git] / services / oboeservice / AAudioServiceStreamBase.cpp
1 /*
2  * Copyright (C) 2016 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16
17 #define LOG_TAG "AAudioServiceStreamBase"
18 //#define LOG_NDEBUG 0
19 #include <utils/Log.h>
20
21 #include <iomanip>
22 #include <iostream>
23 #include <mutex>
24
25 #include "binding/IAAudioService.h"
26 #include "binding/AAudioServiceMessage.h"
27 #include "utility/AudioClock.h"
28
29 #include "AAudioEndpointManager.h"
30 #include "AAudioService.h"
31 #include "AAudioServiceEndpoint.h"
32 #include "AAudioServiceStreamBase.h"
33 #include "TimestampScheduler.h"
34
35 using namespace android;  // TODO just import names needed
36 using namespace aaudio;   // TODO just import names needed
37
38 /**
39  * Base class for streams in the service.
40  * @return
41  */
42
43 AAudioServiceStreamBase::AAudioServiceStreamBase(AAudioService &audioService)
44         : mUpMessageQueue(nullptr)
45         , mTimestampThread()
46         , mAtomicTimestamp()
47         , mAudioService(audioService) {
48     mMmapClient.clientUid = -1;
49     mMmapClient.clientPid = -1;
50     mMmapClient.packageName = String16("");
51 }
52
53 AAudioServiceStreamBase::~AAudioServiceStreamBase() {
54     ALOGD("AAudioServiceStreamBase::~AAudioServiceStreamBase() destroying %p", this);
55     // If the stream is deleted when OPEN or in use then audio resources will leak.
56     // This would indicate an internal error. So we want to find this ASAP.
57     LOG_ALWAYS_FATAL_IF(!(getState() == AAUDIO_STREAM_STATE_CLOSED
58                         || getState() == AAUDIO_STREAM_STATE_UNINITIALIZED
59                         || getState() == AAUDIO_STREAM_STATE_DISCONNECTED),
60                         "service stream still open, state = %d", getState());
61 }
62
63 std::string AAudioServiceStreamBase::dumpHeader() {
64     return std::string("    T   Handle   UId Run State Format Burst Chan Capacity");
65 }
66
67 std::string AAudioServiceStreamBase::dump() const {
68     std::stringstream result;
69
70     result << "    0x" << std::setfill('0') << std::setw(8) << std::hex << mHandle
71            << std::dec << std::setfill(' ') ;
72     result << std::setw(6) << mMmapClient.clientUid;
73     result << std::setw(4) << (isRunning() ? "yes" : " no");
74     result << std::setw(6) << getState();
75     result << std::setw(7) << getFormat();
76     result << std::setw(6) << mFramesPerBurst;
77     result << std::setw(5) << getSamplesPerFrame();
78     result << std::setw(9) << getBufferCapacity();
79
80     return result.str();
81 }
82
83 aaudio_result_t AAudioServiceStreamBase::open(const aaudio::AAudioStreamRequest &request,
84                                               aaudio_sharing_mode_t sharingMode) {
85     AAudioEndpointManager &mEndpointManager = AAudioEndpointManager::getInstance();
86     aaudio_result_t result = AAUDIO_OK;
87
88     mMmapClient.clientUid = request.getUserId();
89     mMmapClient.clientPid = request.getProcessId();
90     mMmapClient.packageName.setTo(String16("")); // TODO What should we do here?
91
92     // Limit scope of lock to avoid recursive lock in close().
93     {
94         std::lock_guard<std::mutex> lock(mUpMessageQueueLock);
95         if (mUpMessageQueue != nullptr) {
96             ALOGE("AAudioServiceStreamBase::open() called twice");
97             return AAUDIO_ERROR_INVALID_STATE;
98         }
99
100         mUpMessageQueue = new SharedRingBuffer();
101         result = mUpMessageQueue->allocate(sizeof(AAudioServiceMessage),
102                                            QUEUE_UP_CAPACITY_COMMANDS);
103         if (result != AAUDIO_OK) {
104             goto error;
105         }
106
107         // This is not protected by a lock because the stream cannot be
108         // referenced until the service returns a handle to the client.
109         // So only one thread can open a stream.
110         mServiceEndpoint = mEndpointManager.openEndpoint(mAudioService,
111                                                          request,
112                                                          sharingMode);
113         if (mServiceEndpoint == nullptr) {
114             ALOGE("AAudioServiceStreamBase::open() openEndpoint() failed");
115             result = AAUDIO_ERROR_UNAVAILABLE;
116             goto error;
117         }
118         // Save a weak pointer that we will use to access the endpoint.
119         mServiceEndpointWeak = mServiceEndpoint;
120
121         mFramesPerBurst = mServiceEndpoint->getFramesPerBurst();
122         copyFrom(*mServiceEndpoint);
123     }
124     return result;
125
126 error:
127     close();
128     return result;
129 }
130
131 aaudio_result_t AAudioServiceStreamBase::close() {
132     aaudio_result_t result = AAUDIO_OK;
133     if (getState() == AAUDIO_STREAM_STATE_CLOSED) {
134         return AAUDIO_OK;
135     }
136
137     stop();
138
139     sp<AAudioServiceEndpoint> endpoint = mServiceEndpointWeak.promote();
140     if (endpoint == nullptr) {
141         result = AAUDIO_ERROR_INVALID_STATE;
142     } else {
143         endpoint->unregisterStream(this);
144         AAudioEndpointManager &endpointManager = AAudioEndpointManager::getInstance();
145         endpointManager.closeEndpoint(endpoint);
146
147         // AAudioService::closeStream() prevents two threads from closing at the same time.
148         mServiceEndpoint.clear(); // endpoint will hold the pointer until this method returns.
149     }
150
151
152     {
153         std::lock_guard<std::mutex> lock(mUpMessageQueueLock);
154         stopTimestampThread();
155         delete mUpMessageQueue;
156         mUpMessageQueue = nullptr;
157     }
158
159     setState(AAUDIO_STREAM_STATE_CLOSED);
160     return result;
161 }
162
163 aaudio_result_t AAudioServiceStreamBase::startDevice() {
164     mClientHandle = AUDIO_PORT_HANDLE_NONE;
165     sp<AAudioServiceEndpoint> endpoint = mServiceEndpointWeak.promote();
166     if (endpoint == nullptr) {
167         ALOGE("%s() has no endpoint", __func__);
168         return AAUDIO_ERROR_INVALID_STATE;
169     }
170     return endpoint->startStream(this, &mClientHandle);
171 }
172
173 /**
174  * Start the flow of audio data.
175  *
176  * An AAUDIO_SERVICE_EVENT_STARTED will be sent to the client when complete.
177  */
178 aaudio_result_t AAudioServiceStreamBase::start() {
179     aaudio_result_t result = AAUDIO_OK;
180
181     if (isRunning()) {
182         return AAUDIO_OK;
183     }
184
185     // Start with fresh presentation timestamps.
186     mAtomicTimestamp.clear();
187
188     mClientHandle = AUDIO_PORT_HANDLE_NONE;
189     result = startDevice();
190     if (result != AAUDIO_OK) goto error;
191
192     // This should happen at the end of the start.
193     sendServiceEvent(AAUDIO_SERVICE_EVENT_STARTED);
194     setState(AAUDIO_STREAM_STATE_STARTED);
195     mThreadEnabled.store(true);
196     result = mTimestampThread.start(this);
197     if (result != AAUDIO_OK) goto error;
198
199     return result;
200
201 error:
202     disconnect();
203     return result;
204 }
205
206 aaudio_result_t AAudioServiceStreamBase::pause() {
207     aaudio_result_t result = AAUDIO_OK;
208     if (!isRunning()) {
209         return result;
210     }
211
212     // Send it now because the timestamp gets rounded up when stopStream() is called below.
213     // Also we don't need the timestamps while we are shutting down.
214     sendCurrentTimestamp();
215
216     result = stopTimestampThread();
217     if (result != AAUDIO_OK) {
218         disconnect();
219         return result;
220     }
221
222     sp<AAudioServiceEndpoint> endpoint = mServiceEndpointWeak.promote();
223     if (endpoint == nullptr) {
224         ALOGE("%s() has no endpoint", __func__);
225         return AAUDIO_ERROR_INVALID_STATE;
226     }
227     result = endpoint->stopStream(this, mClientHandle);
228     if (result != AAUDIO_OK) {
229         ALOGE("AAudioServiceStreamShared::pause() mServiceEndpoint returned %d", result);
230         disconnect(); // TODO should we return or pause Base first?
231     }
232
233     sendServiceEvent(AAUDIO_SERVICE_EVENT_PAUSED);
234     setState(AAUDIO_STREAM_STATE_PAUSED);
235     return result;
236 }
237
238 aaudio_result_t AAudioServiceStreamBase::stop() {
239     aaudio_result_t result = AAUDIO_OK;
240     if (!isRunning()) {
241         return result;
242     }
243
244     // Send it now because the timestamp gets rounded up when stopStream() is called below.
245     // Also we don't need the timestamps while we are shutting down.
246     sendCurrentTimestamp(); // warning - this calls a virtual function
247     result = stopTimestampThread();
248     if (result != AAUDIO_OK) {
249         disconnect();
250         return result;
251     }
252
253     sp<AAudioServiceEndpoint> endpoint = mServiceEndpointWeak.promote();
254     if (endpoint == nullptr) {
255         ALOGE("%s() has no endpoint", __func__);
256         return AAUDIO_ERROR_INVALID_STATE;
257     }
258     // TODO wait for data to be played out
259     result = endpoint->stopStream(this, mClientHandle);
260     if (result != AAUDIO_OK) {
261         ALOGE("AAudioServiceStreamShared::stop() mServiceEndpoint returned %d", result);
262         disconnect();
263         // TODO what to do with result here?
264     }
265
266     sendServiceEvent(AAUDIO_SERVICE_EVENT_STOPPED);
267     setState(AAUDIO_STREAM_STATE_STOPPED);
268     return result;
269 }
270
271 aaudio_result_t AAudioServiceStreamBase::stopTimestampThread() {
272     aaudio_result_t result = AAUDIO_OK;
273     // clear flag that tells thread to loop
274     if (mThreadEnabled.exchange(false)) {
275         result = mTimestampThread.stop();
276     }
277     return result;
278 }
279
280 aaudio_result_t AAudioServiceStreamBase::flush() {
281     if (getState() != AAUDIO_STREAM_STATE_PAUSED) {
282         ALOGE("AAudioServiceStreamBase::flush() stream not paused, state = %s",
283               AAudio_convertStreamStateToText(mState));
284         return AAUDIO_ERROR_INVALID_STATE;
285     }
286     // Data will get flushed when the client receives the FLUSHED event.
287     sendServiceEvent(AAUDIO_SERVICE_EVENT_FLUSHED);
288     setState(AAUDIO_STREAM_STATE_FLUSHED);
289     return AAUDIO_OK;
290 }
291
292 // implement Runnable, periodically send timestamps to client
293 void AAudioServiceStreamBase::run() {
294     ALOGD("AAudioServiceStreamBase::run() entering ----------------");
295     TimestampScheduler timestampScheduler;
296     timestampScheduler.setBurstPeriod(mFramesPerBurst, getSampleRate());
297     timestampScheduler.start(AudioClock::getNanoseconds());
298     int64_t nextTime = timestampScheduler.nextAbsoluteTime();
299     while(mThreadEnabled.load()) {
300         if (AudioClock::getNanoseconds() >= nextTime) {
301             aaudio_result_t result = sendCurrentTimestamp();
302             if (result != AAUDIO_OK) {
303                 break;
304             }
305             nextTime = timestampScheduler.nextAbsoluteTime();
306         } else  {
307             // Sleep until it is time to send the next timestamp.
308             // TODO Wait for a signal with a timeout so that we can stop more quickly.
309             AudioClock::sleepUntilNanoTime(nextTime);
310         }
311     }
312     ALOGD("AAudioServiceStreamBase::run() exiting ----------------");
313 }
314
315 void AAudioServiceStreamBase::disconnect() {
316     if (getState() != AAUDIO_STREAM_STATE_DISCONNECTED) {
317         sendServiceEvent(AAUDIO_SERVICE_EVENT_DISCONNECTED);
318         setState(AAUDIO_STREAM_STATE_DISCONNECTED);
319     }
320 }
321
322 aaudio_result_t AAudioServiceStreamBase::sendServiceEvent(aaudio_service_event_t event,
323                                                double  dataDouble,
324                                                int64_t dataLong) {
325     AAudioServiceMessage command;
326     command.what = AAudioServiceMessage::code::EVENT;
327     command.event.event = event;
328     command.event.dataDouble = dataDouble;
329     command.event.dataLong = dataLong;
330     return writeUpMessageQueue(&command);
331 }
332
333 aaudio_result_t AAudioServiceStreamBase::writeUpMessageQueue(AAudioServiceMessage *command) {
334     std::lock_guard<std::mutex> lock(mUpMessageQueueLock);
335     if (mUpMessageQueue == nullptr) {
336         ALOGE("writeUpMessageQueue(): mUpMessageQueue null! - stream not open");
337         return AAUDIO_ERROR_NULL;
338     }
339     int32_t count = mUpMessageQueue->getFifoBuffer()->write(command, 1);
340     if (count != 1) {
341         ALOGE("writeUpMessageQueue(): Queue full. Did client die?");
342         return AAUDIO_ERROR_WOULD_BLOCK;
343     } else {
344         return AAUDIO_OK;
345     }
346 }
347
348 aaudio_result_t AAudioServiceStreamBase::sendCurrentTimestamp() {
349     AAudioServiceMessage command;
350     // Send a timestamp for the clock model.
351     aaudio_result_t result = getFreeRunningPosition(&command.timestamp.position,
352                                                     &command.timestamp.timestamp);
353     if (result == AAUDIO_OK) {
354         ALOGV("sendCurrentTimestamp() SERVICE  %8lld at %lld",
355               (long long) command.timestamp.position,
356               (long long) command.timestamp.timestamp);
357         command.what = AAudioServiceMessage::code::TIMESTAMP_SERVICE;
358         result = writeUpMessageQueue(&command);
359
360         if (result == AAUDIO_OK) {
361             // Send a hardware timestamp for presentation time.
362             result = getHardwareTimestamp(&command.timestamp.position,
363                                           &command.timestamp.timestamp);
364             if (result == AAUDIO_OK) {
365                 ALOGV("sendCurrentTimestamp() HARDWARE %8lld at %lld",
366                       (long long) command.timestamp.position,
367                       (long long) command.timestamp.timestamp);
368                 command.what = AAudioServiceMessage::code::TIMESTAMP_HARDWARE;
369                 result = writeUpMessageQueue(&command);
370             }
371         }
372     }
373
374     if (result == AAUDIO_ERROR_UNAVAILABLE) { // TODO review best error code
375         result = AAUDIO_OK; // just not available yet, try again later
376     }
377     return result;
378 }
379
380 /**
381  * Get an immutable description of the in-memory queues
382  * used to communicate with the underlying HAL or Service.
383  */
384 aaudio_result_t AAudioServiceStreamBase::getDescription(AudioEndpointParcelable &parcelable) {
385     {
386         std::lock_guard<std::mutex> lock(mUpMessageQueueLock);
387         if (mUpMessageQueue == nullptr) {
388             ALOGE("getDescription(): mUpMessageQueue null! - stream not open");
389             return AAUDIO_ERROR_NULL;
390         }
391         // Gather information on the message queue.
392         mUpMessageQueue->fillParcelable(parcelable,
393                                         parcelable.mUpMessageQueueParcelable);
394     }
395     return getAudioDataDescription(parcelable);
396 }
397
398 void AAudioServiceStreamBase::onVolumeChanged(float volume) {
399     sendServiceEvent(AAUDIO_SERVICE_EVENT_VOLUME, volume);
400 }