• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright (C) 2010 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include <log/log.h>
18 #include <sys/socket.h>
19 #include <utils/threads.h>
20 
21 #include <android/util/ProtoOutputStream.h>
22 #include <frameworks/base/core/proto/android/service/sensor_service.proto.h>
23 #include <sensor/SensorEventQueue.h>
24 
25 #include "vec.h"
26 #include "SensorEventConnection.h"
27 #include "SensorDevice.h"
28 
29 #define UNUSED(x) (void)(x)
30 
31 namespace android {
32 namespace {
33 
34 // Used as the default value for the target SDK until it's obtained via getTargetSdkVersion.
35 constexpr int kTargetSdkUnknown = 0;
36 
37 }  // namespace
38 
SensorEventConnection(const sp<SensorService> & service,uid_t uid,String8 packageName,bool isDataInjectionMode,const String16 & opPackageName,const String16 & attributionTag)39 SensorService::SensorEventConnection::SensorEventConnection(
40         const sp<SensorService>& service, uid_t uid, String8 packageName, bool isDataInjectionMode,
41         const String16& opPackageName, const String16& attributionTag)
42     : mService(service), mUid(uid), mWakeLockRefCount(0), mHasLooperCallbacks(false),
43       mDead(false), mDataInjectionMode(isDataInjectionMode), mEventCache(nullptr),
44       mCacheSize(0), mMaxCacheSize(0), mTimeOfLastEventDrop(0), mEventsDropped(0),
45       mPackageName(packageName), mOpPackageName(opPackageName), mAttributionTag(attributionTag),
46       mTargetSdk(kTargetSdkUnknown), mDestroyed(false) {
47     mIsRateCappedBasedOnPermission = mService->isRateCappedBasedOnPermission(mOpPackageName);
48     mUserId = multiuser_get_user_id(mUid);
49     mChannel = new BitTube(mService->mSocketBufferSize);
50 #if DEBUG_CONNECTIONS
51     mEventsReceived = mEventsSentFromCache = mEventsSent = 0;
52     mTotalAcksNeeded = mTotalAcksReceived = 0;
53 #endif
54 }
55 
~SensorEventConnection()56 SensorService::SensorEventConnection::~SensorEventConnection() {
57     ALOGD_IF(DEBUG_CONNECTIONS, "~SensorEventConnection(%p)", this);
58     destroy();
59     mService->cleanupConnection(this);
60     if (mEventCache != nullptr) {
61         delete[] mEventCache;
62     }
63 }
64 
destroy()65 void SensorService::SensorEventConnection::destroy() {
66     mDestroyed = true;
67 }
68 
onFirstRef()69 void SensorService::SensorEventConnection::onFirstRef() {
70     LooperCallback::onFirstRef();
71 }
72 
needsWakeLock()73 bool SensorService::SensorEventConnection::needsWakeLock() {
74     Mutex::Autolock _l(mConnectionLock);
75     return !mDead && mWakeLockRefCount > 0;
76 }
77 
resetWakeLockRefCount()78 void SensorService::SensorEventConnection::resetWakeLockRefCount() {
79     Mutex::Autolock _l(mConnectionLock);
80     mWakeLockRefCount = 0;
81 }
82 
dump(String8 & result)83 void SensorService::SensorEventConnection::dump(String8& result) {
84     Mutex::Autolock _l(mConnectionLock);
85     result.appendFormat("\tOperating Mode: ");
86     if (!mService->isWhiteListedPackage(getPackageName())) {
87         result.append("RESTRICTED\n");
88     } else if (mDataInjectionMode) {
89         result.append("DATA_INJECTION\n");
90     } else {
91         result.append("NORMAL\n");
92     }
93     result.appendFormat("\t %s | WakeLockRefCount %d | uid %d | cache size %d | "
94             "max cache size %d\n", mPackageName.string(), mWakeLockRefCount, mUid, mCacheSize,
95             mMaxCacheSize);
96     for (auto& it : mSensorInfo) {
97         const FlushInfo& flushInfo = it.second;
98         result.appendFormat("\t %s 0x%08x | status: %s | pending flush events %d \n",
99                             mService->getSensorName(it.first).string(),
100                             it.first,
101                             flushInfo.mFirstFlushPending ? "First flush pending" :
102                                                            "active",
103                             flushInfo.mPendingFlushEventsToSend);
104     }
105 #if DEBUG_CONNECTIONS
106     result.appendFormat("\t events recvd: %d | sent %d | cache %d | dropped %d |"
107             " total_acks_needed %d | total_acks_recvd %d\n",
108             mEventsReceived,
109             mEventsSent,
110             mEventsSentFromCache,
111             mEventsReceived - (mEventsSentFromCache + mEventsSent + mCacheSize),
112             mTotalAcksNeeded,
113             mTotalAcksReceived);
114 #endif
115 }
116 
117 /**
118  * Dump debugging information as android.service.SensorEventConnectionProto protobuf message using
119  * ProtoOutputStream.
120  *
121  * See proto definition and some notes about ProtoOutputStream in
122  * frameworks/base/core/proto/android/service/sensor_service.proto
123  */
dump(util::ProtoOutputStream * proto) const124 void SensorService::SensorEventConnection::dump(util::ProtoOutputStream* proto) const {
125     using namespace service::SensorEventConnectionProto;
126     Mutex::Autolock _l(mConnectionLock);
127 
128     if (!mService->isWhiteListedPackage(getPackageName())) {
129         proto->write(OPERATING_MODE, OP_MODE_RESTRICTED);
130     } else if (mDataInjectionMode) {
131         proto->write(OPERATING_MODE, OP_MODE_DATA_INJECTION);
132     } else {
133         proto->write(OPERATING_MODE, OP_MODE_NORMAL);
134     }
135     proto->write(PACKAGE_NAME, std::string(mPackageName.string()));
136     proto->write(WAKE_LOCK_REF_COUNT, int32_t(mWakeLockRefCount));
137     proto->write(UID, int32_t(mUid));
138     proto->write(CACHE_SIZE, int32_t(mCacheSize));
139     proto->write(MAX_CACHE_SIZE, int32_t(mMaxCacheSize));
140     for (auto& it : mSensorInfo) {
141         const FlushInfo& flushInfo = it.second;
142         const uint64_t token = proto->start(FLUSH_INFOS);
143         proto->write(FlushInfoProto::SENSOR_NAME,
144                 std::string(mService->getSensorName(it.first)));
145         proto->write(FlushInfoProto::SENSOR_HANDLE, it.first);
146         proto->write(FlushInfoProto::FIRST_FLUSH_PENDING, flushInfo.mFirstFlushPending);
147         proto->write(FlushInfoProto::PENDING_FLUSH_EVENTS_TO_SEND,
148                 flushInfo.mPendingFlushEventsToSend);
149         proto->end(token);
150     }
151 #if DEBUG_CONNECTIONS
152     proto->write(EVENTS_RECEIVED, mEventsReceived);
153     proto->write(EVENTS_SENT, mEventsSent);
154     proto->write(EVENTS_CACHE, mEventsSentFromCache);
155     proto->write(EVENTS_DROPPED, mEventsReceived - (mEventsSentFromCache + mEventsSent +
156             mCacheSize));
157     proto->write(TOTAL_ACKS_NEEDED, mTotalAcksNeeded);
158     proto->write(TOTAL_ACKS_RECEIVED, mTotalAcksReceived);
159 #endif
160 }
161 
addSensor(int32_t handle)162 bool SensorService::SensorEventConnection::addSensor(int32_t handle) {
163     Mutex::Autolock _l(mConnectionLock);
164     sp<SensorInterface> si = mService->getSensorInterfaceFromHandle(handle);
165     if (si == nullptr ||
166         !canAccessSensor(si->getSensor(), "Add to SensorEventConnection: ", mOpPackageName) ||
167         mSensorInfo.count(handle) > 0) {
168         return false;
169     }
170     mSensorInfo[handle] = FlushInfo();
171     return true;
172 }
173 
removeSensor(int32_t handle)174 bool SensorService::SensorEventConnection::removeSensor(int32_t handle) {
175     Mutex::Autolock _l(mConnectionLock);
176     if (mSensorInfo.erase(handle) >= 0) {
177         return true;
178     }
179     return false;
180 }
181 
getActiveSensorHandles() const182 std::vector<int32_t> SensorService::SensorEventConnection::getActiveSensorHandles() const {
183     Mutex::Autolock _l(mConnectionLock);
184     std::vector<int32_t> list;
185     for (auto& it : mSensorInfo) {
186         list.push_back(it.first);
187     }
188     return list;
189 }
190 
hasSensor(int32_t handle) const191 bool SensorService::SensorEventConnection::hasSensor(int32_t handle) const {
192     Mutex::Autolock _l(mConnectionLock);
193     return mSensorInfo.count(handle) > 0;
194 }
195 
hasAnySensor() const196 bool SensorService::SensorEventConnection::hasAnySensor() const {
197     Mutex::Autolock _l(mConnectionLock);
198     return mSensorInfo.size() ? true : false;
199 }
200 
hasOneShotSensors() const201 bool SensorService::SensorEventConnection::hasOneShotSensors() const {
202     Mutex::Autolock _l(mConnectionLock);
203     for (auto &it : mSensorInfo) {
204         const int handle = it.first;
205         sp<SensorInterface> si = mService->getSensorInterfaceFromHandle(handle);
206         if (si != nullptr && si->getSensor().getReportingMode() == AREPORTING_MODE_ONE_SHOT) {
207             return true;
208         }
209     }
210     return false;
211 }
212 
getPackageName() const213 String8 SensorService::SensorEventConnection::getPackageName() const {
214     return mPackageName;
215 }
216 
setFirstFlushPending(int32_t handle,bool value)217 void SensorService::SensorEventConnection::setFirstFlushPending(int32_t handle,
218                                 bool value) {
219     Mutex::Autolock _l(mConnectionLock);
220     if (mSensorInfo.count(handle) > 0) {
221         FlushInfo& flushInfo = mSensorInfo[handle];
222         flushInfo.mFirstFlushPending = value;
223     }
224 }
225 
updateLooperRegistration(const sp<Looper> & looper)226 void SensorService::SensorEventConnection::updateLooperRegistration(const sp<Looper>& looper) {
227     Mutex::Autolock _l(mConnectionLock);
228     updateLooperRegistrationLocked(looper);
229 }
230 
updateLooperRegistrationLocked(const sp<Looper> & looper)231 void SensorService::SensorEventConnection::updateLooperRegistrationLocked(
232         const sp<Looper>& looper) {
233     bool isConnectionActive = (mSensorInfo.size() > 0 && !mDataInjectionMode) ||
234                               mDataInjectionMode;
235     // If all sensors are unregistered OR Looper has encountered an error, we can remove the Fd from
236     // the Looper if it has been previously added.
237     if (!isConnectionActive || mDead) { if (mHasLooperCallbacks) {
238         ALOGD_IF(DEBUG_CONNECTIONS, "%p removeFd fd=%d", this,
239                  mChannel->getSendFd());
240         looper->removeFd(mChannel->getSendFd()); mHasLooperCallbacks = false; }
241     return; }
242 
243     int looper_flags = 0;
244     if (mCacheSize > 0) looper_flags |= ALOOPER_EVENT_OUTPUT;
245     if (mDataInjectionMode) looper_flags |= ALOOPER_EVENT_INPUT;
246     for (auto& it : mSensorInfo) {
247         const int handle = it.first;
248         sp<SensorInterface> si = mService->getSensorInterfaceFromHandle(handle);
249         if (si != nullptr && si->getSensor().isWakeUpSensor()) {
250             looper_flags |= ALOOPER_EVENT_INPUT;
251         }
252     }
253 
254     // If flags is still set to zero, we don't need to add this fd to the Looper, if the fd has
255     // already been added, remove it. This is likely to happen when ALL the events stored in the
256     // cache have been sent to the corresponding app.
257     if (looper_flags == 0) {
258         if (mHasLooperCallbacks) {
259             ALOGD_IF(DEBUG_CONNECTIONS, "removeFd fd=%d", mChannel->getSendFd());
260             looper->removeFd(mChannel->getSendFd());
261             mHasLooperCallbacks = false;
262         }
263         return;
264     }
265 
266     // Add the file descriptor to the Looper for receiving acknowledegments if the app has
267     // registered for wake-up sensors OR for sending events in the cache.
268     int ret = looper->addFd(mChannel->getSendFd(), 0, looper_flags, this, nullptr);
269     if (ret == 1) {
270         ALOGD_IF(DEBUG_CONNECTIONS, "%p addFd fd=%d", this, mChannel->getSendFd());
271         mHasLooperCallbacks = true;
272     } else {
273         ALOGE("Looper::addFd failed ret=%d fd=%d", ret, mChannel->getSendFd());
274     }
275 }
276 
incrementPendingFlushCountIfHasAccess(int32_t handle)277 bool SensorService::SensorEventConnection::incrementPendingFlushCountIfHasAccess(int32_t handle) {
278     if (hasSensorAccess()) {
279         Mutex::Autolock _l(mConnectionLock);
280         if (mSensorInfo.count(handle) > 0) {
281             FlushInfo& flushInfo = mSensorInfo[handle];
282             flushInfo.mPendingFlushEventsToSend++;
283         }
284         return true;
285     } else {
286         return false;
287     }
288 }
289 
sendEvents(sensors_event_t const * buffer,size_t numEvents,sensors_event_t * scratch,wp<const SensorEventConnection> const * mapFlushEventsToConnections)290 status_t SensorService::SensorEventConnection::sendEvents(
291         sensors_event_t const* buffer, size_t numEvents,
292         sensors_event_t* scratch,
293         wp<const SensorEventConnection> const * mapFlushEventsToConnections) {
294     // filter out events not for this connection
295 
296     std::unique_ptr<sensors_event_t[]> sanitizedBuffer;
297 
298     int count = 0;
299     Mutex::Autolock _l(mConnectionLock);
300     if (scratch) {
301         size_t i=0;
302         while (i<numEvents) {
303             int32_t sensor_handle = buffer[i].sensor;
304             if (buffer[i].type == SENSOR_TYPE_META_DATA) {
305                 ALOGD_IF(DEBUG_CONNECTIONS, "flush complete event sensor==%d ",
306                         buffer[i].meta_data.sensor);
307                 // Setting sensor_handle to the correct sensor to ensure the sensor events per
308                 // connection are filtered correctly.  buffer[i].sensor is zero for meta_data
309                 // events.
310                 sensor_handle = buffer[i].meta_data.sensor;
311             }
312 
313             // Check if this connection has registered for this sensor. If not continue to the
314             // next sensor_event.
315             if (mSensorInfo.count(sensor_handle) == 0) {
316                 ++i;
317                 continue;
318             }
319 
320             FlushInfo& flushInfo = mSensorInfo[sensor_handle];
321             // Check if there is a pending flush_complete event for this sensor on this connection.
322             if (buffer[i].type == SENSOR_TYPE_META_DATA && flushInfo.mFirstFlushPending == true &&
323                     mapFlushEventsToConnections[i] == this) {
324                 flushInfo.mFirstFlushPending = false;
325                 ALOGD_IF(DEBUG_CONNECTIONS, "First flush event for sensor==%d ",
326                         buffer[i].meta_data.sensor);
327                 ++i;
328                 continue;
329             }
330 
331             // If there is a pending flush complete event for this sensor on this connection,
332             // ignore the event and proceed to the next.
333             if (flushInfo.mFirstFlushPending) {
334                 ++i;
335                 continue;
336             }
337 
338             do {
339                 // Keep copying events into the scratch buffer as long as they are regular
340                 // sensor_events are from the same sensor_handle OR they are flush_complete_events
341                 // from the same sensor_handle AND the current connection is mapped to the
342                 // corresponding flush_complete_event.
343                 if (buffer[i].type == SENSOR_TYPE_META_DATA) {
344                     if (mapFlushEventsToConnections[i] == this) {
345                         scratch[count++] = buffer[i];
346                     }
347                 } else {
348                     // Regular sensor event, just copy it to the scratch buffer after checking
349                     // the AppOp.
350                     if (hasSensorAccess() && noteOpIfRequired(buffer[i])) {
351                         scratch[count++] = buffer[i];
352                     }
353                 }
354                 i++;
355             } while ((i<numEvents) && ((buffer[i].sensor == sensor_handle &&
356                                         buffer[i].type != SENSOR_TYPE_META_DATA) ||
357                                        (buffer[i].type == SENSOR_TYPE_META_DATA  &&
358                                         buffer[i].meta_data.sensor == sensor_handle)));
359         }
360     } else {
361         if (hasSensorAccess()) {
362             scratch = const_cast<sensors_event_t *>(buffer);
363             count = numEvents;
364         } else {
365             sanitizedBuffer.reset(new sensors_event_t[numEvents]);
366             scratch = sanitizedBuffer.get();
367             for (size_t i = 0; i < numEvents; i++) {
368                 if (buffer[i].type == SENSOR_TYPE_META_DATA) {
369                     scratch[count++] = buffer[i++];
370                 }
371             }
372         }
373     }
374 
375     sendPendingFlushEventsLocked();
376     // Early return if there are no events for this connection.
377     if (count == 0) {
378         return status_t(NO_ERROR);
379     }
380 
381 #if DEBUG_CONNECTIONS
382      mEventsReceived += count;
383 #endif
384     if (mCacheSize != 0) {
385         // There are some events in the cache which need to be sent first. Copy this buffer to
386         // the end of cache.
387         appendEventsToCacheLocked(scratch, count);
388         return status_t(NO_ERROR);
389     }
390 
391     int index_wake_up_event = -1;
392     if (hasSensorAccess()) {
393         index_wake_up_event = findWakeUpSensorEventLocked(scratch, count);
394         if (index_wake_up_event >= 0) {
395             scratch[index_wake_up_event].flags |= WAKE_UP_SENSOR_EVENT_NEEDS_ACK;
396             ++mWakeLockRefCount;
397 #if DEBUG_CONNECTIONS
398             ++mTotalAcksNeeded;
399 #endif
400         }
401     }
402 
403     // NOTE: ASensorEvent and sensors_event_t are the same type.
404     ssize_t size = SensorEventQueue::write(mChannel,
405                                     reinterpret_cast<ASensorEvent const*>(scratch), count);
406     if (size < 0) {
407         // Write error, copy events to local cache.
408         if (index_wake_up_event >= 0) {
409             // If there was a wake_up sensor_event, reset the flag.
410             scratch[index_wake_up_event].flags &= ~WAKE_UP_SENSOR_EVENT_NEEDS_ACK;
411             if (mWakeLockRefCount > 0) {
412                 --mWakeLockRefCount;
413             }
414 #if DEBUG_CONNECTIONS
415             --mTotalAcksNeeded;
416 #endif
417         }
418         if (mEventCache == nullptr) {
419             mMaxCacheSize = computeMaxCacheSizeLocked();
420             mEventCache = new sensors_event_t[mMaxCacheSize];
421             mCacheSize = 0;
422         }
423         // Save the events so that they can be written later
424         appendEventsToCacheLocked(scratch, count);
425 
426         // Add this file descriptor to the looper to get a callback when this fd is available for
427         // writing.
428         updateLooperRegistrationLocked(mService->getLooper());
429         return size;
430     }
431 
432 #if DEBUG_CONNECTIONS
433     if (size > 0) {
434         mEventsSent += count;
435     }
436 #endif
437 
438     return size < 0 ? status_t(size) : status_t(NO_ERROR);
439 }
440 
hasSensorAccess()441 bool SensorService::SensorEventConnection::hasSensorAccess() {
442     return mService->isUidActive(mUid)
443         && !mService->mSensorPrivacyPolicy->isSensorPrivacyEnabled();
444 }
445 
noteOpIfRequired(const sensors_event_t & event)446 bool SensorService::SensorEventConnection::noteOpIfRequired(const sensors_event_t& event) {
447     bool success = true;
448     const auto iter = mHandleToAppOp.find(event.sensor);
449     if (iter != mHandleToAppOp.end()) {
450         if (mTargetSdk == kTargetSdkUnknown) {
451             // getTargetSdkVersion returns -1 if it fails so this operation should only be run once
452             // per connection and then cached. Perform this here as opposed to in the constructor to
453             // avoid log spam for NDK/VNDK clients that don't use sensors guarded with permissions
454             // and pass in invalid op package names.
455             mTargetSdk = SensorService::getTargetSdkVersion(mOpPackageName);
456         }
457 
458         // Special handling for step count/detect backwards compatibility: if the app's target SDK
459         // is pre-Q, still permit delivering events to the app even if permission isn't granted
460         // (since this permission was only introduced in Q)
461         if ((event.type == SENSOR_TYPE_STEP_COUNTER || event.type == SENSOR_TYPE_STEP_DETECTOR) &&
462                 mTargetSdk > 0 && mTargetSdk <= __ANDROID_API_P__) {
463             success = true;
464         } else {
465             int32_t sensorHandle = event.sensor;
466             String16 noteMsg("Sensor event (");
467             noteMsg.append(String16(mService->getSensorStringType(sensorHandle)));
468             noteMsg.append(String16(")"));
469             int32_t appOpMode = mService->sAppOpsManager.noteOp(iter->second, mUid,
470                                                                 mOpPackageName, mAttributionTag,
471                                                                 noteMsg);
472             success = (appOpMode == AppOpsManager::MODE_ALLOWED);
473         }
474     }
475     return success;
476 }
477 
reAllocateCacheLocked(sensors_event_t const * scratch,int count)478 void SensorService::SensorEventConnection::reAllocateCacheLocked(sensors_event_t const* scratch,
479                                                                  int count) {
480     sensors_event_t *eventCache_new;
481     const int new_cache_size = computeMaxCacheSizeLocked();
482     // Allocate new cache, copy over events from the old cache & scratch, free up memory.
483     eventCache_new = new sensors_event_t[new_cache_size];
484     memcpy(eventCache_new, mEventCache, mCacheSize * sizeof(sensors_event_t));
485     memcpy(&eventCache_new[mCacheSize], scratch, count * sizeof(sensors_event_t));
486 
487     ALOGD_IF(DEBUG_CONNECTIONS, "reAllocateCacheLocked maxCacheSize=%d %d", mMaxCacheSize,
488             new_cache_size);
489 
490     delete[] mEventCache;
491     mEventCache = eventCache_new;
492     mCacheSize += count;
493     mMaxCacheSize = new_cache_size;
494 }
495 
appendEventsToCacheLocked(sensors_event_t const * events,int count)496 void SensorService::SensorEventConnection::appendEventsToCacheLocked(sensors_event_t const* events,
497                                                                      int count) {
498     if (count <= 0) {
499         return;
500     } else if (mCacheSize + count <= mMaxCacheSize) {
501         // The events fit within the current cache: add them
502         memcpy(&mEventCache[mCacheSize], events, count * sizeof(sensors_event_t));
503         mCacheSize += count;
504     } else if (mCacheSize + count <= computeMaxCacheSizeLocked()) {
505         // The events fit within a resized cache: resize the cache and add the events
506         reAllocateCacheLocked(events, count);
507     } else {
508         // The events do not fit within the cache: drop the oldest events.
509         int freeSpace = mMaxCacheSize - mCacheSize;
510 
511         // Drop up to the currently cached number of events to make room for new events
512         int cachedEventsToDrop = std::min(mCacheSize, count - freeSpace);
513 
514         // New events need to be dropped if there are more new events than the size of the cache
515         int newEventsToDrop = std::max(0, count - mMaxCacheSize);
516 
517         // Determine the number of new events to copy into the cache
518         int eventsToCopy = std::min(mMaxCacheSize, count);
519 
520         constexpr nsecs_t kMinimumTimeBetweenDropLogNs = 2 * 1000 * 1000 * 1000; // 2 sec
521         if (events[0].timestamp - mTimeOfLastEventDrop > kMinimumTimeBetweenDropLogNs) {
522             ALOGW("Dropping %d cached events (%d/%d) to save %d/%d new events. %d events previously"
523                     " dropped", cachedEventsToDrop, mCacheSize, mMaxCacheSize, eventsToCopy,
524                     count, mEventsDropped);
525             mEventsDropped = 0;
526             mTimeOfLastEventDrop = events[0].timestamp;
527         } else {
528             // Record the number dropped
529             mEventsDropped += cachedEventsToDrop + newEventsToDrop;
530         }
531 
532         // Check for any flush complete events in the events that will be dropped
533         countFlushCompleteEventsLocked(mEventCache, cachedEventsToDrop);
534         countFlushCompleteEventsLocked(events, newEventsToDrop);
535 
536         // Only shift the events if they will not all be overwritten
537         if (eventsToCopy != mMaxCacheSize) {
538             memmove(mEventCache, &mEventCache[cachedEventsToDrop],
539                     (mCacheSize - cachedEventsToDrop) * sizeof(sensors_event_t));
540         }
541         mCacheSize -= cachedEventsToDrop;
542 
543         // Copy the events into the cache
544         memcpy(&mEventCache[mCacheSize], &events[newEventsToDrop],
545                 eventsToCopy * sizeof(sensors_event_t));
546         mCacheSize += eventsToCopy;
547     }
548 }
549 
sendPendingFlushEventsLocked()550 void SensorService::SensorEventConnection::sendPendingFlushEventsLocked() {
551     ASensorEvent flushCompleteEvent;
552     memset(&flushCompleteEvent, 0, sizeof(flushCompleteEvent));
553     flushCompleteEvent.type = SENSOR_TYPE_META_DATA;
554     // Loop through all the sensors for this connection and check if there are any pending
555     // flush complete events to be sent.
556     for (auto& it : mSensorInfo) {
557         const int handle = it.first;
558         sp<SensorInterface> si = mService->getSensorInterfaceFromHandle(handle);
559         if (si == nullptr) {
560             continue;
561         }
562 
563         FlushInfo& flushInfo = it.second;
564         while (flushInfo.mPendingFlushEventsToSend > 0) {
565             flushCompleteEvent.meta_data.sensor = handle;
566             bool wakeUpSensor = si->getSensor().isWakeUpSensor();
567             if (wakeUpSensor) {
568                ++mWakeLockRefCount;
569                flushCompleteEvent.flags |= WAKE_UP_SENSOR_EVENT_NEEDS_ACK;
570             }
571             ssize_t size = SensorEventQueue::write(mChannel, &flushCompleteEvent, 1);
572             if (size < 0) {
573                 if (wakeUpSensor) --mWakeLockRefCount;
574                 return;
575             }
576             ALOGD_IF(DEBUG_CONNECTIONS, "sent dropped flush complete event==%d ",
577                     flushCompleteEvent.meta_data.sensor);
578             flushInfo.mPendingFlushEventsToSend--;
579         }
580     }
581 }
582 
writeToSocketFromCache()583 void SensorService::SensorEventConnection::writeToSocketFromCache() {
584     // At a time write at most half the size of the receiver buffer in SensorEventQueue OR
585     // half the size of the socket buffer allocated in BitTube whichever is smaller.
586     const int maxWriteSize = helpers::min(SensorEventQueue::MAX_RECEIVE_BUFFER_EVENT_COUNT/2,
587             int(mService->mSocketBufferSize/(sizeof(sensors_event_t)*2)));
588     Mutex::Autolock _l(mConnectionLock);
589     // Send pending flush complete events (if any)
590     sendPendingFlushEventsLocked();
591     for (int numEventsSent = 0; numEventsSent < mCacheSize;) {
592         const int numEventsToWrite = helpers::min(mCacheSize - numEventsSent, maxWriteSize);
593         int index_wake_up_event = -1;
594         if (hasSensorAccess()) {
595             index_wake_up_event =
596                       findWakeUpSensorEventLocked(mEventCache + numEventsSent, numEventsToWrite);
597             if (index_wake_up_event >= 0) {
598                 mEventCache[index_wake_up_event + numEventsSent].flags |=
599                         WAKE_UP_SENSOR_EVENT_NEEDS_ACK;
600                 ++mWakeLockRefCount;
601 #if DEBUG_CONNECTIONS
602                 ++mTotalAcksNeeded;
603 #endif
604             }
605         }
606 
607         ssize_t size = SensorEventQueue::write(mChannel,
608                           reinterpret_cast<ASensorEvent const*>(mEventCache + numEventsSent),
609                           numEventsToWrite);
610         if (size < 0) {
611             if (index_wake_up_event >= 0) {
612                 // If there was a wake_up sensor_event, reset the flag.
613                 mEventCache[index_wake_up_event + numEventsSent].flags  &=
614                         ~WAKE_UP_SENSOR_EVENT_NEEDS_ACK;
615                 if (mWakeLockRefCount > 0) {
616                     --mWakeLockRefCount;
617                 }
618 #if DEBUG_CONNECTIONS
619                 --mTotalAcksNeeded;
620 #endif
621             }
622             memmove(mEventCache, &mEventCache[numEventsSent],
623                                  (mCacheSize - numEventsSent) * sizeof(sensors_event_t));
624             ALOGD_IF(DEBUG_CONNECTIONS, "wrote %d events from cache size==%d ",
625                     numEventsSent, mCacheSize);
626             mCacheSize -= numEventsSent;
627             return;
628         }
629         numEventsSent += numEventsToWrite;
630 #if DEBUG_CONNECTIONS
631         mEventsSentFromCache += numEventsToWrite;
632 #endif
633     }
634     ALOGD_IF(DEBUG_CONNECTIONS, "wrote all events from cache size=%d ", mCacheSize);
635     // All events from the cache have been sent. Reset cache size to zero.
636     mCacheSize = 0;
637     // There are no more events in the cache. We don't need to poll for write on the fd.
638     // Update Looper registration.
639     updateLooperRegistrationLocked(mService->getLooper());
640 }
641 
countFlushCompleteEventsLocked(sensors_event_t const * scratch,const int numEventsDropped)642 void SensorService::SensorEventConnection::countFlushCompleteEventsLocked(
643                 sensors_event_t const* scratch, const int numEventsDropped) {
644     ALOGD_IF(DEBUG_CONNECTIONS, "dropping %d events ", numEventsDropped);
645     // Count flushComplete events in the events that are about to the dropped. These will be sent
646     // separately before the next batch of events.
647     for (int j = 0; j < numEventsDropped; ++j) {
648         if (scratch[j].type == SENSOR_TYPE_META_DATA) {
649             if (mSensorInfo.count(scratch[j].meta_data.sensor) == 0) {
650                 ALOGW("%s: sensor 0x%x is not found in connection",
651                       __func__, scratch[j].meta_data.sensor);
652                 continue;
653             }
654 
655             FlushInfo& flushInfo = mSensorInfo[scratch[j].meta_data.sensor];
656             flushInfo.mPendingFlushEventsToSend++;
657             ALOGD_IF(DEBUG_CONNECTIONS, "increment pendingFlushCount %d",
658                      flushInfo.mPendingFlushEventsToSend);
659         }
660     }
661     return;
662 }
663 
findWakeUpSensorEventLocked(sensors_event_t const * scratch,const int count)664 int SensorService::SensorEventConnection::findWakeUpSensorEventLocked(
665                        sensors_event_t const* scratch, const int count) {
666     for (int i = 0; i < count; ++i) {
667         if (mService->isWakeUpSensorEvent(scratch[i])) {
668             return i;
669         }
670     }
671     return -1;
672 }
673 
getSensorChannel() const674 sp<BitTube> SensorService::SensorEventConnection::getSensorChannel() const
675 {
676     return mChannel;
677 }
678 
enableDisable(int handle,bool enabled,nsecs_t samplingPeriodNs,nsecs_t maxBatchReportLatencyNs,int reservedFlags)679 status_t SensorService::SensorEventConnection::enableDisable(
680         int handle, bool enabled, nsecs_t samplingPeriodNs, nsecs_t maxBatchReportLatencyNs,
681         int reservedFlags)
682 {
683     if (mDestroyed) {
684         android_errorWriteLog(0x534e4554, "168211968");
685         return DEAD_OBJECT;
686     }
687 
688     status_t err;
689     if (enabled) {
690         nsecs_t requestedSamplingPeriodNs = samplingPeriodNs;
691         bool isSensorCapped = false;
692         sp<SensorInterface> si = mService->getSensorInterfaceFromHandle(handle);
693         if (si != nullptr) {
694             const Sensor& s = si->getSensor();
695             if (mService->isSensorInCappedSet(s.getType())) {
696                 isSensorCapped = true;
697             }
698         }
699         if (isSensorCapped) {
700             err = mService->adjustSamplingPeriodBasedOnMicAndPermission(&samplingPeriodNs,
701                                 String16(mOpPackageName));
702             if (err != OK) {
703                 return err;
704             }
705         }
706         err = mService->enable(this, handle, samplingPeriodNs, maxBatchReportLatencyNs,
707                                reservedFlags, mOpPackageName);
708         if (err == OK && isSensorCapped) {
709             if (!mIsRateCappedBasedOnPermission ||
710                         requestedSamplingPeriodNs >= SENSOR_SERVICE_CAPPED_SAMPLING_PERIOD_NS) {
711                 mMicSamplingPeriodBackup[handle] = requestedSamplingPeriodNs;
712             } else {
713                 mMicSamplingPeriodBackup[handle] = SENSOR_SERVICE_CAPPED_SAMPLING_PERIOD_NS;
714             }
715         }
716 
717     } else {
718         err = mService->disable(this, handle);
719         mMicSamplingPeriodBackup.erase(handle);
720     }
721     return err;
722 }
723 
setEventRate(int handle,nsecs_t samplingPeriodNs)724 status_t SensorService::SensorEventConnection::setEventRate(int handle, nsecs_t samplingPeriodNs) {
725     if (mDestroyed) {
726         android_errorWriteLog(0x534e4554, "168211968");
727         return DEAD_OBJECT;
728     }
729 
730     nsecs_t requestedSamplingPeriodNs = samplingPeriodNs;
731     bool isSensorCapped = false;
732     sp<SensorInterface> si = mService->getSensorInterfaceFromHandle(handle);
733     if (si != nullptr) {
734         const Sensor& s = si->getSensor();
735         if (mService->isSensorInCappedSet(s.getType())) {
736             isSensorCapped = true;
737         }
738     }
739     if (isSensorCapped) {
740         status_t err = mService->adjustSamplingPeriodBasedOnMicAndPermission(&samplingPeriodNs,
741                             String16(mOpPackageName));
742         if (err != OK) {
743             return err;
744         }
745     }
746     status_t ret = mService->setEventRate(this, handle, samplingPeriodNs, mOpPackageName);
747     if (ret == OK && isSensorCapped) {
748         if (!mIsRateCappedBasedOnPermission ||
749                     requestedSamplingPeriodNs >= SENSOR_SERVICE_CAPPED_SAMPLING_PERIOD_NS) {
750             mMicSamplingPeriodBackup[handle] = requestedSamplingPeriodNs;
751         } else {
752             mMicSamplingPeriodBackup[handle] = SENSOR_SERVICE_CAPPED_SAMPLING_PERIOD_NS;
753         }
754     }
755     return ret;
756 }
757 
onMicSensorAccessChanged(bool isMicToggleOn)758 void SensorService::SensorEventConnection::onMicSensorAccessChanged(bool isMicToggleOn) {
759     if (isMicToggleOn) {
760         capRates();
761     } else {
762         uncapRates();
763     }
764 }
765 
capRates()766 void SensorService::SensorEventConnection::capRates() {
767     Mutex::Autolock _l(mConnectionLock);
768     SensorDevice& dev(SensorDevice::getInstance());
769     for (auto &i : mMicSamplingPeriodBackup) {
770         int handle = i.first;
771         nsecs_t samplingPeriodNs = i.second;
772         if (samplingPeriodNs < SENSOR_SERVICE_CAPPED_SAMPLING_PERIOD_NS) {
773             if (hasSensorAccess()) {
774                 mService->setEventRate(this, handle, SENSOR_SERVICE_CAPPED_SAMPLING_PERIOD_NS,
775                                        mOpPackageName);
776             } else {
777                 // Update SensorDevice with the capped rate so that when sensor access is restored,
778                 // the correct event rate is used.
779                 dev.onMicSensorAccessChanged(this, handle,
780                                              SENSOR_SERVICE_CAPPED_SAMPLING_PERIOD_NS);
781             }
782         }
783     }
784 }
785 
uncapRates()786 void SensorService::SensorEventConnection::uncapRates() {
787     Mutex::Autolock _l(mConnectionLock);
788     SensorDevice& dev(SensorDevice::getInstance());
789     for (auto &i : mMicSamplingPeriodBackup) {
790         int handle = i.first;
791         nsecs_t samplingPeriodNs = i.second;
792         if (samplingPeriodNs < SENSOR_SERVICE_CAPPED_SAMPLING_PERIOD_NS) {
793             if (hasSensorAccess()) {
794                 mService->setEventRate(this, handle, samplingPeriodNs, mOpPackageName);
795             } else {
796                 // Update SensorDevice with the uncapped rate so that when sensor access is
797                 // restored, the correct event rate is used.
798                 dev.onMicSensorAccessChanged(this, handle, samplingPeriodNs);
799             }
800         }
801     }
802 }
803 
flush()804 status_t  SensorService::SensorEventConnection::flush() {
805     if (mDestroyed) {
806         return DEAD_OBJECT;
807     }
808 
809     return  mService->flushSensor(this, mOpPackageName);
810 }
811 
configureChannel(int handle,int rateLevel)812 int32_t SensorService::SensorEventConnection::configureChannel(int handle, int rateLevel) {
813     // SensorEventConnection does not support configureChannel, parameters not used
814     UNUSED(handle);
815     UNUSED(rateLevel);
816     return INVALID_OPERATION;
817 }
818 
handleEvent(int fd,int events,void *)819 int SensorService::SensorEventConnection::handleEvent(int fd, int events, void* /*data*/) {
820     if (events & ALOOPER_EVENT_HANGUP || events & ALOOPER_EVENT_ERROR) {
821         {
822             // If the Looper encounters some error, set the flag mDead, reset mWakeLockRefCount,
823             // and remove the fd from Looper. Call checkWakeLockState to know if SensorService
824             // can release the wake-lock.
825             ALOGD_IF(DEBUG_CONNECTIONS, "%p Looper error %d", this, fd);
826             Mutex::Autolock _l(mConnectionLock);
827             mDead = true;
828             mWakeLockRefCount = 0;
829             updateLooperRegistrationLocked(mService->getLooper());
830         }
831         mService->checkWakeLockState();
832         if (mDataInjectionMode) {
833             // If the Looper has encountered some error in data injection mode, reset SensorService
834             // back to normal mode.
835             mService->resetToNormalMode();
836             mDataInjectionMode = false;
837         }
838         return 1;
839     }
840 
841     if (events & ALOOPER_EVENT_INPUT) {
842         unsigned char buf[sizeof(sensors_event_t)];
843         ssize_t numBytesRead = ::recv(fd, buf, sizeof(buf), MSG_DONTWAIT);
844         {
845             Mutex::Autolock _l(mConnectionLock);
846             if (numBytesRead == sizeof(sensors_event_t)) {
847                 if (!mDataInjectionMode) {
848                     ALOGE("Data injected in normal mode, dropping event"
849                           "package=%s uid=%d", mPackageName.string(), mUid);
850                     // Unregister call backs.
851                     return 0;
852                 }
853                 sensors_event_t sensor_event;
854                 memcpy(&sensor_event, buf, sizeof(sensors_event_t));
855                 sp<SensorInterface> si =
856                         mService->getSensorInterfaceFromHandle(sensor_event.sensor);
857                 if (si == nullptr) {
858                     return 1;
859                 }
860 
861                 SensorDevice& dev(SensorDevice::getInstance());
862                 sensor_event.type = si->getSensor().getType();
863                 dev.injectSensorData(&sensor_event);
864 #if DEBUG_CONNECTIONS
865                 ++mEventsReceived;
866 #endif
867             } else if (numBytesRead == sizeof(uint32_t)) {
868                 uint32_t numAcks = 0;
869                 memcpy(&numAcks, buf, numBytesRead);
870                 // Sanity check to ensure  there are no read errors in recv, numAcks is always
871                 // within the range and not zero. If any of the above don't hold reset
872                 // mWakeLockRefCount to zero.
873                 if (numAcks > 0 && numAcks < mWakeLockRefCount) {
874                     mWakeLockRefCount -= numAcks;
875                 } else {
876                     mWakeLockRefCount = 0;
877                 }
878 #if DEBUG_CONNECTIONS
879                 mTotalAcksReceived += numAcks;
880 #endif
881            } else {
882                // Read error, reset wakelock refcount.
883                mWakeLockRefCount = 0;
884            }
885         }
886         // Check if wakelock can be released by sensorservice. mConnectionLock needs to be released
887         // here as checkWakeLockState() will need it.
888         if (mWakeLockRefCount == 0) {
889             mService->checkWakeLockState();
890         }
891         // continue getting callbacks.
892         return 1;
893     }
894 
895     if (events & ALOOPER_EVENT_OUTPUT) {
896         // send sensor data that is stored in mEventCache for this connection.
897         mService->sendEventsFromCache(this);
898     }
899     return 1;
900 }
901 
computeMaxCacheSizeLocked() const902 int SensorService::SensorEventConnection::computeMaxCacheSizeLocked() const {
903     size_t fifoWakeUpSensors = 0;
904     size_t fifoNonWakeUpSensors = 0;
905     for (auto& it : mSensorInfo) {
906         sp<SensorInterface> si = mService->getSensorInterfaceFromHandle(it.first);
907         if (si == nullptr) {
908             continue;
909         }
910         const Sensor& sensor = si->getSensor();
911         if (sensor.getFifoReservedEventCount() == sensor.getFifoMaxEventCount()) {
912             // Each sensor has a reserved fifo. Sum up the fifo sizes for all wake up sensors and
913             // non wake_up sensors.
914             if (sensor.isWakeUpSensor()) {
915                 fifoWakeUpSensors += sensor.getFifoReservedEventCount();
916             } else {
917                 fifoNonWakeUpSensors += sensor.getFifoReservedEventCount();
918             }
919         } else {
920             // Shared fifo. Compute the max of the fifo sizes for wake_up and non_wake up sensors.
921             if (sensor.isWakeUpSensor()) {
922                 fifoWakeUpSensors = fifoWakeUpSensors > sensor.getFifoMaxEventCount() ?
923                                           fifoWakeUpSensors : sensor.getFifoMaxEventCount();
924 
925             } else {
926                 fifoNonWakeUpSensors = fifoNonWakeUpSensors > sensor.getFifoMaxEventCount() ?
927                                           fifoNonWakeUpSensors : sensor.getFifoMaxEventCount();
928 
929             }
930         }
931    }
932    if (fifoWakeUpSensors + fifoNonWakeUpSensors == 0) {
933        // It is extremely unlikely that there is a write failure in non batch mode. Return a cache
934        // size that is equal to that of the batch mode.
935        // ALOGW("Write failure in non-batch mode");
936        return MAX_SOCKET_BUFFER_SIZE_BATCHED/sizeof(sensors_event_t);
937    }
938    return fifoWakeUpSensors + fifoNonWakeUpSensors;
939 }
940 
941 } // namespace android
942 
943