1 /*
2 * Copyright 2017, The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 //#define LOG_NDEBUG 0
18 #define LOG_TAG "MediaDescrambler-JNI"
19 #include <utils/Log.h>
20
21 #include "android_media_MediaDescrambler.h"
22 #include "android_runtime/AndroidRuntime.h"
23 #include "android_os_HwRemoteBinder.h"
24 #include <nativehelper/JNIHelp.h>
25
26 #include <android/hardware/cas/native/1.0/BpHwDescrambler.h>
27 #include <android/hardware/cas/native/1.0/BnHwDescrambler.h>
28 #include <android/hardware/cas/native/1.0/IDescrambler.h>
29 #include <binder/MemoryDealer.h>
30 #include <hidl/HidlSupport.h>
31 #include <hidlmemory/FrameworkUtils.h>
32 #include <media/stagefright/foundation/ADebug.h>
33 #include <media/cas/DescramblerAPI.h>
34 #include <nativehelper/ScopedLocalRef.h>
35
36 namespace android {
37 class IMemory;
38 class MemoryDealer;
39
40 namespace hardware {
41 class HidlMemory;
42 };
43 using hardware::fromHeap;
44 using hardware::HidlMemory;
45 using hardware::hidl_string;
46 using hardware::hidl_vec;
47 using namespace hardware::cas::V1_0;
48 using namespace hardware::cas::native::V1_0;
49
50 struct JDescrambler : public RefBase {
51 JDescrambler(JNIEnv *env, jobject descramberBinderObj);
52
53 status_t descramble(
54 uint32_t key,
55 ssize_t totalLength,
56 const hidl_vec<SubSample>& subSamples,
57 const void *srcPtr,
58 jint srcOffset,
59 void *dstPtr,
60 jint dstOffset,
61 Status *status,
62 uint32_t *bytesWritten,
63 hidl_string *detailedError);
64
65
66 protected:
67 virtual ~JDescrambler();
68
69 private:
70 sp<IDescrambler> mDescrambler;
71 sp<IMemory> mMem;
72 sp<MemoryDealer> mDealer;
73 sp<HidlMemory> mHidlMemory;
74 SharedBuffer mDescramblerSrcBuffer;
75
76 Mutex mSharedMemLock;
77
78 bool ensureBufferCapacity(size_t neededSize);
79
80 DISALLOW_EVIL_CONSTRUCTORS(JDescrambler);
81 };
82
83 struct fields_t {
84 jfieldID context;
85 jbyte flagPesHeader;
86 };
87
88 static fields_t gFields;
89
getDescrambler(JNIEnv * env,jobject thiz)90 static sp<JDescrambler> getDescrambler(JNIEnv *env, jobject thiz) {
91 return (JDescrambler *)env->GetLongField(thiz, gFields.context);
92 }
93
setDescrambler(JNIEnv * env,jobject thiz,const sp<JDescrambler> & descrambler)94 static void setDescrambler(
95 JNIEnv *env, jobject thiz, const sp<JDescrambler> &descrambler) {
96 sp<JDescrambler> old = (JDescrambler *)env->GetLongField(thiz, gFields.context);
97 if (descrambler != NULL) {
98 descrambler->incStrong(thiz);
99 }
100 if (old != NULL) {
101 old->decStrong(thiz);
102 }
103 env->SetLongField(thiz, gFields.context, (jlong)descrambler.get());
104 }
105
getBufferAndSize(JNIEnv * env,jobject byteBuf,jint offset,jint limit,size_t length,void ** outPtr,jbyteArray * outByteArray)106 static status_t getBufferAndSize(
107 JNIEnv *env, jobject byteBuf, jint offset, jint limit, size_t length,
108 void **outPtr, jbyteArray *outByteArray) {
109 void *ptr = env->GetDirectBufferAddress(byteBuf);
110
111 jbyteArray byteArray = NULL;
112
113 ScopedLocalRef<jclass> byteBufClass(env, env->FindClass("java/nio/ByteBuffer"));
114 CHECK(byteBufClass.get() != NULL);
115
116 if (ptr == NULL) {
117 jmethodID arrayID =
118 env->GetMethodID(byteBufClass.get(), "array", "()[B");
119 CHECK(arrayID != NULL);
120
121 byteArray =
122 (jbyteArray)env->CallObjectMethod(byteBuf, arrayID);
123
124 if (byteArray == NULL) {
125 return INVALID_OPERATION;
126 }
127
128 jboolean isCopy;
129 ptr = env->GetByteArrayElements(byteArray, &isCopy);
130 }
131
132 if ((jint)length + offset > limit) {
133 if (byteArray != NULL) {
134 env->ReleaseByteArrayElements(byteArray, (jbyte *)ptr, 0);
135 }
136
137 return -ERANGE;
138 }
139
140 *outPtr = ptr;
141 *outByteArray = byteArray;
142
143 return OK;
144 }
145
JDescrambler(JNIEnv * env,jobject descramblerBinderObj)146 JDescrambler::JDescrambler(JNIEnv *env, jobject descramblerBinderObj) {
147 mDescrambler = GetDescrambler(env, descramblerBinderObj);
148 if (mDescrambler == NULL) {
149 jniThrowException(env, "java/lang/NullPointerException", NULL);
150 }
151 }
152
~JDescrambler()153 JDescrambler::~JDescrambler() {
154 // Don't call release() here, it's called by Java class
155 mDescrambler.clear();
156 mMem.clear();
157 mDealer.clear();
158 }
159
GetDescrambler(JNIEnv * env,jobject obj)160 sp<IDescrambler> GetDescrambler(JNIEnv *env, jobject obj) {
161 if (obj != NULL) {
162 sp<hardware::IBinder> hwBinder =
163 JHwRemoteBinder::GetNativeContext(env, obj)->getBinder();
164
165 if (hwBinder != NULL) {
166 return hardware::fromBinder<
167 IDescrambler, BpHwDescrambler, BnHwDescrambler>(hwBinder);
168 }
169 }
170 return NULL;
171 }
172
ensureBufferCapacity(size_t neededSize)173 bool JDescrambler::ensureBufferCapacity(size_t neededSize) {
174 if (mMem != NULL && mMem->size() >= neededSize) {
175 return true;
176 }
177
178 ALOGV("ensureBufferCapacity: current size %zu, new size %zu",
179 mMem == NULL ? 0 : mMem->size(), neededSize);
180
181 size_t alignment = MemoryDealer::getAllocationAlignment();
182 neededSize = (neededSize + (alignment - 1)) & ~(alignment - 1);
183 // Align to multiples of 64K.
184 neededSize = (neededSize + 65535) & ~65535;
185 mDealer = new MemoryDealer(neededSize, "JDescrambler");
186 mMem = mDealer->allocate(neededSize);
187
188 ssize_t offset;
189 size_t size;
190 sp<IMemoryHeap> heap = mMem->getMemory(&offset, &size);
191 if (heap == NULL) {
192 return false;
193 }
194
195 mHidlMemory = fromHeap(heap);
196 mDescramblerSrcBuffer.heapBase = *mHidlMemory;
197 mDescramblerSrcBuffer.offset = (uint64_t) offset;
198 mDescramblerSrcBuffer.size = (uint64_t) size;
199 return true;
200 }
201
descramble(uint32_t key,ssize_t totalLength,const hidl_vec<SubSample> & subSamples,const void * srcPtr,jint srcOffset,void * dstPtr,jint dstOffset,Status * status,uint32_t * bytesWritten,hidl_string * detailedError)202 status_t JDescrambler::descramble(
203 uint32_t key,
204 ssize_t totalLength,
205 const hidl_vec<SubSample>& subSamples,
206 const void *srcPtr,
207 jint srcOffset,
208 void *dstPtr,
209 jint dstOffset,
210 Status *status,
211 uint32_t *bytesWritten,
212 hidl_string *detailedError) {
213 // TODO: IDescrambler::descramble() is re-entrant, however because we
214 // only have 1 shared mem buffer, we can only do 1 descramble at a time.
215 // Concurrency might be improved by allowing on-demand allocation of up
216 // to 2 shared mem buffers.
217 Mutex::Autolock autolock(mSharedMemLock);
218
219 if (!ensureBufferCapacity(totalLength)) {
220 return NO_MEMORY;
221 }
222
223 memcpy(mMem->unsecurePointer(),
224 (const void*)((const uint8_t*)srcPtr + srcOffset), totalLength);
225
226 DestinationBuffer dstBuffer;
227 dstBuffer.type = BufferType::SHARED_MEMORY;
228 dstBuffer.nonsecureMemory = mDescramblerSrcBuffer;
229
230 auto err = mDescrambler->descramble(
231 (ScramblingControl) key,
232 subSamples,
233 mDescramblerSrcBuffer,
234 0,
235 dstBuffer,
236 0,
237 [&status, &bytesWritten, &detailedError] (
238 Status _status, uint32_t _bytesWritten,
239 const hidl_string& _detailedError) {
240 *status = _status;
241 *bytesWritten = _bytesWritten;
242 *detailedError = _detailedError;
243 });
244
245 if (!err.isOk()) {
246 return FAILED_TRANSACTION;
247 }
248
249 if (*status == Status::OK) {
250 if (*bytesWritten > 0 && (ssize_t) *bytesWritten <= totalLength) {
251 memcpy((void*)((uint8_t*)dstPtr + dstOffset), mMem->unsecurePointer(),
252 *bytesWritten);
253 } else {
254 // status seems OK but bytesWritten is invalid, we really
255 // have no idea what is wrong.
256 *status = Status::ERROR_CAS_UNKNOWN;
257 }
258 }
259 return OK;
260 }
261
262 } // namespace android
263
264 using namespace android;
265
android_media_MediaDescrambler_native_release(JNIEnv * env,jobject thiz)266 static void android_media_MediaDescrambler_native_release(JNIEnv *env, jobject thiz) {
267 setDescrambler(env, thiz, NULL);
268 }
269
android_media_MediaDescrambler_native_init(JNIEnv * env)270 static void android_media_MediaDescrambler_native_init(JNIEnv *env) {
271 ScopedLocalRef<jclass> clazz(
272 env, env->FindClass("android/media/MediaDescrambler"));
273 CHECK(clazz.get() != NULL);
274
275 gFields.context = env->GetFieldID(clazz.get(), "mNativeContext", "J");
276 CHECK(gFields.context != NULL);
277
278 jfieldID fieldPesHeader = env->GetStaticFieldID(
279 clazz.get(), "SCRAMBLE_FLAG_PES_HEADER", "B");
280 CHECK(fieldPesHeader != NULL);
281
282 gFields.flagPesHeader = env->GetStaticByteField(clazz.get(), fieldPesHeader);
283 }
284
android_media_MediaDescrambler_native_setup(JNIEnv * env,jobject thiz,jobject descramblerBinderObj)285 static void android_media_MediaDescrambler_native_setup(
286 JNIEnv *env, jobject thiz, jobject descramblerBinderObj) {
287 setDescrambler(env, thiz, new JDescrambler(env, descramblerBinderObj));
288 }
289
getSubSampleInfo(JNIEnv * env,jint numSubSamples,jintArray numBytesOfClearDataObj,jintArray numBytesOfEncryptedDataObj,hidl_vec<SubSample> * outSubSamples)290 static ssize_t getSubSampleInfo(JNIEnv *env, jint numSubSamples,
291 jintArray numBytesOfClearDataObj, jintArray numBytesOfEncryptedDataObj,
292 hidl_vec<SubSample> *outSubSamples) {
293
294 if (numSubSamples <= 0 ||
295 numSubSamples >= (signed)(INT32_MAX / sizeof(SubSample))) {
296 // subSamples array may silently overflow if number of samples are
297 // too large. Use INT32_MAX as maximum allocation size may be less
298 // than SIZE_MAX on some platforms.
299 ALOGE("numSubSamples is invalid!");
300 return -1;
301 }
302
303 jboolean isCopy;
304 ssize_t totalSize = 0;
305
306 jint *numBytesOfClearData =
307 (numBytesOfClearDataObj == NULL)
308 ? NULL
309 : env->GetIntArrayElements(numBytesOfClearDataObj, &isCopy);
310
311 jint *numBytesOfEncryptedData =
312 (numBytesOfEncryptedDataObj == NULL)
313 ? NULL
314 : env->GetIntArrayElements(numBytesOfEncryptedDataObj, &isCopy);
315
316 outSubSamples->resize(numSubSamples);
317 SubSample *subSamples = outSubSamples->data();
318 if (subSamples == NULL) {
319 ALOGE("Failed to allocate SubSample array!");
320 return -1;
321 }
322
323 for (jint i = 0; i < numSubSamples; ++i) {
324 subSamples[i].numBytesOfClearData =
325 (numBytesOfClearData == NULL) ? 0 : numBytesOfClearData[i];
326
327 subSamples[i].numBytesOfEncryptedData =
328 (numBytesOfEncryptedData == NULL)
329 ? 0 : numBytesOfEncryptedData[i];
330
331 totalSize += subSamples[i].numBytesOfClearData +
332 subSamples[i].numBytesOfEncryptedData;
333 }
334
335 if (numBytesOfEncryptedData != NULL) {
336 env->ReleaseIntArrayElements(
337 numBytesOfEncryptedDataObj, numBytesOfEncryptedData, 0);
338 numBytesOfEncryptedData = NULL;
339 }
340
341 if (numBytesOfClearData != NULL) {
342 env->ReleaseIntArrayElements(
343 numBytesOfClearDataObj, numBytesOfClearData, 0);
344 numBytesOfClearData = NULL;
345 }
346
347 if (totalSize < 0) {
348 return -1;
349 }
350
351 return totalSize;
352 }
353
createServiceSpecificException(JNIEnv * env,int serviceSpecificError,const char * msg)354 static jthrowable createServiceSpecificException(
355 JNIEnv *env, int serviceSpecificError, const char *msg) {
356 if (env->ExceptionCheck()) {
357 ALOGW("Discarding pending exception");
358 env->ExceptionDescribe();
359 env->ExceptionClear();
360 }
361
362 ScopedLocalRef<jclass> clazz(
363 env, env->FindClass("android/os/ServiceSpecificException"));
364 CHECK(clazz.get() != NULL);
365
366 const jmethodID ctor = env->GetMethodID(clazz.get(), "<init>", "(ILjava/lang/String;)V");
367 CHECK(ctor != NULL);
368
369 ScopedLocalRef<jstring> msgObj(
370 env, env->NewStringUTF(msg != NULL ?
371 msg : String8::format("Error %#x", serviceSpecificError)));
372
373 return (jthrowable)env->NewObject(
374 clazz.get(), ctor, serviceSpecificError, msgObj.get());
375 }
376
android_media_MediaDescrambler_native_descramble(JNIEnv * env,jobject thiz,jbyte key,jbyte flags,jint numSubSamples,jintArray numBytesOfClearDataObj,jintArray numBytesOfEncryptedDataObj,jobject srcBuf,jint srcOffset,jint srcLimit,jobject dstBuf,jint dstOffset,jint dstLimit)377 static jint android_media_MediaDescrambler_native_descramble(
378 JNIEnv *env, jobject thiz, jbyte key, jbyte flags, jint numSubSamples,
379 jintArray numBytesOfClearDataObj, jintArray numBytesOfEncryptedDataObj,
380 jobject srcBuf, jint srcOffset, jint srcLimit,
381 jobject dstBuf, jint dstOffset, jint dstLimit) {
382 sp<JDescrambler> descrambler = getDescrambler(env, thiz);
383 if (descrambler == NULL) {
384 jniThrowException(env, "java/lang/IllegalStateException",
385 "Invalid descrambler object!");
386 return -1;
387 }
388
389 hidl_vec<SubSample> subSamples;
390 ssize_t totalLength = getSubSampleInfo(
391 env, numSubSamples, numBytesOfClearDataObj,
392 numBytesOfEncryptedDataObj, &subSamples);
393 if (totalLength < 0) {
394 jniThrowException(env, "java/lang/IllegalArgumentException",
395 "Invalid subsample info!");
396 return -1;
397 }
398
399 void *srcPtr = NULL, *dstPtr = NULL;
400 jbyteArray srcArray = NULL, dstArray = NULL;
401 status_t err = getBufferAndSize(
402 env, srcBuf, srcOffset, srcLimit, totalLength, &srcPtr, &srcArray);
403
404 if (err == OK) {
405 if (dstBuf == NULL) {
406 dstPtr = srcPtr;
407 } else {
408 err = getBufferAndSize(
409 env, dstBuf, dstOffset, dstLimit, totalLength, &dstPtr, &dstArray);
410 }
411 }
412
413 if (err != OK) {
414 jniThrowException(env, "java/lang/IllegalArgumentException",
415 "Invalid buffer offset and/or size for subsamples!");
416 return -1;
417 }
418
419 uint32_t scramblingControl = (uint32_t)key;
420
421 if (flags & gFields.flagPesHeader) {
422 scramblingControl |= DescramblerPlugin::kScrambling_Flag_PesHeader;
423 }
424
425 Status status;
426 uint32_t bytesWritten;
427 hidl_string detailedError;
428
429 err = descrambler->descramble(
430 scramblingControl, totalLength, subSamples,
431 srcPtr, srcOffset, dstPtr, dstOffset,
432 &status, &bytesWritten, &detailedError);
433
434 // Release byte array before throwing
435 if (srcArray != NULL) {
436 env->ReleaseByteArrayElements(srcArray, (jbyte *)srcPtr, 0);
437 }
438 if (dstArray != NULL) {
439 env->ReleaseByteArrayElements(dstArray, (jbyte *)dstPtr, 0);
440 }
441
442 if (err == NO_MEMORY) {
443 jniThrowException(env, "java/lang/OutOfMemoryError", NULL);
444 } else if (err == FAILED_TRANSACTION) {
445 jniThrowException(env, "android/os/RemoteException", NULL);
446 } else if (status != Status::OK) {
447 // Throw ServiceSpecific with cas error code and detailed msg,
448 // which will be re-thrown as MediaCasStateException.
449 env->Throw(createServiceSpecificException(
450 env, (int) status, detailedError.c_str()));
451 }
452 return bytesWritten;
453 }
454
455 static const JNINativeMethod gMethods[] = {
456 { "native_release", "()V",
457 (void *)android_media_MediaDescrambler_native_release },
458 { "native_init", "()V",
459 (void *)android_media_MediaDescrambler_native_init },
460 { "native_setup", "(Landroid/os/IHwBinder;)V",
461 (void *)android_media_MediaDescrambler_native_setup },
462 { "native_descramble", "(BBI[I[ILjava/nio/ByteBuffer;IILjava/nio/ByteBuffer;II)I",
463 (void *)android_media_MediaDescrambler_native_descramble },
464 };
465
register_android_media_Descrambler(JNIEnv * env)466 int register_android_media_Descrambler(JNIEnv *env) {
467 return AndroidRuntime::registerNativeMethods(env,
468 "android/media/MediaDescrambler", gMethods, NELEM(gMethods));
469 }
470
471