1 /*
2 * Copyright 2017, The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 //#define LOG_NDEBUG 0
18 #define LOG_TAG "MediaDescrambler-JNI"
19 #include <utils/Log.h>
20
21 #include "android_media_MediaDescrambler.h"
22 #include "android_runtime/AndroidRuntime.h"
23 #include "android_os_HwRemoteBinder.h"
24 #include "JNIHelp.h"
25
26 #include <android/hardware/cas/native/1.0/BpHwDescrambler.h>
27 #include <android/hardware/cas/native/1.0/BnHwDescrambler.h>
28 #include <binder/MemoryDealer.h>
29 #include <hidl/HidlSupport.h>
30 #include <media/stagefright/foundation/ADebug.h>
31 #include <nativehelper/ScopedLocalRef.h>
32
33 namespace android {
34
35 using hardware::hidl_handle;
36
37 struct fields_t {
38 jfieldID context;
39 };
40
41 static fields_t gFields;
42
getDescrambler(JNIEnv * env,jobject thiz)43 static sp<JDescrambler> getDescrambler(JNIEnv *env, jobject thiz) {
44 return (JDescrambler *)env->GetLongField(thiz, gFields.context);
45 }
46
setDescrambler(JNIEnv * env,jobject thiz,const sp<JDescrambler> & descrambler)47 static void setDescrambler(
48 JNIEnv *env, jobject thiz, const sp<JDescrambler> &descrambler) {
49 sp<JDescrambler> old = (JDescrambler *)env->GetLongField(thiz, gFields.context);
50 if (descrambler != NULL) {
51 descrambler->incStrong(thiz);
52 }
53 if (old != NULL) {
54 old->decStrong(thiz);
55 }
56 env->SetLongField(thiz, gFields.context, (jlong)descrambler.get());
57 }
58
getBufferAndSize(JNIEnv * env,jobject byteBuf,jint offset,jint limit,size_t length,void ** outPtr,jbyteArray * outByteArray)59 static status_t getBufferAndSize(
60 JNIEnv *env, jobject byteBuf, jint offset, jint limit, size_t length,
61 void **outPtr, jbyteArray *outByteArray) {
62 void *ptr = env->GetDirectBufferAddress(byteBuf);
63
64 jbyteArray byteArray = NULL;
65
66 ScopedLocalRef<jclass> byteBufClass(env, env->FindClass("java/nio/ByteBuffer"));
67 CHECK(byteBufClass.get() != NULL);
68
69 if (ptr == NULL) {
70 jmethodID arrayID =
71 env->GetMethodID(byteBufClass.get(), "array", "()[B");
72 CHECK(arrayID != NULL);
73
74 byteArray =
75 (jbyteArray)env->CallObjectMethod(byteBuf, arrayID);
76
77 if (byteArray == NULL) {
78 return INVALID_OPERATION;
79 }
80
81 jboolean isCopy;
82 ptr = env->GetByteArrayElements(byteArray, &isCopy);
83 }
84
85 if ((jint)length + offset > limit) {
86 if (byteArray != NULL) {
87 env->ReleaseByteArrayElements(byteArray, (jbyte *)ptr, 0);
88 }
89
90 return -ERANGE;
91 }
92
93 *outPtr = ptr;
94 *outByteArray = byteArray;
95
96 return OK;
97 }
98
JDescrambler(JNIEnv * env,jobject descramblerBinderObj)99 JDescrambler::JDescrambler(JNIEnv *env, jobject descramblerBinderObj) {
100 mDescrambler = GetDescrambler(env, descramblerBinderObj);
101 if (mDescrambler == NULL) {
102 jniThrowException(env, "java/lang/NullPointerException", NULL);
103 }
104 }
105
~JDescrambler()106 JDescrambler::~JDescrambler() {
107 // Don't call release() here, it's called by Java class
108 mDescrambler.clear();
109 mMem.clear();
110 mDealer.clear();
111 }
112
113 // static
GetDescrambler(JNIEnv * env,jobject obj)114 sp<IDescrambler> JDescrambler::GetDescrambler(JNIEnv *env, jobject obj) {
115 if (obj != NULL) {
116 sp<hardware::IBinder> hwBinder =
117 JHwRemoteBinder::GetNativeContext(env, obj)->getBinder();
118
119 if (hwBinder != NULL) {
120 return hardware::fromBinder<
121 IDescrambler, BpHwDescrambler, BnHwDescrambler>(hwBinder);
122 }
123 }
124 return NULL;
125 }
126
ensureBufferCapacity(size_t neededSize)127 bool JDescrambler::ensureBufferCapacity(size_t neededSize) {
128 if (mMem != NULL && mMem->size() >= neededSize) {
129 return true;
130 }
131
132 ALOGV("ensureBufferCapacity: current size %zu, new size %zu",
133 mMem == NULL ? 0 : mMem->size(), neededSize);
134
135 size_t alignment = MemoryDealer::getAllocationAlignment();
136 neededSize = (neededSize + (alignment - 1)) & ~(alignment - 1);
137 // Align to multiples of 64K.
138 neededSize = (neededSize + 65535) & ~65535;
139 mDealer = new MemoryDealer(neededSize, "JDescrambler");
140 mMem = mDealer->allocate(neededSize);
141
142 ssize_t offset;
143 size_t size;
144 sp<IMemoryHeap> heap = mMem->getMemory(&offset, &size);
145 if (heap == NULL) {
146 return false;
147 }
148
149 native_handle_t* nativeHandle = native_handle_create(1, 0);
150 if (!nativeHandle) {
151 ALOGE("ensureBufferCapacity: failed to create native handle");
152 return false;
153 }
154 nativeHandle->data[0] = heap->getHeapID();
155 mDescramblerSrcBuffer.heapBase = hidl_memory("ashmem",
156 hidl_handle(nativeHandle), heap->getSize());
157 mDescramblerSrcBuffer.offset = (uint64_t) offset;
158 mDescramblerSrcBuffer.size = (uint64_t) size;
159 return true;
160 }
161
descramble(jbyte key,ssize_t totalLength,const hidl_vec<SubSample> & subSamples,const void * srcPtr,jint srcOffset,void * dstPtr,jint dstOffset,Status * status,uint32_t * bytesWritten,hidl_string * detailedError)162 status_t JDescrambler::descramble(
163 jbyte key,
164 ssize_t totalLength,
165 const hidl_vec<SubSample>& subSamples,
166 const void *srcPtr,
167 jint srcOffset,
168 void *dstPtr,
169 jint dstOffset,
170 Status *status,
171 uint32_t *bytesWritten,
172 hidl_string *detailedError) {
173 // TODO: IDescrambler::descramble() is re-entrant, however because we
174 // only have 1 shared mem buffer, we can only do 1 descramble at a time.
175 // Concurrency might be improved by allowing on-demand allocation of up
176 // to 2 shared mem buffers.
177 Mutex::Autolock autolock(mSharedMemLock);
178
179 if (!ensureBufferCapacity(totalLength)) {
180 return NO_MEMORY;
181 }
182
183 memcpy(mMem->pointer(),
184 (const void*)((const uint8_t*)srcPtr + srcOffset), totalLength);
185
186 DestinationBuffer dstBuffer;
187 dstBuffer.type = BufferType::SHARED_MEMORY;
188 dstBuffer.nonsecureMemory = mDescramblerSrcBuffer;
189
190 auto err = mDescrambler->descramble(
191 (ScramblingControl) key,
192 subSamples,
193 mDescramblerSrcBuffer,
194 0,
195 dstBuffer,
196 0,
197 [&status, &bytesWritten, &detailedError] (
198 Status _status, uint32_t _bytesWritten,
199 const hidl_string& _detailedError) {
200 *status = _status;
201 *bytesWritten = _bytesWritten;
202 *detailedError = _detailedError;
203 });
204
205 if (!err.isOk()) {
206 return FAILED_TRANSACTION;
207 }
208
209 if (*status == Status::OK) {
210 if (*bytesWritten > 0 && (ssize_t) *bytesWritten <= totalLength) {
211 memcpy((void*)((uint8_t*)dstPtr + dstOffset), mMem->pointer(), *bytesWritten);
212 } else {
213 // status seems OK but bytesWritten is invalid, we really
214 // have no idea what is wrong.
215 *status = Status::ERROR_CAS_UNKNOWN;
216 }
217 }
218 return OK;
219 }
220
221 } // namespace android
222
223 using namespace android;
224
android_media_MediaDescrambler_native_release(JNIEnv * env,jobject thiz)225 static void android_media_MediaDescrambler_native_release(JNIEnv *env, jobject thiz) {
226 setDescrambler(env, thiz, NULL);
227 }
228
android_media_MediaDescrambler_native_init(JNIEnv * env)229 static void android_media_MediaDescrambler_native_init(JNIEnv *env) {
230 ScopedLocalRef<jclass> clazz(
231 env, env->FindClass("android/media/MediaDescrambler"));
232 CHECK(clazz.get() != NULL);
233
234 gFields.context = env->GetFieldID(clazz.get(), "mNativeContext", "J");
235 CHECK(gFields.context != NULL);
236 }
237
android_media_MediaDescrambler_native_setup(JNIEnv * env,jobject thiz,jobject descramblerBinderObj)238 static void android_media_MediaDescrambler_native_setup(
239 JNIEnv *env, jobject thiz, jobject descramblerBinderObj) {
240 setDescrambler(env, thiz, new JDescrambler(env, descramblerBinderObj));
241 }
242
getSubSampleInfo(JNIEnv * env,jint numSubSamples,jintArray numBytesOfClearDataObj,jintArray numBytesOfEncryptedDataObj,hidl_vec<SubSample> * outSubSamples)243 static ssize_t getSubSampleInfo(JNIEnv *env, jint numSubSamples,
244 jintArray numBytesOfClearDataObj, jintArray numBytesOfEncryptedDataObj,
245 hidl_vec<SubSample> *outSubSamples) {
246
247 if (numSubSamples <= 0 ||
248 numSubSamples >= (signed)(INT32_MAX / sizeof(SubSample))) {
249 // subSamples array may silently overflow if number of samples are
250 // too large. Use INT32_MAX as maximum allocation size may be less
251 // than SIZE_MAX on some platforms.
252 ALOGE("numSubSamples is invalid!");
253 return -1;
254 }
255
256 jboolean isCopy;
257 ssize_t totalSize = 0;
258
259 jint *numBytesOfClearData =
260 (numBytesOfClearDataObj == NULL)
261 ? NULL
262 : env->GetIntArrayElements(numBytesOfClearDataObj, &isCopy);
263
264 jint *numBytesOfEncryptedData =
265 (numBytesOfEncryptedDataObj == NULL)
266 ? NULL
267 : env->GetIntArrayElements(numBytesOfEncryptedDataObj, &isCopy);
268
269 outSubSamples->resize(numSubSamples);
270 SubSample *subSamples = outSubSamples->data();
271 if (subSamples == NULL) {
272 ALOGE("Failed to allocate SubSample array!");
273 return -1;
274 }
275
276 for (jint i = 0; i < numSubSamples; ++i) {
277 subSamples[i].numBytesOfClearData =
278 (numBytesOfClearData == NULL) ? 0 : numBytesOfClearData[i];
279
280 subSamples[i].numBytesOfEncryptedData =
281 (numBytesOfEncryptedData == NULL)
282 ? 0 : numBytesOfEncryptedData[i];
283
284 totalSize += subSamples[i].numBytesOfClearData +
285 subSamples[i].numBytesOfEncryptedData;
286 }
287
288 if (numBytesOfEncryptedData != NULL) {
289 env->ReleaseIntArrayElements(
290 numBytesOfEncryptedDataObj, numBytesOfEncryptedData, 0);
291 numBytesOfEncryptedData = NULL;
292 }
293
294 if (numBytesOfClearData != NULL) {
295 env->ReleaseIntArrayElements(
296 numBytesOfClearDataObj, numBytesOfClearData, 0);
297 numBytesOfClearData = NULL;
298 }
299
300 if (totalSize < 0) {
301 return -1;
302 }
303
304 return totalSize;
305 }
306
createServiceSpecificException(JNIEnv * env,int serviceSpecificError,const char * msg)307 static jthrowable createServiceSpecificException(
308 JNIEnv *env, int serviceSpecificError, const char *msg) {
309 if (env->ExceptionCheck()) {
310 ALOGW("Discarding pending exception");
311 env->ExceptionDescribe();
312 env->ExceptionClear();
313 }
314
315 ScopedLocalRef<jclass> clazz(
316 env, env->FindClass("android/os/ServiceSpecificException"));
317 CHECK(clazz.get() != NULL);
318
319 const jmethodID ctor = env->GetMethodID(clazz.get(), "<init>", "(ILjava/lang/String;)V");
320 CHECK(ctor != NULL);
321
322 ScopedLocalRef<jstring> msgObj(
323 env, env->NewStringUTF(msg != NULL ?
324 msg : String8::format("Error %#x", serviceSpecificError)));
325
326 return (jthrowable)env->NewObject(
327 clazz.get(), ctor, serviceSpecificError, msgObj.get());
328 }
329
android_media_MediaDescrambler_native_descramble(JNIEnv * env,jobject thiz,jbyte key,jint numSubSamples,jintArray numBytesOfClearDataObj,jintArray numBytesOfEncryptedDataObj,jobject srcBuf,jint srcOffset,jint srcLimit,jobject dstBuf,jint dstOffset,jint dstLimit)330 static jint android_media_MediaDescrambler_native_descramble(
331 JNIEnv *env, jobject thiz, jbyte key, jint numSubSamples,
332 jintArray numBytesOfClearDataObj, jintArray numBytesOfEncryptedDataObj,
333 jobject srcBuf, jint srcOffset, jint srcLimit,
334 jobject dstBuf, jint dstOffset, jint dstLimit) {
335 sp<JDescrambler> descrambler = getDescrambler(env, thiz);
336 if (descrambler == NULL) {
337 jniThrowException(env, "java/lang/IllegalStateException",
338 "Invalid descrambler object!");
339 return -1;
340 }
341
342 hidl_vec<SubSample> subSamples;
343 ssize_t totalLength = getSubSampleInfo(
344 env, numSubSamples, numBytesOfClearDataObj,
345 numBytesOfEncryptedDataObj, &subSamples);
346 if (totalLength < 0) {
347 jniThrowException(env, "java/lang/IllegalArgumentException",
348 "Invalid subsample info!");
349 return -1;
350 }
351
352 void *srcPtr = NULL, *dstPtr = NULL;
353 jbyteArray srcArray = NULL, dstArray = NULL;
354 status_t err = getBufferAndSize(
355 env, srcBuf, srcOffset, srcLimit, totalLength, &srcPtr, &srcArray);
356
357 if (err == OK) {
358 if (dstBuf == NULL) {
359 dstPtr = srcPtr;
360 } else {
361 err = getBufferAndSize(
362 env, dstBuf, dstOffset, dstLimit, totalLength, &dstPtr, &dstArray);
363 }
364 }
365
366 if (err != OK) {
367 jniThrowException(env, "java/lang/IllegalArgumentException",
368 "Invalid buffer offset and/or size for subsamples!");
369 return -1;
370 }
371
372 Status status;
373 uint32_t bytesWritten;
374 hidl_string detailedError;
375
376 err = descrambler->descramble(
377 key, totalLength, subSamples,
378 srcPtr, srcOffset, dstPtr, dstOffset,
379 &status, &bytesWritten, &detailedError);
380
381 // Release byte array before throwing
382 if (srcArray != NULL) {
383 env->ReleaseByteArrayElements(srcArray, (jbyte *)srcPtr, 0);
384 }
385 if (dstArray != NULL) {
386 env->ReleaseByteArrayElements(dstArray, (jbyte *)dstPtr, 0);
387 }
388
389 if (err == NO_MEMORY) {
390 jniThrowException(env, "java/lang/OutOfMemoryError", NULL);
391 } else if (err == FAILED_TRANSACTION) {
392 jniThrowException(env, "android/os/RemoteException", NULL);
393 } else if (status != Status::OK) {
394 // Throw ServiceSpecific with cas error code and detailed msg,
395 // which will be re-thrown as MediaCasStateException.
396 env->Throw(createServiceSpecificException(
397 env, (int) status, detailedError.c_str()));
398 }
399 return bytesWritten;
400 }
401
402 static const JNINativeMethod gMethods[] = {
403 { "native_release", "()V",
404 (void *)android_media_MediaDescrambler_native_release },
405 { "native_init", "()V",
406 (void *)android_media_MediaDescrambler_native_init },
407 { "native_setup", "(Landroid/os/IHwBinder;)V",
408 (void *)android_media_MediaDescrambler_native_setup },
409 { "native_descramble", "(BI[I[ILjava/nio/ByteBuffer;IILjava/nio/ByteBuffer;II)I",
410 (void *)android_media_MediaDescrambler_native_descramble },
411 };
412
register_android_media_Descrambler(JNIEnv * env)413 int register_android_media_Descrambler(JNIEnv *env) {
414 return AndroidRuntime::registerNativeMethods(env,
415 "android/media/MediaDescrambler", gMethods, NELEM(gMethods));
416 }
417
418